ssl/s3_srvr.c:1403: error: INTEGER_OVERFLOW_L2
  ([0, +oo] - 1):unsigned32 by call to `ssl3_send_alert`.
Showing all 12 steps of the trace


ssl/s3_srvr.c:1217:4: Call
1215.   #endif
1216.   
1217.   	n=ssl3_get_message(s,
           ^
1218.   		SSL3_ST_SR_KEY_EXCH_A,
1219.   		SSL3_ST_SR_KEY_EXCH_B,

ssl/s3_both.c:263:1: Parameter `s->ctx->sessions->p`
  261.   	}
  262.   
  263. > long ssl3_get_message(SSL *s, int st1, int stn, int mt, long max, int *ok)
  264.   	{
  265.   	unsigned char *p;

ssl/s3_srvr.c:1403:2: Call
1401.   	return(1);
1402.   f_err:
1403.   	ssl3_send_alert(s,SSL3_AL_FATAL,al);
         ^
1404.   #if !defined(NO_DH) || !defined(NO_RSA)
1405.   err:

ssl/s3_pkt.c:1022:1: Parameter `s->ctx->sessions->p`
  1020.   	}
  1021.   
  1022. > void ssl3_send_alert(SSL *s, int level, int desc)
  1023.   	{
  1024.   	/* Map tls/ssl alert value to correct one */

ssl/s3_pkt.c:1029:3: Call
  1027.   	/* If a fatal one, remove from cache */
  1028.   	if ((level == 2) && (s->session != NULL))
  1029.   		SSL_CTX_remove_session(s->ctx,s->session);
            ^
  1030.   
  1031.   	s->s3->alert_dispatch=1;

ssl/ssl_sess.c:325:1: Parameter `ctx->sessions->p`
    323.   	}
    324.   
    325. > int SSL_CTX_remove_session(SSL_CTX *ctx, SSL_SESSION *c)
    326.   	{
    327.   	SSL_SESSION *r;

ssl/ssl_sess.c:333:20: Call
    331.   		{
    332.   		CRYPTO_w_lock(CRYPTO_LOCK_SSL_CTX);
    333.   		r=(SSL_SESSION *)lh_delete(ctx->sessions,(char *)c);
                              ^
    334.   		if (r != NULL)
    335.   			{

crypto/lhash/lhash.c:231:1: Parameter `lh->pmax`
      229.   	}
      230.   
      231. > char *lh_delete(LHASH *lh, char *data)
      232.   	{
      233.   	unsigned long hash;

crypto/lhash/lhash.c:257:3: Call
      255.   	if ((lh->num_nodes > MIN_NODES) &&
      256.   		(lh->down_load >= (lh->num_items*LH_LOAD_MULT/lh->num_nodes)))
      257.   		contract(lh);
               ^
      258.   
      259.   	return(ret);

crypto/lhash/lhash.c:366:1: <LHS trace>
364.   	}
365.   
366. > static void contract(LHASH *lh)
367.   	{
368.   	LHASH_NODE **n,*n1,*np;

crypto/lhash/lhash.c:366:1: Parameter `lh->p`
        364.   	}
        365.   
        366. > static void contract(LHASH *lh)
        367.   	{
        368.   	LHASH_NODE **n,*n1,*np;

crypto/lhash/lhash.c:370:5: Binary operation: ([0, +oo] - 1):unsigned32 by call to `ssl3_send_alert` 
        368.   	LHASH_NODE **n,*n1,*np;
        369.   
        370.   	np=lh->b[lh->p+lh->pmax-1];
                   ^
        371.   	lh->b[lh->p+lh->pmax-1]=NULL; /* 24/07-92 - eay - weird but :-( */
        372.   	if (lh->p == 0)

