ssl/ssl_lib.c:588: error: INTEGER_OVERFLOW_L2
  ([0, max(0, `s->ctx->sessions->num_nodes`)] - 1):unsigned32 by call to `SSL_CTX_free`.
Showing all 11 steps of the trace


ssl/ssl_lib.c:505:1: Parameter `s->ctx->sessions->num_nodes`
503.   	}
504.   
505. > void SSL_free(SSL *s)
506.   	{
507.   	int i;

ssl/ssl_lib.c:588:14: Call
586.   	if (s->method != NULL) s->method->ssl_free(s);
587.   
588.   	if (s->ctx) SSL_CTX_free(s->ctx);
                    ^
589.   
590.   #ifndef	OPENSSL_NO_KRB5

ssl/ssl_lib.c:1899:1: Parameter `a->sessions->num_nodes`
  1897.   #endif
  1898.   
  1899. > void SSL_CTX_free(SSL_CTX *a)
  1900.   	{
  1901.   	int i;

ssl/ssl_lib.c:1931:3: Call
  1929.   	 */
  1930.   	if (a->sessions != NULL)
  1931.   		SSL_CTX_flush_sessions(a,0);
            ^
  1932.   
  1933.   	CRYPTO_free_ex_data(CRYPTO_EX_INDEX_SSL_CTX, a, &a->ex_data);

ssl/ssl_sess.c:985:1: Parameter `s->sessions->num_nodes`
    983.   static IMPLEMENT_LHASH_DOALL_ARG_FN(timeout, SSL_SESSION, TIMEOUT_PARAM)
    984.   
    985. > void SSL_CTX_flush_sessions(SSL_CTX *s, long t)
    986.   	{
    987.   	unsigned long i;

ssl/ssl_sess.c:997:2: Call
    995.   	i=CHECKED_LHASH_OF(SSL_SESSION, tp.cache)->down_load;
    996.   	CHECKED_LHASH_OF(SSL_SESSION, tp.cache)->down_load=0;
    997.   	lh_SSL_SESSION_doall_arg(tp.cache, LHASH_DOALL_ARG_FN(timeout),
             ^
    998.   				 TIMEOUT_PARAM, &tp);
    999.   	CHECKED_LHASH_OF(SSL_SESSION, tp.cache)->down_load=i;

crypto/lhash/lhash.c:305:1: Parameter `lh->num_nodes`
      303.   	}
      304.   
      305. > void lh_doall_arg(_LHASH *lh, LHASH_DOALL_ARG_FN_TYPE func, void *arg)
      306.   	{
      307.   	doall_util_fn(lh, 1, (LHASH_DOALL_FN_TYPE)0, func, arg);

crypto/lhash/lhash.c:307:2: Call
      305.   void lh_doall_arg(_LHASH *lh, LHASH_DOALL_ARG_FN_TYPE func, void *arg)
      306.   	{
      307.   	doall_util_fn(lh, 1, (LHASH_DOALL_FN_TYPE)0, func, arg);
              ^
      308.   	}
      309.   

crypto/lhash/lhash.c:270:1: <LHS trace>
268.   	}
269.   
270. > static void doall_util_fn(_LHASH *lh, int use_arg, LHASH_DOALL_FN_TYPE func,
271.   			  LHASH_DOALL_ARG_FN_TYPE func_arg, void *arg)
272.   	{

crypto/lhash/lhash.c:270:1: Parameter `lh->num_nodes`
        268.   	}
        269.   
        270. > static void doall_util_fn(_LHASH *lh, int use_arg, LHASH_DOALL_FN_TYPE func,
        271.   			  LHASH_DOALL_ARG_FN_TYPE func_arg, void *arg)
        272.   	{

crypto/lhash/lhash.c:281:7: Binary operation: ([0, max(0, s->ctx->sessions->num_nodes)] - 1):unsigned32 by call to `SSL_CTX_free` 
        279.   	/* reverse the order so we search from 'top to bottom'
        280.   	 * We were having memory leaks otherwise */
        281.   	for (i=lh->num_nodes-1; i>=0; i--)
                     ^
        282.   		{
        283.   		a=lh->b[i];

