ssl/s23_clnt.c:217: error: INTEGER_OVERFLOW_L2
  ([0, max(0, `s->ctx->sessions->num_items`)] - 1):unsigned64 by call to `ssl23_client_hello`.
Showing all 13 steps of the trace


ssl/s23_clnt.c:145:1: Parameter `s->ctx->sessions->num_items`
143.   			ssl23_get_client_method)
144.   
145. > int ssl23_connect(SSL *s)
146.   	{
147.   	BUF_MEM *buf=NULL;

ssl/s23_clnt.c:217:8: Call
215.   
216.   			s->shutdown=0;
217.   			ret=ssl23_client_hello(s);
              ^
218.   			if (ret <= 0) goto end;
219.   			s->state=SSL23_ST_CR_SRVR_HELLO_A;

ssl/s23_clnt.c:297:1: Parameter `s->ctx->sessions->num_items`
  295.   	}
  296.   
  297. > static int ssl23_client_hello(SSL *s)
  298.   	{
  299.   	unsigned char *buf;

ssl/s23_clnt.c:561:5: Call
  559.   			if ((p = ssl_add_clienthello_tlsext(s, p, buf+SSL3_RT_MAX_PLAIN_LENGTH, &al)) == NULL)
  560.   				{
  561.   				ssl3_send_alert(s,SSL3_AL_FATAL,al);
             ^
  562.   				SSLerr(SSL_F_SSL23_CLIENT_HELLO,ERR_R_INTERNAL_ERROR);
  563.   				return -1;

ssl/s3_pkt.c:1788:1: Parameter `s->ctx->sessions->num_items`
    1786.   	}
    1787.   
    1788. > int ssl3_send_alert(SSL *s, int level, int desc)
    1789.   	{
    1790.   	/* Map tls/ssl alert value to correct one */

ssl/s3_pkt.c:1797:3: Call
    1795.   	/* If a fatal one, remove from cache */
    1796.   	if ((level == SSL3_AL_FATAL) && (s->session != NULL))
    1797.   		SSL_CTX_remove_session(s->ctx,s->session);
              ^
    1798.   
    1799.   	s->s3->alert_dispatch=1;

ssl/ssl_sess.c:677:1: Parameter `ctx->sessions->num_items`
      675.   	}
      676.   
      677. > int SSL_CTX_remove_session(SSL_CTX *ctx, SSL_SESSION *c)
      678.   {
      679.   	return remove_session_lock(ctx, c, 1);

ssl/ssl_sess.c:679:9: Call
      677.   int SSL_CTX_remove_session(SSL_CTX *ctx, SSL_SESSION *c)
      678.   {
      679.   	return remove_session_lock(ctx, c, 1);
                     ^
      680.   }
      681.   

ssl/ssl_sess.c:682:1: Parameter `ctx->sessions->num_items`
        680.   }
        681.   
        682. > static int remove_session_lock(SSL_CTX *ctx, SSL_SESSION *c, int lck)
        683.   	{
        684.   	SSL_SESSION *r;

ssl/ssl_sess.c:693:6: Call
        691.   			{
        692.   			ret=1;
        693.   			r=lh_SSL_SESSION_delete(ctx->sessions,c);
                    ^
        694.   			SSL_SESSION_list_remove(ctx,c);
        695.   			}

crypto/lhash/lhash.c:217:1: <LHS trace>
215.   	}
216.   
217. > void *lh_delete(_LHASH *lh, const void *data)
218.   	{
219.   	unsigned long hash;

crypto/lhash/lhash.c:217:1: Parameter `lh->num_items`
          215.   	}
          216.   
          217. > void *lh_delete(_LHASH *lh, const void *data)
          218.   	{
          219.   	unsigned long hash;

crypto/lhash/lhash.c:240:2: Binary operation: ([0, max(0, s->ctx->sessions->num_items)] - 1):unsigned64 by call to `ssl23_client_hello` 
          238.   		}
          239.   
          240.   	lh->num_items--;
                  ^
          241.   	if ((lh->num_nodes > MIN_NODES) &&
          242.   		(lh->down_load >= (lh->num_items*LH_LOAD_MULT/lh->num_nodes)))