static void contract(LHASH *lh)
	{
	LHASH_NODE **n,*n1,*np;
	np=lh->b[lh->p+lh->pmax-1];
	lh->b[lh->p+lh->pmax-1]=NULL;
	if (lh->p == 0)
		{
		n=(LHASH_NODE **)Realloc((char *)lh->b,
			(unsigned int)(sizeof(LHASH_NODE *)*lh->pmax));
		if (n == NULL)
			{
			lh->error++;
			return;
			}
		lh->num_contract_reallocs++;
		lh->num_alloc_nodes/=2;
		lh->pmax/=2;
		lh->p=lh->pmax-1;
		lh->b=n;
		}
	else
		lh->p--;
	lh->num_nodes--;
	lh->num_contracts++;
	n1=lh->b[(int)lh->p];
	if (n1 == NULL)
		lh->b[(int)lh->p]=np;
	else
		{
		while (n1->next != NULL)
			n1=n1->next;
		n1->next=np;
		}
	}
['static int ssl3_get_client_key_exchange(SSL *s)\n\t{\n\tint i,al,ok;\n\tlong n;\n\tunsigned long l;\n\tunsigned char *p;\n\tRSA *rsa=NULL;\n\tEVP_PKEY *pkey=NULL;\n#ifndef NO_DH\n\tBIGNUM *pub=NULL;\n\tDH *dh_srvr;\n#endif\n\tn=ssl3_get_message(s,\n\t\tSSL3_ST_SR_KEY_EXCH_A,\n\t\tSSL3_ST_SR_KEY_EXCH_B,\n\t\tSSL3_MT_CLIENT_KEY_EXCHANGE,\n\t\t400,\n\t\t&ok);\n\tif (!ok) return((int)n);\n\tp=(unsigned char *)s->init_buf->data;\n\tl=s->s3->tmp.new_cipher->algorithms;\n#ifndef NO_RSA\n\tif (l & SSL_kRSA)\n\t\t{\n\t\tif (s->s3->tmp.use_rsa_tmp)\n\t\t\t{\n\t\t\tif ((s->session->cert != NULL) &&\n\t\t\t\t(s->session->cert->rsa_tmp != NULL))\n\t\t\t\trsa=s->session->cert->rsa_tmp;\n\t\t\telse if ((s->ctx->default_cert != NULL) &&\n\t\t\t\t(s->ctx->default_cert->rsa_tmp != NULL))\n\t\t\t\trsa=s->ctx->default_cert->rsa_tmp;\n\t\t\tif (rsa == NULL)\n\t\t\t\t{\n\t\t\t\tal=SSL_AD_HANDSHAKE_FAILURE;\n\t\t\t\tSSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,SSL_R_MISSING_TMP_RSA_PKEY);\n\t\t\t\tgoto f_err;\n\t\t\t\t}\n\t\t\t}\n\t\telse\n\t\t\t{\n\t\t\tpkey=s->cert->pkeys[SSL_PKEY_RSA_ENC].privatekey;\n\t\t\tif (\t(pkey == NULL) ||\n\t\t\t\t(pkey->type != EVP_PKEY_RSA) ||\n\t\t\t\t(pkey->pkey.rsa == NULL))\n\t\t\t\t{\n\t\t\t\tal=SSL_AD_HANDSHAKE_FAILURE;\n\t\t\t\tSSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,SSL_R_MISSING_RSA_CERTIFICATE);\n\t\t\t\tgoto f_err;\n\t\t\t\t}\n\t\t\trsa=pkey->pkey.rsa;\n\t\t\t}\n\t\tif (s->version > SSL3_VERSION)\n\t\t\t{\n\t\t\tn2s(p,i);\n\t\t\tif (n != i+2)\n\t\t\t\t{\n\t\t\t\tif (!