ssl/s3_clnt.c:406: error: INTEGER_OVERFLOW_L2
  ([0, +oo] - 10):unsigned64 by call to `ssl3_send_client_certificate`.
Showing all 13 steps of the trace


ssl/s3_clnt.c:175:1: Parameter `s->init_buf->length`
173.   
174.   
175. > int ssl3_connect(SSL *s)
176.   {
177.       BUF_MEM *buf = NULL;

ssl/s3_clnt.c:406:19: Call
404.           case SSL3_ST_CW_CERT_C:
405.           case SSL3_ST_CW_CERT_D:
406.               ret = ssl3_send_client_certificate(s);
                         ^
407.               if (ret <= 0)
408.                   goto end;

ssl/s3_clnt.c:3141:1: Parameter `s->init_buf->length`
  3139.   }
  3140.   
  3141. > int ssl3_send_client_certificate(SSL *s)
  3142.   {
  3143.       X509 *x509 = NULL;

ssl/s3_clnt.c:3216:14: Call
  3214.       if (s->state == SSL3_ST_CW_CERT_C) {
  3215.           s->state = SSL3_ST_CW_CERT_D;
  3216.           if (!ssl3_output_cert_chain(s,
                       ^
  3217.                                       (s->s3->tmp.cert_req ==
  3218.                                        2) ? NULL : s->cert->key)) {

ssl/s3_both.c:386:1: Parameter `s->init_buf->length`
    384.   }
    385.   
    386. > unsigned long ssl3_output_cert_chain(SSL *s, CERT_PKEY *cpk)
    387.   {
    388.       unsigned char *p;

ssl/s3_both.c:391:10: Call
    389.       unsigned long l = 3 + SSL_HM_HEADER_LENGTH(s);
    390.   
    391.       if (!ssl_add_cert_chain(s, cpk, &l))
                    ^
    392.           return 0;
    393.   

ssl/ssl_cert.c:871:1: Parameter `s->init_buf->length`
      869.   
      870.   /* Add certificate chain to internal SSL BUF_MEM strcuture */
      871. > int ssl_add_cert_chain(SSL *s, CERT_PKEY *cpk, unsigned long *l)
      872.   {
      873.       BUF_MEM *buf = s->init_buf;

ssl/ssl_cert.c:881:10: Call
      879.   
      880.       /* TLSv1 sends a chain with nothing in it, instead of an alert */
      881.       if (!BUF_MEM_grow_clean(buf, 10)) {
                      ^
      882.           SSLerr(SSL_F_SSL_ADD_CERT_CHAIN, ERR_R_BUF_LIB);
      883.           return 0;

crypto/buffer/buffer.c:162:1: <LHS trace>
160.   }
161.   
162. > size_t BUF_MEM_grow_clean(BUF_MEM *str, size_t len)
163.   {
164.       char *ret;

crypto/buffer/buffer.c:162:1: Parameter `len`
        160.   }
        161.   
        162. > size_t BUF_MEM_grow_clean(BUF_MEM *str, size_t len)
        163.   {
        164.       char *ret;

crypto/buffer/buffer.c:162:1: <RHS trace>
160.   }
161.   
162. > size_t BUF_MEM_grow_clean(BUF_MEM *str, size_t len)
163.   {
164.       char *ret;

crypto/buffer/buffer.c:162:1: Parameter `len`
        160.   }
        161.   
        162. > size_t BUF_MEM_grow_clean(BUF_MEM *str, size_t len)
        163.   {
        164.       char *ret;

crypto/buffer/buffer.c:168:9: Binary operation: ([0, +oo] - 10):unsigned64 by call to `ssl3_send_client_certificate` 
        166.   
        167.       if (str->length >= len) {
        168.           memset(&str->data[len], 0, str->length - len);
                       ^
        169.           str->length = len;
        170.           return (len);
