apps/s_time.c:507: error: INTEGER_OVERFLOW_L2
  ([0, +oo] - 1):unsigned32 by call to `SSL_free`.
Showing all 16 steps of the trace


apps/s_time.c:471:15: Call
469.   #endif
470.   
471.   		if( (scon = doConnection( NULL )) == NULL )
                     ^
472.   			goto end;
473.   

apps/s_time.c:625:1: Parameter `scon->ctx->sessions->p`
  623.    *		SSL *	= the connection pointer.
  624.    */
  625. > static SSL *doConnection(SSL *scon)
  626.   	{
  627.   	BIO *conn;

apps/s_time.c:507:3: Call
505.   		fflush(stdout);
506.   
507.   		SSL_free( scon );
         ^
508.   		scon=NULL;
509.   		}

ssl/ssl_lib.c:308:1: Parameter `s->ctx->sessions->p`
  306.   }
  307.   
  308. > void SSL_free(SSL *s)
  309.   	{
  310.   	int i;

ssl/ssl_lib.c:354:3: Call
  352.   	if (s->session != NULL)
  353.   		{
  354.   		ssl_clear_bad_session(s);
           ^
  355.   		SSL_SESSION_free(s->session);
  356.   		}

ssl/ssl_sess.c:595:1: Parameter `s->ctx->sessions->p`
    593.   	}
    594.   
    595. > int ssl_clear_bad_session(SSL *s)
    596.   	{
    597.   	if (	(s->session != NULL) &&

ssl/ssl_sess.c:601:3: Call
    599.   		!(SSL_in_init(s) || SSL_in_before(s)))
    600.   		{
    601.   		SSL_CTX_remove_session(s->ctx,s->session);
             ^
    602.   		return(1);
    603.   		}

ssl/ssl_sess.c:395:1: Parameter `ctx->sessions->p`
      393.   	}
      394.   
      395. > int SSL_CTX_remove_session(SSL_CTX *ctx, SSL_SESSION *c)
      396.   {
      397.   	return remove_session_lock(ctx, c, 1);

ssl/ssl_sess.c:397:9: Call
      395.   int SSL_CTX_remove_session(SSL_CTX *ctx, SSL_SESSION *c)
      396.   {
      397.   	return remove_session_lock(ctx, c, 1);
                     ^
      398.   }
      399.   

ssl/ssl_sess.c:400:1: Parameter `ctx->sessions->p`
        398.   }
        399.   
        400. > static int remove_session_lock(SSL_CTX *ctx, SSL_SESSION *c, int lck)
        401.   	{
        402.   	SSL_SESSION *r;

ssl/ssl_sess.c:408:20: Call
        406.   		{
        407.   		if(lck) CRYPTO_w_lock(CRYPTO_LOCK_SSL_CTX);
        408.   		r=(SSL_SESSION *)lh_delete(ctx->sessions,(char *)c);
                                  ^
        409.   		if (r != NULL)
        410.   			{

crypto/lhash/lhash.c:220:1: Parameter `lh->pmax`
          218.   	}
          219.   
          220. > char *lh_delete(LHASH *lh, char *data)
          221.   	{
          222.   	unsigned long hash;

crypto/lhash/lhash.c:246:3: Call
          244.   	if ((lh->num_nodes > MIN_NODES) &&
          245.   		(lh->down_load >= (lh->num_items*LH_LOAD_MULT/lh->num_nodes)))
          246.   		contract(lh);
                   ^
          247.   
          248.   	return(ret);

crypto/lhash/lhash.c:355:1: <LHS trace>
353.   	}
354.   
355. > static void contract(LHASH *lh)
356.   	{
357.   	LHASH_NODE **n,*n1,*np;

crypto/lhash/lhash.c:355:1: Parameter `lh->p`
            353.   	}
            354.   
            355. > static void contract(LHASH *lh)
            356.   	{
            357.   	LHASH_NODE **n,*n1,*np;

crypto/lhash/lhash.c:359:5: Binary operation: ([0, +oo] - 1):unsigned32 by call to `SSL_free` 
            357.   	LHASH_NODE **n,*n1,*np;
            358.   
            359.   	np=lh->b[lh->p+lh->pmax-1];
                       ^
            360.   	lh->b[lh->p+lh->pmax-1]=NULL; /* 24/07-92 - eay - weird but :-( */
            361.   	if (lh->p == 0)

