src/os/unix/ngx_readv_chain.c:70: error: Null Dereference
  pointer `iov` last assigned on line 57 could be null and is dereferenced at line 70, column 13.

src/os/unix/ngx_readv_chain.c:13:1: start of procedure ngx_readv_chain()
11. 
12. 
13. ssize_t
    ^
14. ngx_readv_chain(ngx_connection_t *c, ngx_chain_t *chain)
15. {

src/os/unix/ngx_readv_chain.c:23:5: 
21.     struct iovec  *iov, iovs[NGX_IOVS_PREALLOCATE];
22. 
23.     rev = c->read;
        ^
24. 
25. #if (NGX_HAVE_KQUEUE)

src/os/unix/ngx_readv_chain.c:56:5: 
54. #endif
55. 
56.     prev = NULL;
        ^
57.     iov = NULL;
58.     size = 0;

src/os/unix/ngx_readv_chain.c:57:5: 
55. 
56.     prev = NULL;
57.     iov = NULL;
        ^
58.     size = 0;
59. 

src/os/unix/ngx_readv_chain.c:58:5: 
56.     prev = NULL;
57.     iov = NULL;
58.     size = 0;
        ^
59. 
60.     vec.elts = iovs;

src/os/unix/ngx_readv_chain.c:60:5: 
58.     size = 0;
59. 
60.     vec.elts = iovs;
        ^
61.     vec.nelts = 0;
62.     vec.size = sizeof(struct iovec);

src/os/unix/ngx_readv_chain.c:61:5: 
59. 
60.     vec.elts = iovs;
61.     vec.nelts = 0;
        ^
62.     vec.size = sizeof(struct iovec);
63.     vec.nalloc = NGX_IOVS_PREALLOCATE;

src/os/unix/ngx_readv_chain.c:62:5: 
60.     vec.elts = iovs;
61.     vec.nelts = 0;
62.     vec.size = sizeof(struct iovec);
        ^
63.     vec.nalloc = NGX_IOVS_PREALLOCATE;
64.     vec.pool = c->pool;

src/os/unix/ngx_readv_chain.c:63:5: 
61.     vec.nelts = 0;
62.     vec.size = sizeof(struct iovec);
63.     vec.nalloc = NGX_IOVS_PREALLOCATE;
        ^
64.     vec.pool = c->pool;
65. 

src/os/unix/ngx_readv_chain.c:64:5: 
62.     vec.size = sizeof(struct iovec);
63.     vec.nalloc = NGX_IOVS_PREALLOCATE;
64.     vec.pool = c->pool;
        ^
65. 
66.     /* coalesce the neighbouring bufs */

src/os/unix/ngx_readv_chain.c:68:12: Loop condition is true. Entering loop body
66.     /* coalesce the neighbouring bufs */
67. 
68.     while (chain) {
               ^
69.         if (prev == chain->buf->last) {
70.             iov->iov_len += chain->buf->end - chain->buf->last;

src/os/unix/ngx_readv_chain.c:69:13: Taking true branch
67. 
68.     while (chain) {
69.         if (prev == chain->buf->last) {
                ^
70.             iov->iov_len += chain->buf->end - chain->buf->last;
71. 

src/os/unix/ngx_readv_chain.c:70:13: 
68.     while (chain) {
69.         if (prev == chain->buf->last) {
70.             iov->iov_len += chain->buf->end - chain->buf->last;
                ^
71. 
72.         } else {

