ssl/record/rec_layer_d1.c:389: error: INTEGER_OVERFLOW_L2
  ([0, max(1, `s->rlayer.numwpipes`)] - 1):unsigned32 by call to `dtls1_read_failed`.
Showing all 25 steps of the trace


ssl/record/rec_layer_d1.c:290:1: Parameter `s->rlayer.numwpipes`
288.    *             none of our business
289.    */
290. > int dtls1_read_bytes(SSL *s, int type, int *recvd_type, unsigned char *buf,
291.                        int len, int peek)
292.   {

ssl/record/rec_layer_d1.c:381:9: Call
379.   
380.       /* Check for timeout */
381.       if (dtls1_handle_timeout(s) > 0)
               ^
382.           goto start;
383.   

ssl/d1_lib.c:355:1: Parameter `s->rlayer.numwpipes`
  353.   }
  354.   
  355. > int dtls1_handle_timeout(SSL *s)
  356.   {
  357.       /* if no timer is expired, don't do anything */

ssl/record/rec_layer_d1.c:387:15: Call
385.       if ((SSL3_RECORD_get_length(rr) == 0)
386.           || (s->rlayer.rstate == SSL_ST_READ_BODY)) {
387.           ret = dtls1_get_record(s);
                     ^
388.           if (ret <= 0) {
389.               ret = dtls1_read_failed(s, ret);

ssl/record/ssl3_record.c:1458:1: Parameter `s->rlayer.numwpipes`
  1456.    */
  1457.   /* used only by dtls1_read_bytes */
  1458. > int dtls1_get_record(SSL *s)
  1459.   {
  1460.       int ssl_major, ssl_minor;

ssl/record/ssl3_record.c:1474:9: Call
  1472.        * This is a non-blocking operation.
  1473.        */
  1474.       if (dtls1_process_buffered_records(s) < 0)
                  ^
  1475.           return -1;
  1476.   

ssl/record/rec_layer_d1.c:229:1: Parameter `s->rlayer.numwpipes`
    227.                      &((s)->rlayer.d->unprocessed_rcds))
    228.   
    229. > int dtls1_process_buffered_records(SSL *s)
    230.   {
    231.       pitem *item;

ssl/record/rec_layer_d1.c:389:19: Call
387.           ret = dtls1_get_record(s);
388.           if (ret <= 0) {
389.               ret = dtls1_read_failed(s, ret);
                         ^
390.               /* anything other than a timeout is an error */
391.               if (ret <= 0)

ssl/statem/statem_dtls.c:912:1: Parameter `s->rlayer.numwpipes`
  910.   #endif
  911.   
  912. > int dtls1_read_failed(SSL *s, int code)
  913.   {
  914.       if (code > 0) {

ssl/statem/statem_dtls.c:938:12: Call
  936.       }
  937.   
  938.       return dtls1_handle_timeout(s);
                    ^
  939.   }
  940.   

ssl/d1_lib.c:355:1: Parameter `s->rlayer.numwpipes`
    353.   }
    354.   
    355. > int dtls1_handle_timeout(SSL *s)
    356.   {
    357.       /* if no timer is expired, don't do anything */

ssl/d1_lib.c:379:12: Call
    377.   
    378.       dtls1_start_timer(s);
    379.       return dtls1_retransmit_buffered_messages(s);
                      ^
    380.   }
    381.   

ssl/statem/statem_dtls.c:956:1: Parameter `s->rlayer.numwpipes`
      954.   }
      955.   
      956. > int dtls1_retransmit_buffered_messages(SSL *s)
      957.   {
      958.       pqueue *sent = s->d1->sent_messages;

ssl/statem/statem_dtls.c:968:13: Call
      966.       for (item = pqueue_next(&iter); item != NULL; item = pqueue_next(&iter)) {
      967.           frag = (hm_fragment *)item->data;
      968.           if (dtls1_retransmit_message(s, (unsigned short)
                         ^
      969.                                        dtls1_get_queue_priority
      970.                                        (frag->msg_header.seq,

ssl/statem/statem_dtls.c:1042:1: Parameter `s->rlayer.numwpipes`
        1040.   }
        1041.   
        1042. > int dtls1_retransmit_message(SSL *s, unsigned short seq, int *found)
        1043.   {
        1044.       int ret;

ssl/statem/statem_dtls.c:1104:11: Call
        1102.                                           saved_retransmit_state.epoch);
        1103.   
        1104.       ret = dtls1_do_write(s, frag->msg_header.is_ccs ?
                          ^
        1105.                            SSL3_RT_CHANGE_CIPHER_SPEC : SSL3_RT_HANDSHAKE);
        1106.   

ssl/statem/statem_dtls.c:111:1: Parameter `s->rlayer.numwpipes`
          109.    * SSL3_RT_CHANGE_CIPHER_SPEC)
          110.    */
          111. > int dtls1_do_write(SSL *s, int type)
          112.   {
          113.       int ret;

ssl/statem/statem_dtls.c:239:15: Call
          237.           }
          238.   
          239.           ret = dtls1_write_bytes(s, type, &s->init_buf->data[s->init_off], len);
                               ^
          240.           if (ret < 0) {
          241.               /*

ssl/record/rec_layer_d1.c:905:1: Parameter `s->rlayer.numwpipes`
            903.    * not all data has been sent or non-blocking IO.
            904.    */
            905. > int dtls1_write_bytes(SSL *s, int type, const void *buf, int len)
            906.   {
            907.       int i;

ssl/record/rec_layer_d1.c:911:9: Call
            909.       OPENSSL_assert(len <= SSL3_RT_MAX_PLAIN_LENGTH);
            910.       s->rwstate = SSL_NOTHING;
            911.       i = do_dtls1_write(s, type, buf, len, 0);
                           ^
            912.       return i;
            913.   }

ssl/record/rec_layer_d1.c:915:1: Parameter `s->rlayer.numwpipes`
              913.   }
              914.   
              915. > int do_dtls1_write(SSL *s, int type, const unsigned char *buf,
              916.                      unsigned int len, int create_empty_fragment)
              917.   {

ssl/record/rec_layer_d1.c:1103:12: Call
              1101.   
              1102.       /* we now just need to write the buffer */
              1103.       return ssl3_write_pending(s, type, buf, len);
                                 ^
              1104.    err:
              1105.       return -1;

ssl/record/rec_layer_s3.c:878:1: <LHS trace>
876.   
877.   /* if s->s3->wbuf.left != 0, we need to call this */
878. > int ssl3_write_pending(SSL *s, int type, const unsigned char *buf,
879.                          unsigned int len)
880.   {

ssl/record/rec_layer_s3.c:878:1: Parameter `s->rlayer.numwpipes`
                876.   
                877.   /* if s->s3->wbuf.left != 0, we need to call this */
                878. > int ssl3_write_pending(SSL *s, int type, const unsigned char *buf,
                879.                          unsigned int len)
                880.   {

ssl/record/rec_layer_s3.c:897:16: Binary operation: ([0, max(1, s->rlayer.numwpipes)] - 1):unsigned32 by call to `dtls1_read_failed` 
                895.           /* Loop until we find a buffer we haven't written out yet */
                896.           if (SSL3_BUFFER_get_left(&wb[currbuf]) == 0
                897.               && currbuf < s->rlayer.numwpipes - 1) {
                                      ^
                898.               currbuf++;
                899.               continue;
