ssl/statem/statem_srvr.c:1442: error: NULL_DEREFERENCE
  pointer `clienthello` last assigned on line 1242 could be null and is dereferenced at line 1442, column 5.
Showing all 27 steps of the trace


ssl/statem/statem_srvr.c:1234:1: start of procedure tls_process_client_hello()
1232.   #endif                          /* !OPENSSL_NO_EC */
1233.   
1234. > MSG_PROCESS_RETURN tls_process_client_hello(SSL *s, PACKET *pkt)
1235.   {
1236.       int al = SSL_AD_INTERNAL_ERROR;

ssl/statem/statem_srvr.c:1236:5: 
1234.   MSG_PROCESS_RETURN tls_process_client_hello(SSL *s, PACKET *pkt)
1235.   {
1236. >     int al = SSL_AD_INTERNAL_ERROR;
1237.       /* |cookie| will only be initialized for DTLS. */
1238.       PACKET session_id, compression, extensions, cookie;

ssl/statem/statem_srvr.c:1239:5: 
1237.       /* |cookie| will only be initialized for DTLS. */
1238.       PACKET session_id, compression, extensions, cookie;
1239. >     static const unsigned char null_compression = 0;
1240.       CLIENTHELLO_MSG *clienthello;
1241.   

ssl/statem/statem_srvr.c:1242:5: 
1240.       CLIENTHELLO_MSG *clienthello;
1241.   
1242. >     clienthello = OPENSSL_zalloc(sizeof(*clienthello));
1243.       if (clienthello == NULL) {
1244.           SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, ERR_R_INTERNAL_ERROR);

crypto/mem.c:186:1: start of procedure CRYPTO_zalloc()
  184.   }
  185.   
  186. > void *CRYPTO_zalloc(size_t num, const char *file, int line)
  187.   {
  188.       void *ret = CRYPTO_malloc(num, file, line);

crypto/mem.c:188:5: 
  186.   void *CRYPTO_zalloc(size_t num, const char *file, int line)
  187.   {
  188. >     void *ret = CRYPTO_malloc(num, file, line);
  189.   
  190.       FAILTEST();

crypto/mem.c:158:1: start of procedure CRYPTO_malloc()
    156.   #endif
    157.   
    158. > void *CRYPTO_malloc(size_t num, const char *file, int line)
    159.   {
    160.       void *ret = NULL;

crypto/mem.c:160:5: 
    158.   void *CRYPTO_malloc(size_t num, const char *file, int line)
    159.   {
    160. >     void *ret = NULL;
    161.   
    162.       if (malloc_impl != NULL && malloc_impl != CRYPTO_malloc)

crypto/mem.c:162:9: Taking false branch
    160.       void *ret = NULL;
    161.   
    162.       if (malloc_impl != NULL && malloc_impl != CRYPTO_malloc)
                   ^
    163.           return malloc_impl(num, file, line);
    164.   

crypto/mem.c:165:9: Taking false branch
    163.           return malloc_impl(num, file, line);
    164.   
    165.       if (num == 0)
                   ^
    166.           return NULL;
    167.   

crypto/mem.c:169:5: 
    167.   
    168.       FAILTEST();
    169. >     allow_customize = 0;
    170.   #ifndef OPENSSL_NO_CRYPTO_MDEBUG
    171.       if (call_malloc_debug) {

crypto/mem.c:179:5: 
    177.       }
    178.   #else
    179. >     osslargused(file); osslargused(line);
    180.       ret = malloc(num);
    181.   #endif

crypto/mem.c:179:24: 
    177.       }
    178.   #else
    179. >     osslargused(file); osslargused(line);
    180.       ret = malloc(num);
    181.   #endif

crypto/mem.c:180:5: 
    178.   #else
    179.       osslargused(file); osslargused(line);
    180. >     ret = malloc(num);
    181.   #endif
    182.   

crypto/mem.c:183:5: 
    181.   #endif
    182.   
    183. >     return ret;
    184.   }
    185.   

crypto/mem.c:184:1: return from a call to CRYPTO_malloc
    182.   
    183.       return ret;
    184. > }
    185.   
    186.   void *CRYPTO_zalloc(size_t num, const char *file, int line)

crypto/mem.c:191:9: Taking false branch
  189.   
  190.       FAILTEST();
  191.       if (ret != NULL)
                 ^
  192.           memset(ret, 0, num);
  193.       return ret;

crypto/mem.c:193:5: 
  191.       if (ret != NULL)
  192.           memset(ret, 0, num);
  193. >     return ret;
  194.   }
  195.   

crypto/mem.c:194:1: return from a call to CRYPTO_zalloc
  192.           memset(ret, 0, num);
  193.       return ret;
  194. > }
  195.   
  196.   void *CRYPTO_realloc(void *str, size_t num, const char *file, int line)

ssl/statem/statem_srvr.c:1243:9: Taking true branch
1241.   
1242.       clienthello = OPENSSL_zalloc(sizeof(*clienthello));
1243.       if (clienthello == NULL) {
                ^
1244.           SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, ERR_R_INTERNAL_ERROR);
1245.           goto err;

ssl/statem/statem_srvr.c:1244:9: Skipping ERR_put_error(): empty list of specs
1242.       clienthello = OPENSSL_zalloc(sizeof(*clienthello));
1243.       if (clienthello == NULL) {
1244.           SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, ERR_R_INTERNAL_ERROR);
                ^
1245.           goto err;
1246.       }

ssl/statem/statem_srvr.c:1439:2: 
1437.    f_err:
1438.       ssl3_send_alert(s, SSL3_AL_FATAL, al);
1439. >  err:
1440.       ossl_statem_set_error(s);
1441.   

ssl/statem/statem_srvr.c:1440:5: 
1438.       ssl3_send_alert(s, SSL3_AL_FATAL, al);
1439.    err:
1440. >     ossl_statem_set_error(s);
1441.   
1442.       OPENSSL_free(clienthello->pre_proc_exts);

ssl/statem/statem.c:116:1: start of procedure ossl_statem_set_error()
  114.    * the current connection.
  115.    */
  116. > void ossl_statem_set_error(SSL *s)
  117.   {
  118.       s->statem.state = MSG_FLOW_ERROR;

ssl/statem/statem.c:118:5: 
  116.   void ossl_statem_set_error(SSL *s)
  117.   {
  118. >     s->statem.state = MSG_FLOW_ERROR;
  119.   }
  120.   

ssl/statem/statem.c:119:1: return from a call to ossl_statem_set_error
  117.   {
  118.       s->statem.state = MSG_FLOW_ERROR;
  119. > }
  120.   
  121.   /*

ssl/statem/statem_srvr.c:1442:5: 
1440.       ossl_statem_set_error(s);
1441.   
1442. >     OPENSSL_free(clienthello->pre_proc_exts);
1443.       OPENSSL_free(clienthello);
1444.   
