ssl/d1_both.c:1051: error: NULL_DEREFERENCE
  pointer `frag` last assigned on line 1049 could be null and is dereferenced at line 1051, column 12.
Showing all 21 steps of the trace


ssl/d1_both.c:1038:1: start of procedure dtls1_buffer_message()
1036.   #endif
1037.   
1038. > int
1039.   dtls1_buffer_message(SSL *s, int is_ccs)
1040.       {

ssl/d1_both.c:1047:5: Condition is true
1045.       /* this function is called immediately after a message has 
1046.        * been serialized */
1047.       OPENSSL_assert(s->init_off == 0);
            ^
1048.   
1049.       frag = dtls1_hm_fragment_new(s->init_num);

ssl/d1_both.c:1049:5: 
1047.       OPENSSL_assert(s->init_off == 0);
1048.   
1049. >     frag = dtls1_hm_fragment_new(s->init_num);
1050.   
1051.       memcpy(frag->fragment, s->init_buf->data, s->init_num);

ssl/d1_both.c:144:1: start of procedure dtls1_hm_fragment_new()
  142.   static void dtls1_process_handshake_fragment(SSL *s, int frag_len);
  143.   
  144. > static hm_fragment *
  145.   dtls1_hm_fragment_new(unsigned long frag_len)
  146.       {

ssl/d1_both.c:147:5: 
  145.   dtls1_hm_fragment_new(unsigned long frag_len)
  146.       {
  147. >     hm_fragment *frag = NULL;
  148.       unsigned char *buf = NULL;
  149.   

ssl/d1_both.c:148:5: 
  146.       {
  147.       hm_fragment *frag = NULL;
  148. >     unsigned char *buf = NULL;
  149.   
  150.       frag = (hm_fragment *)OPENSSL_malloc(sizeof(hm_fragment));

ssl/d1_both.c:150:5: 
  148.       unsigned char *buf = NULL;
  149.   
  150. >     frag = (hm_fragment *)OPENSSL_malloc(sizeof(hm_fragment));
  151.       if ( frag == NULL)
  152.           return NULL;

crypto/mem.c:294:1: start of procedure CRYPTO_malloc()
    292.   	}
    293.   
    294. > void *CRYPTO_malloc(int num, const char *file, int line)
    295.   	{
    296.   	void *ret = NULL;

crypto/mem.c:296:2: 
    294.   void *CRYPTO_malloc(int num, const char *file, int line)
    295.   	{
    296. > 	void *ret = NULL;
    297.   
    298.   	if (num <= 0) return NULL;

crypto/mem.c:298:6: Taking false branch
    296.   	void *ret = NULL;
    297.   
    298.   	if (num <= 0) return NULL;
                ^
    299.   
    300.   	allow_customize = 0;

crypto/mem.c:300:2: 
    298.   	if (num <= 0) return NULL;
    299.   
    300. > 	allow_customize = 0;
    301.   	if (malloc_debug_func != NULL)
    302.   		{

crypto/mem.c:301:6: Taking false branch
    299.   
    300.   	allow_customize = 0;
    301.   	if (malloc_debug_func != NULL)
                ^
    302.   		{
    303.   		allow_customize_debug = 0;

crypto/mem.c:306:2: Skipping __function_pointer__(): unresolved function pointer
    304.   		malloc_debug_func(NULL, num, file, line, 0);
    305.   		}
    306.   	ret = malloc_ex_func(num,file,line);
            ^
    307.   #ifdef LEVITTE_DEBUG_MEM
    308.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);

crypto/mem.c:310:6: Taking false branch
    308.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);
    309.   #endif
    310.   	if (malloc_debug_func != NULL)
                ^
    311.   		malloc_debug_func(ret, num, file, line, 1);
    312.   

crypto/mem.c:317:12: Taking false branch
    315.            * sanitisation function can't be optimised out. NB: We only do
    316.            * this for >2Kb so the overhead doesn't bother us. */
    317.           if(ret && (num > 2048))
                      ^
    318.   	{	extern unsigned char cleanse_ctr;
    319.                   ((unsigned char *)ret)[0] = cleanse_ctr;

crypto/mem.c:323:2: 
    321.   #endif
    322.   
    323. > 	return ret;
    324.   	}
    325.   

crypto/mem.c:324:2: return from a call to CRYPTO_malloc
    322.   
    323.   	return ret;
    324.   	}
            ^
    325.   
    326.   void *CRYPTO_realloc(void *str, int num, const char *file, int line)

ssl/d1_both.c:151:10: Taking true branch
  149.   
  150.       frag = (hm_fragment *)OPENSSL_malloc(sizeof(hm_fragment));
  151.       if ( frag == NULL)
                  ^
  152.           return NULL;
  153.   

