ssl/record/rec_layer_s3.c:1048: error: INTEGER_OVERFLOW_L2
  ([0, max(0, `s->ctx->sessions->num_items`)] - 1):unsigned64 by call to `ssl3_get_record`.
Showing all 15 steps of the trace


ssl/record/rec_layer_s3.c:968:1: Parameter `s->ctx->sessions->num_items`
966.    *             none of our business
967.    */
968. > int ssl3_read_bytes(SSL *s, int type, int *recvd_type, unsigned char *buf,
969.                       int len, int peek)
970.   {

ssl/record/rec_layer_s3.c:1048:19: Call
1046.           /* get new records if necessary */
1047.           if (num_recs == 0) {
1048.               ret = ssl3_get_record(s);
                          ^
1049.               if (ret <= 0)
1050.                   return (ret);

ssl/record/ssl3_record.c:126:1: Parameter `s->ctx->sessions->num_items`
  124.    */
  125.   /* used only by ssl3_read_bytes */
  126. > int ssl3_get_record(SSL *s)
  127.   {
  128.       int ssl_major, ssl_minor, al;

ssl/record/ssl3_record.c:509:5: Call
  507.   
  508.    f_err:
  509.       ssl3_send_alert(s, SSL3_AL_FATAL, al);
             ^
  510.    err:
  511.       return ret;

ssl/s3_msg.c:64:1: Parameter `s->ctx->sessions->num_items`
    62.   }
    63.   
    64. > int ssl3_send_alert(SSL *s, int level, int desc)
    65.   {
    66.       /* Map tls/ssl alert value to correct one */

ssl/s3_msg.c:75:9: Call
    73.       /* If a fatal one, remove from cache */
    74.       if ((level == SSL3_AL_FATAL) && (s->session != NULL))
    75.           SSL_CTX_remove_session(s->ctx, s->session);
                  ^
    76.   
    77.       s->s3->alert_dispatch = 1;

ssl/ssl_sess.c:691:1: Parameter `ctx->sessions->num_items`
      689.   }
      690.   
      691. > int SSL_CTX_remove_session(SSL_CTX *ctx, SSL_SESSION *c)
      692.   {
      693.       return remove_session_lock(ctx, c, 1);

ssl/ssl_sess.c:693:12: Call
      691.   int SSL_CTX_remove_session(SSL_CTX *ctx, SSL_SESSION *c)
      692.   {
      693.       return remove_session_lock(ctx, c, 1);
                        ^
      694.   }
      695.   

ssl/ssl_sess.c:696:1: Parameter `ctx->sessions->num_items`
        694.   }
        695.   
        696. > static int remove_session_lock(SSL_CTX *ctx, SSL_SESSION *c, int lck)
        697.   {
        698.       SSL_SESSION *r;

ssl/ssl_sess.c:706:17: Call
        704.           if ((r = lh_SSL_SESSION_retrieve(ctx->sessions, c)) == c) {
        705.               ret = 1;
        706.               r = lh_SSL_SESSION_delete(ctx->sessions, c);
                               ^
        707.               SSL_SESSION_list_remove(ctx, c);
        708.           }

ssl/ssl_locl.h:581:1: Parameter `lh->num_items`
          579.   };
          580.   
          581. > DEFINE_LHASH_OF(SSL_SESSION);
          582.   /* Needed in ssl_cert.c */
          583.   DEFINE_LHASH_OF(X509_NAME);

ssl/ssl_locl.h:581:1: Call
          579.   };
          580.   
          581. > DEFINE_LHASH_OF(SSL_SESSION);
          582.   /* Needed in ssl_cert.c */
          583.   DEFINE_LHASH_OF(X509_NAME);

crypto/lhash/lhash.c:103:1: <LHS trace>
101.   }
102.   
103. > void *OPENSSL_LH_delete(OPENSSL_LHASH *lh, const void *data)
104.   {
105.       unsigned long hash;

crypto/lhash/lhash.c:103:1: Parameter `lh->num_items`
            101.   }
            102.   
            103. > void *OPENSSL_LH_delete(OPENSSL_LHASH *lh, const void *data)
            104.   {
            105.       unsigned long hash;

crypto/lhash/lhash.c:123:5: Binary operation: ([0, max(0, s->ctx->sessions->num_items)] - 1):unsigned64 by call to `ssl3_get_record` 
            121.       }
            122.   
            123.       lh->num_items--;
                       ^
            124.       if ((lh->num_nodes > MIN_NODES) &&
            125.           (lh->down_load >= (lh->num_items * LH_LOAD_MULT / lh->num_nodes)))