(s->options & SSL_OP_TLS_D5_BUG))\n\t\t\t\t\t{\n\t\t\t\t\tSSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,SSL_R_TLS_RSA_ENCRYPTED_VALUE_LENGTH_IS_WRONG);\n\t\t\t\t\tgoto err;\n\t\t\t\t\t}\n\t\t\t\telse\n\t\t\t\t\tp-=2;\n\t\t\t\t}\n\t\t\telse\n\t\t\t\tn=i;\n\t\t\t}\n\t\ti=RSA_private_decrypt((int)n,p,p,rsa,RSA_PKCS1_PADDING);\n#if 1\n\t\tif ((i != SSL_MAX_MASTER_KEY_LENGTH) ||\n\t\t\t((p[0] != (s->client_version>>8)) ||\n\t\t\t (p[1] != (s->client_version & 0xff))))\n\t\t\t{\n\t\t\tint bad=1;\n\t\t\tif ((i == SSL_MAX_MASTER_KEY_LENGTH) &&\n\t\t\t\t(p[0] == (s->version>>8)) &&\n\t\t\t\t(p[1] == 0))\n\t\t\t\t{\n\t\t\t\tif (s->options & SSL_OP_TLS_ROLLBACK_BUG)\n\t\t\t\t\tbad=0;\n\t\t\t\t}\n\t\t\tif (bad)\n\t\t\t\t{\n\t\t\t\tp[0]=(s->version>>8);\n\t\t\t\tp[1]=(s->version & 0xff);\n\t\t\t\tRAND_bytes(&(p[2]),SSL_MAX_MASTER_KEY_LENGTH-2);\n\t\t\t\ti=SSL_MAX_MASTER_KEY_LENGTH;\n\t\t\t\t}\n\t\t\t}\n#else\n\t\tif (i != SSL_MAX_MASTER_KEY_LENGTH)\n\t\t\t{\n\t\t\tal=SSL_AD_DECODE_ERROR;\n\t\t\tSSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,SSL_R_BAD_RSA_DECRYPT);\n\t\t\tgoto f_err;\n\t\t\t}\n\t\tif ((p[0] != (s->version>>8)) || (p[1] != (s->version & 0xff)))\n\t\t\t{\n\t\t\tal=SSL_AD_DECODE_ERROR;\n\t\t\tSSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,SSL_R_BAD_PROTOCOL_VERSION_NUMBER);\n\t\t\tgoto f_err;\n\t\t\t}\n#endif\n\t\ts->session->master_key_length=\n\t\t\ts->method->ssl3_enc->generate_master_secret(s,\n\t\t\t\ts->session->master_key,\n\t\t\t\tp,i);\n\t\tmemset(p,0,i);\n\t\t}\n\telse\n#endif\n#ifndef NO_DH\n\t\tif (l & (SSL_kEDH|SSL_kDHr|SSL_kDHd))\n\t\t{\n\t\tn2s(p,i);\n\t\tif (n != i+2)\n\t\t\t{\n\t\t\tif (!(s->options & SSL_OP_SSLEAY_080_CLIENT_DH_BUG))\n\t\t\t\t{\n\t\t\t\tSSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,SSL_R_DH_PUBLIC_VALUE_LENGTH_IS_WRONG);\n\t\t\t\tgoto err;\n\t\t\t\t}\n\t\t\telse\n\t\t\t\t{\n\t\t\t\tp-=2;\n\t\t\t\ti=(int)n;\n\t\t\t\t}\n\t\t\t}\n\t\tif (n == 0L)\n\t\t\t{\n\t\t\tal=SSL_AD_HANDSHAKE_FAILURE;\n\t\t\tSSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,SSL_R_UNABLE_TO_DECODE_DH_CERTS);\n\t\t\tgoto f_err;\n\t\t\t}\n\t\telse\n\t\t\t{\n\t\t\tif (s->s3->tmp.dh == NULL)\n\t\t\t\t{\n\t\t\t\tal=SSL_AD_HANDSHAKE_FAILURE;\n\t\t\t\tSSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,SSL_R_MISSING_TMP_DH_KEY);\n\t\t\t\tgoto f_err;\n\t\t\t\t}\n\t\t\telse\n\t\t\t\tdh_srvr=s->s3->tmp.dh;\n\t\t\t}\n\t\tpub=BN_bin2bn(p,i,NULL);\n\t\tif (pub == NULL)\n\t\t\t{\n\t\t\tSSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,SSL_R_BN_LIB);\n\t\t\tgoto