ssl/d1_both.c:152:9: 
  150.       frag = (hm_fragment *)OPENSSL_malloc(sizeof(hm_fragment));
  151.       if ( frag == NULL)
  152. >         return NULL;
  153.   
  154.       buf = (unsigned char *)OPENSSL_malloc(frag_len 

ssl/d1_both.c:165:5: return from a call to dtls1_hm_fragment_new
  163.   
  164.       return frag;
  165.       }
             ^
  166.   
  167.   static void

ssl/d1_both.c:1051:5: 
1049.       frag = dtls1_hm_fragment_new(s->init_num);
1050.   
1051. >     memcpy(frag->fragment, s->init_buf->data, s->init_num);
1052.   
1053.       if ( is_ccs)

int
dtls1_buffer_message(SSL *s, int is_ccs)
    {
    pitem *item;
    hm_fragment *frag;
    unsigned char seq64be[8];
    OPENSSL_assert(s->init_off == 0);
    frag = dtls1_hm_fragment_new(s->init_num);
    memcpy(frag->fragment, s->init_buf->data, s->init_num);
    if ( is_ccs)
        {
        OPENSSL_assert(s->d1->w_msg_hdr.msg_len +
            DTLS1_CCS_HEADER_LENGTH == (unsigned int)s->init_num);
        }
    else
        {
        OPENSSL_assert(s->d1->w_msg_hdr.msg_len +
            DTLS1_HM_HEADER_LENGTH == (unsigned int)s->init_num);
        }
    frag->msg_header.msg_len = s->d1->w_msg_hdr.msg_len;
    frag->msg_header.seq = s->d1->w_msg_hdr.seq;
    frag->msg_header.type = s->d1->w_msg_hdr.type;
    frag->msg_header.frag_off = 0;
    frag->msg_header.frag_len = s->d1->w_msg_hdr.msg_len;
    frag->msg_header.is_ccs = is_ccs;
    memset(seq64be,0,sizeof(seq64be));
    seq64be[6] = (unsigned char)(frag->msg_header.seq>>8);
    seq64be[7] = (unsigned char)(frag->msg_header.seq);
    item = pitem_new(seq64be, frag);
    if ( item == NULL)
        {
        dtls1_hm_fragment_free(frag);
        return 0;
        }
#if 0
    fprintf( stderr, "buffered messge: \ttype = %xx\n", msg_buf->type);
    fprintf( stderr, "\t\t\t\t\tlen = %d\n", msg_buf->len);
    fprintf( stderr, "\t\t\t\t\tseq_num = %d\n", msg_buf->seq_num);
#endif
    pqueue_insert(s->d1->sent_messages, item);
    return 1;
    }
['int\ndtls1_buffer_message(SSL *s, int is_ccs)\n    {\n    pitem *item;\n    hm_fragment *frag;\n    unsigned char seq64be[8];\n    OPENSSL_assert(s->init_off == 0);\n    frag = dtls1_hm_fragment_new(s->init_num);\n    memcpy(frag->fragment, s->init_buf->data, s->init_num);\n    if ( is_ccs)\n        {\n        OPENSSL_assert(s->d1->w_msg_hdr.msg_len +\n            DTLS1_CCS_HEADER_LENGTH == (unsigned int)s->init_num);\n        }\n    else\n        {\n        OPENSSL_assert(s->d1->w_msg_hdr.msg_len +\n            DTLS1_HM_HEADER_LENGTH == (unsigned int)s->init_num);\n        }\n    frag->msg_header.msg_len = s->d1->w_msg_hdr.msg_len;\n    frag->msg_header.seq = s->d1->w_msg_hdr.seq;\n    frag->msg_header.type = s->d1->w_msg_hdr.type;\n    frag->msg_header.frag_off = 0;\n    frag->msg_header.frag_len = s->d1->w_msg_hdr.msg_len;\n    frag->msg_header.is_ccs = is_ccs;\n    memset(seq64be,0,sizeof(seq64be));\n    seq64be[6] = (unsigned char)(frag->msg_header.seq>>8);\n    seq64be[7] = (unsigned char)(frag->msg_header.seq);\n    item = pitem_new(seq64be, frag);\n    if ( item == NULL)\n        {\n        dtls1_hm_fragment_free(frag);\n        return 0;\n        }\n#if 0\n    fprintf( stderr, "buffered messge: \\ttype = %xx\\n", msg_buf->type);\n    fprintf( stderr, "\\t\\t\\t\\t\\tlen = %d\\n", msg_buf->len);\n    fprintf( stderr, "\\t\\t\\t\\t\\tseq_num = %d\\n", msg_buf->seq_num);\n#endif\n    pqueue_insert(s->d1->sent_messages, item);\n    return 1;\n    }', 'static hm_fragment *\ndtls1_hm_fragment_new(unsigned long frag_len)\n    {\n    hm_fragment *frag = NULL;\n    unsigned char *buf = NULL;\n    frag = (hm_fragment *)OPENSSL_malloc(sizeof(hm_fragment));\n    if ( frag == NULL)\n        return NULL;\n    buf = (unsigned char *)OPENSSL_malloc(frag_len\n        + DTLS1_HM_HEADER_LENGTH);\n    if ( buf == NULL)\n        {\n        OPENSSL_free(frag);\n        return NULL;\n        }\n    frag->fragment = buf;\n    return frag;\n    }', 'void *CRYPTO_malloc(int num, const char *file, int line)\n\t{\n\tvoid *ret = NULL;\n\tif (num <= 0) return NULL;\n\tallow_customize = 0;\n\tif (malloc_debug_func != NULL)\n\t\t{\n\t\tallow_customize_debug = 0;\n\t\tmalloc_debug_func(NULL, num, file, line, 0);\n\t\t}\n\tret = malloc_ex_func(num,file,line);\n#ifdef LEVITTE_DEBUG_MEM\n\tfprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\\n", ret, num);\n#endif\n\tif (malloc_debug_func != NULL)\n\t\tmalloc_debug_func(ret, num, file, line, 1);\n#ifndef OPENSSL_CPUID_OBJ\n        if(ret && (num > 2048))\n\t{\textern unsigned char cleanse_ctr;\n                ((unsigned char *)ret)[0] = cleanse_ctr;\n\t}\n#endif\n\treturn ret;\n\t}']