ssl/d1_both.c:1112: error: NULL_DEREFERENCE
  pointer `frag` last assigned on line 1110 could be null and is dereferenced at line 1112, column 9.
Showing all 22 steps of the trace


ssl/d1_both.c:1099:1: start of procedure dtls1_buffer_message()
1097.   	}
1098.   
1099. > int
1100.   dtls1_buffer_message(SSL *s, int is_ccs)
1101.   	{

ssl/d1_both.c:1108:2: Condition is true
1106.   	/* this function is called immediately after a message has 
1107.   	 * been serialized */
1108.   	OPENSSL_assert(s->init_off == 0);
         ^
1109.   
1110.   	frag = dtls1_hm_fragment_new(s->init_num, 0);

ssl/d1_both.c:1110:2: 
1108.   	OPENSSL_assert(s->init_off == 0);
1109.   
1110. > 	frag = dtls1_hm_fragment_new(s->init_num, 0);
1111.   
1112.   	memcpy(frag->fragment, s->init_buf->data, s->init_num);

ssl/d1_both.c:172:1: start of procedure dtls1_hm_fragment_new()
  170.   	long max, int *ok);
  171.   
  172. > static hm_fragment *
  173.   dtls1_hm_fragment_new(unsigned long frag_len, int reassembly)
  174.   	{

ssl/d1_both.c:175:2: 
  173.   dtls1_hm_fragment_new(unsigned long frag_len, int reassembly)
  174.   	{
  175. > 	hm_fragment *frag = NULL;
  176.   	unsigned char *buf = NULL;
  177.   	unsigned char *bitmask = NULL;

ssl/d1_both.c:176:2: 
  174.   	{
  175.   	hm_fragment *frag = NULL;
  176. > 	unsigned char *buf = NULL;
  177.   	unsigned char *bitmask = NULL;
  178.   

ssl/d1_both.c:177:2: 
  175.   	hm_fragment *frag = NULL;
  176.   	unsigned char *buf = NULL;
  177. > 	unsigned char *bitmask = NULL;
  178.   
  179.   	frag = (hm_fragment *)OPENSSL_malloc(sizeof(hm_fragment));

ssl/d1_both.c:179:2: 
  177.   	unsigned char *bitmask = NULL;
  178.   
  179. > 	frag = (hm_fragment *)OPENSSL_malloc(sizeof(hm_fragment));
  180.   	if ( frag == NULL)
  181.   		return NULL;

crypto/mem.c:297:1: start of procedure CRYPTO_malloc()
    295.   	}
    296.   
    297. > void *CRYPTO_malloc(int num, const char *file, int line)
    298.   	{
    299.   	void *ret = NULL;

crypto/mem.c:299:2: 
    297.   void *CRYPTO_malloc(int num, const char *file, int line)
    298.   	{
    299. > 	void *ret = NULL;
    300.   
    301.   	if (num <= 0) return NULL;

crypto/mem.c:301:6: Taking false branch
    299.   	void *ret = NULL;
    300.   
    301.   	if (num <= 0) return NULL;
                ^
    302.   
    303.   	allow_customize = 0;

crypto/mem.c:303:2: 
    301.   	if (num <= 0) return NULL;
    302.   
    303. > 	allow_customize = 0;
    304.   	if (malloc_debug_func != NULL)
    305.   		{

crypto/mem.c:304:6: Taking false branch
    302.   
    303.   	allow_customize = 0;
    304.   	if (malloc_debug_func != NULL)
                ^
    305.   		{
    306.   		allow_customize_debug = 0;

crypto/mem.c:309:2: Skipping __function_pointer__(): unresolved function pointer
    307.   		malloc_debug_func(NULL, num, file, line, 0);
    308.   		}
    309.   	ret = malloc_ex_func(num,file,line);
            ^
    310.   #ifdef LEVITTE_DEBUG_MEM
    311.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);

crypto/mem.c:313:6: Taking false branch
    311.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);
    312.   #endif
    313.   	if (malloc_debug_func != NULL)
                ^
    314.   		malloc_debug_func(ret, num, file, line, 1);
    315.   