void *lh_delete(_LHASH *lh, const void *data)
	{
	unsigned long hash;
	LHASH_NODE *nn,**rn;
	void *ret;
	lh->error=0;
	rn=getrn(lh,data,&hash);
	if (*rn == NULL)
		{
		lh->num_no_delete++;
		return(NULL);
		}
	else
		{
		nn= *rn;
		*rn=nn->next;
		ret=nn->data;
		OPENSSL_free(nn);
		lh->num_delete++;
		}
	lh->num_items--;
	if ((lh->num_nodes > MIN_NODES) &&
		(lh->down_load >= (lh->num_items*LH_LOAD_MULT/lh->num_nodes)))
		contract(lh);
	return(ret);
	}
['int ssl23_connect(SSL *s)\n\t{\n\tBUF_MEM *buf=NULL;\n\tunsigned long Time=(unsigned long)time(NULL);\n\tvoid (*cb)(const SSL *ssl,int type,int val)=NULL;\n\tint ret= -1;\n\tint new_state,state;\n\tRAND_add(&Time,sizeof(Time),0);\n\tERR_clear_error();\n\tclear_sys_error();\n\tif (s->info_callback != NULL)\n\t\tcb=s->info_callback;\n\telse if (s->ctx->info_callback != NULL)\n\t\tcb=s->ctx->info_callback;\n\ts->in_handshake++;\n\tif (!SSL_in_init(s) || SSL_in_before(s)) SSL_clear(s);\n\tfor (;;)\n\t\t{\n\t\tstate=s->state;\n\t\tswitch(s->state)\n\t\t\t{\n\t\tcase SSL_ST_BEFORE:\n\t\tcase SSL_ST_CONNECT:\n\t\tcase SSL_ST_BEFORE|SSL_ST_CONNECT:\n\t\tcase SSL_ST_OK|SSL_ST_CONNECT:\n\t\t\tif (s->session != NULL)\n\t\t\t\t{\n\t\t\t\tSSLerr(SSL_F_SSL23_CONNECT,SSL_R_SSL23_DOING_SESSION_ID_REUSE);\n\t\t\t\tret= -1;\n\t\t\t\tgoto end;\n\t\t\t\t}\n\t\t\ts->server=0;\n\t\t\tif (cb != NULL) cb(s,SSL_CB_HANDSHAKE_START,1);\n\t\t\ts->type=SSL_ST_CONNECT;\n\t\t\tif (s->init_buf == NULL)\n\t\t\t\t{\n\t\t\t\tif ((buf=BUF_MEM_new()) == NULL)\n\t\t\t\t\t{\n\t\t\t\t\tret= -1;\n\t\t\t\t\tgoto end;\n\t\t\t\t\t}\n\t\t\t\tif (!BUF_MEM_grow(buf,SSL3_RT_MAX_PLAIN_LENGTH))\n\t\t\t\t\t{\n\t\t\t\t\tret= -1;\n\t\t\t\t\tgoto end;\n\t\t\t\t\t}\n\t\t\t\ts->init_buf=buf;\n\t\t\t\tbuf=NULL;\n\t\t\t\t}\n\t\t\tif (!ssl3_setup_buffers(s)) { ret= -1; goto end; }\n\t\t\tssl3_init_finished_mac(s);\n\t\t\ts->state=SSL23_ST_CW_CLNT_HELLO_A;\n\t\t\ts->ctx->stats.sess_connect++;\n\t\t\ts->init_num=0;\n\t\t\tbreak;\n\t\tcase SSL23_ST_CW_CLNT_HELLO_A:\n\t\tcase SSL23_ST_CW_CLNT_HELLO_B:\n\t\t\ts->shutdown=0;\n\t\t\tret=ssl23_client_hello(s);\n\t\t\tif (ret <= 0) goto end;\n\t\t\ts->state=SSL23_ST_CR_SRVR_HELLO_A;\n\t\t\ts->init_num=0;\n\t\t\tbreak;\n\t\tcase SSL23_ST_CR_SRVR_HELLO_A:\n\t\tcase SSL23_ST_CR_SRVR_HELLO_B:\n\t\t\tret=ssl23_get_server_hello(s);\n\t\t\tif (ret >= 0) cb=NULL;\n\t\t\tgoto