apps/s_server.c:2115: error: NULL_DEREFERENCE
  pointer `con` last assigned on line 2112 could be null and is dereferenced by call to `SSL_callback_ctrl()` at line 2115, column 13.
Showing all 56 steps of the trace


apps/s_server.c:2082:1: start of procedure sv_body()
2080.   }
2081.   
2082. > static int sv_body(const char *hostname, int s, int stype,
2083.                      unsigned char *context)
2084.   {

apps/s_server.c:2085:5: 
2083.                      unsigned char *context)
2084.   {
2085. >     char *buf = NULL;
2086.       fd_set readfds;
2087.       int ret = 1, width;

apps/s_server.c:2087:5: 
2085.       char *buf = NULL;
2086.       fd_set readfds;
2087. >     int ret = 1, width;
2088.       int k, i;
2089.       unsigned long l;

apps/s_server.c:2090:5: 
2088.       int k, i;
2089.       unsigned long l;
2090. >     SSL *con = NULL;
2091.       BIO *sbio;
2092.       struct timeval timeout;

apps/s_server.c:2099:5: 
2097.   #endif
2098.   
2099. >     buf = app_malloc(bufsize, "server buffer");
2100.   #ifdef FIONBIO
2101.       if (s_nbio) {

apps/apps.c:991:1: start of procedure app_malloc()
  989.   }
  990.   
  991. > void* app_malloc(int sz, const char *what)
  992.   {
  993.       void *vp = OPENSSL_malloc(sz);

apps/apps.c:993:5: 
  991.   void* app_malloc(int sz, const char *what)
  992.   {
  993. >     void *vp = OPENSSL_malloc(sz);
  994.   
  995.       if (vp == NULL) {

crypto/mem.c:119:1: start of procedure CRYPTO_malloc()
    117.   }
    118.   
    119. > void *CRYPTO_malloc(size_t num, const char *file, int line)
    120.   {
    121.       void *ret = NULL;

crypto/mem.c:121:5: 
    119.   void *CRYPTO_malloc(size_t num, const char *file, int line)
    120.   {
    121. >     void *ret = NULL;
    122.   
    123.       if (num <= 0)

crypto/mem.c:123:9: Taking false branch
    121.       void *ret = NULL;
    122.   
    123.       if (num <= 0)
                   ^
    124.           return NULL;
    125.   

crypto/mem.c:126:5: 
    124.           return NULL;
    125.   
    126. >     allow_customize = 0;
    127.   #ifndef OPENSSL_NO_CRYPTO_MDEBUG
    128.       if (call_malloc_debug) {

crypto/mem.c:136:5: 
    134.       }
    135.   #else
    136. >     (void)file;
    137.       (void)line;
    138.       ret = malloc(num);

crypto/mem.c:137:5: 
    135.   #else
    136.       (void)file;
    137. >     (void)line;
    138.       ret = malloc(num);
    139.   #endif

crypto/mem.c:138:5: 
    136.       (void)file;
    137.       (void)line;
    138. >     ret = malloc(num);
    139.   #endif
    140.   

crypto/mem.c:153:5: 
    151.   #endif
    152.   
    153. >     return ret;
    154.   }
    155.   

crypto/mem.c:154:1: return from a call to CRYPTO_malloc
    152.   
    153.       return ret;
    154. > }
    155.   
    156.   void *CRYPTO_zalloc(size_t num, const char *file, int line)

apps/apps.c:995:9: Taking false branch
  993.       void *vp = OPENSSL_malloc(sz);
  994.   
  995.       if (vp == NULL) {
                 ^
  996.           BIO_printf(bio_err, "%s: Could not allocate %d bytes for %s\n",
  997.                   opt_getprog(), sz, what);

apps/apps.c:1001:5: 
  999.           exit(1);
  1000.       }
  1001. >     return vp;
  1002.   }
  1003.   

apps/apps.c:1002:1: return from a call to app_malloc
  1000.       }
  1001.       return vp;
  1002. > }
  1003.   
  1004.   /*

apps/s_server.c:2101:9: Taking false branch
2099.       buf = app_malloc(bufsize, "server buffer");
2100.   #ifdef FIONBIO
2101.       if (s_nbio) {
                ^
2102.           unsigned long sl = 1;
2103.   

