crypto/conf/conf_def.c:525: error: INTEGER_OVERFLOW_L2
  ([0, +oo] - [0, 65536]):unsigned64 by call to `BUF_MEM_grow_clean`.
Showing all 8 steps of the trace


crypto/conf/conf_def.c:405:1: Parameter `*from`
403.   }
404.   
405. > static int str_copy(CONF *conf, char *section, char **pto, char *from)
406.   {
407.       int q, r, rr = 0, to = 0, len = 0;

crypto/conf/conf_def.c:520:13: Assignment
518.                   goto err;
519.               }
520.               newsize = strlen(p) + buf->length - (e - from);
                   ^
521.               if (newsize > MAX_CONF_VALUE_LENGTH) {
522.                   CONFerr(CONF_F_STR_COPY, CONF_R_VARIABLE_EXPANSION_TOO_LONG);

crypto/conf/conf_def.c:525:18: Call
523.                   goto err;
524.               }
525.               if (!BUF_MEM_grow_clean(buf, newsize)) {
                        ^
526.                   CONFerr(CONF_F_STR_COPY, ERR_R_MALLOC_FAILURE);
527.                   goto err;

crypto/buffer/buffer.c:111:1: <LHS trace>
109.   }
110.   
111. > size_t BUF_MEM_grow_clean(BUF_MEM *str, size_t len)
112.   {
113.       char *ret;

crypto/buffer/buffer.c:111:1: Parameter `len`
  109.   }
  110.   
  111. > size_t BUF_MEM_grow_clean(BUF_MEM *str, size_t len)
  112.   {
  113.       char *ret;

crypto/buffer/buffer.c:111:1: <RHS trace>
109.   }
110.   
111. > size_t BUF_MEM_grow_clean(BUF_MEM *str, size_t len)
112.   {
113.       char *ret;

crypto/buffer/buffer.c:111:1: Parameter `len`
  109.   }
  110.   
  111. > size_t BUF_MEM_grow_clean(BUF_MEM *str, size_t len)
  112.   {
  113.       char *ret;

crypto/buffer/buffer.c:118:13: Binary operation: ([0, +oo] - [0, 65536]):unsigned64 by call to `BUF_MEM_grow_clean` 
  116.       if (str->length >= len) {
  117.           if (str->data != NULL)
  118.               memset(&str->data[len], 0, str->length - len);
                     ^
  119.           str->length = len;
  120.           return len;
