crypto/evp/pmeth_lib.c:122: error: NULL_DEREFERENCE
  pointer `ret` last assigned on line 121 could be null and is dereferenced at line 122, column 2.
Showing all 47 steps of the trace


crypto/evp/pmeth_lib.c:108:1: start of procedure int_ctx_new()
106.   	}
107.   
108. > static EVP_PKEY_CTX *int_ctx_new(EVP_PKEY *pkey, ENGINE *e, int id)
109.   	{
110.   	EVP_PKEY_CTX *ret;

crypto/evp/pmeth_lib.c:112:6: Taking true branch
110.   	EVP_PKEY_CTX *ret;
111.   	const EVP_PKEY_METHOD *pmeth;
112.   	if (id == -1)
            ^
113.   		{
114.   		if (!pkey || !pkey->ameth)

crypto/evp/pmeth_lib.c:114:8: Taking false branch
112.   	if (id == -1)
113.   		{
114.   		if (!pkey || !pkey->ameth)
              ^
115.   			return NULL;
116.   		id = pkey->ameth->pkey_id;

crypto/evp/pmeth_lib.c:114:17: Taking false branch
112.   	if (id == -1)
113.   		{
114.   		if (!pkey || !pkey->ameth)
                       ^
115.   			return NULL;
116.   		id = pkey->ameth->pkey_id;

crypto/evp/pmeth_lib.c:116:3: 
114.   		if (!pkey || !pkey->ameth)
115.   			return NULL;
116. > 		id = pkey->ameth->pkey_id;
117.   		}
118.   	pmeth = EVP_PKEY_meth_find(id, e);

crypto/evp/pmeth_lib.c:118:2: 
116.   		id = pkey->ameth->pkey_id;
117.   		}
118. > 	pmeth = EVP_PKEY_meth_find(id, e);
119.   	if (pmeth == NULL)
120.   		return NULL;

crypto/evp/pmeth_lib.c:86:1: start of procedure EVP_PKEY_meth_find()
  84.   	}
  85.   
  86. > const EVP_PKEY_METHOD *EVP_PKEY_meth_find(int type, ENGINE *e)
  87.   	{
  88.   	EVP_PKEY_METHOD tmp, *t = &tmp, **ret;

crypto/evp/pmeth_lib.c:88:2: 
  86.   const EVP_PKEY_METHOD *EVP_PKEY_meth_find(int type, ENGINE *e)
  87.   	{
  88. > 	EVP_PKEY_METHOD tmp, *t = &tmp, **ret;
  89.   	tmp.pkey_id = type;
  90.   	if (app_pkey_methods)

crypto/evp/pmeth_lib.c:89:2: 
  87.   	{
  88.   	EVP_PKEY_METHOD tmp, *t = &tmp, **ret;
  89. > 	tmp.pkey_id = type;
  90.   	if (app_pkey_methods)
  91.   		{

crypto/evp/pmeth_lib.c:90:6: Taking true branch
  88.   	EVP_PKEY_METHOD tmp, *t = &tmp, **ret;
  89.   	tmp.pkey_id = type;
  90.   	if (app_pkey_methods)
             ^
  91.   		{
  92.   		int idx;

crypto/evp/pmeth_lib.c:93:3: 
  91.   		{
  92.   		int idx;
  93. > 		idx = sk_find(app_pkey_methods, (char *)&tmp);
  94.   		if (idx >= 0)
  95.   			return (EVP_PKEY_METHOD *)

crypto/stack/stack.c:242:1: start of procedure sk_find()
    240.   	}
    241.   
    242. > int sk_find(STACK *st, char *data)
    243.   	{
    244.   	return internal_find(st, data, OBJ_BSEARCH_FIRST_VALUE_ON_MATCH);

crypto/stack/stack.c:244:2: 
    242.   int sk_find(STACK *st, char *data)
    243.   	{
    244. > 	return internal_find(st, data, OBJ_BSEARCH_FIRST_VALUE_ON_MATCH);
    245.   	}
    246.   int sk_find_ex(STACK *st, char *data)

crypto/stack/stack.c:213:1: start of procedure internal_find()
      211.   	}
      212.   
      213. > static int internal_find(STACK *st, char *data, int ret_val_options)
      214.   	{
      215.   	char **r;

crypto/stack/stack.c:218:5: Taking false branch
      216.   	int i;
      217.   	int (*comp_func)(const void *,const void *);
      218.   	if(st == NULL) return -1;
                 ^
      219.   
      220.   	if (st->comp == NULL)

crypto/stack/stack.c:220:6: Taking true branch
      218.   	if(st == NULL) return -1;
      219.   
      220.   	if (st->comp == NULL)
                  ^
      221.   		{
      222.   		for (i=0; i<st->num; i++)

