ssl/record/ssl3_record.c:440: error: INTEGER_OVERFLOW_L2
  ([0, 34112] - [256, 34368]):unsigned32 by call to `ssl3_cbc_copy_mac`.
Showing all 8 steps of the trace


ssl/record/ssl3_record.c:186:1: Parameter `s->rlayer.rrec.length`
184.    */
185.   /* used only by ssl3_read_bytes */
186. > int ssl3_get_record(SSL *s)
187.   {
188.       int ssl_major, ssl_minor, al;

ssl/record/ssl3_record.c:360:5: Assignment
358.       /* decrypt in place in 'rr->input' */
359.       rr->data = rr->input;
360.       rr->orig_len = rr->length;
           ^
361.       /*
362.        * If in encrypt-then-mac mode calculate mac from encrypted record. All

ssl/record/ssl3_record.c:440:13: Call
438.                */
439.               mac = mac_tmp;
440.               ssl3_cbc_copy_mac(mac_tmp, rr, mac_size);
                   ^
441.               rr->length -= mac_size;
442.           } else {

ssl/record/ssl3_record.c:1141:1: <LHS trace>
1139.   #define CBC_MAC_ROTATE_IN_PLACE
1140.   
1141. > void ssl3_cbc_copy_mac(unsigned char *out,
1142.                          const SSL3_RECORD *rec, unsigned md_size)
1143.   {

ssl/record/ssl3_record.c:1141:1: Parameter `md_size`
  1139.   #define CBC_MAC_ROTATE_IN_PLACE
  1140.   
  1141. > void ssl3_cbc_copy_mac(unsigned char *out,
  1142.                          const SSL3_RECORD *rec, unsigned md_size)
  1143.   {

ssl/record/ssl3_record.c:1141:1: <RHS trace>
1139.   #define CBC_MAC_ROTATE_IN_PLACE
1140.   
1141. > void ssl3_cbc_copy_mac(unsigned char *out,
1142.                          const SSL3_RECORD *rec, unsigned md_size)
1143.   {

ssl/record/ssl3_record.c:1141:1: Parameter `md_size`
  1139.   #define CBC_MAC_ROTATE_IN_PLACE
  1140.   
  1141. > void ssl3_cbc_copy_mac(unsigned char *out,
  1142.                          const SSL3_RECORD *rec, unsigned md_size)
  1143.   {

ssl/record/ssl3_record.c:1174:9: Binary operation: ([0, 34112] - [256, 34368]):unsigned32 by call to `ssl3_cbc_copy_mac` 
  1172.       /* This information is public so it's safe to branch based on it. */
  1173.       if (rec->orig_len > md_size + 255 + 1)
  1174.           scan_start = rec->orig_len - (md_size + 255 + 1);
                  ^
  1175.       /*
  1176.        * div_spoiler contains a multiple of md_size that is used to cause the
