apps/s_cb.c:769: error: NULL_DEREFERENCE
  pointer `buffer` last assigned on line 767 could be null and is dereferenced by call to `memcpy()` at line 769, column 5.
Showing all 67 steps of the trace


apps/s_cb.c:729:1: start of procedure generate_cookie_callback()
727.   
728.   #ifndef OPENSSL_NO_SOCK
729. > int generate_cookie_callback(SSL *ssl, unsigned char *cookie,
730.                                unsigned int *cookie_len)
731.   {

apps/s_cb.c:733:5: 
731.   {
732.       unsigned char *buffer;
733. >     size_t length = 0;
734.       unsigned short port;
735.       BIO_ADDR *lpeer = NULL, *peer = NULL;

apps/s_cb.c:735:5: 
733.       size_t length = 0;
734.       unsigned short port;
735. >     BIO_ADDR *lpeer = NULL, *peer = NULL;
736.   
737.       /* Initialize a random secret */

apps/s_cb.c:738:10: Taking false branch
736.   
737.       /* Initialize a random secret */
738.       if (!cookie_initialized) {
                ^
739.           if (RAND_bytes(cookie_secret, COOKIE_SECRET_LENGTH) <= 0) {
740.               BIO_printf(bio_err, "error setting random cookie secret\n");

apps/s_cb.c:746:9: 
744.       }
745.   
746. >     if (SSL_is_dtls(ssl)) {
747.           lpeer = peer = BIO_ADDR_new();
748.           if (peer == NULL) {

ssl/ssl_lib.c:860:1: start of procedure SSL_is_dtls()
  858.   }
  859.   
  860. > int SSL_is_dtls(const SSL *s)
  861.   {
  862.       return SSL_IS_DTLS(s) ? 1 : 0;

ssl/ssl_lib.c:862:12: Condition is true
  860.   int SSL_is_dtls(const SSL *s)
  861.   {
  862.       return SSL_IS_DTLS(s) ? 1 : 0;
                    ^
  863.   }
  864.   

ssl/ssl_lib.c:862:5: 
  860.   int SSL_is_dtls(const SSL *s)
  861.   {
  862. >     return SSL_IS_DTLS(s) ? 1 : 0;
  863.   }
  864.   

ssl/ssl_lib.c:863:1: return from a call to SSL_is_dtls
  861.   {
  862.       return SSL_IS_DTLS(s) ? 1 : 0;
  863. > }
  864.   
  865.   int SSL_up_ref(SSL *s)

apps/s_cb.c:746:9: Taking true branch
744.       }
745.   
746.       if (SSL_is_dtls(ssl)) {
               ^
747.           lpeer = peer = BIO_ADDR_new();
748.           if (peer == NULL) {

apps/s_cb.c:747:9: Skipping BIO_ADDR_new(): empty list of specs
745.   
746.       if (SSL_is_dtls(ssl)) {
747.           lpeer = peer = BIO_ADDR_new();
               ^
748.           if (peer == NULL) {
749.               BIO_printf(bio_err, "memory full\n");

apps/s_cb.c:748:13: Taking false branch
746.       if (SSL_is_dtls(ssl)) {
747.           lpeer = peer = BIO_ADDR_new();
748.           if (peer == NULL) {
                   ^
749.               BIO_printf(bio_err, "memory full\n");
750.               return 0;

apps/s_cb.c:754:15: 
752.   
753.           /* Read peer information */
754. >         (void)BIO_dgram_get_peer(SSL_get_rbio(ssl), peer);
755.       } else {
756.           peer = ourpeer;

ssl/ssl_lib.c:1303:1: start of procedure SSL_get_rbio()
  1301.   }
  1302.   
  1303. > BIO *SSL_get_rbio(const SSL *s)
  1304.   {
  1305.       return s->rbio;

ssl/ssl_lib.c:1305:5: 
  1303.   BIO *SSL_get_rbio(const SSL *s)
  1304.   {
  1305. >     return s->rbio;
  1306.   }
  1307.   

