ssl/statem/statem.c:559: error: INTEGER_OVERFLOW_L2
  ([0, +oo] - [`s->rlayer.rrec[*].length` + 4, `s->rlayer.rrec[*].length` + 4]):unsigned64 by call to `tls_get_message_header`.
Showing all 9 steps of the trace


ssl/statem/statem.c:518:1: Parameter `s->rlayer.rrec[*].length`
516.    * will resume in the same state where we left off.
517.    */
518. > static SUB_STATE_RETURN read_state_machine(SSL *s) {
519.       OSSL_STATEM *st = &s->statem;
520.       int ret, mt;

ssl/statem/statem.c:559:23: Call
557.                   ret = dtls_get_message(s, &mt, &len);
558.               } else {
559.                   ret = tls_get_message_header(s, &mt);
                             ^
560.               }
561.   

ssl/statem/statem_lib.c:439:1: Parameter `s->init_buf->length`
  437.   }
  438.   
  439. > int tls_get_message_header(SSL *s, int *mt)
  440.   {
  441.       /* s->init_num < SSL3_HM_HEADER_LENGTH */

ssl/statem/statem_lib.c:504:19: Call
  502.           l = RECORD_LAYER_get_rrec_length(&s->rlayer)
  503.               + SSL3_HM_HEADER_LENGTH;
  504.           if (l && !BUF_MEM_grow_clean(s->init_buf, (int)l)) {
                           ^
  505.               SSLerr(SSL_F_TLS_GET_MESSAGE_HEADER, ERR_R_BUF_LIB);
  506.               goto err;

crypto/buffer/buffer.c:157:1: <LHS trace>
155.   }
156.   
157. > size_t BUF_MEM_grow_clean(BUF_MEM *str, size_t len)
158.   {
159.       char *ret;

crypto/buffer/buffer.c:157:1: Parameter `len`
    155.   }
    156.   
    157. > size_t BUF_MEM_grow_clean(BUF_MEM *str, size_t len)
    158.   {
    159.       char *ret;

crypto/buffer/buffer.c:157:1: <RHS trace>
155.   }
156.   
157. > size_t BUF_MEM_grow_clean(BUF_MEM *str, size_t len)
158.   {
159.       char *ret;

crypto/buffer/buffer.c:157:1: Parameter `len`
    155.   }
    156.   
    157. > size_t BUF_MEM_grow_clean(BUF_MEM *str, size_t len)
    158.   {
    159.       char *ret;

crypto/buffer/buffer.c:163:9: Binary operation: ([0, +oo] - [s->rlayer.rrec[*].length + 4, s->rlayer.rrec[*].length + 4]):unsigned64 by call to `tls_get_message_header` 
    161.   
    162.       if (str->length >= len) {
    163.           memset(&str->data[len], 0, str->length - len);
                   ^
    164.           str->length = len;
    165.           return (len);
