ssl/s3_both.c:472: error: INTEGER_OVERFLOW_L2
  ([0, max(0, `s->ctx->sessions->num_items`)] - 1):unsigned64 by call to `tls_get_message_body`.
Showing all 13 steps of the trace


ssl/s3_both.c:411:1: Parameter `s->ctx->sessions->num_items`
409.    * are read in state 'st1', the body is read in state 'stn'.
410.    */
411. > long ssl3_get_message(SSL *s, int st1, int stn, int mt, long max, int *ok)
412.   {
413.       unsigned char *p;

ssl/s3_both.c:472:9: Call
470.   
471.       /* next state (stn) */
472.       if (tls_get_message_body(s, (unsigned long *)&n) == 0) {
               ^
473.           *ok = 0;
474.           return n;

ssl/s3_both.c:584:1: Parameter `s->ctx->sessions->num_items`
  582.   }
  583.   
  584. > int tls_get_message_body(SSL *s, unsigned long *len)
  585.   {
  586.       long n;

ssl/s3_both.c:640:9: Call
  638.       if (s->init_num < 0) {
  639.           SSLerr(SSL_F_TLS_GET_MESSAGE_BODY, ERR_R_INTERNAL_ERROR);
  640.           ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR);
                 ^
  641.           *len = 0;
  642.           return 0;

ssl/s3_msg.c:166:1: Parameter `s->ctx->sessions->num_items`
    164.   }
    165.   
    166. > int ssl3_send_alert(SSL *s, int level, int desc)
    167.   {
    168.       /* Map tls/ssl alert value to correct one */

ssl/s3_msg.c:177:9: Call
    175.       /* If a fatal one, remove from cache */
    176.       if ((level == SSL3_AL_FATAL) && (s->session != NULL))
    177.           SSL_CTX_remove_session(s->ctx, s->session);
                   ^
    178.   
    179.       s->s3->alert_dispatch = 1;

ssl/ssl_sess.c:776:1: Parameter `ctx->sessions->num_items`
      774.   }
      775.   
      776. > int SSL_CTX_remove_session(SSL_CTX *ctx, SSL_SESSION *c)
      777.   {
      778.       return remove_session_lock(ctx, c, 1);

ssl/ssl_sess.c:778:12: Call
      776.   int SSL_CTX_remove_session(SSL_CTX *ctx, SSL_SESSION *c)
      777.   {
      778.       return remove_session_lock(ctx, c, 1);
                        ^
      779.   }
      780.   

ssl/ssl_sess.c:781:1: Parameter `ctx->sessions->num_items`
        779.   }
        780.   
        781. > static int remove_session_lock(SSL_CTX *ctx, SSL_SESSION *c, int lck)
        782.   {
        783.       SSL_SESSION *r;

ssl/ssl_sess.c:791:17: Call
        789.           if ((r = lh_SSL_SESSION_retrieve(ctx->sessions, c)) == c) {
        790.               ret = 1;
        791.               r = lh_SSL_SESSION_delete(ctx->sessions, c);
                               ^
        792.               SSL_SESSION_list_remove(ctx, c);
        793.           }

crypto/lhash/lhash.c:189:1: <LHS trace>
187.   }
188.   
189. > void *lh_delete(_LHASH *lh, const void *data)
190.   {
191.       unsigned long hash;

crypto/lhash/lhash.c:189:1: Parameter `lh->num_items`
          187.   }
          188.   
          189. > void *lh_delete(_LHASH *lh, const void *data)
          190.   {
          191.       unsigned long hash;

crypto/lhash/lhash.c:209:5: Binary operation: ([0, max(0, s->ctx->sessions->num_items)] - 1):unsigned64 by call to `tls_get_message_body` 
          207.       }
          208.   
          209.       lh->num_items--;
                     ^
          210.       if ((lh->num_nodes > MIN_NODES) &&
          211.           (lh->down_load >= (lh->num_items * LH_LOAD_MULT / lh->num_nodes)))

