crypto/objects/o_names.c:236: error: INTEGER_OVERFLOW_L2
  ([0, +oo] - 1):unsigned64 by call to `lh_OBJ_NAME_delete`.
Showing all 6 steps of the trace


crypto/objects/o_names.c:236:11: Call
234.       on.name = name;
235.       on.type = type;
236.       ret = lh_OBJ_NAME_delete(names_lh, &on);
                 ^
237.       if (ret != NULL) {
238.           /* free things */

crypto/objects/obj_lcl.h:12:1: Parameter `lh->num_items`
  10.   typedef struct name_funcs_st NAME_FUNCS;
  11.   DEFINE_STACK_OF(NAME_FUNCS)
  12. > DEFINE_LHASH_OF(OBJ_NAME);
  13.   typedef struct added_obj_st ADDED_OBJ;
  14.   DEFINE_LHASH_OF(ADDED_OBJ);

crypto/objects/obj_lcl.h:12:1: Call
  10.   typedef struct name_funcs_st NAME_FUNCS;
  11.   DEFINE_STACK_OF(NAME_FUNCS)
  12. > DEFINE_LHASH_OF(OBJ_NAME);
  13.   typedef struct added_obj_st ADDED_OBJ;
  14.   DEFINE_LHASH_OF(ADDED_OBJ);

crypto/lhash/lhash.c:103:1: <LHS trace>
101.   }
102.   
103. > void *OPENSSL_LH_delete(OPENSSL_LHASH *lh, const void *data)
104.   {
105.       unsigned long hash;

crypto/lhash/lhash.c:103:1: Parameter `lh->num_items`
    101.   }
    102.   
    103. > void *OPENSSL_LH_delete(OPENSSL_LHASH *lh, const void *data)
    104.   {
    105.       unsigned long hash;

crypto/lhash/lhash.c:123:5: Binary operation: ([0, +oo] - 1):unsigned64 by call to `lh_OBJ_NAME_delete` 
    121.       }
    122.   
    123.       lh->num_items--;
               ^
    124.       if ((lh->num_nodes > MIN_NODES) &&
    125.           (lh->down_load >= (lh->num_items * LH_LOAD_MULT / lh->num_nodes)))

void *OPENSSL_LH_delete(OPENSSL_LHASH *lh, const void *data)
{
    unsigned long hash;
    OPENSSL_LH_NODE *nn, **rn;
    void *ret;
    lh->error = 0;
    rn = getrn(lh, data, &hash);
    if (*rn == NULL) {
        lh->num_no_delete++;
        return (NULL);
    } else {
        nn = *rn;
        *rn = nn->next;
        ret = nn->data;
        OPENSSL_free(nn);
        lh->num_delete++;
    }
    lh->num_items--;
    if ((lh->num_nodes > MIN_NODES) &&
        (lh->down_load >= (lh->num_items * LH_LOAD_MULT / lh->num_nodes)))
        contract(lh);
    return (ret);
}
['int OBJ_NAME_remove(const char *name, int type)\n{\n    OBJ_NAME on, *ret;\n    if (names_lh == NULL)\n        return (0);\n    type &= ~OBJ_NAME_ALIAS;\n    on.name = name;\n    on.type = type;\n    ret = lh_OBJ_NAME_delete(names_lh, &on);\n    if (ret != NULL) {\n        if ((name_funcs_stack != NULL)\n            && (sk_NAME_FUNCS_num(name_funcs_stack) > ret->type)) {\n            sk_NAME_FUNCS_value(name_funcs_stack,\n                                ret->type)->free_func(ret->name, ret->type,\n                                                      ret->data);\n        }\n        OPENSSL_free(ret);\n        return (1);\n    } else\n        return (0);\n}', 'void *OPENSSL_LH_delete(OPENSSL_LHASH *lh, const void *data)\n{\n    unsigned long hash;\n    OPENSSL_LH_NODE *nn, **rn;\n    void *ret;\n    lh->error = 0;\n    rn = getrn(lh, data, &hash);\n    if (*rn == NULL) {\n        lh->num_no_delete++;\n        return (NULL);\n    } else {\n        nn = *rn;\n        *rn = nn->next;\n        ret = nn->data;\n        OPENSSL_free(nn);\n        lh->num_delete++;\n    }\n    lh->num_items--;\n    if ((lh->num_nodes > MIN_NODES) &&\n        (lh->down_load >= (lh->num_items * LH_LOAD_MULT / lh->num_nodes)))\n        contract(lh);\n    return (ret);\n}']