crypto/x509/x509_obj.c:82: error: NULL_DEREFERENCE
  pointer `b->data` last assigned on line 81 could be null and is dereferenced by call to `BUF_MEM_grow()` at line 82, column 8.
Showing all 27 steps of the trace


crypto/x509/x509_obj.c:66:1: start of procedure X509_NAME_oneline()
64.   #include "buffer.h"
65.   
66. > char *X509_NAME_oneline(X509_NAME *a, char *buf, int len)
67.   	{
68.   	X509_NAME_ENTRY *ne;

crypto/x509/x509_obj.c:74:2: 
72.   	char *p;
73.   	unsigned char *q;
74. > 	BUF_MEM *b=NULL;
75.   	static char hex[17]="0123456789ABCDEF";
76.   	int gs_doit[4];

crypto/x509/x509_obj.c:75:2: 
73.   	unsigned char *q;
74.   	BUF_MEM *b=NULL;
75. > 	static char hex[17]="0123456789ABCDEF";
76.   	int gs_doit[4];
77.   	char tmp_buf[80];

crypto/x509/x509_obj.c:79:6: Taking true branch
77.   	char tmp_buf[80];
78.   
79.   	if (buf == NULL)
           ^
80.   		{
81.   		if ((b=BUF_MEM_new()) == NULL) goto err;

crypto/x509/x509_obj.c:81:7: 
79.   	if (buf == NULL)
80.   		{
81. > 		if ((b=BUF_MEM_new()) == NULL) goto err;
82.   		if (!BUF_MEM_grow(b,200)) goto err;
83.   		b->data[0]='\0';

crypto/buffer/buffer.c:63:1: start of procedure BUF_MEM_new()
  61.   #include "buffer.h"
  62.   
  63. > BUF_MEM *BUF_MEM_new(void)
  64.   	{
  65.   	BUF_MEM *ret;

crypto/buffer/buffer.c:67:2: 
  65.   	BUF_MEM *ret;
  66.   
  67. > 	ret=(BUF_MEM *)Malloc(sizeof(BUF_MEM));
  68.   	if (ret == NULL)
  69.   		{

crypto/buffer/buffer.c:68:6: Taking false branch
  66.   
  67.   	ret=(BUF_MEM *)Malloc(sizeof(BUF_MEM));
  68.   	if (ret == NULL)
             ^
  69.   		{
  70.   		BUFerr(BUF_F_BUF_MEM_NEW,ERR_R_MALLOC_FAILURE);

crypto/buffer/buffer.c:73:2: 
  71.   		return(NULL);
  72.   		}
  73. > 	ret->length=0;
  74.   	ret->max=0;
  75.   	ret->data=NULL;

crypto/buffer/buffer.c:74:2: 
  72.   		}
  73.   	ret->length=0;
  74. > 	ret->max=0;
  75.   	ret->data=NULL;
  76.   	return(ret);

crypto/buffer/buffer.c:75:2: 
  73.   	ret->length=0;
  74.   	ret->max=0;
  75. > 	ret->data=NULL;
  76.   	return(ret);
  77.   	}

crypto/buffer/buffer.c:76:2: 
  74.   	ret->max=0;
  75.   	ret->data=NULL;
  76. > 	return(ret);
  77.   	}
  78.   

crypto/buffer/buffer.c:77:2: return from a call to BUF_MEM_new
  75.   	ret->data=NULL;
  76.   	return(ret);
  77.   	}
         ^
  78.   
  79.   void BUF_MEM_free(BUF_MEM *a)

crypto/x509/x509_obj.c:81:7: Taking false branch
79.   	if (buf == NULL)
80.   		{
81.   		if ((b=BUF_MEM_new()) == NULL) goto err;
            ^
82.   		if (!BUF_MEM_grow(b,200)) goto err;
83.   		b->data[0]='\0';

crypto/x509/x509_obj.c:82:8: 
80.   		{
81.   		if ((b=BUF_MEM_new()) == NULL) goto err;
82. > 		if (!BUF_MEM_grow(b,200)) goto err;
83.   		b->data[0]='\0';
84.   		len=200;