end;\n\t\tdefault:\n\t\t\tSSLerr(SSL_F_SSL23_CONNECT,SSL_R_UNKNOWN_STATE);\n\t\t\tret= -1;\n\t\t\tgoto end;\n\t\t\t}\n\t\tif (s->debug) { (void)BIO_flush(s->wbio); }\n\t\tif ((cb != NULL) && (s->state != state))\n\t\t\t{\n\t\t\tnew_state=s->state;\n\t\t\ts->state=state;\n\t\t\tcb(s,SSL_CB_CONNECT_LOOP,1);\n\t\t\ts->state=new_state;\n\t\t\t}\n\t\t}\nend:\n\ts->in_handshake--;\n\tif (buf != NULL)\n\t\tBUF_MEM_free(buf);\n\tif (cb != NULL)\n\t\tcb(s,SSL_CB_CONNECT_EXIT,ret);\n\treturn(ret);\n\t}', 'static int ssl23_client_hello(SSL *s)\n\t{\n\tunsigned char *buf;\n\tunsigned char *p,*d;\n\tint i,ch_len;\n\tunsigned long l;\n\tint ssl2_compat;\n\tint version = 0, version_major, version_minor;\n\tint al = 0;\n#ifndef OPENSSL_NO_COMP\n\tint j;\n\tSSL_COMP *comp;\n#endif\n\tint ret;\n\tunsigned long mask, options = s->options;\n\tssl2_compat = (options & SSL_OP_NO_SSLv2) ? 0 : 1;\n\tif (ssl2_compat && !ssl_security(s, SSL_SECOP_SSL2_COMPAT, 0, 0, NULL))\n\t\tssl2_compat = 0;\n\tif (ssl2_compat && ssl23_no_ssl2_ciphers(s))\n\t\tssl2_compat = 0;\n\tmask =\tSSL_OP_NO_TLSv1_1|SSL_OP_NO_TLSv1\n#if !defined(OPENSSL_NO_SSL3)\n\t\t|SSL_OP_NO_SSLv3\n#endif\n#if !defined(OPENSSL_NO_SSL2)\n\t\t|(ssl2_compat?SSL_OP_NO_SSLv2:0)\n#endif\n\t\t;\n#if !defined(OPENSSL_NO_TLS1_2_CLIENT)\n\tversion = TLS1_2_VERSION;\n\tif ((options & SSL_OP_NO_TLSv1_2) && (options & mask) != mask)\n\t\tversion = TLS1_1_VERSION;\n#else\n\tversion = TLS1_1_VERSION;\n#endif\n\tmask &= ~SSL_OP_NO_TLSv1_1;\n\tif ((options & SSL_OP_NO_TLSv1_1) && (options & mask) != mask)\n\t\tversion = TLS1_VERSION;\n\tmask &= ~SSL_OP_NO_TLSv1;\n#if !defined(OPENSSL_NO_SSL3)\n\tif ((options & SSL_OP_NO_TLSv1) && (options & mask) != mask)\n\t\tversion = SSL3_VERSION;\n\tmask &= ~SSL_OP_NO_SSLv3;\n#endif\n#if !defined(OPENSSL_NO_SSL2)\n\tif ((options & SSL_OP_NO_SSLv3) && (options & mask) != mask)\n\t\tversion = SSL2_VERSION;\n#endif\n#ifndef OPENSSL_NO_TLSEXT\n\tif (version != SSL2_VERSION)\n\t\t{\n\t\tif (s->tlsext_hostname != NULL)\n\t\t\tssl2_compat = 0;\n\t\tif (s->tlsext_status_type != -1)\n\t\t\tssl2_compat = 0;\n#ifdef TLSEXT_TYPE_opaque_prf_input\n\t\tif (s->ctx->tlsext_opaque_prf_input_callback != 0 || s->tlsext_opaque_prf_input != NULL)\n\t\t\tssl2_compat = 0;\n#endif\n\t\tif (s->ctx->custom_cli_ext_records_count != 0)\n\t\t\tssl2_compat = 0;\n\t\t}\n#endif\n\tbuf=(unsigned