crypto/txt_db/txt_db.c:233: error: NULL_DEREFERENCE
  pointer `buf` last assigned on line 197 could be null and is dereferenced by call to `BUF_MEM_free()` at line 233, column 5.
Showing all 31 steps of the trace


crypto/txt_db/txt_db.c:190:1: start of procedure TXT_DB_write()
188.   }
189.   
190. > long TXT_DB_write(BIO *out, TXT_DB *db)
191.   {
192.       long i, j, n, nn, l, tot = 0;

crypto/txt_db/txt_db.c:192:5: 
190.   long TXT_DB_write(BIO *out, TXT_DB *db)
191.   {
192. >     long i, j, n, nn, l, tot = 0;
193.       char *p, **pp, *f;
194.       BUF_MEM *buf = NULL;

crypto/txt_db/txt_db.c:194:5: 
192.       long i, j, n, nn, l, tot = 0;
193.       char *p, **pp, *f;
194. >     BUF_MEM *buf = NULL;
195.       long ret = -1;
196.   

crypto/txt_db/txt_db.c:195:5: 
193.       char *p, **pp, *f;
194.       BUF_MEM *buf = NULL;
195. >     long ret = -1;
196.   
197.       if ((buf = BUF_MEM_new()) == NULL)

crypto/txt_db/txt_db.c:197:9: 
195.       long ret = -1;
196.   
197. >     if ((buf = BUF_MEM_new()) == NULL)
198.           goto err;
199.       n = sk_OPENSSL_PSTRING_num(db->data);

crypto/buffer/buffer.c:31:1: start of procedure BUF_MEM_new()
  29.   }
  30.   
  31. > BUF_MEM *BUF_MEM_new(void)
  32.   {
  33.       BUF_MEM *ret;

crypto/buffer/buffer.c:35:5: 
  33.       BUF_MEM *ret;
  34.   
  35. >     ret = OPENSSL_zalloc(sizeof(*ret));
  36.       if (ret == NULL) {
  37.           BUFerr(BUF_F_BUF_MEM_NEW, ERR_R_MALLOC_FAILURE);

crypto/mem.c:228:1: start of procedure CRYPTO_zalloc()
    226.   }
    227.   
    228. > void *CRYPTO_zalloc(size_t num, const char *file, int line)
    229.   {
    230.       void *ret = CRYPTO_malloc(num, file, line);

crypto/mem.c:230:5: 
    228.   void *CRYPTO_zalloc(size_t num, const char *file, int line)
    229.   {
    230. >     void *ret = CRYPTO_malloc(num, file, line);
    231.   
    232.       FAILTEST();

crypto/mem.c:192:1: start of procedure CRYPTO_malloc()
      190.   #endif
      191.   
      192. > void *CRYPTO_malloc(size_t num, const char *file, int line)
      193.   {
      194.       void *ret = NULL;

crypto/mem.c:194:5: 
      192.   void *CRYPTO_malloc(size_t num, const char *file, int line)
      193.   {
      194. >     void *ret = NULL;
      195.   
      196.       INCREMENT(malloc_count);

crypto/mem.c:197:9: Taking false branch
      195.   
      196.       INCREMENT(malloc_count);
      197.       if (malloc_impl != NULL && malloc_impl != CRYPTO_malloc)
                     ^
      198.           return malloc_impl(num, file, line);
      199.   

crypto/mem.c:200:9: Taking false branch
      198.           return malloc_impl(num, file, line);
      199.   
      200.       if (num == 0)
                     ^
      201.           return NULL;
      202.   

crypto/mem.c:204:9: Taking false branch
      202.   
      203.       FAILTEST();
      204.       if (allow_customize) {
                     ^
      205.           /*
      206.            * Disallow customization after the first allocation. We only set this

crypto/mem.c:221:5: 
      219.       }
      220.   #else
      221. >     (void)(file); (void)(line);
      222.       ret = malloc(num);
      223.   #endif

crypto/mem.c:221:19: 
      219.       }
      220.   #else
      221. >     (void)(file); (void)(line);
      222.       ret = malloc(num);
      223.   #endif

crypto/mem.c:222:5: 
      220.   #else
      221.       (void)(file); (void)(line);
      222. >     ret = malloc(num);
      223.   #endif
      224.   

