ssl/ssl_ciph.c:1820: error: NULL_DEREFERENCE
  pointer `comp` last assigned on line 1819 could be null and is dereferenced at line 1820, column 2.
Showing all 44 steps of the trace


ssl/ssl_ciph.c:1799:1: start of procedure SSL_COMP_add_compression_method()
1797.   	}
1798.   
1799. > int SSL_COMP_add_compression_method(int id, COMP_METHOD *cm)
1800.   	{
1801.   	SSL_COMP *comp;

ssl/ssl_ciph.c:1803:13: Taking false branch
1801.   	SSL_COMP *comp;
1802.   
1803.           if (cm == NULL || cm->type == NID_undef)
                    ^
1804.                   return 1;
1805.   

ssl/ssl_ciph.c:1803:27: Taking false branch
1801.   	SSL_COMP *comp;
1802.   
1803.           if (cm == NULL || cm->type == NID_undef)
                                  ^
1804.                   return 1;
1805.   

ssl/ssl_ciph.c:1812:6: Taking false branch
1810.   	   64 to 192:  external party methods assigned by IANA
1811.   	   193 to 255: reserved for private use */
1812.   	if (id < 193 || id > 255)
             ^
1813.   		{
1814.   		SSLerr(SSL_F_SSL_COMP_ADD_COMPRESSION_METHOD,SSL_R_COMPRESSION_ID_NOT_WITHIN_PRIVATE_RANGE);

ssl/ssl_ciph.c:1812:18: Taking false branch
1810.   	   64 to 192:  external party methods assigned by IANA
1811.   	   193 to 255: reserved for private use */
1812.   	if (id < 193 || id > 255)
                         ^
1813.   		{
1814.   		SSLerr(SSL_F_SSL_COMP_ADD_COMPRESSION_METHOD,SSL_R_COMPRESSION_ID_NOT_WITHIN_PRIVATE_RANGE);

ssl/ssl_ciph.c:1818:2: 
1816.   		}
1817.   
1818. > 	MemCheck_off();
1819.   	comp=(SSL_COMP *)OPENSSL_malloc(sizeof(SSL_COMP));
1820.   	comp->id=id;

crypto/mem_dbg.c:216:1: start of procedure CRYPTO_mem_ctrl()
  214.   	}
  215.   
  216. > int CRYPTO_mem_ctrl(int mode)
  217.   	{
  218.   	int ret=mh_mode;

crypto/mem_dbg.c:218:2: 
  216.   int CRYPTO_mem_ctrl(int mode)
  217.   	{
  218. > 	int ret=mh_mode;
  219.   
  220.   	CRYPTO_w_lock(CRYPTO_LOCK_MALLOC);

crypto/mem_dbg.c:220:2: 
  218.   	int ret=mh_mode;
  219.   
  220. > 	CRYPTO_w_lock(CRYPTO_LOCK_MALLOC);
  221.   	switch (mode)
  222.   		{

crypto/cryptlib.c:561:1: start of procedure CRYPTO_lock()
    559.   #endif
    560.   
    561. > void CRYPTO_lock(int mode, int type, const char *file, int line)
    562.   	{
    563.   #ifdef LOCK_DEBUG

crypto/cryptlib.c:588:6: Taking false branch
    586.   		}
    587.   #endif
    588.   	if (type < 0)
                ^
    589.   		{
    590.   		if (dynlock_lock_callback != NULL)

crypto/cryptlib.c:603:7: Taking true branch
    601.   		}
    602.   	else
    603.   		if (locking_callback != NULL)
                 ^
    604.   			locking_callback(mode,type,file,line);
    605.   	}

crypto/cryptlib.c:604:4: Skipping __function_pointer__(): unresolved function pointer
    602.   	else
    603.   		if (locking_callback != NULL)
    604.   			locking_callback(mode,type,file,line);
              ^
    605.   	}
    606.   

