ssl/record/ssl3_record.c:845: error: INTEGER_OVERFLOW_L2
  ([0, +oo] - [0, `*inrecs->data` + 1]):unsigned64 by call to `ssl3_cbc_remove_padding`.
Showing all 8 steps of the trace


ssl/record/ssl3_record.c:774:1: Parameter `*inrecs->data`
772.    *       occurred.
773.    */
774. > int ssl3_enc(SSL *s, SSL3_RECORD *inrecs, size_t n_recs, int sending)
775.   {
776.       SSL3_RECORD *rec;

ssl/record/ssl3_record.c:845:20: Call
843.           }
844.           if ((bs != 1) && !sending)
845.               return ssl3_cbc_remove_padding(rec, bs, mac_size);
                          ^
846.       }
847.       return 1;

ssl/record/ssl3_record.c:1310:1: <LHS trace>
1308.    *  -1: otherwise.
1309.    */
1310. > int ssl3_cbc_remove_padding(SSL3_RECORD *rec,
1311.                               size_t block_size, size_t mac_size)
1312.   {

ssl/record/ssl3_record.c:1310:1: Parameter `rec->length`
  1308.    *  -1: otherwise.
  1309.    */
  1310. > int ssl3_cbc_remove_padding(SSL3_RECORD *rec,
  1311.                               size_t block_size, size_t mac_size)
  1312.   {

ssl/record/ssl3_record.c:1310:1: <RHS trace>
1308.    *  -1: otherwise.
1309.    */
1310. > int ssl3_cbc_remove_padding(SSL3_RECORD *rec,
1311.                               size_t block_size, size_t mac_size)
1312.   {

ssl/record/ssl3_record.c:1310:1: Parameter `*rec->data`
  1308.    *  -1: otherwise.
  1309.    */
  1310. > int ssl3_cbc_remove_padding(SSL3_RECORD *rec,
  1311.                               size_t block_size, size_t mac_size)
  1312.   {

ssl/record/ssl3_record.c:1323:5: Assignment
  1321.           return 0;
  1322.   
  1323.       padding_length = rec->data[rec->length - 1];
              ^
  1324.       good = constant_time_ge_s(rec->length, padding_length + overhead);
  1325.       /* SSLv3 requires that the padding is minimal. */

ssl/record/ssl3_record.c:1327:5: Binary operation: ([0, +oo] - [0, *inrecs->data + 1]):unsigned64 by call to `ssl3_cbc_remove_padding` 
  1325.       /* SSLv3 requires that the padding is minimal. */
  1326.       good &= constant_time_ge_s(block_size, padding_length + 1);
  1327.       rec->length -= good & (padding_length + 1);
              ^
  1328.       return constant_time_select_int_s(good, 1, -1);
  1329.   }