void *OPENSSL_LH_delete(OPENSSL_LHASH *lh, const void *data)
{
    unsigned long hash;
    OPENSSL_LH_NODE *nn, **rn;
    void *ret;
    lh->error = 0;
    rn = getrn(lh, data, &hash);
    if (*rn == NULL) {
        lh->num_no_delete++;
        return (NULL);
    } else {
        nn = *rn;
        *rn = nn->next;
        ret = nn->data;
        OPENSSL_free(nn);
        lh->num_delete++;
    }
    lh->num_items--;
    if ((lh->num_nodes > MIN_NODES) &&
        (lh->down_load >= (lh->num_items * LH_LOAD_MULT / lh->num_nodes)))
        contract(lh);
    return (ret);
}
['int ssl3_read_bytes(SSL *s, int type, int *recvd_type, unsigned char *buf,\n                    int len, int peek)\n{\n    int al, i, j, ret;\n    unsigned int n, curr_rec, num_recs, read_bytes;\n    SSL3_RECORD *rr;\n    SSL3_BUFFER *rbuf;\n    void (*cb) (const SSL *ssl, int type2, int val) = NULL;\n    rbuf = &s->rlayer.rbuf;\n    if (!SSL3_BUFFER_is_initialised(rbuf)) {\n        if (!ssl3_setup_read_buffer(s))\n            return (-1);\n    }\n    if ((type && (type != SSL3_RT_APPLICATION_DATA)\n         && (type != SSL3_RT_HANDSHAKE)) || (peek\n                                             && (type !=\n                                                 SSL3_RT_APPLICATION_DATA))) {\n        SSLerr(SSL_F_SSL3_READ_BYTES, ERR_R_INTERNAL_ERROR);\n        return -1;\n    }\n    if ((type == SSL3_RT_HANDSHAKE) && (s->rlayer.handshake_fragment_len > 0))\n    {\n        unsigned char *src = s->rlayer.handshake_fragment;\n        unsigned char *dst = buf;\n        unsigned int k;\n        n = 0;\n        while ((len > 0) && (s->rlayer.handshake_fragment_len > 0)) {\n            *dst++ = *src++;\n            len--;\n            s->rlayer.handshake_fragment_len--;\n            n++;\n        }\n        for (k = 0; k < s->rlayer.handshake_fragment_len; k++)\n            s->rlayer.handshake_fragment[k] = *src++;\n        if (recvd_type != NULL)\n            *recvd_type = SSL3_RT_HANDSHAKE;\n        return n;\n    }\n    if (!ossl_statem_get_in_handshake(s) && SSL_in_init(s)) {\n        i = s->handshake_func(s);\n        if (i < 0)\n            return (i);\n        if (i == 0) {\n            SSLerr(SSL_F_SSL3_READ_BYTES, SSL_R_SSL_HANDSHAKE_FAILURE);\n            return (-1);\n        }\n    }\n start:\n    s->rwstate = SSL_NOTHING;\n    rr = s->rlayer.rrec;\n    num_recs = RECORD_LAYER_get_numrpipes(&s->rlayer);\n    do {\n        if (num_recs == 0) {\n            ret = ssl3_get_record(s);\n            if (ret <= 0)\n                return (ret);\n            num_recs = RECORD_LAYER_get_numrpipes(&s->rlayer);\n            if (num_recs == 0) {\n                al = SSL_AD_INTERNAL_ERROR;\n                SSLerr(SSL_F_SSL3_READ_BYTES, ERR_R_INTERNAL_ERROR);\n                goto f_err;\n            }\n        }\n        for (curr_rec = 0;\n             curr_rec < num_recs && SSL3_RECORD_get_length(&rr[curr_rec]) == 0;\n             curr_rec++);\n        if (curr_rec == num_recs) {\n            RECORD_LAYER_set_numrpipes(&s->rlayer, 0);\n            num_recs = 0;\n            curr_rec = 0;\n        }\n    } while (num_recs == 0);\n    rr = &rr[curr_rec];\n    if (s->s3->change_cipher_spec\n        && (SSL3_RECORD_get_type(rr) != SSL3_RT_HANDSHAKE)) {\n        al = SSL_AD_UNEXPECTED_MESSAGE;\n        SSLerr(SSL_F_SSL3_READ_BYTES, SSL_R_DATA_BETWEEN_CCS_AND_FINISHED);\n        goto f_err;\n    }\n    if (s->shutdown & SSL_RECEIVED_SHUTDOWN) {\n        SSL3_RECORD_set_length(rr, 0);\n        s->rwstate = SSL_NOTHING;\n        return (0);\n    }\n    if (type == SSL3_RECORD_get_type(rr)\n            || (SSL3_RECORD_get_type(rr) == SSL3_RT_CHANGE_CIPHER_SPEC\n                && type == SSL3_RT_HANDSHAKE && recvd_type != NULL)) {\n        if (SSL_in_init(s) && (type == SSL3_RT_APPLICATION_DATA) &&\n            (s->enc_read_ctx == NULL)) {\n            al = SSL_AD_UNEXPECTED_MESSAGE;\n            SSLerr(SSL_F_SSL3_READ_BYTES, SSL_R_APP_DATA_IN_HANDSHAKE);\n            goto f_err;\n        }\n        if (type == SSL3_RT_HANDSHAKE\n                && SSL3_RECORD_get_type(rr) == SSL3_RT_CHANGE_CIPHER_SPEC\n                && s->rlayer.handshake_fragment_len > 0) {\n            al = SSL_AD_UNEXPECTED_MESSAGE;\n            SSLerr(SSL_F_SSL3_READ_BYTES, SSL_R_CCS_RECEIVED_EARLY);\n            goto f_err;\n        }\n        if (recvd_type != NULL)\n            *recvd_type = SSL3_RECORD_get_type(rr);\n        if (len <= 0)\n            return (len);\n        read_bytes = 0;\n        do {\n            if ((unsigned int)len - read_bytes > SSL3_RECORD_get_length(rr))\n                n = SSL3_RECORD_get_length(rr);\n            else\n                n = (unsigned int)len - read_bytes;\n            memcpy(buf, &(rr->data[rr->off]), n);\n            buf += n;\n            if (!peek) {\n                SSL3_RECORD_add_length(rr, -n);\n                SSL3_RECORD_add_off(rr, n);\n                if (SSL3_RECORD_get_length(rr) == 0) {\n                    s->rlayer.rstate = SSL_ST_READ_HEADER;\n                    SSL3_RECORD_set_off(rr, 0);\n                }\n            }\n            if (SSL3_RECORD_get_length(rr) == 0\n                || (peek && n == SSL3_RECORD_get_length(rr))) {\n                curr_rec++;\n                rr++;\n            }\n            read_bytes += n;\n        } while (type == SSL3_RT_APPLICATION_DATA && curr_rec < num_recs\n                 && read_bytes < (unsigned int)len);\n        if (!peek && curr_rec == num_recs\n                && (s->mode & SSL_MODE_RELEASE_BUFFERS)\n                && SSL3_BUFFER_get_left(rbuf) == 0)\n            ssl3_release_read_buffer(s);\n        return read_bytes;\n    }\n    if (rr->type == SSL3_RT_HANDSHAKE && type == SSL3_RT_CHANGE_CIPHER_SPEC) {\n        al = SSL_AD_UNEXPECTED_MESSAGE;\n        SSLerr(SSL_F_SSL3_READ_BYTES, SSL_R_UNEXPECTED_MESSAGE);\n        goto f_err;\n    }\n    if (rr->rec_version == SSL2_VERSION) {\n        al = SSL_AD_INTERNAL_ERROR;\n        SSLerr(SSL_F_SSL3_READ_BYTES, ERR_R_INTERNAL_ERROR);\n        goto f_err;\n    }\n    if(s->method->version == TLS_ANY_VERSION\n            && (s->server || rr->type != SSL3_RT_ALERT)) {\n        s->version = rr->rec_version;\n        al = SSL_AD_UNEXPECTED_MESSAGE;\n        SSLerr(SSL_F_SSL3_READ_BYTES, SSL_R_UNEXPECTED_MESSAGE);\n        goto f_err;\n    }\n    {\n        unsigned int dest_maxlen = 0;\n        unsigned char *dest = NULL;\n        unsigned int *dest_len = NULL;\n        if (SSL3_RECORD_get_type(rr) == SSL3_RT_HANDSHAKE) {\n            dest_maxlen = sizeof s->rlayer.handshake_fragment;\n            dest = s->rlayer.handshake_fragment;\n            dest_len = &s->rlayer.handshake_fragment_len;\n        } else if (SSL3_RECORD_get_type(rr) == SSL3_RT_ALERT) {\n            dest_maxlen = sizeof s->rlayer.alert_fragment;\n            dest = s->rlayer.alert_fragment;\n            dest_len = &s->rlayer.alert_fragment_len;\n        }\n        if (dest_maxlen > 0) {\n            n = dest_maxlen - *dest_len;\n            if (SSL3_RECORD_get_length(rr) < n)\n                n = SSL3_RECORD_get_length(rr);\n            while (n-- > 0) {\n                dest[(*dest_len)++] =\n                    SSL3_RECORD_get_data(rr)[SSL3_RECORD_get_off(rr)];\n                SSL3_RECORD_add_off(rr, 1);\n                SSL3_RECORD_add_length(rr, -1);\n            }\n            if (*dest_len < dest_maxlen)\n                goto start;\n        }\n    }\n    if ((!s->server) &&\n        (s->rlayer.handshake_fragment_len >= 