ssl/record/ssl3_record.c:634: error: INTEGER_OVERFLOW_L2
  ([0, +oo] - 1):unsigned32 by call to `ssl3_cbc_remove_padding`.
Showing all 5 steps of the trace


ssl/record/ssl3_record.c:575:1: Parameter `s->rlayer.rrec.length`
573.    *       occurred.
574.    */
575. > int ssl3_enc(SSL *s, int send)
576.   {
577.       SSL3_RECORD *rec;

ssl/record/ssl3_record.c:634:20: Call
632.               mac_size = EVP_MD_CTX_size(s->read_hash);
633.           if ((bs != 1) && !send)
634.               return ssl3_cbc_remove_padding(s, rec, bs, mac_size);
                          ^
635.       }
636.       return (1);

ssl/record/ssl3_record.c:1005:1: <LHS trace>
1003.    *  -1: otherwise.
1004.    */
1005. > int ssl3_cbc_remove_padding(const SSL *s,
1006.                               SSL3_RECORD *rec,
1007.                               unsigned block_size, unsigned mac_size)

ssl/record/ssl3_record.c:1005:1: Parameter `rec->length`
  1003.    *  -1: otherwise.
  1004.    */
  1005. > int ssl3_cbc_remove_padding(const SSL *s,
  1006.                               SSL3_RECORD *rec,
  1007.                               unsigned block_size, unsigned mac_size)

ssl/record/ssl3_record.c:1018:22: Binary operation: ([0, +oo] - 1):unsigned32 by call to `ssl3_cbc_remove_padding` 
  1016.           return 0;
  1017.   
  1018.       padding_length = rec->data[rec->length - 1];
                               ^
  1019.       good = constant_time_ge(rec->length, padding_length + overhead);
  1020.       /* SSLv3 requires that the padding is minimal. */