crypto/stack/stack.c:222:8: 
      220.   	if (st->comp == NULL)
      221.   		{
      222. > 		for (i=0; i<st->num; i++)
      223.   			if (st->data[i] == data)
      224.   				return(i);

crypto/stack/stack.c:222:13: Loop condition is true. Entering loop body
      220.   	if (st->comp == NULL)
      221.   		{
      222.   		for (i=0; i<st->num; i++)
                         ^
      223.   			if (st->data[i] == data)
      224.   				return(i);

crypto/stack/stack.c:223:8: Taking true branch
      221.   		{
      222.   		for (i=0; i<st->num; i++)
      223.   			if (st->data[i] == data)
                    ^
      224.   				return(i);
      225.   		return(-1);

crypto/stack/stack.c:224:5: 
      222.   		for (i=0; i<st->num; i++)
      223.   			if (st->data[i] == data)
      224. > 				return(i);
      225.   		return(-1);
      226.   		}

crypto/stack/stack.c:240:2: return from a call to internal_find
      238.   	if (r == NULL) return(-1);
      239.   	return((int)(r-st->data));
      240.   	}
              ^
      241.   
      242.   int sk_find(STACK *st, char *data)

crypto/stack/stack.c:245:2: return from a call to sk_find
    243.   	{
    244.   	return internal_find(st, data, OBJ_BSEARCH_FIRST_VALUE_ON_MATCH);
    245.   	}
            ^
    246.   int sk_find_ex(STACK *st, char *data)
    247.   	{

crypto/evp/pmeth_lib.c:94:7: Taking true branch
  92.   		int idx;
  93.   		idx = sk_find(app_pkey_methods, (char *)&tmp);
  94.   		if (idx >= 0)
              ^
  95.   			return (EVP_PKEY_METHOD *)
  96.   				sk_value(app_pkey_methods, idx);

crypto/evp/pmeth_lib.c:95:4: 
  93.   		idx = sk_find(app_pkey_methods, (char *)&tmp);
  94.   		if (idx >= 0)
  95. > 			return (EVP_PKEY_METHOD *)
  96.   				sk_value(app_pkey_methods, idx);
  97.   		}

crypto/stack/stack.c:307:1: start of procedure sk_value()
    305.   }
    306.   
    307. > char *sk_value(const STACK *st, int i)
    308.   {
    309.   	if(!st || (i < 0) || (i >= st->num)) return NULL;

crypto/stack/stack.c:309:6: Taking false branch
    307.   char *sk_value(const STACK *st, int i)
    308.   {
    309.   	if(!st || (i < 0) || (i >= st->num)) return NULL;
                ^
    310.   	return st->data[i];
    311.   }

crypto/stack/stack.c:309:13: Taking false branch
    307.   char *sk_value(const STACK *st, int i)
    308.   {
    309.   	if(!st || (i < 0) || (i >= st->num)) return NULL;
                       ^
    310.   	return st->data[i];
    311.   }

crypto/stack/stack.c:309:24: Taking false branch
    307.   char *sk_value(const STACK *st, int i)
    308.   {
    309.   	if(!st || (i < 0) || (i >= st->num)) return NULL;
                                  ^
    310.   	return st->data[i];
    311.   }

crypto/stack/stack.c:310:2: 
    308.   {
    309.   	if(!st || (i < 0) || (i >= st->num)) return NULL;
    310. > 	return st->data[i];
    311.   }
    312.   

crypto/stack/stack.c:311:1: return from a call to sk_value
    309.   	if(!st || (i < 0) || (i >= st->num)) return NULL;
    310.   	return st->data[i];
    311. > }
    312.   
    313.   char *sk_set(STACK *st, int i, char *value)

crypto/evp/pmeth_lib.c:106:2: return from a call to EVP_PKEY_meth_find
  104.   		return NULL;
  105.   	return *ret;
  106.   	}
          ^
  107.   
  108.   static EVP_PKEY_CTX *int_ctx_new(EVP_PKEY *pkey, ENGINE *e, int id)

crypto/evp/pmeth_lib.c:119:6: Taking false branch
117.   		}
118.   	pmeth = EVP_PKEY_meth_find(id, e);
119.   	if (pmeth == NULL)
            ^
120.   		return NULL;
121.   	ret = OPENSSL_malloc(sizeof(EVP_PKEY_CTX));

crypto/evp/pmeth_lib.c:121:2: 
119.   	if (pmeth == NULL)
120.   		return NULL;
121. > 	ret = OPENSSL_malloc(sizeof(EVP_PKEY_CTX));
122.   	ret->pmeth = pmeth;
123.   	ret->operation = EVP_PKEY_OP_UNDEFINED;

crypto/mem.c:291:1: start of procedure CRYPTO_malloc()
  289.   	}
  290.   
  291. > void *CRYPTO_malloc(int num, const char *file, int line)
  292.   	{
  293.   	void *ret = NULL;

crypto/mem.c:293:2: 
  291.   void *CRYPTO_malloc(int num, const char *file, int line)
  292.   	{
  293. > 	void *ret = NULL;
  294.   	extern unsigned char cleanse_ctr;
  295.   

