ssl/record/rec_layer_s3.c:590: error: INTEGER_OVERFLOW_L2
  ([0, +oo] - 1):unsigned32 by call to `do_ssl3_write`.
Showing all 9 steps of the trace


ssl/record/rec_layer_s3.c:335:1: Parameter `s->rlayer.numwpipes`
333.    * not all data has been sent or non-blocking IO.
334.    */
335. > int ssl3_write_bytes(SSL *s, int type, const void *buf_, int len)
336.   {
337.       const unsigned char *buf = buf_;

ssl/record/rec_layer_s3.c:590:13: Call
588.           }
589.   
590.           i = do_ssl3_write(s, type, &(buf[tot]), pipelens, numpipes, 0);
                   ^
591.           if (i <= 0) {
592.               /* XXX should we ssl3_release_write_buffer if i<0? */

ssl/record/rec_layer_s3.c:618:1: Parameter `s->rlayer.numwpipes`
  616.   }
  617.   
  618. > int do_ssl3_write(SSL *s, int type, const unsigned char *buf,
  619.                     unsigned int *pipelens, unsigned int numpipes,
  620.                     int create_empty_fragment)

ssl/record/rec_layer_s3.c:639:9: Call
  637.        * will happen with non blocking IO
  638.        */
  639.       if (RECORD_LAYER_write_pending(&s->rlayer))
                 ^
  640.           return (ssl3_write_pending(s, type, buf, totlen));
  641.   

ssl/record/rec_layer_s3.c:92:1: Parameter `rl->numwpipes`
    90.   }
    91.   
    92. > int RECORD_LAYER_write_pending(const RECORD_LAYER *rl)
    93.   {
    94.       return (rl->numwpipes > 0)

ssl/record/rec_layer_s3.c:640:17: Call
  638.        */
  639.       if (RECORD_LAYER_write_pending(&s->rlayer))
  640.           return (ssl3_write_pending(s, type, buf, totlen));
                         ^
  641.   
  642.       /* If we have an alert to send, lets send it */

ssl/record/rec_layer_s3.c:878:1: <LHS trace>
876.   
877.   /* if s->s3->wbuf.left != 0, we need to call this */
878. > int ssl3_write_pending(SSL *s, int type, const unsigned char *buf,
879.                          unsigned int len)
880.   {

ssl/record/rec_layer_s3.c:878:1: Parameter `s->rlayer.numwpipes`
    876.   
    877.   /* if s->s3->wbuf.left != 0, we need to call this */
    878. > int ssl3_write_pending(SSL *s, int type, const unsigned char *buf,
    879.                          unsigned int len)
    880.   {

ssl/record/rec_layer_s3.c:897:16: Binary operation: ([0, +oo] - 1):unsigned32 by call to `do_ssl3_write` 
    895.           /* Loop until we find a buffer we haven't written out yet */
    896.           if (SSL3_BUFFER_get_left(&wb[currbuf]) == 0
    897.               && currbuf < s->rlayer.numwpipes - 1) {
                          ^
    898.               currbuf++;
    899.               continue;
