- Network errors could pollute the buffers because -1 isn't noticed in an

"unsigned int".
- Remove redundant processing with machine->ssl is NULL.
- Remove compiler warnings about uninitialised 'ctx' (it's not used
  uninitialised, but gcc can't see that).

demos/tunala/buffer.c

@@ -87,7 +87,7 @@ static unsigned int buffer_takedata(buffer_t *buf, unsigned char *ptr,
 
 int buffer_from_fd(buffer_t *buf, int fd)
 {
-	unsigned int toread = buffer_unused(buf);
+	int toread = buffer_unused(buf);
 	if(toread == 0)
 		/* Shouldn't be called in this case! */
 		abort();
@@ -101,7 +101,7 @@ int buffer_from_fd(buffer_t *buf, int fd)
 
 int buffer_to_fd(buffer_t *buf, int fd)
 {
-	unsigned int towrite = buffer_used(buf);
+	int towrite = buffer_used(buf);
 	if(towrite == 0)
 		/* Shouldn't be called in this case! */
 		abort();

demos/tunala/sm.c

@@ -82,14 +82,6 @@ int state_machine_set_SSL(state_machine_t *machine, SSL *ssl, int is_server)
 int state_machine_churn(state_machine_t *machine)
 {
 	unsigned int loop;
-	/* Do this loop twice to cover any dependencies about which precise
-	 * order of reads and writes is required. */
-	for(loop = 0; loop < 2; loop++) {
-		buffer_to_SSL(&machine->clean_in, machine->ssl);
-		buffer_to_BIO(&machine->dirty_in, machine->bio_intossl);
-		buffer_from_SSL(&machine->clean_out, machine->ssl);
-		buffer_from_BIO(&machine->dirty_out, machine->bio_fromssl);
-	}
 	if(machine->ssl == NULL) {
 		if(buffer_empty(&machine->clean_out))
 			/* Time to close this state-machine altogether */
@@ -98,6 +90,14 @@ int state_machine_churn(state_machine_t *machine)
 			/* Still buffered data on the clean side to go out */
 			return 1;
 	}
+	/* Do this loop twice to cover any dependencies about which precise
+	 * order of reads and writes is required. */
+	for(loop = 0; loop < 2; loop++) {
+		buffer_to_SSL(&machine->clean_in, machine->ssl);
+		buffer_to_BIO(&machine->dirty_in, machine->bio_intossl);
+		buffer_from_SSL(&machine->clean_out, machine->ssl);
+		buffer_from_BIO(&machine->dirty_out, machine->bio_fromssl);
+	}
 	/* We close on the SSL side if the info callback noticed some problems
 	 * or an SSL shutdown was underway and shutdown traffic had all been
 	 * sent. */

demos/tunala/tunala.c

@@ -727,7 +727,7 @@ static SSL_CTX *initialise_ssl_ctx(int server_mode, const char *engine_id,
 		int out_state, int out_verify, int verify_mode,
 		unsigned int verify_depth)
 {
-	SSL_CTX *ctx, *ret = NULL;
+	SSL_CTX *ctx = NULL, *ret = NULL;
 	SSL_METHOD *meth;
 	ENGINE *e = NULL;