ssl/statem/statem_dtls.c:1107: error: NULL_DEREFERENCE
  pointer `frag->fragment` last assigned on line 1103 could be null and is dereferenced by call to `memcpy()` at line 1107, column 5.
Showing all 26 steps of the trace


ssl/statem/statem_dtls.c:1091:1: start of procedure dtls1_buffer_message()
1089.   }
1090.   
1091. > int dtls1_buffer_message(SSL *s, int is_ccs)
1092.   {
1093.       pitem *item;

ssl/statem/statem_dtls.c:1101:5: Condition is true
1099.        * serialized
1100.        */
1101.       OPENSSL_assert(s->init_off == 0);
            ^
1102.   
1103.       frag = dtls1_hm_fragment_new(s->init_num, 0);

ssl/statem/statem_dtls.c:1103:5: 
1101.       OPENSSL_assert(s->init_off == 0);
1102.   
1103. >     frag = dtls1_hm_fragment_new(s->init_num, 0);
1104.       if (frag == NULL)
1105.           return 0;

ssl/statem/statem_dtls.c:162:1: start of procedure dtls1_hm_fragment_new()
  160.   static int dtls_get_reassembled_message(SSL *s, long *len);
  161.   
  162. > static hm_fragment *dtls1_hm_fragment_new(unsigned long frag_len,
  163.                                             int reassembly)
  164.   {

ssl/statem/statem_dtls.c:165:5: 
  163.                                             int reassembly)
  164.   {
  165. >     hm_fragment *frag = NULL;
  166.       unsigned char *buf = NULL;
  167.       unsigned char *bitmask = NULL;

ssl/statem/statem_dtls.c:166:5: 
  164.   {
  165.       hm_fragment *frag = NULL;
  166. >     unsigned char *buf = NULL;
  167.       unsigned char *bitmask = NULL;
  168.   

ssl/statem/statem_dtls.c:167:5: 
  165.       hm_fragment *frag = NULL;
  166.       unsigned char *buf = NULL;
  167. >     unsigned char *bitmask = NULL;
  168.   
  169.       frag = OPENSSL_malloc(sizeof(*frag));

ssl/statem/statem_dtls.c:169:5: 
  167.       unsigned char *bitmask = NULL;
  168.   
  169. >     frag = OPENSSL_malloc(sizeof(*frag));
  170.       if (frag == NULL)
  171.           return NULL;

crypto/mem.c:119:1: start of procedure CRYPTO_malloc()
    117.   }
    118.   
    119. > void *CRYPTO_malloc(size_t num, const char *file, int line)
    120.   {
    121.       void *ret = NULL;

crypto/mem.c:121:5: 
    119.   void *CRYPTO_malloc(size_t num, const char *file, int line)
    120.   {
    121. >     void *ret = NULL;
    122.   
    123.       if (num <= 0)

crypto/mem.c:123:9: Taking false branch
    121.       void *ret = NULL;
    122.   
    123.       if (num <= 0)
                   ^
    124.           return NULL;
    125.   

crypto/mem.c:126:5: 
    124.           return NULL;
    125.   
    126. >     allow_customize = 0;
    127.   #ifndef OPENSSL_NO_CRYPTO_MDEBUG
    128.       if (call_malloc_debug) {

crypto/mem.c:136:5: 
    134.       }
    135.   #else
    136. >     (void)file;
    137.       (void)line;
    138.       ret = malloc(num);

crypto/mem.c:137:5: 
    135.   #else
    136.       (void)file;
    137. >     (void)line;
    138.       ret = malloc(num);
    139.   #endif

crypto/mem.c:138:5: 
    136.       (void)file;
    137.       (void)line;
    138. >     ret = malloc(num);
    139.   #endif
    140.   

crypto/mem.c:153:5: 
    151.   #endif
    152.   
    153. >     return ret;
    154.   }
    155.   

crypto/mem.c:154:1: return from a call to CRYPTO_malloc
    152.   
    153.       return ret;
    154. > }
    155.   
    156.   void *CRYPTO_zalloc(size_t num, const char *file, int line)

ssl/statem/statem_dtls.c:170:9: Taking false branch
  168.   
  169.       frag = OPENSSL_malloc(sizeof(*frag));
  170.       if (frag == NULL)
                 ^
  171.           return NULL;
  172.   

ssl/statem/statem_dtls.c:173:9: Taking false branch
  171.           return NULL;
  172.   
  173.       if (frag_len) {
                 ^
  174.           buf = OPENSSL_malloc(frag_len);
  175.           if (buf == NULL) {

ssl/statem/statem_dtls.c:182:5: 
  180.   
  181.       /* zero length fragment gets zero frag->fragment */
  182. >     frag->fragment = buf;
  183.   
  184.       /* Initialize reassembly bitmask if necessary */

ssl/statem/statem_dtls.c:185:9: Taking false branch
  183.   
  184.       /* Initialize reassembly bitmask if necessary */
  185.       if (reassembly) {
                 ^
  186.           bitmask = OPENSSL_zalloc(RSMBLY_BITMASK_SIZE(frag_len));
  187.           if (bitmask == NULL) {

ssl/statem/statem_dtls.c:194:5: 
  192.       }
  193.   
  194. >     frag->reassembly = bitmask;
  195.   
  196.       return frag;

ssl/statem/statem_dtls.c:196:5: 
  194.       frag->reassembly = bitmask;
  195.   
  196. >     return frag;
  197.   }
  198.   

ssl/statem/statem_dtls.c:197:1: return from a call to dtls1_hm_fragment_new
  195.   
  196.       return frag;
  197. > }
  198.   
  199.   void dtls1_hm_fragment_free(hm_fragment *frag)

ssl/statem/statem_dtls.c:1104:9: Taking false branch
1102.   
1103.       frag = dtls1_hm_fragment_new(s->init_num, 0);
1104.       if (frag == NULL)
                ^
1105.           return 0;
1106.   

ssl/statem/statem_dtls.c:1107:5: 
1105.           return 0;
1106.   
1107. >     memcpy(frag->fragment, s->init_buf->data, s->init_num);
1108.   
1109.       if (is_ccs) {
