ssl/bio_ssl.c:248: error: INTEGER_OVERFLOW_L2
  ([0, +oo] - 1):unsigned64 by call to `SSL_clear`.
Showing all 14 steps of the trace


ssl/bio_ssl.c:248:14: Call
246.               SSL_set_accept_state(ssl);
247.   
248.           if (!SSL_clear(ssl)) {
                    ^
249.               ret = 0;
250.               break;

ssl/ssl_lib.c:440:1: Parameter `s->ctx->sessions->num_items`
  438.   }
  439.   
  440. > int SSL_clear(SSL *s)
  441.   {
  442.       if (s->method == NULL) {

ssl/ssl_lib.c:447:9: Call
  445.       }
  446.   
  447.       if (ssl_clear_bad_session(s)) {
                 ^
  448.           SSL_SESSION_free(s->session);
  449.           s->session = NULL;

ssl/ssl_sess.c:987:1: Parameter `s->ctx->sessions->num_items`
    985.   }
    986.   
    987. > int ssl_clear_bad_session(SSL *s)
    988.   {
    989.       if ((s->session != NULL) &&

ssl/ssl_sess.c:992:9: Call
    990.           !(s->shutdown & SSL_SENT_SHUTDOWN) &&
    991.           !(SSL_in_init(s) || SSL_in_before(s))) {
    992.           SSL_CTX_remove_session(s->ctx, s->session);
                   ^
    993.           return (1);
    994.       } else

ssl/ssl_sess.c:691:1: Parameter `ctx->sessions->num_items`
      689.   }
      690.   
      691. > int SSL_CTX_remove_session(SSL_CTX *ctx, SSL_SESSION *c)
      692.   {
      693.       return remove_session_lock(ctx, c, 1);

ssl/ssl_sess.c:693:12: Call
      691.   int SSL_CTX_remove_session(SSL_CTX *ctx, SSL_SESSION *c)
      692.   {
      693.       return remove_session_lock(ctx, c, 1);
                        ^
      694.   }
      695.   

ssl/ssl_sess.c:696:1: Parameter `ctx->sessions->num_items`
        694.   }
        695.   
        696. > static int remove_session_lock(SSL_CTX *ctx, SSL_SESSION *c, int lck)
        697.   {
        698.       SSL_SESSION *r;

ssl/ssl_sess.c:706:17: Call
        704.           if ((r = lh_SSL_SESSION_retrieve(ctx->sessions, c)) == c) {
        705.               ret = 1;
        706.               r = lh_SSL_SESSION_delete(ctx->sessions, c);
                               ^
        707.               SSL_SESSION_list_remove(ctx, c);
        708.           }

ssl/ssl_locl.h:581:1: Parameter `lh->num_items`
          579.   };
          580.   
          581. > DEFINE_LHASH_OF(SSL_SESSION);
          582.   /* Needed in ssl_cert.c */
          583.   DEFINE_LHASH_OF(X509_NAME);

ssl/ssl_locl.h:581:1: Call
          579.   };
          580.   
          581. > DEFINE_LHASH_OF(SSL_SESSION);
          582.   /* Needed in ssl_cert.c */
          583.   DEFINE_LHASH_OF(X509_NAME);

crypto/lhash/lhash.c:103:1: <LHS trace>
101.   }
102.   
103. > void *OPENSSL_LH_delete(OPENSSL_LHASH *lh, const void *data)
104.   {
105.       unsigned long hash;

crypto/lhash/lhash.c:103:1: Parameter `lh->num_items`
            101.   }
            102.   
            103. > void *OPENSSL_LH_delete(OPENSSL_LHASH *lh, const void *data)
            104.   {
            105.       unsigned long hash;

crypto/lhash/lhash.c:123:5: Binary operation: ([0, +oo] - 1):unsigned64 by call to `SSL_clear` 
            121.       }
            122.   
            123.       lh->num_items--;
                       ^
            124.       if ((lh->num_nodes > MIN_NODES) &&
            125.           (lh->down_load >= (lh->num_items * LH_LOAD_MULT / lh->num_nodes)))

