ssl/d1_srtp.c:355: error: NULL_DEREFERENCE
  pointer `clnt` last assigned on line 345 could be null and is dereferenced by call to `sk_push()` at line 355, column 4.
Showing all 37 steps of the trace


ssl/d1_srtp.c:306:1: start of procedure ssl_parse_clienthello_use_srtp_ext()
304.   
305.   
306. > int ssl_parse_clienthello_use_srtp_ext(SSL *s, unsigned char *d, int len,int *al)
307.   	{
308.   	SRTP_PROTECTION_PROFILE *cprof,*sprof;

ssl/d1_srtp.c:309:2: 
307.   	{
308.   	SRTP_PROTECTION_PROFILE *cprof,*sprof;
309. > 	STACK_OF(SRTP_PROTECTION_PROFILE) *clnt=0,*srvr;
310.           int ct;
311.           int mki_len;

ssl/d1_srtp.c:317:12: Taking false branch
315.   
316.            /* Length value + the MKI length */
317.           if(len < 3)
                  ^
318.   		{            
319.   		SSLerr(SSL_F_SSL_PARSE_CLIENTHELLO_USE_SRTP_EXT,SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST);

ssl/d1_srtp.c:325:9: 
323.   
324.           /* Pull off the length of the cipher suite list */
325. >         n2s(d, ct);
326.           len -= 2;
327.           

ssl/d1_srtp.c:326:9: 
324.           /* Pull off the length of the cipher suite list */
325.           n2s(d, ct);
326. >         len -= 2;
327.           
328.           /* Check that it is even */

ssl/d1_srtp.c:329:5: Taking false branch
327.           
328.           /* Check that it is even */
329.   	if(ct%2)
           ^
330.   		{
331.   		SSLerr(SSL_F_SSL_PARSE_CLIENTHELLO_USE_SRTP_EXT,SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST);

ssl/d1_srtp.c:337:5: Taking false branch
335.           
336.           /* Check that lengths are consistent */
337.   	if(len < (ct + 1)) 
           ^
338.   		{
339.   		SSLerr(SSL_F_SSL_PARSE_CLIENTHELLO_USE_SRTP_EXT,SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST);

ssl/d1_srtp.c:345:2: 
343.   
344.           
345. > 	clnt=sk_SRTP_PROTECTION_PROFILE_new_null();
346.   
347.   	while(ct)

crypto/stack/stack.c:115:1: start of procedure sk_new_null()
  113.   	}
  114.   
  115. > _STACK *sk_new_null(void)
  116.   	{
  117.   	return sk_new((int (*)(const void *, const void *))0);

crypto/stack/stack.c:117:2: 
  115.   _STACK *sk_new_null(void)
  116.   	{
  117. > 	return sk_new((int (*)(const void *, const void *))0);
  118.   	}
  119.   

crypto/stack/stack.c:120:1: start of procedure sk_new()
    118.   	}
    119.   
    120. > _STACK *sk_new(int (*c)(const void *, const void *))
    121.   	{
    122.   	_STACK *ret;

crypto/stack/stack.c:125:6: 
    123.   	int i;
    124.   
    125. > 	if ((ret=OPENSSL_malloc(sizeof(_STACK))) == NULL)
    126.   		goto err;
    127.   	if ((ret->data=OPENSSL_malloc(sizeof(char *)*MIN_NODES)) == NULL)

crypto/mem.c:296:1: start of procedure CRYPTO_malloc()
      294.   	}
      295.   
      296. > void *CRYPTO_malloc(int num, const char *file, int line)
      297.   	{
      298.   	void *ret = NULL;

crypto/mem.c:298:2: 
      296.   void *CRYPTO_malloc(int num, const char *file, int line)
      297.   	{
      298. > 	void *ret = NULL;
      299.   
      300.   	if (num <= 0) return NULL;

crypto/mem.c:300:6: Taking false branch
      298.   	void *ret = NULL;
      299.   
      300.   	if (num <= 0) return NULL;
                  ^
      301.   
      302.   	allow_customize = 0;

crypto/mem.c:302:2: 
      300.   	if (num <= 0) return NULL;
      301.   
      302. > 	allow_customize = 0;
      303.   	if (malloc_debug_func != NULL)
      304.   		{

crypto/mem.c:303:6: Taking false branch
      301.   
      302.   	allow_customize = 0;
      303.   	if (malloc_debug_func != NULL)
                  ^
      304.   		{
      305.   		allow_customize_debug = 0;

crypto/mem.c:308:2: Skipping __function_pointer__(): unresolved function pointer
      306.   		malloc_debug_func(NULL, num, file, line, 0);
      307.   		}
      308.   	ret = malloc_ex_func(num,file,line);
              ^
      309.   #ifdef LEVITTE_DEBUG_MEM
      310.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);

crypto/mem.c:312:6: Taking false branch
      310.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);
      311.   #endif
      312.   	if (malloc_debug_func != NULL)
                  ^
      313.   		malloc_debug_func(ret, num, file, line, 1);
      314.   

