apps/s_server.c:1741: error: NULL_DEREFERENCE
  pointer `con` last assigned on line 1737 could be null and is dereferenced by call to `SSL_callback_ctrl()` at line 1741, column 3.
Showing all 64 steps of the trace


apps/s_server.c:1706:1: start of procedure sv_body()
1704.   	}
1705.   
1706. > static int sv_body(char *hostname, int s, unsigned char *context)
1707.   	{
1708.   	char *buf=NULL;

apps/s_server.c:1708:2: 
1706.   static int sv_body(char *hostname, int s, unsigned char *context)
1707.   	{
1708. > 	char *buf=NULL;
1709.   	fd_set readfds;
1710.   	int ret=1,width;

apps/s_server.c:1710:2: 
1708.   	char *buf=NULL;
1709.   	fd_set readfds;
1710. > 	int ret=1,width;
1711.   	int k,i;
1712.   	unsigned long l;

apps/s_server.c:1713:2: 
1711.   	int k,i;
1712.   	unsigned long l;
1713. > 	SSL *con=NULL;
1714.   	BIO *sbio;
1715.   #if defined(OPENSSL_SYS_WINDOWS) || defined(OPENSSL_SYS_MSDOS) || defined(OPENSSL_SYS_NETWARE) || defined(OPENSSL_SYS_BEOS_R5)

apps/s_server.c:1719:6: 
1717.   #endif
1718.   
1719. > 	if ((buf=OPENSSL_malloc(bufsize)) == NULL)
1720.   		{
1721.   		BIO_printf(bio_err,"out of memory\n");

crypto/mem.c:294:1: start of procedure CRYPTO_malloc()
  292.   	}
  293.   
  294. > void *CRYPTO_malloc(int num, const char *file, int line)
  295.   	{
  296.   	void *ret = NULL;

crypto/mem.c:296:2: 
  294.   void *CRYPTO_malloc(int num, const char *file, int line)
  295.   	{
  296. > 	void *ret = NULL;
  297.   
  298.   	if (num <= 0) return NULL;

crypto/mem.c:298:6: Taking false branch
  296.   	void *ret = NULL;
  297.   
  298.   	if (num <= 0) return NULL;
              ^
  299.   
  300.   	allow_customize = 0;

crypto/mem.c:300:2: 
  298.   	if (num <= 0) return NULL;
  299.   
  300. > 	allow_customize = 0;
  301.   	if (malloc_debug_func != NULL)
  302.   		{

crypto/mem.c:301:6: Taking true branch
  299.   
  300.   	allow_customize = 0;
  301.   	if (malloc_debug_func != NULL)
              ^
  302.   		{
  303.   		allow_customize_debug = 0;

crypto/mem.c:303:3: 
  301.   	if (malloc_debug_func != NULL)
  302.   		{
  303. > 		allow_customize_debug = 0;
  304.   		malloc_debug_func(NULL, num, file, line, 0);
  305.   		}

crypto/mem.c:304:3: Skipping __function_pointer__(): unresolved function pointer
  302.   		{
  303.   		allow_customize_debug = 0;
  304.   		malloc_debug_func(NULL, num, file, line, 0);
           ^
  305.   		}
  306.   	ret = malloc_ex_func(num,file,line);

crypto/mem.c:306:2: Skipping __function_pointer__(): unresolved function pointer
  304.   		malloc_debug_func(NULL, num, file, line, 0);
  305.   		}
  306.   	ret = malloc_ex_func(num,file,line);
          ^
  307.   #ifdef LEVITTE_DEBUG_MEM
  308.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);

crypto/mem.c:310:6: Taking true branch
  308.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);
  309.   #endif
  310.   	if (malloc_debug_func != NULL)
              ^
  311.   		malloc_debug_func(ret, num, file, line, 1);
  312.   