crypto/cryptlib.c:588:2: 
    586.   		}
    587.   #endif
    588. > 	if (type < 0)
    589.   		{
    590.   		if (dynlock_lock_callback != NULL)

crypto/cryptlib.c:605:2: return from a call to CRYPTO_lock
    603.   		if (locking_callback != NULL)
    604.   			locking_callback(mode,type,file,line);
    605.   	}
            ^
    606.   
    607.   int CRYPTO_add_lock(int *pointer, int amount, int type, const char *file,

crypto/mem_dbg.c:221:2: 
  219.   
  220.   	CRYPTO_w_lock(CRYPTO_LOCK_MALLOC);
  221. > 	switch (mode)
  222.   		{
  223.   	/* for applications (not to be called while multiple threads

crypto/mem_dbg.c:225:2: Switch condition is false. Skipping switch case
  223.   	/* for applications (not to be called while multiple threads
  224.   	 * use the library): */
  225.   	case CRYPTO_MEM_CHECK_ON: /* aka MemCheck_start() */
          ^
  226.   		mh_mode = CRYPTO_MEM_CHECK_ON|CRYPTO_MEM_CHECK_ENABLE;
  227.   		num_disable = 0;

crypto/mem_dbg.c:229:2: Switch condition is false. Skipping switch case
  227.   		num_disable = 0;
  228.   		break;
  229.   	case CRYPTO_MEM_CHECK_OFF: /* aka MemCheck_stop() */
          ^
  230.   		mh_mode = 0;
  231.   		num_disable = 0; /* should be true *before* MemCheck_stop is used,

crypto/mem_dbg.c:236:2: Switch condition is true. Entering switch case
  234.   
  235.   	/* switch off temporarily (for library-internal use): */
  236.   	case CRYPTO_MEM_CHECK_DISABLE: /* aka MemCheck_off() */
          ^
  237.   		if (mh_mode & CRYPTO_MEM_CHECK_ON)
  238.   			{

crypto/mem_dbg.c:237:7: Taking false branch
  235.   	/* switch off temporarily (for library-internal use): */
  236.   	case CRYPTO_MEM_CHECK_DISABLE: /* aka MemCheck_off() */
  237.   		if (mh_mode & CRYPTO_MEM_CHECK_ON)
               ^
  238.   			{
  239.   			CRYPTO_THREADID cur;

crypto/mem_dbg.c:282:2: 
  280.   		break;
  281.   		}
  282. > 	CRYPTO_w_unlock(CRYPTO_LOCK_MALLOC);
  283.   	return(ret);
  284.   	}

crypto/cryptlib.c:561:1: start of procedure CRYPTO_lock()
    559.   #endif
    560.   
    561. > void CRYPTO_lock(int mode, int type, const char *file, int line)
    562.   	{
    563.   #ifdef LOCK_DEBUG

crypto/cryptlib.c:588:6: Taking false branch
    586.   		}
    587.   #endif
    588.   	if (type < 0)
                ^
    589.   		{
    590.   		if (dynlock_lock_callback != NULL)

crypto/cryptlib.c:603:7: Taking true branch
    601.   		}
    602.   	else
    603.   		if (locking_callback != NULL)
                 ^
    604.   			locking_callback(mode,type,file,line);
    605.   	}

crypto/cryptlib.c:604:4: Skipping __function_pointer__(): unresolved function pointer
    602.   	else
    603.   		if (locking_callback != NULL)
    604.   			locking_callback(mode,type,file,line);
              ^
    605.   	}
    606.   

crypto/cryptlib.c:588:2: 
    586.   		}
    587.   #endif
    588. > 	if (type < 0)
    589.   		{
    590.   		if (dynlock_lock_callback != NULL)

crypto/cryptlib.c:605:2: return from a call to CRYPTO_lock
    603.   		if (locking_callback != NULL)
    604.   			locking_callback(mode,type,file,line);
    605.   	}
            ^
    606.   
    607.   int CRYPTO_add_lock(int *pointer, int amount, int type, const char *file,

crypto/mem_dbg.c:283:2: 
  281.   		}
  282.   	CRYPTO_w_unlock(CRYPTO_LOCK_MALLOC);
  283. > 	return(ret);
  284.   	}
  285.   

