ssl/bio_ssl.c:295: error: INTEGER_OVERFLOW_L2
  ([0, +oo] - 1):unsigned64 by call to `SSL_clear`.
Showing all 12 steps of the trace


ssl/bio_ssl.c:295:13: Call
293.               SSL_set_accept_state(ssl);
294.   
295.           if(!SSL_clear(ssl)) {
                   ^
296.               ret = 0;
297.               break;

ssl/ssl_lib.c:190:1: Parameter `s->ctx->sessions->num_items`
  188.   };
  189.   
  190. > int SSL_clear(SSL *s)
  191.   {
  192.   

ssl/ssl_lib.c:198:9: Call
  196.       }
  197.   
  198.       if (ssl_clear_bad_session(s)) {
                 ^
  199.           SSL_SESSION_free(s->session);
  200.           s->session = NULL;

ssl/ssl_sess.c:1010:1: Parameter `s->ctx->sessions->num_items`
    1008.   }
    1009.   
    1010. > int ssl_clear_bad_session(SSL *s)
    1011.   {
    1012.       if ((s->session != NULL) &&

ssl/ssl_sess.c:1015:9: Call
    1013.           !(s->shutdown & SSL_SENT_SHUTDOWN) &&
    1014.           !(SSL_in_init(s) || SSL_in_before(s))) {
    1015.           SSL_CTX_remove_session(s->ctx, s->session);
                    ^
    1016.           return (1);
    1017.       } else

ssl/ssl_sess.c:675:1: Parameter `ctx->sessions->num_items`
      673.   }
      674.   
      675. > int SSL_CTX_remove_session(SSL_CTX *ctx, SSL_SESSION *c)
      676.   {
      677.       return remove_session_lock(ctx, c, 1);

ssl/ssl_sess.c:677:12: Call
      675.   int SSL_CTX_remove_session(SSL_CTX *ctx, SSL_SESSION *c)
      676.   {
      677.       return remove_session_lock(ctx, c, 1);
                        ^
      678.   }
      679.   

ssl/ssl_sess.c:680:1: Parameter `ctx->sessions->num_items`
        678.   }
        679.   
        680. > static int remove_session_lock(SSL_CTX *ctx, SSL_SESSION *c, int lck)
        681.   {
        682.       SSL_SESSION *r;

ssl/ssl_sess.c:690:17: Call
        688.           if ((r = lh_SSL_SESSION_retrieve(ctx->sessions, c)) == c) {
        689.               ret = 1;
        690.               r = lh_SSL_SESSION_delete(ctx->sessions, c);
                               ^
        691.               SSL_SESSION_list_remove(ctx, c);
        692.           }

crypto/lhash/lhash.c:211:1: <LHS trace>
209.   }
210.   
211. > void *lh_delete(_LHASH *lh, const void *data)
212.   {
213.       unsigned long hash;

crypto/lhash/lhash.c:211:1: Parameter `lh->num_items`
          209.   }
          210.   
          211. > void *lh_delete(_LHASH *lh, const void *data)
          212.   {
          213.       unsigned long hash;

crypto/lhash/lhash.c:231:5: Binary operation: ([0, +oo] - 1):unsigned64 by call to `SSL_clear` 
          229.       }
          230.   
          231.       lh->num_items--;
                     ^
          232.       if ((lh->num_nodes > MIN_NODES) &&
          233.           (lh->down_load >= (lh->num_items * LH_LOAD_MULT / lh->num_nodes)))

