ssl/statem/statem_dtls.c:714: error: INTEGER_OVERFLOW_L2
  ([2, max(2147483644, `s->init_buf->max`)] - [1, 2147483644]):unsigned64 by call to `dtls1_retrieve_buffered_fragment`.
Showing all 13 steps of the trace


ssl/statem/statem_dtls.c:704:1: Parameter `s->init_buf->max`
702.   }
703.   
704. > static int dtls_get_reassembled_message(SSL *s, long *len)
705.   {
706.       unsigned char wire[DTLS1_HM_HEADER_LENGTH];

ssl/statem/statem_dtls.c:714:21: Call
712.    redo:
713.       /* see if we have the required fragment already */
714.       if ((frag_len = dtls1_retrieve_buffered_fragment(s, &ok)) || ok) {
                           ^
715.           if (ok)
716.               s->init_num = frag_len;

ssl/statem/statem_dtls.c:436:1: Parameter `s->init_buf->max`
  434.   }
  435.   
  436. > static int dtls1_retrieve_buffered_fragment(SSL *s, int *ok)
  437.   {
  438.       /*-

ssl/statem/statem_dtls.c:463:14: Call
  461.           pqueue_pop(s->d1->buffered_messages);
  462.   
  463.           al = dtls1_preprocess_fragment(s, &frag->msg_header);
                      ^
  464.   
  465.           if (al == 0) {          /* no alert */

ssl/statem/statem_dtls.c:394:1: Parameter `s->init_buf->max`
    392.   }
    393.   
    394. > static int dtls1_preprocess_fragment(SSL *s, struct hm_header_st *msg_hdr)
    395.   {
    396.       size_t frag_off, frag_len, msg_len;

ssl/statem/statem_dtls.c:413:14: Call
    411.            * above
    412.            */
    413.           if (!BUF_MEM_grow_clean
                        ^
    414.               (s->init_buf, msg_len + DTLS1_HM_HEADER_LENGTH)) {
    415.               SSLerr(SSL_F_DTLS1_PREPROCESS_FRAGMENT, ERR_R_BUF_LIB);

crypto/buffer/buffer.c:109:1: Parameter `len`
      107.   }
      108.   
      109. > size_t BUF_MEM_grow_clean(BUF_MEM *str, size_t len)
      110.   {
      111.       char *ret;

crypto/buffer/buffer.c:134:15: Call
      132.           ret = sec_alloc_realloc(str, n);
      133.       else
      134.           ret = OPENSSL_clear_realloc(str->data, str->max, n);
                           ^
      135.       if (ret == NULL) {
      136.           BUFerr(BUF_F_BUF_MEM_GROW_CLEAN, ERR_R_MALLOC_FAILURE);

crypto/mem.c:136:1: <LHS trace>
134.   }
135.   
136. > void *CRYPTO_clear_realloc(void *str, size_t old_len, size_t num,
137.                              const char *file, int line)
138.   {

crypto/mem.c:136:1: Parameter `num`
        134.   }
        135.   
        136. > void *CRYPTO_clear_realloc(void *str, size_t old_len, size_t num,
        137.                              const char *file, int line)
        138.   {

crypto/mem.c:136:1: <RHS trace>
134.   }
135.   
136. > void *CRYPTO_clear_realloc(void *str, size_t old_len, size_t num,
137.                              const char *file, int line)
138.   {

crypto/mem.c:136:1: Parameter `num`
        134.   }
        135.   
        136. > void *CRYPTO_clear_realloc(void *str, size_t old_len, size_t num,
        137.                              const char *file, int line)
        138.   {

crypto/mem.c:151:9: Binary operation: ([2, max(2147483644, s->init_buf->max)] - [1, 2147483644]):unsigned64 by call to `dtls1_retrieve_buffered_fragment` 
        149.       /* Can't shrink the buffer since memcpy below copies |old_len| bytes. */
        150.       if (num < old_len) {
        151.           OPENSSL_cleanse((char*)str + num, old_len - num);
                       ^
        152.           return str;
        153.       }
