ssl/ssl_lib.c:3216: error: NULL_DEREFERENCE
  pointer `ctx` last assigned on line 3207 could be null and is dereferenced by call to `EVP_MD_CTX_free()` at line 3216, column 5.
Showing all 37 steps of the trace


ssl/ssl_lib.c:3198:1: start of procedure ssl_handshake_hash()
3196.   
3197.   /* Retrieve handshake hashes */
3198. > int ssl_handshake_hash(SSL *s, unsigned char *out, int outlen)
3199.   {
3200.       EVP_MD_CTX *ctx = NULL;

ssl/ssl_lib.c:3200:5: 
3198.   int ssl_handshake_hash(SSL *s, unsigned char *out, int outlen)
3199.   {
3200. >     EVP_MD_CTX *ctx = NULL;
3201.       EVP_MD_CTX *hdgst = s->s3->handshake_dgst;
3202.       int ret = EVP_MD_CTX_size(hdgst);

ssl/ssl_lib.c:3201:5: 
3199.   {
3200.       EVP_MD_CTX *ctx = NULL;
3201. >     EVP_MD_CTX *hdgst = s->s3->handshake_dgst;
3202.       int ret = EVP_MD_CTX_size(hdgst);
3203.       if (ret < 0 || ret > outlen) {

ssl/ssl_lib.c:3202:5: 
3200.       EVP_MD_CTX *ctx = NULL;
3201.       EVP_MD_CTX *hdgst = s->s3->handshake_dgst;
3202. >     int ret = EVP_MD_CTX_size(hdgst);
3203.       if (ret < 0 || ret > outlen) {
3204.           ret = 0;

crypto/evp/evp_lib.c:436:1: start of procedure EVP_MD_CTX_md()
  434.   }
  435.   
  436. > const EVP_MD *EVP_MD_CTX_md(const EVP_MD_CTX *ctx)
  437.   {
  438.       if (!ctx)

crypto/evp/evp_lib.c:438:10: Taking false branch
  436.   const EVP_MD *EVP_MD_CTX_md(const EVP_MD_CTX *ctx)
  437.   {
  438.       if (!ctx)
                  ^
  439.           return NULL;
  440.       return ctx->digest;

crypto/evp/evp_lib.c:440:5: 
  438.       if (!ctx)
  439.           return NULL;
  440. >     return ctx->digest;
  441.   }
  442.   

crypto/evp/evp_lib.c:441:1: return from a call to EVP_MD_CTX_md
  439.           return NULL;
  440.       return ctx->digest;
  441. > }
  442.   
  443.   EVP_PKEY_CTX *EVP_MD_CTX_pkey_ctx(const EVP_MD_CTX *ctx)

crypto/evp/evp_lib.c:300:1: start of procedure EVP_MD_size()
  298.   }
  299.   
  300. > int EVP_MD_size(const EVP_MD *md)
  301.   {
  302.       if (!md) {

crypto/evp/evp_lib.c:302:10: Taking false branch
  300.   int EVP_MD_size(const EVP_MD *md)
  301.   {
  302.       if (!md) {
                  ^
  303.           EVPerr(EVP_F_EVP_MD_SIZE, EVP_R_MESSAGE_DIGEST_IS_NULL);
  304.           return -1;

crypto/evp/evp_lib.c:306:5: 
  304.           return -1;
  305.       }
  306. >     return md->md_size;
  307.   }
  308.   

crypto/evp/evp_lib.c:307:1: return from a call to EVP_MD_size
  305.       }
  306.       return md->md_size;
  307. > }
  308.   
  309.   unsigned long EVP_MD_flags(const EVP_MD *md)

ssl/ssl_lib.c:3203:9: Taking false branch
3201.       EVP_MD_CTX *hdgst = s->s3->handshake_dgst;
3202.       int ret = EVP_MD_CTX_size(hdgst);
3203.       if (ret < 0 || ret > outlen) {
                ^
3204.           ret = 0;
3205.           goto err;

ssl/ssl_lib.c:3203:20: Taking false branch
3201.       EVP_MD_CTX *hdgst = s->s3->handshake_dgst;
3202.       int ret = EVP_MD_CTX_size(hdgst);
3203.       if (ret < 0 || ret > outlen) {
                           ^
3204.           ret = 0;
3205.           goto err;

