test/sslapitest.c:4003: error: INTEGER_OVERFLOW_L2
  ([0, +oo] - 1):unsigned32 by call to `SSL_free`.
Showing all 17 steps of the trace


test/sslapitest.c:3961:14: Call
3959.               tstsrpfile = srpvfile;
3960.           }
3961.           if (!TEST_int_eq(SRP_VBASE_init(vbase, tstsrpfile), SRP_NO_ERROR))
                     ^
3962.               goto end;
3963.       }

crypto/srp/srp_vfy.c:480:5: Call
  478.       SRP_user_pwd_free(user_pwd);
  479.   
  480.       TXT_DB_free(tmpdb);
             ^
  481.       BIO_free_all(in);
  482.   

crypto/txt_db/txt_db.c:282:1: Parameter `(*db->index)->num_nodes`
    280.   }
    281.   
    282. > void TXT_DB_free(TXT_DB *db)
    283.   {
    284.       int i, n;

test/sslapitest.c:4003:5: Call
4001.       SRP_VBASE_free(vbase);
4002.       vbase = NULL;
4003.       SSL_free(serverssl);
            ^
4004.       SSL_free(clientssl);
4005.       SSL_CTX_free(sctx);

ssl/ssl_lib.c:1124:1: Parameter `s->ctx->sessions->num_nodes`
  1122.   }
  1123.   
  1124. > void SSL_free(SSL *s)
  1125.   {
  1126.       int i;

ssl/ssl_lib.c:1196:5: Call
  1194.       RECORD_LAYER_release(&s->rlayer);
  1195.   
  1196.       SSL_CTX_free(s->ctx);
              ^
  1197.   
  1198.       ASYNC_WAIT_CTX_free(s->waitctx);

ssl/ssl_lib.c:3046:1: Parameter `a->sessions->num_nodes`
    3044.   }
    3045.   
    3046. > void SSL_CTX_free(SSL_CTX *a)
    3047.   {
    3048.       int i;

ssl/ssl_lib.c:3072:9: Call
    3070.        */
    3071.       if (a->sessions != NULL)
    3072.           SSL_CTX_flush_sessions(a, 0);
                    ^
    3073.   
    3074.       CRYPTO_free_ex_data(CRYPTO_EX_INDEX_SSL_CTX, a, &a->ex_data);

ssl/ssl_sess.c:1116:1: Parameter `s->sessions->num_nodes`
      1114.   IMPLEMENT_LHASH_DOALL_ARG(SSL_SESSION, TIMEOUT_PARAM);
      1115.   
      1116. > void SSL_CTX_flush_sessions(SSL_CTX *s, long t)
      1117.   {
      1118.       unsigned long i;

ssl/ssl_sess.c:1129:5: Call
      1127.       i = lh_SSL_SESSION_get_down_load(s->sessions);
      1128.       lh_SSL_SESSION_set_down_load(s->sessions, 0);
      1129.       lh_SSL_SESSION_doall_TIMEOUT_PARAM(tp.cache, timeout_cb, &tp);
                  ^
      1130.       lh_SSL_SESSION_set_down_load(s->sessions, i);
      1131.       CRYPTO_THREAD_unlock(s->lock);

ssl/ssl_sess.c:1114:1: Parameter `lh->num_nodes`
        1112.   }
        1113.   
        1114. > IMPLEMENT_LHASH_DOALL_ARG(SSL_SESSION, TIMEOUT_PARAM);
        1115.   
        1116.   void SSL_CTX_flush_sessions(SSL_CTX *s, long t)

ssl/ssl_sess.c:1114:1: Call
        1112.   }
        1113.   
        1114. > IMPLEMENT_LHASH_DOALL_ARG(SSL_SESSION, TIMEOUT_PARAM);
        1115.   
        1116.   void SSL_CTX_flush_sessions(SSL_CTX *s, long t)

crypto/lhash/lhash.c:198:1: Parameter `lh->num_nodes`
          196.   }
          197.   
          198. > void OPENSSL_LH_doall_arg(OPENSSL_LHASH *lh, OPENSSL_LH_DOALL_FUNCARG func, void *arg)
          199.   {
          200.       doall_util_fn(lh, 1, (OPENSSL_LH_DOALL_FUNC)0, func, arg);

crypto/lhash/lhash.c:200:5: Call
          198.   void OPENSSL_LH_doall_arg(OPENSSL_LHASH *lh, OPENSSL_LH_DOALL_FUNCARG func, void *arg)
          199.   {
          200.       doall_util_fn(lh, 1, (OPENSSL_LH_DOALL_FUNC)0, func, arg);
                     ^
          201.   }
          202.   