crypto/buffer/buffer.c:92:1: start of procedure BUF_MEM_grow()
  90.   	}
  91.   
  92. > int BUF_MEM_grow(BUF_MEM *str, int len)
  93.   	{
  94.   	char *ret;

crypto/buffer/buffer.c:97:6: Taking false branch
  95.   	unsigned int n;
  96.   
  97.   	if (str->length >= len)
              ^
  98.   		{
  99.   		str->length=len;

crypto/buffer/buffer.c:102:6: Taking false branch
  100.   		return(len);
  101.   		}
  102.   	if (str->max >= len)
              ^
  103.   		{
  104.   		memset(&(str->data[str->length]),0,len-str->length);

crypto/buffer/buffer.c:108:2: 
  106.   		return(len);
  107.   		}
  108. > 	n=(len+3)/3*4;
  109.   	if (str->data == NULL)
  110.   		ret=(char *)Malloc(n);

crypto/buffer/buffer.c:109:6: Taking false branch
  107.   		}
  108.   	n=(len+3)/3*4;
  109.   	if (str->data == NULL)
              ^
  110.   		ret=(char *)Malloc(n);
  111.   	else

crypto/buffer/buffer.c:112:3: 
  110.   		ret=(char *)Malloc(n);
  111.   	else
  112. > 		ret=(char *)Realloc(str->data,n);
  113.   	if (ret == NULL)
  114.   		{

crypto/buffer/buffer.c:113:6: Taking false branch
  111.   	else
  112.   		ret=(char *)Realloc(str->data,n);
  113.   	if (ret == NULL)
              ^
  114.   		{
  115.   		BUFerr(BUF_F_BUF_MEM_GROW,ERR_R_MALLOC_FAILURE);

crypto/buffer/buffer.c:120:3: 
  118.   	else
  119.   		{
  120. > 		str->data=ret;
  121.   		str->length=len;
  122.   		str->max=n;

crypto/buffer/buffer.c:121:3: 
  119.   		{
  120.   		str->data=ret;
  121. > 		str->length=len;
  122.   		str->max=n;
  123.   		}

crypto/buffer/buffer.c:122:3: 
  120.   		str->data=ret;
  121.   		str->length=len;
  122. > 		str->max=n;
  123.   		}
  124.   	return(len);

crypto/buffer/buffer.c:124:2: 
  122.   		str->max=n;
  123.   		}
  124. > 	return(len);
  125.   	}
  126.   

crypto/buffer/buffer.c:125:2: return from a call to BUF_MEM_grow
  123.   		}
  124.   	return(len);
  125.   	}
          ^
  126.   
  127.   char *BUF_strdup(const char *str)

