ssl/record/rec_layer_s3.c:1174: error: INTEGER_OVERFLOW_L2
  ([0, max(0, `s->session_ctx->sessions->num_items`)] - 1):unsigned64 by call to `ssl3_get_record`.
Showing all 15 steps of the trace


ssl/record/rec_layer_s3.c:1093:1: Parameter `s->session_ctx->sessions->num_items`
1091.    *             none of our business
1092.    */
1093. > int ssl3_read_bytes(SSL *s, int type, int *recvd_type, unsigned char *buf,
1094.                       size_t len, int peek, size_t *readbytes)
1095.   {

ssl/record/rec_layer_s3.c:1174:19: Call
1172.           /* get new records if necessary */
1173.           if (num_recs == 0) {
1174.               ret = ssl3_get_record(s);
                          ^
1175.               if (ret <= 0)
1176.                   return ret;

ssl/record/ssl3_record.c:126:1: Parameter `s->session_ctx->sessions->num_items`
  124.    */
  125.   /* used only by ssl3_read_bytes */
  126. > int ssl3_get_record(SSL *s)
  127.   {
  128.       int al;

ssl/record/ssl3_record.c:587:5: Call
  585.   
  586.    f_err:
  587.       ssl3_send_alert(s, SSL3_AL_FATAL, al);
             ^
  588.    err:
  589.       return ret;

ssl/s3_msg.c:63:1: Parameter `s->session_ctx->sessions->num_items`
    61.   }
    62.   
    63. > int ssl3_send_alert(SSL *s, int level, int desc)
    64.   {
    65.       /* Map tls/ssl alert value to correct one */

ssl/s3_msg.c:74:9: Call
    72.       /* If a fatal one, remove from cache */
    73.       if ((level == SSL3_AL_FATAL) && (s->session != NULL))
    74.           SSL_CTX_remove_session(s->session_ctx, s->session);
                  ^
    75.   
    76.       s->s3->alert_dispatch = 1;

ssl/ssl_sess.c:725:1: Parameter `ctx->sessions->num_items`
      723.   }
      724.   
      725. > int SSL_CTX_remove_session(SSL_CTX *ctx, SSL_SESSION *c)
      726.   {
      727.       return remove_session_lock(ctx, c, 1);

ssl/ssl_sess.c:727:12: Call
      725.   int SSL_CTX_remove_session(SSL_CTX *ctx, SSL_SESSION *c)
      726.   {
      727.       return remove_session_lock(ctx, c, 1);
                        ^
      728.   }
      729.   

ssl/ssl_sess.c:730:1: Parameter `ctx->sessions->num_items`
        728.   }
        729.   
        730. > static int remove_session_lock(SSL_CTX *ctx, SSL_SESSION *c, int lck)
        731.   {
        732.       SSL_SESSION *r;

ssl/ssl_sess.c:740:17: Call
        738.           if ((r = lh_SSL_SESSION_retrieve(ctx->sessions, c)) == c) {
        739.               ret = 1;
        740.               r = lh_SSL_SESSION_delete(ctx->sessions, c);
                               ^
        741.               SSL_SESSION_list_remove(ctx, c);
        742.           }

ssl/ssl_locl.h:660:1: Parameter `lh->num_items`
          658.   } CLIENTHELLO_MSG;
          659.   
          660. > DEFINE_LHASH_OF(SSL_SESSION);
          661.   /* Needed in ssl_cert.c */
          662.   DEFINE_LHASH_OF(X509_NAME);

ssl/ssl_locl.h:660:1: Call
          658.   } CLIENTHELLO_MSG;
          659.   
          660. > DEFINE_LHASH_OF(SSL_SESSION);
          661.   /* Needed in ssl_cert.c */
          662.   DEFINE_LHASH_OF(X509_NAME);

crypto/lhash/lhash.c:103:1: <LHS trace>
101.   }
102.   
103. > void *OPENSSL_LH_delete(OPENSSL_LHASH *lh, const void *data)
104.   {
105.       unsigned long hash;

crypto/lhash/lhash.c:103:1: Parameter `lh->num_items`
            101.   }
            102.   
            103. > void *OPENSSL_LH_delete(OPENSSL_LHASH *lh, const void *data)
            104.   {
            105.       unsigned long hash;

crypto/lhash/lhash.c:123:5: Binary operation: ([0, max(0, s->session_ctx->sessions->num_items)] - 1):unsigned64 by call to `ssl3_get_record` 
            121.       }
            122.   
            123.       lh->num_items--;
                       ^
            124.       if ((lh->num_nodes > MIN_NODES) &&
            125.           (lh->down_load >= (lh->num_items * LH_LOAD_MULT / lh->num_nodes)))