ssl/ssl_lib.c:3207:5: 
3205.           goto err;
3206.       }
3207. >     ctx = EVP_MD_CTX_new();
3208.       if (ctx == NULL) {
3209.           ret = 0;

crypto/evp/digest.c:153:1: start of procedure EVP_MD_CTX_new()
  151.   }
  152.   
  153. > EVP_MD_CTX *EVP_MD_CTX_new(void)
  154.   {
  155.       return OPENSSL_zalloc(sizeof(EVP_MD_CTX));

crypto/evp/digest.c:155:5: 
  153.   EVP_MD_CTX *EVP_MD_CTX_new(void)
  154.   {
  155. >     return OPENSSL_zalloc(sizeof(EVP_MD_CTX));
  156.   }
  157.   

crypto/mem.c:315:1: start of procedure CRYPTO_zalloc()
    313.   }
    314.   
    315. > void *CRYPTO_zalloc(int num, const char *file, int line)
    316.   {
    317.       void *ret = CRYPTO_malloc(num, file, line);

crypto/mem.c:317:5: 
    315.   void *CRYPTO_zalloc(int num, const char *file, int line)
    316.   {
    317. >     void *ret = CRYPTO_malloc(num, file, line);
    318.   
    319.       if (ret != NULL)

crypto/mem.c:279:1: start of procedure CRYPTO_malloc()
      277.   }
      278.   
      279. > void *CRYPTO_malloc(int num, const char *file, int line)
      280.   {
      281.       void *ret = NULL;

crypto/mem.c:281:5: 
      279.   void *CRYPTO_malloc(int num, const char *file, int line)
      280.   {
      281. >     void *ret = NULL;
      282.   
      283.       if (num <= 0)

crypto/mem.c:283:9: Taking false branch
      281.       void *ret = NULL;
      282.   
      283.       if (num <= 0)
                     ^
      284.           return NULL;
      285.   

crypto/mem.c:286:9: Taking true branch
      284.           return NULL;
      285.   
      286.       if (allow_customize)
                     ^
      287.           allow_customize = 0;
      288.       if (malloc_debug_func != NULL) {

crypto/mem.c:287:9: 
      285.   
      286.       if (allow_customize)
      287. >         allow_customize = 0;
      288.       if (malloc_debug_func != NULL) {
      289.           if (allow_customize_debug)

crypto/mem.c:288:9: Taking false branch
      286.       if (allow_customize)
      287.           allow_customize = 0;
      288.       if (malloc_debug_func != NULL) {
                     ^
      289.           if (allow_customize_debug)
      290.               allow_customize_debug = 0;

crypto/mem.c:293:5: Skipping __function_pointer__(): unresolved function pointer
      291.           malloc_debug_func(NULL, num, file, line, 0);
      292.       }
      293.       ret = malloc_ex_func(num, file, line);
                 ^
      294.   #ifdef LEVITTE_DEBUG_MEM
      295.       fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);

crypto/mem.c:297:9: Taking false branch
      295.       fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);
      296.   #endif
      297.       if (malloc_debug_func != NULL)
                     ^
      298.           malloc_debug_func(ret, num, file, line, 1);
      299.   

crypto/mem.c:312:5: 
      310.   #endif
      311.   
      312. >     return ret;
      313.   }
      314.   

crypto/mem.c:313:1: return from a call to CRYPTO_malloc
      311.   
      312.       return ret;
      313. > }
      314.   
      315.   void *CRYPTO_zalloc(int num, const char *file, int line)

crypto/mem.c:319:9: Taking false branch
    317.       void *ret = CRYPTO_malloc(num, file, line);
    318.   
    319.       if (ret != NULL)
                   ^
    320.           memset(ret, 0, num);
    321.       return ret;

crypto/mem.c:321:5: 
    319.       if (ret != NULL)
    320.           memset(ret, 0, num);
    321. >     return ret;
    322.   }
    323.   

