ssl/s2_pkt.c:142: error: INTEGER_OVERFLOW_L2
  ([0, 32769] - [-oo, 4]):unsigned32 by call to `read_n`.
Showing all 7 steps of the trace


ssl/s2_pkt.c:99:1: Parameter `s->s2->rbuf_left`
97.    * This routine will return 0 to len bytes, decrypted etc if required.
98.    */
99. > int ssl2_read(SSL *s, void *buf, int len)
100.   	{
101.   	int n;

ssl/s2_pkt.c:142:6: Call
140.   		if (s->first_packet)
141.   			{
142.   			n=read_n(s,5,SSL2_MAX_RECORD_LENGTH_2_BYTE_HEADER+2,0);
            ^
143.   			if (n <= 0) return(n); /* error or non-blocking */
144.   			s->first_packet=0;

ssl/s2_pkt.c:270:1: <LHS trace>
268.   	}
269.   
270. > static int read_n(SSL *s, unsigned int n, unsigned int max,
271.   	     unsigned int extend)
272.   	{

ssl/s2_pkt.c:270:1: Parameter `max`
  268.   	}
  269.   
  270. > static int read_n(SSL *s, unsigned int n, unsigned int max,
  271.   	     unsigned int extend)
  272.   	{

ssl/s2_pkt.c:270:1: <RHS trace>
268.   	}
269.   
270. > static int read_n(SSL *s, unsigned int n, unsigned int max,
271.   	     unsigned int extend)
272.   	{

ssl/s2_pkt.c:270:1: Parameter `n`
  268.   	}
  269.   
  270. > static int read_n(SSL *s, unsigned int n, unsigned int max,
  271.   	     unsigned int extend)
  272.   	{

ssl/s2_pkt.c:331:6: Binary operation: ([0, 32769] - [-oo, 4]):unsigned32 by call to `read_n` 
  329.   			{
  330.   			s->rwstate=SSL_READING;
  331.   			i=BIO_read(s->rbio,(char *)&(s->s2->rbuf[off+newb]),
              ^
  332.   				max-newb);
  333.   			}