apps/s_server.c:2111:9: Taking true branch
2109.   #endif
2110.   
2111.       if (con == NULL) {
                ^
2112.           con = SSL_new(ctx);
2113.   

apps/s_server.c:2112:9: 
2110.   
2111.       if (con == NULL) {
2112. >         con = SSL_new(ctx);
2113.   
2114.           if (s_tlsextdebug) {

ssl/ssl_lib.c:614:1: start of procedure SSL_new()
  612.   }
  613.   
  614. > SSL *SSL_new(SSL_CTX *ctx)
  615.   {
  616.       SSL *s;

ssl/ssl_lib.c:618:9: Taking false branch
  616.       SSL *s;
  617.   
  618.       if (ctx == NULL) {
                 ^
  619.           SSLerr(SSL_F_SSL_NEW, SSL_R_NULL_SSL_CTX);
  620.           return (NULL);

ssl/ssl_lib.c:622:9: Taking false branch
  620.           return (NULL);
  621.       }
  622.       if (ctx->method == NULL) {
                 ^
  623.           SSLerr(SSL_F_SSL_NEW, SSL_R_SSL_CTX_HAS_NO_DEFAULT_SSL_VERSION);
  624.           return (NULL);

ssl/ssl_lib.c:627:5: 
  625.       }
  626.   
  627. >     s = OPENSSL_zalloc(sizeof(*s));
  628.       if (s == NULL)
  629.           goto err;

crypto/mem.c:156:1: start of procedure CRYPTO_zalloc()
    154.   }
    155.   
    156. > void *CRYPTO_zalloc(size_t num, const char *file, int line)
    157.   {
    158.       void *ret = CRYPTO_malloc(num, file, line);

crypto/mem.c:158:5: 
    156.   void *CRYPTO_zalloc(size_t num, const char *file, int line)
    157.   {
    158. >     void *ret = CRYPTO_malloc(num, file, line);
    159.   
    160.       if (ret != NULL)

crypto/mem.c:119:1: start of procedure CRYPTO_malloc()
      117.   }
      118.   
      119. > void *CRYPTO_malloc(size_t num, const char *file, int line)
      120.   {
      121.       void *ret = NULL;

crypto/mem.c:121:5: 
      119.   void *CRYPTO_malloc(size_t num, const char *file, int line)
      120.   {
      121. >     void *ret = NULL;
      122.   
      123.       if (num <= 0)

crypto/mem.c:123:9: Taking false branch
      121.       void *ret = NULL;
      122.   
      123.       if (num <= 0)
                     ^
      124.           return NULL;
      125.   

crypto/mem.c:126:5: 
      124.           return NULL;
      125.   
      126. >     allow_customize = 0;
      127.   #ifndef OPENSSL_NO_CRYPTO_MDEBUG
      128.       if (call_malloc_debug) {

crypto/mem.c:136:5: 
      134.       }
      135.   #else
      136. >     (void)file;
      137.       (void)line;
      138.       ret = malloc(num);

crypto/mem.c:137:5: 
      135.   #else
      136.       (void)file;
      137. >     (void)line;
      138.       ret = malloc(num);
      139.   #endif

crypto/mem.c:138:5: 
      136.       (void)file;
      137.       (void)line;
      138. >     ret = malloc(num);
      139.   #endif
      140.   

crypto/mem.c:153:5: 
      151.   #endif
      152.   
      153. >     return ret;
      154.   }
      155.   

crypto/mem.c:154:1: return from a call to CRYPTO_malloc
      152.   
      153.       return ret;
      154. > }
      155.   
      156.   void *CRYPTO_zalloc(size_t num, const char *file, int line)

crypto/mem.c:160:9: Taking false branch
    158.       void *ret = CRYPTO_malloc(num, file, line);
    159.   
    160.       if (ret != NULL)
                   ^
    161.           memset(ret, 0, num);
    162.       return ret;

crypto/mem.c:162:5: 
    160.       if (ret != NULL)
    161.           memset(ret, 0, num);
    162. >     return ret;
    163.   }
    164.   

