ssl/statem/statem_clnt.c:2850: error: INTEGER_OVERFLOW_L2
  ([0, +oo] - [`pkt->written`, `pkt->written` + 2]):unsigned64 by call to `WPACKET_allocate_bytes`.
Showing all 9 steps of the trace


ssl/statem/statem_clnt.c:2794:1: Parameter `pkt->written`
2792.   }
2793.   
2794. > static int tls_construct_cke_rsa(SSL *s, WPACKET *pkt)
2795.   {
2796.   #ifndef OPENSSL_NO_RSA

ssl/statem/statem_clnt.c:2850:10: Call
2848.           goto err;
2849.       }
2850.       if (!WPACKET_allocate_bytes(pkt, enclen, &encdata)
                 ^
2851.               || EVP_PKEY_encrypt(pctx, encdata, &enclen, pms, pmslen) <= 0) {
2852.           SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CKE_RSA,

ssl/packet.c:15:1: Parameter `pkt->written`
  13.   #define DEFAULT_BUF_SIZE    256
  14.   
  15. > int WPACKET_allocate_bytes(WPACKET *pkt, size_t len, unsigned char **allocbytes)
  16.   {
  17.       if (!WPACKET_reserve_bytes(pkt, len, allocbytes))

ssl/packet.c:17:10: Call
  15.   int WPACKET_allocate_bytes(WPACKET *pkt, size_t len, unsigned char **allocbytes)
  16.   {
  17.       if (!WPACKET_reserve_bytes(pkt, len, allocbytes))
                 ^
  18.           return 0;
  19.   

ssl/packet.c:39:1: <LHS trace>
37.                        ? (p)->staticbuf : (unsigned char *)(p)->buf->data)
38.   
39. > int WPACKET_reserve_bytes(WPACKET *pkt, size_t len, unsigned char **allocbytes)
40.   {
41.       /* Internal API, so should not fail */

ssl/packet.c:39:1: Parameter `pkt->buf->length`
    37.                        ? (p)->staticbuf : (unsigned char *)(p)->buf->data)
    38.   
    39. > int WPACKET_reserve_bytes(WPACKET *pkt, size_t len, unsigned char **allocbytes)
    40.   {
    41.       /* Internal API, so should not fail */

ssl/packet.c:39:1: <RHS trace>
37.                        ? (p)->staticbuf : (unsigned char *)(p)->buf->data)
38.   
39. > int WPACKET_reserve_bytes(WPACKET *pkt, size_t len, unsigned char **allocbytes)
40.   {
41.       /* Internal API, so should not fail */

ssl/packet.c:39:1: Parameter `len`
    37.                        ? (p)->staticbuf : (unsigned char *)(p)->buf->data)
    38.   
    39. > int WPACKET_reserve_bytes(WPACKET *pkt, size_t len, unsigned char **allocbytes)
    40.   {
    41.       /* Internal API, so should not fail */

ssl/packet.c:48:36: Binary operation: ([0, +oo] - [pkt->written, pkt->written + 2]):unsigned64 by call to `WPACKET_allocate_bytes` 
    46.           return 0;
    47.   
    48.       if (pkt->staticbuf == NULL && (pkt->buf->length - pkt->written < len)) {
                                             ^
    49.           size_t newlen;
    50.           size_t reflen;
