src/core/nginx.c:550: error: Null Dereference
  pointer `var` last assigned on line 546 could be null and is dereferenced by call to `memcpy()` at line 550, column 9.

src/core/nginx.c:525:1: start of procedure ngx_exec_new_binary()
523. 
524. 
525. ngx_pid_t
     ^
526. ngx_exec_new_binary(ngx_cycle_t *cycle, char *const *argv)
527. {

src/core/nginx.c:536:5: 
534.     ngx_listening_t   *ls;
535. 
536.     ctx.path = argv[0];
         ^
537.     ctx.name = "new binary process";
538.     ctx.argv = argv;

src/core/nginx.c:537:5: 
535. 
536.     ctx.path = argv[0];
537.     ctx.name = "new binary process";
         ^
538.     ctx.argv = argv;
539. 

src/core/nginx.c:538:5: 
536.     ctx.path = argv[0];
537.     ctx.name = "new binary process";
538.     ctx.argv = argv;
         ^
539. 
540.     n = 2;

src/core/nginx.c:540:5: 
538.     ctx.argv = argv;
539. 
540.     n = 2;
         ^
541.     env = ngx_set_environment(cycle, &n);
542.     if (env == NULL) {

src/core/nginx.c:541:5: Skipping ngx_set_environment(): empty list of specs
539. 
540.     n = 2;
541.     env = ngx_set_environment(cycle, &n);
         ^
542.     if (env == NULL) {
543.         return NGX_INVALID_PID;

src/core/nginx.c:542:9: Taking false branch
540.     n = 2;
541.     env = ngx_set_environment(cycle, &n);
542.     if (env == NULL) {
             ^
543.         return NGX_INVALID_PID;
544.     }

src/core/nginx.c:546:5: 
544.     }
545. 
546.     var = ngx_alloc(sizeof(NGINX_VAR)
         ^
547.                     + cycle->listening.nelts * (NGX_INT32_LEN + 1) + 2,
548.                     cycle->log);

src/os/unix/ngx_alloc.c:16:1: start of procedure ngx_alloc()
  14. 
  15. 
  16. void *
      ^
  17. ngx_alloc(size_t size, ngx_log_t *log)
  18. {

src/os/unix/ngx_alloc.c:21:5: 
  19.     void  *p;
  20. 
  21.     p = malloc(size);
          ^
  22.     if (p == NULL) {
  23.         ngx_log_error(NGX_LOG_EMERG, log, ngx_errno,

src/os/unix/ngx_alloc.c:22:9: Taking true branch
  20. 
  21.     p = malloc(size);
  22.     if (p == NULL) {
              ^
  23.         ngx_log_error(NGX_LOG_EMERG, log, ngx_errno,
  24.                       "malloc() %uz bytes failed", size);

src/os/unix/ngx_alloc.c:23:9: Taking true branch
  21.     p = malloc(size);
  22.     if (p == NULL) {
  23.         ngx_log_error(NGX_LOG_EMERG, log, ngx_errno,
              ^
  24.                       "malloc() %uz bytes failed", size);
  25.     }

src/os/unix/ngx_alloc.c:29:5: 
  27.     ngx_log_debug2(NGX_LOG_DEBUG_ALLOC, log, 0, "malloc: %p:%uz", p, size);
  28. 
  29.     return p;
          ^
  30. }
  31. 

src/os/unix/ngx_alloc.c:30:1: return from a call to ngx_alloc
  28. 
  29.     return p;
  30. }
      ^
  31. 
  32. 

src/core/nginx.c:550:5: 
548.                     cycle->log);
549. 
550.     p = ngx_cpymem(var, NGINX_VAR "=", sizeof(NGINX_VAR));
         ^
551. 
552.     ls = cycle->listening.elts;