void *OPENSSL_LH_delete(OPENSSL_LHASH *lh, const void *data)
{
    unsigned long hash;
    OPENSSL_LH_NODE *nn, **rn;
    void *ret;
    lh->error = 0;
    rn = getrn(lh, data, &hash);
    if (*rn == NULL) {
        lh->num_no_delete++;
        return (NULL);
    } else {
        nn = *rn;
        *rn = nn->next;
        ret = nn->data;
        OPENSSL_free(nn);
        lh->num_delete++;
    }
    lh->num_items--;
    if ((lh->num_nodes > MIN_NODES) &&
        (lh->down_load >= (lh->num_items * LH_LOAD_MULT / lh->num_nodes)))
        contract(lh);
    return (ret);
}
['int ssl3_read_bytes(SSL *s, int type, int *recvd_type, unsigned char *buf,\n                    size_t len, int peek, size_t *readbytes)\n{\n    int al, i, j, ret;\n    size_t n, curr_rec, num_recs, totalbytes;\n    SSL3_RECORD *rr;\n    SSL3_BUFFER *rbuf;\n    void (*cb) (const SSL *ssl, int type2, int val) = NULL;\n    rbuf = &s->rlayer.rbuf;\n    if (!SSL3_BUFFER_is_initialised(rbuf)) {\n        if (!ssl3_setup_read_buffer(s))\n            return -1;\n    }\n    if ((type && (type != SSL3_RT_APPLICATION_DATA)\n         && (type != SSL3_RT_HANDSHAKE)) || (peek\n                                             && (type !=\n                                                 SSL3_RT_APPLICATION_DATA))) {\n        SSLerr(SSL_F_SSL3_READ_BYTES, ERR_R_INTERNAL_ERROR);\n        return -1;\n    }\n    if ((type == SSL3_RT_HANDSHAKE) && (s->rlayer.handshake_fragment_len > 0))\n    {\n        unsigned char *src = s->rlayer.handshake_fragment;\n        unsigned char *dst = buf;\n        unsigned int k;\n        n = 0;\n        while ((len > 0) && (s->rlayer.handshake_fragment_len > 0)) {\n            *dst++ = *src++;\n            len--;\n            s->rlayer.handshake_fragment_len--;\n            n++;\n        }\n        for (k = 0; k < s->rlayer.handshake_fragment_len; k++)\n            s->rlayer.handshake_fragment[k] = *src++;\n        if (recvd_type != NULL)\n            *recvd_type = SSL3_RT_HANDSHAKE;\n        *readbytes = n;\n        return 1;\n    }\n    if (!ossl_statem_get_in_handshake(s) && SSL_in_init(s)) {\n        i = s->handshake_func(s);\n        if (i < 0)\n            return i;\n        if (i == 0) {\n            SSLerr(SSL_F_SSL3_READ_BYTES, SSL_R_SSL_HANDSHAKE_FAILURE);\n            return -1;\n        }\n    }\n start:\n    s->rwstate = SSL_NOTHING;\n    rr = s->rlayer.rrec;\n    num_recs = RECORD_LAYER_get_numrpipes(&s->rlayer);\n    do {\n        if (num_recs == 0) {\n            ret = ssl3_get_record(s);\n            if (ret <= 0)\n                return ret;\n            num_recs = RECORD_LAYER_get_numrpipes(&s->rlayer);\n            if (num_recs == 0) {\n                al = SSL_AD_INTERNAL_ERROR;\n                SSLerr(SSL_F_SSL3_READ_BYTES, ERR_R_INTERNAL_ERROR);\n                goto f_err;\n            }\n        }\n        for (curr_rec = 0;\n             curr_rec < num_recs && SSL3_RECORD_is_read(&rr[curr_rec]);\n             curr_rec++) ;\n        if (curr_rec == num_recs) {\n            RECORD_LAYER_set_numrpipes(&s->rlayer, 0);\n            num_recs = 0;\n            curr_rec = 0;\n        }\n    } while (num_recs == 0);\n    rr = &rr[curr_rec];\n    if (SSL3_RECORD_get_type(rr) != SSL3_RT_ALERT\n            && SSL3_RECORD_get_length(rr) != 0)\n        s->rlayer.alert_count = 0;\n    if (s->s3->change_cipher_spec\n        && (SSL3_RECORD_get_type(rr) != SSL3_RT_HANDSHAKE)) {\n        al = SSL_AD_UNEXPECTED_MESSAGE;\n        SSLerr(SSL_F_SSL3_READ_BYTES, SSL_R_DATA_BETWEEN_CCS_AND_FINISHED);\n        goto f_err;\n    }\n    if (s->shutdown & SSL_RECEIVED_SHUTDOWN) {\n        SSL3_RECORD_set_length(rr, 0);\n        s->rwstate = SSL_NOTHING;\n        return 0;\n    }\n    if (type == SSL3_RECORD_get_type(rr)\n        || (SSL3_RECORD_get_type(rr) == SSL3_RT_CHANGE_CIPHER_SPEC\n            && type == SSL3_RT_HANDSHAKE && recvd_type != NULL\n            && !SSL_IS_TLS13(s))) {\n        if (SSL_in_init(s) && (type == SSL3_RT_APPLICATION_DATA) &&\n            (s->enc_read_ctx == NULL)) {\n            al = SSL_AD_UNEXPECTED_MESSAGE;\n            SSLerr(SSL_F_SSL3_READ_BYTES, SSL_R_APP_DATA_IN_HANDSHAKE);\n            goto f_err;\n        }\n        if (type == SSL3_RT_HANDSHAKE\n            && SSL3_RECORD_get_type(rr) == SSL3_RT_CHANGE_CIPHER_SPEC\n            && s->rlayer.handshake_fragment_len > 0) {\n            al = SSL_AD_UNEXPECTED_MESSAGE;\n            SSLerr(SSL_F_SSL3_READ_BYTES, SSL_R_CCS_RECEIVED_EARLY);\n            goto f_err;\n        }\n        if (recvd_type != NULL)\n            *recvd_type = SSL3_RECORD_get_type(rr);\n        if (len == 0)\n            return 0;\n        totalbytes = 0;\n        do {\n            if (len - totalbytes > SSL3_RECORD_get_length(rr))\n                n = SSL3_RECORD_get_length(rr);\n            else\n                n = len - totalbytes;\n            memcpy(buf, &(rr->data[rr->off]), n);\n            buf += n;\n            if (peek) {\n                if (SSL3_RECORD_get_length(rr) == 0)\n                    SSL3_RECORD_set_read(rr);\n            } else {\n                SSL3_RECORD_sub_length(rr, n);\n                SSL3_RECORD_add_off(rr, n);\n                if (SSL3_RECORD_get_length(rr) == 0) {\n                    s->rlayer.rstate = SSL_ST_READ_HEADER;\n                    SSL3_RECORD_set_off(rr, 0);\n                    SSL3_RECORD_set_read(rr);\n                }\n            }\n            if (SSL3_RECORD_get_length(rr) == 0\n                || (peek && n == SSL3_RECORD_get_length(rr))) {\n                curr_rec++;\n                rr++;\n            }\n            totalbytes += n;\n        } while (type == SSL3_RT_APPLICATION_DATA && curr_rec < num_recs\n                 && totalbytes < len);\n        if (totalbytes == 0) {\n            goto start;\n        }\n        if (!peek && curr_rec == num_recs\n            && (s->mode & SSL_MODE_RELEASE_BUFFERS)\n            && SSL3_BUFFER_get_left(rbuf) == 0)\n            ssl3_release_read_buffer(s);\n        *readbytes = totalbytes;\n        return 1;\n    }\n    if (rr->rec_version == SSL2_VERSION) {\n        al = SSL_AD_INTERNAL_ERROR;\n        SSLerr(SSL_F_SSL3_READ_BYTES, ERR_R_INTERNAL_ERROR);\n        goto f_err;\n    }\n    if (s->method->version == TLS_ANY_VERSION\n        && (s->server || rr->type != SSL3_RT_ALERT)) {\n        s->version = rr->rec_version;\n        al = SSL_AD_UNEXPECTED_MESSAGE;\n        SSLerr(SSL_F_SSL3_READ_BYTES, SSL_R_UNEXPECTED_MESSAGE);\n        goto f_err;\n    }\n    {\n        size_t dest_maxlen = 0;\n        unsigned char *dest = NULL;\n        size_t *dest_len = NULL;\n        if (SSL3_RECORD_get_type(rr) == SSL3_RT_HANDSHAKE) {\n            dest_maxlen = sizeof s->rlayer.handshake_fragment;\n            dest = s->rlayer.handshake_fragment;\n            dest_len = &s->rlayer.handshake_fragment_len;\n        } else if (SSL3_RECORD_get_type(rr) == SSL3_RT_ALERT) {\n            dest_maxlen = sizeof s->rlayer.alert_fragment;\n            dest = s->rlayer.alert_fragment;\n            dest_len = &s->rlayer.alert_fragment_len;\n        }\n        if (dest_maxlen > 0) {\n            n = dest_maxlen - *dest_len;\n            if (SSL3_RECORD_get_length(rr) < n)\n                n = SSL3_RECORD_get_length(rr);\n            while (n-- > 0) {\n                dest[(*dest_len)++] =\n                    SSL3_RECORD_get_data(rr)[SSL3_RECORD_get_off(rr)];\n                SSL3_RECORD_add_off(rr, 1);\n                SSL3_RECORD_add_length(rr, -1);\n            }\n            if (*dest_len < dest_maxlen) {\n                SSL3_RECORD_set_read(rr);\n                goto start;\n            }\n        }\n    }\n    if (s->server &&\n        SSL_is_init_finished(s) &&\n        !s->s3->send_connection_binding &&\n        (s->version > SSL3_VERSION) &&\n        !SSL_IS_TLS13(s) &&\n        (s->rlayer.handshake_fragment_len >= 4) &&\n        (s->rlayer.handshake_fragment[0] == SSL3_MT_CLIENT_HELLO) &&\n        (s->session != NULL) && (s->session->cipher != NULL) &&\n        !