4) &&\n        (s->rlayer.handshake_fragment[0] == SSL3_MT_HELLO_REQUEST) &&\n        (s->session != NULL) && (s->session->cipher != NULL)) {\n        s->rlayer.handshake_fragment_len = 0;\n        if ((s->rlayer.handshake_fragment[1] != 0) ||\n            (s->rlayer.handshake_fragment[2] != 0) ||\n            (s->rlayer.handshake_fragment[3] != 0)) {\n            al = SSL_AD_DECODE_ERROR;\n            SSLerr(SSL_F_SSL3_READ_BYTES, SSL_R_BAD_HELLO_REQUEST);\n            goto f_err;\n        }\n        if (s->msg_callback)\n            s->msg_callback(0, s->version, SSL3_RT_HANDSHAKE,\n                            s->rlayer.handshake_fragment, 4, s,\n                            s->msg_callback_arg);\n        if (SSL_is_init_finished(s) &&\n            !(s->s3->flags & SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS) &&\n            !s->s3->renegotiate) {\n            ssl3_renegotiate(s);\n            if (ssl3_renegotiate_check(s)) {\n                i = s->handshake_func(s);\n                if (i < 0)\n                    return (i);\n                if (i == 0) {\n                    SSLerr(SSL_F_SSL3_READ_BYTES,\n                           SSL_R_SSL_HANDSHAKE_FAILURE);\n                    return (-1);\n                }\n                if (!(s->mode & SSL_MODE_AUTO_RETRY)) {\n                    if (SSL3_BUFFER_get_left(rbuf) == 0) {\n                        BIO *bio;\n                        s->rwstate = SSL_READING;\n                        bio = SSL_get_rbio(s);\n                        BIO_clear_retry_flags(bio);\n                        BIO_set_retry_read(bio);\n                        return (-1);\n                    }\n                }\n            }\n        }\n        goto start;\n    }\n    if (s->server &&\n        SSL_is_init_finished(s) &&\n        !s->s3->send_connection_binding &&\n        (s->version > SSL3_VERSION) &&\n        (s->rlayer.handshake_fragment_len >= 4) &&\n        (s->rlayer.handshake_fragment[0] == SSL3_MT_CLIENT_HELLO) &&\n        (s->session != NULL) && (s->session->cipher != NULL) &&\n        !(s->ctx->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION)) {\n        SSL3_RECORD_set_length(rr, 0);\n        ssl3_send_alert(s, SSL3_AL_WARNING, SSL_AD_NO_RENEGOTIATION);\n        goto start;\n    }\n    if (s->rlayer.alert_fragment_len >= 2) {\n        int alert_level = s->rlayer.alert_fragment[0];\n        int alert_descr = s->rlayer.alert_fragment[1];\n        s->rlayer.alert_fragment_len = 0;\n        if (s->msg_callback)\n            s->msg_callback(0, s->version, SSL3_RT_ALERT,\n                            s->rlayer.alert_fragment, 2, s,\n                            s->msg_callback_arg);\n        if (s->info_callback != NULL)\n            cb = s->info_callback;\n        else if (s->ctx->info_callback != NULL)\n            cb = s->ctx->info_callback;\n        if (cb != NULL) {\n            j = (alert_level << 8) | alert_descr;\n            cb(s, SSL_CB_READ_ALERT, j);\n        }\n        if (alert_level == SSL3_AL_WARNING) {\n            s->s3->warn_alert = alert_descr;\n            if (alert_descr == SSL_AD_CLOSE_NOTIFY) {\n                s->shutdown |= SSL_RECEIVED_SHUTDOWN;\n                return (0);\n            }\n            else if (alert_descr == SSL_AD_NO_RENEGOTIATION) {\n                al = SSL_AD_HANDSHAKE_FAILURE;\n                SSLerr(SSL_F_SSL3_READ_BYTES, SSL_R_NO_RENEGOTIATION);\n                goto f_err;\n            }\n#ifdef SSL_AD_MISSING_SRP_USERNAME\n            else if (alert_descr == SSL_AD_MISSING_SRP_USERNAME)\n                return (0);\n#endif\n        } else if (alert_level == SSL3_AL_FATAL) {\n            char tmp[16];\n            s->rwstate = SSL_NOTHING;\n            s->s3->fatal_alert = alert_descr;\n            SSLerr(SSL_F_SSL3_READ_BYTES, SSL_AD_REASON_OFFSET + alert_descr);\n            BIO_snprintf(tmp, sizeof tmp, "%d", alert_descr);\n            ERR_add_error_data(2, "SSL alert number ", tmp);\n            s->shutdown |= SSL_RECEIVED_SHUTDOWN;\n            SSL_CTX_remove_session(s->ctx, s->session);\n            return (0);\n        } else {\n            al = SSL_AD_ILLEGAL_PARAMETER;\n            SSLerr(SSL_F_SSL3_READ_BYTES, SSL_R_UNKNOWN_ALERT_TYPE);\n            goto f_err;\n        }\n        goto start;\n    }\n    if (s->shutdown & SSL_SENT_SHUTDOWN) {\n        s->rwstate = SSL_NOTHING;\n        SSL3_RECORD_set_length(rr, 0);\n        return (0);\n    }\n    if (SSL3_RECORD_get_type(rr) == SSL3_RT_CHANGE_CIPHER_SPEC) {\n        al = SSL_AD_UNEXPECTED_MESSAGE;\n        SSLerr(SSL_F_SSL3_READ_BYTES, SSL_R_CCS_RECEIVED_EARLY);\n        goto f_err;\n    }\n    if ((s->rlayer.handshake_fragment_len >= 4)\n            && !ossl_statem_get_in_handshake(s)) {\n        if (SSL_is_init_finished(s) &&\n            !(s->s3->flags & SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS)) {\n            ossl_statem_set_in_init(s, 1);\n            s->renegotiate = 1;\n            s->new_session = 1;\n        }\n        i = s->handshake_func(s);\n        if (i < 0)\n            return (i);\n        if (i == 0) {\n            SSLerr(SSL_F_SSL3_READ_BYTES, SSL_R_SSL_HANDSHAKE_FAILURE);\n            return (-1);\n        }\n        if (!(s->mode & SSL_MODE_AUTO_RETRY)) {\n            if (SSL3_BUFFER_get_left(rbuf) == 0) {\n                BIO *bio;\n                s->rwstate = SSL_READING;\n                bio = SSL_get_rbio(s);\n                BIO_clear_retry_flags(bio);\n                BIO_set_retry_read(bio);\n                return (-1);\n            }\n        }\n        goto start;\n    }\n    switch (SSL3_RECORD_get_type(rr)) {\n    default:\n        if (s->version >= TLS1_VERSION && s->version <= TLS1_1_VERSION) {\n            SSL3_RECORD_set_length(rr, 0);\n            goto start;\n        }\n        al = SSL_AD_UNEXPECTED_MESSAGE;\n        SSLerr(SSL_F_SSL3_READ_BYTES, SSL_R_UNEXPECTED_RECORD);\n        goto f_err;\n    case SSL3_RT_CHANGE_CIPHER_SPEC:\n    case SSL3_RT_ALERT:\n    case SSL3_RT_HANDSHAKE:\n        al = SSL_AD_UNEXPECTED_MESSAGE;\n        SSLerr(SSL_F_SSL3_READ_BYTES, ERR_R_INTERNAL_ERROR);\n        goto f_err;\n    case SSL3_RT_APPLICATION_DATA:\n        if (ossl_statem_app_data_allowed(s)) {\n            s->s3->in_read_app_data = 2;\n            return (-1);\n        } else {\n            al = SSL_AD_UNEXPECTED_MESSAGE;\n            SSLerr(SSL_F_SSL3_READ_BYTES, SSL_R_UNEXPECTED_RECORD);\n            goto f_err;\n        }\n    }\n f_err:\n    ssl3_send_alert(s, SSL3_AL_FATAL, al);\n    return (-1);\n}', 'int ssl3_get_record(SSL *s)\n{\n    int ssl_major, ssl_minor, al;\n    int enc_err, n, i, ret = -1;\n    SSL3_RECORD *rr;\n    SSL3_BUFFER *rbuf;\n    SSL_SESSION *sess;\n    unsigned char *p;\n    unsigned char md[EVP_MAX_MD_SIZE];\n    short version;\n    unsigned mac_size;\n    unsigned empty_record_count = 0, curr_empty = 0;\n    unsigned int num_recs = 0;\n    unsigned int max_recs;\n    unsigned int j;\n    rr = RECORD_LAYER_get_rrec(&s->rlayer);\n    rbuf = RECORD_LAYER_get_rbuf(&s->rlayer);\n    max_recs = s->max_pipelines;\n    if (max_recs == 0)\n        max_recs = 1;\n    sess = s->session;\n again:\n    do {\n        if ((RECORD_LAYER_get_rstate(&s->rlayer) != SSL_ST_READ_BODY) ||\n            (RECORD_LAYER_get_packet_length(&s->rlayer)\n             < SSL3_RT_HEADER_LENGTH)) {\n            n = ssl3_read_n(s, SSL3_RT_HEADER_LENGTH,\n                SSL3_BUFFER_get_len(rbuf), 0, num_recs == 0 ? 