ssl/s3_enc.c:563: error: INTEGER_OVERFLOW_L2
  ([0, +oo] - 1):unsigned32 by call to `ssl3_cbc_remove_padding`.
Showing all 5 steps of the trace


ssl/s3_enc.c:497:1: Parameter `s->s3->rrec.length`
495.    *       occurred.
496.    */
497. > int ssl3_enc(SSL *s, int send)
498.   	{
499.   	SSL3_RECORD *rec;

ssl/s3_enc.c:563:11: Call
561.   			mac_size = EVP_MD_CTX_size(s->read_hash);
562.   		if ((bs != 1) && !send)
563.   			return ssl3_cbc_remove_padding(s, rec, bs, mac_size);
                 ^
564.   		}
565.   	return(1);

ssl/s3_cbc.c:81:1: <LHS trace>
79.    *  -1: otherwise. 
80.    */
81. > int ssl3_cbc_remove_padding(const SSL* s,
82.   			    SSL3_RECORD *rec,
83.   			    unsigned block_size,

ssl/s3_cbc.c:81:1: Parameter `rec->length`
  79.    *  -1: otherwise. 
  80.    */
  81. > int ssl3_cbc_remove_padding(const SSL* s,
  82.   			    SSL3_RECORD *rec,
  83.   			    unsigned block_size,

ssl/s3_cbc.c:94:19: Binary operation: ([0, +oo] - 1):unsigned32 by call to `ssl3_cbc_remove_padding` 
  92.   		return 0;
  93.   
  94.   	padding_length = rec->data[rec->length-1];
                          ^
  95.   	good = constant_time_ge(rec->length, padding_length+overhead);
  96.   	/* SSLv3 requires that the padding is minimal. */