crypto/mem.c:296:6: Taking false branch
  294.   	extern unsigned char cleanse_ctr;
  295.   
  296.   	if (num <= 0) return NULL;
              ^
  297.   
  298.   	allow_customize = 0;

crypto/mem.c:298:2: 
  296.   	if (num <= 0) return NULL;
  297.   
  298. > 	allow_customize = 0;
  299.   	if (malloc_debug_func != NULL)
  300.   		{

crypto/mem.c:299:6: Taking true branch
  297.   
  298.   	allow_customize = 0;
  299.   	if (malloc_debug_func != NULL)
              ^
  300.   		{
  301.   		allow_customize_debug = 0;

crypto/mem.c:301:3: 
  299.   	if (malloc_debug_func != NULL)
  300.   		{
  301. > 		allow_customize_debug = 0;
  302.   		malloc_debug_func(NULL, num, file, line, 0);
  303.   		}

crypto/mem.c:302:3: Skipping __function_pointer__(): unresolved function pointer
  300.   		{
  301.   		allow_customize_debug = 0;
  302.   		malloc_debug_func(NULL, num, file, line, 0);
           ^
  303.   		}
  304.   	ret = malloc_ex_func(num,file,line);

crypto/mem.c:304:2: Skipping __function_pointer__(): unresolved function pointer
  302.   		malloc_debug_func(NULL, num, file, line, 0);
  303.   		}
  304.   	ret = malloc_ex_func(num,file,line);
          ^
  305.   #ifdef LEVITTE_DEBUG_MEM
  306.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);

crypto/mem.c:308:6: Taking true branch
  306.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);
  307.   #endif
  308.   	if (malloc_debug_func != NULL)
              ^
  309.   		malloc_debug_func(ret, num, file, line, 1);
  310.   

crypto/mem.c:309:3: Skipping __function_pointer__(): unresolved function pointer
  307.   #endif
  308.   	if (malloc_debug_func != NULL)
  309.   		malloc_debug_func(ret, num, file, line, 1);
           ^
  310.   
  311.           /* Create a dependency on the value of 'cleanse_ctr' so our memory

crypto/mem.c:314:12: Taking false branch
  312.            * sanitisation function can't be optimised out. NB: We only do
  313.            * this for >2Kb so the overhead doesn't bother us. */
  314.           if(ret && (num > 2048))
                    ^
  315.                   ((unsigned char *)ret)[0] = cleanse_ctr;
  316.   

crypto/mem.c:317:2: 
  315.                   ((unsigned char *)ret)[0] = cleanse_ctr;
  316.   
  317. > 	return ret;
  318.   	}
  319.   

crypto/mem.c:318:2: return from a call to CRYPTO_malloc
  316.   
  317.   	return ret;
  318.   	}
          ^
  319.   
  320.   void *CRYPTO_realloc(void *str, int num, const char *file, int line)

crypto/evp/pmeth_lib.c:122:2: 
120.   		return NULL;
121.   	ret = OPENSSL_malloc(sizeof(EVP_PKEY_CTX));
122. > 	ret->pmeth = pmeth;
123.   	ret->operation = EVP_PKEY_OP_UNDEFINED;
124.   	ret->pkey = pkey;

