test/evp_test.c:482: error: NULL_DEREFERENCE
  pointer `cdat` last assigned on line 481 could be null and is dereferenced at line 482, column 5.
Showing all 67 steps of the trace


test/evp_test.c:467:1: start of procedure cipher_test_init()
465.   } CIPHER_DATA;
466.   
467. > static int cipher_test_init(EVP_TEST *t, const char *alg)
468.   {
469.       const EVP_CIPHER *cipher;

test/evp_test.c:473:9: 
471.       int m;
472.   
473. >     if ((cipher = EVP_get_cipherbyname(alg)) == NULL) {
474.           /* If alg has an OID assume disabled algorithm */
475.           if (OBJ_sn2nid(alg) != NID_undef || OBJ_ln2nid(alg) != NID_undef) {

crypto/evp/names.c:58:1: start of procedure EVP_get_cipherbyname()
  56.   }
  57.   
  58. > const EVP_CIPHER *EVP_get_cipherbyname(const char *name)
  59.   {
  60.       const EVP_CIPHER *cp;

crypto/evp/names.c:62:10: Taking false branch
  60.       const EVP_CIPHER *cp;
  61.   
  62.       if (!OPENSSL_init_crypto(OPENSSL_INIT_ADD_ALL_CIPHERS, NULL))
                 ^
  63.           return NULL;
  64.   

crypto/evp/names.c:65:5: 
  63.           return NULL;
  64.   
  65. >     cp = (const EVP_CIPHER *)OBJ_NAME_get(name, OBJ_NAME_TYPE_CIPHER_METH);
  66.       return cp;
  67.   }

crypto/objects/o_names.c:173:1: start of procedure OBJ_NAME_get()
    171.   }
    172.   
    173. > const char *OBJ_NAME_get(const char *name, int type)
    174.   {
    175.       OBJ_NAME on, *ret;

crypto/objects/o_names.c:176:5: 
    174.   {
    175.       OBJ_NAME on, *ret;
    176. >     int num = 0, alias;
    177.       const char *value = NULL;
    178.   

crypto/objects/o_names.c:177:5: 
    175.       OBJ_NAME on, *ret;
    176.       int num = 0, alias;
    177. >     const char *value = NULL;
    178.   
    179.       if (name == NULL)

crypto/objects/o_names.c:179:9: Taking false branch
    177.       const char *value = NULL;
    178.   
    179.       if (name == NULL)
                   ^
    180.           return NULL;
    181.       if (!OBJ_NAME_init())

crypto/objects/o_names.c:181:10: 
    179.       if (name == NULL)
    180.           return NULL;
    181. >     if (!OBJ_NAME_init())
    182.           return NULL;
    183.       CRYPTO_THREAD_read_lock(obj_lock);

crypto/objects/o_names.c:77:1: start of procedure OBJ_NAME_init()
      75.   }
      76.   
      77. > int OBJ_NAME_init(void)
      78.   {
      79.       return RUN_ONCE(&init, o_names_init);

crypto/objects/o_names.c:79:12: 
      77.   int OBJ_NAME_init(void)
      78.   {
      79. >     return RUN_ONCE(&init, o_names_init);
      80.   }
      81.   

crypto/threads_pthread.c:111:1: start of procedure CRYPTO_THREAD_run_once()
        109.   }
        110.   
        111. > int CRYPTO_THREAD_run_once(CRYPTO_ONCE *once, void (*init)(void))
        112.   {
        113.       if (pthread_once(once, init) != 0)

crypto/threads_pthread.c:113:9: Taking false branch
        111.   int CRYPTO_THREAD_run_once(CRYPTO_ONCE *once, void (*init)(void))
        112.   {
        113.       if (pthread_once(once, init) != 0)
                       ^
        114.           return 0;
        115.   

crypto/threads_pthread.c:116:5: 
        114.           return 0;
        115.   
        116. >     return 1;
        117.   }
        118.   

