ssl/d1_both.c:382: error: INTEGER_OVERFLOW_L2
  ([0, `s->ctx->sessions->num_items`] - 1):unsigned64 by call to `dtls1_get_message_fragment`.
Showing all 15 steps of the trace


ssl/d1_both.c:351:1: Parameter `s->ctx->sessions->num_items`
349.    * fragments.
350.    */
351. > long dtls1_get_message(SSL *s, int st1, int stn, int mt, long max, int *ok)
352.   	{
353.   	int i, al;

ssl/d1_both.c:382:7: Call
380.   			}
381.   
382.   		i = dtls1_get_message_fragment(s, st1, stn, max, ok);
             ^
383.   		if ( i == DTLS1_HM_BAD_FRAGMENT ||
384.   			i == DTLS1_HM_FRAGMENT_RETRY)  /* bad fragment received */

ssl/d1_both.c:611:1: Parameter `s->ctx->sessions->num_items`
  609.   
  610.   
  611. > static long
  612.   dtls1_get_message_fragment(SSL *s, int st1, int stn, long max, int *ok)
  613.   	{

ssl/d1_both.c:620:18: Call
  618.   
  619.   	/* see if we have the required fragment already */
  620.   	if ((frag_len = dtls1_retrieve_buffered_fragment(s,max,ok)) || *ok)
                          ^
  621.   		{
  622.   		if (*ok)	s->init_num += frag_len;

ssl/d1_both.c:500:1: Parameter `s->ctx->sessions->num_items`
    498.   
    499.   
    500. > static int
    501.   dtls1_retrieve_buffered_fragment(SSL *s, long max, int *ok)
    502.   	{

ssl/d1_both.c:541:3: Call
    539.   			}
    540.   
    541.   		ssl3_send_alert(s,SSL3_AL_FATAL,al);
             ^
    542.   		s->init_num = 0;
    543.   		*ok = 0;

ssl/s3_pkt.c:1317:1: Parameter `s->ctx->sessions->num_items`
      1315.   	}
      1316.   
      1317. > void ssl3_send_alert(SSL *s, int level, int desc)
      1318.   	{
      1319.   	/* Map tls/ssl alert value to correct one */

ssl/s3_pkt.c:1326:3: Call
      1324.   	/* If a fatal one, remove from cache */
      1325.   	if ((level == 2) && (s->session != NULL))
      1326.   		SSL_CTX_remove_session(s->ctx,s->session);
                ^
      1327.   
      1328.   	s->s3->alert_dispatch=1;

ssl/ssl_sess.c:645:1: Parameter `ctx->sessions->num_items`
        643.   	}
        644.   
        645. > int SSL_CTX_remove_session(SSL_CTX *ctx, SSL_SESSION *c)
        646.   {
        647.   	return remove_session_lock(ctx, c, 1);

ssl/ssl_sess.c:647:9: Call
        645.   int SSL_CTX_remove_session(SSL_CTX *ctx, SSL_SESSION *c)
        646.   {
        647.   	return remove_session_lock(ctx, c, 1);
                       ^
        648.   }
        649.   

ssl/ssl_sess.c:650:1: Parameter `ctx->sessions->num_items`
          648.   }
          649.   
          650. > static int remove_session_lock(SSL_CTX *ctx, SSL_SESSION *c, int lck)
          651.   	{
          652.   	SSL_SESSION *r;

ssl/ssl_sess.c:661:21: Call
          659.   			{
          660.   			ret=1;
          661.   			r=(SSL_SESSION *)lh_delete(ctx->sessions,c);
                                     ^
          662.   			SSL_SESSION_list_remove(ctx,c);
          663.   			}

crypto/lhash/lhash.c:217:1: <LHS trace>
215.   	}
216.   
217. > void *lh_delete(LHASH *lh, const void *data)
218.   	{
219.   	unsigned long hash;

crypto/lhash/lhash.c:217:1: Parameter `lh->num_items`
            215.   	}
            216.   
            217. > void *lh_delete(LHASH *lh, const void *data)
            218.   	{
            219.   	unsigned long hash;

crypto/lhash/lhash.c:240:2: Binary operation: ([0, s->ctx->sessions->num_items] - 1):unsigned64 by call to `dtls1_get_message_fragment` 
            238.   		}
            239.   
            240.   	lh->num_items--;
                    ^
            241.   	if ((lh->num_nodes > MIN_NODES) &&
            242.   		(lh->down_load >= (lh->num_items*LH_LOAD_MULT/lh->num_nodes)))
