crypto/ct/ct_b64.c:108: error: INTEGER_OVERFLOW_L2
  ([0, +oo] - 4):unsigned64 by call to `o2i_SCT_signature`.
Showing all 10 steps of the trace


crypto/ct/ct_b64.c:101:14: Call
99.       dec = NULL;
100.   
101.       declen = ct_base64_decode(signature_base64, &dec);
                    ^
102.       if (declen < 0) {
103.           CTerr(CT_F_SCT_NEW_FROM_BASE64, X509_R_BASE64_DECODE_ERROR);

crypto/ct/ct_b64.c:32:9: Assignment
  30.       if (inlen == 0) {
  31.           *out = NULL;
  32.           return 0;
                ^
  33.       }
  34.   

crypto/ct/ct_b64.c:101:5: Assignment
99.       dec = NULL;
100.   
101.       declen = ct_base64_decode(signature_base64, &dec);
           ^
102.       if (declen < 0) {
103.           CTerr(CT_F_SCT_NEW_FROM_BASE64, X509_R_BASE64_DECODE_ERROR);

crypto/ct/ct_b64.c:108:9: Call
106.   
107.       p = dec;
108.       if (o2i_SCT_signature(sct, &p, declen) <= 0)
               ^
109.           goto err;
110.       OPENSSL_free(dec);

crypto/ct/ct_oct.c:24:1: <LHS trace>
22.   #include "ct_locl.h"
23.   
24. > int o2i_SCT_signature(SCT *sct, const unsigned char **in, size_t len)
25.   {
26.       size_t siglen;

crypto/ct/ct_oct.c:24:1: Parameter `len`
  22.   #include "ct_locl.h"
  23.   
  24. > int o2i_SCT_signature(SCT *sct, const unsigned char **in, size_t len)
  25.   {
  26.       size_t siglen;

crypto/ct/ct_oct.c:27:5: Assignment
  25.   {
  26.       size_t siglen;
  27.       size_t len_remaining = len;
            ^
  28.       const unsigned char *p;
  29.   

crypto/ct/ct_oct.c:24:1: <RHS trace>
22.   #include "ct_locl.h"
23.   
24. > int o2i_SCT_signature(SCT *sct, const unsigned char **in, size_t len)
25.   {
26.       size_t siglen;

crypto/ct/ct_oct.c:24:1: Parameter `**in`
  22.   #include "ct_locl.h"
  23.   
  24. > int o2i_SCT_signature(SCT *sct, const unsigned char **in, size_t len)
  25.   {
  26.       size_t siglen;

crypto/ct/ct_oct.c:56:5: Binary operation: ([0, +oo] - 4):unsigned64 by call to `o2i_SCT_signature` 
  54.       /* Retrieve signature and check it is consistent with the buffer length */
  55.       n2s(p, siglen);
  56.       len_remaining -= (p - *in);
            ^
  57.       if (siglen > len_remaining) {
  58.           CTerr(CT_F_O2I_SCT_SIGNATURE, CT_R_SCT_INVALID_SIGNATURE);
