ssl/s2_clnt.c:208: error: INTEGER_OVERFLOW_L2
  ([1, max(16, `s->s2->challenge_length`)] - [-oo, 190]):unsigned64 by call to `ssl2_enc_init`.
Showing all 11 steps of the trace


ssl/s2_clnt.c:115:1: Parameter `s->s2->challenge_length`
113.   	}
114.   
115. > int ssl2_connect(SSL *s)
116.   	{
117.   	unsigned long l=time(NULL);

ssl/s2_clnt.c:208:9: Call
206.   			/* Ok, we now have all the stuff needed to
207.   			 * start encrypting, so lets fire it up :-) */
208.   			if (!ssl2_enc_init(s,1))
               ^
209.   				{
210.   				ret= -1;

ssl/s2_enc.c:62:1: Parameter `s->s2->challenge_length`
  60.   #include "ssl_locl.h"
  61.   
  62. > int ssl2_enc_init(SSL *s, int client)
  63.   	{
  64.   	/* Max number of bytes needed */

ssl/s2_enc.c:98:2: Call
  96.   	s->s2->key_material_length=num*2;
  97.   
  98.   	ssl2_generate_key_material(s);
          ^
  99.   
  100.   	EVP_EncryptInit(ws,c,&(s->s2->key_material[(client)?num:0]),

ssl/s2_lib.c:357:1: Parameter `s->s2->challenge_length`
    355.   	}
    356.   
    357. > void ssl2_generate_key_material(SSL *s)
    358.   	{
    359.   	unsigned int i;

ssl/s2_lib.c:372:3: Call
    370.   		MD5_Update(&ctx,(unsigned char *)&c,1);
    371.   		c++;
    372.   		MD5_Update(&ctx,s->s2->challenge,s->s2->challenge_length);
             ^
    373.   		MD5_Update(&ctx,s->s2->conn_id,s->s2->conn_id_length);
    374.   		MD5_Final(km,&ctx);

crypto/md5/md5_dgst.c:100:1: <LHS trace>
98.   	}
99.   
100. > void MD5_Update(MD5_CTX *c, const void *_data, unsigned long len)
101.   	{
102.   	register const unsigned char *data=_data;

crypto/md5/md5_dgst.c:100:1: Parameter `len`
      98.   	}
      99.   
      100. > void MD5_Update(MD5_CTX *c, const void *_data, unsigned long len)
      101.   	{
      102.   	register const unsigned char *data=_data;

crypto/md5/md5_dgst.c:100:1: <RHS trace>
98.   	}
99.   
100. > void MD5_Update(MD5_CTX *c, const void *_data, unsigned long len)
101.   	{
102.   	register const unsigned char *data=_data;

crypto/md5/md5_dgst.c:100:1: Parameter `len`
      98.   	}
      99.   
      100. > void MD5_Update(MD5_CTX *c, const void *_data, unsigned long len)
      101.   	{
      102.   	register const unsigned char *data=_data;

crypto/md5/md5_dgst.c:133:4: Binary operation: ([1, max(16, s->s2->challenge_length)] - [-oo, 190]):unsigned64 by call to `ssl2_enc_init` 
      131.   				p[sw]=l;
      132.   				}
      133.   			len-=(MD5_CBLOCK-c->num);
                ^
      134.   
      135.   			md5_block(c,p,64);