void *OPENSSL_LH_delete(OPENSSL_LHASH *lh, const void *data)
{
    unsigned long hash;
    OPENSSL_LH_NODE *nn, **rn;
    void *ret;
    lh->error = 0;
    rn = getrn(lh, data, &hash);
    if (*rn == NULL) {
        lh->num_no_delete++;
        return (NULL);
    } else {
        nn = *rn;
        *rn = nn->next;
        ret = nn->data;
        OPENSSL_free(nn);
        lh->num_delete++;
    }
    lh->num_items--;
    if ((lh->num_nodes > MIN_NODES) &&
        (lh->down_load >= (lh->num_items * LH_LOAD_MULT / lh->num_nodes)))
        contract(lh);
    return (ret);
}
['static long ssl_ctrl(BIO *b, int cmd, long num, void *ptr)\n{\n    SSL **sslp, *ssl;\n    BIO_SSL *bs, *dbs;\n    BIO *dbio, *bio;\n    long ret = 1;\n    BIO *next;\n    bs = BIO_get_data(b);\n    next = BIO_next(b);\n    ssl = bs->ssl;\n    if ((ssl == NULL) && (cmd != BIO_C_SET_SSL))\n        return (0);\n    switch (cmd) {\n    case BIO_CTRL_RESET:\n        SSL_shutdown(ssl);\n        if (ssl->handshake_func == ssl->method->ssl_connect)\n            SSL_set_connect_state(ssl);\n        else if (ssl->handshake_func == ssl->method->ssl_accept)\n            SSL_set_accept_state(ssl);\n        if (!SSL_clear(ssl)) {\n            ret = 0;\n            break;\n        }\n        if (next != NULL)\n            ret = BIO_ctrl(next, cmd, num, ptr);\n        else if (ssl->rbio != NULL)\n            ret = BIO_ctrl(ssl->rbio, cmd, num, ptr);\n        else\n            ret = 1;\n        break;\n    case BIO_CTRL_INFO:\n        ret = 0;\n        break;\n    case BIO_C_SSL_MODE:\n        if (num)\n            SSL_set_connect_state(ssl);\n        else\n            SSL_set_accept_state(ssl);\n        break;\n    case BIO_C_SET_SSL_RENEGOTIATE_TIMEOUT:\n        ret = bs->renegotiate_timeout;\n        if (num < 60)\n            num = 5;\n        bs->renegotiate_timeout = (unsigned long)num;\n        bs->last_time = (unsigned long)time(NULL);\n        break;\n    case BIO_C_SET_SSL_RENEGOTIATE_BYTES:\n        ret = bs->renegotiate_count;\n        if ((long)num >= 512)\n            bs->renegotiate_count = (unsigned long)num;\n        break;\n    case BIO_C_GET_SSL_NUM_RENEGOTIATES:\n        ret = bs->num_renegotiates;\n        break;\n    case BIO_C_SET_SSL:\n        if (ssl != NULL) {\n            ssl_free(b);\n            if (!ssl_new(b))\n                return 0;\n        }\n        BIO_set_shutdown(b, num);\n        ssl = (SSL *)ptr;\n        bs->ssl = ssl;\n        bio = SSL_get_rbio(ssl);\n        if (bio != NULL) {\n            if (next != NULL)\n                BIO_push(bio, next);\n            BIO_set_next(b, bio);\n            BIO_up_ref(bio);\n        }\n        BIO_set_init(b, 1);\n        break;\n    case BIO_C_GET_SSL:\n        if (ptr != NULL) {\n            sslp = (SSL **)ptr;\n            *sslp = ssl;\n        } else\n            ret = 0;\n        break;\n    case BIO_CTRL_GET_CLOSE:\n        ret = BIO_get_shutdown(b);\n        break;\n    case