ssl/record/rec_layer_s3.c:1043: error: INTEGER_OVERFLOW_L2
  ([0, max(0, `s->ctx->sessions->num_items`)] - 1):unsigned64 by call to `ssl3_get_record`.
Showing all 15 steps of the trace


ssl/record/rec_layer_s3.c:968:1: Parameter `s->ctx->sessions->num_items`
966.    *             none of our business
967.    */
968. > int ssl3_read_bytes(SSL *s, int type, int *recvd_type, unsigned char *buf,
969.                       int len, int peek)
970.   {

ssl/record/rec_layer_s3.c:1043:15: Call
1041.       if ((SSL3_RECORD_get_length(rr) == 0)
1042.               || (s->rlayer.rstate == SSL_ST_READ_BODY)) {
1043.           ret = ssl3_get_record(s);
                      ^
1044.           if (ret <= 0)
1045.               return (ret);

ssl/record/ssl3_record.c:186:1: Parameter `s->ctx->sessions->num_items`
  184.    */
  185.   /* used only by ssl3_read_bytes */
  186. > int ssl3_get_record(SSL *s)
  187.   {
  188.       int ssl_major, ssl_minor, al;

ssl/record/ssl3_record.c:507:5: Call
  505.   
  506.    f_err:
  507.       ssl3_send_alert(s, SSL3_AL_FATAL, al);
             ^
  508.    err:
  509.       return (ret);

ssl/s3_msg.c:166:1: Parameter `s->ctx->sessions->num_items`
    164.   }
    165.   
    166. > int ssl3_send_alert(SSL *s, int level, int desc)
    167.   {
    168.       /* Map tls/ssl alert value to correct one */

ssl/s3_msg.c:177:9: Call
    175.       /* If a fatal one, remove from cache */
    176.       if ((level == SSL3_AL_FATAL) && (s->session != NULL))
    177.           SSL_CTX_remove_session(s->ctx, s->session);
                   ^
    178.   
    179.       s->s3->alert_dispatch = 1;

ssl/ssl_sess.c:785:1: Parameter `ctx->sessions->num_items`
      783.   }
      784.   
      785. > int SSL_CTX_remove_session(SSL_CTX *ctx, SSL_SESSION *c)
      786.   {
      787.       return remove_session_lock(ctx, c, 1);

ssl/ssl_sess.c:787:12: Call
      785.   int SSL_CTX_remove_session(SSL_CTX *ctx, SSL_SESSION *c)
      786.   {
      787.       return remove_session_lock(ctx, c, 1);
                        ^
      788.   }
      789.   

ssl/ssl_sess.c:790:1: Parameter `ctx->sessions->num_items`
        788.   }
        789.   
        790. > static int remove_session_lock(SSL_CTX *ctx, SSL_SESSION *c, int lck)
        791.   {
        792.       SSL_SESSION *r;

ssl/ssl_sess.c:800:17: Call
        798.           if ((r = lh_SSL_SESSION_retrieve(ctx->sessions, c)) == c) {
        799.               ret = 1;
        800.               r = lh_SSL_SESSION_delete(ctx->sessions, c);
                               ^
        801.               SSL_SESSION_list_remove(ctx, c);
        802.           }

ssl/ssl_locl.h:694:1: Parameter `lh->num_items`
          692.   };
          693.   
          694. > DEFINE_LHASH_OF(SSL_SESSION);
          695.   
          696.   

ssl/ssl_locl.h:694:1: Call
          692.   };
          693.   
          694. > DEFINE_LHASH_OF(SSL_SESSION);
          695.   
          696.   

crypto/lhash/lhash.c:189:1: <LHS trace>
187.   }
188.   
189. > void *lh_delete(_LHASH *lh, const void *data)
190.   {
191.       unsigned long hash;

crypto/lhash/lhash.c:189:1: Parameter `lh->num_items`
            187.   }
            188.   
            189. > void *lh_delete(_LHASH *lh, const void *data)
            190.   {
            191.       unsigned long hash;

crypto/lhash/lhash.c:209:5: Binary operation: ([0, max(0, s->ctx->sessions->num_items)] - 1):unsigned64 by call to `ssl3_get_record` 
            207.       }
            208.   
            209.       lh->num_items--;
                       ^
            210.       if ((lh->num_nodes > MIN_NODES) &&
            211.           (lh->down_load >= (lh->num_items * LH_LOAD_MULT / lh->num_nodes)))

