ssl/statem/statem_lib.c:983: error: INTEGER_OVERFLOW_L2
  ([0, +oo] - [`pkt->written`, `pkt->written` + 3]):unsigned64 by call to `ssl_add_cert_chain`.
Showing all 18 steps of the trace


ssl/statem/statem_lib.c:977:10: Call
975.   unsigned long ssl3_output_cert_chain(SSL *s, WPACKET *pkt, CERT_PKEY *cpk)
976.   {
977.       if (!WPACKET_start_sub_packet_u24(pkt)) {
                ^
978.           SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_SSL3_OUTPUT_CERT_CHAIN,
979.                    ERR_R_INTERNAL_ERROR);

ssl/packet.c:270:1: Parameter `pkt->buf->length`
  268.   }
  269.   
  270. > int WPACKET_start_sub_packet_len__(WPACKET *pkt, size_t lenbytes)
  271.   {
  272.       WPACKET_SUB *sub;

ssl/statem/statem_lib.c:983:10: Call
981.       }
982.   
983.       if (!ssl_add_cert_chain(s, pkt, cpk))
                ^
984.           return 0;
985.   

ssl/statem/statem_lib.c:879:1: Parameter `pkt->written`
  877.   
  878.   /* Add certificate chain to provided WPACKET */
  879. > static int ssl_add_cert_chain(SSL *s, WPACKET *pkt, CERT_PKEY *cpk)
  880.   {
  881.       int i, chain_count;

ssl/statem/statem_lib.c:960:14: Call
  958.               return 0;
  959.           }
  960.           if (!ssl_add_cert_to_wpacket(s, pkt, x, 0)) {
                      ^
  961.               /* SSLfatal() already called */
  962.               return 0;

ssl/statem/statem_lib.c:850:1: Parameter `pkt->written`
    848.   
    849.   /* Add a certificate to the WPACKET */
    850. > static int ssl_add_cert_to_wpacket(SSL *s, WPACKET *pkt, X509 *x, int chain)
    851.   {
    852.       int len;

ssl/statem/statem_lib.c:861:10: Call
    859.           return 0;
    860.       }
    861.       if (!WPACKET_sub_allocate_bytes_u24(pkt, len, &outbytes)
                    ^
    862.               || i2d_X509(x, &outbytes) != len) {
    863.           SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_SSL_ADD_CERT_TO_WPACKET,

ssl/packet.c:25:1: Parameter `pkt->written`
      23.   }
      24.   
      25. > int WPACKET_sub_allocate_bytes__(WPACKET *pkt, size_t len,
      26.                                    unsigned char **allocbytes, size_t lenbytes)
      27.   {

ssl/packet.c:28:10: Call
      26.                                    unsigned char **allocbytes, size_t lenbytes)
      27.   {
      28.       if (!WPACKET_start_sub_packet_len__(pkt, lenbytes)
                     ^
      29.               || !WPACKET_allocate_bytes(pkt, len, allocbytes)
      30.               || !WPACKET_close(pkt))

ssl/packet.c:270:1: Parameter `pkt->written`
        268.   }
        269.   
        270. > int WPACKET_start_sub_packet_len__(WPACKET *pkt, size_t lenbytes)
        271.   {
        272.       WPACKET_SUB *sub;

ssl/packet.c:293:10: Call
        291.       }
        292.   
        293.       if (!WPACKET_allocate_bytes(pkt, lenbytes, &lenchars))
                        ^
        294.           return 0;
        295.       /* Convert to an offset in case the underlying BUF_MEM gets realloc'd */

ssl/packet.c:15:1: Parameter `pkt->written`
          13.   #define DEFAULT_BUF_SIZE    256
          14.   
          15. > int WPACKET_allocate_bytes(WPACKET *pkt, size_t len, unsigned char **allocbytes)
          16.   {
          17.       if (!WPACKET_reserve_bytes(pkt, len, allocbytes))

ssl/packet.c:17:10: Call
          15.   int WPACKET_allocate_bytes(WPACKET *pkt, size_t len, unsigned char **allocbytes)
          16.   {
          17.       if (!WPACKET_reserve_bytes(pkt, len, allocbytes))
                         ^
          18.           return 0;
          19.   

ssl/packet.c:39:1: <LHS trace>
37.                        ? (p)->staticbuf : (unsigned char *)(p)->buf->data)
38.   
39. > int WPACKET_reserve_bytes(WPACKET *pkt, size_t len, unsigned char **allocbytes)
40.   {
41.       /* Internal API, so should not fail */

ssl/packet.c:39:1: Parameter `pkt->buf->length`
            37.                        ? (p)->staticbuf : (unsigned char *)(p)->buf->data)
            38.   
            39. > int WPACKET_reserve_bytes(WPACKET *pkt, size_t len, unsigned char **allocbytes)
            40.   {
            41.       /* Internal API, so should not fail */

ssl/packet.c:39:1: <RHS trace>
37.                        ? (p)->staticbuf : (unsigned char *)(p)->buf->data)
38.   
39. > int WPACKET_reserve_bytes(WPACKET *pkt, size_t len, unsigned char **allocbytes)
40.   {
41.       /* Internal API, so should not fail */

ssl/packet.c:39:1: Parameter `len`
            37.                        ? (p)->staticbuf : (unsigned char *)(p)->buf->data)
            38.   
            39. > int WPACKET_reserve_bytes(WPACKET *pkt, size_t len, unsigned char **allocbytes)
            40.   {
            41.       /* Internal API, so should not fail */

ssl/packet.c:48:36: Binary operation: ([0, +oo] - [pkt->written, pkt->written + 3]):unsigned64 by call to `ssl_add_cert_chain` 
            46.           return 0;
            47.   
            48.       if (pkt->staticbuf == NULL && (pkt->buf->length - pkt->written < len)) {
                                                     ^
            49.           size_t newlen;
            50.           size_t reflen;
