apps/s_server.c:1560: error: NULL_DEREFERENCE
  pointer `con` last assigned on line 1556 could be null and is dereferenced by call to `SSL_callback_ctrl()` at line 1560, column 3.
Showing all 64 steps of the trace


apps/s_server.c:1525:1: start of procedure sv_body()
1523.   	}
1524.   
1525. > static int sv_body(char *hostname, int s, unsigned char *context)
1526.   	{
1527.   	char *buf=NULL;

apps/s_server.c:1527:2: 
1525.   static int sv_body(char *hostname, int s, unsigned char *context)
1526.   	{
1527. > 	char *buf=NULL;
1528.   	fd_set readfds;
1529.   	int ret=1,width;

apps/s_server.c:1529:2: 
1527.   	char *buf=NULL;
1528.   	fd_set readfds;
1529. > 	int ret=1,width;
1530.   	int k,i;
1531.   	unsigned long l;

apps/s_server.c:1532:2: 
1530.   	int k,i;
1531.   	unsigned long l;
1532. > 	SSL *con=NULL;
1533.   	BIO *sbio;
1534.   #if defined(OPENSSL_SYS_WINDOWS) || defined(OPENSSL_SYS_MSDOS) || defined(OPENSSL_SYS_NETWARE) || defined(OPENSSL_SYS_BEOS_R5)

apps/s_server.c:1538:6: 
1536.   #endif
1537.   
1538. > 	if ((buf=OPENSSL_malloc(bufsize)) == NULL)
1539.   		{
1540.   		BIO_printf(bio_err,"out of memory\n");

crypto/mem.c:294:1: start of procedure CRYPTO_malloc()
  292.   	}
  293.   
  294. > void *CRYPTO_malloc(int num, const char *file, int line)
  295.   	{
  296.   	void *ret = NULL;

crypto/mem.c:296:2: 
  294.   void *CRYPTO_malloc(int num, const char *file, int line)
  295.   	{
  296. > 	void *ret = NULL;
  297.   
  298.   	if (num <= 0) return NULL;

crypto/mem.c:298:6: Taking false branch
  296.   	void *ret = NULL;
  297.   
  298.   	if (num <= 0) return NULL;
              ^
  299.   
  300.   	allow_customize = 0;

crypto/mem.c:300:2: 
  298.   	if (num <= 0) return NULL;
  299.   
  300. > 	allow_customize = 0;
  301.   	if (malloc_debug_func != NULL)
  302.   		{

crypto/mem.c:301:6: Taking true branch
  299.   
  300.   	allow_customize = 0;
  301.   	if (malloc_debug_func != NULL)
              ^
  302.   		{
  303.   		allow_customize_debug = 0;

crypto/mem.c:303:3: 
  301.   	if (malloc_debug_func != NULL)
  302.   		{
  303. > 		allow_customize_debug = 0;
  304.   		malloc_debug_func(NULL, num, file, line, 0);
  305.   		}

crypto/mem.c:304:3: Skipping __function_pointer__(): unresolved function pointer
  302.   		{
  303.   		allow_customize_debug = 0;
  304.   		malloc_debug_func(NULL, num, file, line, 0);
           ^
  305.   		}
  306.   	ret = malloc_ex_func(num,file,line);

crypto/mem.c:306:2: Skipping __function_pointer__(): unresolved function pointer
  304.   		malloc_debug_func(NULL, num, file, line, 0);
  305.   		}
  306.   	ret = malloc_ex_func(num,file,line);
          ^
  307.   #ifdef LEVITTE_DEBUG_MEM
  308.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);

crypto/mem.c:310:6: Taking true branch
  308.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);
  309.   #endif
  310.   	if (malloc_debug_func != NULL)
              ^
  311.   		malloc_debug_func(ret, num, file, line, 1);
  312.   