static int read_n(SSL *s, unsigned int n, unsigned int max,
	     unsigned int extend)
	{
	int i,off,newb;
	if (s->s2->rbuf_left >= (int)n)
		{
		if (extend)
			s->packet_length+=n;
		else
			{
			s->packet= &(s->s2->rbuf[s->s2->rbuf_offs]);
			s->packet_length=n;
			}
		s->s2->rbuf_left-=n;
		s->s2->rbuf_offs+=n;
		return(n);
		}
	if (!s->read_ahead) max=n;
	if (max > (unsigned int)(SSL2_MAX_RECORD_LENGTH_2_BYTE_HEADER+2))
		max=SSL2_MAX_RECORD_LENGTH_2_BYTE_HEADER+2;
	off=0;
	if ((s->s2->rbuf_left != 0) || ((s->packet_length != 0) && extend))
		{
		newb=s->s2->rbuf_left;
		if (extend)
			{
			off=s->packet_length;
			if (s->packet != s->s2->rbuf)
				memcpy(s->s2->rbuf,s->packet,
					(unsigned int)newb+off);
			}
		else if (s->s2->rbuf_offs != 0)
			{
			memcpy(s->s2->rbuf,&(s->s2->rbuf[s->s2->rbuf_offs]),
				(unsigned int)newb);
			s->s2->rbuf_offs=0;
			}
		s->s2->rbuf_left=0;
		}
	else
		newb=0;
	s->packet=s->s2->rbuf;
	while (newb < (int)n)
		{
		clear_sys_error();
		if (s->rbio != NULL)
			{
			s->rwstate=SSL_READING;
			i=BIO_read(s->rbio,(char *)&(s->s2->rbuf[off+newb]),
				max-newb);
			}
		else
			{
			SSLerr(SSL_F_READ_N,SSL_R_READ_BIO_NOT_SET);
			i= -1;
			}
#ifdef PKT_DEBUG
		if (s->debug & 0x01) sleep(1);
#endif
		if (i <= 0)
			{
			s->s2->rbuf_left+=newb;
			return(i);
			}
		newb+=i;
		}
	if (newb > (int)n)
		{
		s->s2->rbuf_offs=n+off;
		s->s2->rbuf_left=newb-n;
		}
	else
		{
		s->s2->rbuf_offs=0;
		s->s2->rbuf_left=0;
		}
	if (extend)
		s->packet_length+=n;
	else
		s->packet_length=n;
	s->rwstate=SSL_NOTHING;
	return(n);
	}
['int ssl2_read(SSL *s, void *buf, int len)\n\t{\n\tint n;\n\tunsigned char mac[MAX_MAC_SIZE];\n\tunsigned char *p;\n\tint i;\n\tunsigned int mac_size=0;\nssl2_read_again:\n\tif (SSL_in_init(s) && !s->in_handshake)\n\t\t{\n\t\tn=s->handshake_func(s);\n\t\tif (n < 0) return(n);\n\t\tif (n == 0)\n\t\t\t{\n\t\t\tSSLerr(SSL_F_SSL2_READ,SSL_R_SSL_HANDSHAKE_FAILURE);\n\t\t\treturn(-1);\n\t\t\t}\n\t\t}\n\tclear_sys_error();\n\ts->rwstate=SSL_NOTHING;\n\tif (len <= 0) return(len);\n\tif (s->s2->ract_data_length != 0)\n\t\t{\n\t\tif (len > s->s2->ract_data_length)\n\t\t\tn=s->s2->ract_data_length;\n\t\telse\n\t\t\tn=len;\n\t\tmemcpy(buf,s->s2->ract_data,(unsigned int)n);\n\t\ts->s2->ract_data_length-=n;\n\t\ts->s2->ract_data+=n;\n\t\tif (s->s2->ract_data_length == 0)\n\t\t\ts->rstate=SSL_ST_READ_HEADER;\n\t\treturn(n);\n\t\t}\n\tif (s->rstate == SSL_ST_READ_HEADER)\n\t\t{\n\t\tif (s->first_packet)\n\t\t\t{\n\t\t\tn=read_n(s,5,SSL2_MAX_RECORD_LENGTH_2_BYTE_HEADER+2,0);\n\t\t\tif (n <= 0) return(n);\n\t\t\ts->first_packet=0;\n\t\t\tp=s->packet;\n\t\t\tif (!((p[0] & 0x80) && (\n\t\t\t\t(p[2] == SSL2_MT_CLIENT_HELLO) ||\n\t\t\t\t(p[2] == SSL2_MT_SERVER_HELLO))))\n\t\t\t\t{\n\t\t\t\tSSLerr(SSL_F_SSL2_READ,SSL_R_NON_SSLV2_INITIAL_PACKET);\n\t\t\t\treturn(-1);\n\t\t\t\t}\n\t\t\t}\n\t\telse\n\t\t\t{\n\t\t\tn=read_n(s,2,SSL2_MAX_RECORD_LENGTH_2_BYTE_HEADER+2,0);\n\t\t\tif (n <= 0) return(n);\n\t\t\t}\n\t\ts->rstate=SSL_ST_READ_BODY;\n\t\tp=s->packet;\n\t\ts->s2->escape=0;\n\t\ts->s2->rlength=(((unsigned int)p[0])<<8)|((unsigned int)p[1]);\n\t\tif ((p[0] & TWO_BYTE_BIT))\n\t\t\t{\n\t\t\ts->s2->three_byte_header=0;\n\t\t\ts->s2->rlength&=TWO_BYTE_MASK;\n\t\t\t}\n\t\telse\n\t\t\t{\n\t\t\ts->s2->three_byte_header=1;\n\t\t\ts->s2->rlength&=THREE_BYTE_MASK;\n\t\t\ts->s2->escape=((p[0] & SEC_ESC_BIT))?1:0;\n\t\t\t}\n\t\t}\n\tif (s->rstate == SSL_ST_READ_BODY)\n\t\t{\n\t\tn=s->s2->rlength+2+s->s2->three_byte_header;\n\t\tif (n > (int)s->packet_length)\n\t\t\t{\n\t\t\tn-=s->packet_length;\n\t\t\ti=read_n(s,(unsigned int)n,(unsigned int)n,1);\n\t\t\tif (i <= 0) return(i);\n\t\t\t}\n\t\tp= &(s->packet[2]);\n\t\ts->rstate=SSL_ST_READ_HEADER;\n\t\tif (s->s2->three_byte_header)\n\t\t\ts->s2->padding= *(p++);\n\t\telse\ts->s2->padding=0;\n\t\tif (s->s2->clear_text)\n\t\t\t{\n\t\t\ts->s2->mac_data=p;\n\t\t\ts->s2->ract_data=p;\n\t\t\ts->s2->pad_data=NULL;\n\t\t\t}\n\t\telse\n\t\t\t{\n\t\t\tmac_size=EVP_MD_size(s->read_hash);\n\t\t\ts->s2->mac_data=p;\n\t\t\ts->s2->ract_data= &p[mac_size];\n\t\t\ts->s2->pad_data= &p[mac_size+\n\t\t\t\ts->s2->rlength-s->s2->padding];\n\t\t\t}\n\t\ts->s2->ract_data_length=s->s2->rlength;\n\t\tif ((!s->s2->clear_text) &&\n\t\t\t(s->s2->rlength >= mac_size))\n\t\t\t{\n\t\t\tssl2_enc(s,0);\n\t\t\ts->s2->ract_data_length-=mac_size;\n\t\t\tssl2_mac(s,mac,0);\n\t\t\ts->s2->ract_data_length-=s->s2->padding;\n\t\t\tif (\t(memcmp(mac,s->s2->mac_data,\n\t\t\t\t(unsigned int)mac_size) != 0) ||\n\t\t\t\t(s->s2->rlength%EVP_CIPHER_CTX_block_size(s->enc_read_ctx) != 0))\n\t\t\t\t{\n\t\t\t\tSSLerr(SSL_F_SSL2_READ,SSL_R_BAD_MAC_DECODE);\n\t\t\t\treturn(-1);\n\t\t\t\t}\n\t\t\t}\n\t\tINC32(s->s2->read_sequence);\n#if 1\n\t\tgoto ssl2_read_again;\n#else\n\t\tif (s->s2->ract_data_length == 0)\n\t\t\treturn(0);\n\t\treturn(ssl2_read(s,buf,len));\n#endif\n\t\t}\n\telse\n\t\t{\n\t\tSSLerr(SSL_F_SSL2_READ,SSL_R_BAD_STATE);\n\t\t\treturn(-1);\n\t\t}\n\t}', 'static int read_n(SSL *s, unsigned int n, unsigned int max,\n\t     unsigned int extend)\n\t{\n\tint i,off,newb;\n\tif (s->s2->rbuf_left >= (int)n)\n\t\t{\n\t\tif (extend)\n\t\t\ts->packet_length+=n;\n\t\telse\n\t\t\t{\n\t\t\ts->packet= &(s->s2->rbuf[s->s2->rbuf_offs]);\n\t\t\ts->packet_length=n;\n\t\t\t}\n\t\ts->s2->rbuf_left-=n;\n\t\ts->s2->rbuf_offs+=n;\n\t\treturn(n);\n\t\t}\n\tif (!s->read_ahead) max=n;\n\tif (max > (unsigned int)(SSL2_MAX_RECORD_LENGTH_2_BYTE_HEADER+2))\n\t\tmax=SSL2_MAX_RECORD_LENGTH_2_BYTE_HEADER+2;\n\toff=0;\n\tif ((s->s2->rbuf_left != 0) || ((s->packet_length != 0) && extend))\n\t\t{\n\t\tnewb=s->s2->rbuf_left;\n\t\tif (extend)\n\t\t\t{\n\t\t\toff=s->packet_length;\n\t\t\tif (s->packet != s->s2->rbuf)\n\t\t\t\tmemcpy(s->s2->rbuf,s->packet,\n\t\t\t\t\t(unsigned int)newb+off);\n\t\t\t}\n\t\telse if (s->s2->rbuf_offs != 0)\n\t\t\t{\n\t\t\tmemcpy(s->s2->rbuf,&(s->s2->rbuf[s->s2->rbuf_offs]),\n\t\t\t\t(unsigned int)newb);\n\t\t\ts->s2->rbuf_offs=0;\n\t\t\t}\n\t\ts->s2->rbuf_left=0;\n\t\t}\n\telse\n\t\tnewb=0;\n\ts->packet=s->s2->rbuf;\n\twhile (newb < (int)n)\n\t\t{\n\t\tclear_sys_error();\n\t\tif (s->rbio != NULL)\n\t\t\t{\n\t\t\ts->rwstate=SSL_READING;\n\t\t\ti=BIO_read(s->rbio,(char *)&(s->s2->rbuf[off+newb]),\n\t\t\t\tmax-newb);\n\t\t\t}\n\t\telse\n\t\t\t{\n\t\t\tSSLerr(SSL_F_READ_N,SSL_R_READ_BIO_NOT_SET);\n\t\t\ti= -1;\n\t\t\t}\n#ifdef PKT_DEBUG\n\t\tif (s->debug & 0x01) sleep(1);\n#endif\n\t\tif (i <= 0)\n\t\t\t{\n\t\t\ts->s2->rbuf_left+=newb;\n\t\t\treturn(i);\n\t\t\t}\n\t\tnewb+=i;\n\t\t}\n\tif (newb > (int)n)\n\t\t{\n\t\ts->s2->rbuf_offs=n+off;\n\t\ts->s2->rbuf_left=newb-n;\n\t\t}\n\telse\n\t\t{\n\t\ts->s2->rbuf_offs=0;\n\t\ts->s2->rbuf_left=0;\n\t\t}\n\tif (extend)\n\t\ts->packet_length+=n;\n\telse\n\t\ts->packet_length=n;\n\ts->rwstate=SSL_NOTHING;\n\treturn(n);\n\t}']