apps/s_client.c:2488: error: NULL_DEREFERENCE
  pointer `result` last assigned on line 2487 could be null and is dereferenced by call to `memcpy()` at line 2488, column 4.
Showing all 20 steps of the trace


apps/s_client.c:2477:1: start of procedure auth_suppdata_generate_cb()
2475.   	}
2476.   
2477. > static int auth_suppdata_generate_cb(SSL *s, unsigned short supp_data_type,
2478.   				     const unsigned char **out,
2479.   				     unsigned short *outlen, void *arg)

apps/s_client.c:2482:6: Taking true branch
2480.   	{
2481.   	unsigned char *result;
2482.   	if (c_auth && server_provided_client_authz && server_provided_server_authz)
             ^
2483.   		{
2484.   		if (!c_auth_require_reneg

apps/s_client.c:2482:16: Taking true branch
2480.   	{
2481.   	unsigned char *result;
2482.   	if (c_auth && server_provided_client_authz && server_provided_server_authz)
                       ^
2483.   		{
2484.   		if (!c_auth_require_reneg

apps/s_client.c:2482:48: Taking true branch
2480.   	{
2481.   	unsigned char *result;
2482.   	if (c_auth && server_provided_client_authz && server_provided_server_authz)
                                                       ^
2483.   		{
2484.   		if (!c_auth_require_reneg

apps/s_client.c:2484:8: Taking true branch
2482.   	if (c_auth && server_provided_client_authz && server_provided_server_authz)
2483.   		{
2484.   		if (!c_auth_require_reneg
               ^
2485.   		    || (c_auth_require_reneg && SSL_num_renegotiations(s)))
2486.   			{

apps/s_client.c:2487:4: 
2485.   		    || (c_auth_require_reneg && SSL_num_renegotiations(s)))
2486.   			{
2487. > 			result = OPENSSL_malloc(10);
2488.   			memcpy(result, "5432154321", 10);
2489.   			*out = result;

crypto/mem.c:295:1: start of procedure CRYPTO_malloc()
  293.   	}
  294.   
  295. > void *CRYPTO_malloc(int num, const char *file, int line)
  296.   	{
  297.   	void *ret = NULL;

crypto/mem.c:297:2: 
  295.   void *CRYPTO_malloc(int num, const char *file, int line)
  296.   	{
  297. > 	void *ret = NULL;
  298.   
  299.   	if (num <= 0) return NULL;

crypto/mem.c:299:6: Taking false branch
  297.   	void *ret = NULL;
  298.   
  299.   	if (num <= 0) return NULL;
              ^
  300.   
  301.   	allow_customize = 0;

crypto/mem.c:301:2: 
  299.   	if (num <= 0) return NULL;
  300.   
  301. > 	allow_customize = 0;
  302.   	if (malloc_debug_func != NULL)
  303.   		{

crypto/mem.c:302:6: Taking true branch
  300.   
  301.   	allow_customize = 0;
  302.   	if (malloc_debug_func != NULL)
              ^
  303.   		{
  304.   		allow_customize_debug = 0;

crypto/mem.c:304:3: 
  302.   	if (malloc_debug_func != NULL)
  303.   		{
  304. > 		allow_customize_debug = 0;
  305.   		malloc_debug_func(NULL, num, file, line, 0);
  306.   		}

crypto/mem.c:305:3: Skipping __function_pointer__(): unresolved function pointer
  303.   		{
  304.   		allow_customize_debug = 0;
  305.   		malloc_debug_func(NULL, num, file, line, 0);
           ^
  306.   		}
  307.   	ret = malloc_ex_func(num,file,line);

crypto/mem.c:307:2: Skipping __function_pointer__(): unresolved function pointer
  305.   		malloc_debug_func(NULL, num, file, line, 0);
  306.   		}
  307.   	ret = malloc_ex_func(num,file,line);
          ^
  308.   #ifdef LEVITTE_DEBUG_MEM
  309.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);

crypto/mem.c:311:6: Taking true branch
  309.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);
  310.   #endif
  311.   	if (malloc_debug_func != NULL)
              ^
  312.   		malloc_debug_func(ret, num, file, line, 1);
  313.   

