ssl/statem/statem_srvr.c:2022: error: INTEGER_OVERFLOW_L2
  ([2, max(2147483644, `s->init_buf->max`)] - [1, 2147483644]):unsigned64 by call to `BUF_MEM_grow_clean`.
Showing all 9 steps of the trace


ssl/statem/statem_srvr.c:1980:1: Parameter `s->init_buf->max`
1978.   }
1979.   
1980. > int tls_construct_certificate_request(SSL *s)
1981.   {
1982.       unsigned char *p, *d;

ssl/statem/statem_srvr.c:2022:18: Call
2020.               name = sk_X509_NAME_value(sk, i);
2021.               j = i2d_X509_NAME(name, NULL);
2022.               if (!BUF_MEM_grow_clean(buf, SSL_HM_HEADER_LENGTH(s) + n + j + 2)) {
                         ^
2023.                   SSLerr(SSL_F_TLS_CONSTRUCT_CERTIFICATE_REQUEST, ERR_R_BUF_LIB);
2024.                   goto err;

crypto/buffer/buffer.c:109:1: Parameter `len`
  107.   }
  108.   
  109. > size_t BUF_MEM_grow_clean(BUF_MEM *str, size_t len)
  110.   {
  111.       char *ret;

crypto/buffer/buffer.c:134:15: Call
  132.           ret = sec_alloc_realloc(str, n);
  133.       else
  134.           ret = OPENSSL_clear_realloc(str->data, str->max, n);
                       ^
  135.       if (ret == NULL) {
  136.           BUFerr(BUF_F_BUF_MEM_GROW_CLEAN, ERR_R_MALLOC_FAILURE);

crypto/mem.c:136:1: <LHS trace>
134.   }
135.   
136. > void *CRYPTO_clear_realloc(void *str, size_t old_len, size_t num,
137.                              const char *file, int line)
138.   {

crypto/mem.c:136:1: Parameter `num`
    134.   }
    135.   
    136. > void *CRYPTO_clear_realloc(void *str, size_t old_len, size_t num,
    137.                              const char *file, int line)
    138.   {

crypto/mem.c:136:1: <RHS trace>
134.   }
135.   
136. > void *CRYPTO_clear_realloc(void *str, size_t old_len, size_t num,
137.                              const char *file, int line)
138.   {

crypto/mem.c:136:1: Parameter `num`
    134.   }
    135.   
    136. > void *CRYPTO_clear_realloc(void *str, size_t old_len, size_t num,
    137.                              const char *file, int line)
    138.   {

crypto/mem.c:151:9: Binary operation: ([2, max(2147483644, s->init_buf->max)] - [1, 2147483644]):unsigned64 by call to `BUF_MEM_grow_clean` 
    149.       /* Can't shrink the buffer since memcpy below copies |old_len| bytes. */
    150.       if (num < old_len) {
    151.           OPENSSL_cleanse((char*)str + num, old_len - num);
                   ^
    152.           return str;
    153.       }