ssize_t
ngx_readv_chain(ngx_connection_t *c, ngx_chain_t *chain)
{
    u_char        *prev;
    ssize_t        n, size;
    ngx_err_t      err;
    ngx_array_t    vec;
    ngx_event_t   *rev;
    struct iovec  *iov, iovs[NGX_IOVS_PREALLOCATE];
    rev = c->read;
#if (NGX_HAVE_KQUEUE)
    if (ngx_event_flags & NGX_USE_KQUEUE_EVENT) {
        ngx_log_debug3(NGX_LOG_DEBUG_EVENT, c->log, 0,
                       "readv: eof:%d, avail:%d, err:%d",
                       rev->pending_eof, rev->available, rev->kq_errno);
        if (rev->available == 0) {
            if (rev->pending_eof) {
                rev->ready = 0;
                rev->eof = 1;
                ngx_log_error(NGX_LOG_INFO, c->log, rev->kq_errno,
                              "kevent() reported about an closed connection");
                if (rev->kq_errno) {
                    rev->error = 1;
                    ngx_set_socket_errno(rev->kq_errno);
                    return NGX_ERROR;
                }
                return 0;
            } else {
                return NGX_AGAIN;
            }
        }
    }
#endif
    prev = NULL;
    iov = NULL;
    size = 0;
    vec.elts = iovs;
    vec.nelts = 0;
    vec.size = sizeof(struct iovec);
    vec.nalloc = NGX_IOVS_PREALLOCATE;
    vec.pool = c->pool;
    while (chain) {
        if (prev == chain->buf->last) {
            iov->iov_len += chain->buf->end - chain->buf->last;
        } else {
            if (vec.nelts >= IOV_MAX) {
                break;
            }
            iov = ngx_array_push(&vec);
            if (iov == NULL) {
                return NGX_ERROR;
            }
            iov->iov_base = (void *) chain->buf->last;
            iov->iov_len = chain->buf->end - chain->buf->last;
        }
        size += chain->buf->end - chain->buf->last;
        prev = chain->buf->end;
        chain = chain->next;
    }
    ngx_log_debug2(NGX_LOG_DEBUG_EVENT, c->log, 0,
                   "readv: %d, last:%d", vec.nelts, iov->iov_len);
    do {
        n = readv(c->fd, (struct iovec *) vec.elts, vec.nelts);
        if (n >= 0) {
#if (NGX_HAVE_KQUEUE)
            if (ngx_event_flags & NGX_USE_KQUEUE_EVENT) {
                rev->available -= n;
                if (rev->available <= 0) {
                    if (!rev->pending_eof) {
                        rev->ready = 0;
                    }
                    if (rev->available < 0) {
                        rev->available = 0;
                    }
                }
                if (n == 0) {
#if 0
                    ngx_log_error(NGX_LOG_ALERT, c->log, 0,
                                  "readv() returned 0 while kevent() reported "
                                  "%d available bytes", rev->available);
#endif
                    rev->ready = 0;
                    rev->eof = 1;
                    rev->available = 0;
                }
                return n;
            }
#endif
            if (n < size && !(ngx_event_flags & NGX_USE_GREEDY_EVENT)) {
                rev->ready = 0;
            }
            if (n == 0) {
                rev->eof = 1;
            }
            return n;
        }
        err = ngx_socket_errno;
        if (err == NGX_EAGAIN || err == NGX_EINTR) {
            ngx_log_debug0(NGX_LOG_DEBUG_EVENT, c->log, err,
                           "readv() not ready");
            n = NGX_AGAIN;
        } else {
            n = ngx_connection_error(c, err, "readv() failed");
            break;
        }
    } while (err == NGX_EINTR);
    rev->ready = 0;
    if (n == NGX_ERROR) {
        c->read->error = 1;
    }
    return n;
}
['ssize_t\nngx_readv_chain(ngx_connection_t *c, ngx_chain_t *chain)\n{\n    u_char        *prev;\n    ssize_t        n, size;\n    ngx_err_t      err;\n    ngx_array_t    vec;\n    ngx_event_t   *rev;\n    struct iovec  *iov, iovs[NGX_IOVS_PREALLOCATE];\n    rev = c->read;\n#if (NGX_HAVE_KQUEUE)\n    if (ngx_event_flags & NGX_USE_KQUEUE_EVENT) {\n        ngx_log_debug3(NGX_LOG_DEBUG_EVENT, c->log, 0,\n                       "readv: eof:%d, avail:%d, err:%d",\n                       rev->pending_eof, rev->available, rev->kq_errno);\n        if (rev->available == 0) {\n            if (rev->pending_eof) {\n                rev->ready = 0;\n                rev->eof = 1;\n                ngx_log_error(NGX_LOG_INFO, c->log, rev->kq_errno,\n                              "kevent() reported about an closed connection");\n                if (rev->kq_errno) {\n                    rev->error = 1;\n                    ngx_set_socket_errno(rev->kq_errno);\n                    return NGX_ERROR;\n                }\n                return 0;\n            } else {\n                return NGX_AGAIN;\n            }\n        }\n    }\n#endif\n    prev = NULL;\n    iov = NULL;\n    size = 0;\n    vec.elts = iovs;\n    vec.nelts = 0;\n    vec.size = sizeof(struct iovec);\n    vec.nalloc = NGX_IOVS_PREALLOCATE;\n    vec.pool = c->pool;\n    while (chain) {\n        if (prev == chain->buf->last) {\n            iov->iov_len += chain->buf->end - chain->buf->last;\n        } else {\n            if (vec.nelts >= IOV_MAX) {\n                break;\n            }\n            iov = ngx_array_push(&vec);\n            if (iov == NULL) {\n                return NGX_ERROR;\n            }\n            iov->iov_base = (void *) chain->buf->last;\n            iov->iov_len = chain->buf->end - chain->buf->last;\n        }\n        size += chain->buf->end - chain->buf->last;\n        prev = chain->buf->end;\n        chain = chain->next;\n    }\n    ngx_log_debug2(NGX_LOG_DEBUG_EVENT, c->log, 0,\n                   "readv: %d, last:%d", vec.nelts, iov->iov_len);\n    do {\n        n = readv(c->fd, (struct iovec *) vec.elts, vec.nelts);\n        if (n >= 0) {\n#if (NGX_HAVE_KQUEUE)\n            if (ngx_event_flags & NGX_USE_KQUEUE_EVENT) {\n                rev->available -= n;\n                if (rev->available <= 0) {\n                    if (!rev->pending_eof) {\n                        rev->ready = 0;\n                    }\n                    if (rev->available < 0) {\n                        rev->available = 0;\n                    }\n                }\n                if (n == 0) {\n#if 0\n                    ngx_log_error(NGX_LOG_ALERT, c->log, 0,\n                                  "readv() returned 0 while kevent() reported "\n                                  "%d available bytes", rev->available);\n#endif\n                    rev->ready = 0;\n                    rev->eof = 1;\n                    rev->available = 0;\n                }\n                return n;\n            }\n#endif\n            if (n < size && !(ngx_event_flags & NGX_USE_GREEDY_EVENT)) {\n                rev->ready = 0;\n            }\n            if (n == 0) {\n                rev->eof = 1;\n            }\n            return n;\n        }\n        err = ngx_socket_errno;\n        if (err == NGX_EAGAIN || err == NGX_EINTR) {\n            ngx_log_debug0(NGX_LOG_DEBUG_EVENT, c->log, err,\n                           "readv() not ready");\n            n = NGX_AGAIN;\n        } else {\n            n = ngx_connection_error(c, err, "readv() failed");\n            break;\n        }\n    } while (err == NGX_EINTR);\n    rev->ready = 0;\n    if (n == NGX_ERROR) {\n        c->read->error = 1;\n    }\n    return n;\n}']