ssl/s3_srvr.c:558: error: INTEGER_OVERFLOW_L2
  ([0, max(0, `s->ctx->sessions->num_items`)] - 1):unsigned64 by call to `ssl3_get_client_certificate`.
Showing all 13 steps of the trace


ssl/s3_srvr.c:195:1: Parameter `s->ctx->sessions->num_items`
193.   #endif
194.   
195. > int ssl3_accept(SSL *s)
196.   {
197.       BUF_MEM *buf;

ssl/s3_srvr.c:558:23: Call
556.           case SSL3_ST_SR_CERT_B:
557.               if (s->s3->tmp.cert_request) {
558.                   ret = ssl3_get_client_certificate(s);
                             ^
559.                   if (ret <= 0)
560.                       goto end;

ssl/s3_srvr.c:3027:1: Parameter `s->ctx->sessions->num_items`
  3025.   }
  3026.   
  3027. > int ssl3_get_client_certificate(SSL *s)
  3028.   {
  3029.       int i, ok, al, ret = -1;

ssl/s3_srvr.c:3179:5: Call
  3177.   
  3178.    f_err:
  3179.       ssl3_send_alert(s, SSL3_AL_FATAL, al);
              ^
  3180.    done:
  3181.       s->state = SSL_ST_ERR;

ssl/s3_msg.c:166:1: Parameter `s->ctx->sessions->num_items`
    164.   }
    165.   
    166. > int ssl3_send_alert(SSL *s, int level, int desc)
    167.   {
    168.       /* Map tls/ssl alert value to correct one */

ssl/s3_msg.c:177:9: Call
    175.       /* If a fatal one, remove from cache */
    176.       if ((level == SSL3_AL_FATAL) && (s->session != NULL))
    177.           SSL_CTX_remove_session(s->ctx, s->session);
                   ^
    178.   
    179.       s->s3->alert_dispatch = 1;

ssl/ssl_sess.c:787:1: Parameter `ctx->sessions->num_items`
      785.   }
      786.   
      787. > int SSL_CTX_remove_session(SSL_CTX *ctx, SSL_SESSION *c)
      788.   {
      789.       return remove_session_lock(ctx, c, 1);

ssl/ssl_sess.c:789:12: Call
      787.   int SSL_CTX_remove_session(SSL_CTX *ctx, SSL_SESSION *c)
      788.   {
      789.       return remove_session_lock(ctx, c, 1);
                        ^
      790.   }
      791.   

ssl/ssl_sess.c:792:1: Parameter `ctx->sessions->num_items`
        790.   }
        791.   
        792. > static int remove_session_lock(SSL_CTX *ctx, SSL_SESSION *c, int lck)
        793.   {
        794.       SSL_SESSION *r;

ssl/ssl_sess.c:802:17: Call
        800.           if ((r = lh_SSL_SESSION_retrieve(ctx->sessions, c)) == c) {
        801.               ret = 1;
        802.               r = lh_SSL_SESSION_delete(ctx->sessions, c);
                               ^
        803.               SSL_SESSION_list_remove(ctx, c);
        804.           }

crypto/lhash/lhash.c:209:1: <LHS trace>
207.   }
208.   
209. > void *lh_delete(_LHASH *lh, const void *data)
210.   {
211.       unsigned long hash;

crypto/lhash/lhash.c:209:1: Parameter `lh->num_items`
          207.   }
          208.   
          209. > void *lh_delete(_LHASH *lh, const void *data)
          210.   {
          211.       unsigned long hash;

crypto/lhash/lhash.c:229:5: Binary operation: ([0, max(0, s->ctx->sessions->num_items)] - 1):unsigned64 by call to `ssl3_get_client_certificate` 
          227.       }
          228.   
