ssl/record/ssl3_record.c:1454: error: INTEGER_OVERFLOW_L2
  ([0, 297426485248] + [-oo, 17728]):unsigned32 by call to `ssl3_cbc_copy_mac`.
Showing all 10 steps of the trace


ssl/record/ssl3_record.c:1358:1: Parameter `s->rlayer.rrec.length`
1356.   }
1357.   
1358. > int dtls1_process_record(SSL *s)
1359.   {
1360.       int i, al;

ssl/record/ssl3_record.c:1454:13: Call
1452.                */
1453.               mac = mac_tmp;
1454.               ssl3_cbc_copy_mac(mac_tmp, rr, mac_size);
                    ^
1455.               rr->length -= mac_size;
1456.           } else {

ssl/record/ssl3_record.c:1281:1: <LHS trace>
1279.   #define CBC_MAC_ROTATE_IN_PLACE
1280.   
1281. > void ssl3_cbc_copy_mac(unsigned char *out,
1282.                          const SSL3_RECORD *rec, unsigned md_size)
1283.   {

ssl/record/ssl3_record.c:1281:1: Parameter `md_size`
  1279.   #define CBC_MAC_ROTATE_IN_PLACE
  1280.   
  1281. > void ssl3_cbc_copy_mac(unsigned char *out,
  1282.                          const SSL3_RECORD *rec, unsigned md_size)
  1283.   {

ssl/record/ssl3_record.c:1323:5: Assignment
  1321.        * prove that md_size is always even, which I hope is beyond it.
  1322.        */
  1323.       div_spoiler = md_size >> 1;
              ^
  1324.       div_spoiler <<= (sizeof(div_spoiler) - 1) * 8;
  1325.       rotate_offset = (div_spoiler + mac_start - scan_start) % md_size;

ssl/record/ssl3_record.c:1324:5: Assignment
  1322.        */
  1323.       div_spoiler = md_size >> 1;
  1324.       div_spoiler <<= (sizeof(div_spoiler) - 1) * 8;
              ^
  1325.       rotate_offset = (div_spoiler + mac_start - scan_start) % md_size;
  1326.   

ssl/record/ssl3_record.c:1281:1: <RHS trace>
1279.   #define CBC_MAC_ROTATE_IN_PLACE
1280.   
1281. > void ssl3_cbc_copy_mac(unsigned char *out,
1282.                          const SSL3_RECORD *rec, unsigned md_size)
1283.   {

ssl/record/ssl3_record.c:1281:1: Parameter `md_size`
  1279.   #define CBC_MAC_ROTATE_IN_PLACE
  1280.   
  1281. > void ssl3_cbc_copy_mac(unsigned char *out,
  1282.                          const SSL3_RECORD *rec, unsigned md_size)
  1283.   {

ssl/record/ssl3_record.c:1295:5: Assignment
  1293.        */
  1294.       unsigned mac_end = rec->length;
  1295.       unsigned mac_start = mac_end - md_size;
              ^
  1296.       /*
  1297.        * scan_start contains the number of bytes that we can ignore because the

ssl/record/ssl3_record.c:1325:5: Binary operation: ([0, 297426485248] + [-oo, 17728]):unsigned32 by call to `ssl3_cbc_copy_mac` 
  1323.       div_spoiler = md_size >> 1;
  1324.       div_spoiler <<= (sizeof(div_spoiler) - 1) * 8;
  1325.       rotate_offset = (div_spoiler + mac_start - scan_start) % md_size;
              ^
  1326.   
  1327.       memset(rotated_mac, 0, md_size);