ngx_pid_t
ngx_exec_new_binary(ngx_cycle_t *cycle, char *const *argv)
{
    char             **env, *var;
    u_char            *p;
    ngx_uint_t         i, n;
    ngx_pid_t          pid;
    ngx_exec_ctx_t     ctx;
    ngx_core_conf_t   *ccf;
    ngx_listening_t   *ls;
    ctx.path = argv[0];
    ctx.name = "new binary process";
    ctx.argv = argv;
    n = 2;
    env = ngx_set_environment(cycle, &n);
    if (env == NULL) {
        return NGX_INVALID_PID;
    }
    var = ngx_alloc(sizeof(NGINX_VAR)
                    + cycle->listening.nelts * (NGX_INT32_LEN + 1) + 2,
                    cycle->log);
    p = ngx_cpymem(var, NGINX_VAR "=", sizeof(NGINX_VAR));
    ls = cycle->listening.elts;
    for (i = 0; i < cycle->listening.nelts; i++) {
        p = ngx_sprintf(p, "%ud;", ls[i].fd);
    }
    *p = '\0';
    env[n++] = var;
#if (NGX_SETPROCTITLE_USES_ENV)
    env[n++] = "SPARE=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
               "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
               "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
               "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
               "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX";
#endif
    env[n] = NULL;
#if (NGX_DEBUG)
    {
    char  **e;
    for (e = env; *e; e++) {
        ngx_log_debug1(NGX_LOG_DEBUG_CORE, cycle->log, 0, "env: %s", *e);
    }
    }
#endif
    ctx.envp = (char *const *) env;
    ccf = (ngx_core_conf_t *) ngx_get_conf(cycle->conf_ctx, ngx_core_module);
    if (ngx_rename_file(ccf->pid.data, ccf->oldpid.data) != NGX_OK) {
        ngx_log_error(NGX_LOG_ALERT, cycle->log, ngx_errno,
                      ngx_rename_file_n " %s to %s failed "
                      "before executing new binary process \"%s\"",
                      ccf->pid.data, ccf->oldpid.data, argv[0]);
        ngx_free(env);
        ngx_free(var);
        return NGX_INVALID_PID;
    }
    pid = ngx_execute(cycle, &ctx);
    if (pid == NGX_INVALID_PID) {
        if (ngx_rename_file(ccf->oldpid.data, ccf->pid.data) != NGX_OK) {
            ngx_log_error(NGX_LOG_ALERT, cycle->log, ngx_errno,
                          ngx_rename_file_n " %s back to %s failed after "
                          "the try to execute the new binary process \"%s\"",
                          ccf->oldpid.data, ccf->pid.data, argv[0]);
        }
    }
    ngx_free(env);
    ngx_free(var);
    return pid;
}
['ngx_pid_t\nngx_exec_new_binary(ngx_cycle_t *cycle, char *const *argv)\n{\n    char             **env, *var;\n    u_char            *p;\n    ngx_uint_t         i, n;\n    ngx_pid_t          pid;\n    ngx_exec_ctx_t     ctx;\n    ngx_core_conf_t   *ccf;\n    ngx_listening_t   *ls;\n    ctx.path = argv[0];\n    ctx.name = "new binary process";\n    ctx.argv = argv;\n    n = 2;\n    env = ngx_set_environment(cycle, &n);\n    if (env == NULL) {\n        return NGX_INVALID_PID;\n    }\n    var = ngx_alloc(sizeof(NGINX_VAR)\n                    + cycle->listening.nelts * (NGX_INT32_LEN + 1) + 2,\n                    cycle->log);\n    p = ngx_cpymem(var, NGINX_VAR "=", sizeof(NGINX_VAR));\n    ls = cycle->listening.elts;\n    for (i = 0; i < cycle->listening.nelts; i++) {\n        p = ngx_sprintf(p, "%ud;", ls[i].fd);\n    }\n    *p = \'\\0\';\n    env[n++] = var;\n#if (NGX_SETPROCTITLE_USES_ENV)\n    env[n++] = "SPARE=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"\n               "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"\n               "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"\n               "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"\n               "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX";\n#endif\n    env[n] = NULL;\n#if (NGX_DEBUG)\n    {\n    char  **e;\n    for (e = env; *e; e++) {\n        ngx_log_debug1(NGX_LOG_DEBUG_CORE, cycle->log, 0, "env: %s", *e);\n    }\n    }\n#endif\n    ctx.envp = (char *const *) env;\n    ccf = (ngx_core_conf_t *) ngx_get_conf(cycle->conf_ctx, ngx_core_module);\n    if (ngx_rename_file(ccf->pid.data, ccf->oldpid.data) != NGX_OK) {\n        ngx_log_error(NGX_LOG_ALERT, cycle->log, ngx_errno,\n                      ngx_rename_file_n " %s to %s failed "\n                      "before executing new binary process \\"%s\\"",\n                      ccf->pid.data, ccf->oldpid.data, argv[0]);\n        ngx_free(env);\n        ngx_free(var);\n        return NGX_INVALID_PID;\n    }\n    pid = ngx_execute(cycle, &ctx);\n    if (pid == NGX_INVALID_PID) {\n        if (ngx_rename_file(ccf->oldpid.data, ccf->pid.data) != NGX_OK) {\n            ngx_log_error(NGX_LOG_ALERT, cycle->log, ngx_errno,\n                          ngx_rename_file_n " %s back to %s failed after "\n                          "the try to execute the new binary process \\"%s\\"",\n                          ccf->oldpid.data, ccf->pid.data, argv[0]);\n        }\n    }\n    ngx_free(env);\n    ngx_free(var);\n    return pid;\n}', 'void *\nngx_alloc(size_t size, ngx_log_t *log)\n{\n    void  *p;\n    p = malloc(size);\n    if (p == NULL) {\n        ngx_log_error(NGX_LOG_EMERG, log, ngx_errno,\n                      "malloc() %uz bytes failed", size);\n    }\n    ngx_log_debug2(NGX_LOG_DEBUG_ALLOC, log, 0, "malloc: %p:%uz", p, size);\n    return p;\n}']