void *lh_delete(_LHASH *lh, const void *data)
{
    unsigned long hash;
    LHASH_NODE *nn, **rn;
    void *ret;
    lh->error = 0;
    rn = getrn(lh, data, &hash);
    if (*rn == NULL) {
        lh->num_no_delete++;
        return (NULL);
    } else {
        nn = *rn;
        *rn = nn->next;
        ret = nn->data;
        OPENSSL_free(nn);
        lh->num_delete++;
    }
    lh->num_items--;
    if ((lh->num_nodes > MIN_NODES) &&
        (lh->down_load >= (lh->num_items * LH_LOAD_MULT / lh->num_nodes)))
        contract(lh);
    return (ret);
}
['int ssl3_read_bytes(SSL *s, int type, int *recvd_type, unsigned char *buf,\n                    int len, int peek)\n{\n    int al, i, j, ret;\n    unsigned int n;\n    SSL3_RECORD *rr;\n    void (*cb) (const SSL *ssl, int type2, int val) = NULL;\n    if (!SSL3_BUFFER_is_initialised(&s->rlayer.rbuf)) {\n        if (!ssl3_setup_read_buffer(s))\n            return (-1);\n    }\n    if ((type && (type != SSL3_RT_APPLICATION_DATA)\n         && (type != SSL3_RT_HANDSHAKE)) || (peek\n                                             && (type !=\n                                                 SSL3_RT_APPLICATION_DATA))) {\n        SSLerr(SSL_F_SSL3_READ_BYTES, ERR_R_INTERNAL_ERROR);\n        return -1;\n    }\n    if ((type == SSL3_RT_HANDSHAKE) && (s->rlayer.handshake_fragment_len > 0))\n    {\n        unsigned char *src = s->rlayer.handshake_fragment;\n        unsigned char *dst = buf;\n        unsigned int k;\n        n = 0;\n        while ((len > 0) && (s->rlayer.handshake_fragment_len > 0)) {\n            *dst++ = *src++;\n            len--;\n            s->rlayer.handshake_fragment_len--;\n            n++;\n        }\n        for (k = 0; k < s->rlayer.handshake_fragment_len; k++)\n            s->rlayer.handshake_fragment[k] = *src++;\n        if (recvd_type != NULL)\n            *recvd_type = SSL3_RT_HANDSHAKE;\n        return n;\n    }\n    if (!ossl_statem_get_in_handshake(s) && SSL_in_init(s)) {\n        i = s->handshake_func(s);\n        if (i < 0)\n            return (i);\n        if (i == 0) {\n            SSLerr(SSL_F_SSL3_READ_BYTES, SSL_R_SSL_HANDSHAKE_FAILURE);\n            return (-1);\n        }\n    }\n start:\n    s->rwstate = SSL_NOTHING;\n    rr = &s->rlayer.rrec;\n    if ((SSL3_RECORD_get_length(rr) == 0)\n            || (s->rlayer.rstate == SSL_ST_READ_BODY)) {\n        ret = ssl3_get_record(s);\n        if (ret <= 0)\n            return (ret);\n    }\n    if (s->s3->change_cipher_spec\n        && (SSL3_RECORD_get_type(rr) != SSL3_RT_HANDSHAKE)) {\n        al = SSL_AD_UNEXPECTED_MESSAGE;\n        SSLerr(SSL_F_SSL3_READ_BYTES, SSL_R_DATA_BETWEEN_CCS_AND_FINISHED);\n        goto f_err;\n    }\n    if (s->shutdown & SSL_RECEIVED_SHUTDOWN) {\n        SSL3_RECORD_set_length(rr, 0);\n        s->rwstate = SSL_NOTHING;\n        return (0);\n    }\n    if (type == SSL3_RECORD_get_type(rr)\n            || (SSL3_RECORD_get_type(rr) == SSL3_RT_CHANGE_CIPHER_SPEC\n                && type == SSL3_RT_HANDSHAKE && recvd_type != NULL)) {\n        if (SSL_in_init(s) && (type == SSL3_RT_APPLICATION_DATA) &&\n            (s->enc_read_ctx == NULL)) {\n            al = SSL_AD_UNEXPECTED_MESSAGE;\n            SSLerr(SSL_F_SSL3_READ_BYTES, SSL_R_APP_DATA_IN_HANDSHAKE);\n            goto