ssl/d1_both.c:356: error: INTEGER_OVERFLOW_L2
  ([0, +oo] - 1):unsigned32 by call to `dtls1_get_message_fragment`.
Showing all 15 steps of the trace


ssl/d1_both.c:327:1: Parameter `s->ctx->sessions->p`
325.    * fragments.
326.    */
327. > long dtls1_get_message(SSL *s, int st1, int stn, int mt, long max, int *ok)
328.   	{
329.   	int i, al;

ssl/d1_both.c:356:7: Call
354.   			}
355.   
356.   		i = dtls1_get_message_fragment(s, st1, stn, max, ok);
             ^
357.   		if ( i == DTLS1_HM_BAD_FRAGMENT ||
358.   			i == DTLS1_HM_FRAGMENT_RETRY)  /* bad fragment received */

ssl/d1_both.c:526:1: Parameter `s->ctx->sessions->p`
  524.   
  525.   
  526. > static long
  527.   dtls1_get_message_fragment(SSL *s, int st1, int stn, long max, int *ok)
  528.   	{

ssl/d1_both.c:752:2: Call
  750.   
  751.   f_err:
  752.   	ssl3_send_alert(s,SSL3_AL_FATAL,al);
          ^
  753.   	s->init_num = 0;
  754.   err:

ssl/s3_pkt.c:1317:1: Parameter `s->ctx->sessions->p`
    1315.   	}
    1316.   
    1317. > void ssl3_send_alert(SSL *s, int level, int desc)
    1318.   	{
    1319.   	/* Map tls/ssl alert value to correct one */

ssl/s3_pkt.c:1326:3: Call
    1324.   	/* If a fatal one, remove from cache */
    1325.   	if ((level == 2) && (s->session != NULL))
    1326.   		SSL_CTX_remove_session(s->ctx,s->session);
              ^
    1327.   
    1328.   	s->s3->alert_dispatch=1;

ssl/ssl_sess.c:643:1: Parameter `ctx->sessions->p`
      641.   	}
      642.   
      643. > int SSL_CTX_remove_session(SSL_CTX *ctx, SSL_SESSION *c)
      644.   {
      645.   	return remove_session_lock(ctx, c, 1);

ssl/ssl_sess.c:645:9: Call
      643.   int SSL_CTX_remove_session(SSL_CTX *ctx, SSL_SESSION *c)
      644.   {
      645.   	return remove_session_lock(ctx, c, 1);
                     ^
      646.   }
      647.   

ssl/ssl_sess.c:648:1: Parameter `ctx->sessions->pmax`
        646.   }
        647.   
        648. > static int remove_session_lock(SSL_CTX *ctx, SSL_SESSION *c, int lck)
        649.   	{
        650.   	SSL_SESSION *r;

ssl/ssl_sess.c:659:21: Call
        657.   			{
        658.   			ret=1;
        659.   			r=(SSL_SESSION *)lh_delete(ctx->sessions,c);
                                   ^
        660.   			SSL_SESSION_list_remove(ctx,c);
        661.   			}

crypto/lhash/lhash.c:217:1: Parameter `lh->pmax`
          215.   	}
          216.   
          217. > void *lh_delete(LHASH *lh, const void *data)
          218.   	{
          219.   	unsigned long hash;

crypto/lhash/lhash.c:243:3: Call
          241.   	if ((lh->num_nodes > MIN_NODES) &&
          242.   		(lh->down_load >= (lh->num_items*LH_LOAD_MULT/lh->num_nodes)))
          243.   		contract(lh);
                   ^
          244.   
          245.   	return(ret);

crypto/lhash/lhash.c:364:1: <LHS trace>
362.   	}
363.   
364. > static void contract(LHASH *lh)
365.   	{
366.   	LHASH_NODE **n,*n1,*np;

crypto/lhash/lhash.c:364:1: Parameter `lh->p`
            362.   	}
            363.   
            364. > static void contract(LHASH *lh)
            365.   	{
            366.   	LHASH_NODE **n,*n1,*np;

crypto/lhash/lhash.c:368:5: Binary operation: ([0, +oo] - 1):unsigned32 by call to `dtls1_get_message_fragment` 
            366.   	LHASH_NODE **n,*n1,*np;
            367.   
            368.   	np=lh->b[lh->p+lh->pmax-1];
                       ^
            369.   	lh->b[lh->p+lh->pmax-1]=NULL; /* 24/07-92 - eay - weird but :-( */
            370.   	if (lh->p == 0)