char *)s->init_buf->data;\n\tif (s->state == SSL23_ST_CW_CLNT_HELLO_A)\n\t\t{\n#if 0\n\t\tif (!ssl_get_new_session(s,0))\n\t\t\t{\n\t\t\treturn(-1);\n\t\t\t}\n#endif\n\t\tp=s->s3->client_random;\n\t\tif (ssl_fill_hello_random(s, 0, p, SSL3_RANDOM_SIZE) <= 0)\n\t\t\treturn -1;\n\t\tif (version == TLS1_2_VERSION)\n\t\t\t{\n\t\t\tversion_major = TLS1_2_VERSION_MAJOR;\n\t\t\tversion_minor = TLS1_2_VERSION_MINOR;\n\t\t\t}\n\t\telse if (tls1_suiteb(s))\n\t\t\t{\n\t\t\tSSLerr(SSL_F_SSL23_CLIENT_HELLO,\n\t\t\t\t\tSSL_R_ONLY_TLS_1_2_ALLOWED_IN_SUITEB_MODE);\n\t\t\treturn -1;\n\t\t\t}\n\t\telse if (version == TLS1_1_VERSION)\n\t\t\t{\n\t\t\tversion_major = TLS1_1_VERSION_MAJOR;\n\t\t\tversion_minor = TLS1_1_VERSION_MINOR;\n\t\t\t}\n\t\telse if (version == TLS1_VERSION)\n\t\t\t{\n\t\t\tversion_major = TLS1_VERSION_MAJOR;\n\t\t\tversion_minor = TLS1_VERSION_MINOR;\n\t\t\t}\n#ifdef OPENSSL_FIPS\n\t\telse if(FIPS_mode())\n\t\t\t{\n\t\t\tSSLerr(SSL_F_SSL23_CLIENT_HELLO,\n\t\t\t\t\tSSL_R_ONLY_TLS_ALLOWED_IN_FIPS_MODE);\n\t\t\treturn -1;\n\t\t\t}\n#endif\n\t\telse if (version == SSL3_VERSION)\n\t\t\t{\n\t\t\tversion_major = SSL3_VERSION_MAJOR;\n\t\t\tversion_minor = SSL3_VERSION_MINOR;\n\t\t\t}\n\t\telse if (version == SSL2_VERSION)\n\t\t\t{\n\t\t\tversion_major = SSL2_VERSION_MAJOR;\n\t\t\tversion_minor = SSL2_VERSION_MINOR;\n\t\t\t}\n\t\telse\n\t\t\t{\n\t\t\tSSLerr(SSL_F_SSL23_CLIENT_HELLO,SSL_R_NO_PROTOCOLS_AVAILABLE);\n\t\t\treturn(-1);\n\t\t\t}\n\t\ts->client_version = version;\n\t\tif (ssl2_compat)\n\t\t\t{\n\t\t\td = &(buf[2]);\n\t\t\tp = d + 9;\n\t\t\t*(d++) = SSL2_MT_CLIENT_HELLO;\n\t\t\t*(d++) = version_major;\n\t\t\t*(d++) = version_minor;\n\t\t\ti=ssl_cipher_list_to_bytes(s,SSL_get_ciphers(s),p,0);\n\t\t\tif (i == 0)\n\t\t\t\t{\n\t\t\t\tSSLerr(SSL_F_SSL23_CLIENT_HELLO,SSL_R_NO_CIPHERS_AVAILABLE);\n\t\t\t\treturn -1;\n\t\t\t\t}\n\t\t\ts2n(i,d);\n\t\t\tp+=i;\n#if 0\n\t\t\ts->session->session_id_length=0;\n#endif\n\t\t\ts2n(0,d);\n\t\t\tif (s->options & SSL_OP_NETSCAPE_CHALLENGE_BUG)\n\t\t\t\tch_len=SSL2_CHALLENGE_LENGTH;\n\t\t\telse\n\t\t\t\tch_len=SSL2_MAX_CHALLENGE_LENGTH;\n\t\t\tif (SSL3_RANDOM_SIZE < ch_len)\n\t\t\t\ti=SSL3_RANDOM_SIZE;\n\t\t\telse\n\t\t\t\ti=ch_len;\n\t\t\ts2n(i,d);\n\t\t\tmemset(&(s->s3->client_random[0]),0,SSL3_RANDOM_SIZE);\n\t\t\tif (RAND_pseudo_bytes(&(s->s3->client_random[SSL3_RANDOM_SIZE-i]),i) <= 