ssl/record/rec_layer_d1.c:242: error: INTEGER_OVERFLOW_L2
  ([0, 17728] - [256, 320]):unsigned32 by call to `dtls1_process_record`.
Showing all 10 steps of the trace


ssl/record/rec_layer_d1.c:229:1: Parameter `s->rlayer.rrec.length`
227.                      &((s)->rlayer.d->unprocessed_rcds))
228.   
229. > int dtls1_process_buffered_records(SSL *s)
230.   {
231.       pitem *item;

ssl/record/rec_layer_d1.c:242:18: Call
240.           while (pqueue_peek(s->rlayer.d->unprocessed_rcds.q)) {
241.               dtls1_get_unprocessed_record(s);
242.               if (!dtls1_process_record(s))
                        ^
243.                   return (0);
244.               if (dtls1_buffer_record(s, &(s->rlayer.d->processed_rcds),

ssl/record/ssl3_record.c:1276:1: Parameter `s->rlayer.rrec.length`
  1274.   }
  1275.   
  1276. > int dtls1_process_record(SSL *s)
  1277.   {
  1278.       int i, al;

ssl/record/ssl3_record.c:1315:5: Assignment
  1313.       /* decrypt in place in 'rr->input' */
  1314.       rr->data = rr->input;
  1315.       rr->orig_len = rr->length;
              ^
  1316.   
  1317.       enc_err = s->method->ssl3_enc->enc(s, rr, 1, 0);

ssl/record/ssl3_record.c:1372:13: Call
  1370.                */
  1371.               mac = mac_tmp;
  1372.               ssl3_cbc_copy_mac(mac_tmp, rr, mac_size);
                      ^
  1373.               rr->length -= mac_size;
  1374.           } else {

ssl/record/ssl3_record.c:1199:1: <LHS trace>
1197.   #define CBC_MAC_ROTATE_IN_PLACE
1198.   
1199. > void ssl3_cbc_copy_mac(unsigned char *out,
1200.                          const SSL3_RECORD *rec, unsigned md_size)
1201.   {

ssl/record/ssl3_record.c:1199:1: Parameter `md_size`
    1197.   #define CBC_MAC_ROTATE_IN_PLACE
    1198.   
    1199. > void ssl3_cbc_copy_mac(unsigned char *out,
    1200.                          const SSL3_RECORD *rec, unsigned md_size)
    1201.   {

ssl/record/ssl3_record.c:1199:1: <RHS trace>
1197.   #define CBC_MAC_ROTATE_IN_PLACE
1198.   
1199. > void ssl3_cbc_copy_mac(unsigned char *out,
1200.                          const SSL3_RECORD *rec, unsigned md_size)
1201.   {

ssl/record/ssl3_record.c:1199:1: Parameter `md_size`
    1197.   #define CBC_MAC_ROTATE_IN_PLACE
    1198.   
    1199. > void ssl3_cbc_copy_mac(unsigned char *out,
    1200.                          const SSL3_RECORD *rec, unsigned md_size)
    1201.   {

ssl/record/ssl3_record.c:1232:9: Binary operation: ([0, 17728] - [256, 320]):unsigned32 by call to `dtls1_process_record` 
    1230.       /* This information is public so it's safe to branch based on it. */
    1231.       if (rec->orig_len > md_size + 255 + 1)
    1232.           scan_start = rec->orig_len - (md_size + 255 + 1);
                    ^
    1233.       /*
    1234.        * div_spoiler contains a multiple of md_size that is used to cause the
