ssl/d1_both.c:381: error: INTEGER_OVERFLOW_L2
  ([0, max(0, `s->ctx->sessions->num_items`)] - 1):unsigned64 by call to `dtls1_get_message_fragment`.
Showing all 15 steps of the trace


ssl/d1_both.c:350:1: Parameter `s->ctx->sessions->num_items`
348.    * fragments.
349.    */
350. > long dtls1_get_message(SSL *s, int st1, int stn, int mt, long max, int *ok)
351.   	{
352.   	int i, al;

ssl/d1_both.c:381:7: Call
379.   			}
380.   
381.   		i = dtls1_get_message_fragment(s, st1, stn, max, ok);
             ^
382.   		if ( i == DTLS1_HM_BAD_FRAGMENT ||
383.   			i == DTLS1_HM_FRAGMENT_RETRY)  /* bad fragment received */

ssl/d1_both.c:627:1: Parameter `s->ctx->sessions->num_items`
  625.   
  626.   
  627. > static long
  628.   dtls1_get_message_fragment(SSL *s, int st1, int stn, long max, int *ok)
  629.   	{

ssl/d1_both.c:636:18: Call
  634.   
  635.   	/* see if we have the required fragment already */
  636.   	if ((frag_len = dtls1_retrieve_buffered_fragment(s,max,ok)) || *ok)
                          ^
  637.   		{
  638.   		if (*ok)	s->init_num += frag_len;

ssl/d1_both.c:501:1: Parameter `s->ctx->sessions->num_items`
    499.   
    500.   
    501. > static int
    502.   dtls1_retrieve_buffered_fragment(SSL *s, long max, int *ok)
    503.   	{

ssl/d1_both.c:543:3: Call
    541.   			}
    542.   
    543.   		ssl3_send_alert(s,SSL3_AL_FATAL,al);
             ^
    544.   		s->init_num = 0;
    545.   		*ok = 0;

ssl/s3_pkt.c:1353:1: Parameter `s->ctx->sessions->num_items`
      1351.   	}
      1352.   
      1353. > int ssl3_send_alert(SSL *s, int level, int desc)
      1354.   	{
      1355.   	/* Map tls/ssl alert value to correct one */

ssl/s3_pkt.c:1362:3: Call
      1360.   	/* If a fatal one, remove from cache */
      1361.   	if ((level == 2) && (s->session != NULL))
      1362.   		SSL_CTX_remove_session(s->ctx,s->session);
                ^
      1363.   
      1364.   	s->s3->alert_dispatch=1;

ssl/ssl_sess.c:653:1: Parameter `ctx->sessions->num_items`
        651.   	}
        652.   
        653. > int SSL_CTX_remove_session(SSL_CTX *ctx, SSL_SESSION *c)
        654.   {
        655.   	return remove_session_lock(ctx, c, 1);

ssl/ssl_sess.c:655:9: Call
        653.   int SSL_CTX_remove_session(SSL_CTX *ctx, SSL_SESSION *c)
        654.   {
        655.   	return remove_session_lock(ctx, c, 1);
                       ^
        656.   }
        657.   

ssl/ssl_sess.c:658:1: Parameter `ctx->sessions->num_items`
          656.   }
          657.   
          658. > static int remove_session_lock(SSL_CTX *ctx, SSL_SESSION *c, int lck)
          659.   	{
          660.   	SSL_SESSION *r;

ssl/ssl_sess.c:669:6: Call
          667.   			{
          668.   			ret=1;
          669.   			r=lh_SSL_SESSION_delete(ctx->sessions,c);
                      ^
          670.   			SSL_SESSION_list_remove(ctx,c);
          671.   			}

crypto/lhash/lhash.c:217:1: <LHS trace>
215.   	}
216.   
217. > void *lh_delete(_LHASH *lh, const void *data)
218.   	{
219.   	unsigned long hash;

crypto/lhash/lhash.c:217:1: Parameter `lh->num_items`
            215.   	}
            216.   
            217. > void *lh_delete(_LHASH *lh, const void *data)
            218.   	{
            219.   	unsigned long hash;

crypto/lhash/lhash.c:240:2: Binary operation: ([0, max(0, s->ctx->sessions->num_items)] - 1):unsigned64 by call to `dtls1_get_message_fragment` 
            238.   		}
            239.   
            240.   	lh->num_items--;
                    ^
            241.   	if ((lh->num_nodes > MIN_NODES) &&
            242.   		(lh->down_load >= (lh->num_items*LH_LOAD_MULT/lh->num_nodes)))