err;\n\t\t\t}\n\t\ti=DH_compute_key(p,pub,dh_srvr);\n\t\tif (i <= 0)\n\t\t\t{\n\t\t\tSSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,ERR_R_DH_LIB);\n\t\t\tgoto err;\n\t\t\t}\n\t\tDH_free(s->s3->tmp.dh);\n\t\ts->s3->tmp.dh=NULL;\n\t\tBN_clear_free(pub);\n\t\tpub=NULL;\n\t\ts->session->master_key_length=\n\t\t\ts->method->ssl3_enc->generate_master_secret(s,\n\t\t\t\ts->session->master_key,p,i);\n\t\t}\n\telse\n#endif\n\t\t{\n\t\tal=SSL_AD_HANDSHAKE_FAILURE;\n\t\tSSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,SSL_R_UNKNOWN_CIPHER_TYPE);\n\t\tgoto f_err;\n\t\t}\n\treturn(1);\nf_err:\n\tssl3_send_alert(s,SSL3_AL_FATAL,al);\n#if !defined(NO_DH) || !defined(NO_RSA)\nerr:\n#endif\n\treturn(-1);\n\t}', 'long ssl3_get_message(SSL *s, int st1, int stn, int mt, long max, int *ok)\n\t{\n\tunsigned char *p;\n\tunsigned long l;\n\tlong n;\n\tint i,al;\n\tif (s->s3->tmp.reuse_message)\n\t\t{\n\t\ts->s3->tmp.reuse_message=0;\n\t\tif ((mt >= 0) && (s->s3->tmp.message_type != mt))\n\t\t\t{\n\t\t\tal=SSL_AD_UNEXPECTED_MESSAGE;\n\t\t\tSSLerr(SSL_F_SSL3_GET_MESSAGE,SSL_R_UNEXPECTED_MESSAGE);\n\t\t\tgoto f_err;\n\t\t\t}\n\t\t*ok=1;\n\t\treturn((int)s->s3->tmp.message_size);\n\t\t}\n\tp=(unsigned char *)s->init_buf->data;\n\tif (s->state == st1)\n\t\t{\n\t\ti=ssl3_read_bytes(s,SSL3_RT_HANDSHAKE,\n\t\t\t(char *)&(p[s->init_num]),\n\t\t\t4-s->init_num);\n\t\tif (i < (4-s->init_num))\n\t\t\t{\n\t\t\t*ok=0;\n\t\t\treturn(ssl3_part_read(s,i));\n\t\t\t}\n\t\tif ((mt >= 0) && (*p != mt))\n\t\t\t{\n\t\t\tal=SSL_AD_UNEXPECTED_MESSAGE;\n\t\t\tSSLerr(SSL_F_SSL3_GET_MESSAGE,SSL_R_UNEXPECTED_MESSAGE);\n\t\t\tgoto f_err;\n\t\t\t}\n\t\ts->s3->tmp.message_type= *(p++);\n\t\tn2l3(p,l);\n\t\tif (l > (unsigned long)max)\n\t\t\t{\n\t\t\tal=SSL_AD_ILLEGAL_PARAMETER;\n\t\t\tSSLerr(SSL_F_SSL3_GET_MESSAGE,SSL_R_EXCESSIVE_MESSAGE_SIZE);\n\t\t\tgoto f_err;\n\t\t\t}\n\t\tif (l && !BUF_MEM_grow(s->init_buf,(int)l))\n\t\t\t{\n\t\t\tSSLerr(SSL_F_SSL3_GET_MESSAGE,ERR_R_BUF_LIB);\n\t\t\tgoto err;\n\t\t\t}\n\t\ts->s3->tmp.message_size=l;\n\t\ts->state=stn;\n\t\ts->init_num=0;\n\t\t}\n\tp=(unsigned char *)s->init_buf->data;\n\tn=s->s3->tmp.message_size;\n\tif (n > 0)\n\t\t{\n\t\ti=ssl3_read_bytes(s,SSL3_RT_HANDSHAKE,\n\t\t\t(char *)&(p[s->init_num]),(int)n);\n\t\tif (i != (int)n)\n\t\t\t{\n\t\t\t*ok=0;\n\t\t\treturn(ssl3_part_read(s,i));\n\t\t\t}\n\t\t}\n\t*ok=1;\n\treturn(n);\nf_err:\n\tssl3_send_alert(s,SSL3_AL_FATAL,al);\nerr:\n\t*ok=0;\n\treturn(-1);\n\t}', 'void ssl3_send_alert(SSL *s, int level, int desc)\n\t{\n\tdesc=s->method->ssl3_enc->alert_value(desc);\n\tif (desc < 0) return;\n\tif ((level == 2) && (s->session != NULL))\n\t\tSSL_CTX_remove_session(s->ctx,s->session);\n\ts->s3->alert_dispatch=1;\n\ts->s3->send_alert[0]=level;\n\ts->s3->send_alert[1]=desc;\n\tif (s->s3->wbuf.left == 0)\n\t\tssl3_dispatch_alert(s);\n\t}', 'int SSL_CTX_remove_session(SSL_CTX *ctx, SSL_SESSION *c)\n\t{\n\tSSL_SESSION *r;\n\tint ret=0;\n\tif ((c != NULL) && (c->session_id_length != 0))\n\t\t{\n\t\tCRYPTO_w_lock(CRYPTO_LOCK_SSL_CTX);\n\t\tr=(SSL_SESSION *)lh_delete(ctx->sessions,(char *)c);\n\t\tif (r != NULL)\n\t\t\t{\n\t\t\tret=1;\n\t\t\tSSL_SESSION_list_remove(ctx,c);\n\t\t\t}\n\t\tCRYPTO_w_unlock(CRYPTO_LOCK_SSL_CTX);\n\t\tif (ret)\n\t\t\t{\n\t\t\tr->not_resumable=1;\n\t\t\tif (ctx->remove_session_cb != NULL)\n\t\t\t\tctx->remove_session_cb(ctx,r);\n\t\t\tSSL_SESSION_free(r);\n\t\t\t}\n\t\t}\n\telse\n\t\tret=0;\n\treturn(ret);\n\t}', 'char *lh_delete(LHASH *lh, char *data)\n\t{\n\tunsigned long hash;\n\tLHASH_NODE *nn,**rn;\n\tchar *ret;\n\tlh->error=0;\n\trn=getrn(lh,data,&hash);\n\tif (*rn == NULL)\n\t\t{\n\t\tlh->num_no_delete++;\n\t\treturn(NULL);\n\t\t}\n\telse\n\t\t{\n\t\tnn= *rn;\n\t\t*rn=nn->next;\n\t\tret=nn->data;\n\t\tFree((char *)nn);\n\t\tlh->num_delete++;\n\t\t}\n\tlh->num_items--;\n\tif ((lh->num_nodes > MIN_NODES) &&\n\t\t(lh->down_load >= (lh->num_items*LH_LOAD_MULT/lh->num_nodes)))\n\t\tcontract(lh);\n\treturn(ret);\n\t}', 'static void contract(LHASH *lh)\n\t{\n\tLHASH_NODE **n,*n1,*np;\n\tnp=lh->b[lh->p+lh->pmax-1];\n\tlh->b[lh->p+lh->pmax-1]=NULL;\n\tif (lh->p == 0)\n\t\t{\n\t\tn=(LHASH_NODE **)Realloc((char *)lh->b,\n\t\t\t(unsigned int)(sizeof(LHASH_NODE *)*lh->pmax));\n\t\tif (n == NULL)\n\t\t\t{\n\t\t\tlh->error++;\n\t\t\treturn;\n\t\t\t}\n\t\tlh->num_contract_reallocs++;\n\t\tlh->num_alloc_nodes/=2;\n\t\tlh->pmax/=2;\n\t\tlh->p=lh->pmax-1;\n\t\tlh->b=n;\n\t\t}\n\telse\n\t\tlh->p--;\n\tlh->num_nodes--;\n\tlh->num_contracts++;\n\tn1=lh->b[(int)lh->p];\n\tif (n1 == NULL)\n\t\tlh->b[(int)lh->p]=np;\n\telse\n\t\t{\n\t\twhile (n1->next != NULL)\n\t\t\tn1=n1->next;\n\t\tn1->next=np;\n\t\t}\n\t}']