ssl/statem/statem.c:585: error: UNINITIALIZED_VALUE
  The value read from len was never initialized.
Showing all 1 steps of the trace


ssl/statem/statem.c:585:18: 
583.   
584.               s->first_packet = 0;
585. >             if (!PACKET_buf_init(&pkt, s->init_msg, len)) {
586.                   ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR);
587.                   SSLerr(SSL_F_READ_STATE_MACHINE, ERR_R_INTERNAL_ERROR);

static enum SUB_STATE_RETURN read_state_machine(SSL *s) {
    STATEM *st = &s->statem;
    int ret, mt;
    unsigned long len;
    int (*transition)(SSL *s, int mt);
    PACKET pkt;
    enum MSG_PROCESS_RETURN (*process_message)(SSL *s, PACKET *pkt);
    enum WORK_STATE (*post_process_message)(SSL *s, enum WORK_STATE wst);
    unsigned long (*max_message_size)(SSL *s);
    void (*cb) (const SSL *ssl, int type, int val) = NULL;
    if (s->info_callback != NULL)
        cb = s->info_callback;
    else if (s->ctx->info_callback != NULL)
        cb = s->ctx->info_callback;
    if(s->server) {
        transition = server_read_transition;
        process_message = server_process_message;
        max_message_size = server_max_message_size;
        post_process_message = server_post_process_message;
    } else {
        transition = client_read_transition;
        process_message = client_process_message;
        max_message_size = client_max_message_size;
        post_process_message = client_post_process_message;
    }
    if (st->read_state_first_init) {
        s->first_packet = 1;
        st->read_state_first_init = 0;
    }
    while(1) {
        switch(st->read_state) {
        case READ_STATE_HEADER:
            s->init_num = 0;
            if (SSL_IS_DTLS(s)) {
                ret = dtls_get_message(s, &mt, &len);
            } else {
                ret = tls_get_message_header(s, &mt);
            }
            if (ret == 0) {
                return SUB_STATE_ERROR;
            }
            if (cb != NULL) {
                if (s->server)
                    cb(s, SSL_CB_ACCEPT_LOOP, 1);
                else
                    cb(s, SSL_CB_CONNECT_LOOP, 1);
            }
            if(!transition(s, mt)) {
                ssl3_send_alert(s, SSL3_AL_FATAL, SSL3_AD_UNEXPECTED_MESSAGE);
                SSLerr(SSL_F_READ_STATE_MACHINE, SSL_R_UNEXPECTED_MESSAGE);
                return SUB_STATE_ERROR;
            }
            if (s->s3->tmp.message_size > max_message_size(s)) {
                ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_ILLEGAL_PARAMETER);
                SSLerr(SSL_F_READ_STATE_MACHINE, SSL_R_EXCESSIVE_MESSAGE_SIZE);
                return SUB_STATE_ERROR;
            }
            st->read_state = READ_STATE_BODY;
        case READ_STATE_BODY:
            if (!SSL_IS_DTLS(s)) {
                ret = tls_get_message_body(s, &len);
                if (ret == 0) {
                    return SUB_STATE_ERROR;
                }
            }
            s->first_packet = 0;
            if (!PACKET_buf_init(&pkt, s->init_msg, len)) {
                ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR);
                SSLerr(SSL_F_READ_STATE_MACHINE, ERR_R_INTERNAL_ERROR);
                return SUB_STATE_ERROR;
            }
            ret = process_message(s, &pkt);
            if (ret == MSG_PROCESS_ERROR) {
                return SUB_STATE_ERROR;
            }
            if (ret == MSG_PROCESS_FINISHED_READING) {
                if (SSL_IS_DTLS(s)) {
                    dtls1_stop_timer(s);
                }
                return SUB_STATE_FINISHED;
            }
            if (ret == MSG_PROCESS_CONTINUE_PROCESSING) {
                st->read_state = READ_STATE_POST_PROCESS;
                st->read_state_work = WORK_MORE_A;
            } else {
                st->read_state = READ_STATE_HEADER;
            }
            break;
        case READ_STATE_POST_PROCESS:
            st->read_state_work = post_process_message(s, st->read_state_work);
            switch(st->read_state_work) {
            default:
                return SUB_STATE_ERROR;
            case WORK_FINISHED_CONTINUE:
                st->read_state = READ_STATE_HEADER;
                break;
            case WORK_FINISHED_STOP:
                if (SSL_IS_DTLS(s)) {
                    dtls1_stop_timer(s);
                }
                return SUB_STATE_FINISHED;
            }
            break;
        default:
            ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR);