crypto/mem.c:225:5: 
      223.   #endif
      224.   
      225. >     return ret;
      226.   }
      227.   

crypto/mem.c:226:1: return from a call to CRYPTO_malloc
      224.   
      225.       return ret;
      226. > }
      227.   
      228.   void *CRYPTO_zalloc(size_t num, const char *file, int line)

crypto/mem.c:233:9: Taking false branch
    231.   
    232.       FAILTEST();
    233.       if (ret != NULL)
                   ^
    234.           memset(ret, 0, num);
    235.       return ret;

crypto/mem.c:235:5: 
    233.       if (ret != NULL)
    234.           memset(ret, 0, num);
    235. >     return ret;
    236.   }
    237.   

crypto/mem.c:236:1: return from a call to CRYPTO_zalloc
    234.           memset(ret, 0, num);
    235.       return ret;
    236. > }
    237.   
    238.   void *CRYPTO_realloc(void *str, size_t num, const char *file, int line)

crypto/buffer/buffer.c:36:9: Taking true branch
  34.   
  35.       ret = OPENSSL_zalloc(sizeof(*ret));
  36.       if (ret == NULL) {
                ^
  37.           BUFerr(BUF_F_BUF_MEM_NEW, ERR_R_MALLOC_FAILURE);
  38.           return NULL;

crypto/buffer/buffer.c:37:9: Skipping ERR_put_error(): empty list of specs
  35.       ret = OPENSSL_zalloc(sizeof(*ret));
  36.       if (ret == NULL) {
  37.           BUFerr(BUF_F_BUF_MEM_NEW, ERR_R_MALLOC_FAILURE);
                ^
  38.           return NULL;
  39.       }

crypto/buffer/buffer.c:38:9: 
  36.       if (ret == NULL) {
  37.           BUFerr(BUF_F_BUF_MEM_NEW, ERR_R_MALLOC_FAILURE);
  38. >         return NULL;
  39.       }
  40.       return ret;

crypto/buffer/buffer.c:41:1: return from a call to BUF_MEM_new
  39.       }
  40.       return ret;
  41. > }
  42.   
  43.   void BUF_MEM_free(BUF_MEM *a)

crypto/txt_db/txt_db.c:197:9: Taking true branch
195.       long ret = -1;
196.   
197.       if ((buf = BUF_MEM_new()) == NULL)
               ^
198.           goto err;
199.       n = sk_OPENSSL_PSTRING_num(db->data);

crypto/txt_db/txt_db.c:232:2: 
230.       }
231.       ret = tot;
232. >  err:
233.       BUF_MEM_free(buf);
234.       return ret;

crypto/txt_db/txt_db.c:233:5: 
231.       ret = tot;
232.    err:
233. >     BUF_MEM_free(buf);
234.       return ret;
235.   }

crypto/buffer/buffer.c:43:1: start of procedure BUF_MEM_free()
  41.   }
  42.   
  43. > void BUF_MEM_free(BUF_MEM *a)
  44.   {
  45.       if (a->data != NULL) {

crypto/buffer/buffer.c:45:9: 
  43.   void BUF_MEM_free(BUF_MEM *a)
  44.   {
  45. >     if (a->data != NULL) {
  46.           if (a->flags & BUF_MEM_FLAG_SECURE)
  47.               OPENSSL_secure_clear_free(a->data, a->max);

