crypto/err/err.c:553: error: INTEGER_OVERFLOW_L2
  ([0, +oo] - 1):unsigned32 by call to `lh_delete`.
Showing all 9 steps of the trace


crypto/err/err.c:548:12: Call
546.   
547.       CRYPTO_w_lock(CRYPTO_LOCK_ERR);
548.       hash = get_hash(0, 0);
                  ^
549.       if (hash) {
550.           for (; str->error; str++) {

crypto/err/err.c:279:26: Call
  277.       if (!int_error_hash && create) {
  278.           CRYPTO_push_info("get_hash (err.c)");
  279.           int_error_hash = lh_ERR_STRING_DATA_new();
                                  ^
  280.           CRYPTO_pop_info();
  281.       }

crypto/lhash/lhash.c:128:5: Assignment
    126.       ret->num_nodes = MIN_NODES / 2;
    127.       ret->num_alloc_nodes = MIN_NODES;
    128.       ret->p = 0;
               ^
    129.       ret->pmax = MIN_NODES / 2;
    130.       ret->up_load = UP_LOAD;

crypto/err/err.c:553:19: Call
551.               if (lib)
552.                   str->error |= ERR_PACK(lib, 0, 0);
553.               (void)lh_ERR_STRING_DATA_delete(hash, str);
                         ^
554.           }
555.       }

crypto/lhash/lhash.c:209:1: Parameter `lh->pmax`
  207.   }
  208.   
  209. > void *lh_delete(_LHASH *lh, const void *data)
  210.   {
  211.       unsigned long hash;

crypto/lhash/lhash.c:232:9: Call
  230.       if ((lh->num_nodes > MIN_NODES) &&
  231.           (lh->down_load >= (lh->num_items * LH_LOAD_MULT / lh->num_nodes)))
  232.           contract(lh);
                 ^
  233.   
  234.       return (ret);

crypto/lhash/lhash.c:343:1: <LHS trace>
341.   }
342.   
343. > static void contract(_LHASH *lh)
344.   {
345.       LHASH_NODE **n, *n1, *np;

crypto/lhash/lhash.c:343:1: Parameter `lh->p`
    341.   }
    342.   
    343. > static void contract(_LHASH *lh)
    344.   {
    345.       LHASH_NODE **n, *n1, *np;

crypto/lhash/lhash.c:347:10: Binary operation: ([0, +oo] - 1):unsigned32 by call to `lh_delete` 
    345.       LHASH_NODE **n, *n1, *np;
    346.   
    347.       np = lh->b[lh->p + lh->pmax - 1];
                    ^
    348.       lh->b[lh->p + lh->pmax - 1] = NULL; /* 24/07-92 - eay - weird but :-( */
    349.       if (lh->p == 0) {

