ssl/s3_clnt.c:353: error: INTEGER_OVERFLOW_L2
  ([min(0, `*s->init_msg`), +oo] - 1):unsigned32 by call to `ssl3_get_key_exchange`.
Showing all 9 steps of the trace


ssl/s3_clnt.c:182:1: Parameter `*s->init_msg`
180.                            ssl3_connect, ssl3_get_client_method)
181.   #endif
182. > int ssl3_connect(SSL *s)
183.   {
184.       BUF_MEM *buf = NULL;

ssl/s3_clnt.c:353:19: Call
351.           case SSL3_ST_CR_KEY_EXCH_A:
352.           case SSL3_ST_CR_KEY_EXCH_B:
353.               ret = ssl3_get_key_exchange(s);
                         ^
354.               if (ret <= 0)
355.                   goto end;

ssl/s3_clnt.c:1462:9: Assignment
  1460.   #ifndef OPENSSL_NO_SRP
  1461.       if (alg_k & SSL_kSRP) {
  1462.           param_len = 2;
                  ^
  1463.           if (param_len > n) {
  1464.               SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE, SSL_R_LENGTH_TOO_SHORT);

ssl/s3_clnt.c:1505:9: Assignment
  1503.               goto f_err;
  1504.           }
  1505.           param_len += 1;
                  ^
  1506.   
  1507.           i = (unsigned int)(p[0]);

ssl/s3_clnt.c:1516:30: Call
  1514.           param_len += i;
  1515.   
  1516.           if (!(s->srp_ctx.s = BN_bin2bn(p, i, NULL))) {
                                       ^
  1517.               SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE, ERR_R_BN_LIB);
  1518.               goto err;

crypto/bn/bn_lib.c:523:1: <LHS trace>
521.   }
522.   
523. > BIGNUM *BN_bin2bn(const unsigned char *s, int len, BIGNUM *ret)
524.   {
525.       unsigned int i, m;

crypto/bn/bn_lib.c:523:1: Parameter `len`
    521.   }
    522.   
    523. > BIGNUM *BN_bin2bn(const unsigned char *s, int len, BIGNUM *ret)
    524.   {
    525.       unsigned int i, m;

crypto/bn/bn_lib.c:536:5: Assignment
    534.       bn_check_top(ret);
    535.       l = 0;
    536.       n = len;
               ^
    537.       if (n == 0) {
    538.           ret->top = 0;

crypto/bn/bn_lib.c:541:5: Binary operation: ([min(0, *s->init_msg), +oo] - 1):unsigned32 by call to `ssl3_get_key_exchange` 
    539.           return (ret);
    540.       }
    541.       i = ((n - 1) / BN_BYTES) + 1;
               ^
    542.       m = ((n - 1) % (BN_BYTES));
    543.       if (bn_wexpand(ret, (int)i) == NULL) {
