ssl/ssl_lib.c:3167: error: NULL_DEREFERENCE
  pointer `*hash` last assigned on line 3165 could be null and is dereferenced by call to `EVP_MD_CTX_free()` at line 3167, column 9.
Showing all 26 steps of the trace


ssl/ssl_lib.c:3162:1: start of procedure ssl_replace_hash()
3160.    */
3161.   
3162. > EVP_MD_CTX *ssl_replace_hash(EVP_MD_CTX **hash, const EVP_MD *md)
3163.   {
3164.       ssl_clear_hash_ctx(hash);

ssl/ssl_lib.c:3164:5: 
3162.   EVP_MD_CTX *ssl_replace_hash(EVP_MD_CTX **hash, const EVP_MD *md)
3163.   {
3164. >     ssl_clear_hash_ctx(hash);
3165.       *hash = EVP_MD_CTX_new();
3166.       if (*hash == NULL || (md && EVP_DigestInit_ex(*hash, md, NULL) <= 0)) {

ssl/ssl_lib.c:3174:1: start of procedure ssl_clear_hash_ctx()
  3172.   }
  3173.   
  3174. > void ssl_clear_hash_ctx(EVP_MD_CTX **hash)
  3175.   {
  3176.   

ssl/ssl_lib.c:3177:9: Taking false branch
  3175.   {
  3176.   
  3177.       if (*hash)
                  ^
  3178.           EVP_MD_CTX_free(*hash);
  3179.       *hash = NULL;

ssl/ssl_lib.c:3179:5: 
  3177.       if (*hash)
  3178.           EVP_MD_CTX_free(*hash);
  3179. >     *hash = NULL;
  3180.   }
  3181.   

ssl/ssl_lib.c:3180:1: return from a call to ssl_clear_hash_ctx
  3178.           EVP_MD_CTX_free(*hash);
  3179.       *hash = NULL;
  3180. > }
  3181.   
  3182.   /* Retrieve handshake hashes */

ssl/ssl_lib.c:3165:5: 
3163.   {
3164.       ssl_clear_hash_ctx(hash);
3165. >     *hash = EVP_MD_CTX_new();
3166.       if (*hash == NULL || (md && EVP_DigestInit_ex(*hash, md, NULL) <= 0)) {
3167.           EVP_MD_CTX_free(*hash);

crypto/evp/digest.c:153:1: start of procedure EVP_MD_CTX_new()
  151.   }
  152.   
  153. > EVP_MD_CTX *EVP_MD_CTX_new(void)
  154.   {
  155.       return OPENSSL_zalloc(sizeof(EVP_MD_CTX));

crypto/evp/digest.c:155:5: 
  153.   EVP_MD_CTX *EVP_MD_CTX_new(void)
  154.   {
  155. >     return OPENSSL_zalloc(sizeof(EVP_MD_CTX));
  156.   }
  157.   

crypto/mem.c:312:1: start of procedure CRYPTO_zalloc()
    310.   }
    311.   
    312. > void *CRYPTO_zalloc(size_t num, const char *file, int line)
    313.   {
    314.       void *ret = CRYPTO_malloc(num, file, line);

crypto/mem.c:314:5: 
    312.   void *CRYPTO_zalloc(size_t num, const char *file, int line)
    313.   {
    314. >     void *ret = CRYPTO_malloc(num, file, line);
    315.   
    316.       if (ret != NULL)

crypto/mem.c:279:1: start of procedure CRYPTO_malloc()
      277.   }
      278.   
      279. > void *CRYPTO_malloc(size_t num, const char *file, int line)
      280.   {
      281.       void *ret = NULL;

crypto/mem.c:281:5: 
      279.   void *CRYPTO_malloc(size_t num, const char *file, int line)
      280.   {
      281. >     void *ret = NULL;
      282.   
      283.       if (num <= 0)

crypto/mem.c:283:9: Taking false branch
      281.       void *ret = NULL;
      282.   
      283.       if (num <= 0)
                     ^
      284.           return NULL;
      285.   

crypto/mem.c:286:9: Taking false branch
      284.           return NULL;
      285.   
      286.       if (allow_customize)
                     ^
      287.           allow_customize = 0;
      288.       if (malloc_debug_func != NULL) {

crypto/mem.c:288:9: Taking false branch
      286.       if (allow_customize)
      287.           allow_customize = 0;
      288.       if (malloc_debug_func != NULL) {
                     ^
      289.           if (allow_customize_debug)
      290.               allow_customize_debug = 0;

crypto/mem.c:293:5: Skipping __function_pointer__(): unresolved function pointer
      291.           malloc_debug_func(NULL, num, file, line, 0);
      292.       }
      293.       ret = malloc_ex_func(num, file, line);
                 ^
      294.       if (malloc_debug_func != NULL)
      295.           malloc_debug_func(ret, num, file, line, 1);

crypto/mem.c:294:9: Taking false branch
      292.       }
      293.       ret = malloc_ex_func(num, file, line);
      294.       if (malloc_debug_func != NULL)
                     ^
      295.           malloc_debug_func(ret, num, file, line, 1);
      296.   

crypto/mem.c:309:5: 
      307.   #endif
      308.   
      309. >     return ret;
      310.   }
      311.   

crypto/mem.c:310:1: return from a call to CRYPTO_malloc
      308.   
      309.       return ret;
      310. > }
      311.   
      312.   void *CRYPTO_zalloc(size_t num, const char *file, int line)

crypto/mem.c:316:9: Taking false branch
    314.       void *ret = CRYPTO_malloc(num, file, line);
    315.   
    316.       if (ret != NULL)
                   ^
    317.           memset(ret, 0, num);
    318.       return ret;

crypto/mem.c:318:5: 
    316.       if (ret != NULL)
    317.           memset(ret, 0, num);
    318. >     return ret;
    319.   }
    320.   

crypto/mem.c:319:1: return from a call to CRYPTO_zalloc
    317.           memset(ret, 0, num);
    318.       return ret;
    319. > }
    320.   
    321.   void *CRYPTO_realloc(void *str, size_t num, const char *file, int line)

crypto/evp/digest.c:156:1: return from a call to EVP_MD_CTX_new
  154.   {
  155.       return OPENSSL_zalloc(sizeof(EVP_MD_CTX));
  156. > }
  157.   
  158.   void EVP_MD_CTX_free(EVP_MD_CTX *ctx)

ssl/ssl_lib.c:3166:9: Taking true branch
3164.       ssl_clear_hash_ctx(hash);
3165.       *hash = EVP_MD_CTX_new();
3166.       if (*hash == NULL || (md && EVP_DigestInit_ex(*hash, md, NULL) <= 0)) {
                ^
3167.           EVP_MD_CTX_free(*hash);
3168.           *hash = NULL;

ssl/ssl_lib.c:3167:9: 
3165.       *hash = EVP_MD_CTX_new();
3166.       if (*hash == NULL || (md && EVP_DigestInit_ex(*hash, md, NULL) <= 0)) {
3167. >         EVP_MD_CTX_free(*hash);
3168.           *hash = NULL;
3169.           return NULL;