void *lh_delete(_LHASH *lh, const void *data)
{
    unsigned long hash;
    LHASH_NODE *nn, **rn;
    void *ret;
    lh->error = 0;
    rn = getrn(lh, data, &hash);
    if (*rn == NULL) {
        lh->num_no_delete++;
        return (NULL);
    } else {
        nn = *rn;
        *rn = nn->next;
        ret = nn->data;
        OPENSSL_free(nn);
        lh->num_delete++;
    }
    lh->num_items--;
    if ((lh->num_nodes > MIN_NODES) &&
        (lh->down_load >= (lh->num_items * LH_LOAD_MULT / lh->num_nodes)))
        contract(lh);
    return (ret);
}
['static long ssl_ctrl(BIO *b, int cmd, long num, void *ptr)\n{\n    SSL **sslp, *ssl;\n    BIO_SSL *bs;\n    BIO *dbio, *bio;\n    long ret = 1;\n    bs = (BIO_SSL *)b->ptr;\n    ssl = bs->ssl;\n    if ((ssl == NULL) && (cmd != BIO_C_SET_SSL))\n        return (0);\n    switch (cmd) {\n    case BIO_CTRL_RESET:\n        SSL_shutdown(ssl);\n        if (ssl->handshake_func == ssl->method->ssl_connect)\n            SSL_set_connect_state(ssl);\n        else if (ssl->handshake_func == ssl->method->ssl_accept)\n            SSL_set_accept_state(ssl);\n        if(!SSL_clear(ssl)) {\n            ret = 0;\n            break;\n        }\n        if (b->next_bio != NULL)\n            ret = BIO_ctrl(b->next_bio, cmd, num, ptr);\n        else if (ssl->rbio != NULL)\n            ret = BIO_ctrl(ssl->rbio, cmd, num, ptr);\n        else\n            ret = 1;\n        break;\n    case BIO_CTRL_INFO:\n        ret = 0;\n        break;\n    case BIO_C_SSL_MODE:\n        if (num)\n            SSL_set_connect_state(ssl);\n        else\n            SSL_set_accept_state(ssl);\n        break;\n    case BIO_C_SET_SSL_RENEGOTIATE_TIMEOUT:\n        ret = bs->renegotiate_timeout;\n        if (num < 60)\n            num = 5;\n        bs->renegotiate_timeout = (unsigned long)num;\n        bs->last_time = (unsigned long)time(NULL);\n        break;\n    case BIO_C_SET_SSL_RENEGOTIATE_BYTES:\n        ret = bs->renegotiate_count;\n        if ((long)num >= 512)\n            bs->renegotiate_count = (unsigned long)num;\n        break;\n    case BIO_C_GET_SSL_NUM_RENEGOTIATES:\n        ret = bs->num_renegotiates;\n        break;\n    case BIO_C_SET_SSL:\n        if (ssl != NULL) {\n            ssl_free(b);\n            if (!ssl_new(b))\n                return 0;\n        }\n        b->shutdown = (int)num;\n        ssl = (SSL *)ptr;\n        ((BIO_SSL *)b->ptr)->ssl = ssl;\n        bio = SSL_get_rbio(ssl);\n        if (bio != NULL) {\n            if (b->next_bio != NULL)\n                BIO_push(bio, b->next_bio);\n            b->next_bio = bio;\n            CRYPTO_add(&bio->references, 1, CRYPTO_LOCK_BIO);\n        }\n        b->init = 1;\n        break;\n    case BIO_C_GET_SSL:\n        if (ptr != NULL) {\n            sslp = (SSL **)ptr;\n            *sslp = ssl;\n        } else\n            ret = 0;\n        break;\n    case BIO_CTRL_GET_CLOSE:\n        ret = b->shutdown;\n        break;\n    case BIO_CTRL_SET_CLOSE:\n        b->shutdown = (int)num;\n        break;\n    case BIO_CTRL_WPENDING:\n        ret = BIO_ctrl(ssl->wbio, cmd, num, ptr);\n        break;\n    case BIO_CTRL_PENDING:\n        ret = SSL_pending(ssl);\n        if (ret == 0)\n            ret = BIO_pending(ssl->rbio);\n        break;\n    case BIO_CTRL_FLUSH:\n        BIO_clear_retry_flags(b);\n        ret = BIO_ctrl(ssl->wbio, cmd, num, ptr);\n        BIO_copy_next_retry(b);\n        break;\n    case BIO_CTRL_PUSH:\n        if ((b->next_bio != NULL) && (b->next_bio != ssl->rbio)) {\n            SSL_set_bio(ssl, b->next_bio, b->next_bio);\n            CRYPTO_add(&b->next_bio->references, 1, CRYPTO_LOCK_BIO);\n        }\n        break;\n    case BIO_CTRL_POP:\n        if (b == ptr) {\n            if (ssl->rbio != ssl->wbio)\n                BIO_free_all(ssl->wbio);\n            if (b->next_bio != NULL)\n                CRYPTO_add(&b->next_bio->references, -1, CRYPTO_LOCK_BIO);\n            ssl->wbio = NULL;\n            ssl->rbio = NULL;\n        }\n        break;\n    case BIO_C_DO_STATE_MACHINE:\n        BIO_clear_retry_flags(b);\n        b->retry_reason = 0;\n        ret = (int)SSL_do_handshake(ssl);\n        switch (SSL_get_error(ssl, (int)ret)) {\n        case SSL_ERROR_WANT_READ:\n            BIO_set_flags(b, BIO_FLAGS_READ | BIO_FLAGS_SHOULD_RETRY);\n            break;\n        case SSL_ERROR_WANT_WRITE:\n            BIO_set_flags(b, BIO_FLAGS_WRITE | BIO_FLAGS_SHOULD_RETRY);\n            break;\n        case SSL_ERROR_WANT_CONNECT:\n            