ssl/s3_clnt.c:402: error: INTEGER_OVERFLOW_L2
  ([0, +oo] - 10):unsigned64 by call to `ssl3_send_client_certificate`.
Showing all 13 steps of the trace


ssl/s3_clnt.c:182:1: Parameter `s->init_buf->length`
180.                            ssl3_connect, ssl3_get_client_method)
181.   #endif
182. > int ssl3_connect(SSL *s)
183.   {
184.       BUF_MEM *buf = NULL;

ssl/s3_clnt.c:402:19: Call
400.           case SSL3_ST_CW_CERT_C:
401.           case SSL3_ST_CW_CERT_D:
402.               ret = ssl3_send_client_certificate(s);
                         ^
403.               if (ret <= 0)
404.                   goto end;

ssl/s3_clnt.c:3257:1: Parameter `s->init_buf->length`
  3255.   }
  3256.   
  3257. > int ssl3_send_client_certificate(SSL *s)
  3258.   {
  3259.       X509 *x509 = NULL;

ssl/s3_clnt.c:3328:14: Call
  3326.       if (s->state == SSL3_ST_CW_CERT_C) {
  3327.           s->state = SSL3_ST_CW_CERT_D;
  3328.           if (!ssl3_output_cert_chain(s,
                       ^
  3329.                                       (s->s3->tmp.cert_req ==
  3330.                                        2) ? NULL : s->cert->key)) {

ssl/s3_both.c:315:1: Parameter `s->init_buf->length`
    313.   }
    314.   
    315. > unsigned long ssl3_output_cert_chain(SSL *s, CERT_PKEY *cpk)
    316.   {
    317.       unsigned char *p;

ssl/s3_both.c:320:10: Call
    318.       unsigned long l = 3 + SSL_HM_HEADER_LENGTH(s);
    319.   
    320.       if (!ssl_add_cert_chain(s, cpk, &l))
                    ^
    321.           return 0;
    322.   

ssl/ssl_cert.c:1066:1: Parameter `s->init_buf->length`
      1064.   
      1065.   /* Add certificate chain to internal SSL BUF_MEM strcuture */
      1066. > int ssl_add_cert_chain(SSL *s, CERT_PKEY *cpk, unsigned long *l)
      1067.   {
      1068.       BUF_MEM *buf = s->init_buf;

ssl/ssl_cert.c:1076:10: Call
      1074.   
      1075.       /* TLSv1 sends a chain with nothing in it, instead of an alert */
      1076.       if (!BUF_MEM_grow_clean(buf, 10)) {
                       ^
      1077.           SSLerr(SSL_F_SSL_ADD_CERT_CHAIN, ERR_R_BUF_LIB);
      1078.           return 0;

crypto/buffer/buffer.c:133:1: <LHS trace>
131.   }
132.   
133. > int BUF_MEM_grow_clean(BUF_MEM *str, size_t len)
134.   {
135.       char *ret;

crypto/buffer/buffer.c:133:1: Parameter `len`
        131.   }
        132.   
        133. > int BUF_MEM_grow_clean(BUF_MEM *str, size_t len)
        134.   {
        135.       char *ret;

crypto/buffer/buffer.c:133:1: <RHS trace>
131.   }
132.   
133. > int BUF_MEM_grow_clean(BUF_MEM *str, size_t len)
134.   {
135.       char *ret;

crypto/buffer/buffer.c:133:1: Parameter `len`
        131.   }
        132.   
        133. > int BUF_MEM_grow_clean(BUF_MEM *str, size_t len)
        134.   {
        135.       char *ret;

crypto/buffer/buffer.c:139:9: Binary operation: ([0, +oo] - 10):unsigned64 by call to `ssl3_send_client_certificate` 
        137.   
        138.       if (str->length >= len) {
        139.           memset(&str->data[len], 0, str->length - len);
                       ^
        140.           str->length = len;
        141.           return (len);