(s->ctx->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION)) {\n        SSL3_RECORD_set_length(rr, 0);\n        SSL3_RECORD_set_read(rr);\n        ssl3_send_alert(s, SSL3_AL_WARNING, SSL_AD_NO_RENEGOTIATION);\n        goto start;\n    }\n    if (s->rlayer.alert_fragment_len >= 2) {\n        int alert_level = s->rlayer.alert_fragment[0];\n        int alert_descr = s->rlayer.alert_fragment[1];\n        s->rlayer.alert_fragment_len = 0;\n        if (s->msg_callback)\n            s->msg_callback(0, s->version, SSL3_RT_ALERT,\n                            s->rlayer.alert_fragment, 2, s,\n                            s->msg_callback_arg);\n        if (s->info_callback != NULL)\n            cb = s->info_callback;\n        else if (s->ctx->info_callback != NULL)\n            cb = s->ctx->info_callback;\n        if (cb != NULL) {\n            j = (alert_level << 8) | alert_descr;\n            cb(s, SSL_CB_READ_ALERT, j);\n        }\n        if (alert_level == SSL3_AL_WARNING) {\n            s->s3->warn_alert = alert_descr;\n            SSL3_RECORD_set_read(rr);\n            s->rlayer.alert_count++;\n            if (s->rlayer.alert_count == MAX_WARN_ALERT_COUNT) {\n                al = SSL_AD_UNEXPECTED_MESSAGE;\n                SSLerr(SSL_F_SSL3_READ_BYTES, SSL_R_TOO_MANY_WARN_ALERTS);\n                goto f_err;\n            }\n            if (alert_descr == SSL_AD_CLOSE_NOTIFY) {\n                s->shutdown |= SSL_RECEIVED_SHUTDOWN;\n                return 0;\n            }\n            else if (alert_descr == SSL_AD_NO_RENEGOTIATION) {\n                al = SSL_AD_HANDSHAKE_FAILURE;\n                SSLerr(SSL_F_SSL3_READ_BYTES, SSL_R_NO_RENEGOTIATION);\n                goto f_err;\n            }\n#ifdef SSL_AD_MISSING_SRP_USERNAME\n            else if (alert_descr == SSL_AD_MISSING_SRP_USERNAME)\n                return (0);\n#endif\n        } else if (alert_level == SSL3_AL_FATAL) {\n            char tmp[16];\n            s->rwstate = SSL_NOTHING;\n            s->s3->fatal_alert = alert_descr;\n            SSLerr(SSL_F_SSL3_READ_BYTES, SSL_AD_REASON_OFFSET + alert_descr);\n            BIO_snprintf(tmp, sizeof tmp, "%d", alert_descr);\n            ERR_add_error_data(2, "SSL alert number ", tmp);\n            s->shutdown |= SSL_RECEIVED_SHUTDOWN;\n            SSL3_RECORD_set_read(rr);\n            SSL_CTX_remove_session(s->session_ctx, s->session);\n            return 0;\n        } else {\n            al = SSL_AD_ILLEGAL_PARAMETER;\n            SSLerr(SSL_F_SSL3_READ_BYTES, SSL_R_UNKNOWN_ALERT_TYPE);\n            goto f_err;\n        }\n        goto start;\n    }\n    if (s->shutdown & SSL_SENT_SHUTDOWN) {\n        s->rwstate = SSL_NOTHING;\n        SSL3_RECORD_set_length(rr, 0);\n        SSL3_RECORD_set_read(rr);\n        return 0;\n    }\n    if (SSL3_RECORD_get_type(rr) == SSL3_RT_CHANGE_CIPHER_SPEC) {\n        al = SSL_AD_UNEXPECTED_MESSAGE;\n        SSLerr(SSL_F_SSL3_READ_BYTES, SSL_R_CCS_RECEIVED_EARLY);\n        goto f_err;\n    }\n    if ((s->rlayer.handshake_fragment_len >= 4)\n            && !ossl_statem_get_in_handshake(s)) {\n        assert(SSL_is_init_finished(s));\n        if (!SSL_is_init_finished(s)) {\n            al = SSL_AD_INTERNAL_ERROR;\n            SSLerr(SSL_F_SSL3_READ_BYTES, ERR_R_INTERNAL_ERROR);\n            goto f_err;\n        }\n        ossl_statem_set_in_init(s, 1);\n        i = s->handshake_func(s);\n        if (i < 0)\n            return i;\n        if (i == 0) {\n            SSLerr(SSL_F_SSL3_READ_BYTES, SSL_R_SSL_HANDSHAKE_FAILURE);\n            return -1;\n        }\n        if (!