ssl/record/rec_layer_d1.c:502: error: INTEGER_OVERFLOW_L2
  ([0, max(1, `s->rlayer.numwpipes`)] - 1):unsigned32 by call to `dtls1_read_failed`.
Showing all 25 steps of the trace


ssl/record/rec_layer_d1.c:403:1: Parameter `s->rlayer.numwpipes`
401.    *             none of our business
402.    */
403. > int dtls1_read_bytes(SSL *s, int type, int *recvd_type, unsigned char *buf,
404.                        int len, int peek)
405.   {

ssl/record/rec_layer_d1.c:494:9: Call
492.   
493.       /* Check for timeout */
494.       if (dtls1_handle_timeout(s) > 0)
               ^
495.           goto start;
496.   

ssl/d1_lib.c:404:1: Parameter `s->rlayer.numwpipes`
  402.   }
  403.   
  404. > int dtls1_handle_timeout(SSL *s)
  405.   {
  406.       /* if no timer is expired, don't do anything */

ssl/record/rec_layer_d1.c:500:15: Call
498.       if ((SSL3_RECORD_get_length(rr) == 0)
499.               || (s->rlayer.rstate == SSL_ST_READ_BODY)) {
500.           ret = dtls1_get_record(s);
                     ^
501.           if (ret <= 0) {
502.               ret = dtls1_read_failed(s, ret);

ssl/record/ssl3_record.c:1541:1: Parameter `s->rlayer.numwpipes`
  1539.    */
  1540.   /* used only by dtls1_read_bytes */
  1541. > int dtls1_get_record(SSL *s)
  1542.   {
  1543.       int ssl_major, ssl_minor;

ssl/record/ssl3_record.c:1557:9: Call
  1555.        * This is a non-blocking operation.
  1556.        */
  1557.       if (dtls1_process_buffered_records(s) < 0)
                  ^
  1558.           return -1;
  1559.   

ssl/record/rec_layer_d1.c:342:1: Parameter `s->rlayer.numwpipes`
    340.   
    341.   
    342. > int dtls1_process_buffered_records(SSL *s)
    343.   {
    344.       pitem *item;

ssl/record/rec_layer_d1.c:502:19: Call
500.           ret = dtls1_get_record(s);
501.           if (ret <= 0) {
502.               ret = dtls1_read_failed(s, ret);
                         ^
503.               /* anything other than a timeout is an error */
504.               if (ret <= 0)

ssl/statem/statem_dtls.c:1022:1: Parameter `s->rlayer.numwpipes`
  1020.   #endif
  1021.   
  1022. > int dtls1_read_failed(SSL *s, int code)
  1023.   {
  1024.       if (code > 0) {

ssl/statem/statem_dtls.c:1048:12: Call
  1046.       }
  1047.   
  1048.       return dtls1_handle_timeout(s);
                     ^
  1049.   }
  1050.   

ssl/d1_lib.c:404:1: Parameter `s->rlayer.numwpipes`
    402.   }
    403.   
    404. > int dtls1_handle_timeout(SSL *s)
    405.   {
    406.       /* if no timer is expired, don't do anything */

ssl/d1_lib.c:428:12: Call
    426.   
    427.       dtls1_start_timer(s);
    428.       return dtls1_retransmit_buffered_messages(s);
                      ^
    429.   }
    430.   

ssl/statem/statem_dtls.c:1066:1: Parameter `s->rlayer.numwpipes`
      1064.   }
      1065.   
      1066. > int dtls1_retransmit_buffered_messages(SSL *s)
      1067.   {
      1068.       pqueue *sent = s->d1->sent_messages;

ssl/statem/statem_dtls.c:1078:13: Call
      1076.       for (item = pqueue_next(&iter); item != NULL; item = pqueue_next(&iter)) {
      1077.           frag = (hm_fragment *)item->data;
      1078.           if (dtls1_retransmit_message(s, (unsigned short)
                          ^
      1079.                                        dtls1_get_queue_priority
      1080.                                        (frag->msg_header.seq,

ssl/statem/statem_dtls.c:1154:1: Parameter `s->rlayer.numwpipes`
        1152.   }
        1153.   
        1154. > int
        1155.   dtls1_retransmit_message(SSL *s, unsigned short seq, int *found)
        1156.   {

ssl/statem/statem_dtls.c:1216:11: Call
        1214.           frag->msg_header.saved_retransmit_state.epoch);
        1215.   
        1216.       ret = dtls1_do_write(s, frag->msg_header.is_ccs ?
                          ^
        1217.                            SSL3_RT_CHANGE_CIPHER_SPEC : SSL3_RT_HANDSHAKE);
        1218.   

ssl/statem/statem_dtls.c:217:1: Parameter `s->rlayer.numwpipes`
          215.    * SSL3_RT_CHANGE_CIPHER_SPEC)
          216.    */
          217. > int dtls1_do_write(SSL *s, int type)
          218.   {
          219.       int ret;

ssl/statem/statem_dtls.c:346:15: Call
          344.           }
          345.   
          346.           ret = dtls1_write_bytes(s, type, &s->init_buf->data[s->init_off],
                               ^
          347.                                   len);
          348.           if (ret < 0) {

ssl/record/rec_layer_d1.c:1021:1: Parameter `s->rlayer.numwpipes`
            1019.    * not all data has been sent or non-blocking IO.
            1020.    */
            1021. > int dtls1_write_bytes(SSL *s, int type, const void *buf, int len)
            1022.   {
            1023.       int i;

ssl/record/rec_layer_d1.c:1027:9: Call
            1025.       OPENSSL_assert(len <= SSL3_RT_MAX_PLAIN_LENGTH);
            1026.       s->rwstate = SSL_NOTHING;
            1027.       i = do_dtls1_write(s, type, buf, len, 0);
                            ^
            1028.       return i;
            1029.   }

ssl/record/rec_layer_d1.c:1031:1: Parameter `s->rlayer.numwpipes`
              1029.   }
              1030.   
              1031. > int do_dtls1_write(SSL *s, int type, const unsigned char *buf,
              1032.                      unsigned int len, int create_empty_fragment)
              1033.   {

ssl/record/rec_layer_d1.c:1050:17: Call
              1048.       if (SSL3_BUFFER_get_left(wb) != 0) {
              1049.           OPENSSL_assert(0);      /* XDTLS: want to see if we ever get here */
              1050.           return (ssl3_write_pending(s, type, buf, len));
                                      ^
              1051.       }
              1052.   

ssl/record/rec_layer_s3.c:999:1: <LHS trace>
997.   
998.   /* if s->s3->wbuf.left != 0, we need to call this */
999. > int ssl3_write_pending(SSL *s, int type, const unsigned char *buf,
1000.                          unsigned int len)
1001.   {

ssl/record/rec_layer_s3.c:999:1: Parameter `s->rlayer.numwpipes`
                997.   
                998.   /* if s->s3->wbuf.left != 0, we need to call this */
                999. > int ssl3_write_pending(SSL *s, int type, const unsigned char *buf,
                1000.                          unsigned int len)
                1001.   {

ssl/record/rec_layer_s3.c:1018:20: Binary operation: ([0, max(1, s->rlayer.numwpipes)] - 1):unsigned32 by call to `dtls1_read_failed` 
                1016.           /* Loop until we find a buffer we haven't written out yet */
                1017.           if (SSL3_BUFFER_get_left(&wb[currbuf]) == 0
                1018.                   && currbuf < s->rlayer.numwpipes - 1) {
                                           ^
                1019.               currbuf++;
                1020.               continue;
