apps/s_server.c:763: error: INTEGER_OVERFLOW_L2
  ([0, +oo] - 1):unsigned32 by call to `SSL_free`.
Showing all 16 steps of the trace


apps/s_server.c:587:14: Call
585.   
586.   	if (con == NULL) {
587.   		con=(SSL *)SSL_new(ctx);
                    ^
588.   		if(context)
589.   		      SSL_set_session_id_context(con, context, strlen(context));

ssl/ssl_lib.c:162:1: Parameter `ctx->cert_store->certs->num_nodes`
  160.   	}
  161.   
  162. > SSL *SSL_new(SSL_CTX *ctx)
  163.   	{
  164.   	SSL *s;

apps/s_server.c:591:2: Call
589.   		      SSL_set_session_id_context(con, context, strlen(context));
590.   	}
591.   	SSL_clear(con);
        ^
592.   
593.   	sbio=BIO_new_socket(s,BIO_NOCLOSE);

ssl/ssl_lib.c:82:1: Parameter `s->ctx->sessions->num_nodes`
  80.   	};
  81.   
  82. > int SSL_clear(SSL *s)
  83.   	{
  84.   	int state;

apps/s_server.c:763:19: Call
761.   	SSL_shutdown(con);
762.   #endif
763.   	if (con != NULL) SSL_free(con);
                         ^
764.   	BIO_printf(bio_s_out,"CONNECTION CLOSED\n");
765.   	if (buf != NULL)

ssl/ssl_lib.c:233:1: Parameter `s->ctx->cert_store->certs->num_nodes`
  231.       }
  232.   
  233. > void SSL_free(SSL *s)
  234.   	{
  235.   	int i;

ssl/ssl_lib.c:288:14: Call
  286.   	/* Free up if allocated */
  287.   
  288.   	if (s->ctx) SSL_CTX_free(s->ctx);
                      ^
  289.   
  290.   	if (s->client_CA != NULL)

ssl/ssl_lib.c:1005:1: Parameter `a->cert_store->certs->num_nodes`
    1003.       { Free(comp); }
    1004.   
    1005. > void SSL_CTX_free(SSL_CTX *a)
    1006.   	{
    1007.   	int i;

ssl/ssl_lib.c:1031:3: Call
    1029.   		}
    1030.   	if (a->cert_store != NULL)
    1031.   		X509_STORE_free(a->cert_store);
              ^
    1032.   	if (a->cipher_list != NULL)
    1033.   		sk_SSL_CIPHER_free(a->cipher_list);

crypto/x509/x509_lu.c:229:1: Parameter `vfy->certs->num_nodes`
      227.   	}
      228.   
      229. > void X509_STORE_free(X509_STORE *vfy)
      230.   	{
      231.   	int i;

crypto/x509/x509_lu.c:248:2: Call
      246.   
      247.   	CRYPTO_free_ex_data(x509_store_meth,(char *)vfy,&vfy->ex_data);
      248.   	lh_doall(vfy->certs,cleanup);
              ^
      249.   	lh_free(vfy->certs);
      250.   	Free(vfy);

crypto/lhash/lhash.c:284:1: Parameter `lh->num_nodes`
        282.   	}
        283.   
        284. > void lh_doall(LHASH *lh, void (*func)())
        285.   	{
        286.   	lh_doall_arg(lh,func,NULL);

crypto/lhash/lhash.c:286:2: Call
        284.   void lh_doall(LHASH *lh, void (*func)())
        285.   	{
        286.   	lh_doall_arg(lh,func,NULL);
                ^
        287.   	}
        288.   

crypto/lhash/lhash.c:289:1: <LHS trace>
287.   	}
288.   
289. > void lh_doall_arg(LHASH *lh, void (*func)(), char *arg)
290.   	{
291.   	int i;

crypto/lhash/lhash.c:289:1: Parameter `lh->num_nodes`
          287.   	}
          288.   
          289. > void lh_doall_arg(LHASH *lh, void (*func)(), char *arg)
          290.   	{
          291.   	int i;

crypto/lhash/lhash.c:296:7: Binary operation: ([0, +oo] - 1):unsigned32 by call to `SSL_free` 
          294.   	/* reverse the order so we search from 'top to bottom'
          295.   	 * We were having memory leaks otherwise */
          296.   	for (i=lh->num_nodes-1; i>=0; i--)
                       ^
          297.   		{
          298.   		a=lh->b[i];

