ssl/statem/statem_srvr.c:2034: error: INTEGER_OVERFLOW_L2
  ([2, max(2147483644, `s->init_buf->max`)] - [1, 2147483644]):unsigned64 by call to `BUF_MEM_grow_clean`.
Showing all 9 steps of the trace


ssl/statem/statem_srvr.c:1992:1: Parameter `s->init_buf->max`
1990.   }
1991.   
1992. > int tls_construct_certificate_request(SSL *s)
1993.   {
1994.       unsigned char *p, *d;

ssl/statem/statem_srvr.c:2034:18: Call
2032.               name = sk_X509_NAME_value(sk, i);
2033.               j = i2d_X509_NAME(name, NULL);
2034.               if (!BUF_MEM_grow_clean
                         ^
2035.                   (buf, SSL_HM_HEADER_LENGTH(s) + n + j + 2)) {
2036.                   SSLerr(SSL_F_TLS_CONSTRUCT_CERTIFICATE_REQUEST,

crypto/buffer/buffer.c:158:1: Parameter `len`
  156.   }
  157.   
  158. > size_t BUF_MEM_grow_clean(BUF_MEM *str, size_t len)
  159.   {
  160.       char *ret;

crypto/buffer/buffer.c:182:15: Call
  180.           ret = sec_alloc_realloc(str, n);
  181.       else
  182.           ret = OPENSSL_clear_realloc(str->data, str->max, n);
                       ^
  183.       if (ret == NULL) {
  184.           BUFerr(BUF_F_BUF_MEM_GROW_CLEAN, ERR_R_MALLOC_FAILURE);

crypto/mem.c:193:1: <LHS trace>
191.   }
192.   
193. > void *CRYPTO_clear_realloc(void *str, size_t old_len, size_t num,
194.                              const char *file, int line)
195.   {

crypto/mem.c:193:1: Parameter `num`
    191.   }
    192.   
    193. > void *CRYPTO_clear_realloc(void *str, size_t old_len, size_t num,
    194.                              const char *file, int line)
    195.   {

crypto/mem.c:193:1: <RHS trace>
191.   }
192.   
193. > void *CRYPTO_clear_realloc(void *str, size_t old_len, size_t num,
194.                              const char *file, int line)
195.   {

crypto/mem.c:193:1: Parameter `num`
    191.   }
    192.   
    193. > void *CRYPTO_clear_realloc(void *str, size_t old_len, size_t num,
    194.                              const char *file, int line)
    195.   {

crypto/mem.c:208:9: Binary operation: ([2, max(2147483644, s->init_buf->max)] - [1, 2147483644]):unsigned64 by call to `BUF_MEM_grow_clean` 
    206.       /* Can't shrink the buffer since memcpy below copies |old_len| bytes. */
    207.       if (num < old_len) {
    208.           memset((char*)str + num, 0, old_len - num);
                   ^
    209.           return str;
    210.       }