static void contract(_LHASH *lh)
{
    LHASH_NODE **n, *n1, *np;
    np = lh->b[lh->p + lh->pmax - 1];
    lh->b[lh->p + lh->pmax - 1] = NULL;
    if (lh->p == 0) {
        n = OPENSSL_realloc(lh->b,
                            (unsigned int)(sizeof(LHASH_NODE *) * lh->pmax));
        if (n == NULL) {
            lh->error++;
            return;
        }
        lh->num_contract_reallocs++;
        lh->num_alloc_nodes /= 2;
        lh->pmax /= 2;
        lh->p = lh->pmax - 1;
        lh->b = n;
    } else
        lh->p--;
    lh->num_nodes--;
    lh->num_contracts++;
    n1 = lh->b[(int)lh->p];
    if (n1 == NULL)
        lh->b[(int)lh->p] = np;
    else {
        while (n1->next != NULL)
            n1 = n1->next;
        n1->next = np;
    }
}
['void ERR_unload_strings(int lib, ERR_STRING_DATA *str)\n{\n    LHASH_OF(ERR_STRING_DATA) *hash;\n    CRYPTO_w_lock(CRYPTO_LOCK_ERR);\n    hash = get_hash(0, 0);\n    if (hash) {\n        for (; str->error; str++) {\n            if (lib)\n                str->error |= ERR_PACK(lib, 0, 0);\n            (void)lh_ERR_STRING_DATA_delete(hash, str);\n        }\n    }\n    CRYPTO_w_unlock(CRYPTO_LOCK_ERR);\n}', 'static LHASH_OF(ERR_STRING_DATA) *get_hash(int create, int lockit)\n{\n    LHASH_OF(ERR_STRING_DATA) *ret = NULL;\n    if (lockit)\n        CRYPTO_w_lock(CRYPTO_LOCK_ERR);\n    if (!int_error_hash && create) {\n        CRYPTO_push_info("get_hash (err.c)");\n        int_error_hash = lh_ERR_STRING_DATA_new();\n        CRYPTO_pop_info();\n    }\n    if (int_error_hash)\n        ret = int_error_hash;\n    if (lockit)\n        CRYPTO_w_unlock(CRYPTO_LOCK_ERR);\n    return ret;\n}', '_LHASH *lh_new(LHASH_HASH_FN_TYPE h, LHASH_COMP_FN_TYPE c)\n{\n    _LHASH *ret;\n    int i;\n    if ((ret = OPENSSL_malloc(sizeof(*ret))) == NULL)\n        goto err0;\n    if ((ret->b = OPENSSL_malloc(sizeof(*ret->b) * MIN_NODES)) == NULL)\n        goto err1;\n    for (i = 0; i < MIN_NODES; i++)\n        ret->b[i] = NULL;\n    ret->comp = ((c == NULL) ? (LHASH_COMP_FN_TYPE)strcmp : c);\n    ret->hash = ((h == NULL) ? (LHASH_HASH_FN_TYPE)lh_strhash : h);\n    ret->num_nodes = MIN_NODES / 2;\n    ret->num_alloc_nodes = MIN_NODES;\n    ret->p = 0;\n    ret->pmax = MIN_NODES / 2;\n    ret->up_load = UP_LOAD;\n    ret->down_load = DOWN_LOAD;\n    ret->num_items = 0;\n    ret->num_expands = 0;\n    ret->num_expand_reallocs = 0;\n    ret->num_contracts = 0;\n    ret->num_contract_reallocs = 0;\n    ret->num_hash_calls = 0;\n    ret->num_comp_calls = 0;\n    ret->num_insert = 0;\n    ret->num_replace = 0;\n    ret->num_delete = 0;\n    ret->num_no_delete = 0;\n    ret->num_retrieve = 0;\n    ret->num_retrieve_miss = 0;\n    ret->num_hash_comps = 0;\n    ret->error = 0;\n    return (ret);\n err1:\n    OPENSSL_free(ret);\n err0:\n    return (NULL);\n}', 'void *lh_delete(_LHASH *lh, const void *data)\n{\n    unsigned long hash;\n    LHASH_NODE *nn, **rn;\n    void *ret;\n    lh->error = 0;\n    rn = getrn(lh, data, &hash);\n    if (*rn == NULL) {\n        lh->num_no_delete++;\n        return (NULL);\n    } else {\n        nn = *rn;\n        *rn = nn->next;\n        ret = nn->data;\n        OPENSSL_free(nn);\n        lh->num_delete++;\n    }\n    lh->num_items--;\n    if ((lh->num_nodes > MIN_NODES) &&\n        (lh->down_load >= (lh->num_items * LH_LOAD_MULT / lh->num_nodes)))\n        contract(lh);\n    return (ret);\n}', 'static void contract(_LHASH *lh)\n{\n    LHASH_NODE **n, *n1, *np;\n    np = lh->b[lh->p + lh->pmax - 1];\n    lh->b[lh->p + lh->pmax - 1] = NULL;\n    if (lh->p == 0) {\n        n = OPENSSL_realloc(lh->b,\n                            (unsigned int)(sizeof(LHASH_NODE *) * lh->pmax));\n        if (n == NULL) {\n            lh->error++;\n            return;\n        }\n        lh->num_contract_reallocs++;\n        lh->num_alloc_nodes /= 2;\n        lh->pmax /= 2;\n        lh->p = lh->pmax - 1;\n        lh->b = n;\n    } else\n        lh->p--;\n    lh->num_nodes--;\n    lh->num_contracts++;\n    n1 = lh->b[(int)lh->p];\n    if (n1 == NULL)\n        lh->b[(int)lh->p] = np;\n    else {\n        while (n1->next != NULL)\n            n1 = n1->next;\n        n1->next = np;\n    }\n}']