          229.       lh->num_items--;
                     ^
          230.       if ((lh->num_nodes > MIN_NODES) &&
          231.           (lh->down_load >= (lh->num_items * LH_LOAD_MULT / lh->num_nodes)))

void *lh_delete(_LHASH *lh, const void *data)
{
    unsigned long hash;
    LHASH_NODE *nn, **rn;
    void *ret;
    lh->error = 0;
    rn = getrn(lh, data, &hash);
    if (*rn == NULL) {
        lh->num_no_delete++;
        return (NULL);
    } else {
        nn = *rn;
        *rn = nn->next;
        ret = nn->data;
        OPENSSL_free(nn);
        lh->num_delete++;
    }
    lh->num_items--;
    if ((lh->num_nodes > MIN_NODES) &&
        (lh->down_load >= (lh->num_items * LH_LOAD_MULT / lh->num_nodes)))
        contract(lh);
    return (ret);
}
['int ssl3_accept(SSL *s)\n{\n    BUF_MEM *buf;\n    unsigned long alg_k, Time = (unsigned long)time(NULL);\n    void (*cb) (const SSL *ssl, int type, int val) = NULL;\n    int ret = -1;\n    int new_state, state, skip = 0;\n    RAND_add(&Time, sizeof(Time), 0);\n    ERR_clear_error();\n    clear_sys_error();\n    if (s->info_callback != NULL)\n        cb = s->info_callback;\n    else if (s->ctx->info_callback != NULL)\n        cb = s->ctx->info_callback;\n    s->in_handshake++;\n    if (!SSL_in_init(s) || SSL_in_before(s)) {\n        if (!SSL_clear(s))\n            return -1;\n    }\n#ifndef OPENSSL_NO_HEARTBEATS\n    if (s->tlsext_hb_pending) {\n        s->tlsext_hb_pending = 0;\n        s->tlsext_hb_seq++;\n    }\n#endif\n    for (;;) {\n        state = s->state;\n        switch (s->state) {\n        case SSL_ST_RENEGOTIATE:\n            s->renegotiate = 1;\n        case SSL_ST_BEFORE:\n        case SSL_ST_ACCEPT:\n        case SSL_ST_BEFORE | SSL_ST_ACCEPT:\n        case SSL_ST_OK | SSL_ST_ACCEPT:\n            s->server = 1;\n            if (cb != NULL)\n                cb(s, SSL_CB_HANDSHAKE_START, 1);\n            if ((s->version >> 8 != 3) && s->version != TLS_ANY_VERSION) {\n                SSLerr(SSL_F_SSL3_ACCEPT, ERR_R_INTERNAL_ERROR);\n                s->state = SSL_ST_ERR;\n                return -1;\n            }\n            if (!ssl_security(s, SSL_SECOP_VERSION, 0, s->version, NULL)) {\n                SSLerr(SSL_F_SSL3_ACCEPT, SSL_R_VERSION_TOO_LOW);\n                return -1;\n            }\n            s->type = SSL_ST_ACCEPT;\n            if (s->init_buf == NULL) {\n                if ((buf = BUF_MEM_new()) == NULL) {\n                    ret = -1;\n                    s->state = SSL_ST_ERR;\n                    goto end;\n                }\n                if (!BUF_MEM_grow(buf, SSL3_RT_MAX_PLAIN_LENGTH)) {\n                    BUF_MEM_free(buf);\n                    ret = -1;\n                    s->state = SSL_ST_ERR;\n                    goto end;\n                }\n                s->init_buf = buf;\n            }\n            if (!ssl3_setup_buffers(s)) {\n                ret = -1;\n                s->state = SSL_ST_ERR;\n                goto end;\n            }\n            s->init_num = 0;\n            s->s3->flags &= ~TLS1_FLAGS_SKIP_CERT_VERIFY;\n            s->s3->change_cipher_spec = 0;\n            if (s->state != SSL_ST_RENEGOTIATE) {\n                if (!ssl_init_wbio_buffer(s, 1)) {\n                    ret = -1;\n                    s->state = SSL_ST_ERR;\n                    goto end;\n                }\n                ssl3_init_finished_mac(s);\n                s->state = SSL3_ST_SR_CLNT_HELLO_A;\n                s->ctx->stats.sess_accept++;\n            } else if (!s->s3->send_connection_binding &&\n                       !