crypto/mem.c:319:12: Taking false branch
      317.            * sanitisation function can't be optimised out. NB: We only do
      318.            * this for >2Kb so the overhead doesn't bother us. */
      319.           if(ret && (num > 2048))
                        ^
      320.   	{	extern unsigned char cleanse_ctr;
      321.                   ((unsigned char *)ret)[0] = cleanse_ctr;

crypto/mem.c:325:2: 
      323.   #endif
      324.   
      325. > 	return ret;
      326.   	}
      327.   char *CRYPTO_strdup(const char *str, const char *file, int line)

crypto/mem.c:326:2: return from a call to CRYPTO_malloc
      324.   
      325.   	return ret;
      326.   	}
              ^
      327.   char *CRYPTO_strdup(const char *str, const char *file, int line)
      328.   	{

crypto/stack/stack.c:125:6: Taking true branch
    123.   	int i;
    124.   
    125.   	if ((ret=OPENSSL_malloc(sizeof(_STACK))) == NULL)
                ^
    126.   		goto err;
    127.   	if ((ret->data=OPENSSL_malloc(sizeof(char *)*MIN_NODES)) == NULL)

crypto/stack/stack.c:136:1: 
    134.   	ret->sorted=0;
    135.   	return(ret);
    136. > err:
    137.   	if(ret)
    138.   		OPENSSL_free(ret);

crypto/stack/stack.c:137:5: Taking false branch
    135.   	return(ret);
    136.   err:
    137.   	if(ret)
               ^
    138.   		OPENSSL_free(ret);
    139.   	return(NULL);

crypto/stack/stack.c:139:2: 
    137.   	if(ret)
    138.   		OPENSSL_free(ret);
    139. > 	return(NULL);
    140.   	}
    141.   

crypto/stack/stack.c:140:2: return from a call to sk_new
    138.   		OPENSSL_free(ret);
    139.   	return(NULL);
    140.   	}
            ^
    141.   
    142.   int sk_insert(_STACK *st, void *data, int loc)

crypto/stack/stack.c:118:2: return from a call to sk_new_null
  116.   	{
  117.   	return sk_new((int (*)(const void *, const void *))0);
  118.   	}
          ^
  119.   
  120.   _STACK *sk_new(int (*c)(const void *, const void *))

ssl/d1_srtp.c:347:8: Loop condition is true. Entering loop body
345.   	clnt=sk_SRTP_PROTECTION_PROFILE_new_null();
346.   
347.   	while(ct)
              ^
348.   		{
349.   		n2s(d,id);

ssl/d1_srtp.c:349:3: 
347.   	while(ct)
348.   		{
349. > 		n2s(d,id);
350.   		ct-=2;
351.                   len-=2;

ssl/d1_srtp.c:350:3: 
348.   		{
349.   		n2s(d,id);
350. > 		ct-=2;
351.                   len-=2;
352.   

ssl/d1_srtp.c:351:17: 
349.   		n2s(d,id);
350.   		ct-=2;
351. >                 len-=2;
352.   
353.   		if(!find_profile_by_num(id,&cprof))

ssl/d1_srtp.c:353:7: Taking true branch
351.                   len-=2;
352.   
353.   		if(!find_profile_by_num(id,&cprof))
             ^
354.   			{
355.   			sk_SRTP_PROTECTION_PROFILE_push(clnt,cprof);

ssl/d1_srtp.c:355:4: Condition is true
353.   		if(!find_profile_by_num(id,&cprof))
354.   			{
355.   			sk_SRTP_PROTECTION_PROFILE_push(clnt,cprof);
          ^
356.   			}
357.   		else

ssl/d1_srtp.c:355:4: Condition is true
353.   		if(!find_profile_by_num(id,&cprof))
354.   			{
355.   			sk_SRTP_PROTECTION_PROFILE_push(clnt,cprof);
          ^
356.   			}
357.   		else

crypto/stack/stack.c:244:1: start of procedure sk_push()
  242.   	}
  243.   
  244. > int sk_push(_STACK *st, void *data)
  245.   	{
  246.   	return(sk_insert(st,data,st->num));

crypto/stack/stack.c:246:2: Skipping sk_insert(): empty list of specs
  244.   int sk_push(_STACK *st, void *data)
  245.   	{
  246.   	return(sk_insert(st,data,st->num));
          ^
  247.   	}
  248.   