(s->mode & SSL_MODE_AUTO_RETRY)) {\n            if (SSL3_BUFFER_get_left(rbuf) == 0) {\n                BIO *bio;\n                s->rwstate = SSL_READING;\n                bio = SSL_get_rbio(s);\n                BIO_clear_retry_flags(bio);\n                BIO_set_retry_read(bio);\n                return -1;\n            }\n        }\n        goto start;\n    }\n    switch (SSL3_RECORD_get_type(rr)) {\n    default:\n        al = SSL_AD_UNEXPECTED_MESSAGE;\n        SSLerr(SSL_F_SSL3_READ_BYTES, SSL_R_UNEXPECTED_RECORD);\n        goto f_err;\n    case SSL3_RT_CHANGE_CIPHER_SPEC:\n    case SSL3_RT_ALERT:\n    case SSL3_RT_HANDSHAKE:\n        al = SSL_AD_UNEXPECTED_MESSAGE;\n        SSLerr(SSL_F_SSL3_READ_BYTES, ERR_R_INTERNAL_ERROR);\n        goto f_err;\n    case SSL3_RT_APPLICATION_DATA:\n        if (ossl_statem_app_data_allowed(s)) {\n            s->s3->in_read_app_data = 2;\n            return -1;\n        } else {\n            al = SSL_AD_UNEXPECTED_MESSAGE;\n            SSLerr(SSL_F_SSL3_READ_BYTES, SSL_R_UNEXPECTED_RECORD);\n            goto f_err;\n        }\n    }\n f_err:\n    ssl3_send_alert(s, SSL3_AL_FATAL, al);\n    return -1;\n}', 'int ssl3_get_record(SSL *s)\n{\n    int al;\n    int enc_err, rret, ret = -1;\n    int i;\n    size_t more, n;\n    SSL3_RECORD *rr, *thisrr;\n    SSL3_BUFFER *rbuf;\n    SSL_SESSION *sess;\n    unsigned char *p;\n    unsigned char md[EVP_MAX_MD_SIZE];\n    unsigned int version;\n    size_t mac_size;\n    int imac_size;\n    size_t num_recs = 0, max_recs, j;\n    PACKET pkt, sslv2pkt;\n    rr = RECORD_LAYER_get_rrec(&s->rlayer);\n    rbuf = RECORD_LAYER_get_rbuf(&s->rlayer);\n    max_recs = s->max_pipelines;\n    if (max_recs == 0)\n        max_recs = 1;\n    sess = s->session;\n    do {\n        thisrr = &rr[num_recs];\n        if ((RECORD_LAYER_get_rstate(&s->rlayer) != SSL_ST_READ_BODY) ||\n            (RECORD_LAYER_get_packet_length(&s->rlayer)\n             < SSL3_RT_HEADER_LENGTH)) {\n            size_t sslv2len;\n            unsigned int type;\n            rret = ssl3_read_n(s, SSL3_RT_HEADER_LENGTH,\n                               SSL3_BUFFER_get_len(rbuf), 0,\n                               num_recs == 0 ? 1 : 0, &n);\n            if (rret <= 0)\n                return rret;\n            RECORD_LAYER_set_rstate(&s->rlayer, SSL_ST_READ_BODY);\n            p = RECORD_LAYER_get_packet(&s->rlayer);\n            if (!PACKET_buf_init(&pkt, RECORD_LAYER_get_packet(&s->rlayer),\n                                 RECORD_LAYER_get_packet_length(&s->rlayer))) {\n                al = SSL_AD_INTERNAL_ERROR;\n                SSLerr(SSL_F_SSL3_GET_RECORD, ERR_R_INTERNAL_ERROR);\n                goto f_err;\n            }\n            sslv2pkt = pkt;\n            if (!PACKET_get_net_2_len(&sslv2pkt, &sslv2len)\n                    || !PACKET_get_1(&sslv2pkt, &type)) {\n                al = SSL_AD_INTERNAL_ERROR;\n                SSLerr(SSL_F_SSL3_GET_RECORD, ERR_R_INTERNAL_ERROR);\n                goto f_err;\n            }\n            if (s->server && RECORD_LAYER_is_first_record(&s->rlayer)\n                    && (sslv2len & 0x8000) != 0\n                    && (type == SSL2_MT_CLIENT_HELLO)) {\n                thisrr->type = SSL3_RT_HANDSHAKE;\n                thisrr->rec_version = SSL2_VERSION;\n                thisrr->length = sslv2len & 0x7fff;\n                if (thisrr->length > SSL3_BUFFER_get_len(rbuf)\n                    - SSL2_RT_HEADER_LENGTH) {\n                    al = SSL_AD_RECORD_OVERFLOW;\n                    SSLerr(SSL_F_SSL3_GET_RECORD, SSL_R_PACKET_LENGTH_TOO_LONG);\n                    goto f_err;\n                }\n                if (thisrr->length < MIN_SSL2_RECORD_LEN) {\n                    al = SSL_AD_HANDSHAKE_FAILURE;\n                    SSLerr(SSL_F_SSL3_GET_RECORD, SSL_R_LENGTH_TOO_SHORT);\n                    goto f_err;\n                }\n            } else {\n                if (s->msg_callback)\n                    s->msg_callback(0, 0, SSL3_RT_HEADER, p, 5, s,\n                                    s->msg_callback_arg);\n                if (!PACKET_get_1(&pkt, &type)\n                        || !PACKET_get_net_2(&pkt, &version)\n                        || !PACKET_get_net_2_len(&pkt, &thisrr->length)) {\n                    al = SSL_AD_INTERNAL_ERROR;\n                    SSLerr(SSL_F_SSL3_GET_RECORD, ERR_R_INTERNAL_ERROR);\n                    goto f_err;\n                }\n                thisrr->type = type;\n                thisrr->rec_version = version;\n                if (!s->first_packet && !SSL_IS_TLS13(s)\n                        && version != (unsigned int)s->version) {\n                    SSLerr(SSL_F_SSL3_GET_RECORD, SSL_R_WRONG_VERSION_NUMBER);\n                    if ((s->version & 0xFF00) == (version & 0xFF00)\n                        && !s->enc_write_ctx && !s->write_hash) {\n                        if (thisrr->type == SSL3_RT_ALERT) {\n                            goto err;\n                        }\n                        s->version = (unsigned short)version;\n                    }\n                    al = SSL_AD_PROTOCOL_VERSION;\n                    goto f_err;\n                }\n                if ((version >> 8) != SSL3_VERSION_MAJOR) {\n                    if (RECORD_LAYER_is_first_record(&s->rlayer)) {\n                        p = RECORD_LAYER_get_packet(&s->rlayer);\n                        if (strncmp((char *)p, "GET ", 4) == 0 ||\n                            strncmp((char *)p, "POST ", 5) == 0 ||\n                            strncmp((char *)p, "HEAD ", 5) == 0 ||\n                            strncmp((char *)p, "PUT ", 4) == 0) {\n                            SSLerr(SSL_F_SSL3_GET_RECORD, SSL_R_HTTP_REQUEST);\n                            goto err;\n                        } else if (strncmp((char *)p, "CONNE", 5) == 0) {\n                            SSLerr(SSL_F_SSL3_GET_RECORD,\n                                   SSL_R_HTTPS_PROXY_REQUEST);\n                            goto err;\n                        }\n                        SSLerr(SSL_F_SSL3_GET_RECORD,\n                               SSL_R_WRONG_VERSION_NUMBER);\n                        goto err;\n                    } else {\n                        SSLerr(SSL_F_SSL3_GET_RECORD,\n                               SSL_R_WRONG_VERSION_NUMBER);\n                        al = SSL_AD_PROTOCOL_VERSION;\n                        goto f_err;\n                    }\n                }\n                if (SSL_IS_TLS13(s) && s->enc_read_ctx != NULL\n                        && thisrr->type != SSL3_RT_APPLICATION_DATA) {\n                    SSLerr(SSL_F_SSL3_GET_RECORD, SSL_R_BAD_RECORD_TYPE);\n                    al = SSL_AD_UNEXPECTED_MESSAGE;\n                    goto f_err;\n                }\n                if (thisrr->length >\n                    SSL3_BUFFER_get_len(rbuf) - SSL3_RT_HEADER_LENGTH) {\n                    al = SSL_AD_RECORD_OVERFLOW;\n                    SSLerr(SSL_F_SSL3_GET_RECORD, SSL_R_PACKET_LENGTH_TOO_LONG);\n                    goto f_err;\n                }\n            }\n        }\n        if (thisrr->rec_version == SSL2_VERSION) {\n            more = thisrr->length + SSL2_RT_HEADER_LENGTH\n                - SSL3_RT_HEADER_LENGTH;\n        } else {\n            more = thisrr->length;\n        }\n        if (more > 0) {\n            rret = ssl3_read_n(s, more, more, 1, 0, &n);\n            if (rret <= 0)\n                return rret;\n        }\n        RECORD_LAYER_set_rstate(&s->rlayer, SSL_ST_READ_HEADER);\n        if (thisrr->rec_version == SSL2_VERSION) {\n            thisrr->input =\n                &(RECORD_LAYER_get_packet(&s->rlayer)[SSL2_RT_HEADER_LENGTH]);\n        } else {\n            thisrr->input =\n                &(RECORD_LAYER_get_packet(&s->rlayer)[SSL3_RT_HEADER_LENGTH]);\n        }\n        if (thisrr->length > SSL3_RT_MAX_ENCRYPTED_LENGTH) {\n            al = SSL_AD_RECORD_OVERFLOW;\n            SSLerr(SSL_F_SSL3_GET_RECORD, SSL_R_ENCRYPTED_LENGTH_TOO_LONG);\n            goto f_err;\n        }\n        thisrr->data = thisrr->input;\n        thisrr->orig_len = thisrr->length;\n        thisrr->read = 0;\n        num_recs++;\n        RECORD_LAYER_reset_packet_length(&s->rlayer);\n        RECORD_LAYER_clear_first_record(&s->rlayer);\n    } while (num_recs < max_recs\n             && thisrr->type == SSL3_RT_APPLICATION_DATA\n             && SSL_USE_EXPLICIT_IV(s)\n             && s->enc_read_ctx != NULL\n             && (EVP_CIPHER_flags(EVP_CIPHER_CTX_cipher(s->enc_read_ctx))\n                 & EVP_CIPH_FLAG_PIPELINE)\n             && ssl3_record_app_data_waiting(s));\n    if (SSL_READ_ETM(s) && s->read_hash) {\n        unsigned char *mac;\n        imac_size = EVP_MD_CTX_size(s->read_hash);\n        assert(imac_size >= 0 && imac_size <= EVP_MAX_MD_SIZE);\n        if (imac_size < 0 || imac_size > EVP_MAX_MD_SIZE) {\n                al = SSL_AD_INTERNAL_ERROR;\n                SSLerr(SSL_F_SSL3_GET_RECORD, ERR_LIB_EVP);\n                goto f_err;\n        }\n        mac_size = (size_t)imac_size;\n        for (j = 0; j < num_recs; j++) {\n            thisrr = &rr[j];\n            if (thisrr->length < mac_size) {\n                al = SSL_AD_DECODE_ERROR;\n                SSLerr(SSL_F_SSL3_GET_RECORD, SSL_R_LENGTH_TOO_SHORT);\n                goto f_err;\n            }\n            thisrr->length -= mac_size;\n            mac = thisrr->data + thisrr->length;\n            i = s->method->ssl3_enc->mac(s, thisrr, md, 0   );\n            if (i == 0 || CRYPTO_memcmp(md, mac, mac_size) != 0) {\n                al = SSL_AD_BAD_RECORD_MAC;\n                SSLerr(SSL_F_SSL3_GET_RECORD,\n                       SSL_R_DECRYPTION_FAILED_OR_BAD_RECORD_MAC);\n                goto f_err;\n            }\n        }\n    }\n    enc_err = s->method->ssl3_enc->enc(s, rr, num_recs, 0);\n    if (enc_err == 0) {\n        al = SSL_AD_DECRYPTION_FAILED;\n        SSLerr(SSL_F_SSL3_GET_RECORD, SSL_R_BLOCK_CIPHER_PAD_IS_WRONG);\n        goto f_err;\n    }\n#ifdef SSL_DEBUG\n    printf("dec %"OSSLzu"\\n", rr[0].length);\n    {\n        size_t z;\n        for (z = 0; z < rr[0].length; z++)\n            printf("%02X%c", rr[0].data[z], ((z + 1) % 16) ? \' \' : \'\\n\');\n    }\n    printf("\\n");\n#endif\n    if ((sess != NULL) &&\n        (s->enc_read_ctx != NULL) &&\n        (!SSL_READ_ETM(s) && EVP_MD_CTX_md(s->read_hash) != NULL)) {\n        unsigned char *mac = NULL;\n        unsigned char mac_tmp[EVP_MAX_MD_SIZE];\n        mac_size = EVP_MD_CTX_size(s->read_hash);\n        OPENSSL_assert(mac_size <= EVP_MAX_MD_SIZE);\n        for (j = 0; j < num_recs; j++) {\n            thisrr = &rr[j];\n            if (thisrr->orig_len < mac_size ||\n                (EVP_CIPHER_CTX_mode(s->enc_read_ctx) == EVP_CIPH_CBC_MODE &&\n                 thisrr->orig_len < mac_size + 1)) {\n                al = SSL_AD_DECODE_ERROR;\n                SSLerr(SSL_F_SSL3_GET_RECORD, SSL_R_LENGTH_TOO_SHORT);\n                goto f_err;\n            }\n            if (EVP_CIPHER_CTX_mode(s->enc_read_ctx) == EVP_CIPH_CBC_MODE) {\n                mac = mac_tmp;\n                ssl3_cbc_copy_mac(mac_tmp, thisrr, mac_size);\n                thisrr->length -= mac_size;\n            } else {\n                thisrr->length -= mac_size;\n                mac = &thisrr->data[thisrr->length];\n            }\n            i = s->method->ssl3_enc->mac(s, thisrr, md, 0   );\n            if (i == 0 || mac == NULL\n                || CRYPTO_memcmp(md, mac, (size_t)mac_size) != 0)\n                enc_err = -1;\n            if (thisrr->length > SSL3_RT_MAX_COMPRESSED_LENGTH + mac_size)\n                enc_err = -1;\n        }\n    }\n    if (enc_err < 0) {\n        al = SSL_AD_BAD_RECORD_MAC;\n        SSLerr(SSL_F_SSL3_GET_RECORD,\n               SSL_R_DECRYPTION_FAILED_OR_BAD_RECORD_MAC);\n        goto f_err;\n    }\n    for (j = 0; j < num_recs; j++) {\n        thisrr = &rr[j];\n        if (s->expand != NULL) {\n            if (thisrr->length > SSL3_RT_MAX_COMPRESSED_LENGTH) {\n                al = SSL_AD_RECORD_OVERFLOW;\n                SSLerr(SSL_F_SSL3_GET_RECORD, SSL_R_COMPRESSED_LENGTH_TOO_LONG);\n                goto f_err;\n            }\n            if (!ssl3_do_uncompress(s, thisrr)) {\n                al = SSL_AD_DECOMPRESSION_FAILURE;\n                SSLerr(SSL_F_SSL3_GET_RECORD, SSL_R_BAD_DECOMPRESSION);\n                goto f_err;\n            }\n        }\n        if (SSL_IS_TLS13(s) && s->enc_read_ctx != NULL) {\n            size_t end;\n            if (thisrr->length == 0) {\n                al = SSL_AD_UNEXPECTED_MESSAGE;\n                SSLerr(SSL_F_SSL3_GET_RECORD, SSL_R_BAD_RECORD_TYPE);\n                goto f_err;\n            }\n            for (end = thisrr->length - 1; end > 0 && thisrr->data[end] == 0;\n                 end--)\n                continue;\n            thisrr->length = end;\n            thisrr->type = thisrr->data[end];\n            if (thisrr->type != SSL3_RT_APPLICATION_DATA\n                    && thisrr->type != SSL3_RT_ALERT\n                    && thisrr->type != SSL3_RT_HANDSHAKE) {\n                al = SSL_AD_UNEXPECTED_MESSAGE;\n                SSLerr(SSL_F_SSL3_GET_RECORD, SSL_R_BAD_RECORD_TYPE);\n                goto f_err;\n            }\n        }\n        if (thisrr->length > SSL3_RT_MAX_PLAIN_LENGTH) {\n            al = SSL_AD_RECORD_OVERFLOW;\n            SSLerr(SSL_F_SSL3_GET_RECORD, SSL_R_DATA_LENGTH_TOO_LONG);\n            goto f_err;\n        }\n        thisrr->off = 0;\n        if (thisrr->length == 0) {\n            RECORD_LAYER_inc_empty_record_count(&s->rlayer);\n            if (RECORD_LAYER_get_empty_record_count(&s->rlayer)\n                > MAX_EMPTY_RECORDS) {\n                al = SSL_AD_UNEXPECTED_MESSAGE;\n                SSLerr(SSL_F_SSL3_GET_RECORD, SSL_R_RECORD_TOO_SMALL);\n                goto f_err;\n            }\n        } else {\n            RECORD_LAYER_reset_empty_record_count(&s->rlayer);\n        }\n    }\n    RECORD_LAYER_set_numrpipes(&s->rlayer, num_recs);\n    return 1;\n f_err:\n    ssl3_send_alert(s, SSL3_AL_FATAL, al);\n err:\n    return ret;\n}', 'int ssl3_send_alert(SSL *s, int level, int desc)\n{\n    desc = s->method->ssl3_enc->alert_value(desc);\n    if (s->version == SSL3_VERSION && desc == SSL_AD_PROTOCOL_VERSION)\n        desc = SSL_AD_HANDSHAKE_FAILURE;\n    if (desc < 0)\n        return -1;\n    if ((level == SSL3_AL_FATAL) && (s->session != NULL))\n        SSL_CTX_remove_session(s->session_ctx, s->session);\n    s->s3->alert_dispatch = 1;\n    s->s3->send_alert[0] = level;\n    s->s3->send_alert[1] = desc;\n    if (!RECORD_LAYER_write_pending(&s->rlayer)) {\n        return s->method->ssl_dispatch_alert(s);\n    }\n    return -1;\n}', 'int SSL_CTX_remove_session(SSL_CTX *ctx, SSL_SESSION *c)\n{\n    return remove_session_lock(ctx, c, 1);\n}', 'static int remove_session_lock(SSL_CTX *ctx, SSL_SESSION *c, int lck)\n{\n    SSL_SESSION *r;\n    int ret = 0;\n    if ((c != NULL) && (c->session_id_length != 0)) {\n        if (lck)\n            CRYPTO_THREAD_write_lock(ctx->lock);\n        if ((r = lh_SSL_SESSION_retrieve(ctx->sessions, c)) == c) {\n            ret = 1;\n            r = lh_SSL_SESSION_delete(ctx->sessions, c);\n            SSL_SESSION_list_remove(ctx, c);\n        }\n        c->not_resumable = 1;\n        if (lck)\n            CRYPTO_THREAD_unlock(ctx->lock);\n        if (ret)\n            SSL_SESSION_free(r);\n        if (ctx->remove_session_cb != NULL)\n            ctx->remove_session_cb(ctx, c);\n    } else\n        ret = 0;\n    return (ret);\n}', 'DEFINE_LHASH_OF(SSL_SESSION)', 'void *OPENSSL_LH_delete(OPENSSL_LHASH *lh, const void *data)\n{\n    unsigned long hash;\n    OPENSSL_LH_NODE *nn, **rn;\n    void *ret;\n    lh->error = 0;\n    rn = getrn(lh, data, &hash);\n    if (*rn == NULL) {\n        lh->num_no_delete++;\n        return (NULL);\n    } else {\n        nn = *rn;\n        *rn = nn->next;\n        ret = nn->data;\n        OPENSSL_free(nn);\n        lh->num_delete++;\n    }\n    lh->num_items--;\n    if ((lh->num_nodes > MIN_NODES) &&\n        (lh->down_load >= (lh->num_items * LH_LOAD_MULT / lh->num_nodes)))\n        contract(lh);\n    return (ret);\n}']