Commit 36e15462b1 for openssl.org

commit 36e15462b1fd2af9d5189e07829b864c88a6925a
Author: Norbert Pocs <norbertp@openssl.org>
Date:   Thu Sep 3 09:06:47 2026 +0200

    dtls: Don't check for NULL when it can't be

    In dtls context SSL_CONNECTION->d1 is always set by dtls1_new(),
    therefore checking for it only makes the static analysis to think it can
    be otherwise and the variable can be dereferenced later in the function.

    Fixes coverity issue 1700558 and 1700557.

    Signed-off-by: Norbert Pocs <norbertp@openssl.org>
    Reviewed-by: Neil Horman <nhorman@openssl.org>
    Reviewed-by: Andrew Dinh <andrewd@openssl.org>
    Merge-date: Thu Sep 17 16:51:00 2026
    Merged-from: https://github.com/openssl/openssl/pull/32666

diff --git a/ssl/statem/statem_srvr.c b/ssl/statem/statem_srvr.c
index 081d37f1d8..704b8c0756 100644
--- a/ssl/statem/statem_srvr.c
+++ b/ssl/statem/statem_srvr.c
@@ -1670,9 +1670,7 @@ CON_FUNC_RETURN dtls_construct_hello_verify_request(SSL_CONNECTION *s,
     int cb_ret = 0;

 #if !defined(OPENSSL_NO_DTLS)
-    DTLS_LISTENER *dl = (s->d1 != NULL && s->d1->listener != NULL)
-        ? (DTLS_LISTENER *)s->d1->listener
-        : NULL;
+    DTLS_LISTENER *dl = (DTLS_LISTENER *)s->d1->listener;

     if (dl != NULL && dl->require_hvr_cookie && sctx->app_gen_cookie_cb == NULL) {
         cb_ret = ossl_dtls_listener_gen_cookie_cb(ussl, s->d1->cookie, &cookie_leni);