crypto/property/property.c:487: error: INTEGER_OVERFLOW_L2
  ([0, +oo] - 1):unsigned64 by call to `lh_QUERY_delete`.
Showing all 6 steps of the trace


crypto/property/property.c:487:13: Call
485.       if (method == NULL) {
486.           elem.query = prop_query;
487.           if (lh_QUERY_delete(alg->cache, &elem) != NULL)
                   ^
488.               store->nelem--;
489.           ossl_property_unlock(store);

crypto/property/property.c:41:1: Parameter `lh->num_items`
  39.   } QUERY;
  40.   
  41. > DEFINE_LHASH_OF(QUERY);
  42.   
  43.   typedef struct {

crypto/property/property.c:41:1: Call
  39.   } QUERY;
  40.   
  41. > DEFINE_LHASH_OF(QUERY);
  42.   
  43.   typedef struct {

crypto/lhash/lhash.c:137:1: <LHS trace>
135.   }
136.   
137. > void *OPENSSL_LH_delete(OPENSSL_LHASH *lh, const void *data)
138.   {
139.       unsigned long hash;

crypto/lhash/lhash.c:137:1: Parameter `lh->num_items`
    135.   }
    136.   
    137. > void *OPENSSL_LH_delete(OPENSSL_LHASH *lh, const void *data)
    138.   {
    139.       unsigned long hash;

crypto/lhash/lhash.c:157:5: Binary operation: ([0, +oo] - 1):unsigned64 by call to `lh_QUERY_delete` 
    155.       }
    156.   
    157.       lh->num_items--;
               ^
    158.       if ((lh->num_nodes > MIN_NODES) &&
    159.           (lh->down_load >= (lh->num_items * LH_LOAD_MULT / lh->num_nodes)))

void *OPENSSL_LH_delete(OPENSSL_LHASH *lh, const void *data)
{
    unsigned long hash;
    OPENSSL_LH_NODE *nn, **rn;
    void *ret;
    lh->error = 0;
    rn = getrn(lh, data, &hash);
    if (*rn == NULL) {
        lh->num_no_delete++;
        return NULL;
    } else {
        nn = *rn;
        *rn = nn->next;
        ret = nn->data;
        OPENSSL_free(nn);
        lh->num_delete++;
    }
    lh->num_items--;
    if ((lh->num_nodes > MIN_NODES) &&
        (lh->down_load >= (lh->num_items * LH_LOAD_MULT / lh->num_nodes)))
        contract(lh);
    return ret;
}
['int ossl_method_store_cache_set(OSSL_METHOD_STORE *store, int nid,\n                                const char *prop_query, void *method)\n{\n    QUERY elem, *old, *p = NULL;\n    ALGORITHM *alg;\n    size_t len;\n    if (nid <= 0 || store == NULL)\n        return 0;\n    if (prop_query == NULL)\n        return 1;\n    ossl_property_write_lock(store);\n    if (store->need_flush)\n        ossl_method_cache_flush_some(store);\n    alg = ossl_method_store_retrieve(store, nid);\n    if (alg == NULL) {\n        ossl_property_unlock(store);\n        return 0;\n    }\n    if (method == NULL) {\n        elem.query = prop_query;\n        if (lh_QUERY_delete(alg->cache, &elem) != NULL)\n            store->nelem--;\n        ossl_property_unlock(store);\n        return 1;\n    }\n    p = OPENSSL_malloc(sizeof(*p) + (len = strlen(prop_query)));\n    if (p != NULL) {\n        p->query = p->body;\n        p->method = method;\n        memcpy((char *)p->query, prop_query, len + 1);\n        if ((old = lh_QUERY_insert(alg->cache, p)) != NULL) {\n            OPENSSL_free(old);\n            ossl_property_unlock(store);\n            return 1;\n        }\n        if (!lh_QUERY_error(alg->cache)) {\n            if (++store->nelem >= IMPL_CACHE_FLUSH_THRESHOLD)\n                store->need_flush = 1;\n            ossl_property_unlock(store);\n            return 1;\n        }\n    }\n    ossl_property_unlock(store);\n    OPENSSL_free(p);\n    return 0;\n}', 'DEFINE_LHASH_OF(QUERY)', 'void *OPENSSL_LH_delete(OPENSSL_LHASH *lh, const void *data)\n{\n    unsigned long hash;\n    OPENSSL_LH_NODE *nn, **rn;\n    void *ret;\n    lh->error = 0;\n    rn = getrn(lh, data, &hash);\n    if (*rn == NULL) {\n        lh->num_no_delete++;\n        return NULL;\n    } else {\n        nn = *rn;\n        *rn = nn->next;\n        ret = nn->data;\n        OPENSSL_free(nn);\n        lh->num_delete++;\n    }\n    lh->num_items--;\n    if ((lh->num_nodes > MIN_NODES) &&\n        (lh->down_load >= (lh->num_items * LH_LOAD_MULT / lh->num_nodes)))\n        contract(lh);\n    return ret;\n}']