ssl/statem/statem_lib.c:279: error: INTEGER_OVERFLOW_L2
  ([0, +oo] - [`pkt->written`, `pkt->written` + 3]):unsigned64 by call to `ssl_add_cert_chain`.
Showing all 18 steps of the trace


ssl/statem/statem_lib.c:278:10: Call
276.   unsigned long ssl3_output_cert_chain(SSL *s, WPACKET *pkt, CERT_PKEY *cpk)
277.   {
278.       if (!WPACKET_start_sub_packet_u24(pkt)
                ^
279.               || !ssl_add_cert_chain(s, pkt, cpk)
280.               || !WPACKET_close(pkt)) {

ssl/packet.c:224:1: Parameter `pkt->buf->length`
  222.   }
  223.   
  224. > int WPACKET_start_sub_packet_len__(WPACKET *pkt, size_t lenbytes)
  225.   {
  226.       WPACKET_SUB *sub;

ssl/statem/statem_lib.c:279:17: Call
277.   {
278.       if (!WPACKET_start_sub_packet_u24(pkt)
279.               || !ssl_add_cert_chain(s, pkt, cpk)
                       ^
280.               || !WPACKET_close(pkt)) {
281.           SSLerr(SSL_F_SSL3_OUTPUT_CERT_CHAIN, ERR_R_INTERNAL_ERROR);

ssl/ssl_cert.c:764:1: Parameter `pkt->written`
  762.   
  763.   /* Add certificate chain to internal SSL BUF_MEM structure */
  764. > int ssl_add_cert_chain(SSL *s, WPACKET *pkt, CERT_PKEY *cpk)
  765.   {
  766.       int i, chain_count;

ssl/ssl_cert.c:842:14: Call
  840.               return 0;
  841.           }
  842.           if (!ssl_add_cert_to_buf(pkt, x))
                      ^
  843.               return 0;
  844.           for (i = 0; i < sk_X509_num(extra_certs); i++) {

ssl/ssl_cert.c:744:1: Parameter `pkt->written`
    742.   
    743.   /* Add a certificate to the WPACKET */
    744. > static int ssl_add_cert_to_buf(WPACKET *pkt, X509 *x)
    745.   {
    746.       int len;

ssl/ssl_cert.c:754:10: Call
    752.           return 0;
    753.       }
    754.       if (!WPACKET_sub_allocate_bytes_u24(pkt, len, &outbytes)
                    ^
    755.               || i2d_X509(x, &outbytes) != len) {
    756.           SSLerr(SSL_F_SSL_ADD_CERT_TO_BUF, ERR_R_INTERNAL_ERROR);

ssl/packet.c:25:1: Parameter `pkt->written`
      23.   }
      24.   
      25. > int WPACKET_sub_allocate_bytes__(WPACKET *pkt, size_t len,
      26.                                    unsigned char **allocbytes, size_t lenbytes)
      27.   {

ssl/packet.c:28:10: Call
      26.                                    unsigned char **allocbytes, size_t lenbytes)
      27.   {
      28.       if (!WPACKET_start_sub_packet_len__(pkt, lenbytes)
                     ^
      29.               || !WPACKET_allocate_bytes(pkt, len, allocbytes)
      30.               || !WPACKET_close(pkt))

ssl/packet.c:224:1: Parameter `pkt->written`
        222.   }
        223.   
        224. > int WPACKET_start_sub_packet_len__(WPACKET *pkt, size_t lenbytes)
        225.   {
        226.       WPACKET_SUB *sub;

ssl/packet.c:248:10: Call
        246.       }
        247.   
        248.       if (!WPACKET_allocate_bytes(pkt, lenbytes, &lenchars))
                        ^
        249.           return 0;
        250.       /* Convert to an offset in case the underlying BUF_MEM gets realloc'd */

ssl/packet.c:15:1: Parameter `pkt->written`
          13.   #define DEFAULT_BUF_SIZE    256
          14.   
          15. > int WPACKET_allocate_bytes(WPACKET *pkt, size_t len, unsigned char **allocbytes)
          16.   {
          17.       if (!WPACKET_reserve_bytes(pkt, len, allocbytes))

ssl/packet.c:17:10: Call
          15.   int WPACKET_allocate_bytes(WPACKET *pkt, size_t len, unsigned char **allocbytes)
          16.   {
          17.       if (!WPACKET_reserve_bytes(pkt, len, allocbytes))
                         ^
          18.           return 0;
          19.   

ssl/packet.c:36:1: <LHS trace>
34.   }
35.   
36. > int WPACKET_reserve_bytes(WPACKET *pkt, size_t len, unsigned char **allocbytes)
37.   {
38.       /* Internal API, so should not fail */

ssl/packet.c:36:1: Parameter `pkt->buf->length`
            34.   }
            35.   
            36. > int WPACKET_reserve_bytes(WPACKET *pkt, size_t len, unsigned char **allocbytes)
            37.   {
            38.       /* Internal API, so should not fail */

ssl/packet.c:36:1: <RHS trace>
34.   }
35.   
36. > int WPACKET_reserve_bytes(WPACKET *pkt, size_t len, unsigned char **allocbytes)
37.   {
38.       /* Internal API, so should not fail */

ssl/packet.c:36:1: Parameter `len`
            34.   }
            35.   
            36. > int WPACKET_reserve_bytes(WPACKET *pkt, size_t len, unsigned char **allocbytes)
            37.   {
            38.       /* Internal API, so should not fail */

ssl/packet.c:46:9: Binary operation: ([0, +oo] - [pkt->written, pkt->written + 3]):unsigned64 by call to `ssl_add_cert_chain` 
            44.           return 0;
            45.   
            46.       if (pkt->buf->length - pkt->written < len) {
                          ^
            47.           size_t newlen;
            48.           size_t reflen;
