crypto/asn1/tasn_dec.c:1011: error: INTEGER_OVERFLOW_L2
  ([2, max(2147483644, `buf->max`)] - [1, 2147483644]):unsigned64 by call to `collect_data`.
Showing all 11 steps of the trace


crypto/asn1/tasn_dec.c:966:1: Parameter `buf->max`
964.   #endif
965.   
966. > static int asn1_collect(BUF_MEM *buf, const unsigned char **in, long len,
967.                           char inf, int tag, int aclass, int depth)
968.   {

crypto/asn1/tasn_dec.c:1011:29: Call
1009.               if (!asn1_collect(buf, &p, plen, ininf, tag, aclass, depth + 1))
1010.                   return 0;
1011.           } else if (plen && !collect_data(buf, &p, plen))
                                    ^
1012.               return 0;
1013.           len -= p - q;

crypto/asn1/tasn_dec.c:1023:1: Parameter `buf->max`
  1021.   }
  1022.   
  1023. > static int collect_data(BUF_MEM *buf, const unsigned char **p, long plen)
  1024.   {
  1025.       int len;

crypto/asn1/tasn_dec.c:1028:14: Call
  1026.       if (buf) {
  1027.           len = buf->length;
  1028.           if (!BUF_MEM_grow_clean(buf, len + plen)) {
                       ^
  1029.               ASN1err(ASN1_F_COLLECT_DATA, ERR_R_MALLOC_FAILURE);
  1030.               return 0;

crypto/buffer/buffer.c:109:1: Parameter `len`
    107.   }
    108.   
    109. > size_t BUF_MEM_grow_clean(BUF_MEM *str, size_t len)
    110.   {
    111.       char *ret;

crypto/buffer/buffer.c:134:15: Call
    132.           ret = sec_alloc_realloc(str, n);
    133.       else
    134.           ret = OPENSSL_clear_realloc(str->data, str->max, n);
                         ^
    135.       if (ret == NULL) {
    136.           BUFerr(BUF_F_BUF_MEM_GROW_CLEAN, ERR_R_MALLOC_FAILURE);

crypto/mem.c:136:1: <LHS trace>
134.   }
135.   
136. > void *CRYPTO_clear_realloc(void *str, size_t old_len, size_t num,
137.                              const char *file, int line)
138.   {

crypto/mem.c:136:1: Parameter `num`
      134.   }
      135.   
      136. > void *CRYPTO_clear_realloc(void *str, size_t old_len, size_t num,
      137.                              const char *file, int line)
      138.   {

crypto/mem.c:136:1: <RHS trace>
134.   }
135.   
136. > void *CRYPTO_clear_realloc(void *str, size_t old_len, size_t num,
137.                              const char *file, int line)
138.   {

crypto/mem.c:136:1: Parameter `num`
      134.   }
      135.   
      136. > void *CRYPTO_clear_realloc(void *str, size_t old_len, size_t num,
      137.                              const char *file, int line)
      138.   {

crypto/mem.c:151:9: Binary operation: ([2, max(2147483644, buf->max)] - [1, 2147483644]):unsigned64 by call to `collect_data` 
      149.       /* Can't shrink the buffer since memcpy below copies |old_len| bytes. */
      150.       if (num < old_len) {
      151.           OPENSSL_cleanse((char*)str + num, old_len - num);
                     ^
      152.           return str;
      153.       }
