ssl/d1_both.c:623: error: INTEGER_OVERFLOW_L2
  ([-oo, 2147483647] + 3):signed32 by call to `BUF_MEM_grow_clean`.
Showing all 8 steps of the trace


ssl/d1_both.c:563:2: Call
561.   	/* parse the message fragment header */
562.   
563.   	dtls1_get_message_header(p, &msg_hdr);
        ^
564.   
565.   	/* 

ssl/d1_both.c:1240:1: Parameter `*data`
  1238.   	}
  1239.   
  1240. > void
  1241.   dtls1_get_message_header(unsigned char *data, struct hm_header_st *msg_hdr)
  1242.   	{

ssl/d1_both.c:1245:2: Assignment
  1243.   	memset(msg_hdr, 0x00, sizeof(struct hm_header_st));
  1244.   	msg_hdr->type = *(data++);
  1245.   	n2l3(data, msg_hdr->msg_len);
           ^
  1246.   
  1247.   	n2s(data, msg_hdr->seq);

ssl/d1_both.c:572:2: Assignment
570.   		return dtls1_process_out_of_seq_message(s, &msg_hdr, ok);
571.   
572.   	l = msg_hdr.msg_len;
        ^
573.   	frag_off = msg_hdr.frag_off;
574.   	frag_len = msg_hdr.frag_len;

ssl/d1_both.c:623:13: Call
621.   			goto f_err;
622.   			}
623.   		if (l && !BUF_MEM_grow_clean(s->init_buf,(int)l
                   ^
624.   			+ DTLS1_HM_HEADER_LENGTH))
625.   			{

crypto/buffer/buffer.c:128:1: <LHS trace>
126.   	}
127.   
128. > int BUF_MEM_grow_clean(BUF_MEM *str, int len)
129.   	{
130.   	char *ret;

crypto/buffer/buffer.c:128:1: Parameter `len`
  126.   	}
  127.   
  128. > int BUF_MEM_grow_clean(BUF_MEM *str, int len)
  129.   	{
  130.   	char *ret;

crypto/buffer/buffer.c:145:2: Binary operation: ([-oo, 2147483647] + 3):signed32 by call to `BUF_MEM_grow_clean` 
  143.   		return(len);
  144.   		}
  145.   	n=(len+3)/3*4;
          ^
  146.   	if (str->data == NULL)
  147.   		ret=OPENSSL_malloc(n);
