ssl/ssl_lib.c:1240: error: NULL_DEREFERENCE
  pointer `sk` last assigned on line 1227 could be null and is dereferenced by call to `sk_push()` at line 1240, column 9.
Showing all 34 steps of the trace


ssl/ssl_lib.c:1213:1: start of procedure ssl_bytes_to_cipher_list()
1211.   	}
1212.   
1213. > STACK_OF(SSL_CIPHER) *ssl_bytes_to_cipher_list(SSL *s,unsigned char *p,int num,
1214.   					       STACK_OF(SSL_CIPHER) **skp)
1215.   	{

ssl/ssl_lib.c:1220:2: Skipping __function_pointer__(): unresolved function pointer
1218.   	int i,n;
1219.   
1220.   	n=ssl_put_cipher_by_char(s,NULL,NULL);
         ^
1221.   	if ((num%n) != 0)
1222.   		{

ssl/ssl_lib.c:1221:6: Taking false branch
1219.   
1220.   	n=ssl_put_cipher_by_char(s,NULL,NULL);
1221.   	if ((num%n) != 0)
             ^
1222.   		{
1223.   		SSLerr(SSL_F_SSL_BYTES_TO_CIPHER_LIST,SSL_R_ERROR_IN_RECEIVED_CIPHER_LIST);

ssl/ssl_lib.c:1226:7: Taking false branch
1224.   		return(NULL);
1225.   		}
1226.   	if ((skp == NULL) || (*skp == NULL))
              ^
1227.   		sk=sk_SSL_CIPHER_new_null(); /* change perhaps later */
1228.   	else

ssl/ssl_lib.c:1226:24: Taking true branch
1224.   		return(NULL);
1225.   		}
1226.   	if ((skp == NULL) || (*skp == NULL))
                               ^
1227.   		sk=sk_SSL_CIPHER_new_null(); /* change perhaps later */
1228.   	else

ssl/ssl_lib.c:1227:3: 
1225.   		}
1226.   	if ((skp == NULL) || (*skp == NULL))
1227. > 		sk=sk_SSL_CIPHER_new_null(); /* change perhaps later */
1228.   	else
1229.   		{

crypto/stack/stack.c:115:1: start of procedure sk_new_null()
  113.   	}
  114.   
  115. > STACK *sk_new_null(void)
  116.   	{
  117.   	return sk_new((int (*)(const char * const *, const char * const *))0);

crypto/stack/stack.c:117:2: 
  115.   STACK *sk_new_null(void)
  116.   	{
  117. > 	return sk_new((int (*)(const char * const *, const char * const *))0);
  118.   	}
  119.   

crypto/stack/stack.c:120:1: start of procedure sk_new()
    118.   	}
    119.   
    120. > STACK *sk_new(int (*c)(const char * const *, const char * const *))
    121.   	{
    122.   	STACK *ret;

crypto/stack/stack.c:125:6: 
    123.   	int i;
    124.   
    125. > 	if ((ret=(STACK *)OPENSSL_malloc(sizeof(STACK))) == NULL)
    126.   		goto err;
    127.   	if ((ret->data=(char **)OPENSSL_malloc(sizeof(char *)*MIN_NODES)) == NULL)

crypto/mem.c:291:1: start of procedure CRYPTO_malloc()
      289.   	}
      290.   
      291. > void *CRYPTO_malloc(int num, const char *file, int line)
      292.   	{
      293.   	void *ret = NULL;

crypto/mem.c:293:2: 
      291.   void *CRYPTO_malloc(int num, const char *file, int line)
      292.   	{
      293. > 	void *ret = NULL;
      294.   	extern unsigned char cleanse_ctr;
      295.   

crypto/mem.c:296:6: Taking false branch
      294.   	extern unsigned char cleanse_ctr;
      295.   
      296.   	if (num <= 0) return NULL;
                  ^
      297.   
      298.   	allow_customize = 0;

crypto/mem.c:298:2: 
      296.   	if (num <= 0) return NULL;
      297.   
      298. > 	allow_customize = 0;
      299.   	if (malloc_debug_func != NULL)
      300.   		{

crypto/mem.c:299:6: Taking false branch
      297.   
      298.   	allow_customize = 0;
      299.   	if (malloc_debug_func != NULL)
                  ^
      300.   		{
      301.   		allow_customize_debug = 0;

crypto/mem.c:304:2: Skipping __function_pointer__(): unresolved function pointer
      302.   		malloc_debug_func(NULL, num, file, line, 0);
      303.   		}
      304.   	ret = malloc_ex_func(num,file,line);
              ^
      305.   #ifdef LEVITTE_DEBUG_MEM
      306.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);

crypto/mem.c:308:6: Taking false branch
      306.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);
      307.   #endif
      308.   	if (malloc_debug_func != NULL)
                  ^
      309.   		malloc_debug_func(ret, num, file, line, 1);
      310.   

