ssl/statem/statem_dtls.c:709: error: INTEGER_OVERFLOW_L2
  ([2, max(2147483644, `s->init_buf->max`)] - [1, 2147483644]):unsigned64 by call to `dtls1_retrieve_buffered_fragment`.
Showing all 13 steps of the trace


ssl/statem/statem_dtls.c:699:1: Parameter `s->init_buf->max`
697.   }
698.   
699. > static int dtls_get_reassembled_message(SSL *s, long *len)
700.   {
701.       unsigned char wire[DTLS1_HM_HEADER_LENGTH];

ssl/statem/statem_dtls.c:709:21: Call
707.    redo:
708.       /* see if we have the required fragment already */
709.       if ((frag_len = dtls1_retrieve_buffered_fragment(s, &ok)) || ok) {
                           ^
710.           if (ok)
711.               s->init_num = frag_len;

ssl/statem/statem_dtls.c:432:1: Parameter `s->init_buf->max`
  430.   }
  431.   
  432. > static int dtls1_retrieve_buffered_fragment(SSL *s, int *ok)
  433.   {
  434.       /*-

ssl/statem/statem_dtls.c:459:14: Call
  457.           pqueue_pop(s->d1->buffered_messages);
  458.   
  459.           al = dtls1_preprocess_fragment(s, &frag->msg_header);
                      ^
  460.   
  461.           if (al == 0) {          /* no alert */

ssl/statem/statem_dtls.c:391:1: Parameter `s->init_buf->max`
    389.   }
    390.   
    391. > static int dtls1_preprocess_fragment(SSL *s, struct hm_header_st *msg_hdr)
    392.   {
    393.       size_t frag_off, frag_len, msg_len;

ssl/statem/statem_dtls.c:410:14: Call
    408.            * above
    409.            */
    410.           if (!BUF_MEM_grow_clean(s->init_buf, msg_len + DTLS1_HM_HEADER_LENGTH)) {
                        ^
    411.               SSLerr(SSL_F_DTLS1_PREPROCESS_FRAGMENT, ERR_R_BUF_LIB);
    412.               return SSL_AD_INTERNAL_ERROR;

crypto/buffer/buffer.c:109:1: Parameter `len`
      107.   }
      108.   
      109. > size_t BUF_MEM_grow_clean(BUF_MEM *str, size_t len)
      110.   {
      111.       char *ret;

crypto/buffer/buffer.c:134:15: Call
      132.           ret = sec_alloc_realloc(str, n);
      133.       else
      134.           ret = OPENSSL_clear_realloc(str->data, str->max, n);
                           ^
      135.       if (ret == NULL) {
      136.           BUFerr(BUF_F_BUF_MEM_GROW_CLEAN, ERR_R_MALLOC_FAILURE);

crypto/mem.c:136:1: <LHS trace>
134.   }
135.   
136. > void *CRYPTO_clear_realloc(void *str, size_t old_len, size_t num,
137.                              const char *file, int line)
138.   {

crypto/mem.c:136:1: Parameter `num`
        134.   }
        135.   
        136. > void *CRYPTO_clear_realloc(void *str, size_t old_len, size_t num,
        137.                              const char *file, int line)
        138.   {

crypto/mem.c:136:1: <RHS trace>
134.   }
135.   
136. > void *CRYPTO_clear_realloc(void *str, size_t old_len, size_t num,
137.                              const char *file, int line)
138.   {

crypto/mem.c:136:1: Parameter `num`
        134.   }
        135.   
        136. > void *CRYPTO_clear_realloc(void *str, size_t old_len, size_t num,
        137.                              const char *file, int line)
        138.   {

crypto/mem.c:151:9: Binary operation: ([2, max(2147483644, s->init_buf->max)] - [1, 2147483644]):unsigned64 by call to `dtls1_retrieve_buffered_fragment` 
        149.       /* Can't shrink the buffer since memcpy below copies |old_len| bytes. */
        150.       if (num < old_len) {
        151.           OPENSSL_cleanse((char*)str + num, old_len - num);
                       ^
        152.           return str;
        153.       }