static EVP_PKEY_CTX *int_ctx_new(EVP_PKEY *pkey, ENGINE *e, int id)
	{
	EVP_PKEY_CTX *ret;
	const EVP_PKEY_METHOD *pmeth;
	if (id == -1)
		{
		if (!pkey || !pkey->ameth)
			return NULL;
		id = pkey->ameth->pkey_id;
		}
	pmeth = EVP_PKEY_meth_find(id, e);
	if (pmeth == NULL)
		return NULL;
	ret = OPENSSL_malloc(sizeof(EVP_PKEY_CTX));
	ret->pmeth = pmeth;
	ret->operation = EVP_PKEY_OP_UNDEFINED;
	ret->pkey = pkey;
	ret->peerkey = NULL;
	if (pkey)
		CRYPTO_add(&pkey->references,1,CRYPTO_LOCK_EVP_PKEY);
	ret->data = NULL;
	if (pmeth->init)
		{
		if (pmeth->init(ret) <= 0)
			{
			EVP_PKEY_CTX_free(ret);
			return NULL;
			}
		}
	return ret;
	}
['static EVP_PKEY_CTX *int_ctx_new(EVP_PKEY *pkey, ENGINE *e, int id)\n\t{\n\tEVP_PKEY_CTX *ret;\n\tconst EVP_PKEY_METHOD *pmeth;\n\tif (id == -1)\n\t\t{\n\t\tif (!pkey || !pkey->ameth)\n\t\t\treturn NULL;\n\t\tid = pkey->ameth->pkey_id;\n\t\t}\n\tpmeth = EVP_PKEY_meth_find(id, e);\n\tif (pmeth == NULL)\n\t\treturn NULL;\n\tret = OPENSSL_malloc(sizeof(EVP_PKEY_CTX));\n\tret->pmeth = pmeth;\n\tret->operation = EVP_PKEY_OP_UNDEFINED;\n\tret->pkey = pkey;\n\tret->peerkey = NULL;\n\tif (pkey)\n\t\tCRYPTO_add(&pkey->references,1,CRYPTO_LOCK_EVP_PKEY);\n\tret->data = NULL;\n\tif (pmeth->init)\n\t\t{\n\t\tif (pmeth->init(ret) <= 0)\n\t\t\t{\n\t\t\tEVP_PKEY_CTX_free(ret);\n\t\t\treturn NULL;\n\t\t\t}\n\t\t}\n\treturn ret;\n\t}', 'const EVP_PKEY_METHOD *EVP_PKEY_meth_find(int type, ENGINE *e)\n\t{\n\tEVP_PKEY_METHOD tmp, *t = &tmp, **ret;\n\ttmp.pkey_id = type;\n\tif (app_pkey_methods)\n\t\t{\n\t\tint idx;\n\t\tidx = sk_find(app_pkey_methods, (char *)&tmp);\n\t\tif (idx >= 0)\n\t\t\treturn (EVP_PKEY_METHOD *)\n\t\t\t\tsk_value(app_pkey_methods, idx);\n\t\t}\n\tret = (EVP_PKEY_METHOD **) OBJ_bsearch((char *)&t,\n        \t\t(char *)standard_methods,\n\t\t\tsizeof(standard_methods)/sizeof(EVP_PKEY_METHOD *),\n        \t\tsizeof(EVP_PKEY_METHOD *),\n\t\t\t(int (*)(const void *, const void *))pmeth_cmp);\n\tif (!ret || !*ret)\n\t\treturn NULL;\n\treturn *ret;\n\t}', 'int sk_find(STACK *st, char *data)\n\t{\n\treturn internal_find(st, data, OBJ_BSEARCH_FIRST_VALUE_ON_MATCH);\n\t}', 'static int internal_find(STACK *st, char *data, int ret_val_options)\n\t{\n\tchar **r;\n\tint i;\n\tint (*comp_func)(const void *,const void *);\n\tif(st == NULL) return -1;\n\tif (st->comp == NULL)\n\t\t{\n\t\tfor (i=0; i<st->num; i++)\n\t\t\tif (st->data[i] == data)\n\t\t\t\treturn(i);\n\t\treturn(-1);\n\t\t}\n\tsk_sort(st);\n\tif (data == NULL) return(-1);\n\tcomp_func=(int (*)(const void *,const void *))(st->comp);\n\tr=(char **)OBJ_bsearch_ex((char *)&data,(char *)st->data,\n\t\tst->num,sizeof(char *),comp_func,ret_val_options);\n\tif (r == NULL) return(-1);\n\treturn((int)(r-st->data));\n\t}', 'char *sk_value(const STACK *st, int i)\n{\n\tif(!st || (i < 0) || (i >= st->num)) return NULL;\n\treturn st->data[i];\n}', 'void *CRYPTO_malloc(int num, const char *file, int line)\n\t{\n\tvoid *ret = NULL;\n\textern unsigned char cleanse_ctr;\n\tif (num <= 0) return NULL;\n\tallow_customize = 0;\n\tif (malloc_debug_func != NULL)\n\t\t{\n\t\tallow_customize_debug = 0;\n\t\tmalloc_debug_func(NULL, num, file, line, 0);\n\t\t}\n\tret = malloc_ex_func(num,file,line);\n#ifdef LEVITTE_DEBUG_MEM\n\tfprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\\n", ret, num);\n#endif\n\tif (malloc_debug_func != NULL)\n\t\tmalloc_debug_func(ret, num, file, line, 1);\n        if(ret && (num > 2048))\n                ((unsigned char *)ret)[0] = cleanse_ctr;\n\treturn ret;\n\t}']