crypto/mem.c:320:12: Taking false branch
    318.            * sanitisation function can't be optimised out. NB: We only do
    319.            * this for >2Kb so the overhead doesn't bother us. */
    320.           if(ret && (num > 2048))
                      ^
    321.   	{	extern unsigned char cleanse_ctr;
    322.                   ((unsigned char *)ret)[0] = cleanse_ctr;

crypto/mem.c:326:2: 
    324.   #endif
    325.   
    326. > 	return ret;
    327.   	}
    328.   char *CRYPTO_strdup(const char *str, const char *file, int line)

crypto/mem.c:327:2: return from a call to CRYPTO_malloc
    325.   
    326.   	return ret;
    327.   	}
            ^
    328.   char *CRYPTO_strdup(const char *str, const char *file, int line)
    329.   	{

ssl/d1_both.c:180:7: Taking true branch
  178.   
  179.   	frag = (hm_fragment *)OPENSSL_malloc(sizeof(hm_fragment));
  180.   	if ( frag == NULL)
               ^
  181.   		return NULL;
  182.   

ssl/d1_both.c:181:3: 
  179.   	frag = (hm_fragment *)OPENSSL_malloc(sizeof(hm_fragment));
  180.   	if ( frag == NULL)
  181. > 		return NULL;
  182.   
  183.   	if (frag_len)

ssl/d1_both.c:212:2: return from a call to dtls1_hm_fragment_new
  210.   
  211.   	return frag;
  212.   	}
          ^
  213.   
  214.   static void

ssl/d1_both.c:1112:2: 
1110.   	frag = dtls1_hm_fragment_new(s->init_num, 0);
1111.   
1112. > 	memcpy(frag->fragment, s->init_buf->data, s->init_num);
1113.   
1114.   	if ( is_ccs)

