ssl/s3_enc.c:798: error: INTEGER_OVERFLOW_L2
  ([-51, +oo] - 1):unsigned32 by call to `ssl3_cbc_digest_record`.
Showing all 5 steps of the trace


ssl/s3_enc.c:737:1: Parameter `ssl->s3->rrec.orig_len`
735.   	}
736.   
737. > int n_ssl3_mac(SSL *ssl, unsigned char *md, int send)
738.   	{
739.   	SSL3_RECORD *rec;

ssl/s3_enc.c:798:3: Call
796.   
797.   		/* Final param == is SSLv3 */
798.   		ssl3_cbc_digest_record(
         ^
799.   			hash,
800.   			md, &md_size,

ssl/s3_cbc.c:446:4: <LHS trace>
444.   			md_final_raw = tls1_md5_final_raw;
445.   			md_transform = (void(*)(void *ctx, const unsigned char *block)) MD5_Transform;
446.   			md_size = 16;
          ^
447.   			sslv3_pad_length = 48;
448.   			length_is_big_endian = 0;

ssl/s3_cbc.c:446:4: Assignment
  444.   			md_final_raw = tls1_md5_final_raw;
  445.   			md_transform = (void(*)(void *ctx, const unsigned char *block)) MD5_Transform;
  446.   			md_size = 16;
            ^
  447.   			sslv3_pad_length = 48;
  448.   			length_is_big_endian = 0;

ssl/s3_cbc.c:536:2: Binary operation: ([-51, +oo] - 1):unsigned32 by call to `ssl3_cbc_digest_record` 
  534.   	/* max_mac_bytes contains the maximum bytes of bytes in the MAC, including
  535.   	* |header|, assuming that there's no padding. */
  536.   	max_mac_bytes = len - md_size - 1;
          ^
  537.   	/* num_blocks is the maximum number of hash blocks. */
  538.   	num_blocks = (max_mac_bytes + 1 + md_length_size + md_block_size - 1) / md_block_size;
