apps/s_client.c:2323: error: INTEGER_OVERFLOW_L2
  ([0, +oo] - 1):unsigned64 by call to `SSL_free`.
Showing all 16 steps of the trace


apps/s_client.c:1523:11: Call
1521.       }
1522.   
1523.       con = SSL_new(ctx);
                  ^
1524.       if (sess_in) {
1525.           SSL_SESSION *sess;

ssl/ssl_lib.c:613:1: Parameter `ctx->sessions->num_items`
  611.   }
  612.   
  613. > SSL *SSL_new(SSL_CTX *ctx)
  614.   {
  615.       SSL *s;

apps/s_client.c:2323:9: Call
2321.           if (prexit != 0)
2322.               print_stuff(bio_c_out, con, 1);
2323.           SSL_free(con);
                ^
2324.       }
2325.       if (async) {

ssl/ssl_lib.c:977:1: Parameter `s->ctx->sessions->num_items`
  975.   }
  976.   
  977. > void SSL_free(SSL *s)
  978.   {
  979.       int i;

ssl/ssl_lib.c:1021:9: Call
  1019.       /* Make the next call work :-) */
  1020.       if (s->session != NULL) {
  1021.           ssl_clear_bad_session(s);
                  ^
  1022.           SSL_SESSION_free(s->session);
  1023.       }

ssl/ssl_sess.c:1083:1: Parameter `s->ctx->sessions->num_items`
    1081.   }
    1082.   
    1083. > int ssl_clear_bad_session(SSL *s)
    1084.   {
    1085.       if ((s->session != NULL) &&

ssl/ssl_sess.c:1088:9: Call
    1086.           !(s->shutdown & SSL_SENT_SHUTDOWN) &&
    1087.           !(SSL_in_init(s) || SSL_in_before(s))) {
    1088.           SSL_CTX_remove_session(s->ctx, s->session);
                    ^
    1089.           return (1);
    1090.       } else

ssl/ssl_sess.c:785:1: Parameter `ctx->sessions->num_items`
      783.   }
      784.   
      785. > int SSL_CTX_remove_session(SSL_CTX *ctx, SSL_SESSION *c)
      786.   {
      787.       return remove_session_lock(ctx, c, 1);

ssl/ssl_sess.c:787:12: Call
      785.   int SSL_CTX_remove_session(SSL_CTX *ctx, SSL_SESSION *c)
      786.   {
      787.       return remove_session_lock(ctx, c, 1);
                        ^
      788.   }
      789.   

ssl/ssl_sess.c:790:1: Parameter `ctx->sessions->num_items`
        788.   }
        789.   
        790. > static int remove_session_lock(SSL_CTX *ctx, SSL_SESSION *c, int lck)
        791.   {
        792.       SSL_SESSION *r;

ssl/ssl_sess.c:800:17: Call
        798.           if ((r = lh_SSL_SESSION_retrieve(ctx->sessions, c)) == c) {
        799.               ret = 1;
        800.               r = lh_SSL_SESSION_delete(ctx->sessions, c);
                               ^
        801.               SSL_SESSION_list_remove(ctx, c);
        802.           }

ssl/ssl_locl.h:697:1: Parameter `lh->num_items`
          695.   
          696.   DEFINE_STACK_OF(SSL_COMP)
          697. > DEFINE_LHASH_OF(SSL_SESSION);
          698.   
          699.   

ssl/ssl_locl.h:697:1: Call
          695.   
          696.   DEFINE_STACK_OF(SSL_COMP)
          697. > DEFINE_LHASH_OF(SSL_SESSION);
          698.   
          699.   

crypto/lhash/lhash.c:189:1: <LHS trace>
187.   }
188.   
189. > void *lh_delete(_LHASH *lh, const void *data)
190.   {
191.       unsigned long hash;

crypto/lhash/lhash.c:189:1: Parameter `lh->num_items`
            187.   }
            188.   
            189. > void *lh_delete(_LHASH *lh, const void *data)
            190.   {
            191.       unsigned long hash;

crypto/lhash/lhash.c:209:5: Binary operation: ([0, +oo] - 1):unsigned64 by call to `SSL_free` 
            207.       }
            208.   
            209.       lh->num_items--;
                       ^
            210.       if ((lh->num_nodes > MIN_NODES) &&
            211.           (lh->down_load >= (lh->num_items * LH_LOAD_MULT / lh->num_nodes)))

