crypto/err/err.c:399: error: INTEGER_OVERFLOW_L1
  (0 - 1):unsigned64 by call to `lh_delete`.
Showing all 7 steps of the trace


crypto/err/err.c:397:12: Call
395.   
396.       CRYPTO_w_lock(CRYPTO_LOCK_ERR);
397.       hash = int_thread_get(0, 0);
                  ^
398.       if (hash) {
399.           p = lh_ERR_STATE_delete(hash, d);

crypto/err/err.c:326:27: Call
  324.       if (!int_thread_hash && create) {
  325.           CRYPTO_push_info("int_thread_get (err.c)");
  326.           int_thread_hash = lh_ERR_STATE_new();
                                   ^
  327.           CRYPTO_pop_info();
  328.       }

crypto/lhash/lhash.c:132:5: Assignment
    130.       ret->up_load = UP_LOAD;
    131.       ret->down_load = DOWN_LOAD;
    132.       ret->num_items = 0;
               ^
    133.   
    134.       ret->num_expands = 0;

crypto/err/err.c:399:13: Call
397.       hash = int_thread_get(0, 0);
398.       if (hash) {
399.           p = lh_ERR_STATE_delete(hash, d);
                   ^
400.           /* If there are no other references, and we just removed the
401.            * last item, delete the int_thread_hash */

crypto/lhash/lhash.c:209:1: <LHS trace>
207.   }
208.   
209. > void *lh_delete(_LHASH *lh, const void *data)
210.   {
211.       unsigned long hash;

crypto/lhash/lhash.c:209:1: Parameter `lh->num_items`
  207.   }
  208.   
  209. > void *lh_delete(_LHASH *lh, const void *data)
  210.   {
  211.       unsigned long hash;

crypto/lhash/lhash.c:229:5: Binary operation: (0 - 1):unsigned64 by call to `lh_delete` 
  227.       }
  228.   
  229.       lh->num_items--;
             ^
  230.       if ((lh->num_nodes > MIN_NODES) &&
  231.           (lh->down_load >= (lh->num_items * LH_LOAD_MULT / lh->num_nodes)))

void *lh_delete(_LHASH *lh, const void *data)
{
    unsigned long hash;
    LHASH_NODE *nn, **rn;
    void *ret;
    lh->error = 0;
    rn = getrn(lh, data, &hash);
    if (*rn == NULL) {
        lh->num_no_delete++;
        return (NULL);
    } else {
        nn = *rn;
        *rn = nn->next;
        ret = nn->data;
        OPENSSL_free(nn);
        lh->num_delete++;
    }
    lh->num_items--;
    if ((lh->num_nodes > MIN_NODES) &&
        (lh->down_load >= (lh->num_items * LH_LOAD_MULT / lh->num_nodes)))
        contract(lh);
    return (ret);
}
['static void int_thread_del_item(const ERR_STATE *d)\n{\n    ERR_STATE *p = NULL;\n    LHASH_OF(ERR_STATE) *hash;\n    CRYPTO_w_lock(CRYPTO_LOCK_ERR);\n    hash = int_thread_get(0, 0);\n    if (hash) {\n        p = lh_ERR_STATE_delete(hash, d);\n        if (int_thread_hash_references == 1\n            && int_thread_hash\n            && lh_ERR_STATE_num_items(int_thread_hash) == 0) {\n            lh_ERR_STATE_free(int_thread_hash);\n            int_thread_hash = NULL;\n        }\n    }\n    CRYPTO_w_unlock(CRYPTO_LOCK_ERR);\n    int_thread_release(&hash);\n    ERR_STATE_free(p);\n}', 'static LHASH_OF(ERR_STATE) *int_thread_get(int create, int lockit)\n{\n    LHASH_OF(ERR_STATE) *ret = NULL;\n    if (lockit)\n        CRYPTO_w_lock(CRYPTO_LOCK_ERR);\n    if (!int_thread_hash && create) {\n        CRYPTO_push_info("int_thread_get (err.c)");\n        int_thread_hash = lh_ERR_STATE_new();\n        CRYPTO_pop_info();\n    }\n    if (int_thread_hash) {\n        int_thread_hash_references++;\n        ret = int_thread_hash;\n    }\n    if (lockit)\n        CRYPTO_w_unlock(CRYPTO_LOCK_ERR);\n    return ret;\n}', '_LHASH *lh_new(LHASH_HASH_FN_TYPE h, LHASH_COMP_FN_TYPE c)\n{\n    _LHASH *ret;\n    int i;\n    if ((ret = OPENSSL_malloc(sizeof(*ret))) == NULL)\n        goto err0;\n    if ((ret->b = OPENSSL_malloc(sizeof(*ret->b) * MIN_NODES)) == NULL)\n        goto err1;\n    for (i = 0; i < MIN_NODES; i++)\n        ret->b[i] = NULL;\n    ret->comp = ((c == NULL) ? (LHASH_COMP_FN_TYPE)strcmp : c);\n    ret->hash = ((h == NULL) ? (LHASH_HASH_FN_TYPE)lh_strhash : h);\n    ret->num_nodes = MIN_NODES / 2;\n    ret->num_alloc_nodes = MIN_NODES;\n    ret->p = 0;\n    ret->pmax = MIN_NODES / 2;\n    ret->up_load = UP_LOAD;\n    ret->down_load = DOWN_LOAD;\n    ret->num_items = 0;\n    ret->num_expands = 0;\n    ret->num_expand_reallocs = 0;\n    ret->num_contracts = 0;\n    ret->num_contract_reallocs = 0;\n    ret->num_hash_calls = 0;\n    ret->num_comp_calls = 0;\n    ret->num_insert = 0;\n    ret->num_replace = 0;\n    ret->num_delete = 0;\n    ret->num_no_delete = 0;\n    ret->num_retrieve = 0;\n    ret->num_retrieve_miss = 0;\n    ret->num_hash_comps = 0;\n    ret->error = 0;\n    return (ret);\n err1:\n    OPENSSL_free(ret);\n err0:\n    return (NULL);\n}', 'void *lh_delete(_LHASH *lh, const void *data)\n{\n    unsigned long hash;\n    LHASH_NODE *nn, **rn;\n    void *ret;\n    lh->error = 0;\n    rn = getrn(lh, data, &hash);\n    if (*rn == NULL) {\n        lh->num_no_delete++;\n        return (NULL);\n    } else {\n        nn = *rn;\n        *rn = nn->next;\n        ret = nn->data;\n        OPENSSL_free(nn);\n        lh->num_delete++;\n    }\n    lh->num_items--;\n    if ((lh->num_nodes > MIN_NODES) &&\n        (lh->down_load >= (lh->num_items * LH_LOAD_MULT / lh->num_nodes)))\n        contract(lh);\n    return (ret);\n}']