f_err;\n        }\n        if (type == SSL3_RT_HANDSHAKE\n                && SSL3_RECORD_get_type(rr) == SSL3_RT_CHANGE_CIPHER_SPEC\n                && s->rlayer.handshake_fragment_len > 0) {\n            al = SSL_AD_UNEXPECTED_MESSAGE;\n            SSLerr(SSL_F_SSL3_READ_BYTES, SSL_R_CCS_RECEIVED_EARLY);\n            goto f_err;\n        }\n        if (recvd_type != NULL)\n            *recvd_type = SSL3_RECORD_get_type(rr);\n        if (len <= 0)\n            return (len);\n        if ((unsigned int)len > SSL3_RECORD_get_length(rr))\n            n = SSL3_RECORD_get_length(rr);\n        else\n            n = (unsigned int)len;\n        memcpy(buf, &(rr->data[rr->off]), n);\n        if (!peek) {\n            SSL3_RECORD_add_length(rr, -n);\n            SSL3_RECORD_add_off(rr, n);\n            if (SSL3_RECORD_get_length(rr) == 0) {\n                s->rlayer.rstate = SSL_ST_READ_HEADER;\n                SSL3_RECORD_set_off(rr, 0);\n                if (s->mode & SSL_MODE_RELEASE_BUFFERS\n                    && SSL3_BUFFER_get_left(&s->rlayer.rbuf) == 0)\n                    ssl3_release_read_buffer(s);\n            }\n        }\n        return (n);\n    }\n    if (rr->type == SSL3_RT_HANDSHAKE && type == SSL3_RT_CHANGE_CIPHER_SPEC) {\n        al = SSL_AD_UNEXPECTED_MESSAGE;\n        SSLerr(SSL_F_SSL3_READ_BYTES, SSL_R_UNEXPECTED_MESSAGE);\n        goto f_err;\n    }\n    if (rr->rec_version == SSL2_VERSION) {\n        al = SSL_AD_INTERNAL_ERROR;\n        SSLerr(SSL_F_SSL3_READ_BYTES, ERR_R_INTERNAL_ERROR);\n        goto f_err;\n    }\n    if(s->method->version == TLS_ANY_VERSION\n            && (s->server || rr->type != SSL3_RT_ALERT)) {\n        s->version = rr->rec_version;\n        al = SSL_AD_UNEXPECTED_MESSAGE;\n        SSLerr(SSL_F_SSL3_READ_BYTES, SSL_R_UNEXPECTED_MESSAGE);\n        goto f_err;\n    }\n    {\n        unsigned int dest_maxlen = 0;\n        unsigned char *dest = NULL;\n        unsigned int *dest_len = NULL;\n        if (SSL3_RECORD_get_type(rr) == SSL3_RT_HANDSHAKE) {\n            dest_maxlen = sizeof s->rlayer.handshake_fragment;\n            dest = s->rlayer.handshake_fragment;\n            dest_len = &s->rlayer.handshake_fragment_len;\n        } else if (SSL3_RECORD_get_type(rr) == SSL3_RT_ALERT) {\n            dest_maxlen = sizeof s->rlayer.alert_fragment;\n            dest = s->rlayer.alert_fragment;\n            dest_len = &s->rlayer.alert_fragment_len;\n        }\n#ifndef OPENSSL_NO_HEARTBEATS\n        else if (SSL3_RECORD_get_type(rr)== TLS1_RT_HEARTBEAT) {\n            if (tls1_process_heartbeat(s, SSL3_RECORD_get_data(rr),\n                    SSL3_RECORD_get_length(rr)) < 0) {\n                return -1;\n            }\n            SSL3_RECORD_set_length(rr, 0);\n            s->rwstate = SSL_READING;\n            BIO_clear_retry_flags(SSL_get_rbio(s));\n            BIO_set_retry_read(SSL_get_rbio(s));\n            return (-1);\n        }\n#endif\n        if (dest_maxlen > 0) {\n            n = dest_maxlen - *dest_len;\n            if (SSL3_RECORD_get_length(rr) < n)\n                n = SSL3_RECORD_get_length(rr);\n            while (n-- > 0) {\n                dest[(*dest_len)++] =\n                    SSL3_RECORD_get_data(rr)[SSL3_RECORD_get_off(rr)];\n                SSL3_RECORD_add_off(rr, 