apps/x509.c:694: error: INTEGER_OVERFLOW_L2
  ([0, 10] - 1):unsigned32 by call to `X509_STORE_free`.
Showing all 11 steps of the trace


apps/x509.c:175:6: Call
173.   	CAkeyformat=FORMAT_PEM;
174.   
175.   	ctx=X509_STORE_new();
            ^
176.   	if (ctx == NULL) goto end;
177.   	X509_STORE_set_verify_cb_func(ctx,callb);

crypto/x509/x509_lu.c:202:13: Call
  200.   	if ((ret=(X509_STORE *)Malloc(sizeof(X509_STORE))) == NULL)
  201.   		return(NULL);
  202.   	ret->certs=lh_new(x509_object_hash,x509_object_cmp);
                     ^
  203.   	ret->cache=1;
  204.   	ret->get_cert_methods=sk_new_null();

crypto/lhash/lhash.c:141:2: Assignment
    139.   	ret->comp=((c == NULL)?(int (*)())strcmp:c);
    140.   	ret->hash=((h == NULL)?(unsigned long (*)())lh_strhash:h);
    141.   	ret->num_nodes=MIN_NODES/2;
            ^
    142.   	ret->num_alloc_nodes=MIN_NODES;
    143.   	ret->p=0;

apps/x509.c:694:19: Call
692.   	if (out != NULL) BIO_free(out);
693.   	if (STDout != NULL) BIO_free(STDout);
694.   	if (ctx != NULL) X509_STORE_free(ctx);
                         ^
695.   	if (req != NULL) X509_REQ_free(req);
696.   	if (x != NULL) X509_free(x);

crypto/x509/x509_lu.c:229:1: Parameter `vfy->certs->num_nodes`
  227.   	}
  228.   
  229. > void X509_STORE_free(X509_STORE *vfy)
  230.   	{
  231.   	int i;

crypto/x509/x509_lu.c:248:2: Call
  246.   
  247.   	CRYPTO_free_ex_data(x509_store_meth,(char *)vfy,&vfy->ex_data);
  248.   	lh_doall(vfy->certs,cleanup);
          ^
  249.   	lh_free(vfy->certs);
  250.   	Free(vfy);

crypto/lhash/lhash.c:284:1: Parameter `lh->num_nodes`
    282.   	}
    283.   
    284. > void lh_doall(LHASH *lh, void (*func)())
    285.   	{
    286.   	lh_doall_arg(lh,func,NULL);

crypto/lhash/lhash.c:286:2: Call
    284.   void lh_doall(LHASH *lh, void (*func)())
    285.   	{
    286.   	lh_doall_arg(lh,func,NULL);
            ^
    287.   	}
    288.   

crypto/lhash/lhash.c:289:1: <LHS trace>
287.   	}
288.   
289. > void lh_doall_arg(LHASH *lh, void (*func)(), char *arg)
290.   	{
291.   	int i;

crypto/lhash/lhash.c:289:1: Parameter `lh->num_nodes`
      287.   	}
      288.   
      289. > void lh_doall_arg(LHASH *lh, void (*func)(), char *arg)
      290.   	{
      291.   	int i;

crypto/lhash/lhash.c:296:7: Binary operation: ([0, 10] - 1):unsigned32 by call to `X509_STORE_free` 
      294.   	/* reverse the order so we search from 'top to bottom'
      295.   	 * We were having memory leaks otherwise */
      296.   	for (i=lh->num_nodes-1; i>=0; i--)
                   ^
      297.   		{
      298.   		a=lh->b[i];