void *lh_delete(_LHASH *lh, const void *data)
{
    unsigned long hash;
    LHASH_NODE *nn, **rn;
    void *ret;
    lh->error = 0;
    rn = getrn(lh, data, &hash);
    if (*rn == NULL) {
        lh->num_no_delete++;
        return (NULL);
    } else {
        nn = *rn;
        *rn = nn->next;
        ret = nn->data;
        OPENSSL_free(nn);
        lh->num_delete++;
    }
    lh->num_items--;
    if ((lh->num_nodes > MIN_NODES) &&
        (lh->down_load >= (lh->num_items * LH_LOAD_MULT / lh->num_nodes)))
        contract(lh);
    return (ret);
}
['int s_client_main(int argc, char **argv)\n{\n    BIO *sbio;\n    EVP_PKEY *key = NULL;\n    SSL *con = NULL;\n    SSL_CTX *ctx = NULL;\n    STACK_OF(X509) *chain = NULL;\n    X509 *cert = NULL;\n    X509_VERIFY_PARAM *vpm = NULL;\n    SSL_EXCERT *exc = NULL;\n    SSL_CONF_CTX *cctx = NULL;\n    STACK_OF(OPENSSL_STRING) *ssl_args = NULL;\n    char *dane_tlsa_domain = NULL;\n    STACK_OF(OPENSSL_STRING) *dane_tlsa_rrset = NULL;\n    STACK_OF(X509_CRL) *crls = NULL;\n    const SSL_METHOD *meth = TLS_client_method();\n    char *CApath = NULL, *CAfile = NULL, *cbuf = NULL, *sbuf = NULL;\n    char *mbuf = NULL, *proxystr = NULL, *connectstr = NULL;\n    char *cert_file = NULL, *key_file = NULL, *chain_file = NULL;\n    char *chCApath = NULL, *chCAfile = NULL, *host = SSL_HOST_NAME;\n    char *inrand = NULL;\n    char *passarg = NULL, *pass = NULL, *vfyCApath = NULL, *vfyCAfile = NULL;\n    char *sess_in = NULL, *sess_out = NULL, *crl_file = NULL, *p;\n    char *jpake_secret = NULL, *xmpphost = NULL;\n    const char *unix_path = NULL;\n    const char *ehlo = "mail.example.com";\n    struct sockaddr peer;\n    struct timeval timeout, *timeoutp;\n    fd_set readfds, writefds;\n    int noCApath = 0, noCAfile = 0;\n    int build_chain = 0, cbuf_len, cbuf_off, cert_format = FORMAT_PEM;\n    int key_format = FORMAT_PEM, crlf = 0, full_log = 1, mbuf_len = 0;\n    int prexit = 0;\n    int enable_timeouts = 0, sdebug = 0, peerlen = sizeof peer;\n    int reconnect = 0, verify = SSL_VERIFY_NONE, vpmtouched = 0;\n    int ret = 1, in_init = 1, i, nbio_test = 0, s = -1, k, width, state = 0;\n    int sbuf_len, sbuf_off, socket_type = SOCK_STREAM, cmdletters = 1;\n    int starttls_proto = PROTO_OFF, crl_format = FORMAT_PEM, crl_download = 0;\n    int write_tty, read_tty, write_ssl, read_ssl, tty_on, ssl_pending;\n    int fallback_scsv = 0;\n    long socket_mtu = 0, randamt = 0;\n    unsigned short port = PORT;\n    OPTION_CHOICE o;\n#ifndef OPENSSL_NO_ENGINE\n    ENGINE *ssl_client_engine = NULL;\n#endif\n    ENGINE *e = NULL;\n#if defined(OPENSSL_SYS_WINDOWS) || defined(OPENSSL_SYS_MSDOS) || defined(OPENSSL_SYS_NETWARE)\n    struct timeval tv;\n#endif\n    char *servername = NULL;\n    const char *alpn_in = NULL;\n    tlsextctx tlsextcbp = { NULL, 0 };\n    const char *ssl_config = NULL;\n#define MAX_SI_TYPES 100\n    unsigned short serverinfo_types[MAX_SI_TYPES];\n    int serverinfo_count = 0, start = 0, len;\n#ifndef OPENSSL_NO_NEXTPROTONEG\n    const char *next_proto_neg_in = NULL;\n#endif\n#ifndef OPENSSL_NO_SRP\n    char *srppass = NULL;\n    int srp_lateuser = 0;\n    SRP_ARG srp_arg = { NULL, NULL, 0, 0, 0, 1024 };\n#endif\n    prog = opt_progname(argv[0]);\n    c_Pause = 0;\n    c_quiet = 0;\n    c_ign_eof = 0;\n    c_debug = 0;\n    c_msg = 0;\n    c_showcerts = 0;\n    c_nbio = 0;\n    verify_depth = 0;\n    verify_error = X509_V_OK;\n    vpm = X509_VERIFY_PARAM_new();\n    cbuf = app_malloc(BUFSIZZ, "cbuf");\n    sbuf = app_malloc(BUFSIZZ, "sbuf");\n    mbuf = app_malloc(BUFSIZZ, "mbuf");\n    cctx = SSL_CONF_CTX_new();\n    if (vpm == NULL || cctx == NULL) {\n        BIO_printf(bio_err, "%s: out of memory\\n", prog);\n        goto end;\n    }\n    SSL_CONF_CTX_set_flags(cctx, SSL_CONF_FLAG_CLIENT | SSL_CONF_FLAG_CMDLINE);\n    prog = opt_init(argc, argv, s_client_options);\n    while ((o = opt_next()) != OPT_EOF) {\n        switch (o) {\n        case OPT_EOF:\n        case OPT_ERR:\n opthelp:\n            BIO_printf(bio_err, "%s: Use -help for summary.\\n", prog);\n            goto end;\n        case OPT_HELP:\n            opt_help(s_client_options);\n            ret = 0;\n            goto end;\n        case OPT_HOST:\n            host = opt_arg();\n            break;\n        case OPT_PORT:\n            port = atoi(opt_arg());\n            break;\n        case OPT_CONNECT:\n            connectstr = opt_arg();\n            break;\n        case OPT_PROXY:\n            proxystr = opt_arg();\n            starttls_proto = PROTO_CONNECT;\n            break;\n        case OPT_UNIX:\n            unix_path = opt_arg();\n            break;\n        case OPT_XMPPHOST:\n            xmpphost = opt_arg();\n            break;\n        case OPT_SMTPHOST:\n            ehlo = opt_arg();\n            break;\n        case OPT_VERIFY:\n            verify = SSL_VERIFY_PEER;\n            verify_depth = atoi(opt_arg());\n            if (!c_quiet)\n                BIO_printf(bio_err, "verify depth is %d\\n", verify_depth);\n            break;\n        case OPT_CERT:\n            cert_file = opt_arg();\n            break;\n        case OPT_CRL:\n            crl_file = opt_arg();\n            break;\n        case OPT_CRL_DOWNLOAD:\n            crl_download = 1;\n            break;\n        case OPT_SESS_OUT:\n            sess_out = opt_arg();\n            break;\n        case OPT_SESS_IN:\n            sess_in = opt_arg();\n            break;\n        case OPT_CERTFORM:\n            if (!opt_format(opt_arg(), OPT_FMT_PEMDER, &cert_format))\n                goto opthelp;\n            break;\n        case OPT_CRLFORM:\n            if (!opt_format(opt_arg(), OPT_FMT_PEMDER, &crl_format))\n                goto opthelp;\n            break;\n        case OPT_VERIFY_RET_ERROR:\n            verify_return_error = 1;\n            break;\n        case OPT_VERIFY_QUIET:\n            verify_quiet = 1;\n            break;\n        case OPT_BRIEF:\n            c_brief = verify_quiet = c_quiet = 1;\n            break;\n        case OPT_S_CASES:\n            if (ssl_args == NULL)\n                ssl_args = sk_OPENSSL_STRING_new_null();\n            if (ssl_args == NULL\n                || !sk_OPENSSL_STRING_push(ssl_args, opt_flag())\n                || !sk_OPENSSL_STRING_push(ssl_args, opt_arg())) {\n                BIO_printf(bio_err, "%s: Memory allocation failure\\n", prog);\n                goto end;\n            }\n            break;\n        case OPT_V_CASES:\n            if (!opt_verify(o, vpm))\n                goto end;\n            vpmtouched++;\n            break;\n        case OPT_X_CASES:\n            if (!args_excert(o, &exc))\n                goto end;\n            break;\n        case OPT_PREXIT:\n            prexit = 1;\n            break;\n        case OPT_CRLF:\n            crlf = 1;\n            break;\n        case OPT_QUIET:\n            c_quiet = c_ign_eof = 1;\n            break;\n        case OPT_NBIO:\n            c_nbio = 1;\n            break;\n        case OPT_NOCMDS:\n            cmdletters = 0;\n            break;\n        case OPT_ENGINE:\n            e = setup_engine(opt_arg(), 1);\n            break;\n        case OPT_SSL_CLIENT_ENGINE:\n#ifndef OPENSSL_NO_ENGINE\n            ssl_client_engine = ENGINE_by_id(opt_arg());\n            if (ssl_client_engine == NULL) {\n                BIO_printf(bio_err, "Error getting client auth engine\\n");\n                goto opthelp;\n            }\n            break;\n#endif\n            break;\n        case OPT_RAND:\n            inrand = opt_arg();\n            break;\n        case OPT_IGN_EOF:\n            c_ign_eof = 1;\n            break;\n        case OPT_NO_IGN_EOF:\n            c_ign_eof = 0;\n            break;\n        case OPT_PAUSE:\n            c_Pause = 1;\n            break;\n        case OPT_DEBUG:\n            c_debug = 1;\n            break;\n        case OPT_TLSEXTDEBUG:\n            c_tlsextdebug = 1;\n            break;\n        case OPT_STATUS:\n            c_status_req = 1;\n            break;\n        case OPT_WDEBUG:\n#ifdef WATT32\n            dbug_init();\n#endif\n            