crypto/threads_pthread.c:117:1: return from a call to CRYPTO_THREAD_run_once
        115.   
        116.       return 1;
        117. > }
        118.   
        119.   int CRYPTO_THREAD_init_local(CRYPTO_THREAD_LOCAL *key, void (*cleanup)(void *))

crypto/objects/o_names.c:79:12: Condition is true
      77.   int OBJ_NAME_init(void)
      78.   {
      79.       return RUN_ONCE(&init, o_names_init);
                       ^
      80.   }
      81.   

crypto/objects/o_names.c:79:5: 
      77.   int OBJ_NAME_init(void)
      78.   {
      79. >     return RUN_ONCE(&init, o_names_init);
      80.   }
      81.   

crypto/objects/o_names.c:80:1: return from a call to OBJ_NAME_init
      78.   {
      79.       return RUN_ONCE(&init, o_names_init);
      80. > }
      81.   
      82.   int OBJ_NAME_new_index(unsigned long (*hash_func) (const char *),

crypto/objects/o_names.c:181:10: Taking false branch
    179.       if (name == NULL)
    180.           return NULL;
    181.       if (!OBJ_NAME_init())
                    ^
    182.           return NULL;
    183.       CRYPTO_THREAD_read_lock(obj_lock);

crypto/objects/o_names.c:183:5: 
    181.       if (!OBJ_NAME_init())
    182.           return NULL;
    183. >     CRYPTO_THREAD_read_lock(obj_lock);
    184.   
    185.       alias = type & OBJ_NAME_ALIAS;

crypto/threads_pthread.c:57:1: start of procedure CRYPTO_THREAD_read_lock()
      55.   }
      56.   
      57. > int CRYPTO_THREAD_read_lock(CRYPTO_RWLOCK *lock)
      58.   {
      59.   # ifdef USE_RWLOCK

crypto/threads_pthread.c:60:9: Taking true branch
      58.   {
      59.   # ifdef USE_RWLOCK
      60.       if (pthread_rwlock_rdlock(lock) != 0)
                    ^
      61.           return 0;
      62.   # else

crypto/threads_pthread.c:61:9: 
      59.   # ifdef USE_RWLOCK
      60.       if (pthread_rwlock_rdlock(lock) != 0)
      61. >         return 0;
      62.   # else
      63.       if (pthread_mutex_lock(lock) != 0)

crypto/threads_pthread.c:68:1: return from a call to CRYPTO_THREAD_read_lock
      66.   
      67.       return 1;
      68. > }
      69.   
      70.   int CRYPTO_THREAD_write_lock(CRYPTO_RWLOCK *lock)

crypto/objects/o_names.c:185:5: 
    183.       CRYPTO_THREAD_read_lock(obj_lock);
    184.   
    185. >     alias = type & OBJ_NAME_ALIAS;
    186.       type &= ~OBJ_NAME_ALIAS;
    187.   

crypto/objects/o_names.c:186:5: 
    184.   
    185.       alias = type & OBJ_NAME_ALIAS;
    186. >     type &= ~OBJ_NAME_ALIAS;
    187.   
    188.       on.name = name;

crypto/objects/o_names.c:188:5: 
    186.       type &= ~OBJ_NAME_ALIAS;
    187.   
    188. >     on.name = name;
    189.       on.type = type;
    190.   

crypto/objects/o_names.c:189:5: 
    187.   
    188.       on.name = name;
    189. >     on.type = type;
    190.   
    191.       for (;;) {

crypto/objects/o_names.c:203:5: Loop condition is true. Entering loop body
    201.               break;
    202.           }
    203.       }
               ^
    204.   
    205.       CRYPTO_THREAD_unlock(obj_lock);

crypto/objects/o_names.c:192:9: 
    190.   
    191.       for (;;) {
    192. >         ret = lh_OBJ_NAME_retrieve(names_lh, &on);
    193.           if (ret == NULL)
    194.               break;