crypto/lhash/lhash.c:166:1: <LHS trace>
164.   }
165.   
166. > static void doall_util_fn(OPENSSL_LHASH *lh, int use_arg,
167.                             OPENSSL_LH_DOALL_FUNC func,
168.                             OPENSSL_LH_DOALL_FUNCARG func_arg, void *arg)

crypto/lhash/lhash.c:166:1: Parameter `lh->num_nodes`
            164.   }
            165.   
            166. > static void doall_util_fn(OPENSSL_LHASH *lh, int use_arg,
            167.                             OPENSSL_LH_DOALL_FUNC func,
            168.                             OPENSSL_LH_DOALL_FUNCARG func_arg, void *arg)

crypto/lhash/lhash.c:180:10: Binary operation: ([0, +oo] - 1):unsigned32 by call to `SSL_free` 
            178.        * memory leaks otherwise
            179.        */
            180.       for (i = lh->num_nodes - 1; i >= 0; i--) {
                            ^
            181.           a = lh->b[i];
            182.           while (a != NULL) {

static void doall_util_fn(OPENSSL_LHASH *lh, int use_arg,
                          OPENSSL_LH_DOALL_FUNC func,
                          OPENSSL_LH_DOALL_FUNCARG func_arg, void *arg)
{
    int i;
    OPENSSL_LH_NODE *a, *n;
    if (lh == NULL)
        return;
    for (i = lh->num_nodes - 1; i >= 0; i--) {
        a = lh->b[i];
        while (a != NULL) {
            n = a->next;
            if (use_arg)
                func_arg(a->data, arg);
            else
                func(a->data);
            a = n;
        }
    }
}
['static int test_srp(int tst)\n{\n    char *userid = "test", *password = "password", *tstsrpfile;\n    SSL_CTX *cctx = NULL, *sctx = NULL;\n    SSL *clientssl = NULL, *serverssl = NULL;\n    int ret, testresult = 0;\n    vbase = SRP_VBASE_new(NULL);\n    if (!TEST_ptr(vbase))\n        goto end;\n    if (tst == 0 || tst == 1) {\n        if (!TEST_true(create_new_vbase(userid, password)))\n            goto end;\n    } else {\n        if (tst == 4 || tst == 5) {\n            if (!TEST_true(create_new_vfile(userid, password, tmpfilename)))\n                goto end;\n            tstsrpfile = tmpfilename;\n        } else {\n            tstsrpfile = srpvfile;\n        }\n        if (!TEST_int_eq(SRP_VBASE_init(vbase, tstsrpfile), SRP_NO_ERROR))\n            goto end;\n    }\n    if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(), TLS_client_method(),\n                                       TLS1_VERSION, TLS_MAX_VERSION,\n                                       &sctx, &cctx, cert, privkey)))\n        goto end;\n    if (!TEST_int_gt(SSL_CTX_set_srp_username_callback(sctx, ssl_srp_cb), 0)\n            || !TEST_true(SSL_CTX_set_cipher_list(cctx, "SRP-AES-128-CBC-SHA"))\n            || !TEST_true(SSL_CTX_set_max_proto_version(sctx, TLS1_2_VERSION))\n            || !TEST_true(SSL_CTX_set_max_proto_version(cctx, TLS1_2_VERSION))\n            || !TEST_int_gt(SSL_CTX_set_srp_username(cctx, userid), 0))\n        goto end;\n    if (tst % 2 == 1) {\n        if (!TEST_int_gt(SSL_CTX_set_srp_password(cctx, "badpass"), 0))\n            goto end;\n    } else {\n        