break;\n        case OPT_MSG:\n            c_msg = 1;\n            break;\n        case OPT_MSGFILE:\n            bio_c_msg = BIO_new_file(opt_arg(), "w");\n            break;\n        case OPT_TRACE:\n#ifndef OPENSSL_NO_SSL_TRACE\n            c_msg = 2;\n#endif\n            break;\n        case OPT_SECURITY_DEBUG:\n            sdebug = 1;\n            break;\n        case OPT_SECURITY_DEBUG_VERBOSE:\n            sdebug = 2;\n            break;\n        case OPT_SHOWCERTS:\n            c_showcerts = 1;\n            break;\n        case OPT_NBIO_TEST:\n            nbio_test = 1;\n            break;\n        case OPT_STATE:\n            state = 1;\n            break;\n#ifndef OPENSSL_NO_PSK\n        case OPT_PSK_IDENTITY:\n            psk_identity = opt_arg();\n            break;\n        case OPT_PSK:\n            for (p = psk_key = opt_arg(); *p; p++) {\n                if (isxdigit(*p))\n                    continue;\n                BIO_printf(bio_err, "Not a hex number \'%s\'\\n", psk_key);\n                goto end;\n            }\n            break;\n#else\n        case OPT_PSK_IDENTITY:\n        case OPT_PSK:\n            break;\n#endif\n#ifndef OPENSSL_NO_SRP\n        case OPT_SRPUSER:\n            srp_arg.srplogin = opt_arg();\n            meth = TLSv1_client_method();\n            break;\n        case OPT_SRPPASS:\n            srppass = opt_arg();\n            meth = TLSv1_client_method();\n            break;\n        case OPT_SRP_STRENGTH:\n            srp_arg.strength = atoi(opt_arg());\n            BIO_printf(bio_err, "SRP minimal length for N is %d\\n",\n                       srp_arg.strength);\n            meth = TLSv1_client_method();\n            break;\n        case OPT_SRP_LATEUSER:\n            srp_lateuser = 1;\n            meth = TLSv1_client_method();\n            break;\n        case OPT_SRP_MOREGROUPS:\n            srp_arg.amp = 1;\n            meth = TLSv1_client_method();\n            break;\n#else\n        case OPT_SRPUSER:\n        case OPT_SRPPASS:\n        case OPT_SRP_STRENGTH:\n        case OPT_SRP_LATEUSER:\n        case OPT_SRP_MOREGROUPS:\n            break;\n#endif\n        case OPT_SSL_CONFIG:\n            ssl_config = opt_arg();\n            break;\n        case OPT_SSL3:\n#ifndef OPENSSL_NO_SSL3\n            meth = SSLv3_client_method();\n#endif\n            break;\n        case OPT_TLS1_2:\n            meth = TLSv1_2_client_method();\n            break;\n        case OPT_TLS1_1:\n            meth = TLSv1_1_client_method();\n            break;\n        case OPT_TLS1:\n            meth = TLSv1_client_method();\n            break;\n#ifndef OPENSSL_NO_DTLS\n        case OPT_DTLS:\n            meth = DTLS_client_method();\n            socket_type = SOCK_DGRAM;\n            break;\n        case OPT_DTLS1:\n            meth = DTLSv1_client_method();\n            socket_type = SOCK_DGRAM;\n            break;\n        case OPT_DTLS1_2:\n            meth = DTLSv1_2_client_method();\n            socket_type = SOCK_DGRAM;\n            break;\n        case OPT_TIMEOUT:\n            enable_timeouts = 1;\n            break;\n        case OPT_MTU:\n            socket_mtu = atol(opt_arg());\n            break;\n#else\n        case OPT_DTLS:\n        case OPT_DTLS1:\n        case OPT_DTLS1_2:\n        case OPT_TIMEOUT:\n        case OPT_MTU:\n            break;\n#endif\n        case OPT_FALLBACKSCSV:\n            fallback_scsv = 1;\n            break;\n        case OPT_KEYFORM:\n            if (!opt_format(opt_arg(), OPT_FMT_PEMDER, &key_format))\n                goto opthelp;\n            break;\n        case OPT_PASS:\n            passarg = opt_arg();\n            break;\n        case OPT_CERT_CHAIN:\n            chain_file = opt_arg();\n            break;\n        case OPT_KEY:\n            key_file = opt_arg();\n            break;\n        case OPT_RECONNECT:\n            reconnect = 5;\n            break;\n        case OPT_CAPATH:\n            CApath = opt_arg();\n            break;\n        case OPT_NOCAPATH:\n            noCApath = 1;\n            break;\n        case OPT_CHAINCAPATH:\n            chCApath = opt_arg();\n            break;\n        case OPT_VERIFYCAPATH:\n            vfyCApath = opt_arg();\n            break;\n        case OPT_BUILD_CHAIN:\n            build_chain = 1;\n            break;\n        case OPT_CAFILE:\n            CAfile = opt_arg();\n            break;\n        case OPT_NOCAFILE:\n            noCAfile = 1;\n            break;\n        case OPT_CHAINCAFILE:\n            chCAfile = opt_arg();\n            break;\n        case OPT_VERIFYCAFILE:\n            vfyCAfile = opt_arg();\n            break;\n        case OPT_DANE_TLSA_DOMAIN:\n            dane_tlsa_domain = opt_arg();\n            break;\n        case OPT_DANE_TLSA_RRDATA:\n            if (dane_tlsa_rrset == NULL)\n                dane_tlsa_rrset = sk_OPENSSL_STRING_new_null();\n            if (dane_tlsa_rrset == NULL ||\n                !sk_OPENSSL_STRING_push(dane_tlsa_rrset, opt_arg())) {\n                BIO_printf(bio_err, "%s: Memory allocation failure\\n", prog);\n                goto end;\n            }\n            break;\n        case OPT_NEXTPROTONEG:\n            next_proto_neg_in = opt_arg();\n            break;\n        case OPT_ALPN:\n            alpn_in = opt_arg();\n            break;\n        case OPT_SERVERINFO:\n            p = opt_arg();\n            len = strlen(p);\n            for (start = 0, i = 0; i <= len; ++i) {\n                if (i == len || p[i] == \',\') {\n                    serverinfo_types[serverinfo_count] = atoi(p + start);\n                    if (++serverinfo_count == MAX_SI_TYPES)\n                        break;\n                    start = i + 1;\n                }\n            }\n            break;\n        case OPT_STARTTLS:\n            if (!opt_pair(opt_arg(), services, &starttls_proto))\n                goto end;\n        case OPT_SERVERNAME:\n            servername = opt_arg();\n            break;\n        case OPT_JPAKE:\n#ifndef OPENSSL_NO_JPAKE\n            jpake_secret = opt_arg();\n#endif\n            break;\n        case OPT_USE_SRTP:\n            srtp_profiles = opt_arg();\n            break;\n        case OPT_KEYMATEXPORT:\n            keymatexportlabel = opt_arg();\n            break;\n        case OPT_KEYMATEXPORTLEN:\n            keymatexportlen = atoi(opt_arg());\n            break;\n        case OPT_ASYNC:\n            async = 1;\n            break;\n        }\n    }\n    argc = opt_num_rest();\n    argv = opt_rest();\n    if (proxystr) {\n        if (connectstr == NULL) {\n            BIO_printf(bio_err, "%s: -proxy requires use of -connect\\n", prog);\n            goto opthelp;\n        }\n        if (!extract_host_port(proxystr, &host, NULL, &port))\n            goto end;\n    }\n    else if (connectstr != NULL\n            && !extract_host_port(connectstr, &host, NULL, &port))\n        goto end;\n    if (unix_path && (socket_type != SOCK_STREAM)) {\n        BIO_printf(bio_err,\n                   "Can\'t use unix sockets and datagrams together\\n");\n        goto end;\n    }\n#if !defined(OPENSSL_NO_JPAKE) && !defined(OPENSSL_NO_PSK)\n    if (jpake_secret) {\n        if (psk_key) {\n            BIO_printf(bio_err, "Can\'t use JPAKE and PSK together\\n");\n            goto end;\n        }\n        psk_identity = "JPAKE";\n    }\n#endif\n#if !defined(OPENSSL_NO_NEXTPROTONEG)\n    next_proto.status = -1;\n    if (next_proto_neg_in) {\n        next_proto.data =\n            next_protos_parse(&next_proto.len, next_proto_neg_in);\n        if (next_proto.data == NULL) {\n            BIO_printf(bio_err, "Error parsing -nextprotoneg argument\\n");\n            goto end;\n        }\n    } else\n        next_proto.data = NULL;\n#endif\n    if (!app_passwd(passarg, NULL, &pass, NULL)) {\n        BIO_printf(bio_err, "Error getting password\\n");\n        goto end;\n    }\n    if (key_file == NULL)\n        key_file = cert_file;\n    if (key_file) {\n        key = load_key(key_file, key_format, 0, pass, e,\n                       "client certificate private key file");\n        if (key == NULL) {\n            ERR_print_errors(bio_err);\n            goto end;\n        }\n    }\n    if (cert_file) {\n        cert = load_cert(cert_file, cert_format,\n                         NULL, e, "client certificate file");\n        if (cert == NULL) {\n            ERR_print_errors(bio_err);\n            goto end;\n        }\n    }\n    if (chain_file) {\n        chain = load_certs(chain_file, FORMAT_PEM,\n                           NULL, e, "client certificate chain");\n        if (!chain)\n            goto end;\n    }\n    if (crl_file) {\n        X509_CRL *crl;\n        crl = load_crl(crl_file, crl_format);\n        if (crl == NULL) {\n            BIO_puts(bio_err, "Error loading CRL\\n");\n            ERR_print_errors(bio_err);\n            goto end;\n        }\n        crls = sk_X509_CRL_new_null();\n        if (crls == NULL || !sk_X509_CRL_push(crls, crl)) {\n            BIO_puts(bio_err, "Error adding CRL\\n");\n            ERR_print_errors(bio_err);\n            X509_CRL_free(crl);\n            goto end;\n        }\n    }\n    if (!load_excert(&exc))\n        goto end;\n    if (!app_RAND_load_file(NULL, 1) && inrand == NULL\n        && !RAND_status()) {\n        BIO_printf(bio_err,\n                   "warning, not much extra random data, consider using the -rand option\\n");\n    }\n    if (inrand != NULL) {\n        randamt = app_RAND_load_files(inrand);\n        BIO_printf(bio_err, "%ld semi-random bytes loaded\\n", randamt);\n    }\n    if (bio_c_out == NULL) {\n        if (c_quiet && !c_debug) {\n            bio_c_out = BIO_new(BIO_s_null());\n            if (c_msg && !bio_c_msg)\n                bio_c_msg = dup_bio_out(FORMAT_TEXT);\n        } else if (bio_c_out == NULL)\n            bio_c_out = dup_bio_out(FORMAT_TEXT);\n    }\n#ifndef OPENSSL_NO_SRP\n    if (!app_passwd(srppass, NULL, &srp_arg.srppassin, NULL)) {\n        BIO_printf(bio_err, "Error getting password\\n");\n        goto end;\n    }\n#endif\n    ctx = SSL_CTX_new(meth);\n    if (ctx == NULL) {\n        ERR_print_errors(bio_err);\n        goto end;\n    }\n    if (sdebug)\n        ssl_ctx_security_debug(ctx, sdebug);\n    if (ssl_config) {\n        if (SSL_CTX_config(ctx, ssl_config) == 0) {\n            BIO_printf(bio_err, "Error using configuration \\"%s\\"\\n",\n                       ssl_config);\n        ERR_print_errors(bio_err);\n        goto end;\n        }\n    }\n    if (vpmtouched && !SSL_CTX_set1_param(ctx, vpm)) {\n        BIO_printf(bio_err, "Error setting verify params\\n");\n        ERR_print_errors(bio_err);\n        goto end;\n    }\n    if (async) {\n        SSL_CTX_set_mode(ctx, SSL_MODE_ASYNC);\n        ASYNC_init(1, 0, 0);\n    }\n    if (!config_ctx(cctx, ssl_args, ctx, jpake_secret == NULL))\n        goto end;\n    if (!ssl_load_stores(ctx, vfyCApath, vfyCAfile, chCApath, chCAfile,\n                         crls, crl_download)) {\n        BIO_printf(bio_err, "Error loading store locations\\n");\n        ERR_print_errors(bio_err);\n        goto end;\n    }\n#ifndef OPENSSL_NO_ENGINE\n    if (ssl_client_engine) {\n        if (!SSL_CTX_set_client_cert_engine(ctx, ssl_client_engine)) {\n            BIO_puts(bio_err, "Error setting client auth engine\\n");\n            ERR_print_errors(bio_err);\n            ENGINE_free(ssl_client_engine);\n            goto end;\n        }\n        ENGINE_free(ssl_client_engine);\n    }\n#endif\n#ifndef OPENSSL_NO_PSK\n    if (psk_key != NULL || jpake_secret) {\n        if (c_debug)\n            BIO_printf(bio_c_out,\n                       "PSK key given or JPAKE in use, setting client callback\\n");\n        SSL_CTX_set_psk_client_callback(ctx, psk_client_cb);\n    }\n#endif\n#ifndef OPENSSL_NO_SRTP\n    if (srtp_profiles != NULL) {\n        if (SSL_CTX_set_tlsext_use_srtp(ctx, srtp_profiles) != 0) {\n            BIO_printf(bio_err, "Error setting SRTP profile\\n");\n            ERR_print_errors(bio_err);\n            goto end;\n        }\n    }\n#endif\n    if (exc)\n        ssl_ctx_set_excert(ctx, exc);\n#if !defined(OPENSSL_NO_NEXTPROTONEG)\n    if (next_proto.data)\n        SSL_CTX_set_next_proto_select_cb(ctx, next_proto_cb, &next_proto);\n#endif\n    if (alpn_in) {\n        unsigned short alpn_len;\n        unsigned char *alpn = next_protos_parse(&alpn_len, alpn_in);\n        if (alpn == NULL) {\n            BIO_printf(bio_err, "Error parsing -alpn argument\\n");\n            goto end;\n        }\n        if (SSL_CTX_set_alpn_protos(ctx, alpn, alpn_len) != 0) {\n           BIO_printf(bio_err, "Error setting ALPN\\n");\n            goto end;\n        }\n        OPENSSL_free(alpn);\n    }\n    for (i = 0; i < serverinfo_count; i++) {\n        if (!SSL_CTX_add_client_custom_ext(ctx,\n                                           serverinfo_types[i],\n                                           NULL, NULL, NULL,\n                                           serverinfo_cli_parse_cb, NULL)) {\n            BIO_printf(bio_err,\n                    "Warning: Unable to add custom extension %u, skipping\\n",\n                    serverinfo_types[i]);\n        }\n    }\n    if (state)\n        SSL_CTX_set_info_callback(ctx, apps_ssl_info_callback);\n    SSL_CTX_set_verify(ctx, verify, verify_callback);\n    if (!ctx_set_verify_locations(ctx, CAfile, CApath, noCAfile, noCApath)) {\n        ERR_print_errors(bio_err);\n        goto end;\n    }\n    ssl_ctx_add_crls(ctx, crls, crl_download);\n    if (!set_cert_key_stuff(ctx, cert, key, chain, build_chain))\n        goto end;\n    if (servername != NULL) {\n        tlsextcbp.biodebug = bio_err;\n        SSL_CTX_set_tlsext_servername_callback(ctx, ssl_servername_cb);\n        SSL_CTX_set_tlsext_servername_arg(ctx, &tlsextcbp);\n    }\n# ifndef OPENSSL_NO_SRP\n    if (srp_arg.srplogin) {\n        if (!srp_lateuser && !SSL_CTX_set_srp_username(ctx, srp_arg.srplogin)) {\n            BIO_printf(bio_err, "Unable to set SRP username\\n");\n            goto end;\n        }\n        srp_arg.msg = c_msg;\n        srp_arg.debug = c_debug;\n        SSL_CTX_set_srp_cb_arg(ctx, &srp_arg);\n        SSL_CTX_set_srp_client_pwd_callback(ctx, ssl_give_srp_client_pwd_cb);\n        SSL_CTX_set_srp_strength(ctx, srp_arg.strength);\n        if (c_msg || c_debug || srp_arg.amp == 0)\n            SSL_CTX_set_srp_verify_param_callback(ctx,\n                                                  ssl_srp_verify_param_cb);\n    }\n# endif\n    if (dane_tlsa_domain != NULL) {\n        if (SSL_CTX_dane_enable(ctx) <= 0) {\n            BIO_printf(bio_err,\n                       "%s: Error enabling DANE TLSA authentication.\\n", prog);\n            ERR_print_errors(bio_err);\n            goto end;\n        }\n    }\n    con = SSL_new(ctx);\n    if (sess_in) {\n        SSL_SESSION *sess;\n        BIO *stmp = BIO_new_file(sess_in, "r");\n        if (!stmp) {\n            BIO_printf(bio_err, "Can\'t open session file %s\\n", sess_in);\n            ERR_print_errors(bio_err);\n            goto end;\n        }\n        sess = PEM_read_bio_SSL_SESSION(stmp, NULL, 0, NULL);\n        BIO_free(stmp);\n        if (!sess) {\n            BIO_printf(bio_err, "Can\'t open session file %s\\n", sess_in);\n            ERR_print_errors(bio_err);\n            goto end;\n        }\n        if (!SSL_set_session(con, sess)) {\n            BIO_printf(bio_err, "Can\'t set session\\n");\n            ERR_print_errors(bio_err);\n            goto end;\n        }\n        SSL_SESSION_free(sess);\n    }\n    if (fallback_scsv)\n        SSL_set_mode(con, SSL_MODE_SEND_FALLBACK_SCSV);\n    if (servername != NULL) {\n        if (!SSL_set_tlsext_host_name(con, servername)) {\n            BIO_printf(bio_err, "Unable to set TLS servername extension.\\n");\n            ERR_print_errors(bio_err);\n            goto end;\n        }\n    }\n    if (dane_tlsa_domain != NULL) {\n        if (SSL_dane_enable(con, dane_tlsa_domain) <= 0) {\n            BIO_printf(bio_err, "%s: Error enabling DANE TLSA "\n                       "authentication.