crypto/asn1_dsa.c:125: error: INTEGER_OVERFLOW_L2
  ([0, +oo] - [0, `pkt->written` + 4]):unsigned64 by call to `encode_der_integer`.
Showing all 21 steps of the trace


crypto/asn1_dsa.c:116:14: Call
114.   
115.       if (!isnull) {
116.           if (!WPACKET_init_null(&tmppkt, 0))
                    ^
117.               return 0;
118.           dummypkt = &tmppkt;

crypto/packet.c:162:12: Call
  160.       pkt->maxsize = maxmaxsize(lenbytes);
  161.   
  162.       return wpacket_intern_init_len(pkt, 0);
                    ^
  163.   }
  164.   

crypto/packet.c:99:5: Assignment
    97.   
    98.       pkt->curr = 0;
    99.       pkt->written = 0;
               ^
    100.   
    101.       if ((pkt->subs = OPENSSL_zalloc(sizeof(*pkt->subs))) == NULL) {

crypto/asn1_dsa.c:125:10: Call
123.   
124.       /* Calculate the content length */
125.       if (!encode_der_integer(dummypkt, r)
                ^
126.               || !encode_der_integer(dummypkt, s)
127.               || !WPACKET_get_length(dummypkt, &cont_len)

crypto/asn1_dsa.c:66:1: Parameter `pkt->maxsize`
  64.    * Returns 1 on success or 0 on error.
  65.    */
  66. > int encode_der_integer(WPACKET *pkt, const BIGNUM *n)
  67.   {
  68.       unsigned char *bnbytes;

crypto/asn1_dsa.c:85:10: Call
  83.       cont_len = BN_num_bits(n) / 8 + 1;
  84.   
  85.       if (!WPACKET_start_sub_packet(pkt)
                 ^
  86.               || !WPACKET_put_bytes_u8(pkt, ID_INTEGER)
  87.               || !encode_der_length(pkt, cont_len)

crypto/packet.c:324:1: Parameter `pkt->maxsize`
    322.   }
    323.   
    324. > int WPACKET_start_sub_packet(WPACKET *pkt)
    325.   {
    326.       return WPACKET_start_sub_packet_len__(pkt, 0);

crypto/packet.c:326:12: Call
    324.   int WPACKET_start_sub_packet(WPACKET *pkt)
    325.   {
    326.       return WPACKET_start_sub_packet_len__(pkt, 0);
                      ^
    327.   }
    328.   

crypto/packet.c:292:1: Parameter `pkt->maxsize`
      290.   }
      291.   
      292. > int WPACKET_start_sub_packet_len__(WPACKET *pkt, size_t lenbytes)
      293.   {
      294.       WPACKET_SUB *sub;

crypto/asn1_dsa.c:86:17: Call
  84.   
  85.       if (!WPACKET_start_sub_packet(pkt)
  86.               || !WPACKET_put_bytes_u8(pkt, ID_INTEGER)
                        ^
  87.               || !encode_der_length(pkt, cont_len)
  88.               || !WPACKET_allocate_bytes(pkt, cont_len, &bnbytes)

crypto/packet.c:329:1: Parameter `pkt->maxsize`
    327.   }
    328.   
    329. > int WPACKET_put_bytes__(WPACKET *pkt, unsigned int val, size_t size)
    330.   {
    331.       unsigned char *data;

crypto/asn1_dsa.c:87:17: Call
  85.       if (!WPACKET_start_sub_packet(pkt)
  86.               || !WPACKET_put_bytes_u8(pkt, ID_INTEGER)
  87.               || !encode_der_length(pkt, cont_len)
                        ^
  88.               || !WPACKET_allocate_bytes(pkt, cont_len, &bnbytes)
  89.               || !WPACKET_close(pkt))

crypto/asn1_dsa.c:39:1: Parameter `pkt->maxsize`
    37.    * Returns 1 on success or 0 on error.
    38.    */
    39. > int encode_der_length(WPACKET *pkt, size_t cont_len)
    40.   {
    41.       if (cont_len > 0xffff)

crypto/asn1_dsa.c:88:17: Call
  86.               || !WPACKET_put_bytes_u8(pkt, ID_INTEGER)
  87.               || !encode_der_length(pkt, cont_len)
  88.               || !WPACKET_allocate_bytes(pkt, cont_len, &bnbytes)
                        ^
  89.               || !WPACKET_close(pkt))
  90.           return 0;

crypto/packet.c:16:1: Parameter `pkt->maxsize`
    14.   #define DEFAULT_BUF_SIZE    256
    15.   
    16. > int WPACKET_allocate_bytes(WPACKET *pkt, size_t len, unsigned char **allocbytes)
    17.   {
    18.       if (!WPACKET_reserve_bytes(pkt, len, allocbytes))

crypto/packet.c:18:10: Call
    16.   int WPACKET_allocate_bytes(WPACKET *pkt, size_t len, unsigned char **allocbytes)
    17.   {
    18.       if (!WPACKET_reserve_bytes(pkt, len, allocbytes))
                   ^
    19.           return 0;
    20.   

crypto/packet.c:43:1: <LHS trace>
41.                           : NULL))
42.   
43. > int WPACKET_reserve_bytes(WPACKET *pkt, size_t len, unsigned char **allocbytes)
44.   {
45.       /* Internal API, so should not fail */

crypto/packet.c:43:1: Parameter `pkt->maxsize`
      41.                           : NULL))
      42.   
      43. > int WPACKET_reserve_bytes(WPACKET *pkt, size_t len, unsigned char **allocbytes)
      44.   {
      45.       /* Internal API, so should not fail */

crypto/packet.c:43:1: <RHS trace>
41.                           : NULL))
42.   
43. > int WPACKET_reserve_bytes(WPACKET *pkt, size_t len, unsigned char **allocbytes)
44.   {
45.       /* Internal API, so should not fail */

crypto/packet.c:43:1: Parameter `pkt->written`
      41.                           : NULL))
      42.   
      43. > int WPACKET_reserve_bytes(WPACKET *pkt, size_t len, unsigned char **allocbytes)
      44.   {
      45.       /* Internal API, so should not fail */

crypto/packet.c:49:9: Binary operation: ([0, +oo] - [0, pkt->written + 4]):unsigned64 by call to `encode_der_integer` 
      47.           return 0;
      48.   
      49.       if (pkt->maxsize - pkt->written < len)
                    ^
      50.           return 0;
      51.   