(s->options &\n                         SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION)) {\n                SSLerr(SSL_F_SSL3_ACCEPT,\n                       SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);\n                ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_HANDSHAKE_FAILURE);\n                ret = -1;\n                s->state = SSL_ST_ERR;\n                goto end;\n            } else {\n                s->ctx->stats.sess_accept_renegotiate++;\n                s->state = SSL3_ST_SW_HELLO_REQ_A;\n            }\n            break;\n        case SSL3_ST_SW_HELLO_REQ_A:\n        case SSL3_ST_SW_HELLO_REQ_B:\n            s->shutdown = 0;\n            ret = ssl3_send_hello_request(s);\n            if (ret <= 0)\n                goto end;\n            s->s3->tmp.next_state = SSL3_ST_SW_HELLO_REQ_C;\n            s->state = SSL3_ST_SW_FLUSH;\n            s->init_num = 0;\n            ssl3_init_finished_mac(s);\n            break;\n        case SSL3_ST_SW_HELLO_REQ_C:\n            s->state = SSL_ST_OK;\n            break;\n        case SSL3_ST_SR_CLNT_HELLO_A:\n        case SSL3_ST_SR_CLNT_HELLO_B:\n        case SSL3_ST_SR_CLNT_HELLO_C:\n            ret = ssl3_get_client_hello(s);\n            if (ret <= 0)\n                goto end;\n#ifndef OPENSSL_NO_SRP\n            s->state = SSL3_ST_SR_CLNT_HELLO_D;\n        case SSL3_ST_SR_CLNT_HELLO_D:\n            {\n                int al;\n                if ((ret = ssl_check_srp_ext_ClientHello(s, &al)) < 0) {\n                    s->rwstate = SSL_X509_LOOKUP;\n                    goto end;\n                }\n                if (ret != SSL_ERROR_NONE) {\n                    ssl3_send_alert(s, SSL3_AL_FATAL, al);\n                    if (al != TLS1_AD_UNKNOWN_PSK_IDENTITY)\n                        SSLerr(SSL_F_SSL3_ACCEPT, SSL_R_CLIENTHELLO_TLSEXT);\n                    ret = SSL_TLSEXT_ERR_ALERT_FATAL;\n                    ret = -1;\n                    s->state = SSL_ST_ERR;\n                    goto end;\n                }\n            }\n#endif\n            s->renegotiate = 2;\n            s->state = SSL3_ST_SW_SRVR_HELLO_A;\n            s->init_num = 0;\n            break;\n        case SSL3_ST_SW_SRVR_HELLO_A:\n        case SSL3_ST_SW_SRVR_HELLO_B:\n            ret = ssl3_send_server_hello(s);\n            if (ret <= 0)\n                goto end;\n            if (s->hit) {\n                if (s->tlsext_ticket_expected)\n                    s->state = SSL3_ST_SW_SESSION_TICKET_A;\n                else\n                    s->state = SSL3_ST_SW_CHANGE_A;\n            } else {\n                s->state = SSL3_ST_SW_CERT_A;\n            }\n            s->init_num = 0;\n            break;\n        case SSL3_ST_SW_CERT_A:\n        case SSL3_ST_SW_CERT_B:\n            if (!(s->s3->tmp.new_cipher->algorithm_auth &\n                 (SSL_aNULL | SSL_aSRP | SSL_aPSK))) {\n                ret = ssl3_send_server_certificate(s);\n                if (ret <= 0)\n                    goto end;\n                if (s->tlsext_status_expected)\n                    s->state = SSL3_ST_SW_CERT_STATUS_A;\n                else\n                    s->state = SSL3_ST_SW_KEY_EXCH_A;\n            } else {\n                skip = 1;\n                s->state = SSL3_ST_SW_KEY_EXCH_A;\n            }\n            s->init_num = 0;\n            break;\n        case SSL3_ST_SW_KEY_EXCH_A:\n        case SSL3_ST_SW_KEY_EXCH_B:\n            alg_k = s->s3->tmp.new_cipher->algorithm_mkey;\n            s->s3->tmp.use_rsa_tmp = 0;\n            if (0\n#ifndef OPENSSL_NO_PSK\n                || ((alg_k & (SSL_kPSK | SSL_kRSAPSK)) && s->ctx->psk_identity_hint)\n                || (alg_k & (SSL_PSK & (SSL_kDHEPSK | SSL_kECDHEPSK)))\n#endif\n#ifndef OPENSSL_NO_SRP\n                || (alg_k & SSL_kSRP)\n#endif\n                || (alg_k & SSL_kDHE)\n                || (alg_k & SSL_kECDHE)\n                || ((alg_k & SSL_kRSA)\n                    && (s->cert->pkeys[SSL_PKEY_RSA_ENC].privatekey == NULL\n                        || (SSL_C_IS_EXPORT(s->s3->tmp.new_cipher)\n                            && EVP_PKEY_size(s->cert->pkeys\n                                             [SSL_PKEY_RSA_ENC].privatekey) *\n                            8 > SSL_C_EXPORT_PKEYLENGTH(s->s3->tmp.new_cipher)\n                        )\n                    )\n                )\n                ) {\n                ret = ssl3_send_server_key_exchange(s);\n                if (ret <= 0)\n                    goto end;\n            } else\n                skip = 1;\n            s->state = SSL3_ST_SW_CERT_REQ_A;\n            s->init_num = 0;\n            break;\n        case SSL3_ST_SW_CERT_REQ_A:\n        case SSL3_ST_SW_CERT_REQ_B:\n            if (\n                   !(s->verify_mode & SSL_VERIFY_PEER) ||\n                   ((s->session->peer != NULL) &&\n                    (s->verify_mode & SSL_VERIFY_CLIENT_ONCE)) ||\n                   ((s->s3->tmp.new_cipher->algorithm_auth & SSL_aNULL) &&\n                   !(s->verify_mode & SSL_VERIFY_FAIL_IF_NO_PEER_CERT)) ||\n                   (s->s3->tmp.new_cipher->algorithm_auth & SSL_aSRP)\n                   || (s->s3->tmp.new_cipher->algorithm_mkey & SSL_PSK)) {\n                skip = 1;\n                s->s3->tmp.cert_request = 0;\n                s->state = SSL3_ST_SW_SRVR_DONE_A;\n                if (!ssl3_digest_cached_records(s, 0)) {\n                    s->state = SSL_ST_ERR;\n                    return -1;\n                }\n            } else {\n                s->s3->tmp.cert_request = 1;\n                ret = ssl3_send_certificate_request(s);\n                if (ret <= 0)\n                    goto end;\n                s->state = SSL3_ST_SW_SRVR_DONE_A;\n                s->init_num = 0;\n            }\n            break;\n        case SSL3_ST_SW_SRVR_DONE_A:\n        case SSL3_ST_SW_SRVR_DONE_B:\n            ret = ssl3_send_server_done(s);\n            if (ret <= 0)\n                goto end;\n            s->s3->tmp.next_state = SSL3_ST_SR_CERT_A;\n            s->state = SSL3_ST_SW_FLUSH;\n            s->init_num = 0;\n            break;\n        case SSL3_ST_SW_FLUSH:\n            s->rwstate = SSL_WRITING;\n            if (BIO_flush(s->wbio) <= 0) {\n                ret = -1;\n                goto end;\n            }\n            s->rwstate = SSL_NOTHING;\n            s->state = s->s3->tmp.next_state;\n            break;\n        case SSL3_ST_SR_CERT_A:\n        case SSL3_ST_SR_CERT_B:\n            if (s->s3->tmp.cert_request) {\n                ret = ssl3_get_client_certificate(s);\n                if (ret <= 0)\n                    goto end;\n            }\n            s->init_num = 0;\n            s->state = SSL3_ST_SR_KEY_EXCH_A;\n            break;\n        case SSL3_ST_SR_KEY_EXCH_A:\n        case SSL3_ST_SR_KEY_EXCH_B:\n            ret = ssl3_get_client_key_exchange(s);\n            if (ret <= 0)\n                goto end;\n            if (ret == 2) {\n                s->state = SSL3_ST_SR_CHANGE_A;\n                s->init_num = 0;\n            } else if (SSL_USE_SIGALGS(s)) {\n                s->state = SSL3_ST_SR_CERT_VRFY_A;\n                