ssl/statem/statem_srvr.c:1453: error: NULL_DEREFERENCE
  pointer `clienthello` last assigned on line 1253 could be null and is dereferenced at line 1453, column 5.
Showing all 27 steps of the trace


ssl/statem/statem_srvr.c:1245:1: start of procedure tls_process_client_hello()
1243.   #endif                          /* !OPENSSL_NO_EC */
1244.   
1245. > MSG_PROCESS_RETURN tls_process_client_hello(SSL *s, PACKET *pkt)
1246.   {
1247.       int al = SSL_AD_INTERNAL_ERROR;

ssl/statem/statem_srvr.c:1247:5: 
1245.   MSG_PROCESS_RETURN tls_process_client_hello(SSL *s, PACKET *pkt)
1246.   {
1247. >     int al = SSL_AD_INTERNAL_ERROR;
1248.       /* |cookie| will only be initialized for DTLS. */
1249.       PACKET session_id, compression, extensions, cookie;

ssl/statem/statem_srvr.c:1250:5: 
1248.       /* |cookie| will only be initialized for DTLS. */
1249.       PACKET session_id, compression, extensions, cookie;
1250. >     static const unsigned char null_compression = 0;
1251.       CLIENTHELLO_MSG *clienthello;
1252.   

ssl/statem/statem_srvr.c:1253:5: 
1251.       CLIENTHELLO_MSG *clienthello;
1252.   
1253. >     clienthello = OPENSSL_zalloc(sizeof(*clienthello));
1254.       if (clienthello == NULL) {
1255.           SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, ERR_R_INTERNAL_ERROR);

crypto/mem.c:186:1: start of procedure CRYPTO_zalloc()
  184.   }
  185.   
  186. > void *CRYPTO_zalloc(size_t num, const char *file, int line)
  187.   {
  188.       void *ret = CRYPTO_malloc(num, file, line);

crypto/mem.c:188:5: 
  186.   void *CRYPTO_zalloc(size_t num, const char *file, int line)
  187.   {
  188. >     void *ret = CRYPTO_malloc(num, file, line);
  189.   
  190.       FAILTEST();

crypto/mem.c:158:1: start of procedure CRYPTO_malloc()
    156.   #endif
    157.   
    158. > void *CRYPTO_malloc(size_t num, const char *file, int line)
    159.   {
    160.       void *ret = NULL;

crypto/mem.c:160:5: 
    158.   void *CRYPTO_malloc(size_t num, const char *file, int line)
    159.   {
    160. >     void *ret = NULL;
    161.   
    162.       if (malloc_impl != NULL && malloc_impl != CRYPTO_malloc)

crypto/mem.c:162:9: Taking false branch
    160.       void *ret = NULL;
    161.   
    162.       if (malloc_impl != NULL && malloc_impl != CRYPTO_malloc)
                   ^
    163.           return malloc_impl(num, file, line);
    164.   

crypto/mem.c:165:9: Taking false branch
    163.           return malloc_impl(num, file, line);
    164.   
    165.       if (num == 0)
                   ^
    166.           return NULL;
    167.   

crypto/mem.c:169:5: 
    167.   
    168.       FAILTEST();
    169. >     allow_customize = 0;
    170.   #ifndef OPENSSL_NO_CRYPTO_MDEBUG
    171.       if (call_malloc_debug) {

crypto/mem.c:179:5: 
    177.       }
    178.   #else
    179. >     osslargused(file); osslargused(line);
    180.       ret = malloc(num);
    181.   #endif

crypto/mem.c:179:24: 
    177.       }
    178.   #else
    179. >     osslargused(file); osslargused(line);
    180.       ret = malloc(num);
    181.   #endif

crypto/mem.c:180:5: 
    178.   #else
    179.       osslargused(file); osslargused(line);
    180. >     ret = malloc(num);
    181.   #endif
    182.   

crypto/mem.c:183:5: 
    181.   #endif
    182.   
    183. >     return ret;
    184.   }
    185.   

crypto/mem.c:184:1: return from a call to CRYPTO_malloc
    182.   
    183.       return ret;
    184. > }
    185.   
    186.   void *CRYPTO_zalloc(size_t num, const char *file, int line)

crypto/mem.c:191:9: Taking false branch
  189.   
  190.       FAILTEST();
  191.       if (ret != NULL)
                 ^
  192.           memset(ret, 0, num);
  193.       return ret;

crypto/mem.c:193:5: 
  191.       if (ret != NULL)
  192.           memset(ret, 0, num);
  193. >     return ret;
  194.   }
  195.   