crypto/mem.c:314:12: Taking false branch
      312.            * sanitisation function can't be optimised out. NB: We only do
      313.            * this for >2Kb so the overhead doesn't bother us. */
      314.           if(ret && (num > 2048))
                        ^
      315.                   ((unsigned char *)ret)[0] = cleanse_ctr;
      316.   

crypto/mem.c:317:2: 
      315.                   ((unsigned char *)ret)[0] = cleanse_ctr;
      316.   
      317. > 	return ret;
      318.   	}
      319.   

crypto/mem.c:318:2: return from a call to CRYPTO_malloc
      316.   
      317.   	return ret;
      318.   	}
              ^
      319.   
      320.   void *CRYPTO_realloc(void *str, int num, const char *file, int line)

crypto/stack/stack.c:125:6: Taking true branch
    123.   	int i;
    124.   
    125.   	if ((ret=(STACK *)OPENSSL_malloc(sizeof(STACK))) == NULL)
                ^
    126.   		goto err;
    127.   	if ((ret->data=(char **)OPENSSL_malloc(sizeof(char *)*MIN_NODES)) == NULL)

crypto/stack/stack.c:136:1: 
    134.   	ret->sorted=0;
    135.   	return(ret);
    136. > err:
    137.   	if(ret)
    138.   		OPENSSL_free(ret);

crypto/stack/stack.c:137:5: Taking false branch
    135.   	return(ret);
    136.   err:
    137.   	if(ret)
               ^
    138.   		OPENSSL_free(ret);
    139.   	return(NULL);

crypto/stack/stack.c:139:2: 
    137.   	if(ret)
    138.   		OPENSSL_free(ret);
    139. > 	return(NULL);
    140.   	}
    141.   

crypto/stack/stack.c:140:2: return from a call to sk_new
    138.   		OPENSSL_free(ret);
    139.   	return(NULL);
    140.   	}
            ^
    141.   
    142.   int sk_insert(STACK *st, char *data, int loc)

crypto/stack/stack.c:118:2: return from a call to sk_new_null
  116.   	{
  117.   	return sk_new((int (*)(const char * const *, const char * const *))0);
  118.   	}
          ^
  119.   
  120.   STACK *sk_new(int (*c)(const char * const *, const char * const *))

ssl/ssl_lib.c:1234:7: 
1232.   		}
1233.   
1234. > 	for (i=0; i<num; i+=n)
1235.   		{
1236.   		c=ssl_get_cipher_by_char(s,p);

ssl/ssl_lib.c:1234:12: Loop condition is true. Entering loop body
1232.   		}
1233.   
1234.   	for (i=0; i<num; i+=n)
                   ^
1235.   		{
1236.   		c=ssl_get_cipher_by_char(s,p);

ssl/ssl_lib.c:1236:3: Skipping __function_pointer__(): unresolved function pointer
1234.   	for (i=0; i<num; i+=n)
1235.   		{
1236.   		c=ssl_get_cipher_by_char(s,p);
          ^
1237.   		p+=n;
1238.   		if (c != NULL)

ssl/ssl_lib.c:1237:3: 
1235.   		{
1236.   		c=ssl_get_cipher_by_char(s,p);
1237. > 		p+=n;
1238.   		if (c != NULL)
1239.   			{

ssl/ssl_lib.c:1238:7: Taking true branch
1236.   		c=ssl_get_cipher_by_char(s,p);
1237.   		p+=n;
1238.   		if (c != NULL)
              ^
1239.   			{
1240.   			if (!sk_SSL_CIPHER_push(sk,c))

ssl/ssl_lib.c:1240:9: 
1238.   		if (c != NULL)
1239.   			{
1240. > 			if (!sk_SSL_CIPHER_push(sk,c))
1241.   				{
1242.   				SSLerr(SSL_F_SSL_BYTES_TO_CIPHER_LIST,ERR_R_MALLOC_FAILURE);

crypto/stack/stack.c:252:1: start of procedure sk_push()
  250.   	}
  251.   
  252. > int sk_push(STACK *st, char *data)
  253.   	{
  254.   	return(sk_insert(st,data,st->num));

crypto/stack/stack.c:254:2: Skipping sk_insert(): empty list of specs
  252.   int sk_push(STACK *st, char *data)
  253.   	{
  254.   	return(sk_insert(st,data,st->num));
          ^
  255.   	}
  256.   
