ssl/s3_srvr.c:542: error: INTEGER_OVERFLOW_L2
  ([0, +oo] - [0, 4+max(0, `s->init_num`)]):unsigned64 by call to `ssl3_send_certificate_request`.
Showing all 9 steps of the trace


ssl/s3_srvr.c:212:1: Parameter `s->init_num`
210.   #endif
211.   
212. > int ssl3_accept(SSL *s)
213.   {
214.       BUF_MEM *buf;

ssl/s3_srvr.c:542:23: Call
540.               } else {
541.                   s->s3->tmp.cert_request = 1;
542.                   ret = ssl3_send_certificate_request(s);
                             ^
543.                   if (ret <= 0)
544.                       goto end;

ssl/s3_srvr.c:2007:1: Parameter `s->init_num`
  2005.   }
  2006.   
  2007. > int ssl3_send_certificate_request(SSL *s)
  2008.   {
  2009.       unsigned char *p, *d;

ssl/s3_srvr.c:2081:18: Call
  2079.   #ifdef NETSCAPE_HANG_BUG
  2080.           if (!SSL_IS_DTLS(s)) {
  2081.               if (!BUF_MEM_grow_clean(buf, s->init_num + 4)) {
                           ^
  2082.                   SSLerr(SSL_F_SSL3_SEND_CERTIFICATE_REQUEST, ERR_R_BUF_LIB);
  2083.                   goto err;

crypto/buffer/buffer.c:133:1: <LHS trace>
131.   }
132.   
133. > int BUF_MEM_grow_clean(BUF_MEM *str, size_t len)
134.   {
135.       char *ret;

crypto/buffer/buffer.c:133:1: Parameter `len`
    131.   }
    132.   
    133. > int BUF_MEM_grow_clean(BUF_MEM *str, size_t len)
    134.   {
    135.       char *ret;

crypto/buffer/buffer.c:133:1: <RHS trace>
131.   }
132.   
133. > int BUF_MEM_grow_clean(BUF_MEM *str, size_t len)
134.   {
135.       char *ret;

crypto/buffer/buffer.c:133:1: Parameter `len`
    131.   }
    132.   
    133. > int BUF_MEM_grow_clean(BUF_MEM *str, size_t len)
    134.   {
    135.       char *ret;

crypto/buffer/buffer.c:139:9: Binary operation: ([0, +oo] - [0, 4+max(0, s->init_num)]):unsigned64 by call to `ssl3_send_certificate_request` 
    137.   
    138.       if (str->length >= len) {
    139.           memset(&str->data[len], 0, str->length - len);
                   ^
    140.           str->length = len;
    141.           return (len);
