apps/ocsp.c:1342: error: INTEGER_OVERFLOW_L2
  ([0, 8] - 1):unsigned32 by call to `SSL_CTX_free`.
Showing all 13 steps of the trace


apps/ocsp.c:1319:9: Call
1317.   		BIO *sbio;
1318.   #if !defined(OPENSSL_NO_SSL2) && !defined(OPENSSL_NO_SSL3)
1319.   		ctx = SSL_CTX_new(SSLv23_client_method());
                ^
1320.   #elif !defined(OPENSSL_NO_SSL3)
1321.   		ctx = SSL_CTX_new(SSLv3_client_method());

ssl/ssl_lib.c:1518:16: Call
  1516.   	ret->app_verify_cookie_cb=0;
  1517.   
  1518.   	ret->sessions=lh_new(LHASH_HASH_FN(SSL_SESSION_hash),
                         ^
  1519.   			LHASH_COMP_FN(SSL_SESSION_cmp));
  1520.   	if (ret->sessions == NULL) goto err;

crypto/lhash/lhash.c:127:2: Assignment
    125.   	ret->comp=((c == NULL)?(LHASH_COMP_FN_TYPE)strcmp:c);
    126.   	ret->hash=((h == NULL)?(LHASH_HASH_FN_TYPE)lh_strhash:h);
    127.   	ret->num_nodes=MIN_NODES/2;
            ^
    128.   	ret->num_alloc_nodes=MIN_NODES;
    129.   	ret->p=0;

apps/ocsp.c:1342:3: Call
1340.   	end:
1341.   	if (ctx)
1342.   		SSL_CTX_free(ctx);
          ^
1343.   	if (cbio)
1344.   		BIO_free_all(cbio);

ssl/ssl_lib.c:1595:1: Parameter `a->sessions->num_nodes`
  1593.   #endif
  1594.   
  1595. > void SSL_CTX_free(SSL_CTX *a)
  1596.   	{
  1597.   	int i;

ssl/ssl_lib.c:1627:3: Call
  1625.   	 */
  1626.   	if (a->sessions != NULL)
  1627.   		SSL_CTX_flush_sessions(a,0);
            ^
  1628.   
  1629.   	CRYPTO_free_ex_data(CRYPTO_EX_INDEX_SSL_CTX, a, &a->ex_data);

ssl/ssl_sess.c:856:1: Parameter `s->sessions->num_nodes`
    854.   static IMPLEMENT_LHASH_DOALL_ARG_FN(timeout, SSL_SESSION *, TIMEOUT_PARAM *)
    855.   
    856. > void SSL_CTX_flush_sessions(SSL_CTX *s, long t)
    857.   	{
    858.   	unsigned long i;

ssl/ssl_sess.c:868:2: Call
    866.   	i=tp.cache->down_load;
    867.   	tp.cache->down_load=0;
    868.   	lh_doall_arg(tp.cache, LHASH_DOALL_ARG_FN(timeout), &tp);
            ^
    869.   	tp.cache->down_load=i;
    870.   	CRYPTO_w_unlock(CRYPTO_LOCK_SSL_CTX);

crypto/lhash/lhash.c:303:1: Parameter `lh->num_nodes`
      301.   	}
      302.   
      303. > void lh_doall_arg(LHASH *lh, LHASH_DOALL_ARG_FN_TYPE func, void *arg)
      304.   	{
      305.   	doall_util_fn(lh, 1, (LHASH_DOALL_FN_TYPE)0, func, arg);

crypto/lhash/lhash.c:305:2: Call
      303.   void lh_doall_arg(LHASH *lh, LHASH_DOALL_ARG_FN_TYPE func, void *arg)
      304.   	{
      305.   	doall_util_fn(lh, 1, (LHASH_DOALL_FN_TYPE)0, func, arg);
              ^
      306.   	}
      307.   