crypto/mem.c:194:1: return from a call to CRYPTO_zalloc
  192.           memset(ret, 0, num);
  193.       return ret;
  194. > }
  195.   
  196.   void *CRYPTO_realloc(void *str, size_t num, const char *file, int line)

ssl/statem/statem_srvr.c:1254:9: Taking true branch
1252.   
1253.       clienthello = OPENSSL_zalloc(sizeof(*clienthello));
1254.       if (clienthello == NULL) {
                ^
1255.           SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, ERR_R_INTERNAL_ERROR);
1256.           goto err;

ssl/statem/statem_srvr.c:1255:9: Skipping ERR_put_error(): empty list of specs
1253.       clienthello = OPENSSL_zalloc(sizeof(*clienthello));
1254.       if (clienthello == NULL) {
1255.           SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, ERR_R_INTERNAL_ERROR);
                ^
1256.           goto err;
1257.       }

ssl/statem/statem_srvr.c:1450:2: 
1448.    f_err:
1449.       ssl3_send_alert(s, SSL3_AL_FATAL, al);
1450. >  err:
1451.       ossl_statem_set_error(s);
1452.   

ssl/statem/statem_srvr.c:1451:5: 
1449.       ssl3_send_alert(s, SSL3_AL_FATAL, al);
1450.    err:
1451. >     ossl_statem_set_error(s);
1452.   
1453.       OPENSSL_free(clienthello->pre_proc_exts);

ssl/statem/statem.c:116:1: start of procedure ossl_statem_set_error()
  114.    * the current connection.
  115.    */
  116. > void ossl_statem_set_error(SSL *s)
  117.   {
  118.       s->statem.state = MSG_FLOW_ERROR;

ssl/statem/statem.c:118:5: 
  116.   void ossl_statem_set_error(SSL *s)
  117.   {
  118. >     s->statem.state = MSG_FLOW_ERROR;
  119.   }
  120.   

ssl/statem/statem.c:119:1: return from a call to ossl_statem_set_error
  117.   {
  118.       s->statem.state = MSG_FLOW_ERROR;
  119. > }
  120.   
  121.   /*

ssl/statem/statem_srvr.c:1453:5: 
1451.       ossl_statem_set_error(s);
1452.   
1453. >     OPENSSL_free(clienthello->pre_proc_exts);
1454.       OPENSSL_free(clienthello);
1455.   

