ssl/ssl_lib.c:580: error: INTEGER_OVERFLOW_L2
  ([0, max(0, `s->ctx->sessions->num_nodes`)] - 1):unsigned32 by call to `SSL_CTX_free`.
Showing all 11 steps of the trace


ssl/ssl_lib.c:510:1: Parameter `s->ctx->sessions->num_nodes`
508.   }
509.   
510. > void SSL_free(SSL *s)
511.   {
512.       int i;

ssl/ssl_lib.c:580:5: Call
578.       RECORD_LAYER_release(&s->rlayer);
579.   
580.       SSL_CTX_free(s->ctx);
           ^
581.   
582.   #if !defined(OPENSSL_NO_NEXTPROTONEG)

ssl/ssl_lib.c:1829:1: Parameter `a->sessions->num_nodes`
  1827.   }
  1828.   
  1829. > void SSL_CTX_free(SSL_CTX *a)
  1830.   {
  1831.       int i;

ssl/ssl_lib.c:1861:9: Call
  1859.        */
  1860.       if (a->sessions != NULL)
  1861.           SSL_CTX_flush_sessions(a, 0);
                  ^
  1862.   
  1863.       CRYPTO_free_ex_data(CRYPTO_EX_INDEX_SSL_CTX, a, &a->ex_data);

ssl/ssl_sess.c:1067:1: Parameter `s->sessions->num_nodes`
    1065.   static IMPLEMENT_LHASH_DOALL_ARG_FN(timeout, SSL_SESSION, TIMEOUT_PARAM)
    1066.   
    1067. > void SSL_CTX_flush_sessions(SSL_CTX *s, long t)
    1068.   {
    1069.       unsigned long i;

ssl/ssl_sess.c:1080:5: Call
    1078.       i = CHECKED_LHASH_OF(SSL_SESSION, tp.cache)->down_load;
    1079.       CHECKED_LHASH_OF(SSL_SESSION, tp.cache)->down_load = 0;
    1080.       lh_SSL_SESSION_doall_arg(tp.cache, LHASH_DOALL_ARG_FN(timeout),
                ^
    1081.                                TIMEOUT_PARAM, &tp);
    1082.       CHECKED_LHASH_OF(SSL_SESSION, tp.cache)->down_load = i;

crypto/lhash/lhash.c:294:1: Parameter `lh->num_nodes`
      292.   }
      293.   
      294. > void lh_doall_arg(_LHASH *lh, LHASH_DOALL_ARG_FN_TYPE func, void *arg)
      295.   {
      296.       doall_util_fn(lh, 1, (LHASH_DOALL_FN_TYPE)0, func, arg);

crypto/lhash/lhash.c:296:5: Call
      294.   void lh_doall_arg(_LHASH *lh, LHASH_DOALL_ARG_FN_TYPE func, void *arg)
      295.   {
      296.       doall_util_fn(lh, 1, (LHASH_DOALL_FN_TYPE)0, func, arg);
                 ^
      297.   }
      298.   

crypto/lhash/lhash.c:256:1: <LHS trace>
254.   }
255.   
256. > static void doall_util_fn(_LHASH *lh, int use_arg, LHASH_DOALL_FN_TYPE func,
257.                             LHASH_DOALL_ARG_FN_TYPE func_arg, void *arg)
258.   {

crypto/lhash/lhash.c:256:1: Parameter `lh->num_nodes`
        254.   }
        255.   
        256. > static void doall_util_fn(_LHASH *lh, int use_arg, LHASH_DOALL_FN_TYPE func,
        257.                             LHASH_DOALL_ARG_FN_TYPE func_arg, void *arg)
        258.   {

crypto/lhash/lhash.c:269:10: Binary operation: ([0, max(0, s->ctx->sessions->num_nodes)] - 1):unsigned32 by call to `SSL_CTX_free` 
        267.        * memory leaks otherwise
        268.        */
        269.       for (i = lh->num_nodes - 1; i >= 0; i--) {
                        ^
        270.           a = lh->b[i];
        271.           while (a != NULL) {