ssl/ssl_lib.c:1306:1: return from a call to SSL_get_rbio
  1304.   {
  1305.       return s->rbio;
  1306. > }
  1307.   
  1308.   BIO *SSL_get_wbio(const SSL *s)

crypto/bio/bio_lib.c:510:1: start of procedure BIO_ctrl()
  508.   }
  509.   
  510. > long BIO_ctrl(BIO *b, int cmd, long larg, void *parg)
  511.   {
  512.       long ret;

crypto/bio/bio_lib.c:514:9: Taking false branch
  512.       long ret;
  513.   
  514.       if (b == NULL)
                 ^
  515.           return 0;
  516.   

crypto/bio/bio_lib.c:517:10: Taking false branch
  515.           return 0;
  516.   
  517.       if ((b->method == NULL) || (b->method->ctrl == NULL)) {
                  ^
  518.           BIOerr(BIO_F_BIO_CTRL, BIO_R_UNSUPPORTED_METHOD);
  519.           return -2;

crypto/bio/bio_lib.c:517:33: Taking true branch
  515.           return 0;
  516.   
  517.       if ((b->method == NULL) || (b->method->ctrl == NULL)) {
                                         ^
  518.           BIOerr(BIO_F_BIO_CTRL, BIO_R_UNSUPPORTED_METHOD);
  519.           return -2;

crypto/bio/bio_lib.c:518:9: 
  516.   
  517.       if ((b->method == NULL) || (b->method->ctrl == NULL)) {
  518. >         BIOerr(BIO_F_BIO_CTRL, BIO_R_UNSUPPORTED_METHOD);
  519.           return -2;
  520.       }

providers/fips/fipsprov.c:381:1: start of procedure ERR_put_error()
    379.   }
    380.   
    381. > void ERR_put_error(int lib, int func, int reason, const char *file, int line)
    382.   {
    383.       /*

providers/fips/fipsprov.c:388:5: Skipping __function_pointer__(): unresolved function pointer
    386.        * a OPENSSL_CTX pointer.
    387.        */
    388.       c_put_error(NULL, ERR_PACK(lib, func, reason), file, line);
               ^
    389.       ERR_add_error_data(1, "(in the FIPS module)");
    390.   }

providers/fips/fipsprov.c:389:5: Skipping ERR_add_error_data(): empty list of specs
    387.        */
    388.       c_put_error(NULL, ERR_PACK(lib, func, reason), file, line);
    389.       ERR_add_error_data(1, "(in the FIPS module)");
               ^
    390.   }
    391.   

providers/fips/fipsprov.c:390:1: return from a call to ERR_put_error
    388.       c_put_error(NULL, ERR_PACK(lib, func, reason), file, line);
    389.       ERR_add_error_data(1, "(in the FIPS module)");
    390. > }
    391.   
    392.   void ERR_add_error_data(int num, ...)

crypto/bio/bio_lib.c:519:9: 
  517.       if ((b->method == NULL) || (b->method->ctrl == NULL)) {
  518.           BIOerr(BIO_F_BIO_CTRL, BIO_R_UNSUPPORTED_METHOD);
  519. >         return -2;
  520.       }
  521.   

crypto/bio/bio_lib.c:535:1: return from a call to BIO_ctrl
  533.   
  534.       return ret;
  535. > }
  536.   
  537.   long BIO_callback_ctrl(BIO *b, int cmd, BIO_info_cb *fp)

apps/s_cb.c:754:9: 
752.   
753.           /* Read peer information */
754. >         (void)BIO_dgram_get_peer(SSL_get_rbio(ssl), peer);
755.       } else {
756.           peer = ourpeer;

apps/s_cb.c:760:10: 
758.   
759.       /* Create buffer with peer's address and port */
760. >     if (!BIO_ADDR_rawaddress(peer, NULL, &length)) {
761.           BIO_printf(bio_err, "Failed getting peer address\n");
762.           return 0;

crypto/bio/b_addr.c:131:1: start of procedure BIO_ADDR_rawaddress()
  129.   }
  130.   
  131. > int BIO_ADDR_rawaddress(const BIO_ADDR *ap, void *p, size_t *l)
  132.   {
  133.       size_t len = 0;

crypto/bio/b_addr.c:133:5: 
  131.   int BIO_ADDR_rawaddress(const BIO_ADDR *ap, void *p, size_t *l)
  132.   {
  133. >     size_t len = 0;
  134.       const void *addrptr = NULL;
  135.   

