ssl/ssl_lib.c:1353: error: NULL_DEREFERENCE
  pointer `sk` last assigned on line 1340 could be null and is dereferenced by call to `sk_SSL_CIPHER_push()` at line 1353, column 9.
Showing all 37 steps of the trace


ssl/ssl_lib.c:1326:1: start of procedure ssl_bytes_to_cipher_list()
1324.   	}
1325.   
1326. > STACK_OF(SSL_CIPHER) *ssl_bytes_to_cipher_list(SSL *s,unsigned char *p,int num,
1327.   					       STACK_OF(SSL_CIPHER) **skp)
1328.   	{

ssl/ssl_lib.c:1333:2: Skipping __function_pointer__(): unresolved function pointer
1331.   	int i,n;
1332.   
1333.   	n=ssl_put_cipher_by_char(s,NULL,NULL);
         ^
1334.   	if ((num%n) != 0)
1335.   		{

ssl/ssl_lib.c:1334:6: Taking false branch
1332.   
1333.   	n=ssl_put_cipher_by_char(s,NULL,NULL);
1334.   	if ((num%n) != 0)
             ^
1335.   		{
1336.   		SSLerr(SSL_F_SSL_BYTES_TO_CIPHER_LIST,SSL_R_ERROR_IN_RECEIVED_CIPHER_LIST);

ssl/ssl_lib.c:1339:7: Taking false branch
1337.   		return(NULL);
1338.   		}
1339.   	if ((skp == NULL) || (*skp == NULL))
              ^
1340.   		sk=sk_SSL_CIPHER_new_null(); /* change perhaps later */
1341.   	else

ssl/ssl_lib.c:1339:24: Taking true branch
1337.   		return(NULL);
1338.   		}
1339.   	if ((skp == NULL) || (*skp == NULL))
                               ^
1340.   		sk=sk_SSL_CIPHER_new_null(); /* change perhaps later */
1341.   	else

ssl/ssl_lib.c:1340:3: 
1338.   		}
1339.   	if ((skp == NULL) || (*skp == NULL))
1340. > 		sk=sk_SSL_CIPHER_new_null(); /* change perhaps later */
1341.   	else
1342.   		{

ssl/ssl.h:373:1: start of procedure sk_SSL_CIPHER_new_null()
  371.   	} SSL_CIPHER;
  372.   
  373. > DECLARE_STACK_OF(SSL_CIPHER)
  374.   
  375.   typedef struct ssl_st SSL;

crypto/stack/stack.c:115:1: start of procedure sk_new_null()
    113.   	}
    114.   
    115. > STACK *sk_new_null(void)
    116.   	{
    117.   	return sk_new((int (*)(const char * const *, const char * const *))0);

crypto/stack/stack.c:117:2: 
    115.   STACK *sk_new_null(void)
    116.   	{
    117. > 	return sk_new((int (*)(const char * const *, const char * const *))0);
    118.   	}
    119.   

crypto/stack/stack.c:120:1: start of procedure sk_new()
      118.   	}
      119.   
      120. > STACK *sk_new(int (*c)(const char * const *, const char * const *))
      121.   	{
      122.   	STACK *ret;

crypto/stack/stack.c:125:6: 
      123.   	int i;
      124.   
      125. > 	if ((ret=(STACK *)OPENSSL_malloc(sizeof(STACK))) == NULL)
      126.   		goto err;
      127.   	if ((ret->data=(char **)OPENSSL_malloc(sizeof(char *)*MIN_NODES)) == NULL)

crypto/mem.c:294:1: start of procedure CRYPTO_malloc()
        292.   	}
        293.   
        294. > void *CRYPTO_malloc(int num, const char *file, int line)
        295.   	{
        296.   	void *ret = NULL;

crypto/mem.c:296:2: 
        294.   void *CRYPTO_malloc(int num, const char *file, int line)
        295.   	{
        296. > 	void *ret = NULL;
        297.   
        298.   	if (num <= 0) return NULL;

crypto/mem.c:298:6: Taking false branch
        296.   	void *ret = NULL;
        297.   
        298.   	if (num <= 0) return NULL;
                    ^
        299.   
        300.   	allow_customize = 0;

crypto/mem.c:300:2: 
        298.   	if (num <= 0) return NULL;
        299.   
        300. > 	allow_customize = 0;
        301.   	if (malloc_debug_func != NULL)
        302.   		{

crypto/mem.c:301:6: Taking false branch
        299.   
        300.   	allow_customize = 0;
        301.   	if (malloc_debug_func != NULL)
                    ^
        302.   		{
        303.   		allow_customize_debug = 0;

crypto/mem.c:306:2: Skipping __function_pointer__(): unresolved function pointer
        304.   		malloc_debug_func(NULL, num, file, line, 0);
        305.   		}
        306.   	ret = malloc_ex_func(num,file,line);
                ^
        307.   #ifdef LEVITTE_DEBUG_MEM
        308.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);

crypto/mem.c:310:6: Taking false branch
        308.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);
        309.   #endif
        310.   	if (malloc_debug_func != NULL)
                    ^
        311.   		malloc_debug_func(ret, num, file, line, 1);
        312.   

