ssl/record/rec_layer_d1.c:381: error: INTEGER_OVERFLOW_L2
  ([0, max(1, `s->rlayer.numwpipes`)] - 1):unsigned32 by call to `dtls1_handle_timeout`.
Showing all 17 steps of the trace


ssl/record/rec_layer_d1.c:290:1: Parameter `s->rlayer.numwpipes`
288.    *             none of our business
289.    */
290. > int dtls1_read_bytes(SSL *s, int type, int *recvd_type, unsigned char *buf,
291.                        int len, int peek)
292.   {

ssl/record/rec_layer_d1.c:381:9: Call
379.   
380.       /* Check for timeout */
381.       if (dtls1_handle_timeout(s) > 0)
               ^
382.           goto start;
383.   

ssl/d1_lib.c:355:1: Parameter `s->rlayer.numwpipes`
  353.   }
  354.   
  355. > int dtls1_handle_timeout(SSL *s)
  356.   {
  357.       /* if no timer is expired, don't do anything */

ssl/d1_lib.c:379:12: Call
  377.   
  378.       dtls1_start_timer(s);
  379.       return dtls1_retransmit_buffered_messages(s);
                    ^
  380.   }
  381.   

ssl/statem/statem_dtls.c:956:1: Parameter `s->rlayer.numwpipes`
    954.   }
    955.   
    956. > int dtls1_retransmit_buffered_messages(SSL *s)
    957.   {
    958.       pqueue *sent = s->d1->sent_messages;

ssl/statem/statem_dtls.c:968:13: Call
    966.       for (item = pqueue_next(&iter); item != NULL; item = pqueue_next(&iter)) {
    967.           frag = (hm_fragment *)item->data;
    968.           if (dtls1_retransmit_message(s, (unsigned short)
                       ^
    969.                                        dtls1_get_queue_priority
    970.                                        (frag->msg_header.seq,

ssl/statem/statem_dtls.c:1042:1: Parameter `s->rlayer.numwpipes`
      1040.   }
      1041.   
      1042. > int dtls1_retransmit_message(SSL *s, unsigned short seq, int *found)
      1043.   {
      1044.       int ret;

ssl/statem/statem_dtls.c:1104:11: Call
      1102.                                           saved_retransmit_state.epoch);
      1103.   
      1104.       ret = dtls1_do_write(s, frag->msg_header.is_ccs ?
                        ^
      1105.                            SSL3_RT_CHANGE_CIPHER_SPEC : SSL3_RT_HANDSHAKE);
      1106.   

ssl/statem/statem_dtls.c:111:1: Parameter `s->rlayer.numwpipes`
        109.    * SSL3_RT_CHANGE_CIPHER_SPEC)
        110.    */
        111. > int dtls1_do_write(SSL *s, int type)
        112.   {
        113.       int ret;

ssl/statem/statem_dtls.c:239:15: Call
        237.           }
        238.   
        239.           ret = dtls1_write_bytes(s, type, &s->init_buf->data[s->init_off], len);
                             ^
        240.           if (ret < 0) {
        241.               /*

ssl/record/rec_layer_d1.c:905:1: Parameter `s->rlayer.numwpipes`
          903.    * not all data has been sent or non-blocking IO.
          904.    */
          905. > int dtls1_write_bytes(SSL *s, int type, const void *buf, int len)
          906.   {
          907.       int i;

ssl/record/rec_layer_d1.c:911:9: Call
          909.       OPENSSL_assert(len <= SSL3_RT_MAX_PLAIN_LENGTH);
          910.       s->rwstate = SSL_NOTHING;
          911.       i = do_dtls1_write(s, type, buf, len, 0);
                         ^
          912.       return i;
          913.   }

ssl/record/rec_layer_d1.c:915:1: Parameter `s->rlayer.numwpipes`
            913.   }
            914.   
            915. > int do_dtls1_write(SSL *s, int type, const unsigned char *buf,
            916.                      unsigned int len, int create_empty_fragment)
            917.   {

ssl/record/rec_layer_d1.c:1103:12: Call
            1101.   
            1102.       /* we now just need to write the buffer */
            1103.       return ssl3_write_pending(s, type, buf, len);
                               ^
            1104.    err:
            1105.       return -1;

ssl/record/rec_layer_s3.c:878:1: <LHS trace>
876.   
877.   /* if s->s3->wbuf.left != 0, we need to call this */
878. > int ssl3_write_pending(SSL *s, int type, const unsigned char *buf,
879.                          unsigned int len)
880.   {

ssl/record/rec_layer_s3.c:878:1: Parameter `s->rlayer.numwpipes`
              876.   
              877.   /* if s->s3->wbuf.left != 0, we need to call this */
              878. > int ssl3_write_pending(SSL *s, int type, const unsigned char *buf,
              879.                          unsigned int len)
              880.   {

ssl/record/rec_layer_s3.c:897:16: Binary operation: ([0, max(1, s->rlayer.numwpipes)] - 1):unsigned32 by call to `dtls1_handle_timeout` 
              895.           /* Loop until we find a buffer we haven't written out yet */
              896.           if (SSL3_BUFFER_get_left(&wb[currbuf]) == 0
              897.               && currbuf < s->rlayer.numwpipes - 1) {
                                    ^
              898.               currbuf++;
              899.               continue;