crypto/objects/obj_lcl.h:12:1: start of procedure lh_OBJ_NAME_retrieve()
      10.   typedef struct name_funcs_st NAME_FUNCS;
      11.   DEFINE_STACK_OF(NAME_FUNCS)
      12. > DEFINE_LHASH_OF(OBJ_NAME);
      13.   typedef struct added_obj_st ADDED_OBJ;
      14.   DEFINE_LHASH_OF(ADDED_OBJ);

crypto/lhash/lhash.c:154:1: start of procedure OPENSSL_LH_retrieve()
        152.   }
        153.   
        154. > void *OPENSSL_LH_retrieve(OPENSSL_LHASH *lh, const void *data)
        155.   {
        156.       unsigned long hash;

crypto/lhash/lhash.c:160:5: 
        158.       void *ret;
        159.   
        160. >     tsan_store((TSAN_QUALIFIER int *)&lh->error, 0);
        161.   
        162.       rn = getrn(lh, data, &hash);

crypto/lhash/lhash.c:162:5: Skipping getrn(): empty list of specs
        160.       tsan_store((TSAN_QUALIFIER int *)&lh->error, 0);
        161.   
        162.       rn = getrn(lh, data, &hash);
                   ^
        163.   
        164.       if (*rn == NULL) {

crypto/lhash/lhash.c:164:9: Taking false branch
        162.       rn = getrn(lh, data, &hash);
        163.   
        164.       if (*rn == NULL) {
                       ^
        165.           tsan_counter(&lh->num_retrieve_miss);
        166.           return NULL;

crypto/lhash/lhash.c:168:9: 
        166.           return NULL;
        167.       } else {
        168. >         ret = (*rn)->data;
        169.           tsan_counter(&lh->num_retrieve);
        170.       }

crypto/lhash/lhash.c:169:9: 
        167.       } else {
        168.           ret = (*rn)->data;
        169. >         tsan_counter(&lh->num_retrieve);
        170.       }
        171.   

crypto/lhash/lhash.c:172:5: 
        170.       }
        171.   
        172. >     return ret;
        173.   }
        174.   

crypto/lhash/lhash.c:173:1: return from a call to OPENSSL_LH_retrieve
        171.   
        172.       return ret;
        173. > }
        174.   
        175.   static void doall_util_fn(OPENSSL_LHASH *lh, int use_arg,

crypto/objects/obj_lcl.h:12:1: return from a call to lh_OBJ_NAME_retrieve
      10.   typedef struct name_funcs_st NAME_FUNCS;
      11.   DEFINE_STACK_OF(NAME_FUNCS)
      12. > DEFINE_LHASH_OF(OBJ_NAME);
      13.   typedef struct added_obj_st ADDED_OBJ;
      14.   DEFINE_LHASH_OF(ADDED_OBJ);

crypto/objects/o_names.c:193:13: Taking false branch
    191.       for (;;) {
    192.           ret = lh_OBJ_NAME_retrieve(names_lh, &on);
    193.           if (ret == NULL)
                       ^
    194.               break;
    195.           if ((ret->alias) && !alias) {

crypto/objects/o_names.c:195:13: Taking false branch
    193.           if (ret == NULL)
    194.               break;
    195.           if ((ret->alias) && !alias) {
                       ^
    196.               if (++num > 10)
    197.                   break;

crypto/objects/o_names.c:200:13: 
    198.               on.name = ret->data;
    199.           } else {
    200. >             value = ret->data;
    201.               break;
    202.           }

crypto/objects/o_names.c:205:5: 
    203.       }
    204.   
    205. >     CRYPTO_THREAD_unlock(obj_lock);
    206.       return value;
    207.   }

crypto/threads_pthread.c:83:1: start of procedure CRYPTO_THREAD_unlock()
      81.   }
      82.   
      83. > int CRYPTO_THREAD_unlock(CRYPTO_RWLOCK *lock)
      84.   {
      85.   # ifdef USE_RWLOCK