void lh_doall_arg(LHASH *lh, void (*func)(), char *arg)
	{
	int i;
	LHASH_NODE *a,*n;
	for (i=lh->num_nodes-1; i>=0; i--)
		{
		a=lh->b[i];
		while (a != NULL)
			{
			n=a->next;
			func(a->data,arg);
			a=n;
			}
		}
	}
['static int sv_body(char *hostname, int s, char *context)\n\t{\n\tchar *buf=NULL;\n\tfd_set readfds;\n\tint ret=1,width;\n\tint k,i;\n\tunsigned long l;\n\tSSL *con=NULL;\n\tBIO *sbio;\n\tif ((buf=Malloc(bufsize)) == NULL)\n\t\t{\n\t\tBIO_printf(bio_err,"out of memory\\n");\n\t\tgoto err;\n\t\t}\n#ifdef FIONBIO\n\tif (s_nbio)\n\t\t{\n\t\tunsigned long sl=1;\n\t\tif (!s_quiet)\n\t\t\tBIO_printf(bio_err,"turning on non blocking io\\n");\n\t\tif (BIO_socket_ioctl(s,FIONBIO,&sl) < 0)\n\t\t\tERR_print_errors(bio_err);\n\t\t}\n#endif\n\tif (con == NULL) {\n\t\tcon=(SSL *)SSL_new(ctx);\n\t\tif(context)\n\t\t      SSL_set_session_id_context(con, context, strlen(context));\n\t}\n\tSSL_clear(con);\n\tsbio=BIO_new_socket(s,BIO_NOCLOSE);\n\tif (s_nbio_test)\n\t\t{\n\t\tBIO *test;\n\t\ttest=BIO_new(BIO_f_nbio_test());\n\t\tsbio=BIO_push(test,sbio);\n\t\t}\n\tSSL_set_bio(con,sbio,sbio);\n\tSSL_set_accept_state(con);\n\tif (s_debug)\n\t\t{\n\t\tcon->debug=1;\n\t\tBIO_set_callback(SSL_get_rbio(con),bio_dump_cb);\n\t\tBIO_set_callback_arg(SSL_get_rbio(con),bio_s_out);\n\t\t}\n\twidth=s+1;\n\tfor (;;)\n\t\t{\n\t\tFD_ZERO(&readfds);\n#ifndef WINDOWS\n\t\tFD_SET(fileno(stdin),&readfds);\n#endif\n\t\tFD_SET(s,&readfds);\n\t\ti=select(width,&readfds,NULL,NULL,NULL);\n\t\tif (i <= 0) continue;\n\t\tif (FD_ISSET(fileno(stdin),&readfds))\n\t\t\t{\n\t\t\ti=read(fileno(stdin),buf,bufsize);\n\t\t\tif (!s_quiet)\n\t\t\t\t{\n\t\t\t\tif ((i <= 0) || (buf[0] == \'Q\'))\n\t\t\t\t\t{\n\t\t\t\t\tBIO_printf(bio_s_out,"DONE\\n");\n\t\t\t\t\tSHUTDOWN(s);\n\t\t\t\t\tclose_accept_socket();\n\t\t\t\t\tret= -11;\n\t\t\t\t\tgoto err;\n\t\t\t\t\t}\n\t\t\t\tif ((i <= 0) || (buf[0] == \'q\'))\n\t\t\t\t\t{\n\t\t\t\t\tBIO_printf(bio_s_out,"DONE\\n");\n\t\t\t\t\tSHUTDOWN(s);\n\t\t\t\t\tgoto err;\n\t\t\t\t\t}\n\t\t\t\tif ((buf[0] == \'r\') &&\n\t\t\t\t\t((buf[1] == \'\\n\') || (buf[1] == \'\\r\')))\n\t\t\t\t\t{\n\t\t\t\t\tSSL_renegotiate(con);\n\t\t\t\t\ti=SSL_do_handshake(con);\n\t\t\t\t\tprintf("SSL_do_handshake -> %d\\n",i);\n\t\t\t\t\ti=0;\n\t\t\t\t\tcontinue;\n\t\t\t\t\t}\n\t\t\t\tif ((buf[0] == \'R\') &&\n\t\t\t\t\t((buf[1] == \'\\n\') || (buf[1] == \'\\r\')))\n\t\t\t\t\t{\n\t\t\t\t\tSSL_set_verify(con,\n\t\t\t\t\t\tSSL_VERIFY_PEER|SSL_VERIFY_CLIENT_ONCE,NULL);\n\t\t\t\t\tSSL_renegotiate(con);\n\t\t\t\t\ti=SSL_do_handshake(con);\n\t\t\t\t\tprintf("SSL_do_handshake -> %d\\n",i);\n\t\t\t\t\ti=0;\n\t\t\t\t\tcontinue;\n\t\t\t\t\t}\n\t\t\t\tif (buf[0] == \'P\')\n\t\t\t\t\t{\n\t\t\t\t\tstatic char *str="Lets print some clear text\\n";\n\t\t\t\t\tBIO_write(SSL_get_wbio(con),str,strlen(str));\n\t\t\t\t\t}\n\t\t\t\tif (buf[0] == \'S\')\n\t\t\t\t\t{\n\t\t\t\t\tprint_stats(bio_s_out,SSL_get_SSL_CTX(con));\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\tl=k=0;\n\t\t\tfor (;;)\n\t\t\t\t{\n#ifdef RENEG\n{ static count=0; if (++count == 100) { count=0; SSL_renegotiate(con); } }\n#endif\n\t\t\t\tk=SSL_write(con,&(buf[l]),(unsigned int)i);\n\t\t\t\tswitch (SSL_get_error(con,k))\n\t\t\t\t\t{\n\t\t\t\tcase SSL_ERROR_NONE:\n\t\t\t\t\tbreak;\n\t\t\t\tcase SSL_ERROR_WANT_WRITE:\n\t\t\t\tcase SSL_ERROR_WANT_READ:\n\t\t\t\tcase SSL_ERROR_WANT_X509_LOOKUP:\n\t\t\t\t\tBIO_printf(bio_s_out,"Write BLOCK\\n");\n\t\t\t\t\tbreak;\n\t\t\t\tcase SSL_ERROR_SYSCALL:\n\t\t\t\tcase SSL_ERROR_SSL:\n\t\t\t\t\tBIO_printf(bio_s_out,"ERROR\\n");\n\t\t\t\t\tERR_print_errors(bio_err);\n\t\t\t\t\tret=1;\n\t\t\t\t\tgoto err;\n\t\t\t\tcase SSL_ERROR_ZERO_RETURN:\n\t\t\t\t\tBIO_printf(bio_s_out,"DONE\\n");\n\t\t\t\t\tret=1;\n\t\t\t\t\tgoto err;\n\t\t\t\t\t}\n\t\t\t\tl+=k;\n\t\t\t\ti-=k;\n\t\t\t\tif (i <= 0) break;\n\t\t\t\t}\n\t\t\t}\n\t\tif (FD_ISSET(s,&readfds))\n\t\t\t{\n\t\t\tif (!SSL_is_init_finished(con))\n\t\t\t\t{\n\t\t\t\ti=init_ssl_connection(con);\n\t\t\t\tif (i < 0)\n\t\t\t\t\t{\n\t\t\t\t\tret=0;\n\t\t\t\t\tgoto err;\n\t\t\t\t\t}\n\t\t\t\telse if (i == 0)\n\t\t\t\t\t{\n\t\t\t\t\tret=1;\n\t\t\t\t\tgoto err;\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\telse\n\t\t\t\t{\nagain:\n\t\t\t\ti=SSL_read(con,(char *)buf,bufsize);\n\t\t\t\tswitch (SSL_get_error(con,i))\n\t\t\t\t\t{\n\t\t\t\tcase SSL_ERROR_NONE:\n\t\t\t\t\twrite(fileno(stdout),buf,\n\t\t\t\t\t\t(unsigned int)i);\n\t\t\t\t\tif (SSL_pending(con)) goto again;\n\t\t\t\t\tbreak;\n\t\t\t\tcase SSL_ERROR_WANT_WRITE:\n\t\t\t\tcase SSL_ERROR_WANT_READ:\n\t\t\t\tcase SSL_ERROR_WANT_X509_LOOKUP:\n\t\t\t\t\tBIO_printf(bio_s_out,"Read BLOCK\\n");\n\t\t\t\t\tbreak;\n\t\t\t\tcase SSL_ERROR_SYSCALL:\n\t\t\t\tcase SSL_ERROR_SSL:\n\t\t\t\t\tBIO_printf(bio_s_out,"ERROR\\n");\n\t\t\t\t\tERR_print_errors(bio_err);\n\t\t\t\t\tret=1;\n\t\t\t\t\tgoto err;\n\t\t\t\tcase