crypto/lhash/lhash.c:270:1: <LHS trace>
268.   	}
269.   
270. > static void doall_util_fn(LHASH *lh, int use_arg, LHASH_DOALL_FN_TYPE func,
271.   			  LHASH_DOALL_ARG_FN_TYPE func_arg, void *arg)
272.   	{

crypto/lhash/lhash.c:270:1: Parameter `lh->num_nodes`
        268.   	}
        269.   
        270. > static void doall_util_fn(LHASH *lh, int use_arg, LHASH_DOALL_FN_TYPE func,
        271.   			  LHASH_DOALL_ARG_FN_TYPE func_arg, void *arg)
        272.   	{

crypto/lhash/lhash.c:281:7: Binary operation: ([0, 8] - 1):unsigned32 by call to `SSL_CTX_free` 
        279.   	/* reverse the order so we search from 'top to bottom'
        280.   	 * We were having memory leaks otherwise */
        281.   	for (i=lh->num_nodes-1; i>=0; i--)
                     ^
        282.   		{
        283.   		a=lh->b[i];

static void doall_util_fn(LHASH *lh, int use_arg, LHASH_DOALL_FN_TYPE func,
			  LHASH_DOALL_ARG_FN_TYPE func_arg, void *arg)
	{
	int i;
	LHASH_NODE *a,*n;
	if (lh == NULL)
		return;
	for (i=lh->num_nodes-1; i>=0; i--)
		{
		a=lh->b[i];
		while (a != NULL)
			{
			n=a->next;
			if(use_arg)
				func_arg(a->data,arg);
			else
				func(a->data);
			a=n;
			}
		}
	}
['OCSP_RESPONSE *process_responder(BIO *err, OCSP_REQUEST *req,\n\t\t\tchar *host, char *path, char *port, int use_ssl,\n\t\t\tint req_timeout)\n\t{\n\tBIO *cbio = NULL;\n\tSSL_CTX *ctx = NULL;\n\tOCSP_RESPONSE *resp = NULL;\n\tcbio = BIO_new_connect(host);\n\tif (!cbio)\n\t\t{\n\t\tBIO_printf(err, "Error creating connect BIO\\n");\n\t\tgoto end;\n\t\t}\n\tif (port) BIO_set_conn_port(cbio, port);\n\tif (use_ssl == 1)\n\t\t{\n\t\tBIO *sbio;\n#if !defined(OPENSSL_NO_SSL2) && !defined(OPENSSL_NO_SSL3)\n\t\tctx = SSL_CTX_new(SSLv23_client_method());\n#elif !defined(OPENSSL_NO_SSL3)\n\t\tctx = SSL_CTX_new(SSLv3_client_method());\n#elif !defined(OPENSSL_NO_SSL2)\n\t\tctx = SSL_CTX_new(SSLv2_client_method());\n#else\n\t\tBIO_printf(err, "SSL is disabled\\n");\n\t\t\tgoto end;\n#endif\n\t\tif (ctx == NULL)\n\t\t\t{\n\t\t\tBIO_printf(err, "Error creating SSL context.