ssl/s3_clnt.c:351: error: INTEGER_OVERFLOW_L2
  ([0, max(0, `s->ctx->sessions->num_items`)] - 1):unsigned64 by call to `ssl3_get_certificate_request`.
Showing all 13 steps of the trace


ssl/s3_clnt.c:183:1: Parameter `s->ctx->sessions->num_items`
181.   			ssl3_get_client_method)
182.   
183. > int ssl3_connect(SSL *s)
184.   	{
185.   	BUF_MEM *buf=NULL;

ssl/s3_clnt.c:351:8: Call
349.   		case SSL3_ST_CR_CERT_REQ_A:
350.   		case SSL3_ST_CR_CERT_REQ_B:
351.   			ret=ssl3_get_certificate_request(s);
              ^
352.   			if (ret <= 0) goto end;
353.   			s->state=SSL3_ST_CR_SRVR_DONE_A;

ssl/s3_clnt.c:1675:1: Parameter `s->ctx->sessions->num_items`
  1673.   	}
  1674.   
  1675. > int ssl3_get_certificate_request(SSL *s)
  1676.   	{
  1677.   	int ok,ret=0;

ssl/s3_clnt.c:1704:3: Call
  1702.   	if (s->s3->tmp.message_type != SSL3_MT_CERTIFICATE_REQUEST)
  1703.   		{
  1704.   		ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_UNEXPECTED_MESSAGE);
            ^
  1705.   		SSLerr(SSL_F_SSL3_GET_CERTIFICATE_REQUEST,SSL_R_WRONG_MESSAGE_TYPE);
  1706.   		goto err;

ssl/s3_pkt.c:1425:1: Parameter `s->ctx->sessions->num_items`
    1423.   	}
    1424.   
    1425. > int ssl3_send_alert(SSL *s, int level, int desc)
    1426.   	{
    1427.   	/* Map tls/ssl alert value to correct one */

ssl/s3_pkt.c:1434:3: Call
    1432.   	/* If a fatal one, remove from cache */
    1433.   	if ((level == 2) && (s->session != NULL))
    1434.   		SSL_CTX_remove_session(s->ctx,s->session);
              ^
    1435.   
    1436.   	s->s3->alert_dispatch=1;

ssl/ssl_sess.c:658:1: Parameter `ctx->sessions->num_items`
      656.   	}
      657.   
      658. > int SSL_CTX_remove_session(SSL_CTX *ctx, SSL_SESSION *c)
      659.   {
      660.   	return remove_session_lock(ctx, c, 1);

ssl/ssl_sess.c:660:9: Call
      658.   int SSL_CTX_remove_session(SSL_CTX *ctx, SSL_SESSION *c)
      659.   {
      660.   	return remove_session_lock(ctx, c, 1);
                     ^
      661.   }
      662.   

ssl/ssl_sess.c:663:1: Parameter `ctx->sessions->num_items`
        661.   }
        662.   
        663. > static int remove_session_lock(SSL_CTX *ctx, SSL_SESSION *c, int lck)
        664.   	{
        665.   	SSL_SESSION *r;

ssl/ssl_sess.c:674:6: Call
        672.   			{
        673.   			ret=1;
        674.   			r=lh_SSL_SESSION_delete(ctx->sessions,c);
                    ^
        675.   			SSL_SESSION_list_remove(ctx,c);
        676.   			}

crypto/lhash/lhash.c:217:1: <LHS trace>
215.   	}
216.   
217. > void *lh_delete(_LHASH *lh, const void *data)
218.   	{
219.   	unsigned long hash;

crypto/lhash/lhash.c:217:1: Parameter `lh->num_items`
          215.   	}
          216.   
          217. > void *lh_delete(_LHASH *lh, const void *data)
          218.   	{
          219.   	unsigned long hash;

crypto/lhash/lhash.c:240:2: Binary operation: ([0, max(0, s->ctx->sessions->num_items)] - 1):unsigned64 by call to `ssl3_get_certificate_request` 
          238.   		}
          239.   
          240.   	lh->num_items--;
                  ^
          241.   	if ((lh->num_nodes > MIN_NODES) &&
          242.   		(lh->down_load >= (lh->num_items*LH_LOAD_MULT/lh->num_nodes)))