MSG_PROCESS_RETURN tls_process_client_hello(SSL *s, PACKET *pkt)
{
    int al = SSL_AD_INTERNAL_ERROR;
    PACKET session_id, compression, extensions, cookie;
    static const unsigned char null_compression = 0;
    CLIENTHELLO_MSG *clienthello;
    clienthello = OPENSSL_zalloc(sizeof(*clienthello));
    if (clienthello == NULL) {
        SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, ERR_R_INTERNAL_ERROR);
        goto err;
    }
    if (s->renegotiate == 0 && !SSL_IS_FIRST_HANDSHAKE(s)) {
        s->renegotiate = 1;
        s->new_session = 1;
    }
    clienthello->isv2 = RECORD_LAYER_is_sslv2_record(&s->rlayer);
    PACKET_null_init(&cookie);
    if (clienthello->isv2) {
        unsigned int mt;
        if (!SSL_IS_FIRST_HANDSHAKE(s) || s->hello_retry_request) {
            al = SSL_AD_HANDSHAKE_FAILURE;
            SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, SSL_R_UNEXPECTED_MESSAGE);
            goto f_err;
        }
        if (!PACKET_get_1(pkt, &mt)
            || mt != SSL2_MT_CLIENT_HELLO) {
            SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, ERR_R_INTERNAL_ERROR);
            goto err;
        }
    }
    if (!PACKET_get_net_2(pkt, &clienthello->legacy_version)) {
        al = SSL_AD_DECODE_ERROR;
        SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, SSL_R_LENGTH_TOO_SHORT);
        goto err;
    }
    if (clienthello->isv2) {
        unsigned int ciphersuite_len, session_id_len, challenge_len;
        PACKET challenge;
        if (!PACKET_get_net_2(pkt, &ciphersuite_len)
            || !PACKET_get_net_2(pkt, &session_id_len)
            || !PACKET_get_net_2(pkt, &challenge_len)) {
            SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO,
                   SSL_R_RECORD_LENGTH_MISMATCH);
            al = SSL_AD_DECODE_ERROR;
            goto f_err;
        }
        if (session_id_len > SSL_MAX_SSL_SESSION_ID_LENGTH) {
            al = SSL_AD_DECODE_ERROR;
            SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, SSL_R_LENGTH_MISMATCH);
            goto f_err;
        }
        if (!PACKET_get_sub_packet(pkt, &clienthello->ciphersuites,
                                   ciphersuite_len)
            || !PACKET_copy_bytes(pkt, clienthello->session_id, session_id_len)
            || !PACKET_get_sub_packet(pkt, &challenge, challenge_len)
            || PACKET_remaining(pkt) != 0) {
            SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO,
                   SSL_R_RECORD_LENGTH_MISMATCH);
            al = SSL_AD_DECODE_ERROR;
            goto f_err;
        }
        clienthello->session_id_len = session_id_len;
        challenge_len = challenge_len > SSL3_RANDOM_SIZE
                        ? SSL3_RANDOM_SIZE : challenge_len;
        memset(clienthello->random, 0, SSL3_RANDOM_SIZE);
        if (!PACKET_copy_bytes(&challenge,
                               clienthello->random + SSL3_RANDOM_SIZE -
                               challenge_len, challenge_len)
            || !PACKET_buf_init(&compression, &null_compression, 1)) {
            SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, ERR_R_INTERNAL_ERROR);
            al = SSL_AD_INTERNAL_ERROR;
            goto f_err;
        }
        PACKET_null_init(&clienthello->extensions);
    } else {
        if (!PACKET_copy_bytes(pkt, clienthello->random, SSL3_RANDOM_SIZE)
            || !PACKET_get_length_prefixed_1(pkt, &session_id)
            || !PACKET_copy_all(&session_id, clienthello->session_id,
                    SSL_MAX_SSL_SESSION_ID_LENGTH,
                    &clienthello->session_id_len)) {
            al = SSL_AD_DECODE_ERROR;
            SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, SSL_R_LENGTH_MISMATCH);
            goto f_err;
        }
        if (SSL_IS_DTLS(s)) {
            if (!PACKET_get_length_prefixed_1(pkt, &cookie)) {
                al = SSL_AD_DECODE_ERROR;
                SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, SSL_R_LENGTH_MISMATCH);
                goto f_err;
            }
            if (!PACKET_copy_all(&cookie, clienthello->dtls_cookie,
                                 DTLS1_COOKIE_LENGTH,
                                 &clienthello->dtls_cookie_len)) {
                al = SSL_AD_DECODE_ERROR;
                SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, SSL_R_LENGTH_MISMATCH);
                goto f_err;
            }
            if (SSL_get_options(s) & SSL_OP_COOKIE_EXCHANGE) {
                if (clienthello->dtls_cookie_len == 0)
                    return 1;