0)\n\t\t\t\treturn -1;\n\t\t\tmemcpy(p,&(s->s3->client_random[SSL3_RANDOM_SIZE-i]),i);\n\t\t\tp+=i;\n\t\t\ti= p- &(buf[2]);\n\t\t\tbuf[0]=((i>>8)&0xff)|0x80;\n\t\t\tbuf[1]=(i&0xff);\n\t\t\ts->init_num=i+2;\n\t\t\ts->init_off=0;\n\t\t\tssl3_finish_mac(s,&(buf[2]),i);\n\t\t\t}\n\t\telse\n\t\t\t{\n\t\t\td = p = &(buf[9]);\n\t\t\t*(p++) = version_major;\n\t\t\t*(p++) = version_minor;\n\t\t\tmemcpy(p, s->s3->client_random, SSL3_RANDOM_SIZE);\n\t\t\tp += SSL3_RANDOM_SIZE;\n\t\t\t*(p++) = 0;\n\t\t\ti=ssl_cipher_list_to_bytes(s,SSL_get_ciphers(s),&(p[2]),ssl3_put_cipher_by_char);\n\t\t\tif (i == 0)\n\t\t\t\t{\n\t\t\t\tSSLerr(SSL_F_SSL23_CLIENT_HELLO,SSL_R_NO_CIPHERS_AVAILABLE);\n\t\t\t\treturn -1;\n\t\t\t\t}\n#ifdef OPENSSL_MAX_TLS1_2_CIPHER_LENGTH\n\t\t\tif (TLS1_get_version(s) >= TLS1_2_VERSION\n\t\t\t\t&& i > OPENSSL_MAX_TLS1_2_CIPHER_LENGTH)\n\t\t\t\ti = OPENSSL_MAX_TLS1_2_CIPHER_LENGTH & ~1;\n#endif\n\t\t\ts2n(i,p);\n\t\t\tp+=i;\n#ifdef OPENSSL_NO_COMP\n\t\t\t*(p++)=1;\n#else\n\t\t\tif (!ssl_allow_compression(s) || !s->ctx->comp_methods)\n\t\t\t\tj=0;\n\t\t\telse\n\t\t\t\tj=sk_SSL_COMP_num(s->ctx->comp_methods);\n\t\t\t*(p++)=1+j;\n\t\t\tfor (i=0; i<j; i++)\n\t\t\t\t{\n\t\t\t\tcomp=sk_SSL_COMP_value(s->ctx->comp_methods,i);\n\t\t\t\t*(p++)=comp->id;\n\t\t\t\t}\n#endif\n\t\t\t*(p++)=0;\n#ifndef OPENSSL_NO_TLSEXT\n\t\t\tif (ssl_prepare_clienthello_tlsext(s) <= 0)\n\t\t\t\t{\n\t\t\t\tSSLerr(SSL_F_SSL23_CLIENT_HELLO,SSL_R_CLIENTHELLO_TLSEXT);\n\t\t\t\treturn -1;\n\t\t\t\t}\n\t\t\tif ((p = ssl_add_clienthello_tlsext(s, p, buf+SSL3_RT_MAX_PLAIN_LENGTH, &al)) == NULL)\n\t\t\t\t{\n\t\t\t\tssl3_send_alert(s,SSL3_AL_FATAL,al);\n\t\t\t\tSSLerr(SSL_F_SSL23_CLIENT_HELLO,ERR_R_INTERNAL_ERROR);\n\t\t\t\treturn -1;\n\t\t\t\t}\n#endif\n\t\t\tl = p-d;\n\t\t\td=&(buf[5]);\n\t\t\t*(d++)=SSL3_MT_CLIENT_HELLO;\n\t\t\tl2n3(l,d);\n\t\t\tl += 4;\n\t\t\tif (l > SSL3_RT_MAX_PLAIN_LENGTH)\n\t\t\t\t{\n\t\t\t\tSSLerr(SSL_F_SSL23_CLIENT_HELLO,ERR_R_INTERNAL_ERROR);\n\t\t\t\treturn -1;\n\t\t\t\t}\n\t\t\td=buf;\n\t\t\t*(d++) = SSL3_RT_HANDSHAKE;\n\t\t\t*(d++) = version_major;\n\t\t\tif (TLS1_get_client_version(s) > TLS1_VERSION)\n\t\t\t\t*(d++) = 1;\n\t\t\telse\n\t\t\t\t*(d++) = version_minor;\n\t\t\ts2n((int)l,d);\n\t\t\ts->init_num=p-buf;\n\t\t\ts->init_off=0;\n\t\t\tssl3_finish_mac(s,&(buf[5]), s->init_num - 