apps/ca.c:1954: error: INTEGER_OVERFLOW_L2
  ([0, +oo] - 1):unsigned32 by call to `CONF_load`.
Showing all 10 steps of the trace


apps/ca.c:1954:8: Call
1952.   	 * STACK format).
1953.   	 */
1954.   	parms=CONF_load(NULL,infile,&errline);
               ^
1955.   	if (parms == NULL)
1956.   		{

crypto/conf/conf.c:86:1: Parameter `h->num_nodes`
  84.   
  85.   
  86. > LHASH *CONF_load(LHASH *h, const char *file, long *line)
  87.   	{
  88.   	LHASH *ltmp;

crypto/conf/conf.c:98:9: Call
  96.   		}
  97.   
  98.   	ltmp = CONF_load_bio(h, in, line);
                 ^
  99.   	BIO_free(in);
  100.   

crypto/conf/conf.c:118:1: Parameter `h->num_nodes`
    116.   #endif
    117.   
    118. > LHASH *CONF_load_bio(LHASH *h, BIO *in, long *line)
    119.   	{
    120.   	LHASH *ret=NULL;

crypto/conf/conf.c:355:35: Call
    353.   	sprintf(btmp,"%ld",eline);
    354.   	ERR_add_error_data(2,"line ",btmp);
    355.   	if ((h != ret) && (ret != NULL)) CONF_free(ret);
                                             ^
    356.   	if (v != NULL)
    357.   		{

crypto/conf/conf.c:436:1: Parameter `conf->num_nodes`
      434.   	}
      435.   
      436. > void CONF_free(LHASH *conf)
      437.   	{
      438.   	if (conf == NULL) return;

crypto/conf/conf.c:442:2: Call
      440.   	conf->down_load=0; 	/* evil thing to make sure the 'Free()'
      441.   				 * works as expected */
      442.   	lh_doall_arg(conf,(void (*)())value_free_hash,(char *)conf);
              ^
      443.   
      444.   	/* We now have only 'section' entries in the hash table.

crypto/lhash/lhash.c:278:1: <LHS trace>
276.   	}
277.   
278. > void lh_doall_arg(LHASH *lh, void (*func)(), char *arg)
279.   	{
280.   	int i;

crypto/lhash/lhash.c:278:1: Parameter `lh->num_nodes`
        276.   	}
        277.   
        278. > void lh_doall_arg(LHASH *lh, void (*func)(), char *arg)
        279.   	{
        280.   	int i;

crypto/lhash/lhash.c:285:7: Binary operation: ([0, +oo] - 1):unsigned32 by call to `CONF_load` 
        283.   	/* reverse the order so we search from 'top to bottom'
        284.   	 * We were having memory leaks otherwise */
        285.   	for (i=lh->num_nodes-1; i>=0; i--)
                     ^
        286.   		{
        287.   		a=lh->b[i];