crypto/threads_pthread.c:86:9: Taking true branch
      84.   {
      85.   # ifdef USE_RWLOCK
      86.       if (pthread_rwlock_unlock(lock) != 0)
                    ^
      87.           return 0;
      88.   # else

crypto/threads_pthread.c:87:9: 
      85.   # ifdef USE_RWLOCK
      86.       if (pthread_rwlock_unlock(lock) != 0)
      87. >         return 0;
      88.   # else
      89.       if (pthread_mutex_unlock(lock) != 0)

crypto/threads_pthread.c:94:1: return from a call to CRYPTO_THREAD_unlock
      92.   
      93.       return 1;
      94. > }
      95.   
      96.   void CRYPTO_THREAD_lock_free(CRYPTO_RWLOCK *lock)

crypto/objects/o_names.c:206:5: 
    204.   
    205.       CRYPTO_THREAD_unlock(obj_lock);
    206. >     return value;
    207.   }
    208.   

crypto/objects/o_names.c:207:1: return from a call to OBJ_NAME_get
    205.       CRYPTO_THREAD_unlock(obj_lock);
    206.       return value;
    207. > }
    208.   
    209.   int OBJ_NAME_add(const char *name, int type, const char *data)

crypto/evp/names.c:66:5: 
  64.   
  65.       cp = (const EVP_CIPHER *)OBJ_NAME_get(name, OBJ_NAME_TYPE_CIPHER_METH);
  66. >     return cp;
  67.   }
  68.   

crypto/evp/names.c:67:1: return from a call to EVP_get_cipherbyname
  65.       cp = (const EVP_CIPHER *)OBJ_NAME_get(name, OBJ_NAME_TYPE_CIPHER_METH);
  66.       return cp;
  67. > }
  68.   
  69.   const EVP_MD *EVP_get_digestbyname(const char *name)

test/evp_test.c:473:9: Taking false branch
471.       int m;
472.   
473.       if ((cipher = EVP_get_cipherbyname(alg)) == NULL) {
               ^
474.           /* If alg has an OID assume disabled algorithm */
475.           if (OBJ_sn2nid(alg) != NID_undef || OBJ_ln2nid(alg) != NID_undef) {

test/evp_test.c:481:5: 
479.           return 0;
480.       }
481. >     cdat = OPENSSL_zalloc(sizeof(*cdat));
482.       cdat->cipher = cipher;
483.       cdat->enc = -1;

crypto/mem.c:228:1: start of procedure CRYPTO_zalloc()
  226.   }
  227.   
  228. > void *CRYPTO_zalloc(size_t num, const char *file, int line)
  229.   {
  230.       void *ret = CRYPTO_malloc(num, file, line);

crypto/mem.c:230:5: 
  228.   void *CRYPTO_zalloc(size_t num, const char *file, int line)
  229.   {
  230. >     void *ret = CRYPTO_malloc(num, file, line);
  231.   
  232.       FAILTEST();

crypto/mem.c:192:1: start of procedure CRYPTO_malloc()
    190.   #endif
    191.   
    192. > void *CRYPTO_malloc(size_t num, const char *file, int line)
    193.   {
    194.       void *ret = NULL;

crypto/mem.c:194:5: 
    192.   void *CRYPTO_malloc(size_t num, const char *file, int line)
    193.   {
    194. >     void *ret = NULL;
    195.   
    196.       INCREMENT(malloc_count);

crypto/mem.c:197:9: Taking true branch
    195.   
    196.       INCREMENT(malloc_count);
    197.       if (malloc_impl != NULL && malloc_impl != CRYPTO_malloc)
                   ^
    198.           return malloc_impl(num, file, line);
    199.   

crypto/mem.c:197:32: Taking true branch
    195.   
    196.       INCREMENT(malloc_count);
    197.       if (malloc_impl != NULL && malloc_impl != CRYPTO_malloc)
                                          ^
    198.           return malloc_impl(num, file, line);
    199.   

