ssl/record/rec_layer_s3.c:938: error: INTEGER_OVERFLOW_L2
  ([0, +oo] - [0, 2]):unsigned64 by call to `WPACKET_close`.
Showing all 10 steps of the trace


ssl/record/rec_layer_s3.c:726:14: Call
724.   #endif
725.           SSL3_BUFFER_set_offset(wb, align);
726.           if (!WPACKET_init_static_len(&pkt[0], SSL3_BUFFER_get_buf(wb),
                    ^
727.                                        SSL3_BUFFER_get_len(wb), 0)
728.                   || !WPACKET_allocate_bytes(&pkt[0], align, NULL)) {

ssl/packet.c:117:1: Parameter `pkt->curr`
  115.   }
  116.   
  117. > int WPACKET_init_static_len(WPACKET *pkt, unsigned char *buf, size_t len,
  118.                               size_t lenbytes)
  119.   {

ssl/record/rec_layer_s3.c:938:21: Call
936.   
937.           if (!WPACKET_get_length(thispkt, &len)
938.                   || !WPACKET_close(thispkt)) {
                           ^
939.               SSLerr(SSL_F_DO_SSL3_WRITE, ERR_R_INTERNAL_ERROR);
940.               goto err;

ssl/packet.c:245:1: Parameter `pkt->curr`
  243.   }
  244.   
  245. > int WPACKET_close(WPACKET *pkt)
  246.   {
  247.       /*

ssl/packet.c:254:12: Call
  252.           return 0;
  253.   
  254.       return wpacket_intern_close(pkt, pkt->subs, 1);
                    ^
  255.   }
  256.   

ssl/packet.c:188:1: <LHS trace>
186.    * (i.e. it fills in all the lengths), but doesn't actually close anything.
187.    */
188. > static int wpacket_intern_close(WPACKET *pkt, WPACKET_SUB *sub, int doclose)
189.   {
190.       size_t packlen = pkt->written - sub->pwritten;

ssl/packet.c:188:1: Parameter `pkt->curr`
    186.    * (i.e. it fills in all the lengths), but doesn't actually close anything.
    187.    */
    188. > static int wpacket_intern_close(WPACKET *pkt, WPACKET_SUB *sub, int doclose)
    189.   {
    190.       size_t packlen = pkt->written - sub->pwritten;

ssl/packet.c:188:1: <RHS trace>
186.    * (i.e. it fills in all the lengths), but doesn't actually close anything.
187.    */
188. > static int wpacket_intern_close(WPACKET *pkt, WPACKET_SUB *sub, int doclose)
189.   {
190.       size_t packlen = pkt->written - sub->pwritten;

ssl/packet.c:188:1: Parameter `sub->lenbytes`
    186.    * (i.e. it fills in all the lengths), but doesn't actually close anything.
    187.    */
    188. > static int wpacket_intern_close(WPACKET *pkt, WPACKET_SUB *sub, int doclose)
    189.   {
    190.       size_t packlen = pkt->written - sub->pwritten;

ssl/packet.c:203:13: Binary operation: ([0, +oo] - [0, 2]):unsigned64 by call to `WPACKET_close` 
    201.   
    202.           /* Deallocate any bytes allocated for the length of the WPACKET */
    203.           if ((pkt->curr - sub->lenbytes) == sub->packet_len) {
                       ^
    204.               pkt->written -= sub->lenbytes;
    205.               pkt->curr -= sub->lenbytes;