void lh_doall_arg(LHASH *lh, void (*func)(), char *arg)
	{
	int i;
	LHASH_NODE *a,*n;
	for (i=lh->num_nodes-1; i>=0; i--)
		{
		a=lh->b[i];
		while (a != NULL)
			{
			n=a->next;
			func(a->data,arg);
			a=n;
			}
		}
	}
['static int certify_spkac(X509 **xret, char *infile, EVP_PKEY *pkey, X509 *x509,\n\t     const EVP_MD *dgst, STACK_OF(CONF_VALUE) *policy, TXT_DB *db,\n\t     BIGNUM *serial, char *startdate, char *enddate, int days,\n\t     char *ext_sect, LHASH *lconf, int verbose)\n\t{\n\tSTACK_OF(CONF_VALUE) *sk=NULL;\n\tLHASH *parms=NULL;\n\tX509_REQ *req=NULL;\n\tCONF_VALUE *cv=NULL;\n\tNETSCAPE_SPKI *spki = NULL;\n\tX509_REQ_INFO *ri;\n\tchar *type,*buf;\n\tEVP_PKEY *pktmp=NULL;\n\tX509_NAME *n=NULL;\n\tX509_NAME_ENTRY *ne=NULL;\n\tint ok= -1,i,j;\n\tlong errline;\n\tint nid;\n\tparms=CONF_load(NULL,infile,&errline);\n\tif (parms == NULL)\n\t\t{\n\t\tBIO_printf(bio_err,"error on line %ld of %s\\n",errline,infile);\n\t\tERR_print_errors(bio_err);\n\t\tgoto err;\n\t\t}\n\tsk=CONF_get_section(parms, "default");\n\tif (sk_CONF_VALUE_num(sk) == 0)\n\t\t{\n\t\tBIO_printf(bio_err, "no name/value pairs found in %s\\n", infile);\n\t\tCONF_free(parms);\n\t\tgoto err;\n\t\t}\n\treq=X509_REQ_new();\n\tif (req == NULL)\n\t\t{\n\t\tERR_print_errors(bio_err);\n\t\tgoto err;\n\t\t}\n\tri=req->req_info;\n\tn = ri->subject;\n\tfor (i = 0; ; i++)\n\t\t{\n\t\tif (sk_CONF_VALUE_num(sk) <= i) break;\n\t\tcv=sk_CONF_VALUE_value(sk,i);\n\t\ttype=cv->name;\n\t\tfor(buf = cv->name; *buf ; buf++)\n\t\t\tif ((*buf == \':\') || (*buf == \',\') || (*buf == \'.\')) {\n\t\t\t\t\tbuf++;\n\t\t\t\t\tif(*buf) type = buf;\n\t\t\t\t\tbreak;\n\t\t}\n\t\tbuf=cv->value;\n\t\tif ((nid=OBJ_txt2nid(type)) == NID_undef)\n\t\t\t{\n\t\t\tif (strcmp(type, "SPKAC") == 0)\n\t\t\t\t{\n\t\t\t\tspki = NETSCAPE_SPKI_b64_decode(cv->value, -1);\n\t\t\t\tif (spki == NULL)\n\t\t\t\t\t{\n\t\t\t\t\tBIO_printf(bio_err,"unable to load Netscape SPKAC structure\\n");\n\t\t\t\t\tERR_print_errors(bio_err);\n\t\t\t\t\tgoto err;\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\tcontinue;\n\t\t\t}\n\t\tj=ASN1_PRINTABLE_type((unsigned char *)buf,-1);\n\t\tif (fix_data(nid, &j) == 0)\n\t\t\t{\n\t\t\tBIO_printf(bio_err,\n\t\t\t\t"invalid characters in string %s\\n",buf);\n\t\t\tgoto err;\n\t\t\t}\n\t\tif ((ne=X509_NAME_ENTRY_create_by_NID(&ne,nid,j,\n\t\t\t(unsigned char *)buf,\n\t\t\tstrlen(buf))) == NULL)\n\t\t\tgoto