ssl/s3_enc.c:249: error: INTEGER_OVERFLOW_L2
  (32 - [-oo, 190]):unsigned64 by call to `MD5_Update`.
Showing all 12 steps of the trace


ssl/s3_enc.c:246:3: Call
244.   		 * same value since only the correct one will be used :-).
245.   		 */
246.   		MD5_Init(&md);
         ^
247.   		MD5_Update(&md,key,j);
248.   		MD5_Update(&md,er1,SSL3_RANDOM_SIZE);

crypto/md5/md5_dgst.c:97:2: Assignment
  95.   	c->Nl=0;
  96.   	c->Nh=0;
  97.   	c->num=0;
          ^
  98.   	}
  99.   

ssl/s3_enc.c:247:3: Call
245.   		 */
246.   		MD5_Init(&md);
247.   		MD5_Update(&md,key,j);
         ^
248.   		MD5_Update(&md,er1,SSL3_RANDOM_SIZE);
249.   		MD5_Update(&md,er2,SSL3_RANDOM_SIZE);

crypto/md5/md5_dgst.c:100:1: Parameter `c->num`
  98.   	}
  99.   
  100. > void MD5_Update(MD5_CTX *c, const void *_data, unsigned long len)
  101.   	{
  102.   	register const unsigned char *data=_data;

ssl/s3_enc.c:248:3: Call
246.   		MD5_Init(&md);
247.   		MD5_Update(&md,key,j);
248.   		MD5_Update(&md,er1,SSL3_RANDOM_SIZE);
         ^
249.   		MD5_Update(&md,er2,SSL3_RANDOM_SIZE);
250.   		MD5_Final(&(exp_key[0]),&md);

crypto/md5/md5_dgst.c:100:1: Parameter `c->num`
  98.   	}
  99.   
  100. > void MD5_Update(MD5_CTX *c, const void *_data, unsigned long len)
  101.   	{
  102.   	register const unsigned char *data=_data;

ssl/s3_enc.c:249:3: Call
247.   		MD5_Update(&md,key,j);
248.   		MD5_Update(&md,er1,SSL3_RANDOM_SIZE);
249.   		MD5_Update(&md,er2,SSL3_RANDOM_SIZE);
         ^
250.   		MD5_Final(&(exp_key[0]),&md);
251.   		key= &(exp_key[0]);

crypto/md5/md5_dgst.c:100:1: <LHS trace>
98.   	}
99.   
100. > void MD5_Update(MD5_CTX *c, const void *_data, unsigned long len)
101.   	{
102.   	register const unsigned char *data=_data;

crypto/md5/md5_dgst.c:100:1: Parameter `len`
  98.   	}
  99.   
  100. > void MD5_Update(MD5_CTX *c, const void *_data, unsigned long len)
  101.   	{
  102.   	register const unsigned char *data=_data;

crypto/md5/md5_dgst.c:100:1: <RHS trace>
98.   	}
99.   
100. > void MD5_Update(MD5_CTX *c, const void *_data, unsigned long len)
101.   	{
102.   	register const unsigned char *data=_data;

crypto/md5/md5_dgst.c:100:1: Parameter `len`
  98.   	}
  99.   
  100. > void MD5_Update(MD5_CTX *c, const void *_data, unsigned long len)
  101.   	{
  102.   	register const unsigned char *data=_data;

crypto/md5/md5_dgst.c:133:4: Binary operation: (32 - [-oo, 190]):unsigned64 by call to `MD5_Update` 
  131.   				p[sw]=l;
  132.   				}
  133.   			len-=(MD5_CBLOCK-c->num);
            ^
  134.   
  135.   			md5_block(c,p,64);