            }
        }
        if (!PACKET_get_length_prefixed_2(pkt, &clienthello->ciphersuites)) {
            al = SSL_AD_DECODE_ERROR;
            SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, SSL_R_LENGTH_MISMATCH);
            goto f_err;
        }
        if (!PACKET_get_length_prefixed_1(pkt, &compression)) {
            al = SSL_AD_DECODE_ERROR;
            SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, SSL_R_LENGTH_MISMATCH);
            goto f_err;
        }
        if (PACKET_remaining(pkt) == 0) {
            PACKET_null_init(&clienthello->extensions);
        } else {
            if (!PACKET_get_length_prefixed_2(pkt, &clienthello->extensions)) {
                al = SSL_AD_DECODE_ERROR;
                SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, SSL_R_LENGTH_MISMATCH);
                goto f_err;
            }
        }
    }
    if (!PACKET_copy_all(&compression, clienthello->compressions,
                         MAX_COMPRESSIONS_SIZE,
                         &clienthello->compressions_len)) {
        al = SSL_AD_DECODE_ERROR;
        SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, SSL_R_LENGTH_MISMATCH);
        goto f_err;
    }
    extensions = clienthello->extensions;
    if (!tls_collect_extensions(s, &extensions, EXT_CLIENT_HELLO,
                                &clienthello->pre_proc_exts, &al,
                                &clienthello->pre_proc_exts_len)) {
        goto f_err;
    }
    s->clienthello = clienthello;
    return MSG_PROCESS_CONTINUE_PROCESSING;
 f_err:
    ssl3_send_alert(s, SSL3_AL_FATAL, al);
 err:
    ossl_statem_set_error(s);
    OPENSSL_free(clienthello->pre_proc_exts);
    OPENSSL_free(clienthello);
    return MSG_PROCESS_ERROR;
}
['MSG_PROCESS_RETURN tls_process_client_hello(SSL *s, PACKET *pkt)\n{\n    int al = SSL_AD_INTERNAL_ERROR;\n    PACKET session_id, compression, extensions, cookie;\n    static const unsigned char null_compression = 0;\n    CLIENTHELLO_MSG *clienthello;\n    clienthello = OPENSSL_zalloc(sizeof(*clienthello));\n    if (clienthello == NULL) {\n        SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, ERR_R_INTERNAL_ERROR);\n        goto err;\n    }\n    if (s->renegotiate == 0 && !SSL_IS_FIRST_HANDSHAKE(s)) {\n        s->renegotiate = 1;\n        s->new_session = 1;\n    }\n    clienthello->isv2 = RECORD_LAYER_is_sslv2_record(&s->rlayer);\n    PACKET_null_init(&cookie);\n    if (clienthello->isv2) {\n        unsigned int mt;\n        if (!SSL_IS_FIRST_HANDSHAKE(s) || s->hello_retry_request) {\n            al = SSL_AD_HANDSHAKE_FAILURE;\n            SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, SSL_R_UNEXPECTED_MESSAGE);\n            goto f_err;\n        }\n        if (!PACKET_get_1(pkt, &mt)\n            || mt != SSL2_MT_CLIENT_HELLO) {\n            SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, ERR_R_INTERNAL_ERROR);\n            goto err;\n        }\n    }\n    if (!PACKET_get_net_2(pkt, &clienthello->legacy_version)) {\n        al = SSL_AD_DECODE_ERROR;\n        SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, SSL_R_LENGTH_TOO_SHORT);\n        goto err;\n    }\n    if (clienthello->isv2) {\n        unsigned int ciphersuite_len, session_id_len, challenge_len;\n        PACKET challenge;\n        if (!PACKET_get_net_2(pkt, &ciphersuite_len)\n            || !PACKET_get_net_2(pkt, &session_id_len)\n            || !PACKET_get_net_2(pkt, &challenge_len)) {\n            SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO,\n                   SSL_R_RECORD_LENGTH_MISMATCH);\n            al = SSL_AD_DECODE_ERROR;\n            goto f_err;\n        }\n        if (session_id_len > SSL_MAX_SSL_SESSION_ID_LENGTH) {\n            al = SSL_AD_DECODE_ERROR;\n            SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, SSL_R_LENGTH_MISMATCH);\n            goto f_err;\n        }\n        if (!PACKET_get_sub_packet(pkt, &clienthello->ciphersuites,\n                                   ciphersuite_len)\n            || !PACKET_copy_bytes(pkt, clienthello->session_id, session_id_len)\n            || !PACKET_get_sub_packet(pkt, &challenge, challenge_len)\n            || PACKET_remaining(pkt) != 0) {\n            SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO,\n                   SSL_R_RECORD_LENGTH_MISMATCH);\n            al = SSL_AD_DECODE_ERROR;\n            goto f_err;\n        }\n        clienthello->session_id_len = session_id_len;\n        challenge_len = challenge_len > SSL3_RANDOM_SIZE\n                        ? SSL3_RANDOM_SIZE : challenge_len;\n        memset(clienthello->random, 0, SSL3_RANDOM_SIZE);\n        if (!PACKET_copy_bytes(&challenge,\n                               clienthello->random + SSL3_RANDOM_SIZE -\n                               challenge_len, challenge_len)\n            || !PACKET_buf_init(&compression, &null_compression, 1)) {\n            SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, ERR_R_INTERNAL_ERROR);\n            al = SSL_AD_INTERNAL_ERROR;\n            goto f_err;\n        }\n        PACKET_null_init(&clienthello->extensions);\n    } else {\n        if (!PACKET_copy_bytes(pkt, clienthello->random, SSL3_RANDOM_SIZE)\n            || !PACKET_get_length_prefixed_1(pkt, &session_id)\n            || !PACKET_copy_all(&session_id, clienthello->session_id,\n                    SSL_MAX_SSL_SESSION_ID_LENGTH,\n                    &clienthello->session_id_len)) {\n            al = SSL_AD_DECODE_ERROR;\n            SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, SSL_R_LENGTH_MISMATCH);\n            goto f_err;\n        }\n        if (SSL_IS_DTLS(s)) {\n            if (!PACKET_get_length_prefixed_1(pkt, &cookie)) {\n                al = SSL_AD_DECODE_ERROR;\n                SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, SSL_R_LENGTH_MISMATCH);\n                goto f_err;\n            }\n            if (!PACKET_copy_all(&cookie, clienthello->dtls_cookie,\n                                 DTLS1_COOKIE_LENGTH,\n                                 &clienthello->dtls_cookie_len)) {\n                al = SSL_AD_DECODE_ERROR;\n                SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, SSL_R_LENGTH_MISMATCH);\n                goto f_err;\n            }\n            if (SSL_get_options(s) & SSL_OP_COOKIE_EXCHANGE) {\n                if (clienthello->dtls_cookie_len == 0)\n                    return 1;\n            }\n        }\n        if (!PACKET_get_length_prefixed_2(pkt, &clienthello->ciphersuites)) {\n            al = SSL_AD_DECODE_ERROR;\n            SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, SSL_R_LENGTH_MISMATCH);\n            goto f_err;\n        }\n        if (!PACKET_get_length_prefixed_1(pkt, &compression)) {\n            al = SSL_AD_DECODE_ERROR;\n            SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, SSL_R_LENGTH_MISMATCH);\n            goto f_err;\n        }\n        if (PACKET_remaining(pkt) == 0) {\n            PACKET_null_init(&clienthello->extensions);\n        } else {\n            if (!PACKET_get_length_prefixed_2(pkt, &clienthello->extensions)) {\n                al = SSL_AD_DECODE_ERROR;\n                SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, SSL_R_LENGTH_MISMATCH);\n                goto f_err;\n            }\n        }\n    }\n    if (!PACKET_copy_all(&compression, clienthello->compressions,\n                         MAX_COMPRESSIONS_SIZE,\n                         &clienthello->compressions_len)) {\n        al = SSL_AD_DECODE_ERROR;\n        SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, SSL_R_LENGTH_MISMATCH);\n        goto f_err;\n    }\n    extensions = clienthello->extensions;\n    if (!tls_collect_extensions(s, &extensions, EXT_CLIENT_HELLO,\n                                &clienthello->pre_proc_exts, &al,\n                                &clienthello->pre_proc_exts_len)) {\n        goto f_err;\n    }\n    s->clienthello = clienthello;\n    return MSG_PROCESS_CONTINUE_PROCESSING;\n f_err:\n    ssl3_send_alert(s, SSL3_AL_FATAL, al);\n err:\n    ossl_statem_set_error(s);\n    OPENSSL_free(clienthello->pre_proc_exts);\n    OPENSSL_free(clienthello);\n    return MSG_PROCESS_ERROR;\n}', 'void *CRYPTO_zalloc(size_t num, const char *file, int line)\n{\n    void *ret = CRYPTO_malloc(num, file, line);\n    FAILTEST();\n    if (ret != NULL)\n        memset(ret, 0, num);\n    return ret;\n}', 'void *CRYPTO_malloc(size_t num, const char *file, int line)\n{\n    void *ret = NULL;\n    if (malloc_impl != NULL && malloc_impl != CRYPTO_malloc)\n        return malloc_impl(num, file, line);\n    if (num == 0)\n        return NULL;\n    FAILTEST();\n    allow_customize = 0;\n#ifndef OPENSSL_NO_CRYPTO_MDEBUG\n    if (call_malloc_debug) {\n        CRYPTO_mem_debug_malloc(NULL, num, 0, file, line);\n        ret = malloc(num);\n        CRYPTO_mem_debug_malloc(ret, num, 1, file, line);\n    } else {\n        ret = malloc(num);\n    }\n#else\n    osslargused(file); osslargused(line);\n    ret = malloc(num);\n#endif\n    return ret;\n}', 'void ossl_statem_set_error(SSL *s)\n{\n    s->statem.state = MSG_FLOW_ERROR;\n}']