ssl/ssl_lib.c:2641: error: INTEGER_OVERFLOW_L2
  ([0, max(0, `s->ctx->sessions->num_nodes`)] - 1):unsigned32 by call to `SSL_free`.
Showing all 15 steps of the trace


ssl/ssl_lib.c:2526:1: Parameter `s->ctx->sessions->num_nodes`
2524.   }
2525.   
2526. > SSL *SSL_dup(SSL *s)
2527.   {
2528.       STACK_OF(X509_NAME) *sk;

ssl/ssl_lib.c:2533:16: Call
2531.       int i;
2532.   
2533.       if ((ret = SSL_new(SSL_get_SSL_CTX(s))) == NULL)
                       ^
2534.           return (NULL);
2535.   

ssl/ssl_lib.c:267:1: Parameter `ctx->sessions->num_nodes`
  265.   }
  266.   
  267. > SSL *SSL_new(SSL_CTX *ctx)
  268.   {
  269.       SSL *s;

ssl/ssl_lib.c:2641:5: Call
2639.   
2640.    err:
2641.       SSL_free(ret);
            ^
2642.       return NULL;
2643.   }

ssl/ssl_lib.c:510:1: Parameter `s->initial_ctx->sessions->num_nodes`
  508.   }
  509.   
  510. > void SSL_free(SSL *s)
  511.   {
  512.       int i;

ssl/ssl_lib.c:563:5: Call
  561.   
  562.       OPENSSL_free(s->tlsext_hostname);
  563.       SSL_CTX_free(s->initial_ctx);
             ^
  564.   #ifndef OPENSSL_NO_EC
  565.       OPENSSL_free(s->tlsext_ecpointformatlist);

ssl/ssl_lib.c:1829:1: Parameter `a->sessions->num_nodes`
    1827.   }
    1828.   
    1829. > void SSL_CTX_free(SSL_CTX *a)
    1830.   {
    1831.       int i;

ssl/ssl_lib.c:1861:9: Call
    1859.        */
    1860.       if (a->sessions != NULL)
    1861.           SSL_CTX_flush_sessions(a, 0);
                    ^
    1862.   
    1863.       CRYPTO_free_ex_data(CRYPTO_EX_INDEX_SSL_CTX, a, &a->ex_data);

ssl/ssl_sess.c:1067:1: Parameter `s->sessions->num_nodes`
      1065.   static IMPLEMENT_LHASH_DOALL_ARG_FN(timeout, SSL_SESSION, TIMEOUT_PARAM)
      1066.   
      1067. > void SSL_CTX_flush_sessions(SSL_CTX *s, long t)
      1068.   {
      1069.       unsigned long i;

ssl/ssl_sess.c:1080:5: Call
      1078.       i = CHECKED_LHASH_OF(SSL_SESSION, tp.cache)->down_load;
      1079.       CHECKED_LHASH_OF(SSL_SESSION, tp.cache)->down_load = 0;
      1080.       lh_SSL_SESSION_doall_arg(tp.cache, LHASH_DOALL_ARG_FN(timeout),
                  ^
      1081.                                TIMEOUT_PARAM, &tp);
      1082.       CHECKED_LHASH_OF(SSL_SESSION, tp.cache)->down_load = i;

crypto/lhash/lhash.c:294:1: Parameter `lh->num_nodes`
        292.   }
        293.   
        294. > void lh_doall_arg(_LHASH *lh, LHASH_DOALL_ARG_FN_TYPE func, void *arg)
        295.   {
        296.       doall_util_fn(lh, 1, (LHASH_DOALL_FN_TYPE)0, func, arg);

crypto/lhash/lhash.c:296:5: Call
        294.   void lh_doall_arg(_LHASH *lh, LHASH_DOALL_ARG_FN_TYPE func, void *arg)
        295.   {
        296.       doall_util_fn(lh, 1, (LHASH_DOALL_FN_TYPE)0, func, arg);
                   ^
        297.   }
        298.   

crypto/lhash/lhash.c:256:1: <LHS trace>
254.   }
255.   
256. > static void doall_util_fn(_LHASH *lh, int use_arg, LHASH_DOALL_FN_TYPE func,
257.                             LHASH_DOALL_ARG_FN_TYPE func_arg, void *arg)
258.   {

crypto/lhash/lhash.c:256:1: Parameter `lh->num_nodes`
          254.   }
          255.   
          256. > static void doall_util_fn(_LHASH *lh, int use_arg, LHASH_DOALL_FN_TYPE func,
          257.                             LHASH_DOALL_ARG_FN_TYPE func_arg, void *arg)
          258.   {

crypto/lhash/lhash.c:269:10: Binary operation: ([0, max(0, s->ctx->sessions->num_nodes)] - 1):unsigned32 by call to `SSL_free` 
          267.        * memory leaks otherwise
          268.        */
          269.       for (i = lh->num_nodes - 1; i >= 0; i--) {
                          ^
          270.           a = lh->b[i];
          271.           while (a != NULL) {