crypto/mem.c:198:9: Skipping __function_pointer__(): unresolved function pointer
    196.       INCREMENT(malloc_count);
    197.       if (malloc_impl != NULL && malloc_impl != CRYPTO_malloc)
    198.           return malloc_impl(num, file, line);
                   ^
    199.   
    200.       if (num == 0)

crypto/mem.c:226:1: return from a call to CRYPTO_malloc
    224.   
    225.       return ret;
    226. > }
    227.   
    228.   void *CRYPTO_zalloc(size_t num, const char *file, int line)

crypto/mem.c:233:9: Taking false branch
  231.   
  232.       FAILTEST();
  233.       if (ret != NULL)
                 ^
  234.           memset(ret, 0, num);
  235.       return ret;

crypto/mem.c:235:5: 
  233.       if (ret != NULL)
  234.           memset(ret, 0, num);
  235. >     return ret;
  236.   }
  237.   

crypto/mem.c:236:1: return from a call to CRYPTO_zalloc
  234.           memset(ret, 0, num);
  235.       return ret;
  236. > }
  237.   
  238.   void *CRYPTO_realloc(void *str, size_t num, const char *file, int line)

test/evp_test.c:482:5: 
480.       }
481.       cdat = OPENSSL_zalloc(sizeof(*cdat));
482. >     cdat->cipher = cipher;
483.       cdat->enc = -1;
484.       m = EVP_CIPHER_mode(cipher);

