ssl/tls_srp.c:396: error: NULL_DEREFERENCE
  pointer `passwd` last assigned on line 365 could be null and is dereferenced by call to `strlen()` at line 396, column 5.
Showing all 26 steps of the trace


ssl/tls_srp.c:361:1: start of procedure srp_generate_client_master_secret()
359.   
360.   /* client side */
361. > int srp_generate_client_master_secret(SSL *s)
362.   {
363.       BIGNUM *x = NULL, *u = NULL, *K = NULL;

ssl/tls_srp.c:363:5: 
361.   int srp_generate_client_master_secret(SSL *s)
362.   {
363. >     BIGNUM *x = NULL, *u = NULL, *K = NULL;
364.       int ret = -1, tmp_len = 0;
365.       char *passwd = NULL;

ssl/tls_srp.c:364:5: 
362.   {
363.       BIGNUM *x = NULL, *u = NULL, *K = NULL;
364. >     int ret = -1, tmp_len = 0;
365.       char *passwd = NULL;
366.       unsigned char *tmp = NULL;

ssl/tls_srp.c:365:5: 
363.       BIGNUM *x = NULL, *u = NULL, *K = NULL;
364.       int ret = -1, tmp_len = 0;
365. >     char *passwd = NULL;
366.       unsigned char *tmp = NULL;
367.   

ssl/tls_srp.c:366:5: 
364.       int ret = -1, tmp_len = 0;
365.       char *passwd = NULL;
366. >     unsigned char *tmp = NULL;
367.   
368.       /*

ssl/tls_srp.c:371:9: 
369.        * Checks if b % n == 0
370.        */
371. >     if (SRP_Verify_B_mod_N(s->srp_ctx.B, s->srp_ctx.N) == 0)
372.           goto err;
373.       if ((u = SRP_Calc_u(s->srp_ctx.A, s->srp_ctx.B, s->srp_ctx.N)) == NULL)

crypto/srp/srp_lib.c:282:1: start of procedure SRP_Verify_B_mod_N()
  280.   }
  281.   
  282. > int SRP_Verify_B_mod_N(BIGNUM *B, BIGNUM *N)
  283.   {
  284.       BIGNUM *r;

crypto/srp/srp_lib.c:286:5: 
  284.       BIGNUM *r;
  285.       BN_CTX *bn_ctx;
  286. >     int ret = 0;
  287.   
  288.       if (B == NULL || N == NULL || (bn_ctx = BN_CTX_new()) == NULL)

crypto/srp/srp_lib.c:288:9: Taking false branch
  286.       int ret = 0;
  287.   
  288.       if (B == NULL || N == NULL || (bn_ctx = BN_CTX_new()) == NULL)
                 ^
  289.           return 0;
  290.   

crypto/srp/srp_lib.c:288:22: Taking false branch
  286.       int ret = 0;
  287.   
  288.       if (B == NULL || N == NULL || (bn_ctx = BN_CTX_new()) == NULL)
                              ^
  289.           return 0;
  290.   

crypto/srp/srp_lib.c:288:35: Taking true branch
  286.       int ret = 0;
  287.   
  288.       if (B == NULL || N == NULL || (bn_ctx = BN_CTX_new()) == NULL)
                                           ^
  289.           return 0;
  290.   

crypto/srp/srp_lib.c:289:9: 
  287.   
  288.       if (B == NULL || N == NULL || (bn_ctx = BN_CTX_new()) == NULL)
  289. >         return 0;
  290.   
  291.       if ((r = BN_new()) == NULL)

crypto/srp/srp_lib.c:301:1: return from a call to SRP_Verify_B_mod_N
  299.       BN_free(r);
  300.       return ret;
  301. > }
  302.   
  303.   int SRP_Verify_A_mod_N(BIGNUM *A, BIGNUM *N)

ssl/tls_srp.c:371:9: Taking true branch
369.        * Checks if b % n == 0
370.        */
371.       if (SRP_Verify_B_mod_N(s->srp_ctx.B, s->srp_ctx.N) == 0)
               ^
372.           goto err;
373.       if ((u = SRP_Calc_u(s->srp_ctx.A, s->srp_ctx.B, s->srp_ctx.N)) == NULL)

ssl/tls_srp.c:393:2: 
391.       BN_bn2bin(K, tmp);
392.       ret = ssl_generate_master_secret(s, tmp, tmp_len, 1);
393. >  err:
394.       BN_clear_free(K);
395.       BN_clear_free(x);

ssl/tls_srp.c:394:5: 
392.       ret = ssl_generate_master_secret(s, tmp, tmp_len, 1);
393.    err:
394. >     BN_clear_free(K);
395.       BN_clear_free(x);
396.       OPENSSL_clear_free(passwd, strlen(passwd));

crypto/bn/bn_lib.c:233:1: start of procedure BN_clear_free()
  231.   
  232.   
  233. > void BN_clear_free(BIGNUM *a)
  234.   {
  235.       int i;

crypto/bn/bn_lib.c:237:9: Taking true branch
  235.       int i;
  236.   
  237.       if (a == NULL)
                 ^
  238.           return;
  239.       bn_check_top(a);

crypto/bn/bn_lib.c:238:9: 
  236.   
  237.       if (a == NULL)
  238. >         return;
  239.       bn_check_top(a);
  240.       if (a->d != NULL) {

crypto/bn/bn_lib.c:249:1: return from a call to BN_clear_free
  247.       if (i)
  248.           OPENSSL_free(a);
  249. > }
  250.   
  251.   void BN_free(BIGNUM *a)

ssl/tls_srp.c:395:5: 
393.    err:
394.       BN_clear_free(K);
395. >     BN_clear_free(x);
396.       OPENSSL_clear_free(passwd, strlen(passwd));
397.       BN_clear_free(u);