crypto/mem.c:322:1: return from a call to CRYPTO_zalloc
    320.           memset(ret, 0, num);
    321.       return ret;
    322. > }
    323.   
    324.   char *CRYPTO_strdup(const char *str, const char *file, int line)

crypto/evp/digest.c:156:1: return from a call to EVP_MD_CTX_new
  154.   {
  155.       return OPENSSL_zalloc(sizeof(EVP_MD_CTX));
  156. > }
  157.   
  158.   void EVP_MD_CTX_free(EVP_MD_CTX *ctx)

ssl/ssl_lib.c:3208:9: Taking true branch
3206.       }
3207.       ctx = EVP_MD_CTX_new();
3208.       if (ctx == NULL) {
                ^
3209.           ret = 0;
3210.           goto err;

ssl/ssl_lib.c:3209:9: 
3207.       ctx = EVP_MD_CTX_new();
3208.       if (ctx == NULL) {
3209. >         ret = 0;
3210.           goto err;
3211.       }

ssl/ssl_lib.c:3215:2: 
3213.           || EVP_DigestFinal_ex(ctx, out, NULL) <= 0)
3214.           ret = 0;
3215. >  err:
3216.       EVP_MD_CTX_free(ctx);
3217.       return ret;

ssl/ssl_lib.c:3216:5: 
3214.           ret = 0;
3215.    err:
3216. >     EVP_MD_CTX_free(ctx);
3217.       return ret;
3218.   }

int ssl_handshake_hash(SSL *s, unsigned char *out, int outlen)
{
    EVP_MD_CTX *ctx = NULL;
    EVP_MD_CTX *hdgst = s->s3->handshake_dgst;
    int ret = EVP_MD_CTX_size(hdgst);
    if (ret < 0 || ret > outlen) {
        ret = 0;
        goto err;
    }
    ctx = EVP_MD_CTX_new();
    if (ctx == NULL) {
        ret = 0;
        goto err;
    }
    if (!EVP_MD_CTX_copy_ex(ctx, hdgst)
        || EVP_DigestFinal_ex(ctx, out, NULL) <= 0)
        ret = 0;
 err:
    EVP_MD_CTX_free(ctx);
    return ret;
}
['int ssl_handshake_hash(SSL *s, unsigned char *out, int outlen)\n{\n    EVP_MD_CTX *ctx = NULL;\n    EVP_MD_CTX *hdgst = s->s3->handshake_dgst;\n    int ret = EVP_MD_CTX_size(hdgst);\n    if (ret < 0 || ret > outlen) {\n        ret = 0;\n        goto err;\n    }\n    ctx = EVP_MD_CTX_new();\n    if (ctx == NULL) {\n        ret = 0;\n        goto err;\n    }\n    if (!EVP_MD_CTX_copy_ex(ctx, hdgst)\n        || EVP_DigestFinal_ex(ctx, out, NULL) <= 0)\n        ret = 0;\n err:\n    EVP_MD_CTX_free(ctx);\n    return ret;\n}', 'const EVP_MD *EVP_MD_CTX_md(const EVP_MD_CTX *ctx)\n{\n    if (!ctx)\n        return NULL;\n    return ctx->digest;\n}', 'int EVP_MD_size(const EVP_MD *md)\n{\n    if (!md) {\n        EVPerr(EVP_F_EVP_MD_SIZE, EVP_R_MESSAGE_DIGEST_IS_NULL);\n        return -1;\n    }\n    return md->md_size;\n}', 'EVP_MD_CTX *EVP_MD_CTX_new(void)\n{\n    return OPENSSL_zalloc(sizeof(EVP_MD_CTX));\n}', 'void *CRYPTO_zalloc(int num, const char *file, int line)\n{\n    void *ret = CRYPTO_malloc(num, file, line);\n    if (ret != NULL)\n        memset(ret, 0, num);\n    return ret;\n}', 'void *CRYPTO_malloc(int num, const char *file, int line)\n{\n    void *ret = NULL;\n    if (num <= 0)\n        return NULL;\n    if (allow_customize)\n        allow_customize = 0;\n    if (malloc_debug_func != NULL) {\n        if (allow_customize_debug)\n            allow_customize_debug = 0;\n        malloc_debug_func(NULL, num, file, line, 0);\n    }\n    ret = malloc_ex_func(num, file, line);\n#ifdef LEVITTE_DEBUG_MEM\n    fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\\n", ret, num);\n#endif\n    if (malloc_debug_func != NULL)\n        malloc_debug_func(ret, num, file, line, 1);\n#ifndef OPENSSL_CPUID_OBJ\n    if (ret && (num > 2048)) {\n        extern unsigned char cleanse_ctr;\n        ((unsigned char *)ret)[0] = cleanse_ctr;\n    }\n#endif\n    return ret;\n}']