int
dtls1_buffer_message(SSL *s, int is_ccs)
	{
	pitem *item;
	hm_fragment *frag;
	unsigned char seq64be[8];
	OPENSSL_assert(s->init_off == 0);
	frag = dtls1_hm_fragment_new(s->init_num, 0);
	memcpy(frag->fragment, s->init_buf->data, s->init_num);
	if ( is_ccs)
		{
		OPENSSL_assert(s->d1->w_msg_hdr.msg_len +
			       ((s->version==DTLS1_VERSION)?DTLS1_CCS_HEADER_LENGTH:3) == (unsigned int)s->init_num);
		}
	else
		{
		OPENSSL_assert(s->d1->w_msg_hdr.msg_len +
			DTLS1_HM_HEADER_LENGTH == (unsigned int)s->init_num);
		}
	frag->msg_header.msg_len = s->d1->w_msg_hdr.msg_len;
	frag->msg_header.seq = s->d1->w_msg_hdr.seq;
	frag->msg_header.type = s->d1->w_msg_hdr.type;
	frag->msg_header.frag_off = 0;
	frag->msg_header.frag_len = s->d1->w_msg_hdr.msg_len;
	frag->msg_header.is_ccs = is_ccs;
	frag->msg_header.saved_retransmit_state.enc_write_ctx = s->enc_write_ctx;
	frag->msg_header.saved_retransmit_state.write_hash = s->write_hash;
	frag->msg_header.saved_retransmit_state.compress = s->compress;
	frag->msg_header.saved_retransmit_state.session = s->session;
	frag->msg_header.saved_retransmit_state.epoch = s->d1->w_epoch;
	memset(seq64be,0,sizeof(seq64be));
	seq64be[6] = (unsigned char)(dtls1_get_queue_priority(frag->msg_header.seq,
														  frag->msg_header.is_ccs)>>8);
	seq64be[7] = (unsigned char)(dtls1_get_queue_priority(frag->msg_header.seq,
														  frag->msg_header.is_ccs));
	item = pitem_new(seq64be, frag);
	if ( item == NULL)
		{
		dtls1_hm_fragment_free(frag);
		return 0;
		}
#if 0
	fprintf( stderr, "buffered messge: \ttype = %xx\n", msg_buf->type);
	fprintf( stderr, "\t\t\t\t\tlen = %d\n", msg_buf->len);
	fprintf( stderr, "\t\t\t\t\tseq_num = %d\n", msg_buf->seq_num);
#endif
	pqueue_insert(s->d1->sent_messages, item);
	return 1;
	}
['int\ndtls1_buffer_message(SSL *s, int is_ccs)\n\t{\n\tpitem *item;\n\thm_fragment *frag;\n\tunsigned char seq64be[8];\n\tOPENSSL_assert(s->init_off == 0);\n\tfrag = dtls1_hm_fragment_new(s->init_num, 0);\n\tmemcpy(frag->fragment, s->init_buf->data, s->init_num);\n\tif ( is_ccs)\n\t\t{\n\t\tOPENSSL_assert(s->d1->w_msg_hdr.msg_len +\n\t\t\t       ((s->version==DTLS1_VERSION)?DTLS1_CCS_HEADER_LENGTH:3) == (unsigned int)s->init_num);\n\t\t}\n\telse\n\t\t{\n\t\tOPENSSL_assert(s->d1->w_msg_hdr.msg_len +\n\t\t\tDTLS1_HM_HEADER_LENGTH == (unsigned int)s->init_num);\n\t\t}\n\tfrag->msg_header.msg_len = s->d1->w_msg_hdr.msg_len;\n\tfrag->msg_header.seq = s->d1->w_msg_hdr.seq;\n\tfrag->msg_header.type = s->d1->w_msg_hdr.type;\n\tfrag->msg_header.frag_off = 0;\n\tfrag->msg_header.frag_len = s->d1->w_msg_hdr.msg_len;\n\tfrag->msg_header.is_ccs = is_ccs;\n\tfrag->msg_header.saved_retransmit_state.enc_write_ctx = s->enc_write_ctx;\n\tfrag->msg_header.saved_retransmit_state.write_hash = s->write_hash;\n\tfrag->msg_header.saved_retransmit_state.compress = s->compress;\n\tfrag->msg_header.saved_retransmit_state.session = s->session;\n\tfrag->msg_header.saved_retransmit_state.epoch = s->d1->w_epoch;\n\tmemset(seq64be,0,sizeof(seq64be));\n\tseq64be[6] = (unsigned char)(dtls1_get_queue_priority(frag->msg_header.seq,\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t  frag->msg_header.is_ccs)>>8);\n\tseq64be[7] = (unsigned char)(dtls1_get_queue_priority(frag->msg_header.seq,\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t  frag->msg_header.is_ccs));\n\titem = pitem_new(seq64be, frag);\n\tif ( item == NULL)\n\t\t{\n\t\tdtls1_hm_fragment_free(frag);\n\t\treturn 0;\n\t\t}\n#if 0\n\tfprintf( stderr, "buffered messge: \\ttype = %xx\\n", msg_buf->type);\n\tfprintf( stderr, "\\t\\t\\t\\t\\tlen = %d\\n", msg_buf->len);\n\tfprintf( stderr, "\\t\\t\\t\\t\\tseq_num = %d\\n", msg_buf->seq_num);\n#endif\n\tpqueue_insert(s->d1->sent_messages, item);\n\treturn 1;\n\t}', 'static hm_fragment *\ndtls1_hm_fragment_new(unsigned long frag_len, int reassembly)\n\t{\n\thm_fragment *frag = NULL;\n\tunsigned char *buf = NULL;\n\tunsigned char *bitmask = NULL;\n\tfrag = (hm_fragment *)OPENSSL_malloc(sizeof(hm_fragment));\n\tif ( frag == NULL)\n\t\treturn NULL;\n\tif (frag_len)\n\t\t{\n\t\tbuf = (unsigned char *)OPENSSL_malloc(frag_len);\n\t\tif ( buf == NULL)\n\t\t\t{\n\t\t\tOPENSSL_free(frag);\n\t\t\treturn NULL;\n\t\t\t}\n\t\t}\n\tfrag->fragment = buf;\n\tif (reassembly)\n\t\t{\n\t\tbitmask = (unsigned char *)OPENSSL_malloc(RSMBLY_BITMASK_SIZE(frag_len));\n\t\tif (bitmask == NULL)\n\t\t\t{\n\t\t\tif (buf != NULL) OPENSSL_free(buf);\n\t\t\tOPENSSL_free(frag);\n\t\t\treturn NULL;\n\t\t\t}\n\t\tmemset(bitmask, 0, RSMBLY_BITMASK_SIZE(frag_len));\n\t\t}\n\tfrag->reassembly = bitmask;\n\treturn frag;\n\t}', 'void *CRYPTO_malloc(int num, const char *file, int line)\n\t{\n\tvoid *ret = NULL;\n\tif (num <= 0) return NULL;\n\tallow_customize = 0;\n\tif (malloc_debug_func != NULL)\n\t\t{\n\t\tallow_customize_debug = 0;\n\t\tmalloc_debug_func(NULL, num, file, line, 0);\n\t\t}\n\tret = malloc_ex_func(num,file,line);\n#ifdef LEVITTE_DEBUG_MEM\n\tfprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\\n", ret, num);\n#endif\n\tif (malloc_debug_func != NULL)\n\t\tmalloc_debug_func(ret, num, file, line, 1);\n#ifndef OPENSSL_CPUID_OBJ\n        if(ret && (num > 2048))\n\t{\textern unsigned char cleanse_ctr;\n                ((unsigned char *)ret)[0] = cleanse_ctr;\n\t}\n#endif\n\treturn ret;\n\t}']