ssl/ssl_lib.c:3115: error: INTEGER_OVERFLOW_L2
  ([0, max(0, `s->ctx->sessions->num_nodes`)] - 1):unsigned32 by call to `SSL_free`.
Showing all 17 steps of the trace


ssl/ssl_lib.c:2994:1: Parameter `s->ctx->sessions->num_nodes`
2992.   }
2993.   
2994. > SSL *SSL_dup(SSL *s)
2995.   {
2996.       STACK_OF(X509_NAME) *sk;

ssl/ssl_lib.c:3010:16: Call
3008.        * Otherwise, copy configuration state, and session if set.
3009.        */
3010.       if ((ret = SSL_new(SSL_get_SSL_CTX(s))) == NULL)
                       ^
3011.           return (NULL);
3012.   

ssl/ssl_lib.c:613:1: Parameter `ctx->sessions->num_nodes`
  611.   }
  612.   
  613. > SSL *SSL_new(SSL_CTX *ctx)
  614.   {
  615.       SSL *s;

ssl/ssl_lib.c:3115:5: Call
3113.   
3114.    err:
3115.       SSL_free(ret);
            ^
3116.       return NULL;
3117.   }

ssl/ssl_lib.c:977:1: Parameter `s->initial_ctx->sessions->num_nodes`
  975.   }
  976.   
  977. > void SSL_free(SSL *s)
  978.   {
  979.       int i;

ssl/ssl_lib.c:1031:5: Call
  1029.   
  1030.       OPENSSL_free(s->tlsext_hostname);
  1031.       SSL_CTX_free(s->initial_ctx);
              ^
  1032.   #ifndef OPENSSL_NO_EC
  1033.       OPENSSL_free(s->tlsext_ecpointformatlist);

ssl/ssl_lib.c:2348:1: Parameter `a->sessions->num_nodes`
    2346.   }
    2347.   
    2348. > void SSL_CTX_free(SSL_CTX *a)
    2349.   {
    2350.       int i;

ssl/ssl_lib.c:2381:9: Call
    2379.        */
    2380.       if (a->sessions != NULL)
    2381.           SSL_CTX_flush_sessions(a, 0);
                    ^
    2382.   
    2383.       CRYPTO_free_ex_data(CRYPTO_EX_INDEX_SSL_CTX, a, &a->ex_data);

ssl/ssl_sess.c:1065:1: Parameter `s->sessions->num_nodes`
      1063.   IMPLEMENT_LHASH_DOALL_ARG(SSL_SESSION, TIMEOUT_PARAM);
      1064.   
      1065. > void SSL_CTX_flush_sessions(SSL_CTX *s, long t)
      1066.   {
      1067.       unsigned long i;

ssl/ssl_sess.c:1078:5: Call
      1076.       i = CHECKED_LHASH_OF(SSL_SESSION, tp.cache)->down_load;
      1077.       CHECKED_LHASH_OF(SSL_SESSION, tp.cache)->down_load = 0;
      1078.       lh_SSL_SESSION_doall_TIMEOUT_PARAM(tp.cache, timeout_cb, &tp);
                  ^
      1079.       CHECKED_LHASH_OF(SSL_SESSION, tp.cache)->down_load = i;
      1080.       CRYPTO_w_unlock(CRYPTO_LOCK_SSL_CTX);

ssl/ssl_sess.c:1063:1: Parameter `lh->num_nodes`
        1061.   }
        1062.   
        1063. > IMPLEMENT_LHASH_DOALL_ARG(SSL_SESSION, TIMEOUT_PARAM);
        1064.   
        1065.   void SSL_CTX_flush_sessions(SSL_CTX *s, long t)

ssl/ssl_sess.c:1063:1: Call
        1061.   }
        1062.   
        1063. > IMPLEMENT_LHASH_DOALL_ARG(SSL_SESSION, TIMEOUT_PARAM);
        1064.   
        1065.   void SSL_CTX_flush_sessions(SSL_CTX *s, long t)

crypto/lhash/lhash.c:274:1: Parameter `lh->num_nodes`
          272.   }
          273.   
          274. > void lh_doall_arg(_LHASH *lh, LHASH_DOALL_ARG_FN_TYPE func, void *arg)
          275.   {
          276.       doall_util_fn(lh, 1, (LHASH_DOALL_FN_TYPE)0, func, arg);

crypto/lhash/lhash.c:276:5: Call
          274.   void lh_doall_arg(_LHASH *lh, LHASH_DOALL_ARG_FN_TYPE func, void *arg)
          275.   {
          276.       doall_util_fn(lh, 1, (LHASH_DOALL_FN_TYPE)0, func, arg);
                     ^
          277.   }
          278.   

crypto/lhash/lhash.c:236:1: <LHS trace>
234.   }
235.   
236. > static void doall_util_fn(_LHASH *lh, int use_arg, LHASH_DOALL_FN_TYPE func,
237.                             LHASH_DOALL_ARG_FN_TYPE func_arg, void *arg)
238.   {

crypto/lhash/lhash.c:236:1: Parameter `lh->num_nodes`
            234.   }
            235.   
            236. > static void doall_util_fn(_LHASH *lh, int use_arg, LHASH_DOALL_FN_TYPE func,
            237.                             LHASH_DOALL_ARG_FN_TYPE func_arg, void *arg)
            238.   {

crypto/lhash/lhash.c:249:10: Binary operation: ([0, max(0, s->ctx->sessions->num_nodes)] - 1):unsigned32 by call to `SSL_free` 
            247.        * memory leaks otherwise
            248.        */
            249.       for (i = lh->num_nodes - 1; i >= 0; i--) {
                            ^
            250.           a = lh->b[i];
            251.           while (a != NULL) {
