ssl/record/ssl3_record.c:1314: error: INTEGER_OVERFLOW_L2
  ([0, 297426485248] + [`s->rlayer.rrec.length` - 17728, min(17728, `s->rlayer.rrec.length`)]):unsigned32 by call to `ssl3_cbc_copy_mac`.
Showing all 10 steps of the trace


ssl/record/ssl3_record.c:1218:1: Parameter `s->rlayer.rrec.length`
1216.   }
1217.   
1218. > int dtls1_process_record(SSL *s)
1219.   {
1220.       int i, al;

ssl/record/ssl3_record.c:1314:13: Call
1312.                */
1313.               mac = mac_tmp;
1314.               ssl3_cbc_copy_mac(mac_tmp, rr, mac_size);
                    ^
1315.               rr->length -= mac_size;
1316.           } else {

ssl/record/ssl3_record.c:1141:1: <LHS trace>
1139.   #define CBC_MAC_ROTATE_IN_PLACE
1140.   
1141. > void ssl3_cbc_copy_mac(unsigned char *out,
1142.                          const SSL3_RECORD *rec, unsigned md_size)
1143.   {

ssl/record/ssl3_record.c:1141:1: Parameter `md_size`
  1139.   #define CBC_MAC_ROTATE_IN_PLACE
  1140.   
  1141. > void ssl3_cbc_copy_mac(unsigned char *out,
  1142.                          const SSL3_RECORD *rec, unsigned md_size)
  1143.   {

ssl/record/ssl3_record.c:1183:5: Assignment
  1181.        * prove that md_size is always even, which I hope is beyond it.
  1182.        */
  1183.       div_spoiler = md_size >> 1;
              ^
  1184.       div_spoiler <<= (sizeof(div_spoiler) - 1) * 8;
  1185.       rotate_offset = (div_spoiler + mac_start - scan_start) % md_size;

ssl/record/ssl3_record.c:1184:5: Assignment
  1182.        */
  1183.       div_spoiler = md_size >> 1;
  1184.       div_spoiler <<= (sizeof(div_spoiler) - 1) * 8;
              ^
  1185.       rotate_offset = (div_spoiler + mac_start - scan_start) % md_size;
  1186.   

ssl/record/ssl3_record.c:1141:1: <RHS trace>
1139.   #define CBC_MAC_ROTATE_IN_PLACE
1140.   
1141. > void ssl3_cbc_copy_mac(unsigned char *out,
1142.                          const SSL3_RECORD *rec, unsigned md_size)
1143.   {

ssl/record/ssl3_record.c:1141:1: Parameter `md_size`
  1139.   #define CBC_MAC_ROTATE_IN_PLACE
  1140.   
  1141. > void ssl3_cbc_copy_mac(unsigned char *out,
  1142.                          const SSL3_RECORD *rec, unsigned md_size)
  1143.   {

ssl/record/ssl3_record.c:1155:5: Assignment
  1153.        */
  1154.       unsigned mac_end = rec->length;
  1155.       unsigned mac_start = mac_end - md_size;
              ^
  1156.       /*
  1157.        * scan_start contains the number of bytes that we can ignore because the

ssl/record/ssl3_record.c:1185:5: Binary operation: ([0, 297426485248] + [s->rlayer.rrec.length - 17728, min(17728, s->rlayer.rrec.length)]):unsigned32 by call to `ssl3_cbc_copy_mac` 
  1183.       div_spoiler = md_size >> 1;
  1184.       div_spoiler <<= (sizeof(div_spoiler) - 1) * 8;
  1185.       rotate_offset = (div_spoiler + mac_start - scan_start) % md_size;
              ^
  1186.   
  1187.       memset(rotated_mac, 0, md_size);