err;\n\t\tif (!X509_NAME_add_entry(n,ne,-1, 0)) goto err;\n\t\t}\n\tif (spki == NULL)\n\t\t{\n\t\tBIO_printf(bio_err,"Netscape SPKAC structure not found in %s\\n",\n\t\t\tinfile);\n\t\tgoto err;\n\t\t}\n\tBIO_printf(bio_err,"Check that the SPKAC request matches the signature\\n");\n\tif ((pktmp=NETSCAPE_SPKI_get_pubkey(spki)) == NULL)\n\t\t{\n\t\tBIO_printf(bio_err,"error unpacking SPKAC public key\\n");\n\t\tgoto err;\n\t\t}\n\tj = NETSCAPE_SPKI_verify(spki, pktmp);\n\tif (j <= 0)\n\t\t{\n\t\tBIO_printf(bio_err,"signature verification failed on SPKAC public key\\n");\n\t\tgoto err;\n\t\t}\n\tBIO_printf(bio_err,"Signature ok\\n");\n\tX509_REQ_set_pubkey(req,pktmp);\n\tEVP_PKEY_free(pktmp);\n\tok=do_body(xret,pkey,x509,dgst,policy,db,serial,startdate,enddate,\n\t\t   days,1,verbose,req,ext_sect,lconf);\nerr:\n\tif (req != NULL) X509_REQ_free(req);\n\tif (parms != NULL) CONF_free(parms);\n\tif (spki != NULL) NETSCAPE_SPKI_free(spki);\n\tif (ne != NULL) X509_NAME_ENTRY_free(ne);\n\treturn(ok);\n\t}', 'LHASH *CONF_load(LHASH *h, const char *file, long *line)\n\t{\n\tLHASH *ltmp;\n\tBIO *in=NULL;\n\tin=BIO_new_file(file, "rb");\n\tif (in == NULL)\n\t\t{\n\t\tCONFerr(CONF_F_CONF_LOAD,ERR_R_SYS_LIB);\n\t\treturn NULL;\n\t\t}\n\tltmp = CONF_load_bio(h, in, line);\n\tBIO_free(in);\n\treturn ltmp;\n}', 'LHASH *CONF_load_bio(LHASH *h, BIO *in, long *line)\n\t{\n\tLHASH *ret=NULL;\n#define BUFSIZE\t512\n\tchar btmp[16];\n\tint bufnum=0,i,ii;\n\tBUF_MEM *buff=NULL;\n\tchar *s,*p,*end;\n\tint again,n;\n\tlong eline=0;\n\tCONF_VALUE *v=NULL,*vv,*tv;\n\tCONF_VALUE *sv=NULL;\n\tchar *section=NULL,*buf;\n\tSTACK_OF(CONF_VALUE) *section_sk=NULL,*ts;\n\tchar *start,*psection,*pname;\n\tif ((buff=BUF_MEM_new()) == NULL)\n\t\t{\n\t\tCONFerr(CONF_F_CONF_LOAD_BIO,ERR_R_BUF_LIB);\n\t\tgoto err;\n\t\t}\n\tsection=(char *)Malloc(10);\n\tif (section == NULL)\n\t\t{\n\t\tCONFerr(CONF_F_CONF_LOAD_BIO,ERR_R_MALLOC_FAILURE);\n\t\tgoto err;\n\t\t}\n\tstrcpy(section,"default");\n\tif (h == NULL)\n\t\t{\n\t\tif ((ret=lh_new(hash,cmp_conf)) == NULL)\n\t\t\t{\n\t\t\tCONFerr(CONF_F_CONF_LOAD_BIO,ERR_R_MALLOC_FAILURE);\n\t\t\tgoto err;\n\t\t\t}\n\t\t}\n\telse\n\t\tret=h;\n\tsv=new_section(ret,section);\n\tif (sv == NULL)\n\t\t{\n\t\tCONFerr(CONF_F_CONF_LOAD_BIO,\n\t\t\t\t\tCONF_R_UNABLE_TO_CREATE_NEW_SECTION);\n\t\tgoto err;\n\t\t}\n\tsection_sk=(STACK_OF(CONF_VALUE) *)sv->value;\n\tbufnum=0;\n\tfor (;;)\n\t\t{\n\t\tagain=0;\n\t\tif (!BUF_MEM_grow(buff,bufnum+BUFSIZE))\n\t\t\t{\n\t\t\tCONFerr(CONF_F_CONF_LOAD_BIO,ERR_R_BUF_LIB);\n\t\t\tgoto err;\n\t\t\t}\n\t\tp= &(buff->data[bufnum]);\n\t\t*p=\'\\0\';\n\t\tBIO_gets(in, p, BUFSIZE-1);\n\t\tp[BUFSIZE-1]=\'\\0\';\n\t\tii=i=strlen(p);\n\t\tif (i == 0) break;\n\t\twhile (i > 0)\n\t\t\t{\n\t\t\tif ((p[i-1] != \'\\r\') && (p[i-1] != \'\\n\'))\n\t\t\t\tbreak;\n\t\t\telse\n\t\t\t\ti--;\n\t\t\t}\n\t\tif (i == ii)\n\t\t\tagain=1;\n\t\telse\n\t\t\t{\n\t\t\tp[i]=\'\\0\';\n\t\t\teline++;\n\t\t\t}\n\t\tbufnum+=i;\n\t\tv=NULL;\n\t\tif (bufnum >= 1)\n\t\t\t{\n\t\t\tp= &(buff->data[bufnum-1]);\n\t\t\tif (\tIS_ESC(p[0]) &&\n\t\t\t\t((bufnum <= 1) || !IS_ESC(p[-1])))\n\t\t\t\t{\n\t\t\t\tbufnum--;\n\t\t\t\tagain=1;\n\t\t\t\t}\n\t\t\t}\n\t\tif (again) continue;\n\t\tbufnum=0;\n\t\tbuf=buff->data;\n\t\tclear_comments(buf);\n\t\tn=strlen(buf);\n\t\ts=eat_ws(buf);\n\t\tif (IS_EOF(*s)) continue;\n\t\tif (*s == \'[\')\n\t\t\t{\n\t\t\tchar *ss;\n\t\t\ts++;\n\t\t\tstart=eat_ws(s);\n\t\t\tss=start;\nagain:\n\t\t\tend=eat_alpha_numeric(ss);\n\t\t\tp=eat_ws(end);\n\t\t\tif (*p != \']\')\n\t\t\t\t{\n\t\t\t\tif (*p != \'\\0\')\n\t\t\t\t\t{\n\t\t\t\t\tss=p;\n\t\t\t\t\tgoto again;\n\t\t\t\t\t}\n\t\t\t\tCONFerr(CONF_F_CONF_LOAD_BIO,\n\t\t\t\t\tCONF_R_MISSING_CLOSE_SQUARE_BRACKET);\n\t\t\t\tgoto err;\n\t\t\t\t}\n\t\t\t*end=\'\\0\';\n\t\t\tif (!str_copy(ret,NULL,&section,start)) goto err;\n\t\t\tif ((sv=get_section(ret,section)) == NULL)\n\t\t\t\tsv=new_section(ret,section);\n\t\t\tif (sv == NULL)\n\t\t\t\t{\n\t\t\t\tCONFerr(CONF_F_CONF_LOAD_BIO,\n\t\t\t\t\tCONF_R_UNABLE_TO_CREATE_NEW_SECTION);\n\t\t\t\tgoto err;\n\t\t\t\t}\n\t\t\tsection_sk=(STACK_OF(CONF_VALUE) *)sv->value;\n\t\t\tcontinue;\n\t\t\t}\n\t\telse\n\t\t\t{\n\t\t\tpname=s;\n\t\t\tpsection=NULL;\n\t\t\tend=eat_alpha_numeric(s);\n\t\t\tif ((end[0] == \':\') && (end[1] == \':\'))\n\t\t\t\t{\n\t\t\t\t*end=\'\\0\';\n\t\t\t\tend+=2;\n\t\t\t\tpsection=pname;\n\t\t\t\tpname=end;\n\t\t\t\tend=eat_alpha_numeric(end);\n\t\t\t\t}\n\t\t\tp=eat_ws(end);\n\t\t\tif (*p != \'=\')\n\t\t\t\t{\n\t\t\t\tCONFerr(CONF_F_CONF_LOAD_BIO,\n\t\t\t\t\t\tCONF_R_MISSING_EQUAL_SIGN);\n\t\t\t\tgoto err;\n\t\t\t\t}\n\t\t\t*end=\'\\0\';\n\t\t\tp++;\n\t\t\tstart=eat_ws(p);\n\t\t\twhile (!IS_EOF(*p))\n\t\t\t\tp++;\n\t\t\tp--;\n\t\t\twhile ((p != start) && (IS_WS(*p)))\n\t\t\t\tp--;\n\t\t\tp++;\n\t\t\t*p=\'\\0\';\n\t\t\tif (!