apps/ocsp.c:1308: error: INTEGER_OVERFLOW_L2
  ([0, 8] - 1):unsigned32 by call to `SSL_CTX_free`.
Showing all 16 steps of the trace


apps/ocsp.c:1293:15: Call
1291.       if (use_ssl == 1) {
1292.           BIO *sbio;
1293.           ctx = SSL_CTX_new(TLS_client_method());
                      ^
1294.           if (ctx == NULL) {
1295.               BIO_printf(bio_err, "Error creating SSL context.\n");

ssl/ssl_lib.c:2267:21: Call
  2265.           goto err;
  2266.   
  2267.       ret->sessions = lh_SSL_SESSION_new(ssl_session_hash, ssl_session_cmp);
                              ^
  2268.       if (ret->sessions == NULL)
  2269.           goto err;

ssl/ssl_locl.h:697:1: Call
    695.   
    696.   DEFINE_STACK_OF(SSL_COMP)
    697. > DEFINE_LHASH_OF(SSL_SESSION);
    698.   
    699.   

crypto/lhash/lhash.c:123:5: Assignment
      121.       ret->comp = ((c == NULL) ? (LHASH_COMP_FN_TYPE)strcmp : c);
      122.       ret->hash = ((h == NULL) ? (LHASH_HASH_FN_TYPE)lh_strhash : h);
      123.       ret->num_nodes = MIN_NODES / 2;
                 ^
      124.       ret->num_alloc_nodes = MIN_NODES;
      125.       ret->pmax = MIN_NODES / 2;

apps/ocsp.c:1308:5: Call
1306.    end:
1307.       BIO_free_all(cbio);
1308.       SSL_CTX_free(ctx);
            ^
1309.       return resp;
1310.   }

ssl/ssl_lib.c:2348:1: Parameter `a->sessions->num_nodes`
  2346.   }
  2347.   
  2348. > void SSL_CTX_free(SSL_CTX *a)
  2349.   {
  2350.       int i;

ssl/ssl_lib.c:2381:9: Call
  2379.        */
  2380.       if (a->sessions != NULL)
  2381.           SSL_CTX_flush_sessions(a, 0);
                  ^
  2382.   
  2383.       CRYPTO_free_ex_data(CRYPTO_EX_INDEX_SSL_CTX, a, &a->ex_data);

ssl/ssl_sess.c:1065:1: Parameter `s->sessions->num_nodes`
    1063.   IMPLEMENT_LHASH_DOALL_ARG(SSL_SESSION, TIMEOUT_PARAM);
    1064.   
    1065. > void SSL_CTX_flush_sessions(SSL_CTX *s, long t)
    1066.   {
    1067.       unsigned long i;

ssl/ssl_sess.c:1078:5: Call
    1076.       i = CHECKED_LHASH_OF(SSL_SESSION, tp.cache)->down_load;
    1077.       CHECKED_LHASH_OF(SSL_SESSION, tp.cache)->down_load = 0;
    1078.       lh_SSL_SESSION_doall_TIMEOUT_PARAM(tp.cache, timeout_cb, &tp);
                ^
    1079.       CHECKED_LHASH_OF(SSL_SESSION, tp.cache)->down_load = i;
    1080.       CRYPTO_w_unlock(CRYPTO_LOCK_SSL_CTX);

ssl/ssl_sess.c:1063:1: Parameter `lh->num_nodes`
      1061.   }
      1062.   
      1063. > IMPLEMENT_LHASH_DOALL_ARG(SSL_SESSION, TIMEOUT_PARAM);
      1064.   
      1065.   void SSL_CTX_flush_sessions(SSL_CTX *s, long t)

ssl/ssl_sess.c:1063:1: Call
      1061.   }
      1062.   
      1063. > IMPLEMENT_LHASH_DOALL_ARG(SSL_SESSION, TIMEOUT_PARAM);
      1064.   
      1065.   void SSL_CTX_flush_sessions(SSL_CTX *s, long t)

crypto/lhash/lhash.c:274:1: Parameter `lh->num_nodes`
        272.   }
        273.   
        274. > void lh_doall_arg(_LHASH *lh, LHASH_DOALL_ARG_FN_TYPE func, void *arg)
        275.   {
        276.       doall_util_fn(lh, 1, (LHASH_DOALL_FN_TYPE)0, func, arg);

crypto/lhash/lhash.c:276:5: Call
        274.   void lh_doall_arg(_LHASH *lh, LHASH_DOALL_ARG_FN_TYPE func, void *arg)
        275.   {
        276.       doall_util_fn(lh, 1, (LHASH_DOALL_FN_TYPE)0, func, arg);
                   ^
        277.   }
        278.   

