ssl/d1_both.c:974: error: NULL_DEREFERENCE
  pointer `frag` last assigned on line 972 could be null and is dereferenced at line 974, column 9.
Showing all 22 steps of the trace


ssl/d1_both.c:960:1: start of procedure dtls1_buffer_message()
958.   	}
959.   
960. > int
961.   dtls1_buffer_message(SSL *s, int is_ccs)
962.   	{

ssl/d1_both.c:966:2: 
964.   	hm_fragment *frag;
965.   	unsigned char seq64be[8];
966. > 	unsigned int epoch = s->d1->w_epoch;
967.   
968.   	/* this function is called immediately after a message has 

ssl/d1_both.c:970:2: Condition is true
968.   	/* this function is called immediately after a message has 
969.   	 * been serialized */
970.   	OPENSSL_assert(s->init_off == 0);
        ^
971.   
972.   	frag = dtls1_hm_fragment_new(s->init_num);

ssl/d1_both.c:972:2: 
970.   	OPENSSL_assert(s->init_off == 0);
971.   
972. > 	frag = dtls1_hm_fragment_new(s->init_num);
973.   
974.   	memcpy(frag->fragment, s->init_buf->data, s->init_num);

ssl/d1_both.c:143:1: start of procedure dtls1_hm_fragment_new()
  141.   	long max, int *ok);
  142.   
  143. > static hm_fragment *
  144.   dtls1_hm_fragment_new(unsigned long frag_len)
  145.   	{

ssl/d1_both.c:146:2: 
  144.   dtls1_hm_fragment_new(unsigned long frag_len)
  145.   	{
  146. > 	hm_fragment *frag = NULL;
  147.   	unsigned char *buf = NULL;
  148.   

ssl/d1_both.c:147:2: 
  145.   	{
  146.   	hm_fragment *frag = NULL;
  147. > 	unsigned char *buf = NULL;
  148.   
  149.   	frag = (hm_fragment *)OPENSSL_malloc(sizeof(hm_fragment));

ssl/d1_both.c:149:2: 
  147.   	unsigned char *buf = NULL;
  148.   
  149. > 	frag = (hm_fragment *)OPENSSL_malloc(sizeof(hm_fragment));
  150.   	if ( frag == NULL)
  151.   		return NULL;

crypto/mem.c:294:1: start of procedure CRYPTO_malloc()
    292.   	}
    293.   
    294. > void *CRYPTO_malloc(size_t num, const char *file, int line)
    295.   	{
    296.   	void *ret = NULL;

crypto/mem.c:296:2: 
    294.   void *CRYPTO_malloc(size_t num, const char *file, int line)
    295.   	{
    296. > 	void *ret = NULL;
    297.   
    298.   	if (num <= 0) return NULL;

crypto/mem.c:298:6: Taking false branch
    296.   	void *ret = NULL;
    297.   
    298.   	if (num <= 0) return NULL;
                ^
    299.   
    300.   	allow_customize = 0;

crypto/mem.c:300:2: 
    298.   	if (num <= 0) return NULL;
    299.   
    300. > 	allow_customize = 0;
    301.   	if (malloc_debug_func != NULL)
    302.   		{

crypto/mem.c:301:6: Taking false branch
    299.   
    300.   	allow_customize = 0;
    301.   	if (malloc_debug_func != NULL)
                ^
    302.   		{
    303.   		allow_customize_debug = 0;

crypto/mem.c:306:2: Skipping __function_pointer__(): unresolved function pointer
    304.   		malloc_debug_func(NULL, num, file, line, 0);
    305.   		}
    306.   	ret = malloc_ex_func(num,file,line);
            ^
    307.   #ifdef LEVITTE_DEBUG_MEM
    308.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);

crypto/mem.c:310:6: Taking false branch
    308.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);
    309.   #endif
    310.   	if (malloc_debug_func != NULL)
                ^
    311.   		malloc_debug_func(ret, num, file, line, 1);
    312.   

crypto/mem.c:317:12: Taking false branch
    315.            * sanitisation function can't be optimised out. NB: We only do
    316.            * this for >2Kb so the overhead doesn't bother us. */
    317.           if(ret && (num > 2048))
                      ^
    318.   	{	extern unsigned char cleanse_ctr;
    319.                   ((unsigned char *)ret)[0] = cleanse_ctr;

crypto/mem.c:323:2: 
    321.   #endif
    322.   
    323. > 	return ret;
    324.   	}
    325.   char *CRYPTO_strdup(const char *str, const char *file, int line)

crypto/mem.c:324:2: return from a call to CRYPTO_malloc
    322.   
    323.   	return ret;
    324.   	}
            ^
    325.   char *CRYPTO_strdup(const char *str, const char *file, int line)
    326.   	{

ssl/d1_both.c:150:7: Taking true branch
  148.   
  149.   	frag = (hm_fragment *)OPENSSL_malloc(sizeof(hm_fragment));
  150.   	if ( frag == NULL)
               ^
  151.   		return NULL;
  152.   

ssl/d1_both.c:151:3: 
  149.   	frag = (hm_fragment *)OPENSSL_malloc(sizeof(hm_fragment));
  150.   	if ( frag == NULL)
  151. > 		return NULL;
  152.   
  153.   	if (frag_len)

ssl/d1_both.c:167:2: return from a call to dtls1_hm_fragment_new
  165.   
  166.   	return frag;
  167.   	}
          ^
  168.   
  169.   static void

ssl/d1_both.c:974:2: 
972.   	frag = dtls1_hm_fragment_new(s->init_num);
973.   
974. > 	memcpy(frag->fragment, s->init_buf->data, s->init_num);
975.   
976.   	if ( is_ccs)