BIO_CTRL_SET_CLOSE:\n        BIO_set_shutdown(b, (int)num);\n        break;\n    case BIO_CTRL_WPENDING:\n        ret = BIO_ctrl(ssl->wbio, cmd, num, ptr);\n        break;\n    case BIO_CTRL_PENDING:\n        ret = SSL_pending(ssl);\n        if (ret == 0)\n            ret = BIO_pending(ssl->rbio);\n        break;\n    case BIO_CTRL_FLUSH:\n        BIO_clear_retry_flags(b);\n        ret = BIO_ctrl(ssl->wbio, cmd, num, ptr);\n        BIO_copy_next_retry(b);\n        break;\n    case BIO_CTRL_PUSH:\n        if ((next != NULL) && (next != ssl->rbio)) {\n            SSL_set_bio(ssl, next, next);\n            BIO_up_ref(b);\n        }\n        break;\n    case BIO_CTRL_POP:\n        if (b == ptr) {\n            if (ssl->rbio != ssl->wbio)\n                BIO_free_all(ssl->wbio);\n            if (next != NULL)\n                BIO_free(next);\n            ssl->wbio = NULL;\n            ssl->rbio = NULL;\n        }\n        break;\n    case BIO_C_DO_STATE_MACHINE:\n        BIO_clear_retry_flags(b);\n        BIO_set_retry_reason(b, 0);\n        ret = (int)SSL_do_handshake(ssl);\n        switch (SSL_get_error(ssl, (int)ret)) {\n        case SSL_ERROR_WANT_READ:\n            BIO_set_flags(b, BIO_FLAGS_READ | BIO_FLAGS_SHOULD_RETRY);\n            break;\n        case SSL_ERROR_WANT_WRITE:\n            BIO_set_flags(b, BIO_FLAGS_WRITE | BIO_FLAGS_SHOULD_RETRY);\n            break;\n        case SSL_ERROR_WANT_CONNECT:\n            BIO_set_flags(b, BIO_FLAGS_IO_SPECIAL | BIO_FLAGS_SHOULD_RETRY);\n            BIO_set_retry_reason(b, BIO_get_retry_reason(next));\n            break;\n        case SSL_ERROR_WANT_X509_LOOKUP:\n            BIO_set_retry_special(b);\n            BIO_set_retry_reason(b, BIO_RR_SSL_X509_LOOKUP);\n            break;\n        default:\n            break;\n        }\n        break;\n    case BIO_CTRL_DUP:\n        dbio = (BIO *)ptr;\n        dbs = BIO_get_data(dbio);\n        SSL_free(dbs->ssl);\n        dbs->ssl = SSL_dup(ssl);\n        dbs->num_renegotiates = bs->num_renegotiates;\n        dbs->renegotiate_count = bs->renegotiate_count;\n        dbs->byte_count = bs->byte_count;\n        dbs->renegotiate_timeout = bs->renegotiate_timeout;\n        dbs->last_time = bs->last_time;\n        ret = (dbs->ssl != NULL);\n        break;\n    case BIO_C_GET_FD:\n        ret = BIO_ctrl(ssl->rbio, cmd, num, ptr);\n        break;\n    case BIO_CTRL_SET_CALLBACK:\n        {\n#if 0\n            SSLerr(SSL_F_SSL_CTRL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);\n            ret = -1;\n#else\n            ret = 0;\n#endif\n        }\n        break;\n    case BIO_CTRL_GET_CALLBACK:\n        {\n            void (**fptr) (const SSL *xssl, int type, int val);\n            fptr = (void (**)(const SSL *xssl, int type, int val))ptr;\n            *fptr = SSL_get_info_callback(ssl);\n        }\n        break;\n    default:\n        ret = BIO_ctrl(ssl->rbio, cmd, num, ptr);\n        break;\n    }\n    return (ret);\n}', 'int