ssl/statem/statem.c:786: error: INTEGER_OVERFLOW_L2
  ([0, +oo] - 1):unsigned32 by call to `statem_do_write`.
Showing all 13 steps of the trace


ssl/statem/statem.c:716:1: Parameter `s->rlayer.numwpipes`
714.    * result in an NBIO event.
715.    */
716. > static SUB_STATE_RETURN write_state_machine(SSL *s)
717.   {
718.       OSSL_STATEM *st = &s->statem;

ssl/statem/statem.c:786:19: Call
784.                   dtls1_start_timer(s);
785.               }
786.               ret = statem_do_write(s);
                         ^
787.               if (ret <= 0) {
788.                   return SUB_STATE_ERROR;

ssl/statem/statem.c:660:1: Parameter `s->rlayer.numwpipes`
  658.    * Send a previously constructed message to the peer.
  659.    */
  660. > static int statem_do_write(SSL *s)
  661.   {
  662.       OSSL_STATEM *st = &s->statem;

ssl/statem/statem.c:667:20: Call
  665.               || st->hand_state == TLS_ST_SW_CHANGE) {
  666.           if (SSL_IS_DTLS(s))
  667.               return dtls1_do_write(s, SSL3_RT_CHANGE_CIPHER_SPEC);
                            ^
  668.           else
  669.               return ssl3_do_write(s, SSL3_RT_CHANGE_CIPHER_SPEC);

ssl/statem/statem_dtls.c:217:1: Parameter `s->rlayer.numwpipes`
    215.    * SSL3_RT_CHANGE_CIPHER_SPEC)
    216.    */
    217. > int dtls1_do_write(SSL *s, int type)
    218.   {
    219.       int ret;

ssl/statem/statem_dtls.c:346:15: Call
    344.           }
    345.   
    346.           ret = dtls1_write_bytes(s, type, &s->init_buf->data[s->init_off],
                         ^
    347.                                   len);
    348.           if (ret < 0) {

ssl/record/rec_layer_d1.c:1021:1: Parameter `s->rlayer.numwpipes`
      1019.    * not all data has been sent or non-blocking IO.
      1020.    */
      1021. > int dtls1_write_bytes(SSL *s, int type, const void *buf, int len)
      1022.   {
      1023.       int i;

ssl/record/rec_layer_d1.c:1027:9: Call
      1025.       OPENSSL_assert(len <= SSL3_RT_MAX_PLAIN_LENGTH);
      1026.       s->rwstate = SSL_NOTHING;
      1027.       i = do_dtls1_write(s, type, buf, len, 0);
                      ^
      1028.       return i;
      1029.   }

ssl/record/rec_layer_d1.c:1031:1: Parameter `s->rlayer.numwpipes`
        1029.   }
        1030.   
        1031. > int do_dtls1_write(SSL *s, int type, const unsigned char *buf,
        1032.                      unsigned int len, int create_empty_fragment)
        1033.   {

ssl/record/rec_layer_d1.c:1050:17: Call
        1048.       if (SSL3_BUFFER_get_left(wb) != 0) {
        1049.           OPENSSL_assert(0);      /* XDTLS: want to see if we ever get here */
        1050.           return (ssl3_write_pending(s, type, buf, len));
                                ^
        1051.       }
        1052.   

ssl/record/rec_layer_s3.c:999:1: <LHS trace>
997.   
998.   /* if s->s3->wbuf.left != 0, we need to call this */
999. > int ssl3_write_pending(SSL *s, int type, const unsigned char *buf,
1000.                          unsigned int len)
1001.   {

ssl/record/rec_layer_s3.c:999:1: Parameter `s->rlayer.numwpipes`
          997.   
          998.   /* if s->s3->wbuf.left != 0, we need to call this */
          999. > int ssl3_write_pending(SSL *s, int type, const unsigned char *buf,
          1000.                          unsigned int len)
          1001.   {

ssl/record/rec_layer_s3.c:1018:20: Binary operation: ([0, +oo] - 1):unsigned32 by call to `statem_do_write` 
          1016.           /* Loop until we find a buffer we haven't written out yet */
          1017.           if (SSL3_BUFFER_get_left(&wb[currbuf]) == 0
          1018.                   && currbuf < s->rlayer.numwpipes - 1) {
                                     ^
          1019.               currbuf++;
          1020.               continue;
