crypto/asn1/tasn_dec.c:1049: error: INTEGER_OVERFLOW_L2
  ([2, max(2147483644, `buf->max`)] - [1, 2147483644]):unsigned64 by call to `collect_data`.
Showing all 11 steps of the trace


crypto/asn1/tasn_dec.c:1004:1: Parameter `buf->max`
1002.   #endif
1003.   
1004. > static int asn1_collect(BUF_MEM *buf, const unsigned char **in, long len,
1005.                           char inf, int tag, int aclass, int depth)
1006.   {

crypto/asn1/tasn_dec.c:1049:29: Call
1047.               if (!asn1_collect(buf, &p, plen, ininf, tag, aclass, depth + 1))
1048.                   return 0;
1049.           } else if (plen && !collect_data(buf, &p, plen))
                                    ^
1050.               return 0;
1051.           len -= p - q;

crypto/asn1/tasn_dec.c:1061:1: Parameter `buf->max`
  1059.   }
  1060.   
  1061. > static int collect_data(BUF_MEM *buf, const unsigned char **p, long plen)
  1062.   {
  1063.       int len;

crypto/asn1/tasn_dec.c:1066:14: Call
  1064.       if (buf) {
  1065.           len = buf->length;
  1066.           if (!BUF_MEM_grow_clean(buf, len + plen)) {
                       ^
  1067.               ASN1err(ASN1_F_COLLECT_DATA, ERR_R_MALLOC_FAILURE);
  1068.               return 0;

crypto/buffer/buffer.c:158:1: Parameter `len`
    156.   }
    157.   
    158. > size_t BUF_MEM_grow_clean(BUF_MEM *str, size_t len)
    159.   {
    160.       char *ret;

crypto/buffer/buffer.c:182:15: Call
    180.           ret = sec_alloc_realloc(str, n);
    181.       else
    182.           ret = OPENSSL_clear_realloc(str->data, str->max, n);
                         ^
    183.       if (ret == NULL) {
    184.           BUFerr(BUF_F_BUF_MEM_GROW_CLEAN, ERR_R_MALLOC_FAILURE);

crypto/mem.c:193:1: <LHS trace>
191.   }
192.   
193. > void *CRYPTO_clear_realloc(void *str, size_t old_len, size_t num,
194.                              const char *file, int line)
195.   {

crypto/mem.c:193:1: Parameter `num`
      191.   }
      192.   
      193. > void *CRYPTO_clear_realloc(void *str, size_t old_len, size_t num,
      194.                              const char *file, int line)
      195.   {

crypto/mem.c:193:1: <RHS trace>
191.   }
192.   
193. > void *CRYPTO_clear_realloc(void *str, size_t old_len, size_t num,
194.                              const char *file, int line)
195.   {

crypto/mem.c:193:1: Parameter `num`
      191.   }
      192.   
      193. > void *CRYPTO_clear_realloc(void *str, size_t old_len, size_t num,
      194.                              const char *file, int line)
      195.   {

crypto/mem.c:208:9: Binary operation: ([2, max(2147483644, buf->max)] - [1, 2147483644]):unsigned64 by call to `collect_data` 
      206.       /* Can't shrink the buffer since memcpy below copies |old_len| bytes. */
      207.       if (num < old_len) {
      208.           memset((char*)str + num, 0, old_len - num);
                     ^
      209.           return str;
      210.       }
