crypto/evp/evp_lib.c:374: error: NULL_DEREFERENCE
  pointer `to` last assigned on line 372 could be null and is dereferenced by call to `memcpy()` at line 374, column 9.
Showing all 23 steps of the trace


crypto/evp/evp_lib.c:370:1: start of procedure EVP_MD_meth_dup()
368.       return md;
369.   }
370. > EVP_MD *EVP_MD_meth_dup(const EVP_MD *md)
371.   {
372.       EVP_MD *to = EVP_MD_meth_new(md->type, md->pkey_type);

crypto/evp/evp_lib.c:372:5: 
370.   EVP_MD *EVP_MD_meth_dup(const EVP_MD *md)
371.   {
372. >     EVP_MD *to = EVP_MD_meth_new(md->type, md->pkey_type);
373.       if (md != NULL)
374.           memcpy(to, md, sizeof(*to));

crypto/evp/evp_lib.c:361:1: start of procedure EVP_MD_meth_new()
  359.   }
  360.   
  361. > EVP_MD *EVP_MD_meth_new(int md_type, int pkey_type)
  362.   {
  363.       EVP_MD *md = (EVP_MD *)OPENSSL_zalloc(sizeof(EVP_MD));

crypto/evp/evp_lib.c:363:5: 
  361.   EVP_MD *EVP_MD_meth_new(int md_type, int pkey_type)
  362.   {
  363. >     EVP_MD *md = (EVP_MD *)OPENSSL_zalloc(sizeof(EVP_MD));
  364.       if (md != NULL) {
  365.           md->type = md_type;

crypto/mem.c:157:1: start of procedure CRYPTO_zalloc()
    155.   }
    156.   
    157. > void *CRYPTO_zalloc(size_t num, const char *file, int line)
    158.   {
    159.       void *ret = CRYPTO_malloc(num, file, line);

crypto/mem.c:159:5: 
    157.   void *CRYPTO_zalloc(size_t num, const char *file, int line)
    158.   {
    159. >     void *ret = CRYPTO_malloc(num, file, line);
    160.   
    161.       if (ret != NULL)

crypto/mem.c:120:1: start of procedure CRYPTO_malloc()
      118.   }
      119.   
      120. > void *CRYPTO_malloc(size_t num, const char *file, int line)
      121.   {
      122.       void *ret = NULL;

crypto/mem.c:122:5: 
      120.   void *CRYPTO_malloc(size_t num, const char *file, int line)
      121.   {
      122. >     void *ret = NULL;
      123.   
      124.       if (num <= 0)

crypto/mem.c:124:9: Taking false branch
      122.       void *ret = NULL;
      123.   
      124.       if (num <= 0)
                     ^
      125.           return NULL;
      126.   

crypto/mem.c:127:5: 
      125.           return NULL;
      126.   
      127. >     allow_customize = 0;
      128.   #ifndef OPENSSL_NO_CRYPTO_MDEBUG
      129.       if (call_malloc_debug) {

crypto/mem.c:137:5: 
      135.       }
      136.   #else
      137. >     (void)file;
      138.       (void)line;
      139.       ret = malloc(num);

crypto/mem.c:138:5: 
      136.   #else
      137.       (void)file;
      138. >     (void)line;
      139.       ret = malloc(num);
      140.   #endif

crypto/mem.c:139:5: 
      137.       (void)file;
      138.       (void)line;
      139. >     ret = malloc(num);
      140.   #endif
      141.   

crypto/mem.c:154:5: 
      152.   #endif
      153.   
      154. >     return ret;
      155.   }
      156.   

crypto/mem.c:155:1: return from a call to CRYPTO_malloc
      153.   
      154.       return ret;
      155. > }
      156.   
      157.   void *CRYPTO_zalloc(size_t num, const char *file, int line)

crypto/mem.c:161:9: Taking false branch
    159.       void *ret = CRYPTO_malloc(num, file, line);
    160.   
    161.       if (ret != NULL)
                   ^
    162.           memset(ret, 0, num);
    163.       return ret;

crypto/mem.c:163:5: 
    161.       if (ret != NULL)
    162.           memset(ret, 0, num);
    163. >     return ret;
    164.   }
    165.   