crypto/lhash/lhash.c:236:1: <LHS trace>
234.   }
235.   
236. > static void doall_util_fn(_LHASH *lh, int use_arg, LHASH_DOALL_FN_TYPE func,
237.                             LHASH_DOALL_ARG_FN_TYPE func_arg, void *arg)
238.   {

crypto/lhash/lhash.c:236:1: Parameter `lh->num_nodes`
          234.   }
          235.   
          236. > static void doall_util_fn(_LHASH *lh, int use_arg, LHASH_DOALL_FN_TYPE func,
          237.                             LHASH_DOALL_ARG_FN_TYPE func_arg, void *arg)
          238.   {

crypto/lhash/lhash.c:249:10: Binary operation: ([0, 8] - 1):unsigned32 by call to `SSL_CTX_free` 
          247.        * memory leaks otherwise
          248.        */
          249.       for (i = lh->num_nodes - 1; i >= 0; i--) {
                          ^
          250.           a = lh->b[i];
          251.           while (a != NULL) {

static void doall_util_fn(_LHASH *lh, int use_arg, LHASH_DOALL_FN_TYPE func,
                          LHASH_DOALL_ARG_FN_TYPE func_arg, void *arg)
{
    int i;
    LHASH_NODE *a, *n;
    if (lh == NULL)
        return;
    for (i = lh->num_nodes - 1; i >= 0; i--) {
        a = lh->b[i];
        while (a != NULL) {
            n = a->next;
            if (use_arg)
                func_arg(a->data, arg);
            else
                func(a->data);
            a = n;
        }
    }
}
['OCSP_RESPONSE *process_responder(OCSP_REQUEST *req,\n                                 const char *host, const char *path,\n                                 const char *port, int use_ssl,\n                                 STACK_OF(CONF_VALUE) *headers,\n                                 int req_timeout)\n{\n    BIO *cbio = NULL;\n    SSL_CTX *ctx = NULL;\n    OCSP_RESPONSE *resp = NULL;\n    cbio = BIO_new_connect(host);\n    if (!cbio) {\n        BIO_printf(bio_err, "Error creating connect BIO\\n");\n        goto end;\n    }\n    if (port)\n        BIO_set_conn_port(cbio, port);\n    if (use_ssl == 1) {\n        BIO *sbio;\n        ctx = SSL_CTX_new(TLS_client_method());\n        if (ctx == NULL) {\n            BIO_printf(bio_err, "Error creating SSL context.\\n");\n            goto end;\n        }\n        SSL_CTX_set_mode(ctx, SSL_MODE_AUTO_RETRY);\n        sbio = BIO_new_ssl(ctx, 1);\n        cbio = BIO_push(sbio, cbio);\n    }\n    resp = query_responder(cbio, host, path, headers, req, req_timeout);\n    if (!resp)\n        BIO_printf(bio_err, "Error querying OCSP responder\\n");\n end:\n    BIO_free_all(cbio);\n    SSL_CTX_free(ctx);\n    return resp;\n}', 'SSL_CTX *SSL_CTX_new(const SSL_METHOD *meth)\n{\n    SSL_CTX *ret = NULL;\n    if (meth == NULL) {\n        SSLerr(SSL_F_SSL_CTX_NEW, SSL_R_NULL_SSL_METHOD_PASSED);\n        return (NULL);\n    }\n    if (FIPS_mode() && (meth->version < TLS1_VERSION)) {\n        SSLerr(SSL_F_SSL_CTX_NEW, SSL_R_AT_LEAST_TLS_1_0_NEEDED_IN_FIPS_MODE);\n        return NULL;\n    }\n    if (SSL_get_ex_data_X509_STORE_CTX_idx() < 0) {\n        SSLerr(SSL_F_SSL_CTX_NEW, SSL_R_X509_VERIFICATION_SETUP_PROBLEMS);\n        goto err;\n    }\n    ret = OPENSSL_zalloc(sizeof(*ret));\n    if (ret == NULL)\n        goto err;\n    ret->method = meth;\n    ret->min_proto_version = 0;\n    ret->max_proto_version = 0;\n    ret->session_cache_mode = SSL_SESS_CACHE_SERVER;\n    ret->session_cache_size = SSL_SESSION_CACHE_MAX_SIZE_DEFAULT;\n    ret->session_timeout = meth->get_timeout();\n    ret->references = 1;\n    ret->max_cert_list = SSL_MAX_CERT_LIST_DEFAULT;\n    ret->verify_mode = SSL_VERIFY_NONE;\n    if ((ret->cert = ssl_cert_new()) == NULL)\n        goto err;\n    ret->sessions = lh_SSL_SESSION_new(ssl_session_hash, ssl_session_cmp);\n    if (ret->sessions == NULL)\n        goto err;\n    ret->cert_store = X509_STORE_new();\n    if (ret->cert_store == NULL)\n        goto err;\n    if (!ssl_create_cipher_list(ret->method,\n                           &ret->cipher_list, &ret->cipher_list_by_id,\n                           SSL_DEFAULT_CIPHER_LIST, ret->cert)\n       || sk_SSL_CIPHER_num(ret->cipher_list) <= 0) {\n        SSLerr(SSL_F_SSL_CTX_NEW, SSL_R_LIBRARY_HAS_NO_CIPHERS);\n        goto err2;\n    }\n    ret->param = X509_VERIFY_PARAM_new();\n    if (ret->param == NULL)\n        goto err;\n    if ((ret->md5 = EVP_get_digestbyname("ssl3-md5")) == NULL) {\n        SSLerr(SSL_F_SSL_CTX_NEW, SSL_R_UNABLE_TO_LOAD_SSL3_MD5_ROUTINES);\n        goto err2;\n    }\n    if ((ret->sha1 = EVP_get_digestbyname("ssl3-sha1")) == NULL) {\n        SSLerr(SSL_F_SSL_CTX_NEW, SSL_R_UNABLE_TO_LOAD_SSL3_SHA1_ROUTINES);\n        goto err2;\n    }\n    if ((ret->client_CA = sk_X509_NAME_new_null()) == NULL)\n        goto err;\n    CRYPTO_new_ex_data(CRYPTO_EX_INDEX_SSL_CTX, ret, &ret->ex_data);\n    if (!(meth->ssl3_enc->enc_flags & SSL_ENC_FLAG_DTLS))\n        ret->comp_methods = SSL_COMP_get_compression_methods();\n    ret->max_send_fragment = SSL3_RT_MAX_PLAIN_LENGTH;\n    if ((RAND_bytes(ret->tlsext_tick_key_name, 16) <= 0)\n        || (RAND_bytes(ret->tlsext_tick_hmac_key, 16) <= 0)\n        || (RAND_bytes(ret->tlsext_tick_aes_key, 16) <= 0))\n        ret->options |= SSL_OP_NO_TICKET;\n#ifndef OPENSSL_NO_SRP\n    if (!SSL_CTX_SRP_CTX_init(ret))\n        goto err;\n#endif\n#ifndef OPENSSL_NO_ENGINE\n# ifdef OPENSSL_SSL_CLIENT_ENGINE_AUTO\n#  define eng_strx(x)     #x\n#  define eng_str(x)      eng_strx(x)\n    {\n        ENGINE *eng;\n        eng = ENGINE_by_id(eng_str(OPENSSL_SSL_CLIENT_ENGINE_AUTO));\n        if (!eng) {\n            ERR_clear_error();\n            ENGINE_load_builtin_engines();\n            eng = ENGINE_by_id(eng_str(OPENSSL_SSL_CLIENT_ENGINE_AUTO));\n        }\n        if (!eng || !SSL_CTX_set_client_cert_engine(ret, eng))\n            ERR_clear_error();\n    }\n# endif\n#endif\n    ret->options |= SSL_OP_LEGACY_SERVER_CONNECT;\n    return (ret);\n err:\n    SSLerr(SSL_F_SSL_CTX_NEW, ERR_R_MALLOC_FAILURE);\n err2:\n    SSL_CTX_free(ret);\n    return (NULL);\n}', 'DEFINE_LHASH_OF(SSL_SESSION)', '_LHASH *lh_new(LHASH_HASH_FN_TYPE h, LHASH_COMP_FN_TYPE c)\n{\n    _LHASH *ret;\n    if ((ret = OPENSSL_zalloc(sizeof(*ret))) == NULL)\n        goto err0;\n    if ((ret->b = OPENSSL_zalloc(sizeof(*ret->b) * MIN_NODES)) == NULL)\n        goto err1;\n    ret->comp = ((c == NULL) ? (LHASH_COMP_FN_TYPE)strcmp : c);\n    ret->hash = ((h == NULL) ? (LHASH_HASH_FN_TYPE)lh_strhash : h);\n    ret->num_nodes = MIN_NODES / 2;\n    ret->num_alloc_nodes = MIN_NODES;\n    ret->pmax = MIN_NODES / 2;\n    ret->up_load = UP_LOAD;\n    ret->down_load = DOWN_LOAD;\n    return (ret);\n err1:\n    OPENSSL_free(ret);\n err0:\n    return (NULL);\n}', 'void SSL_CTX_free(SSL_CTX *a)\n{\n    int i;\n    if (a == NULL)\n        return;\n    i = CRYPTO_add(&a->references, -1, CRYPTO_LOCK_SSL_CTX);\n#ifdef REF_PRINT\n    REF_PRINT("SSL_CTX", a);\n#endif\n    if (i > 0)\n        return;\n#ifdef REF_CHECK\n    if (i < 0) {\n        fprintf(stderr, "SSL_CTX_free, bad reference count\\n");\n        abort();\n    }\n#endif\n    X509_VERIFY_PARAM_free(a->param);\n    dane_ctx_final(&a->dane);\n    if (a->sessions != NULL)\n        SSL_CTX_flush_sessions(a, 0);\n    CRYPTO_free_ex_data(CRYPTO_EX_INDEX_SSL_CTX, a, &a->ex_data);\n    lh_SSL_SESSION_free(a->sessions);\n    X509_STORE_free(a->cert_store);\n    sk_SSL_CIPHER_free(a->cipher_list);\n    sk_SSL_CIPHER_free(a->cipher_list_by_id);\n    ssl_cert_free(a->cert);\n    sk_X509_NAME_pop_free(a->client_CA, X509_NAME_free);\n    sk_X509_pop_free(a->extra_certs, X509_free);\n    a->comp_methods = NULL;\n#ifndef OPENSSL_NO_SRTP\n    sk_SRTP_PROTECTION_PROFILE_free(a->srtp_profiles);\n#endif\n#ifndef OPENSSL_NO_SRP\n    SSL_CTX_SRP_CTX_free(a);\n#endif\n#ifndef OPENSSL_NO_ENGINE\n    if (a->client_cert_engine)\n        ENGINE_finish(a->client_cert_engine);\n#endif\n#ifndef OPENSSL_NO_EC\n    OPENSSL_free(a->tlsext_ecpointformatlist);\n    OPENSSL_free(a->tlsext_ellipticcurvelist);\n#endif\n    OPENSSL_free(a->alpn_client_proto_list);\n    OPENSSL_free(a);\n}', 'void SSL_CTX_flush_sessions(SSL_CTX *s, long t)\n{\n    unsigned long i;\n    TIMEOUT_PARAM tp;\n    tp.ctx = s;\n    tp.cache = s->sessions;\n    if (tp.cache == NULL)\n        return;\n    tp.time = t;\n    CRYPTO_w_lock(CRYPTO_LOCK_SSL_CTX);\n    i = CHECKED_LHASH_OF(SSL_SESSION, tp.cache)->down_load;\n    CHECKED_LHASH_OF(SSL_SESSION, tp.cache)->down_load = 0;\n    lh_SSL_SESSION_doall_TIMEOUT_PARAM(tp.cache, timeout_cb, &tp);\n    CHECKED_LHASH_OF(SSL_SESSION, tp.cache)->down_load = i;\n    CRYPTO_w_unlock(CRYPTO_LOCK_SSL_CTX);\n}', 'IMPLEMENT_LHASH_DOALL_ARG(SSL_SESSION, TIMEOUT_PARAM)', 'void lh_doall_arg(_LHASH *lh, LHASH_DOALL_ARG_FN_TYPE func, void *arg)\n{\n    doall_util_fn(lh, 1, (LHASH_DOALL_FN_TYPE)0, func, arg);\n}', 'static void doall_util_fn(_LHASH *lh, int use_arg, LHASH_DOALL_FN_TYPE func,\n                          LHASH_DOALL_ARG_FN_TYPE func_arg, void *arg)\n{\n    int i;\n    LHASH_NODE *a, *n;\n    if (lh == NULL)\n        return;\n    for (i = lh->num_nodes - 1; i >= 0; i--) {\n        a = lh->b[i];\n        while (a != NULL) {\n            n = a->next;\n            if (use_arg)\n                func_arg(a->data, arg);\n            else\n                func(a->data);\n            a = n;\n        }\n    }\n}']