ssl/d1_both.c:1035: error: NULL_DEREFERENCE
  pointer `frag` last assigned on line 1033 could be null and is dereferenced at line 1035, column 9.
Showing all 22 steps of the trace


ssl/d1_both.c:1022:1: start of procedure dtls1_buffer_message()
1020.   	}
1021.   
1022. > int
1023.   dtls1_buffer_message(SSL *s, int is_ccs)
1024.   	{

ssl/d1_both.c:1031:2: Condition is true
1029.   	/* this function is called immediately after a message has 
1030.   	 * been serialized */
1031.   	OPENSSL_assert(s->init_off == 0);
         ^
1032.   
1033.   	frag = dtls1_hm_fragment_new(s->init_num, 0);

ssl/d1_both.c:1033:2: 
1031.   	OPENSSL_assert(s->init_off == 0);
1032.   
1033. > 	frag = dtls1_hm_fragment_new(s->init_num, 0);
1034.   
1035.   	memcpy(frag->fragment, s->init_buf->data, s->init_num);

ssl/d1_both.c:172:1: start of procedure dtls1_hm_fragment_new()
  170.   	long max, int *ok);
  171.   
  172. > static hm_fragment *
  173.   dtls1_hm_fragment_new(unsigned long frag_len, int reassembly)
  174.   	{

ssl/d1_both.c:175:2: 
  173.   dtls1_hm_fragment_new(unsigned long frag_len, int reassembly)
  174.   	{
  175. > 	hm_fragment *frag = NULL;
  176.   	unsigned char *buf = NULL;
  177.   	unsigned char *bitmask = NULL;

ssl/d1_both.c:176:2: 
  174.   	{
  175.   	hm_fragment *frag = NULL;
  176. > 	unsigned char *buf = NULL;
  177.   	unsigned char *bitmask = NULL;
  178.   

ssl/d1_both.c:177:2: 
  175.   	hm_fragment *frag = NULL;
  176.   	unsigned char *buf = NULL;
  177. > 	unsigned char *bitmask = NULL;
  178.   
  179.   	frag = (hm_fragment *)OPENSSL_malloc(sizeof(hm_fragment));

ssl/d1_both.c:179:2: 
  177.   	unsigned char *bitmask = NULL;
  178.   
  179. > 	frag = (hm_fragment *)OPENSSL_malloc(sizeof(hm_fragment));
  180.   	if ( frag == NULL)
  181.   		return NULL;

crypto/mem.c:295:1: start of procedure CRYPTO_malloc()
    293.   	}
    294.   
    295. > void *CRYPTO_malloc(int num, const char *file, int line)
    296.   	{
    297.   	void *ret = NULL;

crypto/mem.c:297:2: 
    295.   void *CRYPTO_malloc(int num, const char *file, int line)
    296.   	{
    297. > 	void *ret = NULL;
    298.   
    299.   	if (num <= 0) return NULL;

crypto/mem.c:299:6: Taking false branch
    297.   	void *ret = NULL;
    298.   
    299.   	if (num <= 0) return NULL;
                ^
    300.   
    301.   	allow_customize = 0;

crypto/mem.c:301:2: 
    299.   	if (num <= 0) return NULL;
    300.   
    301. > 	allow_customize = 0;
    302.   	if (malloc_debug_func != NULL)
    303.   		{

crypto/mem.c:302:6: Taking false branch
    300.   
    301.   	allow_customize = 0;
    302.   	if (malloc_debug_func != NULL)
                ^
    303.   		{
    304.   		allow_customize_debug = 0;

crypto/mem.c:307:2: Skipping __function_pointer__(): unresolved function pointer
    305.   		malloc_debug_func(NULL, num, file, line, 0);
    306.   		}
    307.   	ret = malloc_ex_func(num,file,line);
            ^
    308.   #ifdef LEVITTE_DEBUG_MEM
    309.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);

crypto/mem.c:311:6: Taking false branch
    309.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);
    310.   #endif
    311.   	if (malloc_debug_func != NULL)
                ^
    312.   		malloc_debug_func(ret, num, file, line, 1);
    313.   

crypto/mem.c:318:12: Taking false branch
    316.            * sanitisation function can't be optimised out. NB: We only do
    317.            * this for >2Kb so the overhead doesn't bother us. */
    318.           if(ret && (num > 2048))
                      ^
    319.   	{	extern unsigned char cleanse_ctr;
    320.                   ((unsigned char *)ret)[0] = cleanse_ctr;

crypto/mem.c:324:2: 
    322.   #endif
    323.   
    324. > 	return ret;
    325.   	}
    326.   char *CRYPTO_strdup(const char *str, const char *file, int line)

crypto/mem.c:325:2: return from a call to CRYPTO_malloc
    323.   
    324.   	return ret;
    325.   	}
            ^
    326.   char *CRYPTO_strdup(const char *str, const char *file, int line)
    327.   	{

ssl/d1_both.c:180:7: Taking true branch
  178.   
  179.   	frag = (hm_fragment *)OPENSSL_malloc(sizeof(hm_fragment));
  180.   	if ( frag == NULL)
               ^
  181.   		return NULL;
  182.   

ssl/d1_both.c:181:3: 
  179.   	frag = (hm_fragment *)OPENSSL_malloc(sizeof(hm_fragment));
  180.   	if ( frag == NULL)
  181. > 		return NULL;
  182.   
  183.   	if (frag_len)

ssl/d1_both.c:212:2: return from a call to dtls1_hm_fragment_new
  210.   
  211.   	return frag;
  212.   	}
          ^
  213.   
  214.   static void

ssl/d1_both.c:1035:2: 
1033.   	frag = dtls1_hm_fragment_new(s->init_num, 0);
1034.   
1035. > 	memcpy(frag->fragment, s->init_buf->data, s->init_num);
1036.   
1037.   	if ( is_ccs)