s->init_num = 0;\n                if (!s->session->peer)\n                    break;\n                if (!s->s3->handshake_buffer) {\n                    SSLerr(SSL_F_SSL3_ACCEPT, ERR_R_INTERNAL_ERROR);\n                    s->state = SSL_ST_ERR;\n                    return -1;\n                }\n                if (!ssl3_digest_cached_records(s, 1)) {\n                    s->state = SSL_ST_ERR;\n                    return -1;\n                }\n            } else {\n                int offset = 0;\n                int dgst_num;\n                s->state = SSL3_ST_SR_CERT_VRFY_A;\n                s->init_num = 0;\n                if (!ssl3_digest_cached_records(s, 0)) {\n                    s->state = SSL_ST_ERR;\n                    return -1;\n                }\n                for (dgst_num = 0; dgst_num < SSL_MAX_DIGEST; dgst_num++)\n                    if (s->s3->handshake_dgst[dgst_num]) {\n                        int dgst_size;\n                        s->method->ssl3_enc->cert_verify_mac(s,\n                                                             EVP_MD_CTX_type\n                                                             (s->\n                                                              s3->handshake_dgst\n                                                              [dgst_num]),\n                                                             &(s->s3->\n                                                               tmp.cert_verify_md\n                                                               [offset]));\n                        dgst_size =\n                            EVP_MD_CTX_size(s->s3->handshake_dgst[dgst_num]);\n                        if (dgst_size < 0) {\n                            s->state = SSL_ST_ERR;\n                            ret = -1;\n                            goto end;\n                        }\n                        offset += dgst_size;\n                    }\n            }\n            break;\n        case SSL3_ST_SR_CERT_VRFY_A:\n        case SSL3_ST_SR_CERT_VRFY_B:\n            ret = ssl3_get_cert_verify(s);\n            if (ret <= 0)\n                goto end;\n            s->state = SSL3_ST_SR_CHANGE_A;\n            s->init_num = 0;\n            break;\n#if !defined(OPENSSL_NO_NEXTPROTONEG)\n        case SSL3_ST_SR_NEXT_PROTO_A:\n        case SSL3_ST_SR_NEXT_PROTO_B:\n            ret = ssl3_get_next_proto(s);\n            if (ret <= 0)\n                goto end;\n            s->init_num = 0;\n            s->state = SSL3_ST_SR_FINISHED_A;\n            break;\n#endif\n        case SSL3_ST_SR_CHANGE_A:\n        case SSL3_ST_SR_CHANGE_B:\n            ret = ssl3_get_change_cipher_spec(s, SSL3_ST_SR_CHANGE_A,\n                                              SSL3_ST_SR_CHANGE_B);\n            if (ret <= 0)\n                goto end;\n#if defined(OPENSSL_NO_NEXTPROTONEG)\n            s->state = SSL3_ST_SR_FINISHED_A;\n#else\n            if (s->s3->next_proto_neg_seen)\n                s->state = SSL3_ST_SR_NEXT_PROTO_A;\n            else\n                s->state = SSL3_ST_SR_FINISHED_A;\n#endif\n            s->init_num = 0;\n            break;\n        case SSL3_ST_SR_FINISHED_A:\n        case SSL3_ST_SR_FINISHED_B:\n            ret = ssl3_get_finished(s, SSL3_ST_SR_FINISHED_A,\n                                    SSL3_ST_SR_FINISHED_B);\n            if (ret <= 0)\n                goto end;\n            if (s->hit)\n                s->state = SSL_ST_OK;\n            else if (s->tlsext_ticket_expected)\n                s->state = SSL3_ST_SW_SESSION_TICKET_A;\n            