\\n");\n\t\t\tgoto end;\n\t\t\t}\n\t\tSSL_CTX_set_mode(ctx, SSL_MODE_AUTO_RETRY);\n\t\tsbio = BIO_new_ssl(ctx, 1);\n\t\tcbio = BIO_push(sbio, cbio);\n\t\t}\n\tresp = query_responder(err, cbio, path, req, req_timeout);\n\tif (!resp)\n\t\tBIO_printf(bio_err, "Error querying OCSP responsder\\n");\n\tend:\n\tif (ctx)\n\t\tSSL_CTX_free(ctx);\n\tif (cbio)\n\t\tBIO_free_all(cbio);\n\treturn resp;\n\t}', 'SSL_CTX *SSL_CTX_new(const SSL_METHOD *meth)\n\t{\n\tSSL_CTX *ret=NULL;\n\tif (meth == NULL)\n\t\t{\n\t\tSSLerr(SSL_F_SSL_CTX_NEW,SSL_R_NULL_SSL_METHOD_PASSED);\n\t\treturn(NULL);\n\t\t}\n\tif (SSL_get_ex_data_X509_STORE_CTX_idx() < 0)\n\t\t{\n\t\tSSLerr(SSL_F_SSL_CTX_NEW,SSL_R_X509_VERIFICATION_SETUP_PROBLEMS);\n\t\tgoto err;\n\t\t}\n\tret=(SSL_CTX *)OPENSSL_malloc(sizeof(SSL_CTX));\n\tif (ret == NULL)\n\t\tgoto err;\n\tmemset(ret,0,sizeof(SSL_CTX));\n\tret->method=meth;\n\tret->cert_store=NULL;\n\tret->session_cache_mode=SSL_SESS_CACHE_SERVER;\n\tret->session_cache_size=SSL_SESSION_CACHE_MAX_SIZE_DEFAULT;\n\tret->session_cache_head=NULL;\n\tret->session_cache_tail=NULL;\n\tret->session_timeout=meth->get_timeout();\n\tret->new_session_cb=0;\n\tret->remove_session_cb=0;\n\tret->get_session_cb=0;\n\tret->generate_session_id=0;\n\tmemset((char *)&ret->stats,0,sizeof(ret->stats));\n\tret->references=1;\n\tret->quiet_shutdown=0;\n\tret->info_callback=NULL;\n\tret->app_verify_callback=0;\n\tret->app_verify_arg=NULL;\n\tret->max_cert_list=SSL_MAX_CERT_LIST_DEFAULT;\n\tret->read_ahead=0;\n\tret->msg_callback=0;\n\tret->msg_callback_arg=NULL;\n\tret->verify_mode=SSL_VERIFY_NONE;\n#if 0\n\tret->verify_depth=-1;\n#endif\n\tret->sid_ctx_length=0;\n\tret->default_verify_callback=NULL;\n\tif ((ret->cert=ssl_cert_new()) == NULL)\n\t\tgoto err;\n\tret->default_passwd_callback=0;\n\tret->default_passwd_callback_userdata=NULL;\n\tret->client_cert_cb=0;\n\tret->app_gen_cookie_cb=0;\n\tret->app_verify_cookie_cb=0;\n\tret->sessions=lh_new(LHASH_HASH_FN(SSL_SESSION_hash),\n\t\t\tLHASH_COMP_FN(SSL_SESSION_cmp));\n\tif (ret->sessions == NULL) goto err;\n\tret->cert_store=X509_STORE_new();\n\tif (ret->cert_store == NULL) goto err;\n\tssl_create_cipher_list(ret->method,\n\t\t&ret->cipher_list,&ret->cipher_list_by_id,\n\t\tSSL_DEFAULT_CIPHER_LIST);\n\tif (ret->cipher_list == NULL\n\t    || sk_SSL_CIPHER_num(ret->cipher_list) <= 0)\n\t\t{\n\t\tSSLerr(SSL_F_SSL_CTX_NEW,SSL_R_LIBRARY_HAS_NO_CIPHERS);\n\t\tgoto err2;\n\t\t}\n\tret->param = X509_VERIFY_PARAM_new();\n\tif (!ret->param)\n\t\tgoto err;\n\tif ((ret->rsa_md5=EVP_get_digestbyname("ssl2-md5")) == NULL)\n\t\t{\n\t\tSSLerr(SSL_F_SSL_CTX_NEW,SSL_R_UNABLE_TO_LOAD_SSL2_MD5_ROUTINES);\n\t\tgoto