ssl/statem/statem_dtls.c:1108: error: NULL_DEREFERENCE
  pointer `frag->fragment` last assigned on line 1104 could be null and is dereferenced by call to `memcpy()` at line 1108, column 5.
Showing all 26 steps of the trace


ssl/statem/statem_dtls.c:1092:1: start of procedure dtls1_buffer_message()
1090.   }
1091.   
1092. > int dtls1_buffer_message(SSL *s, int is_ccs)
1093.   {
1094.       pitem *item;

ssl/statem/statem_dtls.c:1102:5: Condition is true
1100.        * serialized
1101.        */
1102.       OPENSSL_assert(s->init_off == 0);
            ^
1103.   
1104.       frag = dtls1_hm_fragment_new(s->init_num, 0);

ssl/statem/statem_dtls.c:1104:5: 
1102.       OPENSSL_assert(s->init_off == 0);
1103.   
1104. >     frag = dtls1_hm_fragment_new(s->init_num, 0);
1105.       if (frag == NULL)
1106.           return 0;

ssl/statem/statem_dtls.c:163:1: start of procedure dtls1_hm_fragment_new()
  161.   static int dtls_get_reassembled_message(SSL *s, long *len);
  162.   
  163. > static hm_fragment *dtls1_hm_fragment_new(unsigned long frag_len,
  164.                                             int reassembly)
  165.   {

ssl/statem/statem_dtls.c:166:5: 
  164.                                             int reassembly)
  165.   {
  166. >     hm_fragment *frag = NULL;
  167.       unsigned char *buf = NULL;
  168.       unsigned char *bitmask = NULL;

ssl/statem/statem_dtls.c:167:5: 
  165.   {
  166.       hm_fragment *frag = NULL;
  167. >     unsigned char *buf = NULL;
  168.       unsigned char *bitmask = NULL;
  169.   

ssl/statem/statem_dtls.c:168:5: 
  166.       hm_fragment *frag = NULL;
  167.       unsigned char *buf = NULL;
  168. >     unsigned char *bitmask = NULL;
  169.   
  170.       frag = OPENSSL_malloc(sizeof(*frag));

ssl/statem/statem_dtls.c:170:5: 
  168.       unsigned char *bitmask = NULL;
  169.   
  170. >     frag = OPENSSL_malloc(sizeof(*frag));
  171.       if (frag == NULL)
  172.           return NULL;

crypto/mem.c:120:1: start of procedure CRYPTO_malloc()
    118.   }
    119.   
    120. > void *CRYPTO_malloc(size_t num, const char *file, int line)
    121.   {
    122.       void *ret = NULL;

crypto/mem.c:122:5: 
    120.   void *CRYPTO_malloc(size_t num, const char *file, int line)
    121.   {
    122. >     void *ret = NULL;
    123.   
    124.       if (num <= 0)

crypto/mem.c:124:9: Taking false branch
    122.       void *ret = NULL;
    123.   
    124.       if (num <= 0)
                   ^
    125.           return NULL;
    126.   

crypto/mem.c:127:5: 
    125.           return NULL;
    126.   
    127. >     allow_customize = 0;
    128.   #ifndef OPENSSL_NO_CRYPTO_MDEBUG
    129.       if (call_malloc_debug) {

crypto/mem.c:137:5: 
    135.       }
    136.   #else
    137. >     (void)file;
    138.       (void)line;
    139.       ret = malloc(num);

crypto/mem.c:138:5: 
    136.   #else
    137.       (void)file;
    138. >     (void)line;
    139.       ret = malloc(num);
    140.   #endif

crypto/mem.c:139:5: 
    137.       (void)file;
    138.       (void)line;
    139. >     ret = malloc(num);
    140.   #endif
    141.   

crypto/mem.c:154:5: 
    152.   #endif
    153.   
    154. >     return ret;
    155.   }
    156.   

crypto/mem.c:155:1: return from a call to CRYPTO_malloc
    153.   
    154.       return ret;
    155. > }
    156.   
    157.   void *CRYPTO_zalloc(size_t num, const char *file, int line)

ssl/statem/statem_dtls.c:171:9: Taking false branch
  169.   
  170.       frag = OPENSSL_malloc(sizeof(*frag));
  171.       if (frag == NULL)
                 ^
  172.           return NULL;
  173.   

ssl/statem/statem_dtls.c:174:9: Taking false branch
  172.           return NULL;
  173.   
  174.       if (frag_len) {
                 ^
  175.           buf = OPENSSL_malloc(frag_len);
  176.           if (buf == NULL) {

ssl/statem/statem_dtls.c:183:5: 
  181.   
  182.       /* zero length fragment gets zero frag->fragment */
  183. >     frag->fragment = buf;
  184.   
  185.       /* Initialize reassembly bitmask if necessary */

ssl/statem/statem_dtls.c:186:9: Taking false branch
  184.   
  185.       /* Initialize reassembly bitmask if necessary */
  186.       if (reassembly) {
                 ^
  187.           bitmask = OPENSSL_zalloc(RSMBLY_BITMASK_SIZE(frag_len));
  188.           if (bitmask == NULL) {

ssl/statem/statem_dtls.c:195:5: 
  193.       }
  194.   
  195. >     frag->reassembly = bitmask;
  196.   
  197.       return frag;

ssl/statem/statem_dtls.c:197:5: 
  195.       frag->reassembly = bitmask;
  196.   
  197. >     return frag;
  198.   }
  199.   

ssl/statem/statem_dtls.c:198:1: return from a call to dtls1_hm_fragment_new
  196.   
  197.       return frag;
  198. > }
  199.   
  200.   void dtls1_hm_fragment_free(hm_fragment *frag)

ssl/statem/statem_dtls.c:1105:9: Taking false branch
1103.   
1104.       frag = dtls1_hm_fragment_new(s->init_num, 0);
1105.       if (frag == NULL)
                ^
1106.           return 0;
1107.   

ssl/statem/statem_dtls.c:1108:5: 
1106.           return 0;
1107.   
1108. >     memcpy(frag->fragment, s->init_buf->data, s->init_num);
1109.   
1110.       if (is_ccs) {