crypto/mem.c:311:3: Skipping __function_pointer__(): unresolved function pointer
  309.   #endif
  310.   	if (malloc_debug_func != NULL)
  311.   		malloc_debug_func(ret, num, file, line, 1);
           ^
  312.   
  313.   #ifndef OPENSSL_CPUID_OBJ

crypto/mem.c:317:12: Taking true branch
  315.            * sanitisation function can't be optimised out. NB: We only do
  316.            * this for >2Kb so the overhead doesn't bother us. */
  317.           if(ret && (num > 2048))
                    ^
  318.   	{	extern unsigned char cleanse_ctr;
  319.                   ((unsigned char *)ret)[0] = cleanse_ctr;

crypto/mem.c:317:20: Taking false branch
  315.            * sanitisation function can't be optimised out. NB: We only do
  316.            * this for >2Kb so the overhead doesn't bother us. */
  317.           if(ret && (num > 2048))
                            ^
  318.   	{	extern unsigned char cleanse_ctr;
  319.                   ((unsigned char *)ret)[0] = cleanse_ctr;

crypto/mem.c:323:2: 
  321.   #endif
  322.   
  323. > 	return ret;
  324.   	}
  325.   

crypto/mem.c:324:2: return from a call to CRYPTO_malloc
  322.   
  323.   	return ret;
  324.   	}
          ^
  325.   
  326.   void *CRYPTO_realloc(void *str, int num, const char *file, int line)

apps/s_server.c:1538:6: Taking false branch
1536.   #endif
1537.   
1538.   	if ((buf=OPENSSL_malloc(bufsize)) == NULL)
             ^
1539.   		{
1540.   		BIO_printf(bio_err,"out of memory\n");

apps/s_server.c:1544:6: Taking false branch
1542.   		}
1543.   #ifdef FIONBIO	
1544.   	if (s_nbio)
             ^
1545.   		{
1546.   		unsigned long sl=1;

apps/s_server.c:1555:6: Taking true branch
1553.   #endif
1554.   
1555.   	if (con == NULL) {
             ^
1556.   		con=SSL_new(ctx);
1557.   #ifndef OPENSSL_NO_TLSEXT

apps/s_server.c:1556:3: 
1554.   
1555.   	if (con == NULL) {
1556. > 		con=SSL_new(ctx);
1557.   #ifndef OPENSSL_NO_TLSEXT
1558.   	if (s_tlsextdebug)

ssl/ssl_lib.c:267:1: start of procedure SSL_new()
  265.   	}
  266.   
  267. > SSL *SSL_new(SSL_CTX *ctx)
  268.   	{
  269.   	SSL *s;

ssl/ssl_lib.c:271:6: Taking false branch
  269.   	SSL *s;
  270.   
  271.   	if (ctx == NULL)
              ^
  272.   		{
  273.   		SSLerr(SSL_F_SSL_NEW,SSL_R_NULL_SSL_CTX);

ssl/ssl_lib.c:276:6: Taking false branch
  274.   		return(NULL);
  275.   		}
  276.   	if (ctx->method == NULL)
              ^
  277.   		{
  278.   		SSLerr(SSL_F_SSL_NEW,SSL_R_SSL_CTX_HAS_NO_DEFAULT_SSL_VERSION);

ssl/ssl_lib.c:282:2: 
  280.   		}
  281.   
  282. > 	s=(SSL *)OPENSSL_malloc(sizeof(SSL));
  283.   	if (s == NULL) goto err;
  284.   	memset(s,0,sizeof(SSL));

crypto/mem.c:294:1: start of procedure CRYPTO_malloc()
    292.   	}
    293.   
    294. > void *CRYPTO_malloc(int num, const char *file, int line)
    295.   	{
    296.   	void *ret = NULL;

crypto/mem.c:296:2: 
    294.   void *CRYPTO_malloc(int num, const char *file, int line)
    295.   	{
    296. > 	void *ret = NULL;
    297.   
    298.   	if (num <= 0) return NULL;

crypto/mem.c:298:6: Taking false branch
    296.   	void *ret = NULL;
    297.   
    298.   	if (num <= 0) return NULL;
                ^
    299.   
    300.   	allow_customize = 0;

crypto/mem.c:300:2: 
    298.   	if (num <= 0) return NULL;
    299.   
    300. > 	allow_customize = 0;
    301.   	if (malloc_debug_func != NULL)
    302.   		{

crypto/mem.c:301:6: Taking true branch
    299.   
    300.   	allow_customize = 0;
    301.   	if (malloc_debug_func != NULL)
                ^
    302.   		{
    303.   		allow_customize_debug = 0;