1);\n                SSL3_RECORD_add_length(rr, -1);\n            }\n            if (*dest_len < dest_maxlen)\n                goto start;\n        }\n    }\n    if ((!s->server) &&\n        (s->rlayer.handshake_fragment_len >= 4) &&\n        (s->rlayer.handshake_fragment[0] == SSL3_MT_HELLO_REQUEST) &&\n        (s->session != NULL) && (s->session->cipher != NULL)) {\n        s->rlayer.handshake_fragment_len = 0;\n        if ((s->rlayer.handshake_fragment[1] != 0) ||\n            (s->rlayer.handshake_fragment[2] != 0) ||\n            (s->rlayer.handshake_fragment[3] != 0)) {\n            al = SSL_AD_DECODE_ERROR;\n            SSLerr(SSL_F_SSL3_READ_BYTES, SSL_R_BAD_HELLO_REQUEST);\n            goto f_err;\n        }\n        if (s->msg_callback)\n            s->msg_callback(0, s->version, SSL3_RT_HANDSHAKE,\n                            s->rlayer.handshake_fragment, 4, s,\n                            s->msg_callback_arg);\n        if (SSL_is_init_finished(s) &&\n            !(s->s3->flags & SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS) &&\n            !s->s3->renegotiate) {\n            ssl3_renegotiate(s);\n            if (ssl3_renegotiate_check(s)) {\n                i = s->handshake_func(s);\n                if (i < 0)\n                    return (i);\n                if (i == 0) {\n                    SSLerr(SSL_F_SSL3_READ_BYTES,\n                           SSL_R_SSL_HANDSHAKE_FAILURE);\n                    return (-1);\n                }\n                if (!(s->mode & SSL_MODE_AUTO_RETRY)) {\n                    if (SSL3_BUFFER_get_left(&s->rlayer.rbuf) == 0) {\n                        BIO *bio;\n                        s->rwstate = SSL_READING;\n                        bio = SSL_get_rbio(s);\n                        BIO_clear_retry_flags(bio);\n                        BIO_set_retry_read(bio);\n                        return (-1);\n                    }\n                }\n            }\n        }\n        goto start;\n    }\n    if (s->server &&\n        SSL_is_init_finished(s) &&\n        !s->s3->send_connection_binding &&\n        (s->version > SSL3_VERSION) &&\n        (s->rlayer.handshake_fragment_len >= 4) &&\n        (s->rlayer.handshake_fragment[0] == SSL3_MT_CLIENT_HELLO) &&\n        (s->session != NULL) && (s->session->cipher != NULL) &&\n        !(s->ctx->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION)) {\n        SSL3_RECORD_set_length(rr, 0);\n        ssl3_send_alert(s, SSL3_AL_WARNING, SSL_AD_NO_RENEGOTIATION);\n        goto start;\n    }\n    if (s->rlayer.alert_fragment_len >= 2) {\n        int alert_level = s->rlayer.alert_fragment[0];\n        int alert_descr = s->rlayer.alert_fragment[1];\n        s->rlayer.alert_fragment_len = 0;\n        if (s->msg_callback)\n            s->msg_callback(0, s->version, SSL3_RT_ALERT,\n                            s->rlayer.alert_fragment, 2, s,\n                            s->msg_callback_arg);\n        if (s->info_callback != NULL)\n            cb = s->info_callback;\n        else if (s->ctx->info_callback != NULL)\n            cb = s->ctx->info_callback;\n        if (cb != NULL) {\n            j = (alert_level << 8) | alert_descr;\n            cb(s, SSL_CB_READ_ALERT, j);\n        }\n        if (alert_level == SSL3_AL_WARNING) {\n            