5);\n\t\t\t}\n\t\ts->state=SSL23_ST_CW_CLNT_HELLO_B;\n\t\ts->init_off=0;\n\t\t}\n\tret = ssl23_write_bytes(s);\n\tif ((ret >= 2) && s->msg_callback)\n\t\t{\n\t\tif (ssl2_compat)\n\t\t\ts->msg_callback(1, SSL2_VERSION, 0, s->init_buf->data+2, ret-2, s, s->msg_callback_arg);\n\t\telse\n\t\t\t{\n\t\t\ts->msg_callback(1, version, SSL3_RT_HEADER, s->init_buf->data, 5, s, s->msg_callback_arg);\n\t\t\ts->msg_callback(1, version, SSL3_RT_HANDSHAKE, s->init_buf->data+5, ret-5, s, s->msg_callback_arg);\n\t\t\t}\n\t\t}\n\treturn ret;\n\t}', 'int ssl3_send_alert(SSL *s, int level, int desc)\n\t{\n\tdesc=s->method->ssl3_enc->alert_value(desc);\n\tif (s->version == SSL3_VERSION && desc == SSL_AD_PROTOCOL_VERSION)\n\t\tdesc = SSL_AD_HANDSHAKE_FAILURE;\n\tif (desc < 0) return -1;\n\tif ((level == SSL3_AL_FATAL) && (s->session != NULL))\n\t\tSSL_CTX_remove_session(s->ctx,s->session);\n\ts->s3->alert_dispatch=1;\n\ts->s3->send_alert[0]=level;\n\ts->s3->send_alert[1]=desc;\n\tif (s->s3->wbuf.left == 0)\n\t\treturn s->method->ssl_dispatch_alert(s);\n\treturn -1;\n\t}', 'int SSL_CTX_remove_session(SSL_CTX *ctx, SSL_SESSION *c)\n{\n\treturn remove_session_lock(ctx, c, 1);\n}', 'static int remove_session_lock(SSL_CTX *ctx, SSL_SESSION *c, int lck)\n\t{\n\tSSL_SESSION *r;\n\tint ret=0;\n\tif ((c != NULL) && (c->session_id_length != 0))\n\t\t{\n\t\tif(lck) CRYPTO_w_lock(CRYPTO_LOCK_SSL_CTX);\n\t\tif ((r = lh_SSL_SESSION_retrieve(ctx->sessions,c)) == c)\n\t\t\t{\n\t\t\tret=1;\n\t\t\tr=lh_SSL_SESSION_delete(ctx->sessions,c);\n\t\t\tSSL_SESSION_list_remove(ctx,c);\n\t\t\t}\n\t\tif(lck) CRYPTO_w_unlock(CRYPTO_LOCK_SSL_CTX);\n\t\tif (ret)\n\t\t\t{\n\t\t\tr->not_resumable=1;\n\t\t\tif (ctx->remove_session_cb != NULL)\n\t\t\t\tctx->remove_session_cb(ctx,r);\n\t\t\tSSL_SESSION_free(r);\n\t\t\t}\n\t\t}\n\telse\n\t\tret=0;\n\treturn(ret);\n\t}', 'void *lh_delete(_LHASH *lh, const void *data)\n\t{\n\tunsigned long hash;\n\tLHASH_NODE *nn,**rn;\n\tvoid *ret;\n\tlh->error=0;\n\trn=getrn(lh,data,&hash);\n\tif (*rn == NULL)\n\t\t{\n\t\tlh->num_no_delete++;\n\t\treturn(NULL);\n\t\t}\n\telse\n\t\t{\n\t\tnn= *rn;\n\t\t*rn=nn->next;\n\t\tret=nn->data;\n\t\tOPENSSL_free(nn);\n\t\tlh->num_delete++;\n\t\t}\n\tlh->num_items--;\n\tif ((lh->num_nodes > MIN_NODES) &&\n\t\t(lh->down_load >= (lh->num_items*LH_LOAD_MULT/lh->num_nodes)))\n\t\tcontract(lh);\n\treturn(ret);\n\t}']