ssl/statem/statem_srvr.c:3101: error: INTEGER_OVERFLOW_L2
  ([0, +oo] - 2):unsigned64 by call to `WPACKET_close`.
Showing all 11 steps of the trace


ssl/statem/statem_srvr.c:3076:17: Call
3074.       if (!WPACKET_put_bytes_u32(&pkt, s->hit ? 0 : s->session->timeout)
3075.                  /* Now the actual ticket data */
3076.               || !WPACKET_start_sub_packet_u16(&pkt)
                        ^
3077.               || !WPACKET_get_total_written(&pkt, &macoffset)
3078.                  /* Output key name */

ssl/packet.c:224:1: Parameter `lenbytes`
  222.   }
  223.   
  224. > int WPACKET_start_sub_packet_len__(WPACKET *pkt, size_t lenbytes)
  225.   {
  226.       WPACKET_SUB *sub;

ssl/packet.c:241:5: Assignment
  239.       pkt->subs = sub;
  240.       sub->pwritten = pkt->written + lenbytes;
  241.       sub->lenbytes = lenbytes;
             ^
  242.   
  243.       if (lenbytes == 0) {

ssl/statem/statem_srvr.c:3101:17: Call
3099.               || !WPACKET_allocate_bytes(&pkt, hlen, &macdata2)
3100.               || macdata1 != macdata2
3101.               || !WPACKET_close(&pkt)
                        ^
3102.               || !ssl_close_construct_packet(s, &pkt)) {
3103.           SSLerr(SSL_F_TLS_CONSTRUCT_NEW_SESSION_TICKET, ERR_R_INTERNAL_ERROR);

ssl/packet.c:192:1: Parameter `pkt->curr`
  190.   }
  191.   
  192. > int WPACKET_close(WPACKET *pkt)
  193.   {
  194.       /*

ssl/packet.c:201:12: Call
  199.           return 0;
  200.   
  201.       return wpacket_intern_close(pkt);
                    ^
  202.   }
  203.   

ssl/packet.c:158:1: <LHS trace>
156.    * close a sub-packet and write out its length if necessary.
157.    */
158. > static int wpacket_intern_close(WPACKET *pkt)
159.   {
160.       WPACKET_SUB *sub = pkt->subs;

ssl/packet.c:158:1: Parameter `pkt->curr`
    156.    * close a sub-packet and write out its length if necessary.
    157.    */
    158. > static int wpacket_intern_close(WPACKET *pkt)
    159.   {
    160.       WPACKET_SUB *sub = pkt->subs;

ssl/packet.c:158:1: <RHS trace>
156.    * close a sub-packet and write out its length if necessary.
157.    */
158. > static int wpacket_intern_close(WPACKET *pkt)
159.   {
160.       WPACKET_SUB *sub = pkt->subs;

ssl/packet.c:158:1: Parameter `pkt->subs->lenbytes`
    156.    * close a sub-packet and write out its length if necessary.
    157.    */
    158. > static int wpacket_intern_close(WPACKET *pkt)
    159.   {
    160.       WPACKET_SUB *sub = pkt->subs;

ssl/packet.c:170:13: Binary operation: ([0, +oo] - 2):unsigned64 by call to `WPACKET_close` 
    168.               && sub->flags & WPACKET_FLAGS_ABANDON_ON_ZERO_LENGTH) {
    169.           /* Deallocate any bytes allocated for the length of the WPACKET */
    170.           if ((pkt->curr - sub->lenbytes) == sub->packet_len) {
                       ^
    171.               pkt->written -= sub->lenbytes;
    172.               pkt->curr -= sub->lenbytes;