static void doall_util_fn(_LHASH *lh, int use_arg, LHASH_DOALL_FN_TYPE func,
                          LHASH_DOALL_ARG_FN_TYPE func_arg, void *arg)
{
    int i;
    LHASH_NODE *a, *n;
    if (lh == NULL)
        return;
    for (i = lh->num_nodes - 1; i >= 0; i--) {
        a = lh->b[i];
        while (a != NULL) {
            n = a->next;
            if (use_arg)
                func_arg(a->data, arg);
            else
                func(a->data);
            a = n;
        }
    }
}
['void SSL_free(SSL *s)\n{\n    int i;\n    if (s == NULL)\n        return;\n    i = CRYPTO_add(&s->references, -1, CRYPTO_LOCK_SSL);\n#ifdef REF_PRINT\n    REF_PRINT("SSL", s);\n#endif\n    if (i > 0)\n        return;\n#ifdef REF_CHECK\n    if (i < 0) {\n        fprintf(stderr, "SSL_free, bad reference count\\n");\n        abort();\n    }\n#endif\n    X509_VERIFY_PARAM_free(s->param);\n    CRYPTO_free_ex_data(CRYPTO_EX_INDEX_SSL, s, &s->ex_data);\n    if (s->bbio != NULL) {\n        if (s->bbio == s->wbio) {\n            s->wbio = BIO_pop(s->wbio);\n        }\n        BIO_free(s->bbio);\n        s->bbio = NULL;\n    }\n    BIO_free_all(s->rbio);\n    if (s->wbio != s->rbio)\n        BIO_free_all(s->wbio);\n    BUF_MEM_free(s->init_buf);\n    sk_SSL_CIPHER_free(s->cipher_list);\n    sk_SSL_CIPHER_free(s->cipher_list_by_id);\n    if (s->session != NULL) {\n        ssl_clear_bad_session(s);\n        SSL_SESSION_free(s->session);\n    }\n    clear_ciphers(s);\n    ssl_cert_free(s->cert);\n    OPENSSL_free(s->tlsext_hostname);\n    SSL_CTX_free(s->initial_ctx);\n#ifndef OPENSSL_NO_EC\n    OPENSSL_free(s->tlsext_ecpointformatlist);\n    OPENSSL_free(s->tlsext_ellipticcurvelist);\n#endif\n    sk_X509_EXTENSION_pop_free(s->tlsext_ocsp_exts, X509_EXTENSION_free);\n    sk_OCSP_RESPID_pop_free(s->tlsext_ocsp_ids, OCSP_RESPID_free);\n    OPENSSL_free(s->tlsext_ocsp_resp);\n    OPENSSL_free(s->alpn_client_proto_list);\n    sk_X509_NAME_pop_free(s->client_CA, X509_NAME_free);\n    if (s->method != NULL)\n        s->method->ssl_free(s);\n    RECORD_LAYER_release(&s->rlayer);\n    SSL_CTX_free(s->ctx);\n#if !defined(OPENSSL_NO_NEXTPROTONEG)\n    OPENSSL_free(s->next_proto_negotiated);\n#endif\n#ifndef OPENSSL_NO_SRTP\n    sk_SRTP_PROTECTION_PROFILE_free(s->srtp_profiles);\n#endif\n    OPENSSL_free(s);\n}', 'void SSL_CTX_free(SSL_CTX *a)\n{\n    int i;\n    if (a == NULL)\n        return;\n    i = CRYPTO_add(&a->references, -1, CRYPTO_LOCK_SSL_CTX);\n#ifdef REF_PRINT\n    REF_PRINT("SSL_CTX", a);\n#endif\n    if (i > 0)\n        return;\n#ifdef REF_CHECK\n    if (i < 0) {\n        fprintf(stderr, "SSL_CTX_free, bad reference count\\n");\n        abort();\n    }\n#endif\n    X509_VERIFY_PARAM_free(a->param);\n    if (a->sessions != NULL)\n        SSL_CTX_flush_sessions(a, 0);\n    CRYPTO_free_ex_data(CRYPTO_EX_INDEX_SSL_CTX, a, &a->ex_data);\n    lh_SSL_SESSION_free(a->sessions);\n    X509_STORE_free(a->cert_store);\n    sk_SSL_CIPHER_free(a->cipher_list);\n    sk_SSL_CIPHER_free(a->cipher_list_by_id);\n    ssl_cert_free(a->cert);\n    sk_X509_NAME_pop_free(a->client_CA, X509_NAME_free);\n    sk_X509_pop_free(a->extra_certs, X509_free);\n    a->comp_methods = NULL;\n#ifndef OPENSSL_NO_SRTP\n    sk_SRTP_PROTECTION_PROFILE_free(a->srtp_profiles);\n#endif\n#ifndef OPENSSL_NO_PSK\n    OPENSSL_free(a->psk_identity_hint);\n#endif\n#ifndef OPENSSL_NO_SRP\n    SSL_CTX_SRP_CTX_free(a);\n#endif\n#ifndef OPENSSL_NO_ENGINE\n    if (a->client_cert_engine)\n        ENGINE_finish(a->client_cert_engine);\n#endif\n#ifndef OPENSSL_NO_EC\n    OPENSSL_free(a->tlsext_ecpointformatlist);\n    OPENSSL_free(a->tlsext_ellipticcurvelist);\n#endif\n    OPENSSL_free(a->alpn_client_proto_list);\n    OPENSSL_free(a);\n}', 'void SSL_CTX_flush_sessions(SSL_CTX *s, long t)\n{\n    unsigned long i;\n    TIMEOUT_PARAM tp;\n    tp.ctx = s;\n    tp.cache = s->sessions;\n    if (tp.cache == NULL)\n        return;\n    tp.time = t;\n    CRYPTO_w_lock(CRYPTO_LOCK_SSL_CTX);\n    i = CHECKED_LHASH_OF(SSL_SESSION, tp.cache)->down_load;\n    CHECKED_LHASH_OF(SSL_SESSION, tp.cache)->down_load = 0;\n    lh_SSL_SESSION_doall_arg(tp.cache, LHASH_DOALL_ARG_FN(timeout),\n                             TIMEOUT_PARAM, &tp);\n    CHECKED_LHASH_OF(SSL_SESSION, tp.cache)->down_load = i;\n    CRYPTO_w_unlock(CRYPTO_LOCK_SSL_CTX);\n}', 'void lh_doall_arg(_LHASH *lh, LHASH_DOALL_ARG_FN_TYPE func, void *arg)\n{\n    doall_util_fn(lh, 1, (LHASH_DOALL_FN_TYPE)0, func, arg);\n}', 'static void doall_util_fn(_LHASH *lh, int use_arg, LHASH_DOALL_FN_TYPE func,\n                          LHASH_DOALL_ARG_FN_TYPE func_arg, void *arg)\n{\n    int i;\n    LHASH_NODE *a, *n;\n    if (lh == NULL)\n        return;\n    for (i = lh->num_nodes - 1; i >= 0; i--) {\n        a = lh->b[i];\n        while (a != NULL) {\n            n = a->next;\n            if (use_arg)\n                func_arg(a->data, arg);\n            else\n                func(a->data);\n            a = n;\n        }\n    }\n}']