ssl/s3_clnt.c:227: error: INTEGER_OVERFLOW_L2
  ([0, +oo] - 1):unsigned32 by call to `ssl3_check_cert_and_algorithm`.
Showing all 17 steps of the trace


ssl/s3_clnt.c:220:8: Call
218.   		case SSL3_ST_CR_KEY_EXCH_A:
219.   		case SSL3_ST_CR_KEY_EXCH_B:
220.   			ret=ssl3_get_key_exchange(s);
              ^
221.   			if (ret <= 0) goto end;
222.   			s->state=SSL3_ST_CR_CERT_REQ_A;

ssl/s3_clnt.c:840:4: Call
  838.   #endif
  839.   
  840.   	n=ssl3_get_message(s,
            ^
  841.   		SSL3_ST_CR_KEY_EXCH_A,
  842.   		SSL3_ST_CR_KEY_EXCH_B,

ssl/s3_both.c:258:1: Parameter `s->ctx->sessions->p`
    256.   	}
    257.   
    258. > long ssl3_get_message(SSL *s, int st1, int stn, int mt, long max, int *ok)
    259.   	{
    260.   	unsigned char *p;

ssl/s3_clnt.c:227:9: Call
225.   			/* at this point we check that we have the
226.   			 * required stuff from the server */
227.   			if (!ssl3_check_cert_and_algorithm(s))
               ^
228.   				{
229.   				ret= -1;

ssl/s3_clnt.c:1596:1: Parameter `s->ctx->sessions->p`
  1594.   #define has_bits(i,m)	(((i)&(m)) == (m))
  1595.   
  1596. > static int ssl3_check_cert_and_algorithm(SSL *s)
  1597.   	{
  1598.   	int i,idx;

ssl/s3_clnt.c:1713:2: Call
  1711.   	return(1);
  1712.   f_err:
  1713.   	ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_HANDSHAKE_FAILURE);
           ^
  1714.   err:
  1715.   	return(0);

ssl/s3_pkt.c:984:1: Parameter `s->ctx->sessions->p`
    982.   	}
    983.   
    984. > void ssl3_send_alert(SSL *s, int level, int desc)
    985.   	{
    986.   	/* Map tls/ssl alert value to correct one */

ssl/s3_pkt.c:991:3: Call
    989.   	/* If a fatal one, remove from cache */
    990.   	if ((level == 2) && (s->session != NULL))
    991.   		SSL_CTX_remove_session(s->ctx,s->session);
             ^
    992.   
    993.   	s->s3->alert_dispatch=1;

ssl/ssl_sess.c:320:1: Parameter `ctx->sessions->p`
      318.   	}
      319.   
      320. > int SSL_CTX_remove_session(SSL_CTX *ctx, SSL_SESSION *c)
      321.   {
      322.   	return remove_session_lock(ctx, c, 1);

ssl/ssl_sess.c:322:9: Call
      320.   int SSL_CTX_remove_session(SSL_CTX *ctx, SSL_SESSION *c)
      321.   {
      322.   	return remove_session_lock(ctx, c, 1);
                     ^
      323.   }
      324.   

ssl/ssl_sess.c:325:1: Parameter `ctx->sessions->p`
        323.   }
        324.   
        325. > static int remove_session_lock(SSL_CTX *ctx, SSL_SESSION *c, int lck)
        326.   	{
        327.   	SSL_SESSION *r;

ssl/ssl_sess.c:333:20: Call
        331.   		{
        332.   		if(lck) CRYPTO_w_lock(CRYPTO_LOCK_SSL_CTX);
        333.   		r=(SSL_SESSION *)lh_delete(ctx->sessions,(char *)c);
                                  ^
        334.   		if (r != NULL)
        335.   			{

crypto/lhash/lhash.c:220:1: Parameter `lh->pmax`
          218.   	}
          219.   
          220. > char *lh_delete(LHASH *lh, char *data)
          221.   	{
          222.   	unsigned long hash;

crypto/lhash/lhash.c:246:3: Call
          244.   	if ((lh->num_nodes > MIN_NODES) &&
          245.   		(lh->down_load >= (lh->num_items*LH_LOAD_MULT/lh->num_nodes)))
          246.   		contract(lh);
                   ^
          247.   
          248.   	return(ret);

crypto/lhash/lhash.c:355:1: <LHS trace>
353.   	}
354.   
355. > static void contract(LHASH *lh)
356.   	{
357.   	LHASH_NODE **n,*n1,*np;

crypto/lhash/lhash.c:355:1: Parameter `lh->p`
            353.   	}
            354.   
            355. > static void contract(LHASH *lh)
            356.   	{
            357.   	LHASH_NODE **n,*n1,*np;

crypto/lhash/lhash.c:359:5: Binary operation: ([0, +oo] - 1):unsigned32 by call to `ssl3_check_cert_and_algorithm` 
            357.   	LHASH_NODE **n,*n1,*np;
            358.   
            359.   	np=lh->b[lh->p+lh->pmax-1];
                       ^
            360.   	lh->b[lh->p+lh->pmax-1]=NULL; /* 24/07-92 - eay - weird but :-( */
            361.   	if (lh->p == 0)
