ssl/statem/statem.c:741: error: INTEGER_OVERFLOW_L2
  ([0, +oo] - 1):unsigned32 by call to `statem_do_write`.
Showing all 13 steps of the trace


ssl/statem/statem.c:671:1: Parameter `s->rlayer.numwpipes`
669.    * result in an NBIO event.
670.    */
671. > static SUB_STATE_RETURN write_state_machine(SSL *s)
672.   {
673.       OSSL_STATEM *st = &s->statem;

ssl/statem/statem.c:741:19: Call
739.                   dtls1_start_timer(s);
740.               }
741.               ret = statem_do_write(s);
                         ^
742.               if (ret <= 0) {
743.                   return SUB_STATE_ERROR;

ssl/statem/statem.c:615:1: Parameter `s->rlayer.numwpipes`
  613.    * Send a previously constructed message to the peer.
  614.    */
  615. > static int statem_do_write(SSL *s)
  616.   {
  617.       OSSL_STATEM *st = &s->statem;

ssl/statem/statem.c:622:20: Call
  620.               || st->hand_state == TLS_ST_SW_CHANGE) {
  621.           if (SSL_IS_DTLS(s))
  622.               return dtls1_do_write(s, SSL3_RT_CHANGE_CIPHER_SPEC);
                            ^
  623.           else
  624.               return ssl3_do_write(s, SSL3_RT_CHANGE_CIPHER_SPEC);

ssl/statem/statem_dtls.c:112:1: Parameter `s->rlayer.numwpipes`
    110.    * SSL3_RT_CHANGE_CIPHER_SPEC)
    111.    */
    112. > int dtls1_do_write(SSL *s, int type)
    113.   {
    114.       int ret;

ssl/statem/statem_dtls.c:242:15: Call
    240.           }
    241.   
    242.           ret = dtls1_write_bytes(s, type, &s->init_buf->data[s->init_off],
                         ^
    243.                                   len);
    244.           if (ret < 0) {

ssl/record/rec_layer_d1.c:916:1: Parameter `s->rlayer.numwpipes`
      914.    * not all data has been sent or non-blocking IO.
      915.    */
      916. > int dtls1_write_bytes(SSL *s, int type, const void *buf, int len)
      917.   {
      918.       int i;

ssl/record/rec_layer_d1.c:922:9: Call
      920.       OPENSSL_assert(len <= SSL3_RT_MAX_PLAIN_LENGTH);
      921.       s->rwstate = SSL_NOTHING;
      922.       i = do_dtls1_write(s, type, buf, len, 0);
                     ^
      923.       return i;
      924.   }

ssl/record/rec_layer_d1.c:926:1: Parameter `s->rlayer.numwpipes`
        924.   }
        925.   
        926. > int do_dtls1_write(SSL *s, int type, const unsigned char *buf,
        927.                      unsigned int len, int create_empty_fragment)
        928.   {

ssl/record/rec_layer_d1.c:1112:12: Call
        1110.   
        1111.       /* we now just need to write the buffer */
        1112.       return ssl3_write_pending(s, type, buf, len);
                           ^
        1113.    err:
        1114.       return -1;

ssl/record/rec_layer_s3.c:883:1: <LHS trace>
881.   
882.   /* if s->s3->wbuf.left != 0, we need to call this */
883. > int ssl3_write_pending(SSL *s, int type, const unsigned char *buf,
884.                          unsigned int len)
885.   {

ssl/record/rec_layer_s3.c:883:1: Parameter `s->rlayer.numwpipes`
          881.   
          882.   /* if s->s3->wbuf.left != 0, we need to call this */
          883. > int ssl3_write_pending(SSL *s, int type, const unsigned char *buf,
          884.                          unsigned int len)
          885.   {

ssl/record/rec_layer_s3.c:902:20: Binary operation: ([0, +oo] - 1):unsigned32 by call to `statem_do_write` 
          900.           /* Loop until we find a buffer we haven't written out yet */
          901.           if (SSL3_BUFFER_get_left(&wb[currbuf]) == 0
          902.                   && currbuf < s->rlayer.numwpipes - 1) {
                                    ^
          903.               currbuf++;
          904.               continue;