crypto/mem.c:311:3: Skipping __function_pointer__(): unresolved function pointer
  309.   #endif
  310.   	if (malloc_debug_func != NULL)
  311.   		malloc_debug_func(ret, num, file, line, 1);
           ^
  312.   
  313.   #ifndef OPENSSL_CPUID_OBJ

crypto/mem.c:317:12: Taking true branch
  315.            * sanitisation function can't be optimised out. NB: We only do
  316.            * this for >2Kb so the overhead doesn't bother us. */
  317.           if(ret && (num > 2048))
                    ^
  318.   	{	extern unsigned char cleanse_ctr;
  319.                   ((unsigned char *)ret)[0] = cleanse_ctr;

crypto/mem.c:317:20: Taking false branch
  315.            * sanitisation function can't be optimised out. NB: We only do
  316.            * this for >2Kb so the overhead doesn't bother us. */
  317.           if(ret && (num > 2048))
                            ^
  318.   	{	extern unsigned char cleanse_ctr;
  319.                   ((unsigned char *)ret)[0] = cleanse_ctr;

crypto/mem.c:323:2: 
  321.   #endif
  322.   
  323. > 	return ret;
  324.   	}
  325.   

crypto/mem.c:324:2: return from a call to CRYPTO_malloc
  322.   
  323.   	return ret;
  324.   	}
          ^
  325.   
  326.   void *CRYPTO_realloc(void *str, int num, const char *file, int line)

apps/s_server.c:1719:6: Taking false branch
1717.   #endif
1718.   
1719.   	if ((buf=OPENSSL_malloc(bufsize)) == NULL)
             ^
1720.   		{
1721.   		BIO_printf(bio_err,"out of memory\n");

apps/s_server.c:1725:6: Taking false branch
1723.   		}
1724.   #ifdef FIONBIO	
1725.   	if (s_nbio)
             ^
1726.   		{
1727.   		unsigned long sl=1;

apps/s_server.c:1736:6: Taking true branch
1734.   #endif
1735.   
1736.   	if (con == NULL) {
             ^
1737.   		con=SSL_new(ctx);
1738.   #ifndef OPENSSL_NO_TLSEXT

apps/s_server.c:1737:3: 
1735.   
1736.   	if (con == NULL) {
1737. > 		con=SSL_new(ctx);
1738.   #ifndef OPENSSL_NO_TLSEXT
1739.   	if (s_tlsextdebug)

ssl/ssl_lib.c:271:1: start of procedure SSL_new()
  269.   	}
  270.   
  271. > SSL *SSL_new(SSL_CTX *ctx)
  272.   	{
  273.   	SSL *s;

ssl/ssl_lib.c:275:6: Taking false branch
  273.   	SSL *s;
  274.   
  275.   	if (ctx == NULL)
              ^
  276.   		{
  277.   		SSLerr(SSL_F_SSL_NEW,SSL_R_NULL_SSL_CTX);

ssl/ssl_lib.c:280:6: Taking false branch
  278.   		return(NULL);
  279.   		}
  280.   	if (ctx->method == NULL)
              ^
  281.   		{
  282.   		SSLerr(SSL_F_SSL_NEW,SSL_R_SSL_CTX_HAS_NO_DEFAULT_SSL_VERSION);

ssl/ssl_lib.c:286:2: 
  284.   		}
  285.   
  286. > 	s=(SSL *)OPENSSL_malloc(sizeof(SSL));
  287.   	if (s == NULL) goto err;
  288.   	memset(s,0,sizeof(SSL));

crypto/mem.c:294:1: start of procedure CRYPTO_malloc()
    292.   	}
    293.   
    294. > void *CRYPTO_malloc(int num, const char *file, int line)
    295.   	{
    296.   	void *ret = NULL;

crypto/mem.c:296:2: 
    294.   void *CRYPTO_malloc(int num, const char *file, int line)
    295.   	{
    296. > 	void *ret = NULL;
    297.   
    298.   	if (num <= 0) return NULL;

crypto/mem.c:298:6: Taking false branch
    296.   	void *ret = NULL;
    297.   
    298.   	if (num <= 0) return NULL;
                ^
    299.   
    300.   	allow_customize = 0;

crypto/mem.c:300:2: 
    298.   	if (num <= 0) return NULL;
    299.   
    300. > 	allow_customize = 0;
    301.   	if (malloc_debug_func != NULL)
    302.   		{

crypto/mem.c:301:6: Taking true branch
    299.   
    300.   	allow_customize = 0;
    301.   	if (malloc_debug_func != NULL)
                ^
    302.   		{
    303.   		allow_customize_debug = 0;