\\n", prog);\n            ERR_print_errors(bio_err);\n            goto end;\n        }\n        if (dane_tlsa_rrset == NULL) {\n            BIO_printf(bio_err, "%s: DANE TLSA authentication requires at "\n                       "least one -dane_tlsa_rrset option.\\n", prog);\n            goto end;\n        }\n        if (tlsa_import_rrset(con, dane_tlsa_rrset) <= 0) {\n            BIO_printf(bio_err, "%s: Failed to import any TLSA "\n                       "records.\\n", prog);\n            goto end;\n        }\n    } else if (dane_tlsa_rrset != NULL) {\n            BIO_printf(bio_err, "%s: DANE TLSA authentication requires the "\n                       "-dane_tlsa_domain option.\\n", prog);\n            goto end;\n    }\n re_start:\n#ifdef NO_SYS_UN_H\n    if (init_client(&s, host, port, socket_type) == 0)\n#else\n    if ((!unix_path && (init_client(&s, host, port, socket_type) == 0)) ||\n        (unix_path && (init_client_unix(&s, unix_path) == 0)))\n#endif\n    {\n        BIO_printf(bio_err, "connect:errno=%d\\n", get_last_socket_error());\n        SHUTDOWN(s);\n        goto end;\n    }\n    BIO_printf(bio_c_out, "CONNECTED(%08X)\\n", s);\n#ifdef FIONBIO\n    if (c_nbio) {\n        unsigned long l = 1;\n        BIO_printf(bio_c_out, "turning on non blocking io\\n");\n        if (BIO_socket_ioctl(s, FIONBIO, &l) < 0) {\n            ERR_print_errors(bio_err);\n            goto end;\n        }\n    }\n#endif\n    if (c_Pause & 0x01)\n        SSL_set_debug(con, 1);\n    if (socket_type == SOCK_DGRAM) {\n        sbio = BIO_new_dgram(s, BIO_NOCLOSE);\n        if (getsockname(s, &peer, (void *)&peerlen) < 0) {\n            BIO_printf(bio_err, "getsockname:errno=%d\\n",\n                       get_last_socket_error());\n            SHUTDOWN(s);\n            goto end;\n        }\n        (void)BIO_ctrl_set_connected(sbio, &peer);\n        if (enable_timeouts) {\n            timeout.tv_sec = 0;\n            timeout.tv_usec = DGRAM_RCV_TIMEOUT;\n            BIO_ctrl(sbio, BIO_CTRL_DGRAM_SET_RECV_TIMEOUT, 0, &timeout);\n            timeout.tv_sec = 0;\n            timeout.tv_usec = DGRAM_SND_TIMEOUT;\n            BIO_ctrl(sbio, BIO_CTRL_DGRAM_SET_SEND_TIMEOUT, 0, &timeout);\n        }\n        if (socket_mtu) {\n            if (socket_mtu < DTLS_get_link_min_mtu(con)) {\n                BIO_printf(bio_err, "MTU too small. Must be at least %ld\\n",\n                           DTLS_get_link_min_mtu(con));\n                BIO_free(sbio);\n                goto shut;\n            }\n            SSL_set_options(con, SSL_OP_NO_QUERY_MTU);\n            if (!DTLS_set_link_mtu(con, socket_mtu)) {\n                BIO_printf(bio_err, "Failed to set MTU\\n");\n                BIO_free(sbio);\n                goto shut;\n            }\n        } else\n            BIO_ctrl(sbio, BIO_CTRL_DGRAM_MTU_DISCOVER, 0, NULL);\n    } else\n        sbio = BIO_new_socket(s, BIO_NOCLOSE);\n    if (nbio_test) {\n        BIO *test;\n        test = BIO_new(BIO_f_nbio_test());\n        sbio = BIO_push(test, sbio);\n    }\n    if (c_debug) {\n        SSL_set_debug(con, 1);\n        BIO_set_callback(sbio, bio_dump_callback);\n        BIO_set_callback_arg(sbio, (char *)bio_c_out);\n    }\n    if (c_msg) {\n#ifndef OPENSSL_NO_SSL_TRACE\n        if (c_msg == 2)\n            SSL_set_msg_callback(con, SSL_trace);\n        else\n#endif\n            SSL_set_msg_callback(con, msg_cb);\n        SSL_set_msg_callback_arg(con, bio_c_msg ? bio_c_msg : bio_c_out);\n    }\n    if (c_tlsextdebug) {\n        SSL_set_tlsext_debug_callback(con, tlsext_cb);\n        SSL_set_tlsext_debug_arg(con, bio_c_out);\n    }\n    if (c_status_req) {\n        SSL_set_tlsext_status_type(con, TLSEXT_STATUSTYPE_ocsp);\n        SSL_CTX_set_tlsext_status_cb(ctx, ocsp_resp_cb);\n        SSL_CTX_set_tlsext_status_arg(ctx, bio_c_out);\n    }\n#ifndef OPENSSL_NO_JPAKE\n    if (jpake_secret)\n        jpake_client_auth(bio_c_out, sbio, jpake_secret);\n#endif\n    SSL_set_bio(con, sbio, sbio);\n    SSL_set_connect_state(con);\n    width = SSL_get_fd(con) + 1;\n    read_tty = 1;\n    write_tty = 0;\n    tty_on = 0;\n    read_ssl = 1;\n    write_ssl = 1;\n    cbuf_len = 0;\n    cbuf_off = 0;\n    sbuf_len = 0;\n    sbuf_off = 0;\n    switch ((PROTOCOL_CHOICE) starttls_proto) {\n    case PROTO_OFF:\n        break;\n    case PROTO_SMTP:\n        {\n            int foundit = 0;\n            BIO *fbio = BIO_new(BIO_f_buffer());\n            BIO_push(fbio, sbio);\n            do {\n                mbuf_len = BIO_gets(fbio, mbuf, BUFSIZZ);\n            }\n            while (mbuf_len > 3 && mbuf[3] == \'-\');\n            BIO_printf(fbio, "EHLO %s\\r\\n", ehlo);\n            (void)BIO_flush(fbio);\n            do {\n                mbuf_len = BIO_gets(fbio, mbuf, BUFSIZZ);\n                if (strstr(mbuf, "STARTTLS"))\n                    foundit = 1;\n            }\n            while (mbuf_len > 3 && mbuf[3] == \'-\');\n            (void)BIO_flush(fbio);\n            BIO_pop(fbio);\n            BIO_free(fbio);\n            if (!foundit)\n                BIO_printf(bio_err,\n                           "didn\'t find starttls in server response,"\n                           " trying anyway...\\n");\n            BIO_printf(sbio, "STARTTLS\\r\\n");\n            BIO_read(sbio, sbuf, BUFSIZZ);\n        }\n        break;\n    case PROTO_POP3:\n        {\n            BIO_read(sbio, mbuf, BUFSIZZ);\n            BIO_printf(sbio, "STLS\\r\\n");\n            mbuf_len = BIO_read(sbio, sbuf, BUFSIZZ);\n            if (mbuf_len < 0) {\n                BIO_printf(bio_err, "BIO_read failed\\n");\n                goto end;\n            }\n        }\n        break;\n    case PROTO_IMAP:\n        {\n            int foundit = 0;\n            BIO *fbio = BIO_new(BIO_f_buffer());\n            BIO_push(fbio, sbio);\n            BIO_gets(fbio, mbuf, BUFSIZZ);\n            BIO_printf(fbio, ". CAPABILITY\\r\\n");\n            (void)BIO_flush(fbio);\n            do {\n                mbuf_len = BIO_gets(fbio, mbuf, BUFSIZZ);\n                if (strstr(mbuf, "STARTTLS"))\n                    foundit = 1;\n            }\n            while (mbuf_len > 3 && mbuf[0] != \'.\');\n            (void)BIO_flush(fbio);\n            BIO_pop(fbio);\n            BIO_free(fbio);\n            if (!foundit)\n                BIO_printf(bio_err,\n                           "didn\'t find STARTTLS in server response,"\n                           " trying anyway...\\n");\n            BIO_printf(sbio, ". STARTTLS\\r\\n");\n            BIO_read(sbio, sbuf, BUFSIZZ);\n        }\n        break;\n    case PROTO_FTP:\n        {\n            BIO *fbio = BIO_new(BIO_f_buffer());\n            BIO_push(fbio, sbio);\n            do {\n                mbuf_len = BIO_gets(fbio, mbuf, BUFSIZZ);\n            }\n            while (mbuf_len > 3 && mbuf[3] == \'-\');\n            (void)BIO_flush(fbio);\n            BIO_pop(fbio);\n            BIO_free(fbio);\n            BIO_printf(sbio, "AUTH TLS\\r\\n");\n            BIO_read(sbio, sbuf, BUFSIZZ);\n        }\n        break;\n    case PROTO_XMPP:\n    case PROTO_XMPP_SERVER:\n        {\n            int seen = 0;\n            BIO_printf(sbio, "<stream:stream "\n                       "xmlns:stream=\'http://etherx.jabber.org/streams\' "\n                       "xmlns=\'jabber:%s\' to=\'%s\' version=\'1.0\'>",\n                       starttls_proto == PROTO_XMPP ? "client" : "server",\n                       xmpphost ? xmpphost : host);\n            seen = BIO_read(sbio, mbuf, BUFSIZZ);\n            mbuf[seen] = 0;\n            while (!strstr\n                   (mbuf, "<starttls xmlns=\'urn:ietf:params:xml:ns:xmpp-tls\'")\n                   && !strstr(mbuf,\n                              "<starttls xmlns=\\"urn:ietf:params:xml:ns:xmpp-tls\\""))\n            {\n                seen = BIO_read(sbio, mbuf, BUFSIZZ);\n                if (seen <= 0)\n                    goto shut;\n                mbuf[seen] = 0;\n            }\n            BIO_printf(sbio,\n                       "<starttls xmlns=\'urn:ietf:params:xml:ns:xmpp-tls\'/>");\n            seen = BIO_read(sbio, sbuf, BUFSIZZ);\n            sbuf[seen] = 0;\n            if (!strstr(sbuf, "<proceed"))\n                goto shut;\n            