crypto/bio/b_addr.c:134:5: 
  132.   {
  133.       size_t len = 0;
  134. >     const void *addrptr = NULL;
  135.   
  136.       if (ap->sa.sa_family == AF_INET) {

crypto/bio/b_addr.c:136:9: Taking true branch
  134.       const void *addrptr = NULL;
  135.   
  136.       if (ap->sa.sa_family == AF_INET) {
                 ^
  137.           len = sizeof(ap->s_in.sin_addr);
  138.           addrptr = &ap->s_in.sin_addr;

crypto/bio/b_addr.c:137:9: 
  135.   
  136.       if (ap->sa.sa_family == AF_INET) {
  137. >         len = sizeof(ap->s_in.sin_addr);
  138.           addrptr = &ap->s_in.sin_addr;
  139.       }

crypto/bio/b_addr.c:138:9: 
  136.       if (ap->sa.sa_family == AF_INET) {
  137.           len = sizeof(ap->s_in.sin_addr);
  138. >         addrptr = &ap->s_in.sin_addr;
  139.       }
  140.   #ifdef AF_INET6

crypto/bio/b_addr.c:153:9: Taking false branch
  151.   #endif
  152.   
  153.       if (addrptr == NULL)
                 ^
  154.           return 0;
  155.   

crypto/bio/b_addr.c:156:9: Taking false branch
  154.           return 0;
  155.   
  156.       if (p != NULL) {
                 ^
  157.           memcpy(p, addrptr, len);
  158.       }

crypto/bio/b_addr.c:159:9: Taking true branch
  157.           memcpy(p, addrptr, len);
  158.       }
  159.       if (l != NULL)
                 ^
  160.           *l = len;
  161.   

crypto/bio/b_addr.c:160:9: 
  158.       }
  159.       if (l != NULL)
  160. >         *l = len;
  161.   
  162.       return 1;

crypto/bio/b_addr.c:162:5: 
  160.           *l = len;
  161.   
  162. >     return 1;
  163.   }
  164.   

crypto/bio/b_addr.c:163:1: return from a call to BIO_ADDR_rawaddress
  161.   
  162.       return 1;
  163. > }
  164.   
  165.   unsigned short BIO_ADDR_rawport(const BIO_ADDR *ap)

apps/s_cb.c:760:10: Taking false branch
758.   
759.       /* Create buffer with peer's address and port */
760.       if (!BIO_ADDR_rawaddress(peer, NULL, &length)) {
                ^
761.           BIO_printf(bio_err, "Failed getting peer address\n");
762.           return 0;

apps/s_cb.c:764:5: Condition is true
762.           return 0;
763.       }
764.       OPENSSL_assert(length != 0);
           ^
765.       port = BIO_ADDR_rawport(peer);
766.       length += sizeof(port);

apps/s_cb.c:765:5: 
763.       }
764.       OPENSSL_assert(length != 0);
765. >     port = BIO_ADDR_rawport(peer);
766.       length += sizeof(port);
767.       buffer = app_malloc(length, "cookie generate buffer");

crypto/bio/b_addr.c:165:1: start of procedure BIO_ADDR_rawport()
  163.   }
  164.   
  165. > unsigned short BIO_ADDR_rawport(const BIO_ADDR *ap)
  166.   {
  167.       if (ap->sa.sa_family == AF_INET)

crypto/bio/b_addr.c:167:9: Taking true branch
  165.   unsigned short BIO_ADDR_rawport(const BIO_ADDR *ap)
  166.   {
  167.       if (ap->sa.sa_family == AF_INET)
                 ^
  168.           return ap->s_in.sin_port;
  169.   #ifdef AF_INET6

crypto/bio/b_addr.c:168:9: 
  166.   {
  167.       if (ap->sa.sa_family == AF_INET)
  168. >         return ap->s_in.sin_port;
  169.   #ifdef AF_INET6
  170.       if (ap->sa.sa_family == AF_INET6)

crypto/bio/b_addr.c:174:1: return from a call to BIO_ADDR_rawport
  172.   #endif
  173.       return 0;
  174. > }
  175.   
  176.   /*-

apps/s_cb.c:766:5: 
764.       OPENSSL_assert(length != 0);
765.       port = BIO_ADDR_rawport(peer);
766. >     length += sizeof(port);
767.       buffer = app_malloc(length, "cookie generate buffer");
768.   

