ssl/record/rec_layer_d1.c:441: error: INTEGER_OVERFLOW_L2
  ([0, max(1, `s->rlayer.numwpipes`)] - 1):unsigned64 by call to `dtls1_read_failed`.
Showing all 25 steps of the trace


ssl/record/rec_layer_d1.c:338:1: Parameter `s->rlayer.numwpipes`
336.    *             none of our business
337.    */
338. > int dtls1_read_bytes(SSL *s, int type, int *recvd_type, unsigned char *buf,
339.                        size_t len, int peek, size_t *readbytes)
340.   {

ssl/record/rec_layer_d1.c:433:9: Call
431.   
432.       /* Check for timeout */
433.       if (dtls1_handle_timeout(s) > 0)
               ^
434.           goto start;
435.   

ssl/d1_lib.c:365:1: Parameter `s->rlayer.numwpipes`
  363.   }
  364.   
  365. > int dtls1_handle_timeout(SSL *s)
  366.   {
  367.       /* if no timer is expired, don't do anything */

ssl/record/rec_layer_d1.c:439:16: Call
437.       if ((SSL3_RECORD_get_length(rr) == 0)
438.           || (s->rlayer.rstate == SSL_ST_READ_BODY)) {
439.           iret = dtls1_get_record(s);
                      ^
440.           if (iret <= 0) {
441.               iret = dtls1_read_failed(s, iret);

ssl/record/ssl3_record.c:1523:1: Parameter `s->rlayer.numwpipes`
  1521.    */
  1522.   /* used only by dtls1_read_bytes */
  1523. > int dtls1_get_record(SSL *s)
  1524.   {
  1525.       int ssl_major, ssl_minor;

ssl/record/ssl3_record.c:1541:10: Call
  1539.        * This is a non-blocking operation.
  1540.        */
  1541.       if (!dtls1_process_buffered_records(s))
                   ^
  1542.           return -1;
  1543.   

ssl/record/rec_layer_d1.c:229:1: Parameter `s->rlayer.numwpipes`
    227.                      &((s)->rlayer.d->unprocessed_rcds))
    228.   
    229. > int dtls1_process_buffered_records(SSL *s)
    230.   {
    231.       pitem *item;

ssl/record/rec_layer_d1.c:441:20: Call
439.           iret = dtls1_get_record(s);
440.           if (iret <= 0) {
441.               iret = dtls1_read_failed(s, iret);
                          ^
442.               /* anything other than a timeout is an error */
443.               if (iret <= 0)

ssl/statem/statem_dtls.c:908:1: Parameter `s->rlayer.numwpipes`
  906.   #endif
  907.   
  908. > int dtls1_read_failed(SSL *s, int code)
  909.   {
  910.       if (code > 0) {

ssl/statem/statem_dtls.c:929:12: Call
  927.       }
  928.   
  929.       return dtls1_handle_timeout(s);
                    ^
  930.   }
  931.   

ssl/d1_lib.c:365:1: Parameter `s->rlayer.numwpipes`
    363.   }
    364.   
    365. > int dtls1_handle_timeout(SSL *s)
    366.   {
    367.       /* if no timer is expired, don't do anything */

ssl/d1_lib.c:383:12: Call
    381.   
    382.       dtls1_start_timer(s);
    383.       return dtls1_retransmit_buffered_messages(s);
                      ^
    384.   }
    385.   

ssl/statem/statem_dtls.c:947:1: Parameter `s->rlayer.numwpipes`
      945.   }
      946.   
      947. > int dtls1_retransmit_buffered_messages(SSL *s)
      948.   {
      949.       pqueue *sent = s->d1->sent_messages;

ssl/statem/statem_dtls.c:959:13: Call
      957.       for (item = pqueue_next(&iter); item != NULL; item = pqueue_next(&iter)) {
      958.           frag = (hm_fragment *)item->data;
      959.           if (dtls1_retransmit_message(s, (unsigned short)
                         ^
      960.                                        dtls1_get_queue_priority
      961.                                        (frag->msg_header.seq,

ssl/statem/statem_dtls.c:1033:1: Parameter `s->rlayer.numwpipes`
        1031.   }
        1032.   
        1033. > int dtls1_retransmit_message(SSL *s, unsigned short seq, int *found)
        1034.   {
        1035.       int ret;

ssl/statem/statem_dtls.c:1095:11: Call
        1093.                                           saved_retransmit_state.epoch);
        1094.   
        1095.       ret = dtls1_do_write(s, frag->msg_header.is_ccs ?
                          ^
        1096.                            SSL3_RT_CHANGE_CIPHER_SPEC : SSL3_RT_HANDSHAKE);
        1097.   

ssl/statem/statem_dtls.c:110:1: Parameter `s->rlayer.numwpipes`
          108.    * SSL3_RT_CHANGE_CIPHER_SPEC)
          109.    */
          110. > int dtls1_do_write(SSL *s, int type)
          111.   {
          112.       int ret;

ssl/statem/statem_dtls.c:235:15: Call
          233.           }
          234.   
          235.           ret = dtls1_write_bytes(s, type, &s->init_buf->data[s->init_off], len,
                               ^
          236.                                   &written);
          237.           if (ret < 0) {

ssl/record/rec_layer_d1.c:959:1: Parameter `s->rlayer.numwpipes`
            957.    * not all data has been sent or non-blocking IO.
            958.    */
            959. > int dtls1_write_bytes(SSL *s, int type, const void *buf, size_t len,
            960.                         size_t *written)
            961.   {

ssl/record/rec_layer_d1.c:966:9: Call
            964.       OPENSSL_assert(len <= SSL3_RT_MAX_PLAIN_LENGTH);
            965.       s->rwstate = SSL_NOTHING;
            966.       i = do_dtls1_write(s, type, buf, len, 0, written);
                           ^
            967.       return i;
            968.   }

ssl/record/rec_layer_d1.c:970:1: Parameter `s->rlayer.numwpipes`
              968.   }
              969.   
              970. > int do_dtls1_write(SSL *s, int type, const unsigned char *buf,
              971.                      size_t len, int create_empty_fragment, size_t *written)
              972.   {

ssl/record/rec_layer_d1.c:1166:12: Call
              1164.   
              1165.       /* we now just need to write the buffer */
              1166.       return ssl3_write_pending(s, type, buf, len, written);
                                 ^
              1167.    err:
              1168.       return -1;

ssl/record/rec_layer_s3.c:899:1: <LHS trace>
897.    * Return values are as per SSL_write()
898.    */
899. > int ssl3_write_pending(SSL *s, int type, const unsigned char *buf, size_t len,
900.                          size_t *written)
901.   {

ssl/record/rec_layer_s3.c:899:1: Parameter `s->rlayer.numwpipes`
                897.    * Return values are as per SSL_write()
                898.    */
                899. > int ssl3_write_pending(SSL *s, int type, const unsigned char *buf, size_t len,
                900.                          size_t *written)
                901.   {

ssl/record/rec_layer_s3.c:918:16: Binary operation: ([0, max(1, s->rlayer.numwpipes)] - 1):unsigned64 by call to `dtls1_read_failed` 
                916.           /* Loop until we find a buffer we haven't written out yet */
                917.           if (SSL3_BUFFER_get_left(&wb[currbuf]) == 0
                918.               && currbuf < s->rlayer.numwpipes - 1) {
                                      ^
                919.               currbuf++;
                920.               continue;