mbuf[0] = 0;\n        }\n        break;\n    case PROTO_TELNET:\n        {\n            static const unsigned char tls_do[] = {\n                   255,   253, 46\n            };\n            static const unsigned char tls_will[] = {\n                   255, 251, 46\n            };\n            static const unsigned char tls_follows[] = {\n                   255, 250, 46,       1,      255, 240\n            };\n            int bytes;\n            bytes = BIO_read(sbio, mbuf, BUFSIZZ);\n            if (bytes != 3 || memcmp(mbuf, tls_do, 3) != 0)\n                goto shut;\n            BIO_write(sbio, tls_will, 3);\n            BIO_write(sbio, tls_follows, 6);\n            (void)BIO_flush(sbio);\n            bytes = BIO_read(sbio, mbuf, BUFSIZZ);\n            if (bytes != 6 || memcmp(mbuf, tls_follows, 6) != 0)\n                goto shut;\n        }\n        break;\n    case PROTO_CONNECT:\n        {\n            int foundit = 0;\n            BIO *fbio = BIO_new(BIO_f_buffer());\n            BIO_push(fbio, sbio);\n            BIO_printf(fbio, "CONNECT %s\\r\\n\\r\\n", connectstr);\n            (void)BIO_flush(fbio);\n            do {\n                mbuf_len = BIO_gets(fbio, mbuf, BUFSIZZ);\n                if (strstr(mbuf, "200") != NULL\n                    && strstr(mbuf, "established") != NULL)\n                    foundit++;\n            } while (mbuf_len > 3 && foundit == 0);\n            (void)BIO_flush(fbio);\n            BIO_pop(fbio);\n            BIO_free(fbio);\n            if (!foundit) {\n                BIO_printf(bio_err, "%s: HTTP CONNECT failed\\n", prog);\n                goto shut;\n            }\n        }\n        break;\n    case PROTO_IRC:\n        {\n            int numeric;\n            BIO *fbio = BIO_new(BIO_f_buffer());\n            BIO_push(fbio, sbio);\n            BIO_printf(fbio, "STARTTLS\\r\\n");\n            (void)BIO_flush(fbio);\n            width = SSL_get_fd(con) + 1;\n            do {\n                numeric = 0;\n                FD_ZERO(&readfds);\n                openssl_fdset(SSL_get_fd(con), &readfds);\n                timeout.tv_sec = S_CLIENT_IRC_READ_TIMEOUT;\n                timeout.tv_usec = 0;\n                if (!BIO_get_buffer_num_lines(fbio)\n                    && !BIO_pending(fbio)\n                    && !BIO_pending(sbio)\n                    && select(width, (void *)&readfds, NULL, NULL,\n                              &timeout) < 1) {\n                    BIO_printf(bio_err,\n                               "Timeout waiting for response (%d seconds).\\n",\n                               S_CLIENT_IRC_READ_TIMEOUT);\n                    break;\n                }\n                mbuf_len = BIO_gets(fbio, mbuf, BUFSIZZ);\n                if (mbuf_len < 1 || sscanf(mbuf, "%*s %d", &numeric) != 1)\n                    break;\n                if ((numeric == 451 || numeric == 421)\n                    && strstr(mbuf, "STARTTLS") != NULL) {\n                    BIO_printf(bio_err, "STARTTLS not supported: %s", mbuf);\n                    break;\n                }\n                if (numeric == 691) {\n                    BIO_printf(bio_err, "STARTTLS negotiation failed: ");\n                    ERR_print_errors(bio_err);\n                    break;\n                }\n            } while (numeric != 670);\n            (void)BIO_flush(fbio);\n            BIO_pop(fbio);\n            BIO_free(fbio);\n            if (numeric != 670) {\n                BIO_printf(bio_err, "Server does not support STARTTLS.\\n");\n                ret = 1;\n                goto shut;\n            }\n        }\n    }\n    for (;;) {\n        FD_ZERO(&readfds);\n        FD_ZERO(&writefds);\n        if ((SSL_version(con) == DTLS1_VERSION) &&\n            DTLSv1_get_timeout(con, &timeout))\n            timeoutp = &timeout;\n        else\n            timeoutp = NULL;\n        if (SSL_in_init(con) && !SSL_total_renegotiations(con)) {\n            in_init = 1;\n            tty_on = 0;\n        } else {\n            tty_on = 1;\n            if (in_init) {\n                in_init = 0;\n                if (servername != NULL && !SSL_session_reused(con)) {\n                    BIO_printf(bio_c_out,\n                               "Server did %sacknowledge servername extension.\\n",\n                               tlsextcbp.ack ? "" : "not ");\n                }\n                if (sess_out) {\n                    BIO *stmp = BIO_new_file(sess_out, "w");\n                    if (stmp) {\n                        PEM_write_bio_SSL_SESSION(stmp, SSL_get_session(con));\n                        BIO_free(stmp);\n                    } else\n                        BIO_printf(bio_err, "Error writing session file %s\\n",\n                                   sess_out);\n                }\n                if (c_brief) {\n                    BIO_puts(bio_err, "CONNECTION ESTABLISHED\\n");\n                    print_ssl_summary(con);\n                }\n                print_stuff(bio_c_out, con, full_log);\n                if (full_log > 0)\n                    full_log--;\n                if (starttls_proto) {\n                    BIO_write(bio_err, mbuf, mbuf_len);\n                    if (!reconnect)\n                        starttls_proto = PROTO_OFF;\n                }\n                if (reconnect) {\n                    reconnect--;\n                    BIO_printf(bio_c_out,\n                               "drop connection and then reconnect\\n");\n                    SSL_shutdown(con);\n                    SSL_set_connect_state(con);\n                    SHUTDOWN(SSL_get_fd(con));\n                    goto re_start;\n                }\n            }\n        }\n        ssl_pending = read_ssl && SSL_pending(con);\n        if (!ssl_pending) {\n#if !defined(OPENSSL_SYS_WINDOWS) && !defined(OPENSSL_SYS_MSDOS) && !defined(OPENSSL_SYS_NETWARE)\n            if (tty_on) {\n                if (read_tty)\n                    openssl_fdset(fileno(stdin), &readfds);\n                if (write_tty)\n                    openssl_fdset(fileno(stdout), &writefds);\n            }\n            if (read_ssl)\n                openssl_fdset(SSL_get_fd(con), &readfds);\n            if (write_ssl)\n                openssl_fdset(SSL_get_fd(con), &writefds);\n#else\n            if (!tty_on || !write_tty) {\n                if (read_ssl)\n                    openssl_fdset(SSL_get_fd(con), &readfds);\n                if (write_ssl)\n                    openssl_fdset(SSL_get_fd(con), &writefds);\n            }\n#endif\n#if defined(OPENSSL_SYS_WINDOWS) || defined(OPENSSL_SYS_MSDOS)\n            i = 0;\n            if (!write_tty) {\n                if (read_tty) {\n                    tv.tv_sec = 1;\n                    tv.tv_usec = 0;\n                    i = select(width, (void *)&readfds, (void *)&writefds,\n                               NULL, &tv);\n# if defined(OPENSSL_SYS_WINCE) || defined(OPENSSL_SYS_MSDOS)\n                    if (!i && (!_kbhit() || !read_tty))\n                        continue;\n# else\n                    if (!i && (!