crypto/mem.c:317:12: Taking false branch
        315.            * sanitisation function can't be optimised out. NB: We only do
        316.            * this for >2Kb so the overhead doesn't bother us. */
        317.           if(ret && (num > 2048))
                          ^
        318.   	{	extern unsigned char cleanse_ctr;
        319.                   ((unsigned char *)ret)[0] = cleanse_ctr;

crypto/mem.c:323:2: 
        321.   #endif
        322.   
        323. > 	return ret;
        324.   	}
        325.   

crypto/mem.c:324:2: return from a call to CRYPTO_malloc
        322.   
        323.   	return ret;
        324.   	}
                ^
        325.   
        326.   void *CRYPTO_realloc(void *str, int num, const char *file, int line)

crypto/stack/stack.c:125:6: Taking true branch
      123.   	int i;
      124.   
      125.   	if ((ret=(STACK *)OPENSSL_malloc(sizeof(STACK))) == NULL)
                  ^
      126.   		goto err;
      127.   	if ((ret->data=(char **)OPENSSL_malloc(sizeof(char *)*MIN_NODES)) == NULL)

crypto/stack/stack.c:136:1: 
      134.   	ret->sorted=0;
      135.   	return(ret);
      136. > err:
      137.   	if(ret)
      138.   		OPENSSL_free(ret);

crypto/stack/stack.c:137:5: Taking false branch
      135.   	return(ret);
      136.   err:
      137.   	if(ret)
                 ^
      138.   		OPENSSL_free(ret);
      139.   	return(NULL);

crypto/stack/stack.c:139:2: 
      137.   	if(ret)
      138.   		OPENSSL_free(ret);
      139. > 	return(NULL);
      140.   	}
      141.   

crypto/stack/stack.c:140:2: return from a call to sk_new
      138.   		OPENSSL_free(ret);
      139.   	return(NULL);
      140.   	}
              ^
      141.   
      142.   int sk_insert(STACK *st, char *data, int loc)

crypto/stack/stack.c:118:2: return from a call to sk_new_null
    116.   	{
    117.   	return sk_new((int (*)(const char * const *, const char * const *))0);
    118.   	}
            ^
    119.   
    120.   STACK *sk_new(int (*c)(const char * const *, const char * const *))

ssl/ssl.h:373:1: return from a call to sk_SSL_CIPHER_new_null
  371.   	} SSL_CIPHER;
  372.   
  373. > DECLARE_STACK_OF(SSL_CIPHER)
  374.   
  375.   typedef struct ssl_st SSL;

ssl/ssl_lib.c:1347:7: 
1345.   		}
1346.   
1347. > 	for (i=0; i<num; i+=n)
1348.   		{
1349.   		c=ssl_get_cipher_by_char(s,p);

ssl/ssl_lib.c:1347:12: Loop condition is true. Entering loop body
1345.   		}
1346.   
1347.   	for (i=0; i<num; i+=n)
                   ^
1348.   		{
1349.   		c=ssl_get_cipher_by_char(s,p);

ssl/ssl_lib.c:1349:3: Skipping __function_pointer__(): unresolved function pointer
1347.   	for (i=0; i<num; i+=n)
1348.   		{
1349.   		c=ssl_get_cipher_by_char(s,p);
          ^
1350.   		p+=n;
1351.   		if (c != NULL)

ssl/ssl_lib.c:1350:3: 
1348.   		{
1349.   		c=ssl_get_cipher_by_char(s,p);
1350. > 		p+=n;
1351.   		if (c != NULL)
1352.   			{

ssl/ssl_lib.c:1351:7: Taking true branch
1349.   		c=ssl_get_cipher_by_char(s,p);
1350.   		p+=n;
1351.   		if (c != NULL)
              ^
1352.   			{
1353.   			if (!sk_SSL_CIPHER_push(sk,c))

ssl/ssl_lib.c:1353:9: 
1351.   		if (c != NULL)
1352.   			{
1353. > 			if (!sk_SSL_CIPHER_push(sk,c))
1354.   				{
1355.   				SSLerr(SSL_F_SSL_BYTES_TO_CIPHER_LIST,ERR_R_MALLOC_FAILURE);

ssl/ssl.h:373:1: start of procedure sk_SSL_CIPHER_push()
  371.   	} SSL_CIPHER;
  372.   
  373. > DECLARE_STACK_OF(SSL_CIPHER)
  374.   
  375.   typedef struct ssl_st SSL;

crypto/stack/stack.c:251:1: start of procedure sk_push()
    249.   	}
    250.   
    251. > int sk_push(STACK *st, char *data)
    252.   	{
    253.   	return(sk_insert(st,data,st->num));

crypto/stack/stack.c:253:2: Skipping sk_insert(): empty list of specs
    251.   int sk_push(STACK *st, char *data)
    252.   	{
    253.   	return(sk_insert(st,data,st->num));
            ^
    254.   	}
    255.   