crypto/mem.c:163:1: return from a call to CRYPTO_zalloc
    161.           memset(ret, 0, num);
    162.       return ret;
    163. > }
    164.   
    165.   void *CRYPTO_realloc(void *str, size_t num, const char *file, int line)

ssl/ssl_lib.c:628:9: Taking true branch
  626.   
  627.       s = OPENSSL_zalloc(sizeof(*s));
  628.       if (s == NULL)
                 ^
  629.           goto err;
  630.   

ssl/ssl_lib.c:744:2: 
  742.   
  743.       return (s);
  744. >  err:
  745.       SSL_free(s);
  746.       SSLerr(SSL_F_SSL_NEW, ERR_R_MALLOC_FAILURE);

ssl/ssl_lib.c:745:5: 
  743.       return (s);
  744.    err:
  745. >     SSL_free(s);
  746.       SSLerr(SSL_F_SSL_NEW, ERR_R_MALLOC_FAILURE);
  747.       return (NULL);

ssl/ssl_lib.c:990:1: start of procedure SSL_free()
    988.   }
    989.   
    990. > void SSL_free(SSL *s)
    991.   {
    992.       int i;

ssl/ssl_lib.c:994:9: Taking true branch
    992.       int i;
    993.   
    994.       if (s == NULL)
                   ^
    995.           return;
    996.   

ssl/ssl_lib.c:995:9: 
    993.   
    994.       if (s == NULL)
    995. >         return;
    996.   
    997.       i = CRYPTO_add(&s->references, -1, CRYPTO_LOCK_SSL);

ssl/ssl_lib.c:1074:1: return from a call to SSL_free
    1072.   
    1073.       OPENSSL_free(s);
    1074. > }
    1075.   
    1076.   void SSL_set_rbio(SSL *s, BIO *rbio)

ssl/ssl_lib.c:746:5: Skipping ERR_put_error(): empty list of specs
  744.    err:
  745.       SSL_free(s);
  746.       SSLerr(SSL_F_SSL_NEW, ERR_R_MALLOC_FAILURE);
             ^
  747.       return (NULL);
  748.   }

ssl/ssl_lib.c:747:5: 
  745.       SSL_free(s);
  746.       SSLerr(SSL_F_SSL_NEW, ERR_R_MALLOC_FAILURE);
  747. >     return (NULL);
  748.   }
  749.   

ssl/ssl_lib.c:748:1: return from a call to SSL_new
  746.       SSLerr(SSL_F_SSL_NEW, ERR_R_MALLOC_FAILURE);
  747.       return (NULL);
  748. > }
  749.   
  750.   void SSL_up_ref(SSL *s)

apps/s_server.c:2114:13: Taking true branch
2112.           con = SSL_new(ctx);
2113.   
2114.           if (s_tlsextdebug) {
                    ^
2115.               SSL_set_tlsext_debug_callback(con, tlsext_cb);
2116.               SSL_set_tlsext_debug_arg(con, bio_s_out);

apps/s_server.c:2115:13: 
2113.   
2114.           if (s_tlsextdebug) {
2115. >             SSL_set_tlsext_debug_callback(con, tlsext_cb);
2116.               SSL_set_tlsext_debug_arg(con, bio_s_out);
2117.           }

ssl/ssl_lib.c:1696:1: start of procedure SSL_callback_ctrl()
  1694.   }
  1695.   
  1696. > long SSL_callback_ctrl(SSL *s, int cmd, void (*fp) (void))
  1697.   {
  1698.       switch (cmd) {

ssl/ssl_lib.c:1698:5: 
  1696.   long SSL_callback_ctrl(SSL *s, int cmd, void (*fp) (void))
  1697.   {
  1698. >     switch (cmd) {
  1699.       case SSL_CTRL_SET_MSG_CALLBACK:
  1700.           s->msg_callback = (void (*)

ssl/ssl_lib.c:1699:5: Switch condition is false. Skipping switch case
  1697.   {
  1698.       switch (cmd) {
  1699.       case SSL_CTRL_SET_MSG_CALLBACK:
              ^
  1700.           s->msg_callback = (void (*)
  1701.                              (int write_p, int version, int content_type,

ssl/ssl_lib.c:1707:9: Skipping __function_pointer__(): unresolved function pointer
  1705.   
  1706.       default:
  1707.           return (s->method->ssl_callback_ctrl(s, cmd, fp));
                  ^
  1708.       }
  1709.   }