void MD5_Update(MD5_CTX *c, const void *_data, unsigned long len)
	{
	register const unsigned char *data=_data;
	register ULONG *p;
	int sw,sc;
	ULONG l;
	if (len == 0) return;
	l=(c->Nl+(len<<3))&0xffffffffL;
	if (l < c->Nl)
		c->Nh++;
	c->Nh+=(len>>29);
	c->Nl=l;
	if (c->num != 0)
		{
		p=c->data;
		sw=c->num>>2;
		sc=c->num&0x03;
		if ((c->num+len) >= MD5_CBLOCK)
			{
			l= p[sw];
			p_c2l(data,l,sc);
			p[sw++]=l;
			for (; sw<MD5_LBLOCK; sw++)
				{
				c2l(data,l);
				p[sw]=l;
				}
			len-=(MD5_CBLOCK-c->num);
			md5_block(c,p,64);
			c->num=0;
			}
		else
			{
			int ew,ec;
			c->num+=(int)len;
			if ((sc+len) < 4)
				{
				l= p[sw];
				p_c2l_p(data,l,sc,len);
				p[sw]=l;
				}
			else
				{
				ew=(c->num>>2);
				ec=(c->num&0x03);
				l= p[sw];
				p_c2l(data,l,sc);
				p[sw++]=l;
				for (; sw < ew; sw++)
					{ c2l(data,l); p[sw]=l; }
				if (ec)
					{
					c2l_p(data,l,ec);
					p[sw]=l;
					}
				}
			return;
			}
		}
#ifdef L_ENDIAN
	if ((((unsigned long)data)%sizeof(ULONG)) == 0)
		{
		sw=(int)len/MD5_CBLOCK;
		if (sw > 0)
			{
			sw*=MD5_CBLOCK;
			md5_block(c,(ULONG *)data,sw);
			data+=sw;
			len-=sw;
			}
		}
#endif
	p=c->data;
	while (len >= MD5_CBLOCK)
		{
#if defined(L_ENDIAN) || defined(B_ENDIAN)
		if (p != (unsigned long *)data)
			memcpy(p,data,MD5_CBLOCK);
		data+=MD5_CBLOCK;
#ifdef B_ENDIAN
		for (sw=(MD5_LBLOCK/4); sw; sw--)
			{
			Endian_Reverse32(p[0]);
			Endian_Reverse32(p[1]);
			Endian_Reverse32(p[2]);
			Endian_Reverse32(p[3]);
			p+=4;
			}
#endif
#else
		for (sw=(MD5_LBLOCK/4); sw; sw--)
			{
			c2l(data,l); *(p++)=l;
			c2l(data,l); *(p++)=l;
			c2l(data,l); *(p++)=l;
			c2l(data,l); *(p++)=l;
			}
#endif
		p=c->data;
		md5_block(c,p,64);
		len-=MD5_CBLOCK;
		}
	sc=(int)len;
	c->num=sc;
	if (sc)
		{
		sw=sc>>2;
#ifdef L_ENDIAN
		p[sw]=0;
		memcpy(p,data,sc);
#else
		sc&=0x03;
		for ( ; sw; sw--)
			{ c2l(data,l); *(p++)=l; }
		c2l_p(data,l,sc);
		*p=l;
#endif
		}
	}
['int ssl3_change_cipher_state(SSL *s, int which)\n\t{\n\tunsigned char *p,*key_block,*mac_secret;\n\tunsigned char exp_key[EVP_MAX_KEY_LENGTH];\n\tunsigned char exp_iv[EVP_MAX_KEY_LENGTH];\n\tunsigned char *ms,*key,*iv,*er1,*er2;\n\tEVP_CIPHER_CTX *dd;\n\tconst EVP_CIPHER *c;\n\tCOMP_METHOD *comp;\n\tconst EVP_MD *m;\n\tMD5_CTX md;\n\tint exp,n,i,j,k,cl;\n\texp=SSL_C_IS_EXPORT(s->s3->tmp.new_cipher);\n\tc=s->s3->tmp.new_sym_enc;\n\tm=s->s3->tmp.new_hash;\n\tif (s->s3->tmp.new_compression == NULL)\n\t\tcomp=NULL;\n\telse\n\t\tcomp=s->s3->tmp.new_compression->method;\n\tkey_block=s->s3->tmp.key_block;\n\tif (which & SSL3_CC_READ)\n\t\t{\n\t\tif ((s->enc_read_ctx == NULL) &&\n\t\t\t((s->enc_read_ctx=(EVP_CIPHER_CTX *)\n\t\t\tMalloc(sizeof(EVP_CIPHER_CTX))) == NULL))\n\t\t\tgoto