ssl/statem/statem_lib.c:1004: error: INTEGER_OVERFLOW_L2
  ([0, +oo] - [`pkt->written`, `pkt->written` + 3]):unsigned64 by call to `ssl_add_cert_chain`.
Showing all 18 steps of the trace


ssl/statem/statem_lib.c:998:10: Call
996.   unsigned long ssl3_output_cert_chain(SSL *s, WPACKET *pkt, CERT_PKEY *cpk)
997.   {
998.       if (!WPACKET_start_sub_packet_u24(pkt)) {
                 ^
999.           SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_SSL3_OUTPUT_CERT_CHAIN,
1000.                    ERR_R_INTERNAL_ERROR);

ssl/packet.c:272:1: Parameter `pkt->buf->length`
  270.   }
  271.   
  272. > int WPACKET_start_sub_packet_len__(WPACKET *pkt, size_t lenbytes)
  273.   {
  274.       WPACKET_SUB *sub;

ssl/statem/statem_lib.c:1004:10: Call
1002.       }
1003.   
1004.       if (!ssl_add_cert_chain(s, pkt, cpk))
                 ^
1005.           return 0;
1006.   

ssl/statem/statem_lib.c:900:1: Parameter `pkt->written`
  898.   
  899.   /* Add certificate chain to provided WPACKET */
  900. > static int ssl_add_cert_chain(SSL *s, WPACKET *pkt, CERT_PKEY *cpk)
  901.   {
  902.       int i, chain_count;

ssl/statem/statem_lib.c:981:14: Call
  979.               return 0;
  980.           }
  981.           if (!ssl_add_cert_to_wpacket(s, pkt, x, 0)) {
                      ^
  982.               /* SSLfatal() already called */
  983.               return 0;

ssl/statem/statem_lib.c:871:1: Parameter `pkt->written`
    869.   
    870.   /* Add a certificate to the WPACKET */
    871. > static int ssl_add_cert_to_wpacket(SSL *s, WPACKET *pkt, X509 *x, int chain)
    872.   {
    873.       int len;

ssl/statem/statem_lib.c:882:10: Call
    880.           return 0;
    881.       }
    882.       if (!WPACKET_sub_allocate_bytes_u24(pkt, len, &outbytes)
                    ^
    883.               || i2d_X509(x, &outbytes) != len) {
    884.           SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_SSL_ADD_CERT_TO_WPACKET,

ssl/packet.c:26:1: Parameter `pkt->written`
      24.   }
      25.   
      26. > int WPACKET_sub_allocate_bytes__(WPACKET *pkt, size_t len,
      27.                                    unsigned char **allocbytes, size_t lenbytes)
      28.   {

ssl/packet.c:29:10: Call
      27.                                    unsigned char **allocbytes, size_t lenbytes)
      28.   {
      29.       if (!WPACKET_start_sub_packet_len__(pkt, lenbytes)
                     ^
      30.               || !WPACKET_allocate_bytes(pkt, len, allocbytes)
      31.               || !WPACKET_close(pkt))

ssl/packet.c:272:1: Parameter `pkt->written`
        270.   }
        271.   
        272. > int WPACKET_start_sub_packet_len__(WPACKET *pkt, size_t lenbytes)
        273.   {
        274.       WPACKET_SUB *sub;

ssl/packet.c:296:10: Call
        294.       }
        295.   
        296.       if (!WPACKET_allocate_bytes(pkt, lenbytes, &lenchars))
                        ^
        297.           return 0;
        298.       /* Convert to an offset in case the underlying BUF_MEM gets realloc'd */

ssl/packet.c:16:1: Parameter `pkt->written`
          14.   #define DEFAULT_BUF_SIZE    256
          15.   
          16. > int WPACKET_allocate_bytes(WPACKET *pkt, size_t len, unsigned char **allocbytes)
          17.   {
          18.       if (!WPACKET_reserve_bytes(pkt, len, allocbytes))

ssl/packet.c:18:10: Call
          16.   int WPACKET_allocate_bytes(WPACKET *pkt, size_t len, unsigned char **allocbytes)
          17.   {
          18.       if (!WPACKET_reserve_bytes(pkt, len, allocbytes))
                         ^
          19.           return 0;
          20.   

ssl/packet.c:40:1: <LHS trace>
38.                        ? (p)->staticbuf : (unsigned char *)(p)->buf->data)
39.   
40. > int WPACKET_reserve_bytes(WPACKET *pkt, size_t len, unsigned char **allocbytes)
41.   {
42.       /* Internal API, so should not fail */

ssl/packet.c:40:1: Parameter `pkt->buf->length`
            38.                        ? (p)->staticbuf : (unsigned char *)(p)->buf->data)
            39.   
            40. > int WPACKET_reserve_bytes(WPACKET *pkt, size_t len, unsigned char **allocbytes)
            41.   {
            42.       /* Internal API, so should not fail */

ssl/packet.c:40:1: <RHS trace>
38.                        ? (p)->staticbuf : (unsigned char *)(p)->buf->data)
39.   
40. > int WPACKET_reserve_bytes(WPACKET *pkt, size_t len, unsigned char **allocbytes)
41.   {
42.       /* Internal API, so should not fail */

ssl/packet.c:40:1: Parameter `len`
            38.                        ? (p)->staticbuf : (unsigned char *)(p)->buf->data)
            39.   
            40. > int WPACKET_reserve_bytes(WPACKET *pkt, size_t len, unsigned char **allocbytes)
            41.   {
            42.       /* Internal API, so should not fail */

ssl/packet.c:49:36: Binary operation: ([0, +oo] - [pkt->written, pkt->written + 3]):unsigned64 by call to `ssl_add_cert_chain` 
            47.           return 0;
            48.   
            49.       if (pkt->staticbuf == NULL && (pkt->buf->length - pkt->written < len)) {
                                                     ^
            50.           size_t newlen;
            51.           size_t reflen;