((_kbhit())\n                                 || (WAIT_OBJECT_0 ==\n                                     WaitForSingleObject(GetStdHandle\n                                                         (STD_INPUT_HANDLE),\n                                                         0)))\n                               || !read_tty))\n                        continue;\n# endif\n                } else\n                    i = select(width, (void *)&readfds, (void *)&writefds,\n                               NULL, timeoutp);\n            }\n#elif defined(OPENSSL_SYS_NETWARE)\n            if (!write_tty) {\n                if (read_tty) {\n                    tv.tv_sec = 1;\n                    tv.tv_usec = 0;\n                    i = select(width, (void *)&readfds, (void *)&writefds,\n                               NULL, &tv);\n                } else\n                    i = select(width, (void *)&readfds, (void *)&writefds,\n                               NULL, timeoutp);\n            }\n#else\n            i = select(width, (void *)&readfds, (void *)&writefds,\n                       NULL, timeoutp);\n#endif\n            if (i < 0) {\n                BIO_printf(bio_err, "bad select %d\\n",\n                           get_last_socket_error());\n                goto shut;\n            }\n        }\n        if ((SSL_version(con) == DTLS1_VERSION)\n            && DTLSv1_handle_timeout(con) > 0) {\n            BIO_printf(bio_err, "TIMEOUT occurred\\n");\n        }\n        if (!ssl_pending && FD_ISSET(SSL_get_fd(con), &writefds)) {\n            k = SSL_write(con, &(cbuf[cbuf_off]), (unsigned int)cbuf_len);\n            switch (SSL_get_error(con, k)) {\n            case SSL_ERROR_NONE:\n                cbuf_off += k;\n                cbuf_len -= k;\n                if (k <= 0)\n                    goto end;\n                if (cbuf_len <= 0) {\n                    read_tty = 1;\n                    write_ssl = 0;\n                } else {\n                    read_tty = 0;\n                    write_ssl = 1;\n                }\n                break;\n            case SSL_ERROR_WANT_WRITE:\n                BIO_printf(bio_c_out, "write W BLOCK\\n");\n                write_ssl = 1;\n                read_tty = 0;\n                break;\n            case SSL_ERROR_WANT_ASYNC:\n                BIO_printf(bio_c_out, "write A BLOCK\\n");\n                wait_for_async(con);\n                write_ssl = 1;\n                read_tty = 0;\n                break;\n            case SSL_ERROR_WANT_READ:\n                BIO_printf(bio_c_out, "write R BLOCK\\n");\n                write_tty = 0;\n                read_ssl = 1;\n                write_ssl = 0;\n                break;\n            case SSL_ERROR_WANT_X509_LOOKUP:\n                BIO_printf(bio_c_out, "write X BLOCK\\n");\n                break;\n            case SSL_ERROR_ZERO_RETURN:\n                if (cbuf_len != 0) {\n                    BIO_printf(bio_c_out, "shutdown\\n");\n                    ret = 0;\n                    goto shut;\n                } else {\n                    read_tty = 1;\n                    write_ssl = 0;\n                    break;\n                }\n            case SSL_ERROR_SYSCALL:\n                if ((k != 0) || (cbuf_len != 0)) {\n                    BIO_printf(bio_err, "write:errno=%d\\n",\n                               get_last_socket_error());\n                    goto shut;\n                } else {\n                    read_tty = 1;\n                    write_ssl = 0;\n                }\n                break;\n            case SSL_ERROR_SSL:\n                ERR_print_errors(bio_err);\n                goto shut;\n            }\n        }\n#if defined(OPENSSL_SYS_WINDOWS) || defined(OPENSSL_SYS_MSDOS) || defined(OPENSSL_SYS_NETWARE)\n        else if (!ssl_pending && write_tty)\n#else\n        else if (!ssl_pending && FD_ISSET(fileno(stdout), &writefds))\n#endif\n        {\n#ifdef CHARSET_EBCDIC\n            ascii2ebcdic(&(sbuf[sbuf_off]), &(sbuf[sbuf_off]), sbuf_len);\n#endif\n            i = raw_write_stdout(&(sbuf[sbuf_off]), sbuf_len);\n            if (i <= 0) {\n                BIO_printf(bio_c_out, "DONE\\n");\n                ret = 0;\n                goto shut;\n            }\n            sbuf_len -= i;;\n            sbuf_off += i;\n            if (sbuf_len <= 0) {\n                read_ssl = 1;\n                write_tty = 0;\n            }\n        } else if (ssl_pending || FD_ISSET(SSL_get_fd(con), &readfds)) {\n#ifdef RENEG\n            {\n                static int iiii;\n                if (++iiii == 52) {\n                    SSL_renegotiate(con);\n                    iiii = 0;\n                }\n            }\n#endif\n            k = SSL_read(con, sbuf, 1024   );\n            switch (SSL_get_error(con, k)) {\n            case SSL_ERROR_NONE:\n                if (k <= 0)\n                    goto end;\n                sbuf_off = 0;\n                sbuf_len = k;\n                read_ssl = 0;\n                write_tty = 1;\n                break;\n            case SSL_ERROR_WANT_ASYNC:\n                BIO_printf(bio_c_out, "read A BLOCK\\n");\n                wait_for_async(con);\n                write_tty = 0;\n                read_ssl = 1;\n                if ((read_tty == 0) && (write_ssl == 0))\n                    write_ssl = 1;\n                break;\n            case SSL_ERROR_WANT_WRITE:\n                BIO_printf(bio_c_out, "read W BLOCK\\n");\n                write_ssl = 1;\n                read_tty = 0;\n                break;\n            case SSL_ERROR_WANT_READ:\n                BIO_printf(bio_c_out, "read R BLOCK\\n");\n                write_tty = 0;\n                read_ssl = 1;\n                if ((read_tty == 0) && (write_ssl == 0))\n                    write_ssl = 1;\n                break;\n            case SSL_ERROR_WANT_X509_LOOKUP:\n                BIO_printf(bio_c_out, "read X BLOCK\\n");\n                break;\n            case SSL_ERROR_SYSCALL:\n                ret = get_last_socket_error();\n                if (c_brief)\n                    BIO_puts(bio_err, "CONNECTION CLOSED BY SERVER\\n");\n                else\n                    BIO_printf(bio_err, "read:errno=%d\\n", ret);\n                goto shut;\n            case SSL_ERROR_ZERO_RETURN:\n                BIO_printf(bio_c_out, "closed\\n");\n                ret = 0;\n                goto shut;\n            case SSL_ERROR_SSL:\n                ERR_print_errors(bio_err);\n                goto shut;\n            }\n        }\n#if defined(OPENSSL_SYS_WINDOWS) || defined(OPENSSL_SYS_MSDOS)\n# if defined(OPENSSL_SYS_WINCE) || defined(OPENSSL_SYS_MSDOS)\n        else if (_kbhit())\n# else\n        else if ((_kbhit())\n                 || (WAIT_OBJECT_0 ==\n                     WaitForSingleObject(GetStdHandle(STD_INPUT_HANDLE), 0)))\n# endif\n#elif defined (OPENSSL_SYS_NETWARE)\n        else if (_kbhit())\n#else\n        else if (FD_ISSET(fileno(stdin), &readfds))\n#endif\n        {\n            if (crlf) {\n                int j, lf_num;\n                i = raw_read_stdin(cbuf, BUFSIZZ / 2);\n                lf_num = 0;\n                for (j = 0; j < i; j++)\n                    if (cbuf[j] == \'\\n\')\n                        lf_num++;\n                for (j = i - 1; j >= 0; j--) {\n                    cbuf[j + lf_num] = cbuf[j];\n                    if (cbuf[j] == \'\\n\') {\n                        lf_num--;\n                        i++;\n                        cbuf[j + lf_num] = \'\\r\';\n                    }\n                }\n                assert(lf_num == 0);\n            } else\n                i = raw_read_stdin(cbuf, BUFSIZZ);\n            if ((!c_ign_eof) && ((i <= 0) || (cbuf[0] == \'Q\' && cmdletters))) {\n                BIO_printf(bio_err, "DONE\\n");\n                ret = 0;\n                goto shut;\n            }\n            if ((!c_ign_eof) && (cbuf[0] == \'R\' && cmdletters)) {\n                BIO_printf(bio_err, "RENEGOTIATING\\n");\n                SSL_renegotiate(con);\n                cbuf_len = 0;\n            }\n#ifndef OPENSSL_NO_HEARTBEATS\n            else if ((!c_ign_eof) && (cbuf[0] == \'B\' && cmdletters)) {\n                BIO_printf(bio_err, "HEARTBEATING\\n");\n                SSL_heartbeat(con);\n                cbuf_len = 0;\n            }\n#endif\n            else {\n                cbuf_len = i;\n                cbuf_off = 0;\n#ifdef CHARSET_EBCDIC\n                ebcdic2ascii(cbuf, cbuf, i);\n#endif\n            }\n            write_ssl = 1;\n            read_tty = 0;\n        }\n    }\n    ret = 0;\n shut:\n    if (in_init)\n        print_stuff(bio_c_out, con, full_log);\n    SSL_shutdown(con);\n    SHUTDOWN(SSL_get_fd(con));\n end:\n    if (con != NULL) {\n        if (prexit != 0)\n            print_stuff(bio_c_out, con, 1);\n        SSL_free(con);\n    }\n    if (async) {\n        ASYNC_cleanup(1);\n    }\n#if !defined(OPENSSL_NO_NEXTPROTONEG)\n    OPENSSL_free(next_proto.data);\n#endif\n    SSL_CTX_free(ctx);\n    X509_free(cert);\n    sk_X509_CRL_pop_free(crls, X509_CRL_free);\n    EVP_PKEY_free(key);\n    sk_X509_pop_free(chain, X509_free);\n    