s->s3->warn_alert = alert_descr;\n            if (alert_descr == SSL_AD_CLOSE_NOTIFY) {\n                s->shutdown |= SSL_RECEIVED_SHUTDOWN;\n                return (0);\n            }\n            else if (alert_descr == SSL_AD_NO_RENEGOTIATION) {\n                al = SSL_AD_HANDSHAKE_FAILURE;\n                SSLerr(SSL_F_SSL3_READ_BYTES, SSL_R_NO_RENEGOTIATION);\n                goto f_err;\n            }\n#ifdef SSL_AD_MISSING_SRP_USERNAME\n            else if (alert_descr == SSL_AD_MISSING_SRP_USERNAME)\n                return (0);\n#endif\n        } else if (alert_level == SSL3_AL_FATAL) {\n            char tmp[16];\n            s->rwstate = SSL_NOTHING;\n            s->s3->fatal_alert = alert_descr;\n            SSLerr(SSL_F_SSL3_READ_BYTES, SSL_AD_REASON_OFFSET + alert_descr);\n            BIO_snprintf(tmp, sizeof tmp, "%d", alert_descr);\n            ERR_add_error_data(2, "SSL alert number ", tmp);\n            s->shutdown |= SSL_RECEIVED_SHUTDOWN;\n            SSL_CTX_remove_session(s->ctx, s->session);\n            return (0);\n        } else {\n            al = SSL_AD_ILLEGAL_PARAMETER;\n            SSLerr(SSL_F_SSL3_READ_BYTES, SSL_R_UNKNOWN_ALERT_TYPE);\n            goto f_err;\n        }\n        goto start;\n    }\n    if (s->shutdown & SSL_SENT_SHUTDOWN) {\n        s->rwstate = SSL_NOTHING;\n        SSL3_RECORD_set_length(rr, 0);\n        return (0);\n    }\n    if (SSL3_RECORD_get_type(rr) == SSL3_RT_CHANGE_CIPHER_SPEC) {\n        al = SSL_AD_UNEXPECTED_MESSAGE;\n        SSLerr(SSL_F_SSL3_READ_BYTES, SSL_R_CCS_RECEIVED_EARLY);\n        goto f_err;\n    }\n    if ((s->rlayer.handshake_fragment_len >= 4)\n            && !ossl_statem_get_in_handshake(s)) {\n        if (SSL_is_init_finished(s) &&\n            !(s->s3->flags & SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS)) {\n            ossl_statem_set_in_init(s, 1);\n            s->renegotiate = 1;\n            s->new_session = 1;\n        }\n        i = s->handshake_func(s);\n        if (i < 0)\n            return (i);\n        if (i == 0) {\n            SSLerr(SSL_F_SSL3_READ_BYTES, SSL_R_SSL_HANDSHAKE_FAILURE);\n            return (-1);\n        }\n        if (!(s->mode & SSL_MODE_AUTO_RETRY)) {\n            if (SSL3_BUFFER_get_left(&s->rlayer.rbuf) == 0) {\n                BIO *bio;\n                s->rwstate = SSL_READING;\n                bio = SSL_get_rbio(s);\n                BIO_clear_retry_flags(bio);\n                BIO_set_retry_read(bio);\n                return (-1);\n            }\n        }\n        goto start;\n    }\n    switch (SSL3_RECORD_get_type(rr)) {\n    default:\n        if (s->version >= TLS1_VERSION && s->version <= TLS1_1_VERSION) {\n            SSL3_RECORD_set_length(rr, 0);\n            goto start;\n        }\n        al = SSL_AD_UNEXPECTED_MESSAGE;\n        SSLerr(SSL_F_SSL3_READ_BYTES, SSL_R_UNEXPECTED_RECORD);\n        goto f_err;\n    case SSL3_RT_CHANGE_CIPHER_SPEC:\n    case SSL3_RT_ALERT:\n    case SSL3_RT_HANDSHAKE:\n        al = SSL_AD_UNEXPECTED_MESSAGE;\n        SSLerr(SSL_F_SSL3_READ_BYTES, ERR_R_INTERNAL_ERROR);\n        goto f_err;\n    case SSL3_RT_APPLICATION_DATA:\n        if (ossl_statem_app_data_allowed(s)) {\n            s->s3->in_read_app_data = 2;\n            return (-1);\n        } else {\n            al = SSL_AD_UNEXPECTED_MESSAGE;\n            SSLerr(SSL_F_SSL3_READ_BYTES, SSL_R_UNEXPECTED_RECORD);\n            goto f_err;\n        }\n    }\n f_err:\n    ssl3_send_alert(s, SSL3_AL_FATAL, al);\n    return (-1);\n}', 'int ssl3_get_record(SSL *s)\n{\n    int ssl_major, ssl_minor, al;\n    int enc_err, n, i, ret = -1;\n    SSL3_RECORD *rr;\n    SSL_SESSION *sess;\n    unsigned char *p;\n    unsigned char md[EVP_MAX_MD_SIZE];\n    short version;\n    unsigned mac_size;\n    unsigned empty_record_count = 0;\n    rr = RECORD_LAYER_get_rrec(&s->rlayer);\n    sess = s->session;\n again:\n    if ((RECORD_LAYER_get_rstate(&s->rlayer) != SSL_ST_READ_BODY) ||\n        (RECORD_LAYER_get_packet_length(&s->rlayer) < SSL3_RT_HEADER_LENGTH)) {\n        n = ssl3_read_n(s, SSL3_RT_HEADER_LENGTH,\n            SSL3_BUFFER_get_len(&s->rlayer.rbuf), 0);\n        if (n <= 0)\n            return (n);\n        RECORD_LAYER_set_rstate(&s->rlayer, SSL_ST_READ_BODY);\n        p = RECORD_LAYER_get_packet(&s->rlayer);\n        if (s->first_packet && s->server && !s->read_hash && !s->enc_read_ctx\n                && (p[0] & 0x80) && (p[2] == SSL2_MT_CLIENT_HELLO)) {\n            rr->type = SSL3_RT_HANDSHAKE;\n            rr->rec_version = SSL2_VERSION;\n            rr->length = ((p[0] & 0x7f) << 8) | p[1];\n            if (rr->length > SSL3_BUFFER_get_len(&s->rlayer.rbuf)\n                                    - SSL2_RT_HEADER_LENGTH) {\n                al = SSL_AD_RECORD_OVERFLOW;\n                SSLerr(SSL_F_SSL3_GET_RECORD, SSL_R_PACKET_LENGTH_TOO_LONG);\n                goto f_err;\n            }\n            if (rr->length < MIN_SSL2_RECORD_LEN) {\n                al = SSL_AD_HANDSHAKE_FAILURE;\n                SSLerr(SSL_F_SSL3_GET_RECORD, SSL_R_LENGTH_TOO_SHORT);\n                goto f_err;\n            }\n        } else {\n            if (s->msg_callback)\n                s->msg_callback(0, 0, SSL3_RT_HEADER, p, 5, s,\n                                s->msg_callback_arg);\n            rr->type = *(p++);\n            ssl_major = *(p++);\n            ssl_minor = *(p++);\n            version = (ssl_major << 8) | ssl_minor;\n            rr->rec_version = version;\n            n2s(p, rr->length);\n            if (!s->first_packet && version != s->version) {\n                SSLerr(SSL_F_SSL3_GET_RECORD, SSL_R_WRONG_VERSION_NUMBER);\n                if ((s->version & 0xFF00) == (version & 0xFF00)\n                    && !s->enc_write_ctx && !s->write_hash) {\n                    if (rr->type == SSL3_RT_ALERT) {\n                         goto err;\n                    }\n                    s->version = (unsigned short)version;\n                }\n                al = SSL_AD_PROTOCOL_VERSION;\n                goto f_err;\n            }\n            if ((version >> 8) != SSL3_VERSION_MAJOR) {\n                SSLerr(SSL_F_SSL3_GET_RECORD, SSL_R_WRONG_VERSION_NUMBER);\n                goto err;\n            }\n            if (rr->length >\n                    SSL3_BUFFER_get_len(&s->rlayer.rbuf)\n                    - SSL3_RT_HEADER_LENGTH) {\n                al = SSL_AD_RECORD_OVERFLOW;\n                SSLerr(SSL_F_SSL3_GET_RECORD, SSL_R_PACKET_LENGTH_TOO_LONG);\n                goto f_err;\n            }\n        }\n    }\n    if (rr->rec_version == SSL2_VERSION) {\n        i = rr->length + SSL2_RT_HEADER_LENGTH - SSL3_RT_HEADER_LENGTH;\n    } else {\n        i = rr->length;\n    }\n    if (i > 0) {\n        n = ssl3_read_n(s, i, i, 1);\n        if (n <= 0)\n            return (n);\n    }\n    RECORD_LAYER_set_rstate(&s->rlayer, SSL_ST_READ_HEADER);\n    if(rr->rec_version == SSL2_VERSION) {\n        rr->input = &(RECORD_LAYER_get_packet(&s->rlayer)[SSL2_RT_HEADER_LENGTH]);\n    } else {\n        rr->input = &(RECORD_LAYER_get_packet(&s->rlayer)[SSL3_RT_HEADER_LENGTH]);\n    }\n    if (rr->length > SSL3_RT_MAX_ENCRYPTED_LENGTH) {\n        al = SSL_AD_RECORD_OVERFLOW;\n        SSLerr(SSL_F_SSL3_GET_RECORD, SSL_R_ENCRYPTED_LENGTH_TOO_LONG);\n        goto f_err;\n    }\n    rr->data = rr->input;\n    rr->orig_len = rr->length;\n    if (SSL_USE_ETM(s) && s->read_hash) {\n        unsigned char *mac;\n        mac_size = EVP_MD_CTX_size(s->read_hash);\n        OPENSSL_assert(mac_size <= EVP_MAX_MD_SIZE);\n        if (rr->length < mac_size) {\n            al = SSL_AD_DECODE_ERROR;\n            SSLerr(SSL_F_SSL3_GET_RECORD, SSL_R_LENGTH_TOO_SHORT);\n            goto f_err;\n        }\n        rr->length -= mac_size;\n        mac = rr->data + rr->length;\n        i = s->method->ssl3_enc->mac(s, md, 0   );\n        if (i < 0 || CRYPTO_memcmp(md, mac, (size_t)mac_size) != 0) {\n            al = SSL_AD_BAD_RECORD_MAC;\n            SSLerr(SSL_F_SSL3_GET_RECORD,\n                   SSL_R_DECRYPTION_FAILED_OR_BAD_RECORD_MAC);\n            goto f_err;\n        }\n    }\n    enc_err = s->method->ssl3_enc->enc(s, 0);\n    if (enc_err == 0) {\n        al = SSL_AD_DECRYPTION_FAILED;\n        SSLerr(SSL_F_SSL3_GET_RECORD, SSL_R_BLOCK_CIPHER_PAD_IS_WRONG);\n        goto f_err;\n    }\n#ifdef TLS_DEBUG\n    printf("dec %d\\n", rr->length);\n    {\n        unsigned int z;\n        for (z = 0; z < rr->length; z++)\n            printf("%02X%c", rr->data[z], ((z + 1) % 16) ? \' \' : \'\\n\');\n    }\n    printf("\\n");\n#endif\n    if ((sess != NULL) &&\n        (s->enc_read_ctx != NULL) &&\n        (EVP_MD_CTX_md(s->read_hash) != NULL) && !SSL_USE_ETM(s)) {\n        unsigned char *mac = NULL;\n        unsigned char mac_tmp[EVP_MAX_MD_SIZE];\n        mac_size = EVP_MD_CTX_size(s->read_hash);\n        OPENSSL_assert(mac_size <= EVP_MAX_MD_SIZE);\n        if (rr->orig_len < mac_size ||\n            (EVP_CIPHER_CTX_mode(s->enc_read_ctx) == EVP_CIPH_CBC_MODE &&\n             rr->orig_len < mac_size + 1)) {\n            al = SSL_AD_DECODE_ERROR;\n            SSLerr(SSL_F_SSL3_GET_RECORD, SSL_R_LENGTH_TOO_SHORT);\n            goto f_err;\n        }\n        if (EVP_CIPHER_CTX_mode(s->enc_read_ctx) == EVP_CIPH_CBC_MODE) {\n            mac = mac_tmp;\n            ssl3_cbc_copy_mac(mac_tmp, rr, mac_size);\n            rr->length -= mac_size;\n        } else {\n            rr->length -= mac_size;\n            mac = &rr->data[rr->length];\n        }\n        i = s->method->ssl3_enc->mac(s, md, 0   );\n        if (i < 0 || mac == NULL\n            || CRYPTO_memcmp(md, mac, (size_t)mac_size) != 0)\n            enc_err = -1;\n        if (rr->length > SSL3_RT_MAX_COMPRESSED_LENGTH + mac_size)\n            enc_err = -1;\n    }\n    if (enc_err < 0) {\n        al = SSL_AD_BAD_RECORD_MAC;\n        