crypto/mem_dbg.c:284:2: return from a call to CRYPTO_mem_ctrl
  282.   	CRYPTO_w_unlock(CRYPTO_LOCK_MALLOC);
  283.   	return(ret);
  284.   	}
          ^
  285.   
  286.   int CRYPTO_is_mem_check_on(void)

ssl/ssl_ciph.c:1819:2: 
1817.   
1818.   	MemCheck_off();
1819. > 	comp=(SSL_COMP *)OPENSSL_malloc(sizeof(SSL_COMP));
1820.   	comp->id=id;
1821.   	comp->method=cm;

crypto/mem.c:296:1: start of procedure CRYPTO_malloc()
  294.   	}
  295.   
  296. > void *CRYPTO_malloc(int num, const char *file, int line)
  297.   	{
  298.   	void *ret = NULL;

crypto/mem.c:298:2: 
  296.   void *CRYPTO_malloc(int num, const char *file, int line)
  297.   	{
  298. > 	void *ret = NULL;
  299.   
  300.   	if (num <= 0) return NULL;

crypto/mem.c:300:6: Taking false branch
  298.   	void *ret = NULL;
  299.   
  300.   	if (num <= 0) return NULL;
              ^
  301.   
  302.   	allow_customize = 0;

crypto/mem.c:302:2: 
  300.   	if (num <= 0) return NULL;
  301.   
  302. > 	allow_customize = 0;
  303.   	if (malloc_debug_func != NULL)
  304.   		{

crypto/mem.c:303:6: Taking true branch
  301.   
  302.   	allow_customize = 0;
  303.   	if (malloc_debug_func != NULL)
              ^
  304.   		{
  305.   		allow_customize_debug = 0;

crypto/mem.c:305:3: 
  303.   	if (malloc_debug_func != NULL)
  304.   		{
  305. > 		allow_customize_debug = 0;
  306.   		malloc_debug_func(NULL, num, file, line, 0);
  307.   		}

crypto/mem.c:306:3: Skipping __function_pointer__(): unresolved function pointer
  304.   		{
  305.   		allow_customize_debug = 0;
  306.   		malloc_debug_func(NULL, num, file, line, 0);
           ^
  307.   		}
  308.   	ret = malloc_ex_func(num,file,line);

crypto/mem.c:308:2: Skipping __function_pointer__(): unresolved function pointer
  306.   		malloc_debug_func(NULL, num, file, line, 0);
  307.   		}
  308.   	ret = malloc_ex_func(num,file,line);
          ^
  309.   #ifdef LEVITTE_DEBUG_MEM
  310.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);

crypto/mem.c:312:6: Taking true branch
  310.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);
  311.   #endif
  312.   	if (malloc_debug_func != NULL)
              ^
  313.   		malloc_debug_func(ret, num, file, line, 1);
  314.   

crypto/mem.c:313:3: Skipping __function_pointer__(): unresolved function pointer
  311.   #endif
  312.   	if (malloc_debug_func != NULL)
  313.   		malloc_debug_func(ret, num, file, line, 1);
           ^
  314.   
  315.   #ifndef OPENSSL_CPUID_OBJ

crypto/mem.c:319:12: Taking false branch
  317.            * sanitisation function can't be optimised out. NB: We only do
  318.            * this for >2Kb so the overhead doesn't bother us. */
  319.           if(ret && (num > 2048))
                    ^
  320.   	{	extern unsigned char cleanse_ctr;
  321.                   ((unsigned char *)ret)[0] = cleanse_ctr;

crypto/mem.c:325:2: 
  323.   #endif
  324.   
  325. > 	return ret;
  326.   	}
  327.   char *CRYPTO_strdup(const char *str, const char *file, int line)

crypto/mem.c:326:2: return from a call to CRYPTO_malloc
  324.   
  325.   	return ret;
  326.   	}
          ^
  327.   char *CRYPTO_strdup(const char *str, const char *file, int line)
  328.   	{

ssl/ssl_ciph.c:1820:2: 
1818.   	MemCheck_off();
1819.   	comp=(SSL_COMP *)OPENSSL_malloc(sizeof(SSL_COMP));
1820. > 	comp->id=id;
1821.   	comp->method=cm;
1822.   	load_builtin_compressions();

