ssl/s23_clnt.c:215: error: INTEGER_OVERFLOW_L2
  ([0, max(0, `s->ctx->sessions->num_items`)] - 1):unsigned64 by call to `ssl23_client_hello`.
Showing all 13 steps of the trace


ssl/s23_clnt.c:143:1: Parameter `s->ctx->sessions->num_items`
141.   			ssl23_get_client_method)
142.   
143. > int ssl23_connect(SSL *s)
144.   	{
145.   	BUF_MEM *buf=NULL;

ssl/s23_clnt.c:215:8: Call
213.   
214.   			s->shutdown=0;
215.   			ret=ssl23_client_hello(s);
              ^
216.   			if (ret <= 0) goto end;
217.   			s->state=SSL23_ST_CR_SRVR_HELLO_A;

ssl/s23_clnt.c:277:1: Parameter `s->ctx->sessions->num_items`
  275.   	}
  276.   
  277. > static int ssl23_client_hello(SSL *s)
  278.   	{
  279.   	unsigned char *buf;

ssl/s23_clnt.c:440:4: Call
  438.   		if ((p = ssl_add_clienthello_tlsext(s, p, buf+SSL3_RT_MAX_PLAIN_LENGTH, &al)) == NULL)
  439.   			{
  440.   			ssl3_send_alert(s,SSL3_AL_FATAL,al);
            ^
  441.   			SSLerr(SSL_F_SSL23_CLIENT_HELLO,ERR_R_INTERNAL_ERROR);
  442.   			return -1;

ssl/s3_pkt.c:1787:1: Parameter `s->ctx->sessions->num_items`
    1785.   	}
    1786.   
    1787. > int ssl3_send_alert(SSL *s, int level, int desc)
    1788.   	{
    1789.   	/* Map tls/ssl alert value to correct one */

ssl/s3_pkt.c:1796:3: Call
    1794.   	/* If a fatal one, remove from cache */
    1795.   	if ((level == SSL3_AL_FATAL) && (s->session != NULL))
    1796.   		SSL_CTX_remove_session(s->ctx,s->session);
              ^
    1797.   
    1798.   	s->s3->alert_dispatch=1;

ssl/ssl_sess.c:682:1: Parameter `ctx->sessions->num_items`
      680.   	}
      681.   
      682. > int SSL_CTX_remove_session(SSL_CTX *ctx, SSL_SESSION *c)
      683.   {
      684.   	return remove_session_lock(ctx, c, 1);

ssl/ssl_sess.c:684:9: Call
      682.   int SSL_CTX_remove_session(SSL_CTX *ctx, SSL_SESSION *c)
      683.   {
      684.   	return remove_session_lock(ctx, c, 1);
                     ^
      685.   }
      686.   

ssl/ssl_sess.c:687:1: Parameter `ctx->sessions->num_items`
        685.   }
        686.   
        687. > static int remove_session_lock(SSL_CTX *ctx, SSL_SESSION *c, int lck)
        688.   	{
        689.   	SSL_SESSION *r;

ssl/ssl_sess.c:698:6: Call
        696.   			{
        697.   			ret=1;
        698.   			r=lh_SSL_SESSION_delete(ctx->sessions,c);
                    ^
        699.   			SSL_SESSION_list_remove(ctx,c);
        700.   			}

crypto/lhash/lhash.c:217:1: <LHS trace>
215.   	}
216.   
217. > void *lh_delete(_LHASH *lh, const void *data)
218.   	{
219.   	unsigned long hash;

crypto/lhash/lhash.c:217:1: Parameter `lh->num_items`
          215.   	}
          216.   
          217. > void *lh_delete(_LHASH *lh, const void *data)
          218.   	{
          219.   	unsigned long hash;

crypto/lhash/lhash.c:240:2: Binary operation: ([0, max(0, s->ctx->sessions->num_items)] - 1):unsigned64 by call to `ssl23_client_hello` 
          238.   		}
          239.   
          240.   	lh->num_items--;
                  ^
          241.   	if ((lh->num_nodes > MIN_NODES) &&
          242.   		(lh->down_load >= (lh->num_items*LH_LOAD_MULT/lh->num_nodes)))