SSL_ERROR_ZERO_RETURN:\n\t\t\t\t\tBIO_printf(bio_s_out,"DONE\\n");\n\t\t\t\t\tret=1;\n\t\t\t\t\tgoto err;\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t}\nerr:\n\tBIO_printf(bio_s_out,"shutting down SSL\\n");\n#if 1\n\tSSL_set_shutdown(con,SSL_SENT_SHUTDOWN|SSL_RECEIVED_SHUTDOWN);\n#else\n\tSSL_shutdown(con);\n#endif\n\tif (con != NULL) SSL_free(con);\n\tBIO_printf(bio_s_out,"CONNECTION CLOSED\\n");\n\tif (buf != NULL)\n\t\t{\n\t\tmemset(buf,0,bufsize);\n\t\tFree(buf);\n\t\t}\n\tif (ret >= 0)\n\t\tBIO_printf(bio_s_out,"ACCEPT\\n");\n\treturn(ret);\n\t}', 'SSL *SSL_new(SSL_CTX *ctx)\n\t{\n\tSSL *s;\n\tif (ctx == NULL)\n\t\t{\n\t\tSSLerr(SSL_F_SSL_NEW,SSL_R_NULL_SSL_CTX);\n\t\treturn(NULL);\n\t\t}\n\tif (ctx->method == NULL)\n\t\t{\n\t\tSSLerr(SSL_F_SSL_NEW,SSL_R_SSL_CTX_HAS_NO_DEFAULT_SSL_VERSION);\n\t\treturn(NULL);\n\t\t}\n\ts=(SSL *)Malloc(sizeof(SSL));\n\tif (s == NULL) goto err;\n\tmemset(s,0,sizeof(SSL));\n\tif (ctx->default_cert != NULL)\n\t\t{\n\t\tCRYPTO_add(&ctx->default_cert->references,1,\n\t\t\t   CRYPTO_LOCK_SSL_CERT);\n\t\ts->cert=ctx->default_cert;\n\t\t}\n\telse\n\t\ts->cert=NULL;\n\ts->verify_mode=ctx->verify_mode;\n\ts->verify_callback=ctx->default_verify_callback;\n\tCRYPTO_add(&ctx->references,1,CRYPTO_LOCK_SSL_CTX);\n\ts->ctx=ctx;\n\ts->verify_result=X509_V_OK;\n\ts->method=ctx->method;\n\tif (!s->method->ssl_new(s))\n\t\t{\n\t\tSSL_CTX_free(ctx);\n\t\tFree(s);\n\t\tgoto err;\n\t\t}\n\ts->quiet_shutdown=ctx->quiet_shutdown;\n\ts->references=1;\n\ts->server=(ctx->method->ssl_accept == ssl_undefined_function)?0:1;\n\ts->options=ctx->options;\n\tSSL_clear(s);\n\tCRYPTO_new_ex_data(ssl_meth,(char *)s,&s->ex_data);\n\treturn(s);\nerr:\n\tSSLerr(SSL_F_SSL_NEW,ERR_R_MALLOC_FAILURE);\n\treturn(NULL);\n\t}', 'int SSL_clear(SSL *s)\n\t{\n\tint state;\n\tif (s->method == NULL)\n\t\t{\n\t\tSSLerr(SSL_F_SSL_CLEAR,SSL_R_NO_METHOD_SPECIFIED);\n\t\treturn(0);\n\t\t}\n\ts->error=0;\n\ts->hit=0;\n\ts->shutdown=0;\n#if 0\n\tif (s->new_session) return(1);\n#endif\n\tstate=s->state;\n\ts->type=0;\n\ts->state=SSL_ST_BEFORE|((s->server)?SSL_ST_ACCEPT:SSL_ST_CONNECT);\n\ts->version=s->method->version;\n\ts->client_version=s->version;\n\ts->rwstate=SSL_NOTHING;\n\ts->rstate=SSL_ST_READ_HEADER;\n\ts->read_ahead=s->ctx->read_ahead;\n\tif (s->init_buf != NULL)\n\t\t{\n\t\tBUF_MEM_free(s->init_buf);\n\t\ts->init_buf=NULL;\n\t\t}\n\tssl_clear_cipher_ctx(s);\n\tif (ssl_clear_bad_session(s))\n\t\t{\n\t\tSSL_SESSION_free(s->session);\n\t\ts->session=NULL;\n\t\t}\n\ts->first_packet=0;\n#if 1\n\tif ((s->session == NULL) && (s->method != s->ctx->method))\n\t\t{\n\t\ts->method->ssl_free(s);\n\t\ts->method=s->ctx->method;\n\t\tif (!s->method->ssl_new(s))\n\t\t\treturn(0);\n\t\t}\n\telse\n#endif\n\t\ts->method->ssl_clear(s);\n\treturn(1);\n\t}', 'void SSL_free(SSL *s)\n\t{\n\tint i;\n\tif(s == NULL)\n\t    return;\n\ti=CRYPTO_add(&s->references,-1,CRYPTO_LOCK_SSL);\n#ifdef REF_PRINT\n\tREF_PRINT("SSL",s);\n#endif\n\tif (i > 0) return;\n#ifdef REF_CHECK\n\tif (i < 0)\n\t\t{\n\t\tfprintf(stderr,"SSL_free, bad reference count\\n");\n\t\tabort();\n\t\t}\n#endif\n\tCRYPTO_free_ex_data(ssl_meth,(char *)s,&s->ex_data);\n\tif (s->bbio != NULL)\n\t\t{\n\t\tif (s->bbio == s->wbio)\n\t\t\t{\n\t\t\ts->wbio=BIO_pop(s->wbio);\n\t\t\t}\n\t\tBIO_free(s->bbio);\n\t\ts->bbio=NULL;\n\t\t}\n\tif (s->rbio != NULL)\n\t\tBIO_free_all(s->rbio);\n\tif ((s->wbio != NULL) && (s->wbio != s->rbio))\n\t\tBIO_free_all(s->wbio);\n\tif (s->init_buf != NULL) BUF_MEM_free(s->init_buf);\n\tif (s->cipher_list != NULL) sk_SSL_CIPHER_free(s->cipher_list);\n\tif (s->cipher_list_by_id != NULL) sk_SSL_CIPHER_free(s->cipher_list_by_id);\n\tif (s->session != NULL)\n\t\t{\n\t\tssl_clear_bad_session(s);\n\t\tSSL_SESSION_free(s->session);\n\t\t}\n\tssl_clear_cipher_ctx(s);\n\tif (s->cert != NULL) ssl_cert_free(s->cert);\n\tif (s->ctx) SSL_CTX_free(s->ctx);\n\tif (s->client_CA != NULL)\n\t\tsk_X509_NAME_pop_free(s->client_CA,X509_NAME_free);\n\tif (s->method != NULL) s->method->ssl_free(s);\n\tFree((char *)s);\n\t}', 'void X509_STORE_free(X509_STORE *vfy)\n\t{\n\tint i;\n\tSTACK *sk;\n\tX509_LOOKUP *lu;\n\tif(vfy == NULL)\n\t    return;\n\tsk=vfy->get_cert_methods;\n\tfor (i=0; i<sk_num(sk); i++)\n\t\t{\n\t\tlu=(X509_LOOKUP *)sk_value(sk,i);\n\t\tX509_LOOKUP_shutdown(lu);\n\t\tX509_LOOKUP_free(lu);\n\t\t}\n\tsk_free(sk);\n\tCRYPTO_free_ex_data(x509_store_meth,(char *)vfy,&vfy->ex_data);\n\tlh_doall(vfy->certs,cleanup);\n\tlh_free(vfy->certs);\n\tFree(vfy);\n\t}', 'void lh_doall(LHASH *lh, void (*func)())\n\t{\n\tlh_doall_arg(lh,func,NULL);\n\t}', 'void lh_doall_arg(LHASH *lh, void (*func)(), char *arg)\n\t{\n\tint i;\n\tLHASH_NODE *a,*n;\n\tfor (i=lh->num_nodes-1; i>=0; i--)\n\t\t{\n\t\ta=lh->b[i];\n\t\twhile (a != NULL)\n\t\t\t{\n\t\t\tn=a->next;\n\t\t\tfunc(a->data,arg);\n\t\t\ta=n;\n\t\t\t}\n\t\t}\n\t}']