ssl/record/rec_layer_d1.c:397: error: INTEGER_OVERFLOW_L2
  ([0, max(1, `s->rlayer.numwpipes`)] - 1):unsigned32 by call to `dtls1_read_failed`.
Showing all 25 steps of the trace


ssl/record/rec_layer_d1.c:298:1: Parameter `s->rlayer.numwpipes`
296.    *             none of our business
297.    */
298. > int dtls1_read_bytes(SSL *s, int type, int *recvd_type, unsigned char *buf,
299.                        int len, int peek)
300.   {

ssl/record/rec_layer_d1.c:389:9: Call
387.   
388.       /* Check for timeout */
389.       if (dtls1_handle_timeout(s) > 0)
               ^
390.           goto start;
391.   

ssl/d1_lib.c:353:1: Parameter `s->rlayer.numwpipes`
  351.   }
  352.   
  353. > int dtls1_handle_timeout(SSL *s)
  354.   {
  355.       /* if no timer is expired, don't do anything */

ssl/record/rec_layer_d1.c:395:15: Call
393.       if ((SSL3_RECORD_get_length(rr) == 0)
394.               || (s->rlayer.rstate == SSL_ST_READ_BODY)) {
395.           ret = dtls1_get_record(s);
                     ^
396.           if (ret <= 0) {
397.               ret = dtls1_read_failed(s, ret);

ssl/record/ssl3_record.c:1449:1: Parameter `s->rlayer.numwpipes`
  1447.    */
  1448.   /* used only by dtls1_read_bytes */
  1449. > int dtls1_get_record(SSL *s)
  1450.   {
  1451.       int ssl_major, ssl_minor;

ssl/record/ssl3_record.c:1465:9: Call
  1463.        * This is a non-blocking operation.
  1464.        */
  1465.       if (dtls1_process_buffered_records(s) < 0)
                  ^
  1466.           return -1;
  1467.   

ssl/record/rec_layer_d1.c:237:1: Parameter `s->rlayer.numwpipes`
    235.   
    236.   
    237. > int dtls1_process_buffered_records(SSL *s)
    238.   {
    239.       pitem *item;

ssl/record/rec_layer_d1.c:397:19: Call
395.           ret = dtls1_get_record(s);
396.           if (ret <= 0) {
397.               ret = dtls1_read_failed(s, ret);
                         ^
398.               /* anything other than a timeout is an error */
399.               if (ret <= 0)

ssl/statem/statem_dtls.c:918:1: Parameter `s->rlayer.numwpipes`
  916.   #endif
  917.   
  918. > int dtls1_read_failed(SSL *s, int code)
  919.   {
  920.       if (code > 0) {

ssl/statem/statem_dtls.c:944:12: Call
  942.       }
  943.   
  944.       return dtls1_handle_timeout(s);
                    ^
  945.   }
  946.   

ssl/d1_lib.c:353:1: Parameter `s->rlayer.numwpipes`
    351.   }
    352.   
    353. > int dtls1_handle_timeout(SSL *s)
    354.   {
    355.       /* if no timer is expired, don't do anything */

ssl/d1_lib.c:377:12: Call
    375.   
    376.       dtls1_start_timer(s);
    377.       return dtls1_retransmit_buffered_messages(s);
                      ^
    378.   }
    379.   

ssl/statem/statem_dtls.c:962:1: Parameter `s->rlayer.numwpipes`
      960.   }
      961.   
      962. > int dtls1_retransmit_buffered_messages(SSL *s)
      963.   {
      964.       pqueue *sent = s->d1->sent_messages;

ssl/statem/statem_dtls.c:974:13: Call
      972.       for (item = pqueue_next(&iter); item != NULL; item = pqueue_next(&iter)) {
      973.           frag = (hm_fragment *)item->data;
      974.           if (dtls1_retransmit_message(s, (unsigned short)
                         ^
      975.                                        dtls1_get_queue_priority
      976.                                        (frag->msg_header.seq,

ssl/statem/statem_dtls.c:1050:1: Parameter `s->rlayer.numwpipes`
        1048.   }
        1049.   
        1050. > int
        1051.   dtls1_retransmit_message(SSL *s, unsigned short seq, int *found)
        1052.   {

ssl/statem/statem_dtls.c:1112:11: Call
        1110.           frag->msg_header.saved_retransmit_state.epoch);
        1111.   
        1112.       ret = dtls1_do_write(s, frag->msg_header.is_ccs ?
                          ^
        1113.                            SSL3_RT_CHANGE_CIPHER_SPEC : SSL3_RT_HANDSHAKE);
        1114.   

ssl/statem/statem_dtls.c:112:1: Parameter `s->rlayer.numwpipes`
          110.    * SSL3_RT_CHANGE_CIPHER_SPEC)
          111.    */
          112. > int dtls1_do_write(SSL *s, int type)
          113.   {
          114.       int ret;

ssl/statem/statem_dtls.c:242:15: Call
          240.           }
          241.   
          242.           ret = dtls1_write_bytes(s, type, &s->init_buf->data[s->init_off],
                               ^
          243.                                   len);
          244.           if (ret < 0) {

ssl/record/rec_layer_d1.c:916:1: Parameter `s->rlayer.numwpipes`
            914.    * not all data has been sent or non-blocking IO.
            915.    */
            916. > int dtls1_write_bytes(SSL *s, int type, const void *buf, int len)
            917.   {
            918.       int i;

ssl/record/rec_layer_d1.c:922:9: Call
            920.       OPENSSL_assert(len <= SSL3_RT_MAX_PLAIN_LENGTH);
            921.       s->rwstate = SSL_NOTHING;
            922.       i = do_dtls1_write(s, type, buf, len, 0);
                           ^
            923.       return i;
            924.   }

ssl/record/rec_layer_d1.c:926:1: Parameter `s->rlayer.numwpipes`
              924.   }
              925.   
              926. > int do_dtls1_write(SSL *s, int type, const unsigned char *buf,
              927.                      unsigned int len, int create_empty_fragment)
              928.   {

ssl/record/rec_layer_d1.c:1112:12: Call
              1110.   
              1111.       /* we now just need to write the buffer */
              1112.       return ssl3_write_pending(s, type, buf, len);
                                 ^
              1113.    err:
              1114.       return -1;

ssl/record/rec_layer_s3.c:883:1: <LHS trace>
881.   
882.   /* if s->s3->wbuf.left != 0, we need to call this */
883. > int ssl3_write_pending(SSL *s, int type, const unsigned char *buf,
884.                          unsigned int len)
885.   {

ssl/record/rec_layer_s3.c:883:1: Parameter `s->rlayer.numwpipes`
                881.   
                882.   /* if s->s3->wbuf.left != 0, we need to call this */
                883. > int ssl3_write_pending(SSL *s, int type, const unsigned char *buf,
                884.                          unsigned int len)
                885.   {

ssl/record/rec_layer_s3.c:902:20: Binary operation: ([0, max(1, s->rlayer.numwpipes)] - 1):unsigned32 by call to `dtls1_read_failed` 
                900.           /* Loop until we find a buffer we haven't written out yet */
                901.           if (SSL3_BUFFER_get_left(&wb[currbuf]) == 0
                902.                   && currbuf < s->rlayer.numwpipes - 1) {
                                          ^
                903.               currbuf++;
                904.               continue;