SSL_clear(SSL *s)\n{\n    if (s->method == NULL) {\n        SSLerr(SSL_F_SSL_CLEAR, SSL_R_NO_METHOD_SPECIFIED);\n        return (0);\n    }\n    if (ssl_clear_bad_session(s)) {\n        SSL_SESSION_free(s->session);\n        s->session = NULL;\n    }\n    s->error = 0;\n    s->hit = 0;\n    s->shutdown = 0;\n    if (s->renegotiate) {\n        SSLerr(SSL_F_SSL_CLEAR, ERR_R_INTERNAL_ERROR);\n        return 0;\n    }\n    ossl_statem_clear(s);\n    s->version = s->method->version;\n    s->client_version = s->version;\n    s->rwstate = SSL_NOTHING;\n    BUF_MEM_free(s->init_buf);\n    s->init_buf = NULL;\n    clear_ciphers(s);\n    s->first_packet = 0;\n    s->dane.mdpth = -1;\n    s->dane.pdpth = -1;\n    X509_free(s->dane.mcert);\n    s->dane.mcert = NULL;\n    s->dane.mtlsa = NULL;\n    X509_VERIFY_PARAM_move_peername(s->param, NULL);\n    if (!ossl_statem_get_in_handshake(s) && (s->session == NULL)\n        && (s->method != s->ctx->method)) {\n        s->method->ssl_free(s);\n        s->method = s->ctx->method;\n        if (!s->method->ssl_new(s))\n            return (0);\n    } else\n        s->method->ssl_clear(s);\n    RECORD_LAYER_clear(&s->rlayer);\n    return (1);\n}', 'int ssl_clear_bad_session(SSL *s)\n{\n    if ((s->session != NULL) &&\n        !(s->shutdown & SSL_SENT_SHUTDOWN) &&\n        !(SSL_in_init(s) || SSL_in_before(s))) {\n        SSL_CTX_remove_session(s->ctx, s->session);\n        return (1);\n    } else\n        return (0);\n}', 'int SSL_CTX_remove_session(SSL_CTX *ctx, SSL_SESSION *c)\n{\n    return remove_session_lock(ctx, c, 1);\n}', 'static int remove_session_lock(SSL_CTX *ctx, SSL_SESSION *c, int lck)\n{\n    SSL_SESSION *r;\n    int ret = 0;\n    if ((c != NULL) && (c->session_id_length != 0)) {\n        if (lck)\n            CRYPTO_THREAD_write_lock(ctx->lock);\n        if ((r = lh_SSL_SESSION_retrieve(ctx->sessions, c)) == c) {\n            ret = 1;\n            r = lh_SSL_SESSION_delete(ctx->sessions, c);\n            SSL_SESSION_list_remove(ctx, c);\n        }\n        if (lck)\n            CRYPTO_THREAD_unlock(ctx->lock);\n        if (ret) {\n            r->not_resumable = 1;\n            if (ctx->remove_session_cb != NULL)\n                ctx->remove_session_cb(ctx, r);\n            SSL_SESSION_free(r);\n        }\n    } else\n        ret = 0;\n    return (ret);\n}', 'DEFINE_LHASH_OF(SSL_SESSION)', 'void *OPENSSL_LH_delete(OPENSSL_LHASH *lh, const void *data)\n{\n    unsigned long hash;\n    OPENSSL_LH_NODE *nn, **rn;\n    void *ret;\n    lh->error = 0;\n    rn = getrn(lh, data, &hash);\n    if (*rn == NULL) {\n        lh->num_no_delete++;\n        return (NULL);\n    } else {\n        nn = *rn;\n        *rn = nn->next;\n        ret = nn->data;\n        OPENSSL_free(nn);\n        lh->num_delete++;\n    }\n    lh->num_items--;\n    if ((lh->num_nodes > MIN_NODES) &&\n        (lh->down_load >= (lh->num_items * LH_LOAD_MULT / lh->num_nodes)))\n        contract(lh);\n    return (ret);\n}']