void *lh_delete(_LHASH *lh, const void *data)
{
    unsigned long hash;
    LHASH_NODE *nn, **rn;
    void *ret;
    lh->error = 0;
    rn = getrn(lh, data, &hash);
    if (*rn == NULL) {
        lh->num_no_delete++;
        return (NULL);
    } else {
        nn = *rn;
        *rn = nn->next;
        ret = nn->data;
        OPENSSL_free(nn);
        lh->num_delete++;
    }
    lh->num_items--;
    if ((lh->num_nodes > MIN_NODES) &&
        (lh->down_load >= (lh->num_items * LH_LOAD_MULT / lh->num_nodes)))
        contract(lh);
    return (ret);
}
['long ssl3_get_message(SSL *s, int st1, int stn, int mt, long max, int *ok)\n{\n    unsigned char *p;\n    long n;\n    int al, mtin;\n    if (s->s3->tmp.reuse_message) {\n        s->s3->tmp.reuse_message = 0;\n        if ((mt >= 0) && (s->s3->tmp.message_type != mt)) {\n            al = SSL_AD_UNEXPECTED_MESSAGE;\n            SSLerr(SSL_F_SSL3_GET_MESSAGE, SSL_R_UNEXPECTED_MESSAGE);\n            goto f_err;\n        }\n        *ok = 1;\n        s->state = stn;\n        s->init_msg = s->init_buf->data + SSL3_HM_HEADER_LENGTH;\n        s->init_num = (int)s->s3->tmp.message_size;\n        return s->init_num;\n    }\n    p = (unsigned char *)s->init_buf->data;\n    if (s->state == st1) {\n        if (tls_get_message_header(s, &mtin) == 0) {\n            *ok = 0;\n            return -1;\n        }\n        s->state = stn;\n        if (s->init_num == 0\n                && mtin == SSL3_MT_CHANGE_CIPHER_SPEC\n                && (mt < 0 || mt == SSL3_MT_CHANGE_CIPHER_SPEC)) {\n            if (*p != SSL3_MT_CCS) {\n                al = SSL_AD_UNEXPECTED_MESSAGE;\n                SSLerr(SSL_F_SSL3_GET_MESSAGE,\n                       SSL_R_UNEXPECTED_MESSAGE);\n                goto f_err;\n            }\n            s->init_msg = p + 1;\n            s->s3->tmp.message_type = SSL3_MT_CHANGE_CIPHER_SPEC;\n            s->s3->tmp.message_size = s->init_num;\n            *ok = 1;\n            if (s->msg_callback)\n                s->msg_callback(0, s->version,\n                                SSL3_RT_CHANGE_CIPHER_SPEC, p, 1, s,\n                                s->msg_callback_arg);\n            return s->init_num;\n        }\n        if (s->s3->tmp.message_size > (unsigned long)max) {\n            al = SSL_AD_ILLEGAL_PARAMETER;\n            SSLerr(SSL_F_SSL3_GET_MESSAGE, SSL_R_EXCESSIVE_MESSAGE_SIZE);\n            goto f_err;\n        }\n        if ((mt >= 0) && (mtin != mt)) {\n            al = SSL_AD_UNEXPECTED_MESSAGE;\n            SSLerr(SSL_F_SSL3_GET_MESSAGE, SSL_R_UNEXPECTED_MESSAGE);\n            goto f_err;\n        }\n    }\n    if (tls_get_message_body(s, (unsigned long *)&n) == 0) {\n        *ok = 0;\n        return n;\n    }\n    *ok = 1;\n    return n;\n f_err:\n    ssl3_send_alert(s, SSL3_AL_FATAL, al);\n    *ok = 0;\n    return 0;\n}', 'int tls_get_message_body(SSL *s, unsigned long *len)\n{\n    long n;\n    unsigned char *p;\n    int i;\n    if (s->s3->tmp.message_type == SSL3_MT_CHANGE_CIPHER_SPEC) {\n        *len = (unsigned long)s->init_num;\n        return 1;\n    }\n    p = s->init_msg;\n    n = s->s3->tmp.message_size - s->init_num;\n    while (n > 0) {\n        i = s->method->ssl_read_bytes(s, SSL3_RT_HANDSHAKE, NULL,\n                                      &p[s->init_num], n, 