static void contract(LHASH *lh)
	{
	LHASH_NODE **n,*n1,*np;
	np=lh->b[lh->p+lh->pmax-1];
	lh->b[lh->p+lh->pmax-1]=NULL;
	if (lh->p == 0)
		{
		n=(LHASH_NODE **)Realloc((char *)lh->b,
			(unsigned int)(sizeof(LHASH_NODE *)*lh->pmax));
		if (n == NULL)
			{
			lh->error++;
			return;
			}
		lh->num_contract_reallocs++;
		lh->num_alloc_nodes/=2;
		lh->pmax/=2;
		lh->p=lh->pmax-1;
		lh->b=n;
		}
	else
		lh->p--;
	lh->num_nodes--;
	lh->num_contracts++;
	n1=lh->b[(int)lh->p];
	if (n1 == NULL)
		lh->b[(int)lh->p]=np;
	else
		{
		while (n1->next != NULL)
			n1=n1->next;
		n1->next=np;
		}
	}
['int MAIN(int argc, char **argv)\n\t{\n\tdouble totalTime = 0.0;\n\tint nConn = 0;\n\tSSL *scon=NULL;\n\tlong finishtime=0;\n\tint ret=1,i;\n\tMS_STATIC char buf[1024*8];\n\tint ver;\n\tapps_startup();\n\ts_time_init();\n\tif (bio_err == NULL)\n\t\tbio_err=BIO_new_fp(stderr,BIO_NOCLOSE);\n#if !defined(NO_SSL2) && !defined(NO_SSL3)\n\ts_time_meth=SSLv23_client_method();\n#elif !defined(NO_SSL3)\n\ts_time_meth=SSLv3_client_method();\n#elif !defined(NO_SSL2)\n\ts_time_meth=SSLv2_client_method();\n#endif\n\tif( parseArgs( argc, argv ) < 0 )\n\t\tgoto end;\n\tSSLeay_add_ssl_algorithms();\n\tif ((tm_ctx=SSL_CTX_new(s_time_meth)) == NULL) return(1);\n\tSSL_CTX_set_quiet_shutdown(tm_ctx,1);\n\tif (st_bugs) SSL_CTX_set_options(tm_ctx,SSL_OP_ALL);\n\tSSL_CTX_set_cipher_list(tm_ctx,tm_cipher);\n\tif(!set_cert_stuff(tm_ctx,t_cert_file,t_key_file))\n\t\tgoto end;\n\tSSL_load_error_strings();\n\tif ((!SSL_CTX_load_verify_locations(tm_ctx,CAfile,CApath)) ||\n\t\t(!SSL_CTX_set_default_verify_paths(tm_ctx)))\n\t\t{\n\t\tERR_print_errors(bio_err);\n\t\t}\n\tif (tm_cipher == NULL)\n\t\ttm_cipher = getenv("SSL_CIPHER");\n\tif (tm_cipher == NULL ) {\n\t\tfprintf( stderr, "No CIPHER specified\\n" );\n\t}\n\tif (!(perform & 1)) goto next;\n\tprintf( "Collecting connection statistics for %d seconds\\n", maxTime );\n\tbytes_read=0;\n\tfinishtime=(long)time(NULL)+maxTime;\n\ttm_Time_F(START);\n\tfor (;;)\n\t\t{\n\t\tif (finishtime < time(NULL)) break;\n#ifdef WIN32_STUFF\n\t\tif( flushWinMsgs(0) == -1 )\n\t\t\tgoto end;\n\t\tif( waitingToDie || exitNow )\n\t\t\tgoto end;\n#endif\n\t\tif( (scon = doConnection( NULL )) == NULL )\n\t\t\tgoto end;\n\t\tif (s_www_path != NULL)\n\t\t\t{\n\t\t\tsprintf(buf,"GET %s HTTP/1.0\\r\\n\\r\\n",s_www_path);\n\t\t\tSSL_write(scon,buf,strlen(buf));\n\t\t\twhile ((i=SSL_read(scon,buf,sizeof(buf))) > 0)\n\t\t\t\tbytes_read+=i;\n\t\t\t}\n#ifdef NO_SHUTDOWN\n\t\tSSL_set_shutdown(scon,SSL_SENT_SHUTDOWN|SSL_RECEIVED_SHUTDOWN);\n#else\n\t\tSSL_shutdown(scon);\n#endif\n\t\tSHUTDOWN2(SSL_get_fd(scon));\n\t\tnConn += 1;\n\t\tif (SSL_session_reused(scon))\n\t\t\tver=\'r\';\n\t\telse\n\t\t\t{\n\t\t\tver=SSL_version(scon);\n\t\t\tif (ver == TLS1_VERSION)\n\t\t\t\tver=\'t\';\n\t\t\telse if (ver == SSL3_VERSION)\n\t\t\t\tver=\'3\';\n\t\t\telse if (ver == SSL2_VERSION)\n\t\t\t\tver=\'2\';\n\t\t\telse\n\t\t\t\tver=\'*\';\n\t\t\t}\n\t\tfputc(ver,stdout);\n\t\tfflush(stdout);\n\t\tSSL_free( scon );\n\t\tscon=NULL;\n\t\t}\n\ttotalTime += tm_Time_F(STOP);\n\ti=(int)(time(NULL)-finishtime+maxTime);\n\tprintf( "\\n\\n%d connections in %.2fs; %.2f connections/user sec, bytes read %ld\\n", nConn, totalTime, ((double)nConn/totalTime),bytes_read);\n\tprintf( "%d connections in %ld real seconds, %ld bytes read per connection\\n",nConn,time(NULL)-finishtime+maxTime,bytes_read/nConn);\nnext:\n\tif (!(perform & 2)) goto end;\n\tprintf( "\\n\\nNow timing with session id reuse.\\n" );\n\tif( (scon = doConnection( NULL )) == NULL )\n\t\t{\n\t\tfprintf( stderr, "Unable to get connection\\n" );\n\t\tgoto end;\n\t\t}\n\tif (s_www_path != NULL)\n\t\t{\n\t\tsprintf(buf,"GET %s HTTP/1.0\\r\\n\\r\\n",s_www_path);\n\t\tSSL_write(scon,buf,strlen(buf));\n\t\twhile (SSL_read(scon,buf,sizeof(buf)) > 0)\n\t\t\t;\n\t\t}\n#ifdef NO_SHUTDOWN\n\tSSL_set_shutdown(scon,SSL_SENT_SHUTDOWN|SSL_RECEIVED_SHUTDOWN);\n#else\n\tSSL_shutdown(scon);\n#endif\n\tSHUTDOWN2(SSL_get_fd(scon));\n\tnConn = 0;\n\ttotalTime = 0.0;\n\tfinishtime=time(NULL)+maxTime;\n\tprintf( "starting\\n" );\n\tbytes_read=0;\n\ttm_Time_F(START);\n\tfor (;;)\n\t\t{\n\t\tif (finishtime < time(NULL)) break;\n#ifdef WIN32_STUFF\n\t\tif( flushWinMsgs(0) == -1 )\n\t\t\tgoto end;\n\t\tif( waitingToDie || exitNow )\n\t\t\tgoto end;\n#endif\n\t \tif( (doConnection( scon )) == NULL )\n\t\t\tgoto end;\n\t\tif (s_www_path)\n\t\t\t{\n\t\t\tsprintf(buf,"GET %s HTTP/1.0\\r\\n\\r\\n",s_www_path);\n\t\t\tSSL_write(scon,buf,strlen(buf));\n\t\t\twhile ((i=SSL_read(scon,buf,sizeof(buf))) > 0)\n\t\t\t\tbytes_read+=i;\n\t\t\t}\n#ifdef NO_SHUTDOWN\n\t\tSSL_set_shutdown(scon,SSL_SENT_SHUTDOWN|SSL_RECEIVED_SHUTDOWN);\n#else\n\t\tSSL_shutdown(scon);\n#endif\n\t\tSHUTDOWN2(SSL_get_fd(scon));\n\t\tnConn += 1;\n\t\tif (SSL_session_reused(scon))\n\t\t\tver=\'r\';\n\t\telse\n\t\t\t{\n\t\t\tver=SSL_version(scon);\n\t\t\tif (ver == TLS1_VERSION)\n\t\t\t\tver=\'t\';\n\t\t\telse if (ver == SSL3_VERSION)\n\t\t\t\tver=\'3\';\n\t\t\telse if (ver == SSL2_VERSION)\n\t\t\t\tver=\'2\';\n\t\t\telse\n\t\t\t\tver=\'*\';\n\t\t\t}\n\t\tfputc(ver,stdout);\n\t\tfflush(stdout);\n\t\t}\n\ttotalTime += tm_Time_F(STOP);\n\tprintf( "\\n\\n%d connections in %.2fs; %.2f connections/user sec, bytes read %ld\\n", nConn, totalTime, ((double)nConn/totalTime),bytes_read);\n\tprintf( "%d connections in %ld real seconds, %ld bytes read per connection\\n",nConn,time(NULL)-finishtime+maxTime,bytes_read/nConn);\n\tret=0;\nend:\n\tif (scon != NULL) SSL_free(scon);\n\tif (tm_ctx != NULL)\n\t\t{\n\t\tSSL_CTX_free(tm_ctx);\n\t\ttm_ctx=NULL;\n\t\t}\n\tEXIT(ret);\n\t}', 'static SSL *doConnection(SSL *scon)\n\t{\n\tBIO *conn;\n\tSSL *serverCon;\n\tint width, i;\n\tfd_set readfds;\n\tif ((conn=BIO_new(BIO_s_connect())) == NULL)\n\t\treturn(NULL);\n\tBIO_set_conn_hostname(conn,host);\n\tif (scon == NULL)\n\t\tserverCon=(SSL *)SSL_new(tm_ctx);\n\telse\n\t\t{\n\t\tserverCon=scon;\n\t\tSSL_set_connect_state(serverCon);\n\t\t}\n\tSSL_set_bio(serverCon,conn,conn);\n#if 0\n\tif( scon != NULL )\n\t\tSSL_set_session(serverCon,SSL_get_session(scon));\n#endif\n\tfor(;;) {\n\t\ti=SSL_connect(serverCon);\n\t\tif (BIO_sock_should_retry(i))\n\t\t\t{\n\t\t\tBIO_printf(bio_err,"DELAY\\n");\n\t\t\ti=SSL_get_fd(serverCon);\n\t\t\twidth=i+1;\n\t\t\tFD_ZERO(&readfds);\n\t\t\tFD_SET(i,&readfds);\n\t\t\tselect(width,(void *)&readfds,NULL,NULL,NULL);\n\t\t\tcontinue;\n\t\t\t}\n\t\tbreak;\n\t\t}\n\tif(i <= 0)\n\t\t{\n\t\tBIO_printf(bio_err,"ERROR\\n");\n\t\tif (verify_error != X509_V_OK)\n\t\t\tBIO_printf(bio_err,"verify error:%s\\n",\n\t\t\t\tX509_verify_cert_error_string(verify_error));\n\t\telse\n\t\t\tERR_print_errors(bio_err);\n\t\tif (scon == NULL)\n\t\t\tSSL_free(serverCon);\n\t\treturn NULL;\n\t\t}\n\treturn serverCon;\n\t}', 'void SSL_free(SSL *s)\n\t{\n\tint i;\n\tif(s == NULL)\n\t    return;\n\ti=CRYPTO_add(&s->references,-1,CRYPTO_LOCK_SSL);\n#ifdef REF_PRINT\n\tREF_PRINT("SSL",s);\n#endif\n\tif (i > 0) return;\n#ifdef REF_CHECK\n\tif (i < 0)\n\t\t{\n\t\tfprintf(stderr,"SSL_free, bad reference count\\n");\n\t\tabort();\n\t\t}\n#endif\n\tCRYPTO_free_ex_data(ssl_meth,(char *)s,&s->ex_data);\n\tif (s->bbio != NULL)\n\t\t{\n\t\tif (s->bbio == s->wbio)\n\t\t\t{\n\t\t\ts->wbio=BIO_pop(s->wbio);\n\t\t\t}\n\t\tBIO_free(s->bbio);\n\t\ts->bbio=NULL;\n\t\t}\n\tif (s->rbio != NULL)\n\t\tBIO_free_all(s->rbio);\n\tif ((s->wbio != NULL) && (s->wbio != s->rbio))\n\t\tBIO_free_all(s->wbio);\n\tif (s->init_buf != NULL) BUF_MEM_free(s->init_buf);\n\tif (s->cipher_list != NULL) sk_SSL_CIPHER_free(s->cipher_list);\n\tif (s->cipher_list_by_id != NULL) sk_SSL_CIPHER_free(s->cipher_list_by_id);\n\tif (s->session != NULL)\n\t\t{\n\t\tssl_clear_bad_session(s);\n\t\tSSL_SESSION_free(s->session);\n\t\t}\n\tssl_clear_cipher_ctx(s);\n\tif (s->cert != NULL) ssl_cert_free(s->cert);\n\tif (s->ctx) SSL_CTX_free(s->ctx);\n\tif (s->client_CA != NULL)\n\t\tsk_X509_NAME_pop_free(s->client_CA,X509_NAME_free);\n\tif (s->method != NULL) s->method->ssl_free(s);\n\tFree((char *)s);\n\t}', 'int ssl_clear_bad_session(SSL *s)\n\t{\n\tif (\t(s->session != NULL) &&\n\t\t!(s->shutdown & SSL_SENT_SHUTDOWN) &&\n\t\t!(SSL_in_init(s) || SSL_in_before(s)))\n\t\t{\n\t\tSSL_CTX_remove_session(s->ctx,s->session);\n\t\treturn(1);\n\t\t}\n\telse\n\t\treturn(0);\n\t}', 'int SSL_CTX_remove_session(SSL_CTX *ctx, SSL_SESSION *c)\n{\n\treturn remove_session_lock(ctx, c, 1);\n}', 'static int remove_session_lock(SSL_CTX *ctx, SSL_SESSION *c, int lck)\n\t{\n\tSSL_SESSION *r;\n\tint ret=0;\n\tif ((c != NULL) && (c->session_id_length != 0))\n\t\t{\n\t\tif(lck) CRYPTO_w_lock(CRYPTO_LOCK_SSL_CTX);\n\t\tr=(SSL_SESSION *)lh_delete(ctx->sessions,(char *)c);\n\t\tif (r != NULL)\n\t\t\t{\n\t\t\tret=1;\n\t\t\tSSL_SESSION_list_remove(ctx,c);\n\t\t\t}\n\t\tif(lck) CRYPTO_w_unlock(CRYPTO_LOCK_SSL_CTX);\n\t\tif (ret)\n\t\t\t{\n\t\t\tr->not_resumable=1;\n\t\t\tif (ctx->remove_session_cb != NULL)\n\t\t\t\tctx->remove_session_cb(ctx,r);\n\t\t\tSSL_SESSION_free(r);\n\t\t\t}\n\t\t}\n\telse\n\t\tret=0;\n\treturn(ret);\n\t}', 'char *lh_delete(LHASH *lh, char *data)\n\t{\n\tunsigned long hash;\n\tLHASH_NODE *nn,**rn;\n\tchar *ret;\n\tlh->error=0;\n\trn=getrn(lh,data,&hash);\n\tif (*rn == NULL)\n\t\t{\n\t\tlh->num_no_delete++;\n\t\treturn(NULL);\n\t\t}\n\telse\n\t\t{\n\t\tnn= *rn;\n\t\t*rn=nn->next;\n\t\tret=nn->data;\n\t\tFree((char *)nn);\n\t\tlh->num_delete++;\n\t\t}\n\tlh->num_items--;\n\tif ((lh->num_nodes > MIN_NODES) &&\n\t\t(lh->down_load >= (lh->num_items*LH_LOAD_MULT/lh->num_nodes)))\n\t\tcontract(lh);\n\treturn(ret);\n\t}', 'static void contract(LHASH *lh)\n\t{\n\tLHASH_NODE **n,*n1,*np;\n\tnp=lh->b[lh->p+lh->pmax-1];\n\tlh->b[lh->p+lh->pmax-1]=NULL;\n\tif (lh->p == 0)\n\t\t{\n\t\tn=(LHASH_NODE **)Realloc((char *)lh->b,\n\t\t\t(unsigned int)(sizeof(LHASH_NODE *)*lh->pmax));\n\t\tif (n == NULL)\n\t\t\t{\n\t\t\tlh->error++;\n\t\t\treturn;\n\t\t\t}\n\t\tlh->num_contract_reallocs++;\n\t\tlh->num_alloc_nodes/=2;\n\t\tlh->pmax/=2;\n\t\tlh->p=lh->pmax-1;\n\t\tlh->b=n;\n\t\t}\n\telse\n\t\tlh->p--;\n\tlh->num_nodes--;\n\tlh->num_contracts++;\n\tn1=lh->b[(int)lh->p];\n\tif (n1 == NULL)\n\t\tlh->b[(int)lh->p]=np;\n\telse\n\t\t{\n\t\twhile (n1->next != NULL)\n\t\t\tn1=n1->next;\n\t\tn1->next=np;\n\t\t}\n\t}']