static int cipher_test_init(EVP_TEST *t, const char *alg)
{
    const EVP_CIPHER *cipher;
    CIPHER_DATA *cdat;
    int m;
    if ((cipher = EVP_get_cipherbyname(alg)) == NULL) {
        if (OBJ_sn2nid(alg) != NID_undef || OBJ_ln2nid(alg) != NID_undef) {
            t->skip = 1;
            return 1;
        }
        return 0;
    }
    cdat = OPENSSL_zalloc(sizeof(*cdat));
    cdat->cipher = cipher;
    cdat->enc = -1;
    m = EVP_CIPHER_mode(cipher);
    if (m == EVP_CIPH_GCM_MODE
            || m == EVP_CIPH_OCB_MODE
            || m == EVP_CIPH_CCM_MODE)
        cdat->aead = EVP_CIPHER_mode(cipher);
    else if (EVP_CIPHER_flags(cipher) & EVP_CIPH_FLAG_AEAD_CIPHER)
        cdat->aead = -1;
    else
        cdat->aead = 0;
    t->data = cdat;
    return 1;
}
['static int cipher_test_init(EVP_TEST *t, const char *alg)\n{\n    const EVP_CIPHER *cipher;\n    CIPHER_DATA *cdat;\n    int m;\n    if ((cipher = EVP_get_cipherbyname(alg)) == NULL) {\n        if (OBJ_sn2nid(alg) != NID_undef || OBJ_ln2nid(alg) != NID_undef) {\n            t->skip = 1;\n            return 1;\n        }\n        return 0;\n    }\n    cdat = OPENSSL_zalloc(sizeof(*cdat));\n    cdat->cipher = cipher;\n    cdat->enc = -1;\n    m = EVP_CIPHER_mode(cipher);\n    if (m == EVP_CIPH_GCM_MODE\n            || m == EVP_CIPH_OCB_MODE\n            || m == EVP_CIPH_CCM_MODE)\n        cdat->aead = EVP_CIPHER_mode(cipher);\n    else if (EVP_CIPHER_flags(cipher) & EVP_CIPH_FLAG_AEAD_CIPHER)\n        cdat->aead = -1;\n    else\n        cdat->aead = 0;\n    t->data = cdat;\n    return 1;\n}', 'const EVP_CIPHER *EVP_get_cipherbyname(const char *name)\n{\n    const EVP_CIPHER *cp;\n    if (!OPENSSL_init_crypto(OPENSSL_INIT_ADD_ALL_CIPHERS, NULL))\n        return NULL;\n    cp = (const EVP_CIPHER *)OBJ_NAME_get(name, OBJ_NAME_TYPE_CIPHER_METH);\n    return cp;\n}', 'const char *OBJ_NAME_get(const char *name, int type)\n{\n    OBJ_NAME on, *ret;\n    int num = 0, alias;\n    const char *value = NULL;\n    if (name == NULL)\n        return NULL;\n    if (!OBJ_NAME_init())\n        return NULL;\n    CRYPTO_THREAD_read_lock(obj_lock);\n    alias = type & OBJ_NAME_ALIAS;\n    type &= ~OBJ_NAME_ALIAS;\n    on.name = name;\n    on.type = type;\n    for (;;) {\n        ret = lh_OBJ_NAME_retrieve(names_lh, &on);\n        if (ret == NULL)\n            break;\n        if ((ret->alias) && !alias) {\n            if (++num > 10)\n                break;\n            on.name = ret->data;\n        } else {\n            value = ret->data;\n            break;\n        }\n    }\n    CRYPTO_THREAD_unlock(obj_lock);\n    return value;\n}', 'int OBJ_NAME_init(void)\n{\n    return RUN_ONCE(&init, o_names_init);\n}', 'int CRYPTO_THREAD_run_once(CRYPTO_ONCE *once, void (*init)(void))\n{\n    if (pthread_once(once, init) != 0)\n        return 0;\n    return 1;\n}', 'int CRYPTO_THREAD_read_lock(CRYPTO_RWLOCK *lock)\n{\n# ifdef USE_RWLOCK\n    if (pthread_rwlock_rdlock(lock) != 0)\n        return 0;\n# else\n    if (pthread_mutex_lock(lock) != 0)\n        return 0;\n# endif\n    return 1;\n}', 'void *OPENSSL_LH_retrieve(OPENSSL_LHASH *lh, const void *data)\n{\n    unsigned long hash;\n    OPENSSL_LH_NODE **rn;\n    void *ret;\n    tsan_store((TSAN_QUALIFIER int *)&lh->error, 0);\n    rn = getrn(lh, data, &hash);\n    if (*rn == NULL) {\n        tsan_counter(&lh->num_retrieve_miss);\n        return NULL;\n    } else {\n        ret = (*rn)->data;\n        tsan_counter(&lh->num_retrieve);\n    }\n    return ret;\n}', 'int CRYPTO_THREAD_unlock(CRYPTO_RWLOCK *lock)\n{\n# ifdef USE_RWLOCK\n    if (pthread_rwlock_unlock(lock) != 0)\n        return 0;\n# else\n    if (pthread_mutex_unlock(lock) != 0)\n        return 0;\n# endif\n    return 1;\n}', 'void *CRYPTO_zalloc(size_t num, const char *file, int line)\n{\n    void *ret = CRYPTO_malloc(num, file, line);\n    FAILTEST();\n    if (ret != NULL)\n        memset(ret, 0, num);\n    return ret;\n}', 'void *CRYPTO_malloc(size_t num, const char *file, int line)\n{\n    void *ret = NULL;\n    INCREMENT(malloc_count);\n    if (malloc_impl != NULL && malloc_impl != CRYPTO_malloc)\n        return malloc_impl(num, file, line);\n    if (num == 0)\n        return NULL;\n    FAILTEST();\n    if (allow_customize) {\n        allow_customize = 0;\n    }\n#ifndef OPENSSL_NO_CRYPTO_MDEBUG\n    if (call_malloc_debug) {\n        CRYPTO_mem_debug_malloc(NULL, num, 0, file, line);\n        ret = malloc(num);\n        CRYPTO_mem_debug_malloc(ret, num, 1, file, line);\n    } else {\n        ret = malloc(num);\n    }\n#else\n    (void)(file); (void)(line);\n    ret = malloc(num);\n#endif\n    return ret;\n}']