err;\n\t\tdd= s->enc_read_ctx;\n\t\ts->read_hash=m;\n\t\tif (s->expand != NULL)\n\t\t\t{\n\t\t\tCOMP_CTX_free(s->expand);\n\t\t\ts->expand=NULL;\n\t\t\t}\n\t\tif (comp != NULL)\n\t\t\t{\n\t\t\ts->expand=COMP_CTX_new(comp);\n\t\t\tif (s->expand == NULL)\n\t\t\t\t{\n\t\t\t\tSSLerr(SSL_F_SSL3_CHANGE_CIPHER_STATE,SSL_R_COMPRESSION_LIBRARY_ERROR);\n\t\t\t\tgoto err2;\n\t\t\t\t}\n\t\t\tif (s->s3->rrec.comp == NULL)\n\t\t\t\ts->s3->rrec.comp=(unsigned char *)\n\t\t\t\t\tMalloc(SSL3_RT_MAX_PLAIN_LENGTH);\n\t\t\tif (s->s3->rrec.comp == NULL)\n\t\t\t\tgoto err;\n\t\t\t}\n\t\tmemset(&(s->s3->read_sequence[0]),0,8);\n\t\tmac_secret= &(s->s3->read_mac_secret[0]);\n\t\t}\n\telse\n\t\t{\n\t\tif ((s->enc_write_ctx == NULL) &&\n\t\t\t((s->enc_write_ctx=(EVP_CIPHER_CTX *)\n\t\t\tMalloc(sizeof(EVP_CIPHER_CTX))) == NULL))\n\t\t\tgoto err;\n\t\tdd= s->enc_write_ctx;\n\t\ts->write_hash=m;\n\t\tif (s->compress != NULL)\n\t\t\t{\n\t\t\tCOMP_CTX_free(s->compress);\n\t\t\ts->compress=NULL;\n\t\t\t}\n\t\tif (comp != NULL)\n\t\t\t{\n\t\t\ts->compress=COMP_CTX_new(comp);\n\t\t\tif (s->compress == NULL)\n\t\t\t\t{\n\t\t\t\tSSLerr(SSL_F_SSL3_CHANGE_CIPHER_STATE,SSL_R_COMPRESSION_LIBRARY_ERROR);\n\t\t\t\tgoto err2;\n\t\t\t\t}\n\t\t\t}\n\t\tmemset(&(s->s3->write_sequence[0]),0,8);\n\t\tmac_secret= &(s->s3->write_mac_secret[0]);\n\t\t}\n\tEVP_CIPHER_CTX_init(dd);\n\tp=s->s3->tmp.key_block;\n\ti=EVP_MD_size(m);\n\tcl=EVP_CIPHER_key_length(c);\n\tj=exp ? (cl < SSL_C_EXPORT_KEYLENGTH(s->s3->tmp.new_cipher) ?\n\t\t cl : SSL_C_EXPORT_KEYLENGTH(s->s3->tmp.new_cipher)) : cl;\n\tk=EVP_CIPHER_iv_length(c);\n\tif (\t(which == SSL3_CHANGE_CIPHER_CLIENT_WRITE) ||\n\t\t(which == SSL3_CHANGE_CIPHER_SERVER_READ))\n\t\t{\n\t\tms=  &(p[ 0]); n=i+i;\n\t\tkey= &(p[ n]); n+=j+j;\n\t\tiv=  &(p[ n]); n+=k+k;\n\t\ter1= &(s->s3->client_random[0]);\n\t\ter2= &(s->s3->server_random[0]);\n\t\t}\n\telse\n\t\t{\n\t\tn=i;\n\t\tms=  &(p[ n]); n+=i+j;\n\t\tkey= &(p[ n]); n+=j+k;\n\t\tiv=  &(p[ n]); n+=k;\n\t\ter1= &(s->s3->server_random[0]);\n\t\ter2= &(s->s3->client_random[0]);\n\t\t}\n\tif (n > s->s3->tmp.key_block_length)\n\t\t{\n\t\tSSLerr(SSL_F_SSL3_CHANGE_CIPHER_STATE,SSL_R_INTERNAL_ERROR);\n\t\tgoto err2;\n\t\t}\n\tmemcpy(mac_secret,ms,i);\n\tif (exp)\n\t\t{\n\t\tMD5_Init(&md);\n\t\tMD5_Update(&md,key,j);\n\t\tMD5_Update(&md,er1,SSL3_RANDOM_SIZE);\n\t\tMD5_Update(&md,er2,SSL3_RANDOM_SIZE);\n\t\tMD5_Final(&(exp_key[0]),&md);\n\t\tkey= &(exp_key[0]);\n\t\tif (k > 0)\n\t\t\t{\n\t\t\tMD5_Init(&md);\n\t\t\tMD5_Update(&md,er1,SSL3_RANDOM_SIZE);\n\t\t\tMD5_Update(&md,er2,SSL3_RANDOM_SIZE);\n\t\t\tMD5_Final(&(exp_iv[0]),&md);\n\t\t\tiv= &(exp_iv[0]);\n\t\t\t}\n\t\t}\n\ts->session->key_arg_length=0;\n\tEVP_CipherInit(dd,c,key,iv,(which & SSL3_CC_WRITE));\n\tmemset(&(exp_key[0]),0,sizeof(exp_key));\n\tmemset(&(exp_iv[0]),0,sizeof(exp_iv));\n\treturn(1);\nerr:\n\tSSLerr(SSL_F_SSL3_CHANGE_CIPHER_STATE,ERR_R_MALLOC_FAILURE);\nerr2:\n\treturn(0);\n\t}', 'void MD5_Init(MD5_CTX *c)\n\t{\n\tc->A=INIT_DATA_A;\n\tc->B=INIT_DATA_B;\n\tc->C=INIT_DATA_C;\n\tc->D=INIT_DATA_D;\n\tc->Nl=0;\n\tc->Nh=0;\n\tc->num=0;\n\t}', 'void MD5_Update(MD5_CTX *c, const void *_data, unsigned long len)\n\t{\n\tregister const unsigned char *data=_data;\n\tregister ULONG *p;\n\tint sw,sc;\n\tULONG l;\n\tif (len == 0) return;\n\tl=(c->Nl+(len<<3))&0xffffffffL;\n\tif (l < c->Nl)\n\t\tc->Nh++;\n\tc->Nh+=(len>>29);\n\tc->Nl=l;\n\tif (c->num != 0)\n\t\t{\n\t\tp=c->data;\n\t\tsw=c->num>>2;\n\t\tsc=c->num&0x03;\n\t\tif ((c->num+len) >= MD5_CBLOCK)\n\t\t\t{\n\t\t\tl= p[sw];\n\t\t\tp_c2l(data,l,sc);\n\t\t\tp[sw++]=l;\n\t\t\tfor (; sw<MD5_LBLOCK; sw++)\n\t\t\t\t{\n\t\t\t\tc2l(data,l);\n\t\t\t\tp[sw]=l;\n\t\t\t\t}\n\t\t\tlen-=(MD5_CBLOCK-c->num);\n\t\t\tmd5_block(c,p,64);\n\t\t\tc->num=0;\n\t\t\t}\n\t\telse\n\t\t\t{\n\t\t\tint ew,ec;\n\t\t\tc->num+=(int)len;\n\t\t\tif ((sc+len) < 4)\n\t\t\t\t{\n\t\t\t\tl= p[sw];\n\t\t\t\tp_c2l_p(data,l,sc,len);\n\t\t\t\tp[sw]=l;\n\t\t\t\t}\n\t\t\telse\n\t\t\t\t{\n\t\t\t\tew=(c->num>>2);\n\t\t\t\tec=(c->num&0x03);\n\t\t\t\tl= p[sw];\n\t\t\t\tp_c2l(data,l,sc);\n\t\t\t\tp[sw++]=l;\n\t\t\t\tfor (; sw < ew; sw++)\n\t\t\t\t\t{ c2l(data,l); p[sw]=l; }\n\t\t\t\tif (ec)\n\t\t\t\t\t{\n\t\t\t\t\tc2l_p(data,l,ec);\n\t\t\t\t\tp[sw]=l;\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\treturn;\n\t\t\t}\n\t\t}\n#ifdef L_ENDIAN\n\tif ((((unsigned long)data)%sizeof(ULONG)) == 0)\n\t\t{\n\t\tsw=(int)len/MD5_CBLOCK;\n\t\tif (sw > 0)\n\t\t\t{\n\t\t\tsw*=MD5_CBLOCK;\n\t\t\tmd5_block(c,(ULONG *)data,sw);\n\t\t\tdata+=sw;\n\t\t\tlen-=sw;\n\t\t\t}\n\t\t}\n#endif\n\tp=c->data;\n\twhile (len >= MD5_CBLOCK)\n\t\t{\n#if defined(L_ENDIAN) || defined(B_ENDIAN)\n\t\tif (p != (unsigned long *)data)\n\t\t\tmemcpy(p,data,MD5_CBLOCK);\n\t\tdata+=MD5_CBLOCK;\n#ifdef B_ENDIAN\n\t\tfor (sw=(MD5_LBLOCK/4); sw; sw--)\n\t\t\t{\n\t\t\tEndian_Reverse32(p[0]);\n\t\t\tEndian_Reverse32(p[1]);\n\t\t\tEndian_Reverse32(p[2]);\n\t\t\tEndian_Reverse32(p[3]);\n\t\t\tp+=4;\n\t\t\t}\n#endif\n#else\n\t\tfor (sw=(MD5_LBLOCK/4); sw; sw--)\n\t\t\t{\n\t\t\tc2l(data,l); *(p++)=l;\n\t\t\tc2l(data,l); *(p++)=l;\n\t\t\tc2l(data,l); *(p++)=l;\n\t\t\tc2l(data,l); *(p++)=l;\n\t\t\t}\n#endif\n\t\tp=c->data;\n\t\tmd5_block(c,p,64);\n\t\tlen-=MD5_CBLOCK;\n\t\t}\n\tsc=(int)len;\n\tc->num=sc;\n\tif (sc)\n\t\t{\n\t\tsw=sc>>2;\n#ifdef L_ENDIAN\n\t\tp[sw]=0;\n\t\tmemcpy(p,data,sc);\n#else\n\t\tsc&=0x03;\n\t\tfor ( ; sw; sw--)\n\t\t\t{ c2l(data,l); *(p++)=l; }\n\t\tc2l_p(data,l,sc);\n\t\t*p=l;\n#endif\n\t\t}\n\t}']