ssl/statem/statem_srvr.c:1459: error: NULL_DEREFERENCE
  pointer `clienthello` last assigned on line 1259 could be null and is dereferenced at line 1459, column 5.
Showing all 27 steps of the trace


ssl/statem/statem_srvr.c:1251:1: start of procedure tls_process_client_hello()
1249.   #endif                          /* !OPENSSL_NO_EC */
1250.   
1251. > MSG_PROCESS_RETURN tls_process_client_hello(SSL *s, PACKET *pkt)
1252.   {
1253.       int al = SSL_AD_INTERNAL_ERROR;

ssl/statem/statem_srvr.c:1253:5: 
1251.   MSG_PROCESS_RETURN tls_process_client_hello(SSL *s, PACKET *pkt)
1252.   {
1253. >     int al = SSL_AD_INTERNAL_ERROR;
1254.       /* |cookie| will only be initialized for DTLS. */
1255.       PACKET session_id, compression, extensions, cookie;

ssl/statem/statem_srvr.c:1256:5: 
1254.       /* |cookie| will only be initialized for DTLS. */
1255.       PACKET session_id, compression, extensions, cookie;
1256. >     static const unsigned char null_compression = 0;
1257.       CLIENTHELLO_MSG *clienthello;
1258.   

ssl/statem/statem_srvr.c:1259:5: 
1257.       CLIENTHELLO_MSG *clienthello;
1258.   
1259. >     clienthello = OPENSSL_zalloc(sizeof(*clienthello));
1260.       if (clienthello == NULL) {
1261.           SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, ERR_R_INTERNAL_ERROR);

crypto/mem.c:186:1: start of procedure CRYPTO_zalloc()
  184.   }
  185.   
  186. > void *CRYPTO_zalloc(size_t num, const char *file, int line)
  187.   {
  188.       void *ret = CRYPTO_malloc(num, file, line);

crypto/mem.c:188:5: 
  186.   void *CRYPTO_zalloc(size_t num, const char *file, int line)
  187.   {
  188. >     void *ret = CRYPTO_malloc(num, file, line);
  189.   
  190.       FAILTEST();

crypto/mem.c:158:1: start of procedure CRYPTO_malloc()
    156.   #endif
    157.   
    158. > void *CRYPTO_malloc(size_t num, const char *file, int line)
    159.   {
    160.       void *ret = NULL;

crypto/mem.c:160:5: 
    158.   void *CRYPTO_malloc(size_t num, const char *file, int line)
    159.   {
    160. >     void *ret = NULL;
    161.   
    162.       if (malloc_impl != NULL && malloc_impl != CRYPTO_malloc)

crypto/mem.c:162:9: Taking false branch
    160.       void *ret = NULL;
    161.   
    162.       if (malloc_impl != NULL && malloc_impl != CRYPTO_malloc)
                   ^
    163.           return malloc_impl(num, file, line);
    164.   

crypto/mem.c:165:9: Taking false branch
    163.           return malloc_impl(num, file, line);
    164.   
    165.       if (num == 0)
                   ^
    166.           return NULL;
    167.   

crypto/mem.c:169:5: 
    167.   
    168.       FAILTEST();
    169. >     allow_customize = 0;
    170.   #ifndef OPENSSL_NO_CRYPTO_MDEBUG
    171.       if (call_malloc_debug) {

crypto/mem.c:179:5: 
    177.       }
    178.   #else
    179. >     osslargused(file); osslargused(line);
    180.       ret = malloc(num);
    181.   #endif

crypto/mem.c:179:24: 
    177.       }
    178.   #else
    179. >     osslargused(file); osslargused(line);
    180.       ret = malloc(num);
    181.   #endif

crypto/mem.c:180:5: 
    178.   #else
    179.       osslargused(file); osslargused(line);
    180. >     ret = malloc(num);
    181.   #endif
    182.   

crypto/mem.c:183:5: 
    181.   #endif
    182.   
    183. >     return ret;
    184.   }
    185.   

crypto/mem.c:184:1: return from a call to CRYPTO_malloc
    182.   
    183.       return ret;
    184. > }
    185.   
    186.   void *CRYPTO_zalloc(size_t num, const char *file, int line)

crypto/mem.c:191:9: Taking false branch
  189.   
  190.       FAILTEST();
  191.       if (ret != NULL)
                 ^
  192.           memset(ret, 0, num);
  193.       return ret;

crypto/mem.c:193:5: 
  191.       if (ret != NULL)
  192.           memset(ret, 0, num);
  193. >     return ret;
  194.   }
  195.   

crypto/mem.c:194:1: return from a call to CRYPTO_zalloc
  192.           memset(ret, 0, num);
  193.       return ret;
  194. > }
  195.   
  196.   void *CRYPTO_realloc(void *str, size_t num, const char *file, int line)

ssl/statem/statem_srvr.c:1260:9: Taking true branch
1258.   
1259.       clienthello = OPENSSL_zalloc(sizeof(*clienthello));
1260.       if (clienthello == NULL) {
                ^
1261.           SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, ERR_R_INTERNAL_ERROR);
1262.           goto err;

ssl/statem/statem_srvr.c:1261:9: Skipping ERR_put_error(): empty list of specs
1259.       clienthello = OPENSSL_zalloc(sizeof(*clienthello));
1260.       if (clienthello == NULL) {
1261.           SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, ERR_R_INTERNAL_ERROR);
                ^
1262.           goto err;
1263.       }

ssl/statem/statem_srvr.c:1456:2: 
1454.    f_err:
1455.       ssl3_send_alert(s, SSL3_AL_FATAL, al);
1456. >  err:
1457.       ossl_statem_set_error(s);
1458.   

ssl/statem/statem_srvr.c:1457:5: 
1455.       ssl3_send_alert(s, SSL3_AL_FATAL, al);
1456.    err:
1457. >     ossl_statem_set_error(s);
1458.   
1459.       OPENSSL_free(clienthello->pre_proc_exts);

ssl/statem/statem.c:116:1: start of procedure ossl_statem_set_error()
  114.    * the current connection.
  115.    */
  116. > void ossl_statem_set_error(SSL *s)
  117.   {
  118.       s->statem.state = MSG_FLOW_ERROR;

ssl/statem/statem.c:118:5: 
  116.   void ossl_statem_set_error(SSL *s)
  117.   {
  118. >     s->statem.state = MSG_FLOW_ERROR;
  119.   }
  120.   

ssl/statem/statem.c:119:1: return from a call to ossl_statem_set_error
  117.   {
  118.       s->statem.state = MSG_FLOW_ERROR;
  119. > }
  120.   
  121.   /*

ssl/statem/statem_srvr.c:1459:5: 
1457.       ossl_statem_set_error(s);
1458.   
1459. >     OPENSSL_free(clienthello->pre_proc_exts);
1460.       OPENSSL_free(clienthello);
1461.   