if (!TEST_int_gt(SSL_CTX_set_srp_password(cctx, password), 0))\n            goto end;\n    }\n    if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,\n                                      NULL, NULL)))\n        goto end;\n    ret = create_ssl_connection(serverssl, clientssl, SSL_ERROR_NONE);\n    if (ret) {\n        if (!TEST_true(tst % 2 == 0))\n            goto end;\n    } else {\n        if (!TEST_true(tst % 2 == 1))\n            goto end;\n    }\n    testresult = 1;\n end:\n    SRP_VBASE_free(vbase);\n    vbase = NULL;\n    SSL_free(serverssl);\n    SSL_free(clientssl);\n    SSL_CTX_free(sctx);\n    SSL_CTX_free(cctx);\n    return testresult;\n}', 'int SRP_VBASE_init(SRP_VBASE *vb, char *verifier_file)\n{\n    int error_code;\n    STACK_OF(SRP_gN) *SRP_gN_tab = sk_SRP_gN_new_null();\n    char *last_index = NULL;\n    int i;\n    char **pp;\n    SRP_gN *gN = NULL;\n    SRP_user_pwd *user_pwd = NULL;\n    TXT_DB *tmpdb = NULL;\n    BIO *in = BIO_new(BIO_s_file());\n    error_code = SRP_ERR_OPEN_FILE;\n    if (in == NULL || BIO_read_filename(in, verifier_file) <= 0)\n        goto err;\n    error_code = SRP_ERR_VBASE_INCOMPLETE_FILE;\n    if ((tmpdb = TXT_DB_read(in, DB_NUMBER)) == NULL)\n        goto err;\n    error_code = SRP_ERR_MEMORY;\n    if (vb->seed_key) {\n        last_index = SRP_get_default_gN(NULL)->id;\n    }\n    for (i = 0; i < sk_OPENSSL_PSTRING_num(tmpdb->data); i++) {\n        pp = sk_OPENSSL_PSTRING_value(tmpdb->data, i);\n        if (pp[DB_srptype][0] == DB_SRP_INDEX) {\n            if ((gN = OPENSSL_malloc(sizeof(*gN))) == NULL)\n                goto err;\n            if ((gN->id = OPENSSL_strdup(pp[DB_srpid])) == NULL\n                || (gN->N = SRP_gN_place_bn(vb->gN_cache, pp[DB_srpverifier]))\n                        == NULL\n                || (gN->g = SRP_gN_place_bn(vb->gN_cache, pp[DB_srpsalt]))\n                        == NULL\n                || sk_SRP_gN_insert(SRP_gN_tab, gN, 0) == 0)\n                goto err;\n            gN = NULL;\n            if (vb->seed_key != NULL) {\n                last_index = pp[DB_srpid];\n            }\n        } else if (pp[DB_srptype][0] == DB_SRP_VALID) {\n            const SRP_gN *lgN;\n            if ((lgN = SRP_get_gN_by_id(pp[DB_srpgN], SRP_gN_tab)) != NULL) {\n                error_code = SRP_ERR_MEMORY;\n                if ((user_pwd = SRP_user_pwd_new()) == NULL)\n                    goto err;\n                SRP_user_pwd_set_gN(user_pwd, lgN->g, lgN->N);\n                if (!SRP_user_pwd_set_ids\n                    (user_pwd, pp[DB_srpid], pp[DB_srpinfo]))\n                    goto err;\n                error_code = SRP_ERR_VBASE_BN_LIB;\n                if (!SRP_user_pwd_set_sv\n                    (user_pwd, pp[DB_srpsalt], pp[DB_srpverifier]))\n                    goto err;\n                if (sk_SRP_user_pwd_insert(vb->users_pwd, user_pwd, 0) == 0)\n                    goto err;\n                user_pwd = NULL;\n            }\n        }\n    }\n    if (last_index != NULL) {\n        if (((gN = SRP_get_gN_by_id(last_index, SRP_gN_tab)) == NULL)) {\n            error_code = SRP_ERR_VBASE_BN_LIB;\n            goto err;\n        }\n        vb->default_g = gN->g;\n        vb->default_N = gN->N;\n        gN = NULL;\n    }\n    error_code = SRP_NO_ERROR;\n err:\n    if (gN != NULL) {\n        OPENSSL_free(gN->id);\n        OPENSSL_free(gN);\n    }\n    SRP_user_pwd_free(user_pwd);\n    TXT_DB_free(tmpdb);\n    BIO_free_all(in);\n    sk_SRP_gN_free(SRP_gN_tab);\n    return error_code;\n}', 'void TXT_DB_free(TXT_DB *db)\n{\n    int i, n;\n    char **p, *max;\n    if (db == NULL)\n        return;\n    if (db->index != NULL) {\n        for (i = db->num_fields - 1; i >= 0; i--)\n            lh_OPENSSL_STRING_free(db->index[i]);\n        OPENSSL_free(db->index);\n    }\n    OPENSSL_free(db->qual);\n    if (db->data != NULL) {\n        for (i = sk_OPENSSL_PSTRING_num(db->data) - 1; i >= 0; i--) {\n            p = sk_OPENSSL_PSTRING_value(db->data, i);\n            max = p[db->num_fields];\n            if (max == NULL) {\n                for (n = 0; n < db->num_fields; n++)\n                    OPENSSL_free(p[n]);\n            } else {\n                for (n = 0; n < db->num_fields; n++) {\n                    if (((p[n] < (char *)p) || (p[n] > max)))\n                        OPENSSL_free(p[n]);\n                }\n            }\n            OPENSSL_free(sk_OPENSSL_PSTRING_value(db->data, i));\n        }\n        sk_OPENSSL_PSTRING_free(db->data);\n    }\n    OPENSSL_free(db);\n}', 'void SSL_free(SSL *s)\n{\n    int i;\n    if (s == NULL)\n        return;\n    CRYPTO_DOWN_REF(&s->references, &i, s->lock);\n    REF_PRINT_COUNT("SSL", s);\n    if (i > 0)\n        return;\n    REF_ASSERT_ISNT(i < 0);\n    X509_VERIFY_PARAM_free(s->param);\n    dane_final(&s->dane);\n    CRYPTO_free_ex_data(CRYPTO_EX_INDEX_SSL, s, &s->ex_data);\n    ssl_free_wbio_buffer(s);\n    BIO_free_all(s->wbio);\n    BIO_free_all(s->rbio);\n    BUF_MEM_free(s->init_buf);\n    sk_SSL_CIPHER_free(s->cipher_list);\n    sk_SSL_CIPHER_free(s->cipher_list_by_id);\n    sk_SSL_CIPHER_free(s->tls13_ciphersuites);\n    if (s->session != NULL) {\n        ssl_clear_bad_session(s);\n        SSL_SESSION_free(s->session);\n    }\n    SSL_SESSION_free(s->psksession);\n    OPENSSL_free(s->psksession_id);\n    clear_ciphers(s);\n    ssl_cert_free(s->cert);\n    OPENSSL_free(s->ext.hostname);\n    SSL_CTX_free(s->session_ctx);\n#ifndef OPENSSL_NO_EC\n    OPENSSL_free(s->ext.ecpointformats);\n    OPENSSL_free(s->ext.supportedgroups);\n#endif\n    sk_X509_EXTENSION_pop_free(s->ext.ocsp.exts, X509_EXTENSION_free);\n#ifndef OPENSSL_NO_OCSP\n    sk_OCSP_RESPID_pop_free(s->ext.ocsp.ids, OCSP_RESPID_free);\n#endif\n#ifndef OPENSSL_NO_CT\n    SCT_LIST_free(s->scts);\n    OPENSSL_free(s->ext.scts);\n#endif\n    OPENSSL_free(s->ext.ocsp.resp);\n    OPENSSL_free(s->ext.alpn);\n    OPENSSL_free(s->ext.tls13_cookie);\n    OPENSSL_free(s->clienthello);\n    OPENSSL_free(s->pha_context);\n    EVP_MD_CTX_free(s->pha_dgst);\n    sk_X509_NAME_pop_free(s->ca_names, X509_NAME_free);\n    