apps/x509.c:876: error: INTEGER_OVERFLOW_L2
  ([0, +oo] - 1):unsigned32 by call to `CONF_free`.
Showing all 9 steps of the trace


apps/x509.c:191:6: Call
189.   	CAkeyformat=FORMAT_PEM;
190.   
191.   	ctx=X509_STORE_new();
            ^
192.   	if (ctx == NULL) goto end;
193.   	X509_STORE_set_verify_cb_func(ctx,callb);

crypto/x509/x509_lu.c:202:13: Call
  200.   	if ((ret=(X509_STORE *)Malloc(sizeof(X509_STORE))) == NULL)
  201.   		return(NULL);
  202.   	ret->certs=lh_new(x509_object_hash,x509_object_cmp);
                     ^
  203.   	ret->cache=1;
  204.   	ret->get_cert_methods=sk_X509_LOOKUP_new_null();

crypto/lhash/lhash.c:127:2: Assignment
    125.   	ret->comp=((c == NULL)?(int (*)())strcmp:c);
    126.   	ret->hash=((h == NULL)?(unsigned long (*)())lh_strhash:h);
    127.   	ret->num_nodes=MIN_NODES/2;
            ^
    128.   	ret->num_alloc_nodes=MIN_NODES;
    129.   	ret->p=0;

apps/x509.c:876:2: Call
874.   		app_RAND_write_file(NULL, bio_err);
875.   	OBJ_cleanup();
876.   	CONF_free(extconf);
        ^
877.   	BIO_free(out);
878.   	BIO_free(STDout);

crypto/conf/conf.c:440:1: Parameter `conf->num_nodes`
  438.   	}
  439.   
  440. > void CONF_free(LHASH *conf)
  441.   	{
  442.   	if (conf == NULL) return;

crypto/conf/conf.c:446:2: Call
  444.   	conf->down_load=0; 	/* evil thing to make sure the 'Free()'
  445.   				 * works as expected */
  446.   	lh_doall_arg(conf,(void (*)())value_free_hash,conf);
          ^
  447.   
  448.   	/* We now have only 'section' entries in the hash table.

crypto/lhash/lhash.c:275:1: <LHS trace>
273.   	}
274.   
275. > void lh_doall_arg(LHASH *lh, void (*func)(), void *arg)
276.   	{
277.   	int i;

crypto/lhash/lhash.c:275:1: Parameter `lh->num_nodes`
    273.   	}
    274.   
    275. > void lh_doall_arg(LHASH *lh, void (*func)(), void *arg)
    276.   	{
    277.   	int i;

crypto/lhash/lhash.c:282:7: Binary operation: ([0, +oo] - 1):unsigned32 by call to `CONF_free` 
    280.   	/* reverse the order so we search from 'top to bottom'
    281.   	 * We were having memory leaks otherwise */
    282.   	for (i=lh->num_nodes-1; i>=0; i--)
                 ^
    283.   		{
    284.   		a=lh->b[i];
