ssl/s3_enc.c:548: error: INTEGER_OVERFLOW_L2
  ([0, +oo] - 1):unsigned32 by call to `ssl3_cbc_remove_padding`.
Showing all 5 steps of the trace


ssl/s3_enc.c:489:1: Parameter `s->s3->rrec.length`
487.    *       occurred.
488.    */
489. > int ssl3_enc(SSL *s, int send)
490.   {
491.       SSL3_RECORD *rec;

ssl/s3_enc.c:548:20: Call
546.               mac_size = EVP_MD_CTX_size(s->read_hash);
547.           if ((bs != 1) && !send)
548.               return ssl3_cbc_remove_padding(s, rec, bs, mac_size);
                          ^
549.       }
550.       return (1);

ssl/s3_cbc.c:85:1: <LHS trace>
83.    *  -1: otherwise.
84.    */
85. > int ssl3_cbc_remove_padding(const SSL *s,
86.                               SSL3_RECORD *rec,
87.                               unsigned block_size, unsigned mac_size)

ssl/s3_cbc.c:85:1: Parameter `rec->length`
  83.    *  -1: otherwise.
  84.    */
  85. > int ssl3_cbc_remove_padding(const SSL *s,
  86.                               SSL3_RECORD *rec,
  87.                               unsigned block_size, unsigned mac_size)

ssl/s3_cbc.c:98:22: Binary operation: ([0, +oo] - 1):unsigned32 by call to `ssl3_cbc_remove_padding` 
  96.           return 0;
  97.   
  98.       padding_length = rec->data[rec->length - 1];
                              ^
  99.       good = constant_time_ge(rec->length, padding_length + overhead);
  100.       /* SSLv3 requires that the padding is minimal. */