else\n                s->state = SSL3_ST_SW_CHANGE_A;\n            s->init_num = 0;\n            break;\n        case SSL3_ST_SW_SESSION_TICKET_A:\n        case SSL3_ST_SW_SESSION_TICKET_B:\n            ret = ssl3_send_newsession_ticket(s);\n            if (ret <= 0)\n                goto end;\n            s->state = SSL3_ST_SW_CHANGE_A;\n            s->init_num = 0;\n            break;\n        case SSL3_ST_SW_CERT_STATUS_A:\n        case SSL3_ST_SW_CERT_STATUS_B:\n            ret = ssl3_send_cert_status(s);\n            if (ret <= 0)\n                goto end;\n            s->state = SSL3_ST_SW_KEY_EXCH_A;\n            s->init_num = 0;\n            break;\n        case SSL3_ST_SW_CHANGE_A:\n        case SSL3_ST_SW_CHANGE_B:\n            s->session->cipher = s->s3->tmp.new_cipher;\n            if (!s->method->ssl3_enc->setup_key_block(s)) {\n                ret = -1;\n                s->state = SSL_ST_ERR;\n                goto end;\n            }\n            ret = ssl3_send_change_cipher_spec(s,\n                                               SSL3_ST_SW_CHANGE_A,\n                                               SSL3_ST_SW_CHANGE_B);\n            if (ret <= 0)\n                goto end;\n            s->state = SSL3_ST_SW_FINISHED_A;\n            s->init_num = 0;\n            if (!s->method->ssl3_enc->change_cipher_state(s,\n                                                          SSL3_CHANGE_CIPHER_SERVER_WRITE))\n            {\n                ret = -1;\n                s->state = SSL_ST_ERR;\n                goto end;\n            }\n            break;\n        case SSL3_ST_SW_FINISHED_A:\n        case SSL3_ST_SW_FINISHED_B:\n            ret = ssl3_send_finished(s,\n                                     SSL3_ST_SW_FINISHED_A,\n                                     SSL3_ST_SW_FINISHED_B,\n                                     s->method->\n                                     ssl3_enc->server_finished_label,\n                                     s->method->\n                                     ssl3_enc->server_finished_label_len);\n            if (ret <= 0)\n                goto end;\n            s->state = SSL3_ST_SW_FLUSH;\n            if (s->hit) {\n                s->s3->tmp.next_state = SSL3_ST_SR_CHANGE_A;\n            } else\n                s->s3->tmp.next_state = SSL_ST_OK;\n            s->init_num = 0;\n            break;\n        case SSL_ST_OK:\n            ssl3_cleanup_key_block(s);\n            BUF_MEM_free(s->init_buf);\n            s->init_buf = NULL;\n            ssl_free_wbio_buffer(s);\n            s->init_num = 0;\n            if (s->renegotiate == 2) {\n                s->renegotiate = 0;\n                s->new_session = 0;\n                ssl_update_cache(s, SSL_SESS_CACHE_SERVER);\n                s->ctx->stats.sess_accept_good++;\n                s->handshake_func = ssl3_accept;\n                if (cb != NULL)\n                    cb(s, SSL_CB_HANDSHAKE_DONE, 1);\n            }\n            ret = 1;\n            goto end;\n        case SSL_ST_ERR:\n        default:\n            SSLerr(SSL_F_SSL3_ACCEPT, SSL_R_UNKNOWN_STATE);\n            ret = -1;\n            goto end;\n        }\n        if (!s->s3->tmp.reuse_message && !skip) {\n            if (s->debug) {\n                if ((ret = BIO_flush(s->wbio)) <= 0)\n                    goto end;\n            }\n            if ((cb != NULL) && (s->state != state)) {\n                new_state = s->state;\n                s->state = state;\n                cb(s, SSL_CB_ACCEPT_LOOP, 1);\n                s->state = new_state;\n            }\n        }\n        skip = 0;\n    }\n end:\n    s->in_handshake--;\n    if (cb != NULL)\n        cb(s, SSL_CB_ACCEPT_EXIT, ret);\n    return (ret);\n}', 'int ssl3_get_client_certificate(SSL *s)\n{\n    int i, ok, al, ret = -1;\n    X509 *x = NULL;\n    unsigned long l, llen, n;\n    const unsigned char *certstart;\n    unsigned char *certbytes;\n    STACK_OF(X509) *sk = NULL;\n    PACKET pkt, spkt;\n    n = s->method->ssl_get_message(s,\n                                   SSL3_ST_SR_CERT_A,\n                                   SSL3_ST_SR_CERT_B,\n                                   -1, s->max_cert_list, &ok);\n    if (!ok)\n        return ((int)n);\n    if (s->s3->tmp.message_type == SSL3_MT_CLIENT_KEY_EXCHANGE) {\n        if ((s->verify_mode & SSL_VERIFY_PEER) &&\n            (s->verify_mode & SSL_VERIFY_FAIL_IF_NO_PEER_CERT)) {\n            SSLerr(SSL_F_SSL3_GET_CLIENT_CERTIFICATE,\n                   SSL_R_PEER_DID_NOT_RETURN_A_CERTIFICATE);\n            al = SSL_AD_HANDSHAKE_FAILURE;\n            goto f_err;\n        }\n        if ((s->version > SSL3_VERSION) && s->s3->tmp.cert_request) {\n            SSLerr(SSL_F_SSL3_GET_CLIENT_CERTIFICATE,\n                   SSL_R_TLS_PEER_DID_NOT_RESPOND_WITH_CERTIFICATE_LIST);\n            al = SSL_AD_UNEXPECTED_MESSAGE;\n            goto f_err;\n        }\n        s->s3->tmp.reuse_message = 1;\n        return (1);\n    }\n    if (s->s3->tmp.message_type != SSL3_MT_CERTIFICATE) {\n        al = SSL_AD_UNEXPECTED_MESSAGE;\n        SSLerr(SSL_F_SSL3_GET_CLIENT_CERTIFICATE, SSL_R_WRONG_MESSAGE_TYPE);\n        goto f_err;\n    }\n    if (!PACKET_buf_init(&pkt, s->init_msg, n)) {\n        al = SSL_AD_INTERNAL_ERROR;\n        SSLerr(SSL_F_SSL3_GET_CLIENT_CERTIFICATE, ERR_R_INTERNAL_ERROR);\n        goto f_err;\n    }\n    if ((sk = sk_X509_new_null()) == NULL) {\n        SSLerr(SSL_F_SSL3_GET_CLIENT_CERTIFICATE, ERR_R_MALLOC_FAILURE);\n        goto done;\n    }\n    if (!PACKET_get_net_3(&pkt, &llen)\n            || !PACKET_get_sub_packet(&pkt, &spkt, llen)\n            || PACKET_remaining(&pkt) != 0) {\n        al = SSL_AD_DECODE_ERROR;\n        SSLerr(SSL_F_SSL3_GET_CLIENT_CERTIFICATE, SSL_R_LENGTH_MISMATCH);\n        goto f_err;\n    }\n    while (PACKET_remaining(&spkt) > 0) {\n        if (!PACKET_get_net_3(&spkt, &l)\n                || !PACKET_get_bytes(&spkt, &certbytes, l)) {\n            al = SSL_AD_DECODE_ERROR;\n            SSLerr(SSL_F_SSL3_GET_CLIENT_CERTIFICATE,\n                   SSL_R_CERT_LENGTH_MISMATCH);\n            goto f_err;\n        }\n        certstart = certbytes;\n        x = d2i_X509(NULL, (const unsigned char **)&certbytes, l);\n        if (x == NULL) {\n            SSLerr(SSL_F_SSL3_GET_CLIENT_CERTIFICATE, ERR_R_ASN1_LIB);\n            goto done;\n        }\n        if (certbytes != (certstart + l)) {\n            al = SSL_AD_DECODE_ERROR;\n            SSLerr(SSL_F_SSL3_GET_CLIENT_CERTIFICATE,\n                   SSL_R_CERT_LENGTH_MISMATCH);\n            goto f_err;\n        }\n        if (!sk_X509_push(sk, x)) {\n            SSLerr(SSL_F_SSL3_GET_CLIENT_CERTIFICATE, ERR_R_MALLOC_FAILURE);\n            goto done;\n        }\n        x = NULL;\n    }\n    if (sk_X509_num(sk) <= 0) {\n        if (s->version == SSL3_VERSION) {\n            al = SSL_AD_HANDSHAKE_FAILURE;\n            SSLerr(SSL_F_SSL3_GET_CLIENT_CERTIFICATE,\n                   SSL_R_NO_CERTIFICATES_RETURNED);\n            goto f_err;\n        }\n        else if ((s->verify_mode & SSL_VERIFY_PEER) &&\n                 (s->verify_mode & SSL_VERIFY_FAIL_IF_NO_PEER_CERT)) {\n            