(v=(CONF_VALUE *)Malloc(sizeof(CONF_VALUE))))\n\t\t\t\t{\n\t\t\t\tCONFerr(CONF_F_CONF_LOAD_BIO,\n\t\t\t\t\t\t\tERR_R_MALLOC_FAILURE);\n\t\t\t\tgoto err;\n\t\t\t\t}\n\t\t\tif (psection == NULL) psection=section;\n\t\t\tv->name=(char *)Malloc(strlen(pname)+1);\n\t\t\tv->value=NULL;\n\t\t\tif (v->name == NULL)\n\t\t\t\t{\n\t\t\t\tCONFerr(CONF_F_CONF_LOAD_BIO,\n\t\t\t\t\t\t\tERR_R_MALLOC_FAILURE);\n\t\t\t\tgoto err;\n\t\t\t\t}\n\t\t\tstrcpy(v->name,pname);\n\t\t\tif (!str_copy(ret,psection,&(v->value),start)) goto err;\n\t\t\tif (strcmp(psection,section) != 0)\n\t\t\t\t{\n\t\t\t\tif ((tv=get_section(ret,psection))\n\t\t\t\t\t== NULL)\n\t\t\t\t\ttv=new_section(ret,psection);\n\t\t\t\tif (tv == NULL)\n\t\t\t\t\t{\n\t\t\t\t\tCONFerr(CONF_F_CONF_LOAD_BIO,\n\t\t\t\t\t   CONF_R_UNABLE_TO_CREATE_NEW_SECTION);\n\t\t\t\t\tgoto err;\n\t\t\t\t\t}\n\t\t\t\tts=(STACK_OF(CONF_VALUE) *)tv->value;\n\t\t\t\t}\n\t\t\telse\n\t\t\t\t{\n\t\t\t\ttv=sv;\n\t\t\t\tts=section_sk;\n\t\t\t\t}\n\t\t\tv->section=tv->section;\n\t\t\tif (!sk_CONF_VALUE_push(ts,v))\n\t\t\t\t{\n\t\t\t\tCONFerr(CONF_F_CONF_LOAD_BIO,\n\t\t\t\t\t\t\tERR_R_MALLOC_FAILURE);\n\t\t\t\tgoto err;\n\t\t\t\t}\n\t\t\tvv=(CONF_VALUE *)lh_insert(ret,(char *)v);\n\t\t\tif (vv != NULL)\n\t\t\t\t{\n\t\t\t\tsk_CONF_VALUE_delete_ptr(ts,vv);\n\t\t\t\tFree(vv->name);\n\t\t\t\tFree(vv->value);\n\t\t\t\tFree(vv);\n\t\t\t\t}\n\t\t\tv=NULL;\n\t\t\t}\n\t\t}\n\tif (buff != NULL) BUF_MEM_free(buff);\n\tif (section != NULL) Free(section);\n\treturn(ret);\nerr:\n\tif (buff != NULL) BUF_MEM_free(buff);\n\tif (section != NULL) Free(section);\n\tif (line != NULL) *line=eline;\n\tsprintf(btmp,"%ld",eline);\n\tERR_add_error_data(2,"line ",btmp);\n\tif ((h != ret) && (ret != NULL)) CONF_free(ret);\n\tif (v != NULL)\n\t\t{\n\t\tif (v->name != NULL) Free(v->name);\n\t\tif (v->value != NULL) Free(v->value);\n\t\tif (v != NULL) Free(v);\n\t\t}\n\treturn(NULL);\n\t}', 'void CONF_free(LHASH *conf)\n\t{\n\tif (conf == NULL) return;\n\tconf->down_load=0;\n\tlh_doall_arg(conf,(void (*)())value_free_hash,(char *)conf);\n\tlh_doall_arg(conf,(void (*)())value_free_stack,(char *)conf);\n\tlh_free(conf);\n\t}', 'void lh_doall_arg(LHASH *lh, void (*func)(), char *arg)\n\t{\n\tint i;\n\tLHASH_NODE *a,*n;\n\tfor (i=lh->num_nodes-1; i>=0; i--)\n\t\t{\n\t\ta=lh->b[i];\n\t\twhile (a != NULL)\n\t\t\t{\n\t\t\tn=a->next;\n\t\t\tfunc(a->data,arg);\n\t\t\ta=n;\n\t\t\t}\n\t\t}\n\t}']