ssl/statem/statem_dtls.c:738: error: INTEGER_OVERFLOW_L2
  ([2, max(2147483644, `s->init_buf->max`)] - [1, 2147483644]):unsigned64 by call to `dtls1_retrieve_buffered_fragment`.
Showing all 13 steps of the trace


ssl/statem/statem_dtls.c:726:1: Parameter `s->init_buf->max`
724.   }
725.   
726. > static int dtls_get_reassembled_message(SSL *s, int *errtype, size_t *len)
727.   {
728.       unsigned char wire[DTLS1_HM_HEADER_LENGTH];

ssl/statem/statem_dtls.c:738:11: Call
736.    redo:
737.       /* see if we have the required fragment already */
738.       ret = dtls1_retrieve_buffered_fragment(s, &frag_len);
                 ^
739.       if (ret < 0) {
740.           /* SSLfatal() already called */

ssl/statem/statem_dtls.c:456:1: Parameter `s->init_buf->max`
  454.    * fatal error.
  455.    */
  456. > static int dtls1_retrieve_buffered_fragment(SSL *s, size_t *len)
  457.   {
  458.       /*-

ssl/statem/statem_dtls.c:494:15: Call
  492.   
  493.           /* Calls SSLfatal() as required */
  494.           ret = dtls1_preprocess_fragment(s, &frag->msg_header);
                       ^
  495.   
  496.           if (ret) {

ssl/statem/statem_dtls.c:407:1: Parameter `s->init_buf->max`
    405.   }
    406.   
    407. > static int dtls1_preprocess_fragment(SSL *s, struct hm_header_st *msg_hdr)
    408.   {
    409.       size_t frag_off, frag_len, msg_len;

ssl/statem/statem_dtls.c:428:14: Call
    426.            * dtls_max_handshake_message_len(s) above
    427.            */
    428.           if (!BUF_MEM_grow_clean(s->init_buf, msg_len + DTLS1_HM_HEADER_LENGTH)) {
                        ^
    429.               SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_DTLS1_PREPROCESS_FRAGMENT,
    430.                        ERR_R_BUF_LIB);

crypto/buffer/buffer.c:111:1: Parameter `len`
      109.   }
      110.   
      111. > size_t BUF_MEM_grow_clean(BUF_MEM *str, size_t len)
      112.   {
      113.       char *ret;

crypto/buffer/buffer.c:136:15: Call
      134.           ret = sec_alloc_realloc(str, n);
      135.       else
      136.           ret = OPENSSL_clear_realloc(str->data, str->max, n);
                           ^
      137.       if (ret == NULL) {
      138.           BUFerr(BUF_F_BUF_MEM_GROW_CLEAN, ERR_R_MALLOC_FAILURE);

crypto/mem.c:259:1: <LHS trace>
257.   }
258.   
259. > void *CRYPTO_clear_realloc(void *str, size_t old_len, size_t num,
260.                              const char *file, int line)
261.   {

crypto/mem.c:259:1: Parameter `num`
        257.   }
        258.   
        259. > void *CRYPTO_clear_realloc(void *str, size_t old_len, size_t num,
        260.                              const char *file, int line)
        261.   {

crypto/mem.c:259:1: <RHS trace>
257.   }
258.   
259. > void *CRYPTO_clear_realloc(void *str, size_t old_len, size_t num,
260.                              const char *file, int line)
261.   {

crypto/mem.c:259:1: Parameter `num`
        257.   }
        258.   
        259. > void *CRYPTO_clear_realloc(void *str, size_t old_len, size_t num,
        260.                              const char *file, int line)
        261.   {

crypto/mem.c:274:9: Binary operation: ([2, max(2147483644, s->init_buf->max)] - [1, 2147483644]):unsigned64 by call to `dtls1_retrieve_buffered_fragment` 
        272.       /* Can't shrink the buffer since memcpy below copies |old_len| bytes. */
        273.       if (num < old_len) {
        274.           OPENSSL_cleanse((char*)str + num, old_len - num);
                       ^
        275.           return str;
        276.       }