1 : 0);\n            if (n <= 0)\n                return (n);\n            RECORD_LAYER_set_rstate(&s->rlayer, SSL_ST_READ_BODY);\n            p = RECORD_LAYER_get_packet(&s->rlayer);\n            if (s->first_packet && s->server && !s->read_hash\n                    && !s->enc_read_ctx\n                    && (p[0] & 0x80) && (p[2] == SSL2_MT_CLIENT_HELLO)) {\n                rr[num_recs].type = SSL3_RT_HANDSHAKE;\n                rr[num_recs].rec_version = SSL2_VERSION;\n                rr[num_recs].length = ((p[0] & 0x7f) << 8) | p[1];\n                if (rr[num_recs].length > SSL3_BUFFER_get_len(rbuf)\n                                 - SSL2_RT_HEADER_LENGTH) {\n                    al = SSL_AD_RECORD_OVERFLOW;\n                    SSLerr(SSL_F_SSL3_GET_RECORD, SSL_R_PACKET_LENGTH_TOO_LONG);\n                    goto f_err;\n                }\n                if (rr[num_recs].length < MIN_SSL2_RECORD_LEN) {\n                    al = SSL_AD_HANDSHAKE_FAILURE;\n                    SSLerr(SSL_F_SSL3_GET_RECORD, SSL_R_LENGTH_TOO_SHORT);\n                    goto f_err;\n                }\n            } else {\n                if (s->msg_callback)\n                    s->msg_callback(0, 0, SSL3_RT_HEADER, p, 5, s,\n                                    s->msg_callback_arg);\n                rr[num_recs].type = *(p++);\n                ssl_major = *(p++);\n                ssl_minor = *(p++);\n                version = (ssl_major << 8) | ssl_minor;\n                rr[num_recs].rec_version = version;\n                n2s(p, rr[num_recs].length);\n                if (!s->first_packet && version != s->version) {\n                    SSLerr(SSL_F_SSL3_GET_RECORD, SSL_R_WRONG_VERSION_NUMBER);\n                    if ((s->version & 0xFF00) == (version & 0xFF00)\n                        && !s->enc_write_ctx && !s->write_hash) {\n                        if (rr->type == SSL3_RT_ALERT) {\n                             goto err;\n                        }\n                        s->version = (unsigned short)version;\n                    }\n                    al = SSL_AD_PROTOCOL_VERSION;\n                    goto f_err;\n                }\n                if ((version >> 8) != SSL3_VERSION_MAJOR) {\n                    if (s->first_packet) {\n                        p = RECORD_LAYER_get_packet(&s->rlayer);\n                        if (strncmp((char *)p, "GET ", 4) == 0 ||\n                            strncmp((char *)p, "POST ", 5) == 0 ||\n                            strncmp((char *)p, "HEAD ", 5) == 0 ||\n                            strncmp((char *)p, "PUT ", 4) == 0) {\n                            SSLerr(SSL_F_SSL3_GET_RECORD, SSL_R_HTTP_REQUEST);\n                            goto err;\n                        } else if (strncmp((char *)p, "CONNE", 5) == 0) {\n                            SSLerr(SSL_F_SSL3_GET_RECORD,\n                                   SSL_R_HTTPS_PROXY_REQUEST);\n                            goto err;\n                        }\n                    }\n                    SSLerr(SSL_F_SSL3_GET_RECORD, SSL_R_WRONG_VERSION_NUMBER);\n                    goto err;\n                }\n                if (rr[num_recs].length >\n                        SSL3_BUFFER_get_len(rbuf) - SSL3_RT_HEADER_LENGTH) {\n                    al = SSL_AD_RECORD_OVERFLOW;\n                    SSLerr(SSL_F_SSL3_GET_RECORD, SSL_R_PACKET_LENGTH_TOO_LONG);\n                    goto f_err;\n                }\n            }\n        }\n        if (rr[num_recs].rec_version == SSL2_VERSION) {\n            i = rr[num_recs].length + SSL2_RT_HEADER_LENGTH\n                - SSL3_RT_HEADER_LENGTH;\n        } else {\n            i = rr[num_recs].length;\n        }\n        if (i > 0) {\n            n = ssl3_read_n(s, i, i, 1, 0);\n            if (n <= 0)\n                