crypto/mem.c:303:3: 
    301.   	if (malloc_debug_func != NULL)
    302.   		{
    303. > 		allow_customize_debug = 0;
    304.   		malloc_debug_func(NULL, num, file, line, 0);
    305.   		}

crypto/mem.c:304:3: Skipping __function_pointer__(): unresolved function pointer
    302.   		{
    303.   		allow_customize_debug = 0;
    304.   		malloc_debug_func(NULL, num, file, line, 0);
             ^
    305.   		}
    306.   	ret = malloc_ex_func(num,file,line);

crypto/mem.c:306:2: Skipping __function_pointer__(): unresolved function pointer
    304.   		malloc_debug_func(NULL, num, file, line, 0);
    305.   		}
    306.   	ret = malloc_ex_func(num,file,line);
            ^
    307.   #ifdef LEVITTE_DEBUG_MEM
    308.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);

crypto/mem.c:310:6: Taking true branch
    308.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);
    309.   #endif
    310.   	if (malloc_debug_func != NULL)
                ^
    311.   		malloc_debug_func(ret, num, file, line, 1);
    312.   

crypto/mem.c:311:3: Skipping __function_pointer__(): unresolved function pointer
    309.   #endif
    310.   	if (malloc_debug_func != NULL)
    311.   		malloc_debug_func(ret, num, file, line, 1);
             ^
    312.   
    313.   #ifndef OPENSSL_CPUID_OBJ

crypto/mem.c:317:12: Taking false branch
    315.            * sanitisation function can't be optimised out. NB: We only do
    316.            * this for >2Kb so the overhead doesn't bother us. */
    317.           if(ret && (num > 2048))
                      ^
    318.   	{	extern unsigned char cleanse_ctr;
    319.                   ((unsigned char *)ret)[0] = cleanse_ctr;

crypto/mem.c:323:2: 
    321.   #endif
    322.   
    323. > 	return ret;
    324.   	}
    325.   

crypto/mem.c:324:2: return from a call to CRYPTO_malloc
    322.   
    323.   	return ret;
    324.   	}
            ^
    325.   
    326.   void *CRYPTO_realloc(void *str, int num, const char *file, int line)

ssl/ssl_lib.c:283:6: Taking true branch
  281.   
  282.   	s=(SSL *)OPENSSL_malloc(sizeof(SSL));
  283.   	if (s == NULL) goto err;
              ^
  284.   	memset(s,0,sizeof(SSL));
  285.   

ssl/ssl_lib.c:367:1: 
  365.   
  366.   	return(s);
  367. > err:
  368.   	if (s != NULL)
  369.   		{

ssl/ssl_lib.c:368:6: Taking false branch
  366.   	return(s);
  367.   err:
  368.   	if (s != NULL)
              ^
  369.   		{
  370.   		if (s->cert != NULL)

ssl/ssl_lib.c:376:2: 
  374.   		OPENSSL_free(s);
  375.   		}
  376. > 	SSLerr(SSL_F_SSL_NEW,ERR_R_MALLOC_FAILURE);
  377.   	return(NULL);
  378.   	}

crypto/err/err.c:680:1: start of procedure ERR_put_error()
    678.   /********************************************************/
    679.   
    680. > void ERR_put_error(int lib, int func, int reason, const char *file,
    681.   	     int line)
    682.   	{

crypto/err/err.c:704:2: Skipping ERR_get_state(): empty list of specs
    702.   	}
    703.   #endif
    704.   	es=ERR_get_state();
            ^
    705.   
    706.   	es->top=(es->top+1)%ERR_NUM_ERRORS;

crypto/err/err.c:706:2: 
    704.   	es=ERR_get_state();
    705.   
    706. > 	es->top=(es->top+1)%ERR_NUM_ERRORS;
    707.   	if (es->top == es->bottom)
    708.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;

crypto/err/err.c:707:6: Taking false branch
    705.   
    706.   	es->top=(es->top+1)%ERR_NUM_ERRORS;
    707.   	if (es->top == es->bottom)
                ^
    708.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
    709.   	es->err_flags[es->top]=0;

crypto/err/err.c:709:2: 
    707.   	if (es->top == es->bottom)
    708.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
    709. > 	es->err_flags[es->top]=0;
    710.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
    711.   	es->err_file[es->top]=file;

