ssl/record/rec_layer_d1.c:400: error: INTEGER_OVERFLOW_L2
  ([0, max(1, `s->rlayer.numwpipes`)] - 1):unsigned64 by call to `dtls1_handle_timeout`.
Showing all 17 steps of the trace


ssl/record/rec_layer_d1.c:331:1: Parameter `s->rlayer.numwpipes`
329.    *             none of our business
330.    */
331. > int dtls1_read_bytes(SSL *s, int type, int *recvd_type, unsigned char *buf,
332.                        size_t len, int peek, size_t *readbytes)
333.   {

ssl/record/rec_layer_d1.c:400:9: Call
398.   
399.       /* Check for timeout */
400.       if (dtls1_handle_timeout(s) > 0) {
               ^
401.           goto start;
402.       } else if (ossl_statem_in_error(s)) {

ssl/d1_lib.c:388:1: Parameter `s->rlayer.numwpipes`
  386.   }
  387.   
  388. > int dtls1_handle_timeout(SSL *s)
  389.   {
  390.       /* if no timer is expired, don't do anything */

ssl/d1_lib.c:409:12: Call
  407.   
  408.       dtls1_start_timer(s);
  409.       return dtls1_retransmit_buffered_messages(s);
                    ^
  410.   }
  411.   

ssl/statem/statem_dtls.c:979:1: Parameter `s->rlayer.numwpipes`
    977.   }
    978.   
    979. > int dtls1_retransmit_buffered_messages(SSL *s)
    980.   {
    981.       pqueue *sent = s->d1->sent_messages;

ssl/statem/statem_dtls.c:991:13: Call
    989.       for (item = pqueue_next(&iter); item != NULL; item = pqueue_next(&iter)) {
    990.           frag = (hm_fragment *)item->data;
    991.           if (dtls1_retransmit_message(s, (unsigned short)
                       ^
    992.                                        dtls1_get_queue_priority
    993.                                        (frag->msg_header.seq,

ssl/statem/statem_dtls.c:1068:1: Parameter `s->rlayer.numwpipes`
      1066.   }
      1067.   
      1068. > int dtls1_retransmit_message(SSL *s, unsigned short seq, int *found)
      1069.   {
      1070.       int ret;

ssl/statem/statem_dtls.c:1126:11: Call
      1124.                                           saved_retransmit_state.epoch);
      1125.   
      1126.       ret = dtls1_do_write(s, frag->msg_header.is_ccs ?
                        ^
      1127.                            SSL3_RT_CHANGE_CIPHER_SPEC : SSL3_RT_HANDSHAKE);
      1128.   

ssl/statem/statem_dtls.c:110:1: Parameter `s->rlayer.numwpipes`
        108.    * SSL3_RT_CHANGE_CIPHER_SPEC)
        109.    */
        110. > int dtls1_do_write(SSL *s, int type)
        111.   {
        112.       int ret;

ssl/statem/statem_dtls.c:240:15: Call
        238.           }
        239.   
        240.           ret = dtls1_write_bytes(s, type, &s->init_buf->data[s->init_off], len,
                             ^
        241.                                   &written);
        242.           if (ret < 0) {

ssl/record/rec_layer_d1.c:738:1: Parameter `s->rlayer.numwpipes`
          736.    * not all data has been sent or non-blocking IO.
          737.    */
          738. > int dtls1_write_bytes(SSL *s, int type, const void *buf, size_t len,
          739.                         size_t *written)
          740.   {

ssl/record/rec_layer_d1.c:748:9: Call
          746.       }
          747.       s->rwstate = SSL_NOTHING;
          748.       i = do_dtls1_write(s, type, buf, len, 0, written);
                         ^
          749.       return i;
          750.   }

ssl/record/rec_layer_d1.c:752:1: Parameter `s->rlayer.numwpipes`
            750.   }
            751.   
            752. > int do_dtls1_write(SSL *s, int type, const unsigned char *buf,
            753.                      size_t len, int create_empty_fragment, size_t *written)
            754.   {

ssl/record/rec_layer_d1.c:944:12: Call
            942.   
            943.       /* we now just need to write the buffer */
            944.       return ssl3_write_pending(s, type, buf, len, written);
                              ^
            945.    err:
            946.       return -1;

ssl/record/rec_layer_s3.c:1056:1: <LHS trace>
1054.    * Return values are as per SSL_write()
1055.    */
1056. > int ssl3_write_pending(SSL *s, int type, const unsigned char *buf, size_t len,
1057.                          size_t *written)
1058.   {

ssl/record/rec_layer_s3.c:1056:1: Parameter `s->rlayer.numwpipes`
              1054.    * Return values are as per SSL_write()
              1055.    */
              1056. > int ssl3_write_pending(SSL *s, int type, const unsigned char *buf, size_t len,
              1057.                          size_t *written)
              1058.   {

ssl/record/rec_layer_s3.c:1075:16: Binary operation: ([0, max(1, s->rlayer.numwpipes)] - 1):unsigned64 by call to `dtls1_handle_timeout` 
              1073.           /* Loop until we find a buffer we haven't written out yet */
              1074.           if (SSL3_BUFFER_get_left(&wb[currbuf]) == 0
              1075.               && currbuf < s->rlayer.numwpipes - 1) {
                                     ^
              1076.               currbuf++;
              1077.               continue;
