ssl/s3_clnt.c:1093: error: INTEGER_OVERFLOW_L2
  ([0, +oo] - 2):unsigned64 by call to `PACKET_get_bytes`.
Showing all 18 steps of the trace


ssl/s3_clnt.c:974:10: Call
972.       }
973.   
974.       if (!PACKET_buf_init(&pkt, s->init_msg, n)) {
                ^
975.           al = SSL_AD_INTERNAL_ERROR;
976.           SSLerr(SSL_F_SSL3_GET_SERVER_HELLO, ERR_R_INTERNAL_ERROR);

ssl/packet_locl.h:109:1: Parameter `pkt->remaining`
  107.    * is being used.
  108.    */
  109. > static inline int PACKET_buf_init(PACKET *pkt, unsigned char *buf, size_t len)
  110.   {
  111.       /* Sanity check for negative values. */

ssl/s3_clnt.c:983:14: Call
981.           unsigned int sversion;
982.   
983.           if (!PACKET_get_net_2(&pkt, &sversion)) {
                    ^
984.               al = SSL_AD_DECODE_ERROR;
985.               SSLerr(SSL_F_SSL3_GET_SERVER_HELLO, SSL_R_LENGTH_MISMATCH);

ssl/packet_locl.h:169:8: Parameter `pkt->remaining`
  167.   /* Equivalent of n2s */
  168.   /* Get 2 bytes in network order from |pkt| and store the value in |*data| */
  169.   __owur static inline int PACKET_get_net_2(PACKET *pkt, unsigned int *data)
                ^
  170.   {
  171.       if (!PACKET_peek_net_2(pkt, data))

ssl/packet_locl.h:171:10: Call
  169.   __owur static inline int PACKET_get_net_2(PACKET *pkt, unsigned int *data)
  170.   {
  171.       if (!PACKET_peek_net_2(pkt, data))
                  ^
  172.           return 0;
  173.   

ssl/packet_locl.h:155:8: Parameter `pkt->remaining`
    153.    * |*data|
    154.    */
    155.   __owur static inline int PACKET_peek_net_2(const PACKET *pkt,
                  ^
    156.                                              unsigned int *data)
    157.   {

ssl/s3_clnt.c:1071:10: Call
1069.       /* load the server hello data */
1070.       /* load the server random */
1071.       if (!PACKET_copy_bytes(&pkt, s->s3->server_random, SSL3_RANDOM_SIZE)) {
                 ^
1072.           al = SSL_AD_DECODE_ERROR;
1073.           SSLerr(SSL_F_SSL3_GET_SERVER_HELLO, SSL_R_LENGTH_MISMATCH);

ssl/packet_locl.h:340:8: Parameter `pkt->remaining`
  338.    * The caller is responsible for ensuring that |data| can hold |len| bytes.
  339.    */
  340.   __owur static inline int PACKET_copy_bytes(PACKET *pkt, unsigned char *data,
                ^
  341.                                              size_t len)
  342.   {

ssl/packet_locl.h:343:10: Call
  341.                                              size_t len)
  342.   {
  343.       if (!PACKET_peek_copy_bytes(pkt, data, len))
                  ^
  344.           return 0;
  345.   

ssl/packet_locl.h:325:8: Parameter `len`
    323.   
    324.   /* Peek ahead at |len| bytes from |pkt| and copy them to |data| */
    325.   __owur static inline int PACKET_peek_copy_bytes(const PACKET *pkt,
                  ^
    326.                                                   unsigned char *data, size_t len)
    327.   {

ssl/s3_clnt.c:1093:10: Call
1091.       }
1092.   
1093.       if (!PACKET_get_bytes(&pkt, &cipherchars, TLS_CIPHER_LEN)) {
                 ^
1094.           SSLerr(SSL_F_SSL3_GET_SERVER_HELLO, SSL_R_LENGTH_MISMATCH);
1095.           al = SSL_AD_DECODE_ERROR;

ssl/packet_locl.h:313:8: Parameter `len`
  311.    * freed
  312.    */
  313.   __owur static inline int PACKET_get_bytes(PACKET *pkt, unsigned char **data,
                ^
  314.                                             size_t len)
  315.   {

ssl/packet_locl.h:319:5: Call
  317.           return 0;
  318.   
  319.       packet_forward(pkt, len);
             ^
  320.   
  321.       return 1;

ssl/packet_locl.h:79:1: <LHS trace>
77.   
78.   /* Internal unchecked shorthand; don't use outside this file. */
79. > static inline void packet_forward(PACKET *pkt, size_t len)
80.   {
81.       pkt->curr += len;

ssl/packet_locl.h:79:1: Parameter `pkt->remaining`
    77.   
    78.   /* Internal unchecked shorthand; don't use outside this file. */
    79. > static inline void packet_forward(PACKET *pkt, size_t len)
    80.   {
    81.       pkt->curr += len;

ssl/packet_locl.h:79:1: <RHS trace>
77.   
78.   /* Internal unchecked shorthand; don't use outside this file. */
79. > static inline void packet_forward(PACKET *pkt, size_t len)
80.   {
81.       pkt->curr += len;

ssl/packet_locl.h:79:1: Parameter `len`
    77.   
    78.   /* Internal unchecked shorthand; don't use outside this file. */
    79. > static inline void packet_forward(PACKET *pkt, size_t len)
    80.   {
    81.       pkt->curr += len;

ssl/packet_locl.h:82:5: Binary operation: ([0, +oo] - 2):unsigned64 by call to `PACKET_get_bytes` 
    80.   {
    81.       pkt->curr += len;
    82.       pkt->remaining -= len;
              ^
    83.   }
    84.   
