ssl/record/rec_layer_d1.c:412: error: INTEGER_OVERFLOW_L2
  ([0, max(1, `s->rlayer.numwpipes`)] - 1):unsigned64 by call to `dtls1_read_failed`.
Showing all 25 steps of the trace


ssl/record/rec_layer_d1.c:331:1: Parameter `s->rlayer.numwpipes`
329.    *             none of our business
330.    */
331. > int dtls1_read_bytes(SSL *s, int type, int *recvd_type, unsigned char *buf,
332.                        size_t len, int peek, size_t *readbytes)
333.   {

ssl/record/rec_layer_d1.c:400:9: Call
398.   
399.       /* Check for timeout */
400.       if (dtls1_handle_timeout(s) > 0) {
               ^
401.           goto start;
402.       } else if (ossl_statem_in_error(s)) {

ssl/d1_lib.c:388:1: Parameter `s->rlayer.numwpipes`
  386.   }
  387.   
  388. > int dtls1_handle_timeout(SSL *s)
  389.   {
  390.       /* if no timer is expired, don't do anything */

ssl/record/rec_layer_d1.c:410:16: Call
408.       if ((SSL3_RECORD_get_length(rr) == 0)
409.           || (s->rlayer.rstate == SSL_ST_READ_BODY)) {
410.           iret = dtls1_get_record(s);
                      ^
411.           if (iret <= 0) {
412.               iret = dtls1_read_failed(s, iret);

ssl/record/ssl3_record.c:1745:1: Parameter `s->rlayer.numwpipes`
  1743.    */
  1744.   /* used only by dtls1_read_bytes */
  1745. > int dtls1_get_record(SSL *s)
  1746.   {
  1747.       int ssl_major, ssl_minor;

ssl/record/ssl3_record.c:1763:10: Call
  1761.        * This is a non-blocking operation.
  1762.        */
  1763.       if (!dtls1_process_buffered_records(s))
                   ^
  1764.           return -1;
  1765.   

ssl/record/rec_layer_d1.c:222:1: Parameter `s->rlayer.numwpipes`
    220.                      &((s)->rlayer.d->unprocessed_rcds))
    221.   
    222. > int dtls1_process_buffered_records(SSL *s)
    223.   {
    224.       pitem *item;

ssl/record/rec_layer_d1.c:412:20: Call
410.           iret = dtls1_get_record(s);
411.           if (iret <= 0) {
412.               iret = dtls1_read_failed(s, iret);
                          ^
413.               /* anything other than a timeout is an error */
414.               if (iret <= 0)

ssl/statem/statem_dtls.c:939:1: Parameter `s->rlayer.numwpipes`
  937.   #endif
  938.   
  939. > int dtls1_read_failed(SSL *s, int code)
  940.   {
  941.       if (code > 0) {

ssl/statem/statem_dtls.c:961:12: Call
  959.       }
  960.   
  961.       return dtls1_handle_timeout(s);
                    ^
  962.   }
  963.   

ssl/d1_lib.c:388:1: Parameter `s->rlayer.numwpipes`
    386.   }
    387.   
    388. > int dtls1_handle_timeout(SSL *s)
    389.   {
    390.       /* if no timer is expired, don't do anything */

ssl/d1_lib.c:409:12: Call
    407.   
    408.       dtls1_start_timer(s);
    409.       return dtls1_retransmit_buffered_messages(s);
                      ^
    410.   }
    411.   

ssl/statem/statem_dtls.c:979:1: Parameter `s->rlayer.numwpipes`
      977.   }
      978.   
      979. > int dtls1_retransmit_buffered_messages(SSL *s)
      980.   {
      981.       pqueue *sent = s->d1->sent_messages;

ssl/statem/statem_dtls.c:991:13: Call
      989.       for (item = pqueue_next(&iter); item != NULL; item = pqueue_next(&iter)) {
      990.           frag = (hm_fragment *)item->data;
      991.           if (dtls1_retransmit_message(s, (unsigned short)
                         ^
      992.                                        dtls1_get_queue_priority
      993.                                        (frag->msg_header.seq,

ssl/statem/statem_dtls.c:1068:1: Parameter `s->rlayer.numwpipes`
        1066.   }
        1067.   
        1068. > int dtls1_retransmit_message(SSL *s, unsigned short seq, int *found)
        1069.   {
        1070.       int ret;

ssl/statem/statem_dtls.c:1126:11: Call
        1124.                                           saved_retransmit_state.epoch);
        1125.   
        1126.       ret = dtls1_do_write(s, frag->msg_header.is_ccs ?
                          ^
        1127.                            SSL3_RT_CHANGE_CIPHER_SPEC : SSL3_RT_HANDSHAKE);
        1128.   

ssl/statem/statem_dtls.c:110:1: Parameter `s->rlayer.numwpipes`
          108.    * SSL3_RT_CHANGE_CIPHER_SPEC)
          109.    */
          110. > int dtls1_do_write(SSL *s, int type)
          111.   {
          112.       int ret;

ssl/statem/statem_dtls.c:240:15: Call
          238.           }
          239.   
          240.           ret = dtls1_write_bytes(s, type, &s->init_buf->data[s->init_off], len,
                               ^
          241.                                   &written);
          242.           if (ret < 0) {

ssl/record/rec_layer_d1.c:738:1: Parameter `s->rlayer.numwpipes`
            736.    * not all data has been sent or non-blocking IO.
            737.    */
            738. > int dtls1_write_bytes(SSL *s, int type, const void *buf, size_t len,
            739.                         size_t *written)
            740.   {

ssl/record/rec_layer_d1.c:748:9: Call
            746.       }
            747.       s->rwstate = SSL_NOTHING;
            748.       i = do_dtls1_write(s, type, buf, len, 0, written);
                           ^
            749.       return i;
            750.   }

ssl/record/rec_layer_d1.c:752:1: Parameter `s->rlayer.numwpipes`
              750.   }
              751.   
              752. > int do_dtls1_write(SSL *s, int type, const unsigned char *buf,
              753.                      size_t len, int create_empty_fragment, size_t *written)
              754.   {

ssl/record/rec_layer_d1.c:944:12: Call
              942.   
              943.       /* we now just need to write the buffer */
              944.       return ssl3_write_pending(s, type, buf, len, written);
                                ^
              945.    err:
              946.       return -1;

ssl/record/rec_layer_s3.c:1056:1: <LHS trace>
1054.    * Return values are as per SSL_write()
1055.    */
1056. > int ssl3_write_pending(SSL *s, int type, const unsigned char *buf, size_t len,
1057.                          size_t *written)
1058.   {

ssl/record/rec_layer_s3.c:1056:1: Parameter `s->rlayer.numwpipes`
                1054.    * Return values are as per SSL_write()
                1055.    */
                1056. > int ssl3_write_pending(SSL *s, int type, const unsigned char *buf, size_t len,
                1057.                          size_t *written)
                1058.   {

ssl/record/rec_layer_s3.c:1075:16: Binary operation: ([0, max(1, s->rlayer.numwpipes)] - 1):unsigned64 by call to `dtls1_read_failed` 
                1073.           /* Loop until we find a buffer we haven't written out yet */
                1074.           if (SSL3_BUFFER_get_left(&wb[currbuf]) == 0
                1075.               && currbuf < s->rlayer.numwpipes - 1) {
                                       ^
                1076.               currbuf++;
                1077.               continue;