SSLerr(SSL_F_SSL3_GET_CLIENT_CERTIFICATE,\n                   SSL_R_PEER_DID_NOT_RETURN_A_CERTIFICATE);\n            al = SSL_AD_HANDSHAKE_FAILURE;\n            goto f_err;\n        }\n        if (s->s3->handshake_buffer && !ssl3_digest_cached_records(s, 0)) {\n            al = SSL_AD_INTERNAL_ERROR;\n            goto f_err;\n        }\n    } else {\n        EVP_PKEY *pkey;\n        i = ssl_verify_cert_chain(s, sk);\n        if (i <= 0) {\n            al = ssl_verify_alarm_type(s->verify_result);\n            SSLerr(SSL_F_SSL3_GET_CLIENT_CERTIFICATE,\n                   SSL_R_CERTIFICATE_VERIFY_FAILED);\n            goto f_err;\n        }\n        if (i > 1) {\n            SSLerr(SSL_F_SSL3_GET_CLIENT_CERTIFICATE, i);\n            al = SSL_AD_HANDSHAKE_FAILURE;\n            goto f_err;\n        }\n        pkey = X509_get_pubkey(sk_X509_value(sk, 0));\n        if (pkey == NULL) {\n            al = SSL3_AD_HANDSHAKE_FAILURE;\n            SSLerr(SSL_F_SSL3_GET_CLIENT_CERTIFICATE,\n                   SSL_R_UNKNOWN_CERTIFICATE_TYPE);\n            goto f_err;\n        }\n        EVP_PKEY_free(pkey);\n    }\n    X509_free(s->session->peer);\n    s->session->peer = sk_X509_shift(sk);\n    s->session->verify_result = s->verify_result;\n    sk_X509_pop_free(s->session->peer_chain, X509_free);\n    s->session->peer_chain = sk;\n    sk = NULL;\n    ret = 1;\n    goto done;\n f_err:\n    ssl3_send_alert(s, SSL3_AL_FATAL, al);\n done:\n    s->state = SSL_ST_ERR;\n    X509_free(x);\n    sk_X509_pop_free(sk, X509_free);\n    return (ret);\n}', 'int ssl3_send_alert(SSL *s, int level, int desc)\n{\n    desc = s->method->ssl3_enc->alert_value(desc);\n    if (s->version == SSL3_VERSION && desc == SSL_AD_PROTOCOL_VERSION)\n        desc = SSL_AD_HANDSHAKE_FAILURE;\n    if (desc < 0)\n        return -1;\n    if ((level == SSL3_AL_FATAL) && (s->session != NULL))\n        SSL_CTX_remove_session(s->ctx, s->session);\n    s->s3->alert_dispatch = 1;\n    s->s3->send_alert[0] = level;\n    s->s3->send_alert[1] = desc;\n    if (!RECORD_LAYER_write_pending(&s->rlayer)) {\n        return s->method->ssl_dispatch_alert(s);\n    }\n    return -1;\n}', 'int SSL_CTX_remove_session(SSL_CTX *ctx, SSL_SESSION *c)\n{\n    return remove_session_lock(ctx, c, 1);\n}', 'static int remove_session_lock(SSL_CTX *ctx, SSL_SESSION *c, int lck)\n{\n    SSL_SESSION *r;\n    int ret = 0;\n    if ((c != NULL) && (c->session_id_length != 0)) {\n        if (lck)\n            CRYPTO_w_lock(CRYPTO_LOCK_SSL_CTX);\n        if ((r = lh_SSL_SESSION_retrieve(ctx->sessions, c)) == c) {\n            ret = 1;\n            r = lh_SSL_SESSION_delete(ctx->sessions, c);\n            SSL_SESSION_list_remove(ctx, c);\n        }\n        if (lck)\n            CRYPTO_w_unlock(CRYPTO_LOCK_SSL_CTX);\n        if (ret) {\n            r->not_resumable = 1;\n            if (ctx->remove_session_cb != NULL)\n                ctx->remove_session_cb(ctx, r);\n            SSL_SESSION_free(r);\n        }\n    } else\n        ret = 0;\n    return (ret);\n}', 'void *lh_delete(_LHASH *lh, const void *data)\n{\n    unsigned long hash;\n    LHASH_NODE *nn, **rn;\n    void *ret;\n    lh->error = 0;\n    rn = getrn(lh, data, &hash);\n    if (*rn == NULL) {\n        lh->num_no_delete++;\n        return (NULL);\n    } else {\n        nn = *rn;\n        *rn = nn->next;\n        ret = nn->data;\n        OPENSSL_free(nn);\n        lh->num_delete++;\n    }\n    lh->num_items--;\n    if ((lh->num_nodes > MIN_NODES) &&\n        (lh->down_load >= (lh->num_items * LH_LOAD_MULT / lh->num_nodes)))\n        contract(lh);\n    return (ret);\n}']