crypto/mem.c:164:1: return from a call to CRYPTO_zalloc
    162.           memset(ret, 0, num);
    163.       return ret;
    164. > }
    165.   
    166.   void *CRYPTO_realloc(void *str, size_t num, const char *file, int line)

crypto/evp/evp_lib.c:364:9: Taking false branch
  362.   {
  363.       EVP_MD *md = (EVP_MD *)OPENSSL_zalloc(sizeof(EVP_MD));
  364.       if (md != NULL) {
                 ^
  365.           md->type = md_type;
  366.           md->pkey_type = pkey_type;

crypto/evp/evp_lib.c:368:5: 
  366.           md->pkey_type = pkey_type;
  367.       }
  368. >     return md;
  369.   }
  370.   EVP_MD *EVP_MD_meth_dup(const EVP_MD *md)

crypto/evp/evp_lib.c:369:1: return from a call to EVP_MD_meth_new
  367.       }
  368.       return md;
  369. > }
  370.   EVP_MD *EVP_MD_meth_dup(const EVP_MD *md)
  371.   {

crypto/evp/evp_lib.c:373:9: Taking true branch
371.   {
372.       EVP_MD *to = EVP_MD_meth_new(md->type, md->pkey_type);
373.       if (md != NULL)
               ^
374.           memcpy(to, md, sizeof(*to));
375.       return to;

crypto/evp/evp_lib.c:374:9: 
372.       EVP_MD *to = EVP_MD_meth_new(md->type, md->pkey_type);
373.       if (md != NULL)
374. >         memcpy(to, md, sizeof(*to));
375.       return to;
376.   }

EVP_MD *EVP_MD_meth_dup(const EVP_MD *md)
{
    EVP_MD *to = EVP_MD_meth_new(md->type, md->pkey_type);
    if (md != NULL)
        memcpy(to, md, sizeof(*to));
    return to;
}
['EVP_MD *EVP_MD_meth_dup(const EVP_MD *md)\n{\n    EVP_MD *to = EVP_MD_meth_new(md->type, md->pkey_type);\n    if (md != NULL)\n        memcpy(to, md, sizeof(*to));\n    return to;\n}', 'EVP_MD *EVP_MD_meth_new(int md_type, int pkey_type)\n{\n    EVP_MD *md = (EVP_MD *)OPENSSL_zalloc(sizeof(EVP_MD));\n    if (md != NULL) {\n        md->type = md_type;\n        md->pkey_type = pkey_type;\n    }\n    return md;\n}', 'void *CRYPTO_zalloc(size_t num, const char *file, int line)\n{\n    void *ret = CRYPTO_malloc(num, file, line);\n    if (ret != NULL)\n        memset(ret, 0, num);\n    return ret;\n}', 'void *CRYPTO_malloc(size_t num, const char *file, int line)\n{\n    void *ret = NULL;\n    if (num <= 0)\n        return NULL;\n    allow_customize = 0;\n#ifndef OPENSSL_NO_CRYPTO_MDEBUG\n    if (call_malloc_debug) {\n        CRYPTO_mem_debug_malloc(NULL, num, 0, file, line);\n        ret = malloc(num);\n        CRYPTO_mem_debug_malloc(ret, num, 1, file, line);\n    } else {\n        ret = malloc(num);\n    }\n#else\n    (void)file;\n    (void)line;\n    ret = malloc(num);\n#endif\n#ifndef OPENSSL_CPUID_OBJ\n    if (ret && (num > 2048)) {\n        extern unsigned char cleanse_ctr;\n        ((unsigned char *)ret)[0] = cleanse_ctr;\n    }\n#endif\n    return ret;\n}']