int SSL_COMP_add_compression_method(int id, COMP_METHOD *cm)
	{
	SSL_COMP *comp;
        if (cm == NULL || cm->type == NID_undef)
                return 1;
	if (id < 193 || id > 255)
		{
		SSLerr(SSL_F_SSL_COMP_ADD_COMPRESSION_METHOD,SSL_R_COMPRESSION_ID_NOT_WITHIN_PRIVATE_RANGE);
		return 0;
		}
	MemCheck_off();
	comp=(SSL_COMP *)OPENSSL_malloc(sizeof(SSL_COMP));
	comp->id=id;
	comp->method=cm;
	load_builtin_compressions();
	if (ssl_comp_methods
		&& sk_SSL_COMP_find(ssl_comp_methods,comp) >= 0)
		{
		OPENSSL_free(comp);
		MemCheck_on();
		SSLerr(SSL_F_SSL_COMP_ADD_COMPRESSION_METHOD,SSL_R_DUPLICATE_COMPRESSION_ID);
		return(1);
		}
	else if ((ssl_comp_methods == NULL)
		|| !sk_SSL_COMP_push(ssl_comp_methods,comp))
		{
		OPENSSL_free(comp);
		MemCheck_on();
		SSLerr(SSL_F_SSL_COMP_ADD_COMPRESSION_METHOD,ERR_R_MALLOC_FAILURE);
		return(1);
		}
	else
		{
		MemCheck_on();
		return(0);
		}
	}
['int SSL_COMP_add_compression_method(int id, COMP_METHOD *cm)\n\t{\n\tSSL_COMP *comp;\n        if (cm == NULL || cm->type == NID_undef)\n                return 1;\n\tif (id < 193 || id > 255)\n\t\t{\n\t\tSSLerr(SSL_F_SSL_COMP_ADD_COMPRESSION_METHOD,SSL_R_COMPRESSION_ID_NOT_WITHIN_PRIVATE_RANGE);\n\t\treturn 0;\n\t\t}\n\tMemCheck_off();\n\tcomp=(SSL_COMP *)OPENSSL_malloc(sizeof(SSL_COMP));\n\tcomp->id=id;\n\tcomp->method=cm;\n\tload_builtin_compressions();\n\tif (ssl_comp_methods\n\t\t&& sk_SSL_COMP_find(ssl_comp_methods,comp) >= 0)\n\t\t{\n\t\tOPENSSL_free(comp);\n\t\tMemCheck_on();\n\t\tSSLerr(SSL_F_SSL_COMP_ADD_COMPRESSION_METHOD,SSL_R_DUPLICATE_COMPRESSION_ID);\n\t\treturn(1);\n\t\t}\n\telse if ((ssl_comp_methods == NULL)\n\t\t|| !sk_SSL_COMP_push(ssl_comp_methods,comp))\n\t\t{\n\t\tOPENSSL_free(comp);\n\t\tMemCheck_on();\n\t\tSSLerr(SSL_F_SSL_COMP_ADD_COMPRESSION_METHOD,ERR_R_MALLOC_FAILURE);\n\t\treturn(1);\n\t\t}\n\telse\n\t\t{\n\t\tMemCheck_on();\n\t\treturn(0);\n\t\t}\n\t}', 'int CRYPTO_mem_ctrl(int mode)\n\t{\n\tint ret=mh_mode;\n\tCRYPTO_w_lock(CRYPTO_LOCK_MALLOC);\n\tswitch (mode)\n\t\t{\n\tcase CRYPTO_MEM_CHECK_ON:\n\t\tmh_mode = CRYPTO_MEM_CHECK_ON|CRYPTO_MEM_CHECK_ENABLE;\n\t\tnum_disable = 0;\n\t\tbreak;\n\tcase CRYPTO_MEM_CHECK_OFF:\n\t\tmh_mode = 0;\n\t\tnum_disable = 0;\n\t\tbreak;\n\tcase CRYPTO_MEM_CHECK_DISABLE:\n\t\tif (mh_mode & CRYPTO_MEM_CHECK_ON)\n\t\t\t{\n\t\t\tCRYPTO_THREADID cur;\n\t\t\tCRYPTO_THREADID_current(&cur);\n\t\t\tif (!num_disable || CRYPTO_THREADID_cmp(&disabling_threadid, &cur))\n\t\t\t\t{\n\t\t\t\tCRYPTO_w_unlock(CRYPTO_LOCK_MALLOC);\n\t\t\t\tCRYPTO_w_lock(CRYPTO_LOCK_MALLOC2);\n\t\t\t\tCRYPTO_w_lock(CRYPTO_LOCK_MALLOC);\n\t\t\t\tmh_mode &= ~CRYPTO_MEM_CHECK_ENABLE;\n\t\t\t\tCRYPTO_THREADID_cpy(&disabling_threadid, &cur);\n\t\t\t\t}\n\t\t\tnum_disable++;\n\t\t\t}\n\t\tbreak;\n\tcase CRYPTO_MEM_CHECK_ENABLE:\n\t\tif (mh_mode & CRYPTO_MEM_CHECK_ON)\n\t\t\t{\n\t\t\tif (num_disable)\n\t\t\t\t{\n\t\t\t\tnum_disable--;\n\t\t\t\tif (num_disable == 0)\n\t\t\t\t\t{\n\t\t\t\t\tmh_mode|=CRYPTO_MEM_CHECK_ENABLE;\n\t\t\t\t\tCRYPTO_w_unlock(CRYPTO_LOCK_MALLOC2);\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\tbreak;\n\tdefault:\n\t\tbreak;\n\t\t}\n\tCRYPTO_w_unlock(CRYPTO_LOCK_MALLOC);\n\treturn(ret);\n\t}', 'void CRYPTO_lock(int mode, int type, const char *file, int line)\n\t{\n#ifdef LOCK_DEBUG\n\t\t{\n\t\tCRYPTO_THREADID id;\n\t\tchar *rw_text,*operation_text;\n\t\tif (mode & CRYPTO_LOCK)\n\t\t\toperation_text="lock  ";\n\t\telse if (mode & CRYPTO_UNLOCK)\n\t\t\toperation_text="unlock";\n\t\telse\n\t\t\toperation_text="ERROR ";\n\t\tif (mode & CRYPTO_READ)\n\t\t\trw_text="r";\n\t\telse if (mode & CRYPTO_WRITE)\n\t\t\trw_text="w";\n\t\telse\n\t\t\trw_text="ERROR";\n\t\tCRYPTO_THREADID_current(&id);\n\t\tfprintf(stderr,"lock:%08lx:(%s)%s %-18s %s:%d\\n",\n\t\t\tCRYPTO_THREADID_hash(&id), rw_text, operation_text,\n\t\t\tCRYPTO_get_lock_name(type), file, line);\n\t\t}\n#endif\n\tif (type < 0)\n\t\t{\n\t\tif (dynlock_lock_callback != NULL)\n\t\t\t{\n\t\t\tstruct CRYPTO_dynlock_value *pointer\n\t\t\t\t= CRYPTO_get_dynlock_value(type);\n\t\t\tOPENSSL_assert(pointer != NULL);\n\t\t\tdynlock_lock_callback(mode, pointer, file, line);\n\t\t\tCRYPTO_destroy_dynlockid(type);\n\t\t\t}\n\t\t}\n\telse\n\t\tif (locking_callback != NULL)\n\t\t\tlocking_callback(mode,type,file,line);\n\t}', 'void *CRYPTO_malloc(int num, const char *file, int line)\n\t{\n\tvoid *ret = NULL;\n\tif (num <= 0) return NULL;\n\tallow_customize = 0;\n\tif (malloc_debug_func != NULL)\n\t\t{\n\t\tallow_customize_debug = 0;\n\t\tmalloc_debug_func(NULL, num, file, line, 0);\n\t\t}\n\tret = malloc_ex_func(num,file,line);\n#ifdef LEVITTE_DEBUG_MEM\n\tfprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\\n", ret, num);\n#endif\n\tif (malloc_debug_func != NULL)\n\t\tmalloc_debug_func(ret, num, file, line, 1);\n#ifndef OPENSSL_CPUID_OBJ\n        if(ret && (num > 2048))\n\t{\textern unsigned char cleanse_ctr;\n                ((unsigned char *)ret)[0] = cleanse_ctr;\n\t}\n#endif\n\treturn ret;\n\t}']