crypto/mem.c:303:3: 
    301.   	if (malloc_debug_func != NULL)
    302.   		{
    303. > 		allow_customize_debug = 0;
    304.   		malloc_debug_func(NULL, num, file, line, 0);
    305.   		}

crypto/mem.c:304:3: Skipping __function_pointer__(): unresolved function pointer
    302.   		{
    303.   		allow_customize_debug = 0;
    304.   		malloc_debug_func(NULL, num, file, line, 0);
             ^
    305.   		}
    306.   	ret = malloc_ex_func(num,file,line);

crypto/mem.c:306:2: Skipping __function_pointer__(): unresolved function pointer
    304.   		malloc_debug_func(NULL, num, file, line, 0);
    305.   		}
    306.   	ret = malloc_ex_func(num,file,line);
            ^
    307.   #ifdef LEVITTE_DEBUG_MEM
    308.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);

crypto/mem.c:310:6: Taking true branch
    308.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);
    309.   #endif
    310.   	if (malloc_debug_func != NULL)
                ^
    311.   		malloc_debug_func(ret, num, file, line, 1);
    312.   

crypto/mem.c:311:3: Skipping __function_pointer__(): unresolved function pointer
    309.   #endif
    310.   	if (malloc_debug_func != NULL)
    311.   		malloc_debug_func(ret, num, file, line, 1);
             ^
    312.   
    313.   #ifndef OPENSSL_CPUID_OBJ

crypto/mem.c:317:12: Taking false branch
    315.            * sanitisation function can't be optimised out. NB: We only do
    316.            * this for >2Kb so the overhead doesn't bother us. */
    317.           if(ret && (num > 2048))
                      ^
    318.   	{	extern unsigned char cleanse_ctr;
    319.                   ((unsigned char *)ret)[0] = cleanse_ctr;

crypto/mem.c:323:2: 
    321.   #endif
    322.   
    323. > 	return ret;
    324.   	}
    325.   

crypto/mem.c:324:2: return from a call to CRYPTO_malloc
    322.   
    323.   	return ret;
    324.   	}
            ^
    325.   
    326.   void *CRYPTO_realloc(void *str, int num, const char *file, int line)

ssl/ssl_lib.c:287:6: Taking true branch
  285.   
  286.   	s=(SSL *)OPENSSL_malloc(sizeof(SSL));
  287.   	if (s == NULL) goto err;
              ^
  288.   	memset(s,0,sizeof(SSL));
  289.   

ssl/ssl_lib.c:377:1: 
  375.   
  376.   	return(s);
  377. > err:
  378.   	if (s != NULL)
  379.   		{

ssl/ssl_lib.c:378:6: Taking false branch
  376.   	return(s);
  377.   err:
  378.   	if (s != NULL)
              ^
  379.   		{
  380.   		if (s->cert != NULL)

ssl/ssl_lib.c:386:2: 
  384.   		OPENSSL_free(s);
  385.   		}
  386. > 	SSLerr(SSL_F_SSL_NEW,ERR_R_MALLOC_FAILURE);
  387.   	return(NULL);
  388.   	}

crypto/err/err.c:706:1: start of procedure ERR_put_error()
    704.   /********************************************************/
    705.   
    706. > void ERR_put_error(int lib, int func, int reason, const char *file,
    707.   	     int line)
    708.   	{

crypto/err/err.c:730:2: Skipping ERR_get_state(): empty list of specs
    728.   	}
    729.   #endif
    730.   	es=ERR_get_state();
            ^
    731.   
    732.   	es->top=(es->top+1)%ERR_NUM_ERRORS;

crypto/err/err.c:732:2: 
    730.   	es=ERR_get_state();
    731.   
    732. > 	es->top=(es->top+1)%ERR_NUM_ERRORS;
    733.   	if (es->top == es->bottom)
    734.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;

crypto/err/err.c:733:6: Taking false branch
    731.   
    732.   	es->top=(es->top+1)%ERR_NUM_ERRORS;
    733.   	if (es->top == es->bottom)
                ^
    734.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
    735.   	es->err_flags[es->top]=0;

crypto/err/err.c:735:2: 
    733.   	if (es->top == es->bottom)
    734.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
    735. > 	es->err_flags[es->top]=0;
    736.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
    737.   	es->err_file[es->top]=file;