sk_X509_pop_free(s->verified_chain, X509_free);\n    if (s->method != NULL)\n        s->method->ssl_free(s);\n    RECORD_LAYER_release(&s->rlayer);\n    SSL_CTX_free(s->ctx);\n    ASYNC_WAIT_CTX_free(s->waitctx);\n#if !defined(OPENSSL_NO_NEXTPROTONEG)\n    OPENSSL_free(s->ext.npn);\n#endif\n#ifndef OPENSSL_NO_SRTP\n    sk_SRTP_PROTECTION_PROFILE_free(s->srtp_profiles);\n#endif\n    CRYPTO_THREAD_lock_free(s->lock);\n    OPENSSL_free(s);\n}', 'void SSL_CTX_free(SSL_CTX *a)\n{\n    int i;\n    if (a == NULL)\n        return;\n    CRYPTO_DOWN_REF(&a->references, &i, a->lock);\n    REF_PRINT_COUNT("SSL_CTX", a);\n    if (i > 0)\n        return;\n    REF_ASSERT_ISNT(i < 0);\n    X509_VERIFY_PARAM_free(a->param);\n    dane_ctx_final(&a->dane);\n    if (a->sessions != NULL)\n        SSL_CTX_flush_sessions(a, 0);\n    CRYPTO_free_ex_data(CRYPTO_EX_INDEX_SSL_CTX, a, &a->ex_data);\n    lh_SSL_SESSION_free(a->sessions);\n    X509_STORE_free(a->cert_store);\n#ifndef OPENSSL_NO_CT\n    CTLOG_STORE_free(a->ctlog_store);\n#endif\n    sk_SSL_CIPHER_free(a->cipher_list);\n    sk_SSL_CIPHER_free(a->cipher_list_by_id);\n    sk_SSL_CIPHER_free(a->tls13_ciphersuites);\n    ssl_cert_free(a->cert);\n    sk_X509_NAME_pop_free(a->ca_names, X509_NAME_free);\n    sk_X509_pop_free(a->extra_certs, X509_free);\n    a->comp_methods = NULL;\n#ifndef OPENSSL_NO_SRTP\n    sk_SRTP_PROTECTION_PROFILE_free(a->srtp_profiles);\n#endif\n#ifndef OPENSSL_NO_SRP\n    SSL_CTX_SRP_CTX_free(a);\n#endif\n#ifndef OPENSSL_NO_ENGINE\n    ENGINE_finish(a->client_cert_engine);\n#endif\n#ifndef OPENSSL_NO_EC\n    OPENSSL_free(a->ext.ecpointformats);\n    OPENSSL_free(a->ext.supportedgroups);\n#endif\n    OPENSSL_free(a->ext.alpn);\n    OPENSSL_secure_free(a->ext.secure);\n    CRYPTO_THREAD_lock_free(a->lock);\n    OPENSSL_free(a);\n}', 'void SSL_CTX_flush_sessions(SSL_CTX *s, long t)\n{\n    unsigned long i;\n    TIMEOUT_PARAM tp;\n    tp.ctx = s;\n    tp.cache = s->sessions;\n    if (tp.cache == NULL)\n        return;\n    tp.time = t;\n    CRYPTO_THREAD_write_lock(s->lock);\n    i = lh_SSL_SESSION_get_down_load(s->sessions);\n    lh_SSL_SESSION_set_down_load(s->sessions, 0);\n    lh_SSL_SESSION_doall_TIMEOUT_PARAM(tp.cache, timeout_cb, &tp);\n    lh_SSL_SESSION_set_down_load(s->sessions, i);\n    CRYPTO_THREAD_unlock(s->lock);\n}', 'IMPLEMENT_LHASH_DOALL_ARG(SSL_SESSION, TIMEOUT_PARAM)', 'void OPENSSL_LH_doall_arg(OPENSSL_LHASH *lh, OPENSSL_LH_DOALL_FUNCARG func, void *arg)\n{\n    doall_util_fn(lh, 1, (OPENSSL_LH_DOALL_FUNC)0, func, arg);\n}', 'static void doall_util_fn(OPENSSL_LHASH *lh, int use_arg,\n                          OPENSSL_LH_DOALL_FUNC func,\n                          OPENSSL_LH_DOALL_FUNCARG func_arg, void *arg)\n{\n    int i;\n    OPENSSL_LH_NODE *a, *n;\n    if (lh == NULL)\n        return;\n    for (i = lh->num_nodes - 1; i >= 0; i--) {\n        a = lh->b[i];\n        while (a != NULL) {\n            n = a->next;\n            if (use_arg)\n                func_arg(a->data, arg);\n            else\n                func(a->data);\n            a = n;\n        }\n    }\n}']