test/handshake_helper.c:718: error: INTEGER_OVERFLOW_L2
  ([0, +oo] - 1):unsigned32 by call to `SSL_free`.
Showing all 16 steps of the trace


test/handshake_helper.c:707:10: Call
705.       unsigned char *read_buf = NULL, *write_buf = NULL;
706.   
707.       if (!TEST_ptr(ssl = SSL_new(ctx))
                ^
708.               || !TEST_ptr(write_buf = OPENSSL_zalloc(peer_buffer_size))
709.               || !TEST_ptr(read_buf = OPENSSL_zalloc(peer_buffer_size)))

ssl/ssl_lib.c:663:1: Parameter `ctx->sessions->num_nodes`
  661.   }
  662.   
  663. > SSL *SSL_new(SSL_CTX *ctx)
  664.   {
  665.       SSL *s;

test/handshake_helper.c:718:5: Call
716.       return 1;
717.   err:
718.       SSL_free(ssl);
           ^
719.       OPENSSL_free(write_buf);
720.       OPENSSL_free(read_buf);

ssl/ssl_lib.c:1129:1: Parameter `s->ctx->sessions->num_nodes`
  1127.   }
  1128.   
  1129. > void SSL_free(SSL *s)
  1130.   {
  1131.       int i;

ssl/ssl_lib.c:1199:5: Call
  1197.       RECORD_LAYER_release(&s->rlayer);
  1198.   
  1199.       SSL_CTX_free(s->ctx);
              ^
  1200.   
  1201.       ASYNC_WAIT_CTX_free(s->waitctx);

ssl/ssl_lib.c:3012:1: Parameter `a->sessions->num_nodes`
    3010.   }
    3011.   
    3012. > void SSL_CTX_free(SSL_CTX *a)
    3013.   {
    3014.       int i;

ssl/ssl_lib.c:3038:9: Call
    3036.        */
    3037.       if (a->sessions != NULL)
    3038.           SSL_CTX_flush_sessions(a, 0);
                    ^
    3039.   
    3040.       CRYPTO_free_ex_data(CRYPTO_EX_INDEX_SSL_CTX, a, &a->ex_data);

ssl/ssl_sess.c:1102:1: Parameter `s->sessions->num_nodes`
      1100.   IMPLEMENT_LHASH_DOALL_ARG(SSL_SESSION, TIMEOUT_PARAM);
      1101.   
      1102. > void SSL_CTX_flush_sessions(SSL_CTX *s, long t)
      1103.   {
      1104.       unsigned long i;

ssl/ssl_sess.c:1115:5: Call
      1113.       i = lh_SSL_SESSION_get_down_load(s->sessions);
      1114.       lh_SSL_SESSION_set_down_load(s->sessions, 0);
      1115.       lh_SSL_SESSION_doall_TIMEOUT_PARAM(tp.cache, timeout_cb, &tp);
                  ^
      1116.       lh_SSL_SESSION_set_down_load(s->sessions, i);
      1117.       CRYPTO_THREAD_unlock(s->lock);

ssl/ssl_sess.c:1100:1: Parameter `lh->num_nodes`
        1098.   }
        1099.   
        1100. > IMPLEMENT_LHASH_DOALL_ARG(SSL_SESSION, TIMEOUT_PARAM);
        1101.   
        1102.   void SSL_CTX_flush_sessions(SSL_CTX *s, long t)

ssl/ssl_sess.c:1100:1: Call
        1098.   }
        1099.   
        1100. > IMPLEMENT_LHASH_DOALL_ARG(SSL_SESSION, TIMEOUT_PARAM);
        1101.   
        1102.   void SSL_CTX_flush_sessions(SSL_CTX *s, long t)

crypto/lhash/lhash.c:198:1: Parameter `lh->num_nodes`
          196.   }
          197.   
          198. > void OPENSSL_LH_doall_arg(OPENSSL_LHASH *lh, OPENSSL_LH_DOALL_FUNCARG func, void *arg)
          199.   {
          200.       doall_util_fn(lh, 1, (OPENSSL_LH_DOALL_FUNC)0, func, arg);

crypto/lhash/lhash.c:200:5: Call
          198.   void OPENSSL_LH_doall_arg(OPENSSL_LHASH *lh, OPENSSL_LH_DOALL_FUNCARG func, void *arg)
          199.   {
          200.       doall_util_fn(lh, 1, (OPENSSL_LH_DOALL_FUNC)0, func, arg);
                     ^
          201.   }
          202.   

crypto/lhash/lhash.c:166:1: <LHS trace>
164.   }
165.   
166. > static void doall_util_fn(OPENSSL_LHASH *lh, int use_arg,
167.                             OPENSSL_LH_DOALL_FUNC func,
168.                             OPENSSL_LH_DOALL_FUNCARG func_arg, void *arg)

crypto/lhash/lhash.c:166:1: Parameter `lh->num_nodes`
            164.   }
            165.   
            166. > static void doall_util_fn(OPENSSL_LHASH *lh, int use_arg,
            167.                             OPENSSL_LH_DOALL_FUNC func,
            168.                             OPENSSL_LH_DOALL_FUNCARG func_arg, void *arg)

crypto/lhash/lhash.c:180:10: Binary operation: ([0, +oo] - 1):unsigned32 by call to `SSL_free` 
            178.        * memory leaks otherwise
            179.        */
            180.       for (i = lh->num_nodes - 1; i >= 0; i--) {
                            ^
            181.           a = lh->b[i];
            182.           while (a != NULL) {
