crypto/ui/ui_lib.c:435: error: NULL_DEREFERENCE
  pointer `prompt` last assigned on line 433 could be null and is dereferenced by call to `BUF_strlcat()` at line 435, column 3.
Showing all 24 steps of the trace


crypto/ui/ui_lib.c:411:1: start of procedure UI_construct_prompt()
409.   	}
410.   
411. > char *UI_construct_prompt(UI *ui, const char *object_desc,
412.   	const char *object_name)
413.   	{

crypto/ui/ui_lib.c:414:2: 
412.   	const char *object_name)
413.   	{
414. > 	char *prompt = NULL;
415.   
416.   	if (ui->meth->ui_construct_prompt)

crypto/ui/ui_lib.c:416:6: Taking false branch
414.   	char *prompt = NULL;
415.   
416.   	if (ui->meth->ui_construct_prompt)
            ^
417.   		prompt = ui->meth->ui_construct_prompt(ui,
418.   			object_desc, object_name);

crypto/ui/ui_lib.c:421:3: 
419.   	else
420.   		{
421. > 		char prompt1[] = "Enter ";
422.   		char prompt2[] = " for ";
423.   		char prompt3[] = ":";

crypto/ui/ui_lib.c:422:3: 
420.   		{
421.   		char prompt1[] = "Enter ";
422. > 		char prompt2[] = " for ";
423.   		char prompt3[] = ":";
424.   		int len = 0;

crypto/ui/ui_lib.c:423:3: 
421.   		char prompt1[] = "Enter ";
422.   		char prompt2[] = " for ";
423. > 		char prompt3[] = ":";
424.   		int len = 0;
425.   

crypto/ui/ui_lib.c:424:3: 
422.   		char prompt2[] = " for ";
423.   		char prompt3[] = ":";
424. > 		int len = 0;
425.   
426.   		if (object_desc == NULL)

crypto/ui/ui_lib.c:426:7: Taking false branch
424.   		int len = 0;
425.   
426.   		if (object_desc == NULL)
             ^
427.   			return NULL;
428.   		len = sizeof(prompt1) - 1 + strlen(object_desc);

crypto/ui/ui_lib.c:428:3: 
426.   		if (object_desc == NULL)
427.   			return NULL;
428. > 		len = sizeof(prompt1) - 1 + strlen(object_desc);
429.   		if (object_name)
430.   			len += sizeof(prompt2) - 1 + strlen(object_name);

crypto/ui/ui_lib.c:429:7: Taking true branch
427.   			return NULL;
428.   		len = sizeof(prompt1) - 1 + strlen(object_desc);
429.   		if (object_name)
             ^
430.   			len += sizeof(prompt2) - 1 + strlen(object_name);
431.   		len += sizeof(prompt3) - 1;

crypto/ui/ui_lib.c:430:4: 
428.   		len = sizeof(prompt1) - 1 + strlen(object_desc);
429.   		if (object_name)
430. > 			len += sizeof(prompt2) - 1 + strlen(object_name);
431.   		len += sizeof(prompt3) - 1;
432.   

crypto/ui/ui_lib.c:431:3: 
429.   		if (object_name)
430.   			len += sizeof(prompt2) - 1 + strlen(object_name);
431. > 		len += sizeof(prompt3) - 1;
432.   
433.   		prompt = (char *)OPENSSL_malloc(len + 1);

crypto/ui/ui_lib.c:433:3: 
431.   		len += sizeof(prompt3) - 1;
432.   
433. > 		prompt = (char *)OPENSSL_malloc(len + 1);
434.   		BUF_strlcpy(prompt, prompt1, len + 1);
435.   		BUF_strlcat(prompt, object_desc, len + 1);

crypto/mem.c:295:1: start of procedure CRYPTO_malloc()
  293.   	}
  294.   
  295. > void *CRYPTO_malloc(int num, const char *file, int line)
  296.   	{
  297.   	void *ret = NULL;

crypto/mem.c:297:2: 
  295.   void *CRYPTO_malloc(int num, const char *file, int line)
  296.   	{
  297. > 	void *ret = NULL;
  298.   
  299.   	if (num <= 0) return NULL;

crypto/mem.c:299:6: Taking true branch
  297.   	void *ret = NULL;
  298.   
  299.   	if (num <= 0) return NULL;
              ^
  300.   
  301.   	allow_customize = 0;

crypto/mem.c:299:16: 
  297.   	void *ret = NULL;
  298.   
  299. > 	if (num <= 0) return NULL;
  300.   
  301.   	allow_customize = 0;

crypto/mem.c:325:2: return from a call to CRYPTO_malloc
  323.   
  324.   	return ret;
  325.   	}
          ^
  326.   char *CRYPTO_strdup(const char *str, const char *file, int line)
  327.   	{

crypto/ui/ui_lib.c:434:3: Skipping BUF_strlcpy(): empty list of specs
432.   
433.   		prompt = (char *)OPENSSL_malloc(len + 1);
434.   		BUF_strlcpy(prompt, prompt1, len + 1);
         ^
435.   		BUF_strlcat(prompt, object_desc, len + 1);
436.   		if (object_name)