void MD5_Update(MD5_CTX *c, const void *_data, unsigned long len)
	{
	register const unsigned char *data=_data;
	register ULONG *p;
	int sw,sc;
	ULONG l;
	if (len == 0) return;
	l=(c->Nl+(len<<3))&0xffffffffL;
	if (l < c->Nl)
		c->Nh++;
	c->Nh+=(len>>29);
	c->Nl=l;
	if (c->num != 0)
		{
		p=c->data;
		sw=c->num>>2;
		sc=c->num&0x03;
		if ((c->num+len) >= MD5_CBLOCK)
			{
			l= p[sw];
			p_c2l(data,l,sc);
			p[sw++]=l;
			for (; sw<MD5_LBLOCK; sw++)
				{
				c2l(data,l);
				p[sw]=l;
				}
			len-=(MD5_CBLOCK-c->num);
			md5_block(c,p,64);
			c->num=0;
			}
		else
			{
			int ew,ec;
			c->num+=(int)len;
			if ((sc+len) < 4)
				{
				l= p[sw];
				p_c2l_p(data,l,sc,len);
				p[sw]=l;
				}
			else
				{
				ew=(c->num>>2);
				ec=(c->num&0x03);
				l= p[sw];
				p_c2l(data,l,sc);
				p[sw++]=l;
				for (; sw < ew; sw++)
					{ c2l(data,l); p[sw]=l; }
				if (ec)
					{
					c2l_p(data,l,ec);
					p[sw]=l;
					}
				}
			return;
			}
		}
#ifdef L_ENDIAN
	if ((((unsigned long)data)%sizeof(ULONG)) == 0)
		{
		sw=(int)len/MD5_CBLOCK;
		if (sw > 0)
			{
			sw*=MD5_CBLOCK;
			md5_block(c,(ULONG *)data,sw);
			data+=sw;
			len-=sw;
			}
		}
#endif
	p=c->data;
	while (len >= MD5_CBLOCK)
		{
#if defined(L_ENDIAN) || defined(B_ENDIAN)
		if (p != (unsigned long *)data)
			memcpy(p,data,MD5_CBLOCK);
		data+=MD5_CBLOCK;
#ifdef B_ENDIAN
		for (sw=(MD5_LBLOCK/4); sw; sw--)
			{
			Endian_Reverse32(p[0]);
			Endian_Reverse32(p[1]);
			Endian_Reverse32(p[2]);
			Endian_Reverse32(p[3]);
			p+=4;
			}
#endif
#else
		for (sw=(MD5_LBLOCK/4); sw; sw--)
			{
			c2l(data,l); *(p++)=l;
			c2l(data,l); *(p++)=l;
			c2l(data,l); *(p++)=l;
			c2l(data,l); *(p++)=l;
			}
#endif
		p=c->data;
		md5_block(c,p,64);
		len-=MD5_CBLOCK;
		}
	sc=(int)len;
	c->num=sc;
	if (sc)
		{
		sw=sc>>2;
#ifdef L_ENDIAN
		p[sw]=0;
		memcpy(p,data,sc);
#else
		sc&=0x03;
		for ( ; sw; sw--)
			{ c2l(data,l); *(p++)=l; }
		c2l_p(data,l,sc);
		*p=l;
#endif
		}
	}
['int ssl2_connect(SSL *s)\n\t{\n\tunsigned long l=time(NULL);\n\tBUF_MEM *buf=NULL;\n\tint ret= -1;\n\tvoid (*cb)()=NULL;\n\tint new_state,state;\n\tRAND_seed(&l,sizeof(l));\n\tERR_clear_error();\n\tclear_sys_error();\n\tif (s->info_callback != NULL)\n\t\tcb=s->info_callback;\n\telse if (s->ctx->info_callback != NULL)\n\t\tcb=s->ctx->info_callback;\n\tif (!SSL_in_init(s) || SSL_in_before(s)) SSL_clear(s);\n\ts->in_handshake++;\n\tfor (;;)\n\t\t{\n\t\tstate=s->state;\n\t\tswitch (s->state)\n\t\t\t{\n\t\tcase SSL_ST_BEFORE:\n\t\tcase SSL_ST_CONNECT:\n\t\tcase SSL_ST_BEFORE|SSL_ST_CONNECT:\n\t\tcase