SSLerr(SSL_F_SSL3_GET_RECORD,\n               SSL_R_DECRYPTION_FAILED_OR_BAD_RECORD_MAC);\n        goto f_err;\n    }\n    if (s->expand != NULL) {\n        if (rr->length > SSL3_RT_MAX_COMPRESSED_LENGTH) {\n            al = SSL_AD_RECORD_OVERFLOW;\n            SSLerr(SSL_F_SSL3_GET_RECORD, SSL_R_COMPRESSED_LENGTH_TOO_LONG);\n            goto f_err;\n        }\n        if (!ssl3_do_uncompress(s)) {\n            al = SSL_AD_DECOMPRESSION_FAILURE;\n            SSLerr(SSL_F_SSL3_GET_RECORD, SSL_R_BAD_DECOMPRESSION);\n            goto f_err;\n        }\n    }\n    if (rr->length > SSL3_RT_MAX_PLAIN_LENGTH) {\n        al = SSL_AD_RECORD_OVERFLOW;\n        SSLerr(SSL_F_SSL3_GET_RECORD, SSL_R_DATA_LENGTH_TOO_LONG);\n        goto f_err;\n    }\n    rr->off = 0;\n    RECORD_LAYER_reset_packet_length(&s->rlayer);\n    if (rr->length == 0) {\n        empty_record_count++;\n        if (empty_record_count > MAX_EMPTY_RECORDS) {\n            al = SSL_AD_UNEXPECTED_MESSAGE;\n            SSLerr(SSL_F_SSL3_GET_RECORD, SSL_R_RECORD_TOO_SMALL);\n            goto f_err;\n        }\n        goto again;\n    }\n    return (1);\n f_err:\n    ssl3_send_alert(s, SSL3_AL_FATAL, al);\n err:\n    return (ret);\n}', 'int ssl3_send_alert(SSL *s, int level, int desc)\n{\n    desc = s->method->ssl3_enc->alert_value(desc);\n    if (s->version == SSL3_VERSION && desc == SSL_AD_PROTOCOL_VERSION)\n        desc = SSL_AD_HANDSHAKE_FAILURE;\n    if (desc < 0)\n        return -1;\n    if ((level == SSL3_AL_FATAL) && (s->session != NULL))\n        SSL_CTX_remove_session(s->ctx, s->session);\n    s->s3->alert_dispatch = 1;\n    s->s3->send_alert[0] = level;\n    s->s3->send_alert[1] = desc;\n    if (!RECORD_LAYER_write_pending(&s->rlayer)) {\n        return s->method->ssl_dispatch_alert(s);\n    }\n    return -1;\n}', 'int SSL_CTX_remove_session(SSL_CTX *ctx, SSL_SESSION *c)\n{\n    return remove_session_lock(ctx, c, 1);\n}', 'static int remove_session_lock(SSL_CTX *ctx, SSL_SESSION *c, int lck)\n{\n    SSL_SESSION *r;\n    int ret = 0;\n    if ((c != NULL) && (c->session_id_length != 0)) {\n        if (lck)\n            CRYPTO_w_lock(CRYPTO_LOCK_SSL_CTX);\n        if ((r = lh_SSL_SESSION_retrieve(ctx->sessions, c)) == c) {\n            ret = 1;\n            r = lh_SSL_SESSION_delete(ctx->sessions, c);\n            SSL_SESSION_list_remove(ctx, c);\n        }\n        if (lck)\n            CRYPTO_w_unlock(CRYPTO_LOCK_SSL_CTX);\n        if (ret) {\n            r->not_resumable = 1;\n            if (ctx->remove_session_cb != NULL)\n                ctx->remove_session_cb(ctx, r);\n            SSL_SESSION_free(r);\n        }\n    } else\n        ret = 0;\n    return (ret);\n}', 'DEFINE_LHASH_OF(SSL_SESSION)', 'void *lh_delete(_LHASH *lh, const void *data)\n{\n    unsigned long hash;\n    LHASH_NODE *nn, **rn;\n    void *ret;\n    lh->error = 0;\n    rn = getrn(lh, data, &hash);\n    if (*rn == NULL) {\n        lh->num_no_delete++;\n        return (NULL);\n    } else {\n        nn = *rn;\n        *rn = nn->next;\n        ret = nn->data;\n        OPENSSL_free(nn);\n        lh->num_delete++;\n    }\n    lh->num_items--;\n    if ((lh->num_nodes > MIN_NODES) &&\n        (lh->down_load >= (lh->num_items * LH_LOAD_MULT / lh->num_nodes)))\n        contract(lh);\n    return (ret);\n}']