ssl/statem/statem_dtls.c:820: error: INTEGER_OVERFLOW_L2
  ([2, max(2147483644, `s->init_buf->max`)] - [1, 2147483644]):unsigned64 by call to `dtls1_retrieve_buffered_fragment`.
Showing all 13 steps of the trace


ssl/statem/statem_dtls.c:810:1: Parameter `s->init_buf->max`
808.   }
809.   
810. > static int dtls_get_reassembled_message(SSL *s, long *len)
811.   {
812.       unsigned char wire[DTLS1_HM_HEADER_LENGTH];

ssl/statem/statem_dtls.c:820:21: Call
818.    redo:
819.       /* see if we have the required fragment already */
820.       if ((frag_len = dtls1_retrieve_buffered_fragment(s, &ok)) || ok) {
                           ^
821.           if (ok)
822.               s->init_num = frag_len;

ssl/statem/statem_dtls.c:542:1: Parameter `s->init_buf->max`
  540.   }
  541.   
  542. > static int dtls1_retrieve_buffered_fragment(SSL *s, int *ok)
  543.   {
  544.       /*-

ssl/statem/statem_dtls.c:569:14: Call
  567.           pqueue_pop(s->d1->buffered_messages);
  568.   
  569.           al = dtls1_preprocess_fragment(s, &frag->msg_header);
                      ^
  570.   
  571.           if (al == 0) {          /* no alert */

ssl/statem/statem_dtls.c:500:1: Parameter `s->init_buf->max`
    498.   }
    499.   
    500. > static int dtls1_preprocess_fragment(SSL *s, struct hm_header_st *msg_hdr)
    501.   {
    502.       size_t frag_off, frag_len, msg_len;

ssl/statem/statem_dtls.c:519:14: Call
    517.            * above
    518.            */
    519.           if (!BUF_MEM_grow_clean
                        ^
    520.               (s->init_buf, msg_len + DTLS1_HM_HEADER_LENGTH)) {
    521.               SSLerr(SSL_F_DTLS1_PREPROCESS_FRAGMENT, ERR_R_BUF_LIB);

crypto/buffer/buffer.c:158:1: Parameter `len`
      156.   }
      157.   
      158. > size_t BUF_MEM_grow_clean(BUF_MEM *str, size_t len)
      159.   {
      160.       char *ret;

crypto/buffer/buffer.c:182:15: Call
      180.           ret = sec_alloc_realloc(str, n);
      181.       else
      182.           ret = OPENSSL_clear_realloc(str->data, str->max, n);
                           ^
      183.       if (ret == NULL) {
      184.           BUFerr(BUF_F_BUF_MEM_GROW_CLEAN, ERR_R_MALLOC_FAILURE);

crypto/mem.c:193:1: <LHS trace>
191.   }
192.   
193. > void *CRYPTO_clear_realloc(void *str, size_t old_len, size_t num,
194.                              const char *file, int line)
195.   {

crypto/mem.c:193:1: Parameter `num`
        191.   }
        192.   
        193. > void *CRYPTO_clear_realloc(void *str, size_t old_len, size_t num,
        194.                              const char *file, int line)
        195.   {

crypto/mem.c:193:1: <RHS trace>
191.   }
192.   
193. > void *CRYPTO_clear_realloc(void *str, size_t old_len, size_t num,
194.                              const char *file, int line)
195.   {

crypto/mem.c:193:1: Parameter `num`
        191.   }
        192.   
        193. > void *CRYPTO_clear_realloc(void *str, size_t old_len, size_t num,
        194.                              const char *file, int line)
        195.   {

crypto/mem.c:208:9: Binary operation: ([2, max(2147483644, s->init_buf->max)] - [1, 2147483644]):unsigned64 by call to `dtls1_retrieve_buffered_fragment` 
        206.       /* Can't shrink the buffer since memcpy below copies |old_len| bytes. */
        207.       if (num < old_len) {
        208.           memset((char*)str + num, 0, old_len - num);
                       ^
        209.           return str;
        210.       }