SSL_ST_OK|SSL_ST_CONNECT:\n\t\t\ts->server=0;\n\t\t\tif (cb != NULL) cb(s,SSL_CB_HANDSHAKE_START,1);\n\t\t\ts->version=SSL2_VERSION;\n\t\t\ts->type=SSL_ST_CONNECT;\n\t\t\tbuf=s->init_buf;\n\t\t\tif ((buf == NULL) && ((buf=BUF_MEM_new()) == NULL))\n\t\t\t\t{\n\t\t\t\tret= -1;\n\t\t\t\tgoto end;\n\t\t\t\t}\n\t\t\tif (!BUF_MEM_grow(buf,\n\t\t\t\tSSL2_MAX_RECORD_LENGTH_3_BYTE_HEADER))\n\t\t\t\t{\n\t\t\t\tret= -1;\n\t\t\t\tgoto end;\n\t\t\t\t}\n\t\t\ts->init_buf=buf;\n\t\t\ts->init_num=0;\n\t\t\ts->state=SSL2_ST_SEND_CLIENT_HELLO_A;\n\t\t\ts->ctx->stats.sess_connect++;\n\t\t\ts->handshake_func=ssl2_connect;\n\t\t\tBREAK;\n\t\tcase SSL2_ST_SEND_CLIENT_HELLO_A:\n\t\tcase SSL2_ST_SEND_CLIENT_HELLO_B:\n\t\t\ts->shutdown=0;\n\t\t\tret=client_hello(s);\n\t\t\tif (ret <= 0) goto end;\n\t\t\ts->init_num=0;\n\t\t\ts->state=SSL2_ST_GET_SERVER_HELLO_A;\n\t\t\tBREAK;\n\t\tcase SSL2_ST_GET_SERVER_HELLO_A:\n\t\tcase SSL2_ST_GET_SERVER_HELLO_B:\n\t\t\tret=get_server_hello(s);\n\t\t\tif (ret <= 0) goto end;\n\t\t\ts->init_num=0;\n\t\t\tif (!s->hit)\n\t\t\t\t{\n\t\t\t\ts->state=SSL2_ST_SEND_CLIENT_MASTER_KEY_A;\n\t\t\t\tBREAK;\n\t\t\t\t}\n\t\t\telse\n\t\t\t\t{\n\t\t\t\ts->state=SSL2_ST_CLIENT_START_ENCRYPTION;\n\t\t\t\tbreak;\n\t\t\t\t}\n\t\tcase SSL2_ST_SEND_CLIENT_MASTER_KEY_A:\n\t\tcase SSL2_ST_SEND_CLIENT_MASTER_KEY_B:\n\t\t\tret=client_master_key(s);\n\t\t\tif (ret <= 0) goto end;\n\t\t\ts->init_num=0;\n\t\t\ts->state=SSL2_ST_CLIENT_START_ENCRYPTION;\n\t\t\tbreak;\n\t\tcase SSL2_ST_CLIENT_START_ENCRYPTION:\n\t\t\tif (!ssl2_enc_init(s,1))\n\t\t\t\t{\n\t\t\t\tret= -1;\n\t\t\t\tgoto end;\n\t\t\t\t}\n\t\t\ts->s2->clear_text=0;\n\t\t\ts->state=SSL2_ST_SEND_CLIENT_FINISHED_A;\n\t\t\tbreak;\n\t\tcase SSL2_ST_SEND_CLIENT_FINISHED_A:\n\t\tcase SSL2_ST_SEND_CLIENT_FINISHED_B:\n\t\t\tret=client_finished(s);\n\t\t\tif (ret <= 0) goto end;\n\t\t\ts->init_num=0;\n\t\t\ts->state=SSL2_ST_GET_SERVER_VERIFY_A;\n\t\t\tbreak;\n\t\tcase SSL2_ST_GET_SERVER_VERIFY_A:\n\t\tcase SSL2_ST_GET_SERVER_VERIFY_B:\n\t\t\tret=get_server_verify(s);\n\t\t\tif (ret <= 0) goto end;\n\t\t\ts->init_num=0;\n\t\t\ts->state=SSL2_ST_GET_SERVER_FINISHED_A;\n\t\t\tbreak;\n\t\tcase SSL2_ST_GET_SERVER_FINISHED_A:\n\t\tcase SSL2_ST_GET_SERVER_FINISHED_B:\n\t\t\tret=get_server_finished(s);\n\t\t\tif (ret <= 0) goto end;\n\t\t\tbreak;\n\t\tcase SSL2_ST_SEND_CLIENT_CERTIFICATE_A:\n\t\tcase SSL2_ST_SEND_CLIENT_CERTIFICATE_B:\n\t\tcase SSL2_ST_SEND_CLIENT_CERTIFICATE_C:\n\t\tcase SSL2_ST_SEND_CLIENT_CERTIFICATE_D:\n\t\tcase SSL2_ST_X509_GET_CLIENT_CERTIFICATE:\n\t\t\tret=client_certificate(s);\n\t\t\tif (ret <= 0) goto end;\n\t\t\ts->init_num=0;\n\t\t\ts->state=SSL2_ST_GET_SERVER_FINISHED_A;\n\t\t\tbreak;\n\t\tcase SSL_ST_OK:\n\t\t\tif (s->init_buf != NULL)\n\t\t\t\t{\n\t\t\t\tBUF_MEM_free(s->init_buf);\n\t\t\t\ts->init_buf=NULL;\n\t\t\t\t}\n\t\t\ts->init_num=0;\n\t\t\tssl_update_cache(s,SSL_SESS_CACHE_CLIENT);\n\t\t\tif (s->hit) s->ctx->stats.sess_hit++;\n\t\t\tret=1;\n\t\t\ts->ctx->stats.sess_connect_good++;\n\t\t\tif (cb != NULL) cb(s,SSL_CB_HANDSHAKE_DONE,1);\n\t\t\tgoto end;\n\t\tdefault:\n\t\t\tSSLerr(SSL_F_SSL2_CONNECT,SSL_R_UNKNOWN_STATE);\n\t\t\treturn(-1);\n\t\t\t}\n\t\tif ((cb != NULL) && (s->state != state))\n\t\t\t{\n\t\t\tnew_state=s->state;\n\t\t\ts->state=state;\n\t\t\tcb(s,SSL_CB_CONNECT_LOOP,1);\n\t\t\ts->state=new_state;\n\t\t\t}\n\t\t}\nend:\n\ts->in_handshake--;\n\tif (cb != NULL)\n\t\tcb(s,SSL_CB_CONNECT_EXIT,ret);\n\treturn(ret);\n\t}', 'int ssl2_enc_init(SSL *s, int client)\n\t{\n\tEVP_CIPHER_CTX *rs,*ws;\n\tconst EVP_CIPHER *c;\n\tconst EVP_MD *md;\n\tint num;\n\tif (!ssl_cipher_get_evp(s->session,&c,&md,NULL))\n\t\t{\n\t\tssl2_return_error(s,SSL2_PE_NO_CIPHER);\n\t\tSSLerr(SSL_F_SSL2_ENC_INIT,SSL_R_PROBLEMS_MAPPING_CIPHER_FUNCTIONS);\n\t\treturn(0);\n\t\t}\n\ts->read_hash=md;\n\ts->write_hash=md;\n\tif ((s->enc_read_ctx == NULL) &&\n\t\t((s->enc_read_ctx=(EVP_CIPHER_CTX *)\n\t\tMalloc(sizeof(EVP_CIPHER_CTX))) == NULL))\n\t\tgoto err;\n\tif ((s->enc_write_ctx == NULL) &&\n\t\t((s->enc_write_ctx=(EVP_CIPHER_CTX *)\n\t\tMalloc(sizeof(EVP_CIPHER_CTX))) == NULL))\n\t\tgoto err;\n\trs= s->enc_read_ctx;\n\tws= s->enc_write_ctx;\n\tEVP_CIPHER_CTX_init(rs);\n\tEVP_CIPHER_CTX_init(ws);\n\tnum=c->key_len;\n\ts->s2->key_material_length=num*2;\n\tssl2_generate_key_material(s);\n\tEVP_EncryptInit(ws,c,&(s->s2->key_material[(client)?num:0]),\n\t\ts->session->key_arg);\n\tEVP_DecryptInit(rs,c,&(s->s2->key_material[(client)?0:num]),\n\t\ts->session->key_arg);\n\ts->s2->read_key=  &(s->s2->key_material[(client)?0:num]);\n\ts->s2->write_key= &(s->s2->key_material[(client)?num:0]);\n\treturn(1);\nerr:\n\tSSLerr(SSL_F_SSL2_ENC_INIT,ERR_R_MALLOC_FAILURE);\n\treturn(0);\n\t}', "void ssl2_generate_key_material(SSL *s)\n\t{\n\tunsigned int i;\n\tMD5_CTX ctx;\n\tunsigned char *km;\n\tunsigned char c='0';\n\tkm=s->s2->key_material;\n\tfor (i=0; i<s->s2->key_material_length; i+=MD5_DIGEST_LENGTH)\n\t\t{\n\t\tMD5_Init(&ctx);\n\t\tMD5_Update(&ctx,s->session->master_key,s->session->master_key_length);\n\t\tMD5_Update(&ctx,(unsigned char *)&c,1);\n\t\tc++;\n\t\tMD5_Update(&ctx,s->s2->challenge,s->s2->challenge_length);\n\t\tMD5_Update(&ctx,s->s2->conn_id,s->s2->conn_id_length);\n\t\tMD5_Final(km,&ctx);\n\t\tkm+=MD5_DIGEST_LENGTH;\n\t\t}\n\t}", 'void MD5_Update(MD5_CTX *c, const void *_data, unsigned long len)\n\t{\n\tregister const unsigned char *data=_data;\n\tregister ULONG *p;\n\tint sw,sc;\n\tULONG l;\n\tif (len == 0) return;\n\tl=(c->Nl+(len<<3))&0xffffffffL;\n\tif (l < c->Nl)\n\t\tc->Nh++;\n\tc->Nh+=(len>>29);\n\tc->Nl=l;\n\tif (c->num != 0)\n\t\t{\n\t\tp=c->data;\n\t\tsw=c->num>>2;\n\t\tsc=c->num&0x03;\n\t\tif ((c->num+len) >= MD5_CBLOCK)\n\t\t\t{\n\t\t\tl= p[sw];\n\t\t\tp_c2l(data,l,sc);\n\t\t\tp[sw++]=l;\n\t\t\tfor (; sw<MD5_LBLOCK; sw++)\n\t\t\t\t{\n\t\t\t\tc2l(data,l);\n\t\t\t\tp[sw]=l;\n\t\t\t\t}\n\t\t\tlen-=(MD5_CBLOCK-c->num);\n\t\t\tmd5_block(c,p,64);\n\t\t\tc->num=0;\n\t\t\t}\n\t\telse\n\t\t\t{\n\t\t\tint ew,ec;\n\t\t\tc->num+=(int)len;\n\t\t\tif ((sc+len) < 4)\n\t\t\t\t{\n\t\t\t\tl= p[sw];\n\t\t\t\tp_c2l_p(data,l,sc,len);\n\t\t\t\tp[sw]=l;\n\t\t\t\t}\n\t\t\telse\n\t\t\t\t{\n\t\t\t\tew=(c->num>>2);\n\t\t\t\tec=(c->num&0x03);\n\t\t\t\tl= p[sw];\n\t\t\t\tp_c2l(data,l,sc);\n\t\t\t\tp[sw++]=l;\n\t\t\t\tfor (; sw < ew; sw++)\n\t\t\t\t\t{ c2l(data,l); p[sw]=l; }\n\t\t\t\tif (ec)\n\t\t\t\t\t{\n\t\t\t\t\tc2l_p(data,l,ec);\n\t\t\t\t\tp[sw]=l;\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\treturn;\n\t\t\t}\n\t\t}\n#ifdef L_ENDIAN\n\tif ((((unsigned long)data)%sizeof(ULONG)) == 0)\n\t\t{\n\t\tsw=(int)len/MD5_CBLOCK;\n\t\tif (sw > 0)\n\t\t\t{\n\t\t\tsw*=MD5_CBLOCK;\n\t\t\tmd5_block(c,(ULONG *)data,sw);\n\t\t\tdata+=sw;\n\t\t\tlen-=sw;\n\t\t\t}\n\t\t}\n#endif\n\tp=c->data;\n\twhile (len >= MD5_CBLOCK)\n\t\t{\n#if defined(L_ENDIAN) || defined(B_ENDIAN)\n\t\tif (p != (unsigned long *)data)\n\t\t\tmemcpy(p,data,MD5_CBLOCK);\n\t\tdata+=MD5_CBLOCK;\n#ifdef B_ENDIAN\n\t\tfor (sw=(MD5_LBLOCK/4); sw; sw--)\n\t\t\t{\n\t\t\tEndian_Reverse32(p[0]);\n\t\t\tEndian_Reverse32(p[1]);\n\t\t\tEndian_Reverse32(p[2]);\n\t\t\tEndian_Reverse32(p[3]);\n\t\t\tp+=4;\n\t\t\t}\n#endif\n#else\n\t\tfor (sw=(MD5_LBLOCK/4); sw; sw--)\n\t\t\t{\n\t\t\tc2l(data,l); *(p++)=l;\n\t\t\tc2l(data,l); *(p++)=l;\n\t\t\tc2l(data,l); *(p++)=l;\n\t\t\tc2l(data,l); *(p++)=l;\n\t\t\t}\n#endif\n\t\tp=c->data;\n\t\tmd5_block(c,p,64);\n\t\tlen-=MD5_CBLOCK;\n\t\t}\n\tsc=(int)len;\n\tc->num=sc;\n\tif (sc)\n\t\t{\n\t\tsw=sc>>2;\n#ifdef L_ENDIAN\n\t\tp[sw]=0;\n\t\tmemcpy(p,data,sc);\n#else\n\t\tsc&=0x03;\n\t\tfor ( ; sw; sw--)\n\t\t\t{ c2l(data,l); *(p++)=l; }\n\t\tc2l_p(data,l,sc);\n\t\t*p=l;\n#endif\n\t\t}\n\t}']