            SSLerr(SSL_F_READ_STATE_MACHINE, ERR_R_INTERNAL_ERROR);
            statem_set_error(s);
            return SUB_STATE_ERROR;
        }
    }
}
['static enum SUB_STATE_RETURN read_state_machine(SSL *s) {\n    STATEM *st = &s->statem;\n    int ret, mt;\n    unsigned long len;\n    int (*transition)(SSL *s, int mt);\n    PACKET pkt;\n    enum MSG_PROCESS_RETURN (*process_message)(SSL *s, PACKET *pkt);\n    enum WORK_STATE (*post_process_message)(SSL *s, enum WORK_STATE wst);\n    unsigned long (*max_message_size)(SSL *s);\n    void (*cb) (const SSL *ssl, int type, int val) = NULL;\n    if (s->info_callback != NULL)\n        cb = s->info_callback;\n    else if (s->ctx->info_callback != NULL)\n        cb = s->ctx->info_callback;\n    if(s->server) {\n        transition = server_read_transition;\n        process_message = server_process_message;\n        max_message_size = server_max_message_size;\n        post_process_message = server_post_process_message;\n    } else {\n        transition = client_read_transition;\n        process_message = client_process_message;\n        max_message_size = client_max_message_size;\n        post_process_message = client_post_process_message;\n    }\n    if (st->read_state_first_init) {\n        s->first_packet = 1;\n        st->read_state_first_init = 0;\n    }\n    while(1) {\n        switch(st->read_state) {\n        case READ_STATE_HEADER:\n            s->init_num = 0;\n            if (SSL_IS_DTLS(s)) {\n                ret = dtls_get_message(s, &mt, &len);\n            } else {\n                ret = tls_get_message_header(s, &mt);\n            }\n            if (ret == 0) {\n                return SUB_STATE_ERROR;\n            }\n            if (cb != NULL) {\n                if (s->server)\n                    cb(s, SSL_CB_ACCEPT_LOOP, 1);\n                else\n                    cb(s, SSL_CB_CONNECT_LOOP, 1);\n            }\n            if(!transition(s, mt)) {\n                ssl3_send_alert(s, SSL3_AL_FATAL, SSL3_AD_UNEXPECTED_MESSAGE);\n                SSLerr(SSL_F_READ_STATE_MACHINE, SSL_R_UNEXPECTED_MESSAGE);\n                return SUB_STATE_ERROR;\n            }\n            if (s->s3->tmp.message_size > max_message_size(s)) {\n                ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_ILLEGAL_PARAMETER);\n                SSLerr(SSL_F_READ_STATE_MACHINE, SSL_R_EXCESSIVE_MESSAGE_SIZE);\n                return SUB_STATE_ERROR;\n            }\n            st->read_state = READ_STATE_BODY;\n        case READ_STATE_BODY:\n            if (!SSL_IS_DTLS(s)) {\n                ret = tls_get_message_body(s, &len);\n                if (ret == 0) {\n                    return SUB_STATE_ERROR;\n                }\n            }\n            s->first_packet = 0;\n            if (!PACKET_buf_init(&pkt, s->init_msg, len)) {\n                ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR);\n                SSLerr(SSL_F_READ_STATE_MACHINE, ERR_R_INTERNAL_ERROR);\n                return SUB_STATE_ERROR;\n            }\n            ret = process_message(s, &pkt);\n            if (ret == MSG_PROCESS_ERROR) {\n                return SUB_STATE_ERROR;\n            }\n            if (ret == MSG_PROCESS_FINISHED_READING) {\n                if (SSL_IS_DTLS(s)) {\n                    dtls1_stop_timer(s);\n                }\n                return SUB_STATE_FINISHED;\n            }\n            if (ret == MSG_PROCESS_CONTINUE_PROCESSING) {\n                st->read_state = READ_STATE_POST_PROCESS;\n                st->read_state_work = WORK_MORE_A;\n            } else {\n                st->read_state = READ_STATE_HEADER;\n            }\n            break;\n        case READ_STATE_POST_PROCESS:\n            st->read_state_work = post_process_message(s, st->read_state_work);\n            switch(st->read_state_work) {\n            default:\n                return SUB_STATE_ERROR;\n            case WORK_FINISHED_CONTINUE:\n                st->read_state = READ_STATE_HEADER;\n                break;\n            case WORK_FINISHED_STOP:\n                if (SSL_IS_DTLS(s)) {\n                    dtls1_stop_timer(s);\n                }\n                return SUB_STATE_FINISHED;\n            }\n            break;\n        default:\n            ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR);\n            SSLerr(SSL_F_READ_STATE_MACHINE, ERR_R_INTERNAL_ERROR);\n            statem_set_error(s);\n            return SUB_STATE_ERROR;\n        }\n    }\n}']