crypto/ui/ui_lib.c:435:3: 
433.   		prompt = (char *)OPENSSL_malloc(len + 1);
434.   		BUF_strlcpy(prompt, prompt1, len + 1);
435. > 		BUF_strlcat(prompt, object_desc, len + 1);
436.   		if (object_name)
437.   			{

crypto/buffer/buf_str.c:115:1: start of procedure BUF_strlcat()
  113.   	}
  114.   
  115. > size_t BUF_strlcat(char *dst, const char *src, size_t size)
  116.   	{
  117.   	size_t l = 0;

crypto/buffer/buf_str.c:117:2: 
  115.   size_t BUF_strlcat(char *dst, const char *src, size_t size)
  116.   	{
  117. > 	size_t l = 0;
  118.   	for(; size > 0 && *dst; size--, dst++)
  119.   		l++;

crypto/buffer/buf_str.c:118:8: Loop condition is true. Entering loop body
  116.   	{
  117.   	size_t l = 0;
  118.   	for(; size > 0 && *dst; size--, dst++)
                ^
  119.   		l++;
  120.   	return l + BUF_strlcpy(dst, src, size);

crypto/buffer/buf_str.c:118:20: Loop condition is false. Leaving loop
  116.   	{
  117.   	size_t l = 0;
  118.   	for(; size > 0 && *dst; size--, dst++)
                            ^
  119.   		l++;
  120.   	return l + BUF_strlcpy(dst, src, size);

char *UI_construct_prompt(UI *ui, const char *object_desc,
	const char *object_name)
	{
	char *prompt = NULL;
	if (ui->meth->ui_construct_prompt)
		prompt = ui->meth->ui_construct_prompt(ui,
			object_desc, object_name);
	else
		{
		char prompt1[] = "Enter ";
		char prompt2[] = " for ";
		char prompt3[] = ":";
		int len = 0;
		if (object_desc == NULL)
			return NULL;
		len = sizeof(prompt1) - 1 + strlen(object_desc);
		if (object_name)
			len += sizeof(prompt2) - 1 + strlen(object_name);
		len += sizeof(prompt3) - 1;
		prompt = (char *)OPENSSL_malloc(len + 1);
		BUF_strlcpy(prompt, prompt1, len + 1);
		BUF_strlcat(prompt, object_desc, len + 1);
		if (object_name)
			{
			BUF_strlcat(prompt, prompt2, len + 1);
			BUF_strlcat(prompt, object_name, len + 1);
			}
		BUF_strlcat(prompt, prompt3, len + 1);
		}
	return prompt;
	}
['char *UI_construct_prompt(UI *ui, const char *object_desc,\n\tconst char *object_name)\n\t{\n\tchar *prompt = NULL;\n\tif (ui->meth->ui_construct_prompt)\n\t\tprompt = ui->meth->ui_construct_prompt(ui,\n\t\t\tobject_desc, object_name);\n\telse\n\t\t{\n\t\tchar prompt1[] = "Enter ";\n\t\tchar prompt2[] = " for ";\n\t\tchar prompt3[] = ":";\n\t\tint len = 0;\n\t\tif (object_desc == NULL)\n\t\t\treturn NULL;\n\t\tlen = sizeof(prompt1) - 1 + strlen(object_desc);\n\t\tif (object_name)\n\t\t\tlen += sizeof(prompt2) - 1 + strlen(object_name);\n\t\tlen += sizeof(prompt3) - 1;\n\t\tprompt = (char *)OPENSSL_malloc(len + 1);\n\t\tBUF_strlcpy(prompt, prompt1, len + 1);\n\t\tBUF_strlcat(prompt, object_desc, len + 1);\n\t\tif (object_name)\n\t\t\t{\n\t\t\tBUF_strlcat(prompt, prompt2, len + 1);\n\t\t\tBUF_strlcat(prompt, object_name, len + 1);\n\t\t\t}\n\t\tBUF_strlcat(prompt, prompt3, len + 1);\n\t\t}\n\treturn prompt;\n\t}', 'void *CRYPTO_malloc(int num, const char *file, int line)\n\t{\n\tvoid *ret = NULL;\n\tif (num <= 0) return NULL;\n\tallow_customize = 0;\n\tif (malloc_debug_func != NULL)\n\t\t{\n\t\tallow_customize_debug = 0;\n\t\tmalloc_debug_func(NULL, num, file, line, 0);\n\t\t}\n\tret = malloc_ex_func(num,file,line);\n#ifdef LEVITTE_DEBUG_MEM\n\tfprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\\n", ret, num);\n#endif\n\tif (malloc_debug_func != NULL)\n\t\tmalloc_debug_func(ret, num, file, line, 1);\n#ifndef OPENSSL_CPUID_OBJ\n        if(ret && (num > 2048))\n\t{\textern unsigned char cleanse_ctr;\n                ((unsigned char *)ret)[0] = cleanse_ctr;\n\t}\n#endif\n\treturn ret;\n\t}', 'size_t BUF_strlcat(char *dst, const char *src, size_t size)\n\t{\n\tsize_t l = 0;\n\tfor(; size > 0 && *dst; size--, dst++)\n\t\tl++;\n\treturn l + BUF_strlcpy(dst, src, size);\n\t}']