crypto/bn/bn_lib.c:233:1: start of procedure BN_clear_free()
  231.   
  232.   
  233. > void BN_clear_free(BIGNUM *a)
  234.   {
  235.       int i;

crypto/bn/bn_lib.c:237:9: Taking true branch
  235.       int i;
  236.   
  237.       if (a == NULL)
                 ^
  238.           return;
  239.       bn_check_top(a);

crypto/bn/bn_lib.c:238:9: 
  236.   
  237.       if (a == NULL)
  238. >         return;
  239.       bn_check_top(a);
  240.       if (a->d != NULL) {

crypto/bn/bn_lib.c:249:1: return from a call to BN_clear_free
  247.       if (i)
  248.           OPENSSL_free(a);
  249. > }
  250.   
  251.   void BN_free(BIGNUM *a)

ssl/tls_srp.c:396:5: 
394.       BN_clear_free(K);
395.       BN_clear_free(x);
396. >     OPENSSL_clear_free(passwd, strlen(passwd));
397.       BN_clear_free(u);
398.       return ret;

int srp_generate_client_master_secret(SSL *s)
{
    BIGNUM *x = NULL, *u = NULL, *K = NULL;
    int ret = -1, tmp_len = 0;
    char *passwd = NULL;
    unsigned char *tmp = NULL;
    if (SRP_Verify_B_mod_N(s->srp_ctx.B, s->srp_ctx.N) == 0)
        goto err;
    if ((u = SRP_Calc_u(s->srp_ctx.A, s->srp_ctx.B, s->srp_ctx.N)) == NULL)
        goto err;
    if (s->srp_ctx.SRP_give_srp_client_pwd_callback == NULL)
        goto err;
    if (!
        (passwd =
         s->srp_ctx.SRP_give_srp_client_pwd_callback(s,
                                                     s->srp_ctx.SRP_cb_arg)))
        goto err;
    if ((x = SRP_Calc_x(s->srp_ctx.s, s->srp_ctx.login, passwd)) == NULL)
        goto err;
    if ((K = SRP_Calc_client_key(s->srp_ctx.N, s->srp_ctx.B, s->srp_ctx.g, x,
                                 s->srp_ctx.a, u)) == NULL)
        goto err;
    tmp_len = BN_num_bytes(K);
    if ((tmp = OPENSSL_malloc(tmp_len)) == NULL)
        goto err;
    BN_bn2bin(K, tmp);
    ret = ssl_generate_master_secret(s, tmp, tmp_len, 1);
 err:
    BN_clear_free(K);
    BN_clear_free(x);
    OPENSSL_clear_free(passwd, strlen(passwd));
    BN_clear_free(u);
    return ret;
}
['int srp_generate_client_master_secret(SSL *s)\n{\n    BIGNUM *x = NULL, *u = NULL, *K = NULL;\n    int ret = -1, tmp_len = 0;\n    char *passwd = NULL;\n    unsigned char *tmp = NULL;\n    if (SRP_Verify_B_mod_N(s->srp_ctx.B, s->srp_ctx.N) == 0)\n        goto err;\n    if ((u = SRP_Calc_u(s->srp_ctx.A, s->srp_ctx.B, s->srp_ctx.N)) == NULL)\n        goto err;\n    if (s->srp_ctx.SRP_give_srp_client_pwd_callback == NULL)\n        goto err;\n    if (!\n        (passwd =\n         s->srp_ctx.SRP_give_srp_client_pwd_callback(s,\n                                                     s->srp_ctx.SRP_cb_arg)))\n        goto err;\n    if ((x = SRP_Calc_x(s->srp_ctx.s, s->srp_ctx.login, passwd)) == NULL)\n        goto err;\n    if ((K = SRP_Calc_client_key(s->srp_ctx.N, s->srp_ctx.B, s->srp_ctx.g, x,\n                                 s->srp_ctx.a, u)) == NULL)\n        goto err;\n    tmp_len = BN_num_bytes(K);\n    if ((tmp = OPENSSL_malloc(tmp_len)) == NULL)\n        goto err;\n    BN_bn2bin(K, tmp);\n    ret = ssl_generate_master_secret(s, tmp, tmp_len, 1);\n err:\n    BN_clear_free(K);\n    BN_clear_free(x);\n    OPENSSL_clear_free(passwd, strlen(passwd));\n    BN_clear_free(u);\n    return ret;\n}', 'int SRP_Verify_B_mod_N(BIGNUM *B, BIGNUM *N)\n{\n    BIGNUM *r;\n    BN_CTX *bn_ctx;\n    int ret = 0;\n    if (B == NULL || N == NULL || (bn_ctx = BN_CTX_new()) == NULL)\n        return 0;\n    if ((r = BN_new()) == NULL)\n        goto err;\n    if (!BN_nnmod(r, B, N, bn_ctx))\n        goto err;\n    ret = !BN_is_zero(r);\n err:\n    BN_CTX_free(bn_ctx);\n    BN_free(r);\n    return ret;\n}', 'void BN_clear_free(BIGNUM *a)\n{\n    int i;\n    if (a == NULL)\n        return;\n    bn_check_top(a);\n    if (a->d != NULL) {\n        OPENSSL_cleanse(a->d, a->dmax * sizeof(a->d[0]));\n        if (!BN_get_flags(a, BN_FLG_STATIC_DATA))\n            bn_free_d(a);\n    }\n    i = BN_get_flags(a, BN_FLG_MALLOCED);\n    OPENSSL_cleanse(a, sizeof(*a));\n    if (i)\n        OPENSSL_free(a);\n}']