ssl/statem/statem.c:514: error: INTEGER_OVERFLOW_L2
  ([2, max(2147483644, `s->init_buf->max`)] - [1, 2147483644]):unsigned64 by call to `tls_get_message_header`.
Showing all 11 steps of the trace


ssl/statem/statem.c:474:1: Parameter `s->init_buf->max`
472.    * will resume in the same state where we left off.
473.    */
474. > static SUB_STATE_RETURN read_state_machine(SSL *s) {
475.       OSSL_STATEM *st = &s->statem;
476.       int ret, mt;

ssl/statem/statem.c:514:23: Call
512.                   ret = dtls_get_message(s, &mt, &len);
513.               } else {
514.                   ret = tls_get_message_header(s, &mt);
                             ^
515.               }
516.   

ssl/statem/statem_lib.c:338:1: Parameter `s->init_buf->max`
  336.   }
  337.   
  338. > int tls_get_message_header(SSL *s, int *mt)
  339.   {
  340.       /* s->init_num < SSL3_HM_HEADER_LENGTH */

ssl/statem/statem_lib.c:413:19: Call
  411.           l = RECORD_LAYER_get_rrec_length(&s->rlayer)
  412.               + SSL3_HM_HEADER_LENGTH;
  413.           if (l && !BUF_MEM_grow_clean(s->init_buf, (int)l)) {
                           ^
  414.               SSLerr(SSL_F_TLS_GET_MESSAGE_HEADER, ERR_R_BUF_LIB);
  415.               goto err;

crypto/buffer/buffer.c:109:1: Parameter `len`
    107.   }
    108.   
    109. > size_t BUF_MEM_grow_clean(BUF_MEM *str, size_t len)
    110.   {
    111.       char *ret;

crypto/buffer/buffer.c:134:15: Call
    132.           ret = sec_alloc_realloc(str, n);
    133.       else
    134.           ret = OPENSSL_clear_realloc(str->data, str->max, n);
                         ^
    135.       if (ret == NULL) {
    136.           BUFerr(BUF_F_BUF_MEM_GROW_CLEAN, ERR_R_MALLOC_FAILURE);

crypto/mem.c:136:1: <LHS trace>
134.   }
135.   
136. > void *CRYPTO_clear_realloc(void *str, size_t old_len, size_t num,
137.                              const char *file, int line)
138.   {

crypto/mem.c:136:1: Parameter `num`
      134.   }
      135.   
      136. > void *CRYPTO_clear_realloc(void *str, size_t old_len, size_t num,
      137.                              const char *file, int line)
      138.   {

crypto/mem.c:136:1: <RHS trace>
134.   }
135.   
136. > void *CRYPTO_clear_realloc(void *str, size_t old_len, size_t num,
137.                              const char *file, int line)
138.   {

crypto/mem.c:136:1: Parameter `num`
      134.   }
      135.   
      136. > void *CRYPTO_clear_realloc(void *str, size_t old_len, size_t num,
      137.                              const char *file, int line)
      138.   {

crypto/mem.c:151:9: Binary operation: ([2, max(2147483644, s->init_buf->max)] - [1, 2147483644]):unsigned64 by call to `tls_get_message_header` 
      149.       /* Can't shrink the buffer since memcpy below copies |old_len| bytes. */
      150.       if (num < old_len) {
      151.           OPENSSL_cleanse((char*)str + num, old_len - num);
                     ^
      152.           return str;
      153.       }