return (n);\n        }\n        RECORD_LAYER_set_rstate(&s->rlayer, SSL_ST_READ_HEADER);\n        if(rr[num_recs].rec_version == SSL2_VERSION) {\n            rr[num_recs].input =\n                &(RECORD_LAYER_get_packet(&s->rlayer)[SSL2_RT_HEADER_LENGTH]);\n        } else {\n            rr[num_recs].input =\n                &(RECORD_LAYER_get_packet(&s->rlayer)[SSL3_RT_HEADER_LENGTH]);\n        }\n        if (rr[num_recs].length > SSL3_RT_MAX_ENCRYPTED_LENGTH) {\n            al = SSL_AD_RECORD_OVERFLOW;\n            SSLerr(SSL_F_SSL3_GET_RECORD, SSL_R_ENCRYPTED_LENGTH_TOO_LONG);\n            goto f_err;\n        }\n        rr[num_recs].data = rr[num_recs].input;\n        rr[num_recs].orig_len = rr[num_recs].length;\n        num_recs++;\n        RECORD_LAYER_reset_packet_length(&s->rlayer);\n    } while (num_recs < max_recs\n             && rr[num_recs-1].type == SSL3_RT_APPLICATION_DATA\n             && SSL_USE_EXPLICIT_IV(s)\n             && s->enc_read_ctx != NULL\n             && (EVP_CIPHER_flags(EVP_CIPHER_CTX_cipher(s->enc_read_ctx))\n                & EVP_CIPH_FLAG_PIPELINE)\n             && ssl3_record_app_data_waiting(s));\n    if (SSL_USE_ETM(s) && s->read_hash) {\n        unsigned char *mac;\n        mac_size = EVP_MD_CTX_size(s->read_hash);\n        OPENSSL_assert(mac_size <= EVP_MAX_MD_SIZE);\n        for (j = 0; j < num_recs; j++) {\n            if (rr[j].length < mac_size) {\n                al = SSL_AD_DECODE_ERROR;\n                SSLerr(SSL_F_SSL3_GET_RECORD, SSL_R_LENGTH_TOO_SHORT);\n                goto f_err;\n            }\n            rr[j].length -= mac_size;\n            mac = rr[j].data + rr[j].length;\n            i = s->method->ssl3_enc->mac(s, &rr[j], md, 0   );\n            if (i < 0 || CRYPTO_memcmp(md, mac, (size_t)mac_size) != 0) {\n                al = SSL_AD_BAD_RECORD_MAC;\n                SSLerr(SSL_F_SSL3_GET_RECORD,\n                       SSL_R_DECRYPTION_FAILED_OR_BAD_RECORD_MAC);\n                goto f_err;\n            }\n        }\n    }\n    enc_err = s->method->ssl3_enc->enc(s, rr, num_recs, 0);\n    if (enc_err == 0) {\n        al = SSL_AD_DECRYPTION_FAILED;\n        SSLerr(SSL_F_SSL3_GET_RECORD, SSL_R_BLOCK_CIPHER_PAD_IS_WRONG);\n        goto f_err;\n    }\n#ifdef SSL_DEBUG\n    printf("dec %d\\n", rr->length);\n    {\n        unsigned int z;\n        for (z = 0; z < rr->length; z++)\n            printf("%02X%c", rr->data[z], ((z + 1) % 16) ? \' \' : \'\\n\');\n    }\n    printf("\\n");\n#endif\n    if ((sess != NULL) &&\n        (s->enc_read_ctx != NULL) &&\n        (EVP_MD_CTX_md(s->read_hash) != NULL) && !SSL_USE_ETM(s)) {\n        unsigned char *mac = NULL;\n        unsigned char mac_tmp[EVP_MAX_MD_SIZE];\n        mac_size = EVP_MD_CTX_size(s->read_hash);\n        OPENSSL_assert(mac_size <= EVP_MAX_MD_SIZE);\n        for (j=0; j < num_recs; j++) {\n            if (rr[j].orig_len < mac_size ||\n                (EVP_CIPHER_CTX_mode(s->enc_read_ctx) == EVP_CIPH_CBC_MODE &&\n                 rr[j].orig_len < mac_size + 1)) {\n                al = SSL_AD_DECODE_ERROR;\n                SSLerr(SSL_F_SSL3_GET_RECORD, SSL_R_LENGTH_TOO_SHORT);\n                goto f_err;\n            }\n            if (EVP_CIPHER_CTX_mode(s->enc_read_ctx) == EVP_CIPH_CBC_MODE) {\n                mac = mac_tmp;\n                ssl3_cbc_copy_mac(mac_tmp, &rr[j], mac_size);\n                rr[j].length -= mac_size;\n            } else {\n                rr[j].length -= mac_size;\n                mac = &rr[j].data[rr[j].length];\n            }\n            i = s->method->ssl3_enc->mac(s, &rr[j], md, 0   );\n            if (i < 0 || mac == NULL\n                || CRYPTO_memcmp(md, mac, (size_t)mac_size) != 0)\n                enc_err = -1;\n            if (rr->length > SSL3_RT_MAX_COMPRESSED_LENGTH + mac_size)\n                enc_err = -1;\n        }\n    }\n    if (enc_err < 0) {\n        al = SSL_AD_BAD_RECORD_MAC;\n        SSLerr(SSL_F_SSL3_GET_RECORD,\n               SSL_R_DECRYPTION_FAILED_OR_BAD_RECORD_MAC);\n        goto f_err;\n    }\n    for (j = 0; j < num_recs; j++) {\n        if (s->expand != NULL) {\n            if (rr[j].length > SSL3_RT_MAX_COMPRESSED_LENGTH) {\n                al = SSL_AD_RECORD_OVERFLOW;\n                SSLerr(SSL_F_SSL3_GET_RECORD, SSL_R_COMPRESSED_LENGTH_TOO_LONG);\n                goto f_err;\n            }\n            if (!ssl3_do_uncompress(s, &rr[j])) {\n                al = SSL_AD_DECOMPRESSION_FAILURE;\n                SSLerr(SSL_F_SSL3_GET_RECORD, SSL_R_BAD_DECOMPRESSION);\n                goto f_err;\n            }\n        }\n        if (rr[j].length > SSL3_RT_MAX_PLAIN_LENGTH) {\n            al = SSL_AD_RECORD_OVERFLOW;\n            SSLerr(SSL_F_SSL3_GET_RECORD, SSL_R_DATA_LENGTH_TOO_LONG);\n            goto f_err;\n        }\n        rr[j].off = 0;\n        if (rr[j].length == 0) {\n            curr_empty++;\n            empty_record_count++;\n            if (empty_record_count > MAX_EMPTY_RECORDS) {\n                al = SSL_AD_UNEXPECTED_MESSAGE;\n                SSLerr(SSL_F_SSL3_GET_RECORD, SSL_R_RECORD_TOO_SMALL);\n                goto f_err;\n            }\n        }\n    }\n    if (curr_empty == num_recs) {\n        num_recs = 0;\n        curr_empty = 0;\n        goto again;\n    }\n    RECORD_LAYER_set_numrpipes(&s->rlayer, num_recs);\n    return 1;\n f_err:\n    ssl3_send_alert(s, SSL3_AL_FATAL, al);\n err:\n    return ret;\n}', 'int ssl3_send_alert(SSL *s, int level, int desc)\n{\n    desc = s->method->ssl3_enc->alert_value(desc);\n    if (s->version == SSL3_VERSION && desc == SSL_AD_PROTOCOL_VERSION)\n        desc = SSL_AD_HANDSHAKE_FAILURE;\n    if (desc < 0)\n        return -1;\n    if ((level == SSL3_AL_FATAL) && (s->session != NULL))\n        SSL_CTX_remove_session(s->ctx, s->session);\n    s->s3->alert_dispatch = 1;\n    s->s3->send_alert[0] = level;\n    s->s3->send_alert[1] = desc;\n    if (!RECORD_LAYER_write_pending(&s->rlayer)) {\n        return s->method->ssl_dispatch_alert(s);\n    }\n    return -1;\n}', 'int SSL_CTX_remove_session(SSL_CTX *ctx, SSL_SESSION *c)\n{\n    return remove_session_lock(ctx, c, 1);\n}', 'static int remove_session_lock(SSL_CTX *ctx, SSL_SESSION *c, int lck)\n{\n    SSL_SESSION *r;\n    int ret = 0;\n    if ((c != NULL) && (c->session_id_length != 0)) {\n        if (lck)\n            CRYPTO_THREAD_write_lock(ctx->lock);\n        if ((r = lh_SSL_SESSION_retrieve(ctx->sessions, c)) == c) {\n            ret = 1;\n            r = lh_SSL_SESSION_delete(ctx->sessions, c);\n            SSL_SESSION_list_remove(ctx, c);\n        }\n        if (lck)\n            CRYPTO_THREAD_unlock(ctx->lock);\n        if (ret) {\n            r->not_resumable = 1;\n            if (ctx->remove_session_cb != NULL)\n                ctx->remove_session_cb(ctx, r);\n            SSL_SESSION_free(r);\n        }\n    } else\n        ret = 0;\n    return (ret);\n}', 'DEFINE_LHASH_OF(SSL_SESSION)', 'void *OPENSSL_LH_delete(OPENSSL_LHASH *lh, const void *data)\n{\n    unsigned long hash;\n    OPENSSL_LH_NODE *nn, **rn;\n    void *ret;\n    lh->error = 0;\n    rn = getrn(lh, data, &hash);\n    if (*rn == NULL) {\n        lh->num_no_delete++;\n        return (NULL);\n    } else {\n        nn = *rn;\n        *rn = nn->next;\n        ret = nn->data;\n        OPENSSL_free(nn);\n        lh->num_delete++;\n    }\n    lh->num_items--;\n    if ((lh->num_nodes > MIN_NODES) &&\n        (lh->down_load >= (lh->num_items * LH_LOAD_MULT / lh->num_nodes)))\n        contract(lh);\n    return (ret);\n}']