char *X509_NAME_oneline(X509_NAME *a, char *buf, int len)
	{
	X509_NAME_ENTRY *ne;
	unsigned int i;
	int n,lold,l,l1,l2,num,j,type;
	const char *s;
	char *p;
	unsigned char *q;
	BUF_MEM *b=NULL;
	static char hex[17]="0123456789ABCDEF";
	int gs_doit[4];
	char tmp_buf[80];
	if (buf == NULL)
		{
		if ((b=BUF_MEM_new()) == NULL) goto err;
		if (!BUF_MEM_grow(b,200)) goto err;
		b->data[0]='\0';
		len=200;
		}
	if (a == NULL)
	    {
	    if(b)
		{
		buf=b->data;
		Free(b);
		}
	    strncpy(buf,"NO X509_NAME",len);
	    return buf;
	    }
	len--;
	l=0;
	for (i=0; (int)i<sk_num(a->entries); i++)
		{
		ne=(X509_NAME_ENTRY *)sk_value(a->entries,i);
		n=OBJ_obj2nid(ne->object);
		if ((n == NID_undef) || ((s=OBJ_nid2sn(n)) == NULL))
			{
			i2t_ASN1_OBJECT(tmp_buf,sizeof(tmp_buf),ne->object);
			s=tmp_buf;
			}
		l1=strlen(s);
		type=ne->value->type;
		num=ne->value->length;
		q=ne->value->data;
		if ((type == V_ASN1_GENERALSTRING) && ((num%4) == 0))
			{
			gs_doit[0]=gs_doit[1]=gs_doit[2]=gs_doit[3]=0;
			for (j=0; j<num; j++)
				if (q[j] != 0) gs_doit[j&3]=1;
			if (gs_doit[0]|gs_doit[1]|gs_doit[2])
				gs_doit[0]=gs_doit[1]=gs_doit[2]=gs_doit[3]=1;
			else
				{
				gs_doit[0]=gs_doit[1]=gs_doit[2]=0;
				gs_doit[3]=1;
				}
			}
		else
			gs_doit[0]=gs_doit[1]=gs_doit[2]=gs_doit[3]=1;
		for (l2=j=0; j<num; j++)
			{
			if (!gs_doit[j&3]) continue;
			l2++;
			if ((q[j] < ' ') || (q[j] > '~')) l2+=3;
			}
		lold=l;
		l+=1+l1+1+l2;
		if (b != NULL)
			{
			if (!BUF_MEM_grow(b,l+1)) goto err;
			p= &(b->data[lold]);
			}
		else if (l > len)
			{
			break;
			}
		else
			p= &(buf[lold]);
		*(p++)='/';
		memcpy(p,s,(unsigned int)l1); p+=l1;
		*(p++)='=';
		q=ne->value->data;
		for (j=0; j<num; j++)
			{
			if (!gs_doit[j&3]) continue;
			n=q[j];
			if ((n < ' ') || (n > '~'))
				{
				*(p++)='\\';
				*(p++)='x';
				*(p++)=hex[(n>>4)&0x0f];
				*(p++)=hex[n&0x0f];
				}
			else
				*(p++)=n;
			}
		*p='\0';
		}
	if (b != NULL)
		{
		p=b->data;
		Free(b);
		}
	else
		p=buf;
	return(p);
err:
	X509err(X509_F_X509_NAME_ONELINE,ERR_R_MALLOC_FAILURE);
	if (b != NULL) BUF_MEM_free(b);
	return(NULL);
	}
['char *X509_NAME_oneline(X509_NAME *a, char *buf, int len)\n\t{\n\tX509_NAME_ENTRY *ne;\n\tunsigned int i;\n\tint n,lold,l,l1,l2,num,j,type;\n\tconst char *s;\n\tchar *p;\n\tunsigned char *q;\n\tBUF_MEM *b=NULL;\n\tstatic char hex[17]="0123456789ABCDEF";\n\tint gs_doit[4];\n\tchar tmp_buf[80];\n\tif (buf == NULL)\n\t\t{\n\t\tif ((b=BUF_MEM_new()) == NULL) goto err;\n\t\tif (!BUF_MEM_grow(b,200)) goto err;\n\t\tb->data[0]=\'\\0\';\n\t\tlen=200;\n\t\t}\n\tif (a == NULL)\n\t    {\n\t    if(b)\n\t\t{\n\t\tbuf=b->data;\n\t\tFree(b);\n\t\t}\n\t    strncpy(buf,"NO X509_NAME",len);\n\t    return buf;\n\t    }\n\tlen--;\n\tl=0;\n\tfor (i=0; (int)i<sk_num(a->entries); i++)\n\t\t{\n\t\tne=(X509_NAME_ENTRY *)sk_value(a->entries,i);\n\t\tn=OBJ_obj2nid(ne->object);\n\t\tif ((n == NID_undef) || ((s=OBJ_nid2sn(n)) == NULL))\n\t\t\t{\n\t\t\ti2t_ASN1_OBJECT(tmp_buf,sizeof(tmp_buf),ne->object);\n\t\t\ts=tmp_buf;\n\t\t\t}\n\t\tl1=strlen(s);\n\t\ttype=ne->value->type;\n\t\tnum=ne->value->length;\n\t\tq=ne->value->data;\n\t\tif ((type == V_ASN1_GENERALSTRING) && ((num%4) == 0))\n\t\t\t{\n\t\t\tgs_doit[0]=gs_doit[1]=gs_doit[2]=gs_doit[3]=0;\n\t\t\tfor (j=0; j<num; j++)\n\t\t\t\tif (q[j] != 0) gs_doit[j&3]=1;\n\t\t\tif (gs_doit[0]|gs_doit[1]|gs_doit[2])\n\t\t\t\tgs_doit[0]=gs_doit[1]=gs_doit[2]=gs_doit[3]=1;\n\t\t\telse\n\t\t\t\t{\n\t\t\t\tgs_doit[0]=gs_doit[1]=gs_doit[2]=0;\n\t\t\t\tgs_doit[3]=1;\n\t\t\t\t}\n\t\t\t}\n\t\telse\n\t\t\tgs_doit[0]=gs_doit[1]=gs_doit[2]=gs_doit[3]=1;\n\t\tfor (l2=j=0; j<num; j++)\n\t\t\t{\n\t\t\tif (!gs_doit[j&3]) continue;\n\t\t\tl2++;\n\t\t\tif ((q[j] < \' \') || (q[j] > \'~\')) l2+=3;\n\t\t\t}\n\t\tlold=l;\n\t\tl+=1+l1+1+l2;\n\t\tif (b != NULL)\n\t\t\t{\n\t\t\tif (!BUF_MEM_grow(b,l+1)) goto err;\n\t\t\tp= &(b->data[lold]);\n\t\t\t}\n\t\telse if (l > len)\n\t\t\t{\n\t\t\tbreak;\n\t\t\t}\n\t\telse\n\t\t\tp= &(buf[lold]);\n\t\t*(p++)=\'/\';\n\t\tmemcpy(p,s,(unsigned int)l1); p+=l1;\n\t\t*(p++)=\'=\';\n\t\tq=ne->value->data;\n\t\tfor (j=0; j<num; j++)\n\t\t\t{\n\t\t\tif (!gs_doit[j&3]) continue;\n\t\t\tn=q[j];\n\t\t\tif ((n < \' \') || (n > \'~\'))\n\t\t\t\t{\n\t\t\t\t*(p++)=\'\\\\\';\n\t\t\t\t*(p++)=\'x\';\n\t\t\t\t*(p++)=hex[(n>>4)&0x0f];\n\t\t\t\t*(p++)=hex[n&0x0f];\n\t\t\t\t}\n\t\t\telse\n\t\t\t\t*(p++)=n;\n\t\t\t}\n\t\t*p=\'\\0\';\n\t\t}\n\tif (b != NULL)\n\t\t{\n\t\tp=b->data;\n\t\tFree(b);\n\t\t}\n\telse\n\t\tp=buf;\n\treturn(p);\nerr:\n\tX509err(X509_F_X509_NAME_ONELINE,ERR_R_MALLOC_FAILURE);\n\tif (b != NULL) BUF_MEM_free(b);\n\treturn(NULL);\n\t}', 'BUF_MEM *BUF_MEM_new(void)\n\t{\n\tBUF_MEM *ret;\n\tret=(BUF_MEM *)Malloc(sizeof(BUF_MEM));\n\tif (ret == NULL)\n\t\t{\n\t\tBUFerr(BUF_F_BUF_MEM_NEW,ERR_R_MALLOC_FAILURE);\n\t\treturn(NULL);\n\t\t}\n\tret->length=0;\n\tret->max=0;\n\tret->data=NULL;\n\treturn(ret);\n\t}', 'int BUF_MEM_grow(BUF_MEM *str, int len)\n\t{\n\tchar *ret;\n\tunsigned int n;\n\tif (str->length >= len)\n\t\t{\n\t\tstr->length=len;\n\t\treturn(len);\n\t\t}\n\tif (str->max >= len)\n\t\t{\n\t\tmemset(&(str->data[str->length]),0,len-str->length);\n\t\tstr->length=len;\n\t\treturn(len);\n\t\t}\n\tn=(len+3)/3*4;\n\tif (str->data == NULL)\n\t\tret=(char *)Malloc(n);\n\telse\n\t\tret=(char *)Realloc(str->data,n);\n\tif (ret == NULL)\n\t\t{\n\t\tBUFerr(BUF_F_BUF_MEM_GROW,ERR_R_MALLOC_FAILURE);\n\t\tlen=0;\n\t\t}\n\telse\n\t\t{\n\t\tstr->data=ret;\n\t\tstr->length=len;\n\t\tstr->max=n;\n\t\t}\n\treturn(len);\n\t}']