apps/s_cb.c:767:5: 
765.       port = BIO_ADDR_rawport(peer);
766.       length += sizeof(port);
767. >     buffer = app_malloc(length, "cookie generate buffer");
768.   
769.       memcpy(buffer, &port, sizeof(port));

test/testutil/apps_mem.c:14:1: start of procedure app_malloc()
  12.   /* shim that avoids sucking in too much from apps/apps.c */
  13.   
  14. > void* app_malloc(int sz, const char *what)
  15.   {
  16.       void *vp = OPENSSL_malloc(sz);

test/testutil/apps_mem.c:16:5: 
  14.   void* app_malloc(int sz, const char *what)
  15.   {
  16. >     void *vp = OPENSSL_malloc(sz);
  17.   
  18.       return vp;

crypto/mem.c:192:1: start of procedure CRYPTO_malloc()
    190.   #endif
    191.   
    192. > void *CRYPTO_malloc(size_t num, const char *file, int line)
    193.   {
    194.       void *ret = NULL;

crypto/mem.c:194:5: 
    192.   void *CRYPTO_malloc(size_t num, const char *file, int line)
    193.   {
    194. >     void *ret = NULL;
    195.   
    196.       INCREMENT(malloc_count);

crypto/mem.c:197:9: Taking true branch
    195.   
    196.       INCREMENT(malloc_count);
    197.       if (malloc_impl != NULL && malloc_impl != CRYPTO_malloc)
                   ^
    198.           return malloc_impl(num, file, line);
    199.   

crypto/mem.c:197:32: Taking false branch
    195.   
    196.       INCREMENT(malloc_count);
    197.       if (malloc_impl != NULL && malloc_impl != CRYPTO_malloc)
                                          ^
    198.           return malloc_impl(num, file, line);
    199.   

crypto/mem.c:200:9: Taking false branch
    198.           return malloc_impl(num, file, line);
    199.   
    200.       if (num == 0)
                   ^
    201.           return NULL;
    202.   

crypto/mem.c:204:9: Taking true branch
    202.   
    203.       FAILTEST();
    204.       if (allow_customize) {
                   ^
    205.           /*
    206.            * Disallow customization after the first allocation. We only set this

crypto/mem.c:210:9: 
    208.            * allocation.
    209.            */
    210. >         allow_customize = 0;
    211.       }
    212.   #if !defined(OPENSSL_NO_CRYPTO_MDEBUG) && !defined(FIPS_MODE)

crypto/mem.c:221:5: 
    219.       }
    220.   #else
    221. >     (void)(file); (void)(line);
    222.       ret = malloc(num);
    223.   #endif

crypto/mem.c:221:19: 
    219.       }
    220.   #else
    221. >     (void)(file); (void)(line);
    222.       ret = malloc(num);
    223.   #endif

crypto/mem.c:222:5: 
    220.   #else
    221.       (void)(file); (void)(line);
    222. >     ret = malloc(num);
    223.   #endif
    224.   

crypto/mem.c:225:5: 
    223.   #endif
    224.   
    225. >     return ret;
    226.   }
    227.   

crypto/mem.c:226:1: return from a call to CRYPTO_malloc
    224.   
    225.       return ret;
    226. > }
    227.   
    228.   void *CRYPTO_zalloc(size_t num, const char *file, int line)

test/testutil/apps_mem.c:18:5: 
  16.       void *vp = OPENSSL_malloc(sz);
  17.   
  18. >     return vp;
  19.   }

test/testutil/apps_mem.c:19:1: return from a call to app_malloc
  17.   
  18.       return vp;
  19. > }

apps/s_cb.c:769:5: 
767.       buffer = app_malloc(length, "cookie generate buffer");
768.   
769. >     memcpy(buffer, &port, sizeof(port));
770.       BIO_ADDR_rawaddress(peer, buffer + sizeof(port), NULL);
771.   