long TXT_DB_write(BIO *out, TXT_DB *db)
{
    long i, j, n, nn, l, tot = 0;
    char *p, **pp, *f;
    BUF_MEM *buf = NULL;
    long ret = -1;
    if ((buf = BUF_MEM_new()) == NULL)
        goto err;
    n = sk_OPENSSL_PSTRING_num(db->data);
    nn = db->num_fields;
    for (i = 0; i < n; i++) {
        pp = sk_OPENSSL_PSTRING_value(db->data, i);
        l = 0;
        for (j = 0; j < nn; j++) {
            if (pp[j] != NULL)
                l += strlen(pp[j]);
        }
        if (!BUF_MEM_grow_clean(buf, (int)(l * 2 + nn)))
            goto err;
        p = buf->data;
        for (j = 0; j < nn; j++) {
            f = pp[j];
            if (f != NULL)
                for (;;) {
                    if (*f == '\0')
                        break;
                    if (*f == '\t')
                        *(p++) = '\\';
                    *(p++) = *(f++);
                }
            *(p++) = '\t';
        }
        p[-1] = '\n';
        j = p - buf->data;
        if (BIO_write(out, buf->data, (int)j) != j)
            goto err;
        tot += j;
    }
    ret = tot;
 err:
    BUF_MEM_free(buf);
    return ret;
}
["long TXT_DB_write(BIO *out, TXT_DB *db)\n{\n    long i, j, n, nn, l, tot = 0;\n    char *p, **pp, *f;\n    BUF_MEM *buf = NULL;\n    long ret = -1;\n    if ((buf = BUF_MEM_new()) == NULL)\n        goto err;\n    n = sk_OPENSSL_PSTRING_num(db->data);\n    nn = db->num_fields;\n    for (i = 0; i < n; i++) {\n        pp = sk_OPENSSL_PSTRING_value(db->data, i);\n        l = 0;\n        for (j = 0; j < nn; j++) {\n            if (pp[j] != NULL)\n                l += strlen(pp[j]);\n        }\n        if (!BUF_MEM_grow_clean(buf, (int)(l * 2 + nn)))\n            goto err;\n        p = buf->data;\n        for (j = 0; j < nn; j++) {\n            f = pp[j];\n            if (f != NULL)\n                for (;;) {\n                    if (*f == '\\0')\n                        break;\n                    if (*f == '\\t')\n                        *(p++) = '\\\\';\n                    *(p++) = *(f++);\n                }\n            *(p++) = '\\t';\n        }\n        p[-1] = '\\n';\n        j = p - buf->data;\n        if (BIO_write(out, buf->data, (int)j) != j)\n            goto err;\n        tot += j;\n    }\n    ret = tot;\n err:\n    BUF_MEM_free(buf);\n    return ret;\n}", 'BUF_MEM *BUF_MEM_new(void)\n{\n    BUF_MEM *ret;\n    ret = OPENSSL_zalloc(sizeof(*ret));\n    if (ret == NULL) {\n        BUFerr(BUF_F_BUF_MEM_NEW, ERR_R_MALLOC_FAILURE);\n        return NULL;\n    }\n    return ret;\n}', 'void *CRYPTO_zalloc(size_t num, const char *file, int line)\n{\n    void *ret = CRYPTO_malloc(num, file, line);\n    FAILTEST();\n    if (ret != NULL)\n        memset(ret, 0, num);\n    return ret;\n}', 'void *CRYPTO_malloc(size_t num, const char *file, int line)\n{\n    void *ret = NULL;\n    INCREMENT(malloc_count);\n    if (malloc_impl != NULL && malloc_impl != CRYPTO_malloc)\n        return malloc_impl(num, file, line);\n    if (num == 0)\n        return NULL;\n    FAILTEST();\n    if (allow_customize) {\n        allow_customize = 0;\n    }\n#ifndef OPENSSL_NO_CRYPTO_MDEBUG\n    if (call_malloc_debug) {\n        CRYPTO_mem_debug_malloc(NULL, num, 0, file, line);\n        ret = malloc(num);\n        CRYPTO_mem_debug_malloc(ret, num, 1, file, line);\n    } else {\n        ret = malloc(num);\n    }\n#else\n    (void)(file); (void)(line);\n    ret = malloc(num);\n#endif\n    return ret;\n}', 'void BUF_MEM_free(BUF_MEM *a)\n{\n    if (a->data != NULL) {\n        if (a->flags & BUF_MEM_FLAG_SECURE)\n            OPENSSL_secure_clear_free(a->data, a->max);\n        else\n            OPENSSL_clear_free(a->data, a->max);\n    }\n    OPENSSL_free(a);\n}']