static void doall_util_fn(_LHASH *lh, int use_arg, LHASH_DOALL_FN_TYPE func,
			  LHASH_DOALL_ARG_FN_TYPE func_arg, void *arg)
	{
	int i;
	LHASH_NODE *a,*n;
	if (lh == NULL)
		return;
	for (i=lh->num_nodes-1; i>=0; i--)
		{
		a=lh->b[i];
		while (a != NULL)
			{
			n=a->next;
			if(use_arg)
				func_arg(a->data,arg);
			else
				func(a->data);
			a=n;
			}
		}
	}
['void SSL_free(SSL *s)\n\t{\n\tint i;\n\tif(s == NULL)\n\t    return;\n\ti=CRYPTO_add(&s->references,-1,CRYPTO_LOCK_SSL);\n#ifdef REF_PRINT\n\tREF_PRINT("SSL",s);\n#endif\n\tif (i > 0) return;\n#ifdef REF_CHECK\n\tif (i < 0)\n\t\t{\n\t\tfprintf(stderr,"SSL_free, bad reference count\\n");\n\t\tabort();\n\t\t}\n#endif\n\tif (s->param)\n\t\tX509_VERIFY_PARAM_free(s->param);\n\tCRYPTO_free_ex_data(CRYPTO_EX_INDEX_SSL, s, &s->ex_data);\n\tif (s->bbio != NULL)\n\t\t{\n\t\tif (s->bbio == s->wbio)\n\t\t\t{\n\t\t\ts->wbio=BIO_pop(s->wbio);\n\t\t\t}\n\t\tBIO_free(s->bbio);\n\t\ts->bbio=NULL;\n\t\t}\n\tif (s->rbio != NULL)\n\t\tBIO_free_all(s->rbio);\n\tif ((s->wbio != NULL) && (s->wbio != s->rbio))\n\t\tBIO_free_all(s->wbio);\n\tif (s->init_buf != NULL) BUF_MEM_free(s->init_buf);\n\tif (s->cipher_list != NULL) sk_SSL_CIPHER_free(s->cipher_list);\n\tif (s->cipher_list_by_id != NULL) sk_SSL_CIPHER_free(s->cipher_list_by_id);\n\tif (s->session != NULL)\n\t\t{\n\t\tssl_clear_bad_session(s);\n\t\tSSL_SESSION_free(s->session);\n\t\t}\n\tssl_clear_cipher_ctx(s);\n\tssl_clear_hash_ctx(&s->read_hash);\n\tssl_clear_hash_ctx(&s->write_hash);\n\tif (s->cert != NULL) ssl_cert_free(s->cert);\n#ifndef OPENSSL_NO_TLSEXT\n\tif (s->tlsext_hostname)\n\t\tOPENSSL_free(s->tlsext_hostname);\n\tif (s->initial_ctx) SSL_CTX_free(s->initial_ctx);\n#ifndef OPENSSL_NO_EC\n\tif (s->tlsext_ecpointformatlist) OPENSSL_free(s->tlsext_ecpointformatlist);\n\tif (s->tlsext_ellipticcurvelist) OPENSSL_free(s->tlsext_ellipticcurvelist);\n#endif\n\tif (s->tlsext_opaque_prf_input) OPENSSL_free(s->tlsext_opaque_prf_input);\n\tif (s->tlsext_ocsp_exts)\n\t\tsk_X509_EXTENSION_pop_free(s->tlsext_ocsp_exts,\n\t\t\t\t\t\tX509_EXTENSION_free);\n\tif (s->tlsext_ocsp_ids)\n\t\tsk_OCSP_RESPID_pop_free(s->tlsext_ocsp_ids, OCSP_RESPID_free);\n\tif (s->tlsext_ocsp_resp)\n\t\tOPENSSL_free(s->tlsext_ocsp_resp);\n#endif\n\tif (s->client_CA != NULL)\n\t\tsk_X509_NAME_pop_free(s->client_CA,X509_NAME_free);\n\tif (s->method != NULL) s->method->ssl_free(s);\n\tif (s->ctx) SSL_CTX_free(s->ctx);\n#ifndef\tOPENSSL_NO_KRB5\n\tif (s->kssl_ctx != NULL)\n\t\tkssl_ctx_free(s->kssl_ctx);\n#endif\n#if !defined(OPENSSL_NO_TLSEXT) && !defined(OPENSSL_NO_NEXTPROTONEG)\n\tif (s->next_proto_negotiated)\n\t\tOPENSSL_free(s->next_proto_negotiated);\n#endif\n#ifndef OPENSSL_NO_SRTP\n        if (s->srtp_profiles)\n            sk_SRTP_PROTECTION_PROFILE_free(s->srtp_profiles);\n#endif\n\tOPENSSL_free(s);\n\t}', 'void SSL_CTX_free(SSL_CTX *a)\n\t{\n\tint i;\n\tif (a == NULL) return;\n\ti=CRYPTO_add(&a->references,-1,CRYPTO_LOCK_SSL_CTX);\n#ifdef REF_PRINT\n\tREF_PRINT("SSL_CTX",a);\n#endif\n\tif (i > 0) return;\n#ifdef REF_CHECK\n\tif (i < 0)\n\t\t{\n\t\tfprintf(stderr,"SSL_CTX_free, bad reference count\\n");\n\t\tabort();\n\t\t}\n#endif\n\tif (a->param)\n\t\tX509_VERIFY_PARAM_free(a->param);\n\tif (a->sessions != NULL)\n\t\tSSL_CTX_flush_sessions(a,0);\n\tCRYPTO_free_ex_data(CRYPTO_EX_INDEX_SSL_CTX, a, &a->ex_data);\n\tif (a->sessions != NULL)\n\t\tlh_SSL_SESSION_free(a->sessions);\n\tif (a->cert_store != NULL)\n\t\tX509_STORE_free(a->cert_store);\n\tif (a->cipher_list != NULL)\n\t\tsk_SSL_CIPHER_free(a->cipher_list);\n\tif (a->cipher_list_by_id != NULL)\n\t\tsk_SSL_CIPHER_free(a->cipher_list_by_id);\n\tif (a->cert != NULL)\n\t\tssl_cert_free(a->cert);\n\tif (a->client_CA != NULL)\n\t\tsk_X509_NAME_pop_free(a->client_CA,X509_NAME_free);\n\tif (a->extra_certs != NULL)\n\t\tsk_X509_pop_free(a->extra_certs,X509_free);\n#if 0\n\tif (a->comp_methods != NULL)\n\t\tsk_SSL_COMP_pop_free(a->comp_methods,SSL_COMP_free);\n#else\n\ta->comp_methods = NULL;\n#endif\n#ifndef OPENSSL_NO_SRTP\n        if (a->srtp_profiles)\n                sk_SRTP_PROTECTION_PROFILE_free(a->srtp_profiles);\n#endif\n#ifndef OPENSSL_NO_PSK\n\tif (a->psk_identity_hint)\n\t\tOPENSSL_free(a->psk_identity_hint);\n#endif\n#ifndef OPENSSL_NO_SRP\n\tSSL_CTX_SRP_CTX_free(a);\n#endif\n#ifndef OPENSSL_NO_ENGINE\n\tif (a->client_cert_engine)\n\t\tENGINE_finish(a->client_cert_engine);\n#endif\n#ifndef OPENSSL_NO_BUF_FREELISTS\n\tif (a->wbuf_freelist)\n\t\tssl_buf_freelist_free(a->wbuf_freelist);\n\tif (a->rbuf_freelist)\n\t\tssl_buf_freelist_free(a->rbuf_freelist);\n#endif\n\tOPENSSL_free(a);\n\t}', 'void SSL_CTX_flush_sessions(SSL_CTX *s, long t)\n\t{\n\tunsigned long i;\n\tTIMEOUT_PARAM tp;\n\ttp.ctx=s;\n\ttp.cache=s->sessions;\n\tif (tp.cache == NULL) return;\n\ttp.time=t;\n\tCRYPTO_w_lock(CRYPTO_LOCK_SSL_CTX);\n\ti=CHECKED_LHASH_OF(SSL_SESSION, tp.cache)->down_load;\n\tCHECKED_LHASH_OF(SSL_SESSION, tp.cache)->down_load=0;\n\tlh_SSL_SESSION_doall_arg(tp.cache, LHASH_DOALL_ARG_FN(timeout),\n\t\t\t\t TIMEOUT_PARAM, &tp);\n\tCHECKED_LHASH_OF(SSL_SESSION, tp.cache)->down_load=i;\n\tCRYPTO_w_unlock(CRYPTO_LOCK_SSL_CTX);\n\t}', 'void lh_doall_arg(_LHASH *lh, LHASH_DOALL_ARG_FN_TYPE func, void *arg)\n\t{\n\tdoall_util_fn(lh, 1, (LHASH_DOALL_FN_TYPE)0, func, arg);\n\t}', 'static void doall_util_fn(_LHASH *lh, int use_arg, LHASH_DOALL_FN_TYPE func,\n\t\t\t  LHASH_DOALL_ARG_FN_TYPE func_arg, void *arg)\n\t{\n\tint i;\n\tLHASH_NODE *a,*n;\n\tif (lh == NULL)\n\t\treturn;\n\tfor (i=lh->num_nodes-1; i>=0; i--)\n\t\t{\n\t\ta=lh->b[i];\n\t\twhile (a != NULL)\n\t\t\t{\n\t\t\tn=a->next;\n\t\t\tif(use_arg)\n\t\t\t\tfunc_arg(a->data,arg);\n\t\t\telse\n\t\t\t\tfunc(a->data);\n\t\t\ta=n;\n\t\t\t}\n\t\t}\n\t}']