crypto/err/err.c:736:2: 
    734.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
    735.   	es->err_flags[es->top]=0;
    736. > 	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
    737.   	es->err_file[es->top]=file;
    738.   	es->err_line[es->top]=line;

crypto/err/err.c:737:2: 
    735.   	es->err_flags[es->top]=0;
    736.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
    737. > 	es->err_file[es->top]=file;
    738.   	es->err_line[es->top]=line;
    739.   	err_clear_data(es,es->top);

crypto/err/err.c:738:2: 
    736.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
    737.   	es->err_file[es->top]=file;
    738. > 	es->err_line[es->top]=line;
    739.   	err_clear_data(es,es->top);
    740.   	}

crypto/err/err.c:739:2: Taking true branch
    737.   	es->err_file[es->top]=file;
    738.   	es->err_line[es->top]=line;
    739.   	err_clear_data(es,es->top);
            ^
    740.   	}
    741.   

crypto/err/err.c:739:2: Taking false branch
    737.   	es->err_file[es->top]=file;
    738.   	es->err_line[es->top]=line;
    739.   	err_clear_data(es,es->top);
            ^
    740.   	}
    741.   

crypto/err/err.c:739:2: Loop condition is false. Leaving loop
    737.   	es->err_file[es->top]=file;
    738.   	es->err_line[es->top]=line;
    739.   	err_clear_data(es,es->top);
            ^
    740.   	}
    741.   

crypto/err/err.c:740:2: return from a call to ERR_put_error
    738.   	es->err_line[es->top]=line;
    739.   	err_clear_data(es,es->top);
    740.   	}
            ^
    741.   
    742.   void ERR_clear_error(void)

ssl/ssl_lib.c:387:2: 
  385.   		}
  386.   	SSLerr(SSL_F_SSL_NEW,ERR_R_MALLOC_FAILURE);
  387. > 	return(NULL);
  388.   	}
  389.   

ssl/ssl_lib.c:388:2: return from a call to SSL_new
  386.   	SSLerr(SSL_F_SSL_NEW,ERR_R_MALLOC_FAILURE);
  387.   	return(NULL);
  388.   	}
          ^
  389.   
  390.   int SSL_CTX_set_session_id_context(SSL_CTX *ctx,const unsigned char *sid_ctx,

apps/s_server.c:1739:6: Taking true branch
1737.   		con=SSL_new(ctx);
1738.   #ifndef OPENSSL_NO_TLSEXT
1739.   	if (s_tlsextdebug)
             ^
1740.   		{
1741.   		SSL_set_tlsext_debug_callback(con, tlsext_cb);

apps/s_server.c:1741:3: 
1739.   	if (s_tlsextdebug)
1740.   		{
1741. > 		SSL_set_tlsext_debug_callback(con, tlsext_cb);
1742.   		SSL_set_tlsext_debug_arg(con, bio_s_out);
1743.   		}

ssl/ssl_lib.c:1055:1: start of procedure SSL_callback_ctrl()
  1053.   	}
  1054.   
  1055. > long SSL_callback_ctrl(SSL *s, int cmd, void (*fp)(void))
  1056.   	{
  1057.   	switch(cmd)

ssl/ssl_lib.c:1057:2: 
  1055.   long SSL_callback_ctrl(SSL *s, int cmd, void (*fp)(void))
  1056.   	{
  1057. > 	switch(cmd)
  1058.   		{
  1059.   	case SSL_CTRL_SET_MSG_CALLBACK:

ssl/ssl_lib.c:1059:2: Switch condition is false. Skipping switch case
  1057.   	switch(cmd)
  1058.   		{
  1059.   	case SSL_CTRL_SET_MSG_CALLBACK:
           ^
  1060.   		s->msg_callback = (void (*)(int write_p, int version, int content_type, const void *buf, size_t len, SSL *ssl, void *arg))(fp);
  1061.   		return 1;

ssl/ssl_lib.c:1064:3: Skipping __function_pointer__(): unresolved function pointer
  1062.   		
  1063.   	default:
  1064.   		return(s->method->ssl_callback_ctrl(s,cmd,fp));
            ^
  1065.   		}
  1066.   	}