0);\n        if (i <= 0) {\n            s->rwstate = SSL_READING;\n            *len = 0;\n            return 0;\n        }\n        s->init_num += i;\n        n -= i;\n    }\n#ifndef OPENSSL_NO_NEXTPROTONEG\n    if (*s->init_buf->data == SSL3_MT_FINISHED)\n        ssl3_take_mac(s);\n#endif\n    if(RECORD_LAYER_is_sslv2_record(&s->rlayer)) {\n        ssl3_finish_mac(s, (unsigned char *)s->init_buf->data, s->init_num);\n        if (s->msg_callback)\n            s->msg_callback(0, SSL2_VERSION, 0,  s->init_buf->data,\n                            (size_t)s->init_num, s, s->msg_callback_arg);\n    } else {\n        ssl3_finish_mac(s, (unsigned char *)s->init_buf->data,\n            s->init_num + SSL3_HM_HEADER_LENGTH);\n        if (s->msg_callback)\n            s->msg_callback(0, s->version, SSL3_RT_HANDSHAKE, s->init_buf->data,\n                            (size_t)s->init_num + SSL3_HM_HEADER_LENGTH, s,\n                            s->msg_callback_arg);\n    }\n    if (s->init_num < 0) {\n        SSLerr(SSL_F_TLS_GET_MESSAGE_BODY, ERR_R_INTERNAL_ERROR);\n        ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR);\n        *len = 0;\n        return 0;\n    }\n    *len = (unsigned long)s->init_num;\n    return 1;\n}', 'int ssl3_send_alert(SSL *s, int level, int desc)\n{\n    desc = s->method->ssl3_enc->alert_value(desc);\n    if (s->version == SSL3_VERSION && desc == SSL_AD_PROTOCOL_VERSION)\n        desc = SSL_AD_HANDSHAKE_FAILURE;\n    if (desc < 0)\n        return -1;\n    if ((level == SSL3_AL_FATAL) && (s->session != NULL))\n        SSL_CTX_remove_session(s->ctx, s->session);\n    s->s3->alert_dispatch = 1;\n    s->s3->send_alert[0] = level;\n    s->s3->send_alert[1] = desc;\n    if (!RECORD_LAYER_write_pending(&s->rlayer)) {\n        return s->method->ssl_dispatch_alert(s);\n    }\n    return -1;\n}', 'int SSL_CTX_remove_session(SSL_CTX *ctx, SSL_SESSION *c)\n{\n    return remove_session_lock(ctx, c, 1);\n}', 'static int remove_session_lock(SSL_CTX *ctx, SSL_SESSION *c, int lck)\n{\n    SSL_SESSION *r;\n    int ret = 0;\n    if ((c != NULL) && (c->session_id_length != 0)) {\n        if (lck)\n            CRYPTO_w_lock(CRYPTO_LOCK_SSL_CTX);\n        if ((r = lh_SSL_SESSION_retrieve(ctx->sessions, c)) == c) {\n            ret = 1;\n            r = lh_SSL_SESSION_delete(ctx->sessions, c);\n            SSL_SESSION_list_remove(ctx, c);\n        }\n        if (lck)\n            CRYPTO_w_unlock(CRYPTO_LOCK_SSL_CTX);\n        if (ret) {\n            r->not_resumable = 1;\n            if (ctx->remove_session_cb != NULL)\n                ctx->remove_session_cb(ctx, r);\n            SSL_SESSION_free(r);\n        }\n    } else\n        ret = 0;\n    return (ret);\n}', 'void *lh_delete(_LHASH *lh, const void *data)\n{\n    unsigned long hash;\n    LHASH_NODE *nn, **rn;\n    void *ret;\n    lh->error = 0;\n    rn = getrn(lh, data, &hash);\n    if (*rn == NULL) {\n        lh->num_no_delete++;\n        return (NULL);\n    } else {\n        nn = *rn;\n        *rn = nn->next;\n        ret = nn->data;\n        OPENSSL_free(nn);\n        lh->num_delete++;\n    }\n    lh->num_items--;\n    if ((lh->num_nodes > MIN_NODES) &&\n        (lh->down_load >= (lh->num_items * LH_LOAD_MULT / lh->num_nodes)))\n        contract(lh);\n    return (ret);\n}']