crypto/err/err.c:710:2: 
    708.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
    709.   	es->err_flags[es->top]=0;
    710. > 	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
    711.   	es->err_file[es->top]=file;
    712.   	es->err_line[es->top]=line;

crypto/err/err.c:711:2: 
    709.   	es->err_flags[es->top]=0;
    710.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
    711. > 	es->err_file[es->top]=file;
    712.   	es->err_line[es->top]=line;
    713.   	err_clear_data(es,es->top);

crypto/err/err.c:712:2: 
    710.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
    711.   	es->err_file[es->top]=file;
    712. > 	es->err_line[es->top]=line;
    713.   	err_clear_data(es,es->top);
    714.   	}

crypto/err/err.c:713:2: Taking true branch
    711.   	es->err_file[es->top]=file;
    712.   	es->err_line[es->top]=line;
    713.   	err_clear_data(es,es->top);
            ^
    714.   	}
    715.   

crypto/err/err.c:713:2: Taking false branch
    711.   	es->err_file[es->top]=file;
    712.   	es->err_line[es->top]=line;
    713.   	err_clear_data(es,es->top);
            ^
    714.   	}
    715.   

crypto/err/err.c:713:2: Loop condition is false. Leaving loop
    711.   	es->err_file[es->top]=file;
    712.   	es->err_line[es->top]=line;
    713.   	err_clear_data(es,es->top);
            ^
    714.   	}
    715.   

crypto/err/err.c:714:2: return from a call to ERR_put_error
    712.   	es->err_line[es->top]=line;
    713.   	err_clear_data(es,es->top);
    714.   	}
            ^
    715.   
    716.   void ERR_clear_error(void)

ssl/ssl_lib.c:377:2: 
  375.   		}
  376.   	SSLerr(SSL_F_SSL_NEW,ERR_R_MALLOC_FAILURE);
  377. > 	return(NULL);
  378.   	}
  379.   

ssl/ssl_lib.c:378:2: return from a call to SSL_new
  376.   	SSLerr(SSL_F_SSL_NEW,ERR_R_MALLOC_FAILURE);
  377.   	return(NULL);
  378.   	}
          ^
  379.   
  380.   int SSL_CTX_set_session_id_context(SSL_CTX *ctx,const unsigned char *sid_ctx,

apps/s_server.c:1558:6: Taking true branch
1556.   		con=SSL_new(ctx);
1557.   #ifndef OPENSSL_NO_TLSEXT
1558.   	if (s_tlsextdebug)
             ^
1559.   		{
1560.   		SSL_set_tlsext_debug_callback(con, tlsext_cb);

apps/s_server.c:1560:3: 
1558.   	if (s_tlsextdebug)
1559.   		{
1560. > 		SSL_set_tlsext_debug_callback(con, tlsext_cb);
1561.   		SSL_set_tlsext_debug_arg(con, bio_s_out);
1562.   		}

ssl/ssl_lib.c:1037:1: start of procedure SSL_callback_ctrl()
  1035.   	}
  1036.   
  1037. > long SSL_callback_ctrl(SSL *s, int cmd, void (*fp)(void))
  1038.   	{
  1039.   	switch(cmd)

ssl/ssl_lib.c:1039:2: 
  1037.   long SSL_callback_ctrl(SSL *s, int cmd, void (*fp)(void))
  1038.   	{
  1039. > 	switch(cmd)
  1040.   		{
  1041.   	case SSL_CTRL_SET_MSG_CALLBACK:

ssl/ssl_lib.c:1041:2: Switch condition is false. Skipping switch case
  1039.   	switch(cmd)
  1040.   		{
  1041.   	case SSL_CTRL_SET_MSG_CALLBACK:
           ^
  1042.   		s->msg_callback = (void (*)(int write_p, int version, int content_type, const void *buf, size_t len, SSL *ssl, void *arg))(fp);
  1043.   		return 1;

ssl/ssl_lib.c:1046:3: Skipping __function_pointer__(): unresolved function pointer
  1044.   		
  1045.   	default:
  1046.   		return(s->method->ssl_callback_ctrl(s,cmd,fp));
            ^
  1047.   		}
  1048.   	}