OPENSSL_free(pass);\n#ifndef OPENSSL_NO_SRP\n    OPENSSL_free(srp_arg.srppassin);\n#endif\n    X509_VERIFY_PARAM_free(vpm);\n    ssl_excert_free(exc);\n    sk_OPENSSL_STRING_free(ssl_args);\n    sk_OPENSSL_STRING_free(dane_tlsa_rrset);\n    SSL_CONF_CTX_free(cctx);\n    OPENSSL_clear_free(cbuf, BUFSIZZ);\n    OPENSSL_clear_free(sbuf, BUFSIZZ);\n    OPENSSL_clear_free(mbuf, BUFSIZZ);\n    BIO_free(bio_c_out);\n    bio_c_out = NULL;\n    BIO_free(bio_c_msg);\n    bio_c_msg = NULL;\n    return (ret);\n}', 'SSL *SSL_new(SSL_CTX *ctx)\n{\n    SSL *s;\n    if (ctx == NULL) {\n        SSLerr(SSL_F_SSL_NEW, SSL_R_NULL_SSL_CTX);\n        return (NULL);\n    }\n    if (ctx->method == NULL) {\n        SSLerr(SSL_F_SSL_NEW, SSL_R_SSL_CTX_HAS_NO_DEFAULT_SSL_VERSION);\n        return (NULL);\n    }\n    s = OPENSSL_zalloc(sizeof(*s));\n    if (s == NULL)\n        goto err;\n    RECORD_LAYER_init(&s->rlayer, s);\n    s->options = ctx->options;\n    s->min_proto_version = ctx->min_proto_version;\n    s->max_proto_version = ctx->max_proto_version;\n    s->mode = ctx->mode;\n    s->max_cert_list = ctx->max_cert_list;\n    s->references = 1;\n    s->cert = ssl_cert_dup(ctx->cert);\n    if (s->cert == NULL)\n        goto err;\n    RECORD_LAYER_set_read_ahead(&s->rlayer, ctx->read_ahead);\n    s->msg_callback = ctx->msg_callback;\n    s->msg_callback_arg = ctx->msg_callback_arg;\n    s->verify_mode = ctx->verify_mode;\n    s->not_resumable_session_cb = ctx->not_resumable_session_cb;\n    s->sid_ctx_length = ctx->sid_ctx_length;\n    OPENSSL_assert(s->sid_ctx_length <= sizeof s->sid_ctx);\n    memcpy(&s->sid_ctx, &ctx->sid_ctx, sizeof(s->sid_ctx));\n    s->verify_callback = ctx->default_verify_callback;\n    s->generate_session_id = ctx->generate_session_id;\n    s->param = X509_VERIFY_PARAM_new();\n    if (s->param == NULL)\n        goto err;\n    X509_VERIFY_PARAM_inherit(s->param, ctx->param);\n    s->quiet_shutdown = ctx->quiet_shutdown;\n    s->max_send_fragment = ctx->max_send_fragment;\n    CRYPTO_add(&ctx->references, 1, CRYPTO_LOCK_SSL_CTX);\n    s->ctx = ctx;\n    s->tlsext_debug_cb = 0;\n    s->tlsext_debug_arg = NULL;\n    s->tlsext_ticket_expected = 0;\n    s->tlsext_status_type = -1;\n    s->tlsext_status_expected = 0;\n    s->tlsext_ocsp_ids = NULL;\n    s->tlsext_ocsp_exts = NULL;\n    s->tlsext_ocsp_resp = NULL;\n    s->tlsext_ocsp_resplen = -1;\n    CRYPTO_add(&ctx->references, 1, CRYPTO_LOCK_SSL_CTX);\n    s->initial_ctx = ctx;\n# ifndef OPENSSL_NO_EC\n    if (ctx->tlsext_ecpointformatlist) {\n        s->tlsext_ecpointformatlist =\n            OPENSSL_memdup(ctx->tlsext_ecpointformatlist,\n                           ctx->tlsext_ecpointformatlist_length);\n        if (!s->tlsext_ecpointformatlist)\n            goto err;\n        s->tlsext_ecpointformatlist_length =\n            ctx->tlsext_ecpointformatlist_length;\n    }\n    if (ctx->tlsext_ellipticcurvelist) {\n        s->tlsext_ellipticcurvelist =\n            OPENSSL_memdup(ctx->tlsext_ellipticcurvelist,\n                           ctx->tlsext_ellipticcurvelist_length);\n        if (!s->tlsext_ellipticcurvelist)\n            goto err;\n        s->tlsext_ellipticcurvelist_length =\n            ctx->tlsext_ellipticcurvelist_length;\n    }\n# endif\n# ifndef OPENSSL_NO_NEXTPROTONEG\n    s->next_proto_negotiated = NULL;\n# endif\n    if (s->ctx->alpn_client_proto_list) {\n        s->alpn_client_proto_list =\n            OPENSSL_malloc(s->ctx->alpn_client_proto_list_len);\n        if (s->alpn_client_proto_list == NULL)\n            goto err;\n        memcpy(s->alpn_client_proto_list, s->ctx->alpn_client_proto_list,\n               s->ctx->alpn_client_proto_list_len);\n        s->alpn_client_proto_list_len = s->ctx->alpn_client_proto_list_len;\n    }\n    s->verify_result = X509_V_OK;\n    s->default_passwd_callback = ctx->default_passwd_callback;\n    s->default_passwd_callback_userdata = ctx->default_passwd_callback_userdata;\n    s->method = ctx->method;\n    if (!s->method->ssl_new(s))\n        goto err;\n    s->server = (ctx->method->ssl_accept == ssl_undefined_function) ? 0 : 1;\n    if (!SSL_clear(s))\n        goto err;\n    CRYPTO_new_ex_data(CRYPTO_EX_INDEX_SSL, s, &s->ex_data);\n#ifndef OPENSSL_NO_PSK\n    s->psk_client_callback = ctx->psk_client_callback;\n    s->psk_server_callback = ctx->psk_server_callback;\n#endif\n    s->job = NULL;\n    return (s);\n err:\n    SSL_free(s);\n    SSLerr(SSL_F_SSL_NEW, ERR_R_MALLOC_FAILURE);\n    return (NULL);\n}', 'void SSL_free(SSL *s)\n{\n    int i;\n    if (s == NULL)\n        return;\n    i = CRYPTO_add(&s->references, -1, CRYPTO_LOCK_SSL);\n#ifdef REF_PRINT\n    REF_PRINT("SSL", s);\n#endif\n    if (i > 0)\n        return;\n#ifdef REF_CHECK\n    if (i < 0) {\n        fprintf(stderr, "SSL_free, bad reference count\\n");\n        abort();\n    }\n#endif\n    X509_VERIFY_PARAM_free(s->param);\n    dane_final(&s->dane);\n    CRYPTO_free_ex_data(CRYPTO_EX_INDEX_SSL, s, &s->ex_data);\n    if (s->bbio != NULL) {\n        if (s->bbio == s->wbio) {\n            s->wbio = BIO_pop(s->wbio);\n        }\n        BIO_free(s->bbio);\n        s->bbio = NULL;\n    }\n    BIO_free_all(s->rbio);\n    if (s->wbio != s->rbio)\n        BIO_free_all(s->wbio);\n    BUF_MEM_free(s->init_buf);\n    sk_SSL_CIPHER_free(s->cipher_list);\n    sk_SSL_CIPHER_free(s->cipher_list_by_id);\n    if (s->session != NULL) {\n        ssl_clear_bad_session(s);\n        SSL_SESSION_free(s->session);\n    }\n    clear_ciphers(s);\n    ssl_cert_free(s->cert);\n    OPENSSL_free(s->tlsext_hostname);\n    SSL_CTX_free(s->initial_ctx);\n#ifndef OPENSSL_NO_EC\n    OPENSSL_free(s->tlsext_ecpointformatlist);\n    OPENSSL_free(s->tlsext_ellipticcurvelist);\n#endif\n    sk_X509_EXTENSION_pop_free(s->tlsext_ocsp_exts, X509_EXTENSION_free);\n    sk_OCSP_RESPID_pop_free(s->tlsext_ocsp_ids, OCSP_RESPID_free);\n    OPENSSL_free(s->tlsext_ocsp_resp);\n    OPENSSL_free(s->alpn_client_proto_list);\n    sk_X509_NAME_pop_free(s->client_CA, X509_NAME_free);\n    if (s->method != NULL)\n        s->method->ssl_free(s);\n    RECORD_LAYER_release(&s->rlayer);\n    SSL_CTX_free(s->ctx);\n#if !defined(OPENSSL_NO_NEXTPROTONEG)\n    OPENSSL_free(s->next_proto_negotiated);\n#endif\n#ifndef OPENSSL_NO_SRTP\n    sk_SRTP_PROTECTION_PROFILE_free(s->srtp_profiles);\n#endif\n    OPENSSL_free(s);\n}', 'int ssl_clear_bad_session(SSL *s)\n{\n    if ((s->session != NULL) &&\n        !(s->shutdown & SSL_SENT_SHUTDOWN) &&\n        !(SSL_in_init(s) || SSL_in_before(s))) {\n        SSL_CTX_remove_session(s->ctx, s->session);\n        return (1);\n    } else\n        return (0);\n}', 'int SSL_CTX_remove_session(SSL_CTX *ctx, SSL_SESSION *c)\n{\n    return remove_session_lock(ctx, c, 1);\n}', 'static int remove_session_lock(SSL_CTX *ctx, SSL_SESSION *c, int lck)\n{\n    SSL_SESSION *r;\n    int ret = 0;\n    if ((c != NULL) && (c->session_id_length != 0)) {\n        if (lck)\n            CRYPTO_w_lock(CRYPTO_LOCK_SSL_CTX);\n        if ((r = lh_SSL_SESSION_retrieve(ctx->sessions, c)) == c) {\n            ret = 1;\n            r = lh_SSL_SESSION_delete(ctx->sessions, c);\n            SSL_SESSION_list_remove(ctx, c);\n        }\n        if (lck)\n            CRYPTO_w_unlock(CRYPTO_LOCK_SSL_CTX);\n        if (ret) {\n            r->not_resumable = 1;\n            if (ctx->remove_session_cb != NULL)\n                ctx->remove_session_cb(ctx, r);\n            SSL_SESSION_free(r);\n        }\n    } else\n        ret = 0;\n    return (ret);\n}', 'DEFINE_LHASH_OF(SSL_SESSION)', 'void *lh_delete(_LHASH *lh, const void *data)\n{\n    unsigned long hash;\n    LHASH_NODE *nn, **rn;\n    void *ret;\n    lh->error = 0;\n    rn = getrn(lh, data, &hash);\n    if (*rn == NULL) {\n        lh->num_no_delete++;\n        return (NULL);\n    } else {\n        nn = *rn;\n        *rn = nn->next;\n        ret = nn->data;\n        OPENSSL_free(nn);\n        lh->num_delete++;\n    }\n    lh->num_items--;\n    if ((lh->num_nodes > MIN_NODES) &&\n        (lh->down_load >= (lh->num_items * LH_LOAD_MULT / lh->num_nodes)))\n        contract(lh);\n    return (ret);\n}']