STACK_OF(SSL_CIPHER) *ssl_bytes_to_cipher_list(SSL *s,unsigned char *p,int num,
					       STACK_OF(SSL_CIPHER) **skp)
	{
	SSL_CIPHER *c;
	STACK_OF(SSL_CIPHER) *sk;
	int i,n;
	n=ssl_put_cipher_by_char(s,NULL,NULL);
	if ((num%n) != 0)
		{
		SSLerr(SSL_F_SSL_BYTES_TO_CIPHER_LIST,SSL_R_ERROR_IN_RECEIVED_CIPHER_LIST);
		return(NULL);
		}
	if ((skp == NULL) || (*skp == NULL))
		sk=sk_SSL_CIPHER_new_null();
	else
		{
		sk= *skp;
		sk_SSL_CIPHER_zero(sk);
		}
	for (i=0; i<num; i+=n)
		{
		c=ssl_get_cipher_by_char(s,p);
		p+=n;
		if (c != NULL)
			{
			if (!sk_SSL_CIPHER_push(sk,c))
				{
				SSLerr(SSL_F_SSL_BYTES_TO_CIPHER_LIST,ERR_R_MALLOC_FAILURE);
				goto err;
				}
			}
		}
	if (skp != NULL)
		*skp=sk;
	return(sk);
err:
	if ((skp == NULL) || (*skp == NULL))
		sk_SSL_CIPHER_free(sk);
	return(NULL);
	}
['STACK_OF(SSL_CIPHER) *ssl_bytes_to_cipher_list(SSL *s,unsigned char *p,int num,\n\t\t\t\t\t       STACK_OF(SSL_CIPHER) **skp)\n\t{\n\tSSL_CIPHER *c;\n\tSTACK_OF(SSL_CIPHER) *sk;\n\tint i,n;\n\tn=ssl_put_cipher_by_char(s,NULL,NULL);\n\tif ((num%n) != 0)\n\t\t{\n\t\tSSLerr(SSL_F_SSL_BYTES_TO_CIPHER_LIST,SSL_R_ERROR_IN_RECEIVED_CIPHER_LIST);\n\t\treturn(NULL);\n\t\t}\n\tif ((skp == NULL) || (*skp == NULL))\n\t\tsk=sk_SSL_CIPHER_new_null();\n\telse\n\t\t{\n\t\tsk= *skp;\n\t\tsk_SSL_CIPHER_zero(sk);\n\t\t}\n\tfor (i=0; i<num; i+=n)\n\t\t{\n\t\tc=ssl_get_cipher_by_char(s,p);\n\t\tp+=n;\n\t\tif (c != NULL)\n\t\t\t{\n\t\t\tif (!sk_SSL_CIPHER_push(sk,c))\n\t\t\t\t{\n\t\t\t\tSSLerr(SSL_F_SSL_BYTES_TO_CIPHER_LIST,ERR_R_MALLOC_FAILURE);\n\t\t\t\tgoto err;\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\tif (skp != NULL)\n\t\t*skp=sk;\n\treturn(sk);\nerr:\n\tif ((skp == NULL) || (*skp == NULL))\n\t\tsk_SSL_CIPHER_free(sk);\n\treturn(NULL);\n\t}', 'STACK *sk_new_null(void)\n\t{\n\treturn sk_new((int (*)(const char * const *, const char * const *))0);\n\t}', 'STACK *sk_new(int (*c)(const char * const *, const char * const *))\n\t{\n\tSTACK *ret;\n\tint i;\n\tif ((ret=(STACK *)OPENSSL_malloc(sizeof(STACK))) == NULL)\n\t\tgoto err;\n\tif ((ret->data=(char **)OPENSSL_malloc(sizeof(char *)*MIN_NODES)) == NULL)\n\t\tgoto err;\n\tfor (i=0; i<MIN_NODES; i++)\n\t\tret->data[i]=NULL;\n\tret->comp=c;\n\tret->num_alloc=MIN_NODES;\n\tret->num=0;\n\tret->sorted=0;\n\treturn(ret);\nerr:\n\tif(ret)\n\t\tOPENSSL_free(ret);\n\treturn(NULL);\n\t}', 'void *CRYPTO_malloc(int num, const char *file, int line)\n\t{\n\tvoid *ret = NULL;\n\tif (num <= 0) return NULL;\n\tallow_customize = 0;\n\tif (malloc_debug_func != NULL)\n\t\t{\n\t\tallow_customize_debug = 0;\n\t\tmalloc_debug_func(NULL, num, file, line, 0);\n\t\t}\n\tret = malloc_ex_func(num,file,line);\n#ifdef LEVITTE_DEBUG_MEM\n\tfprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\\n", ret, num);\n#endif\n\tif (malloc_debug_func != NULL)\n\t\tmalloc_debug_func(ret, num, file, line, 1);\n#ifndef OPENSSL_CPUID_OBJ\n        if(ret && (num > 2048))\n\t{\textern unsigned char cleanse_ctr;\n                ((unsigned char *)ret)[0] = cleanse_ctr;\n\t}\n#endif\n\treturn ret;\n\t}', 'int sk_push(STACK *st, char *data)\n\t{\n\treturn(sk_insert(st,data,st->num));\n\t}']