ssl/ssl_cert.c:844: error: INTEGER_OVERFLOW_L2
  ([2, max(2147483644, `s->init_buf->max`)] - [1, 2147483644]):unsigned64 by call to `ssl_add_cert_to_buf`.
Showing all 13 steps of the trace


ssl/ssl_cert.c:771:1: Parameter `s->init_buf->max`
769.   
770.   /* Add certificate chain to internal SSL BUF_MEM structure */
771. > int ssl_add_cert_chain(SSL *s, CERT_PKEY *cpk, unsigned long *l)
772.   {
773.       BUF_MEM *buf = s->init_buf;

ssl/ssl_cert.c:781:10: Call
779.   
780.       /* TLSv1 sends a chain with nothing in it, instead of an alert */
781.       if (!BUF_MEM_grow_clean(buf, 10)) {
                ^
782.           SSLerr(SSL_F_SSL_ADD_CERT_CHAIN, ERR_R_BUF_LIB);
783.           return 0;

crypto/buffer/buffer.c:109:1: Parameter `len`
  107.   }
  108.   
  109. > size_t BUF_MEM_grow_clean(BUF_MEM *str, size_t len)
  110.   {
  111.       char *ret;

ssl/ssl_cert.c:844:18: Call
842.               x = sk_X509_value(chain, i);
843.   
844.               if (!ssl_add_cert_to_buf(buf, l, x)) {
                        ^
845.                   X509_STORE_CTX_free(xs_ctx);
846.                   return 0;

ssl/ssl_cert.c:747:1: Parameter `buf->max`
  745.   /* Add a certificate to a BUF_MEM structure */
  746.   
  747. > static int ssl_add_cert_to_buf(BUF_MEM *buf, unsigned long *l, X509 *x)
  748.   {
  749.       int n;

ssl/ssl_cert.c:753:19: Call
  751.   
  752.       n = i2d_X509(x, NULL);
  753.       if (n < 0 || !BUF_MEM_grow_clean(buf, (int)(n + (*l) + 3))) {
                           ^
  754.           SSLerr(SSL_F_SSL_ADD_CERT_TO_BUF, ERR_R_BUF_LIB);
  755.           return 0;

crypto/buffer/buffer.c:109:1: Parameter `len`
    107.   }
    108.   
    109. > size_t BUF_MEM_grow_clean(BUF_MEM *str, size_t len)
    110.   {
    111.       char *ret;

crypto/buffer/buffer.c:134:15: Call
    132.           ret = sec_alloc_realloc(str, n);
    133.       else
    134.           ret = OPENSSL_clear_realloc(str->data, str->max, n);
                         ^
    135.       if (ret == NULL) {
    136.           BUFerr(BUF_F_BUF_MEM_GROW_CLEAN, ERR_R_MALLOC_FAILURE);

crypto/mem.c:136:1: <LHS trace>
134.   }
135.   
136. > void *CRYPTO_clear_realloc(void *str, size_t old_len, size_t num,
137.                              const char *file, int line)
138.   {

crypto/mem.c:136:1: Parameter `num`
      134.   }
      135.   
      136. > void *CRYPTO_clear_realloc(void *str, size_t old_len, size_t num,
      137.                              const char *file, int line)
      138.   {

crypto/mem.c:136:1: <RHS trace>
134.   }
135.   
136. > void *CRYPTO_clear_realloc(void *str, size_t old_len, size_t num,
137.                              const char *file, int line)
138.   {

crypto/mem.c:136:1: Parameter `num`
      134.   }
      135.   
      136. > void *CRYPTO_clear_realloc(void *str, size_t old_len, size_t num,
      137.                              const char *file, int line)
      138.   {

crypto/mem.c:151:9: Binary operation: ([2, max(2147483644, s->init_buf->max)] - [1, 2147483644]):unsigned64 by call to `ssl_add_cert_to_buf` 
      149.       /* Can't shrink the buffer since memcpy below copies |old_len| bytes. */
      150.       if (num < old_len) {
      151.           OPENSSL_cleanse((char*)str + num, old_len - num);
                     ^
      152.           return str;
      153.       }