err2;\n\t\t}\n\tif ((ret->md5=EVP_get_digestbyname("ssl3-md5")) == NULL)\n\t\t{\n\t\tSSLerr(SSL_F_SSL_CTX_NEW,SSL_R_UNABLE_TO_LOAD_SSL3_MD5_ROUTINES);\n\t\tgoto err2;\n\t\t}\n\tif ((ret->sha1=EVP_get_digestbyname("ssl3-sha1")) == NULL)\n\t\t{\n\t\tSSLerr(SSL_F_SSL_CTX_NEW,SSL_R_UNABLE_TO_LOAD_SSL3_SHA1_ROUTINES);\n\t\tgoto err2;\n\t\t}\n\tif ((ret->client_CA=sk_X509_NAME_new_null()) == NULL)\n\t\tgoto err;\n\tCRYPTO_new_ex_data(CRYPTO_EX_INDEX_SSL_CTX, ret, &ret->ex_data);\n\tret->extra_certs=NULL;\n\tret->comp_methods=SSL_COMP_get_compression_methods();\n\tret->max_send_fragment = SSL3_RT_MAX_PLAIN_LENGTH;\n#ifndef OPENSSL_NO_TLSEXT\n\tret->tlsext_servername_callback = 0;\n\tret->tlsext_servername_arg = NULL;\n\tif ((RAND_pseudo_bytes(ret->tlsext_tick_key_name, 16) <= 0)\n\t\t|| (RAND_bytes(ret->tlsext_tick_hmac_key, 16) <= 0)\n\t\t|| (RAND_bytes(ret->tlsext_tick_aes_key, 16) <= 0))\n\t\tret->options |= SSL_OP_NO_TICKET;\n\tret->tlsext_status_cb = 0;\n\tret->tlsext_status_arg = NULL;\n#endif\n#ifndef OPENSSL_NO_PSK\n\tret->psk_identity_hint=NULL;\n\tret->psk_client_callback=NULL;\n\tret->psk_server_callback=NULL;\n#endif\n\treturn(ret);\nerr:\n\tSSLerr(SSL_F_SSL_CTX_NEW,ERR_R_MALLOC_FAILURE);\nerr2:\n\tif (ret != NULL) SSL_CTX_free(ret);\n\treturn(NULL);\n\t}', 'LHASH *lh_new(LHASH_HASH_FN_TYPE h, LHASH_COMP_FN_TYPE c)\n\t{\n\tLHASH *ret;\n\tint i;\n\tif ((ret=(LHASH *)OPENSSL_malloc(sizeof(LHASH))) == NULL)\n\t\tgoto err0;\n\tif ((ret->b=(LHASH_NODE **)OPENSSL_malloc(sizeof(LHASH_NODE *)*MIN_NODES)) == NULL)\n\t\tgoto err1;\n\tfor (i=0; i<MIN_NODES; i++)\n\t\tret->b[i]=NULL;\n\tret->comp=((c == NULL)?(LHASH_COMP_FN_TYPE)strcmp:c);\n\tret->hash=((h == NULL)?(LHASH_HASH_FN_TYPE)lh_strhash:h);\n\tret->num_nodes=MIN_NODES/2;\n\tret->num_alloc_nodes=MIN_NODES;\n\tret->p=0;\n\tret->pmax=MIN_NODES/2;\n\tret->up_load=UP_LOAD;\n\tret->down_load=DOWN_LOAD;\n\tret->num_items=0;\n\tret->num_expands=0;\n\tret->num_expand_reallocs=0;\n\tret->num_contracts=0;\n\tret->num_contract_reallocs=0;\n\tret->num_hash_calls=0;\n\tret->num_comp_calls=0;\n\tret->num_insert=0;\n\tret->num_replace=0;\n\tret->num_delete=0;\n\tret->num_no_delete=0;\n\tret->num_retrieve=0;\n\tret->num_retrieve_miss=0;\n\tret->num_hash_comps=0;\n\tret->error=0;\n\treturn(ret);\nerr1:\n\tOPENSSL_free(ret);\nerr0:\n\treturn(NULL);\n\t}', 