BIO_set_flags(b, BIO_FLAGS_IO_SPECIAL | BIO_FLAGS_SHOULD_RETRY);\n            b->retry_reason = b->next_bio->retry_reason;\n            break;\n        default:\n            break;\n        }\n        break;\n    case BIO_CTRL_DUP:\n        dbio = (BIO *)ptr;\n        if (((BIO_SSL *)dbio->ptr)->ssl != NULL)\n            SSL_free(((BIO_SSL *)dbio->ptr)->ssl);\n        ((BIO_SSL *)dbio->ptr)->ssl = SSL_dup(ssl);\n        ((BIO_SSL *)dbio->ptr)->renegotiate_count =\n            ((BIO_SSL *)b->ptr)->renegotiate_count;\n        ((BIO_SSL *)dbio->ptr)->byte_count = ((BIO_SSL *)b->ptr)->byte_count;\n        ((BIO_SSL *)dbio->ptr)->renegotiate_timeout =\n            ((BIO_SSL *)b->ptr)->renegotiate_timeout;\n        ((BIO_SSL *)dbio->ptr)->last_time = ((BIO_SSL *)b->ptr)->last_time;\n        ret = (((BIO_SSL *)dbio->ptr)->ssl != NULL);\n        break;\n    case BIO_C_GET_FD:\n        ret = BIO_ctrl(ssl->rbio, cmd, num, ptr);\n        break;\n    case BIO_CTRL_SET_CALLBACK:\n        {\n#if 0\n            SSLerr(SSL_F_SSL_CTRL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);\n            ret = -1;\n#else\n            ret = 0;\n#endif\n        }\n        break;\n    case BIO_CTRL_GET_CALLBACK:\n        {\n            void (**fptr) (const SSL *xssl, int type, int val);\n            fptr = (void (**)(const SSL *xssl, int type, int val))ptr;\n            *fptr = SSL_get_info_callback(ssl);\n        }\n        break;\n    default:\n        ret = BIO_ctrl(ssl->rbio, cmd, num, ptr);\n        break;\n    }\n    return (ret);\n}', 'int SSL_clear(SSL *s)\n{\n    if (s->method == NULL) {\n        SSLerr(SSL_F_SSL_CLEAR, SSL_R_NO_METHOD_SPECIFIED);\n        return (0);\n    }\n    if (ssl_clear_bad_session(s)) {\n        SSL_SESSION_free(s->session);\n        s->session = NULL;\n    }\n    s->error = 0;\n    s->hit = 0;\n    s->shutdown = 0;\n    if (s->renegotiate) {\n        SSLerr(SSL_F_SSL_CLEAR, ERR_R_INTERNAL_ERROR);\n        return 0;\n    }\n    s->type = 0;\n    s->state = SSL_ST_BEFORE | ((s->server) ? SSL_ST_ACCEPT : SSL_ST_CONNECT);\n    s->version = s->method->version;\n    s->client_version = s->version;\n    s->rwstate = SSL_NOTHING;\n    s->rstate = SSL_ST_READ_HEADER;\n    if (s->init_buf != NULL) {\n        BUF_MEM_free(s->init_buf);\n        s->init_buf = NULL;\n    }\n    ssl_clear_cipher_ctx(s);\n    ssl_clear_hash_ctx(&s->read_hash);\n    ssl_clear_hash_ctx(&s->write_hash);\n    s->first_packet = 0;\n    if (!s->in_handshake && (s->session == NULL)\n        && (s->method != s->ctx->method)) {\n        s->method->ssl_free(s);\n        s->method = s->ctx->method;\n        if (!s->method->ssl_new(s))\n            return (0);\n    } else\n        s->method->ssl_clear(s);\n    return (1);\n}', 'int ssl_clear_bad_session(SSL *s)\n{\n    if ((s->session != NULL) &&\n        !(s->shutdown & SSL_SENT_SHUTDOWN) &&\n        !(SSL_in_init(s) || SSL_in_before(s))) {\n        SSL_CTX_remove_session(s->ctx, s->session);\n        return (1);\n    } else\n        return (0);\n}', 'int SSL_CTX_remove_session(SSL_CTX *ctx, SSL_SESSION *c)\n{\n    return remove_session_lock(ctx, c, 1);\n}', 'static int remove_session_lock(SSL_CTX *ctx, SSL_SESSION *c, int lck)\n{\n    SSL_SESSION *r;\n    int ret = 0;\n    if ((c != NULL) && (c->session_id_length != 0)) {\n        if (lck)\n            CRYPTO_w_lock(CRYPTO_LOCK_SSL_CTX);\n        if ((r = lh_SSL_SESSION_retrieve(ctx->sessions, c)) == c) {\n            ret = 1;\n            r = lh_SSL_SESSION_delete(ctx->sessions, c);\n            SSL_SESSION_list_remove(ctx, c);\n        }\n        if (lck)\n            CRYPTO_w_unlock(CRYPTO_LOCK_SSL_CTX);\n        if (ret) {\n            r->not_resumable = 1;\n            if (ctx->remove_session_cb != NULL)\n                ctx->remove_session_cb(ctx, r);\n            SSL_SESSION_free(r);\n        }\n    } else\n        ret = 0;\n    return (ret);\n}', 'void *lh_delete(_LHASH *lh, const void *data)\n{\n    unsigned long hash;\n    LHASH_NODE *nn, **rn;\n    void *ret;\n    lh->error = 0;\n    rn = getrn(lh, data, &hash);\n    if (*rn == NULL) {\n        lh->num_no_delete++;\n        return (NULL);\n    } else {\n        nn = *rn;\n        *rn = nn->next;\n        ret = nn->data;\n        OPENSSL_free(nn);\n        lh->num_delete++;\n    }\n    lh->num_items--;\n    if ((lh->num_nodes > MIN_NODES) &&\n        (lh->down_load >= (lh->num_items * LH_LOAD_MULT / lh->num_nodes)))\n        contract(lh);\n    return (ret);\n}']