crypto/mem.c:312:3: Skipping __function_pointer__(): unresolved function pointer
  310.   #endif
  311.   	if (malloc_debug_func != NULL)
  312.   		malloc_debug_func(ret, num, file, line, 1);
           ^
  313.   
  314.   #ifndef OPENSSL_CPUID_OBJ

crypto/mem.c:318:12: Taking false branch
  316.            * sanitisation function can't be optimised out. NB: We only do
  317.            * this for >2Kb so the overhead doesn't bother us. */
  318.           if(ret && (num > 2048))
                    ^
  319.   	{	extern unsigned char cleanse_ctr;
  320.                   ((unsigned char *)ret)[0] = cleanse_ctr;

crypto/mem.c:324:2: 
  322.   #endif
  323.   
  324. > 	return ret;
  325.   	}
  326.   char *CRYPTO_strdup(const char *str, const char *file, int line)

crypto/mem.c:325:2: return from a call to CRYPTO_malloc
  323.   
  324.   	return ret;
  325.   	}
          ^
  326.   char *CRYPTO_strdup(const char *str, const char *file, int line)
  327.   	{

apps/s_client.c:2488:4: 
2486.   			{
2487.   			result = OPENSSL_malloc(10);
2488. > 			memcpy(result, "5432154321", 10);
2489.   			*out = result;
2490.   			*outlen = 10;

static int auth_suppdata_generate_cb(SSL *s, unsigned short supp_data_type,
				     const unsigned char **out,
				     unsigned short *outlen, void *arg)
	{
	unsigned char *result;
	if (c_auth && server_provided_client_authz && server_provided_server_authz)
		{
		if (!c_auth_require_reneg
		    || (c_auth_require_reneg && SSL_num_renegotiations(s)))
			{
			result = OPENSSL_malloc(10);
			memcpy(result, "5432154321", 10);
			*out = result;
			*outlen = 10;
			return 1;
			}
		}
	return -1;
	}
['static int auth_suppdata_generate_cb(SSL *s, unsigned short supp_data_type,\n\t\t\t\t     const unsigned char **out,\n\t\t\t\t     unsigned short *outlen, void *arg)\n\t{\n\tunsigned char *result;\n\tif (c_auth && server_provided_client_authz && server_provided_server_authz)\n\t\t{\n\t\tif (!c_auth_require_reneg\n\t\t    || (c_auth_require_reneg && SSL_num_renegotiations(s)))\n\t\t\t{\n\t\t\tresult = OPENSSL_malloc(10);\n\t\t\tmemcpy(result, "5432154321", 10);\n\t\t\t*out = result;\n\t\t\t*outlen = 10;\n\t\t\treturn 1;\n\t\t\t}\n\t\t}\n\treturn -1;\n\t}', 'void *CRYPTO_malloc(int num, const char *file, int line)\n\t{\n\tvoid *ret = NULL;\n\tif (num <= 0) return NULL;\n\tallow_customize = 0;\n\tif (malloc_debug_func != NULL)\n\t\t{\n\t\tallow_customize_debug = 0;\n\t\tmalloc_debug_func(NULL, num, file, line, 0);\n\t\t}\n\tret = malloc_ex_func(num,file,line);\n#ifdef LEVITTE_DEBUG_MEM\n\tfprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\\n", ret, num);\n#endif\n\tif (malloc_debug_func != NULL)\n\t\tmalloc_debug_func(ret, num, file, line, 1);\n#ifndef OPENSSL_CPUID_OBJ\n        if(ret && (num > 2048))\n\t{\textern unsigned char cleanse_ctr;\n                ((unsigned char *)ret)[0] = cleanse_ctr;\n\t}\n#endif\n\treturn ret;\n\t}']