'void SSL_CTX_free(SSL_CTX *a)\n\t{\n\tint i;\n\tif (a == NULL) return;\n\ti=CRYPTO_add(&a->references,-1,CRYPTO_LOCK_SSL_CTX);\n#ifdef REF_PRINT\n\tREF_PRINT("SSL_CTX",a);\n#endif\n\tif (i > 0) return;\n#ifdef REF_CHECK\n\tif (i < 0)\n\t\t{\n\t\tfprintf(stderr,"SSL_CTX_free, bad reference count\\n");\n\t\tabort();\n\t\t}\n#endif\n\tif (a->param)\n\t\tX509_VERIFY_PARAM_free(a->param);\n\tif (a->sessions != NULL)\n\t\tSSL_CTX_flush_sessions(a,0);\n\tCRYPTO_free_ex_data(CRYPTO_EX_INDEX_SSL_CTX, a, &a->ex_data);\n\tif (a->sessions != NULL)\n\t\tlh_free(a->sessions);\n\tif (a->cert_store != NULL)\n\t\tX509_STORE_free(a->cert_store);\n\tif (a->cipher_list != NULL)\n\t\tsk_SSL_CIPHER_free(a->cipher_list);\n\tif (a->cipher_list_by_id != NULL)\n\t\tsk_SSL_CIPHER_free(a->cipher_list_by_id);\n\tif (a->cert != NULL)\n\t\tssl_cert_free(a->cert);\n\tif (a->client_CA != NULL)\n\t\tsk_X509_NAME_pop_free(a->client_CA,X509_NAME_free);\n\tif (a->extra_certs != NULL)\n\t\tsk_X509_pop_free(a->extra_certs,X509_free);\n#if 0\n\tif (a->comp_methods != NULL)\n\t\tsk_SSL_COMP_pop_free(a->comp_methods,SSL_COMP_free);\n#else\n\ta->comp_methods = NULL;\n#endif\n#ifndef OPENSSL_NO_PSK\n\tif (a->psk_identity_hint)\n\t\tOPENSSL_free(a->psk_identity_hint);\n#endif\n\tOPENSSL_free(a);\n\t}', 'void SSL_CTX_flush_sessions(SSL_CTX *s, long t)\n\t{\n\tunsigned long i;\n\tTIMEOUT_PARAM tp;\n\ttp.ctx=s;\n\ttp.cache=s->sessions;\n\tif (tp.cache == NULL) return;\n\ttp.time=t;\n\tCRYPTO_w_lock(CRYPTO_LOCK_SSL_CTX);\n\ti=tp.cache->down_load;\n\ttp.cache->down_load=0;\n\tlh_doall_arg(tp.cache, LHASH_DOALL_ARG_FN(timeout), &tp);\n\ttp.cache->down_load=i;\n\tCRYPTO_w_unlock(CRYPTO_LOCK_SSL_CTX);\n\t}', 'void lh_doall_arg(LHASH *lh, LHASH_DOALL_ARG_FN_TYPE func, void *arg)\n\t{\n\tdoall_util_fn(lh, 1, (LHASH_DOALL_FN_TYPE)0, func, arg);\n\t}', 'static void doall_util_fn(LHASH *lh, int use_arg, LHASH_DOALL_FN_TYPE func,\n\t\t\t  LHASH_DOALL_ARG_FN_TYPE func_arg, void *arg)\n\t{\n\tint i;\n\tLHASH_NODE *a,*n;\n\tif (lh == NULL)\n\t\treturn;\n\tfor (i=lh->num_nodes-1; i>=0; i--)\n\t\t{\n\t\ta=lh->b[i];\n\t\twhile (a != NULL)\n\t\t\t{\n\t\t\tn=a->next;\n\t\t\tif(use_arg)\n\t\t\t\tfunc_arg(a->data,arg);\n\t\t\telse\n\t\t\t\tfunc(a->data);\n\t\t\ta=n;\n\t\t\t}\n\t\t}\n\t}']