crypto/txt_db/txt_db.c:84: error: NULL_DEREFERENCE
  pointer `buf->data` last assigned on line 83 could be null and is dereferenced by call to `BUF_MEM_grow()` at line 84, column 7.
Showing all 31 steps of the trace


crypto/txt_db/txt_db.c:71:1: start of procedure TXT_DB_read()
69.   const char *TXT_DB_version="TXT_DB" OPENSSL_VERSION_PTEXT;
70.   
71. > TXT_DB *TXT_DB_read(BIO *in, int num)
72.   	{
73.   	TXT_DB *ret=NULL;

crypto/txt_db/txt_db.c:73:2: 
71.   TXT_DB *TXT_DB_read(BIO *in, int num)
72.   	{
73. > 	TXT_DB *ret=NULL;
74.   	int er=1;
75.   	int esc=0;

crypto/txt_db/txt_db.c:74:2: 
72.   	{
73.   	TXT_DB *ret=NULL;
74. > 	int er=1;
75.   	int esc=0;
76.   	long ln=0;

crypto/txt_db/txt_db.c:75:2: 
73.   	TXT_DB *ret=NULL;
74.   	int er=1;
75. > 	int esc=0;
76.   	long ln=0;
77.   	int i,add,n;

crypto/txt_db/txt_db.c:76:2: 
74.   	int er=1;
75.   	int esc=0;
76. > 	long ln=0;
77.   	int i,add,n;
78.   	int size=BUFSIZE;

crypto/txt_db/txt_db.c:78:2: 
76.   	long ln=0;
77.   	int i,add,n;
78. > 	int size=BUFSIZE;
79.   	int offset=0;
80.   	char *p,**pp,*f;

crypto/txt_db/txt_db.c:79:2: 
77.   	int i,add,n;
78.   	int size=BUFSIZE;
79. > 	int offset=0;
80.   	char *p,**pp,*f;
81.   	BUF_MEM *buf=NULL;

crypto/txt_db/txt_db.c:81:2: 
79.   	int offset=0;
80.   	char *p,**pp,*f;
81. > 	BUF_MEM *buf=NULL;
82.   
83.   	if ((buf=BUF_MEM_new()) == NULL) goto err;

crypto/txt_db/txt_db.c:83:6: 
81.   	BUF_MEM *buf=NULL;
82.   
83. > 	if ((buf=BUF_MEM_new()) == NULL) goto err;
84.   	if (!BUF_MEM_grow(buf,size)) goto err;
85.   

crypto/buffer/buffer.c:63:1: start of procedure BUF_MEM_new()
  61.   #include "buffer.h"
  62.   
  63. > BUF_MEM *BUF_MEM_new(void)
  64.   	{
  65.   	BUF_MEM *ret;

crypto/buffer/buffer.c:67:2: 
  65.   	BUF_MEM *ret;
  66.   
  67. > 	ret=(BUF_MEM *)Malloc(sizeof(BUF_MEM));
  68.   	if (ret == NULL)
  69.   		{

crypto/buffer/buffer.c:68:6: Taking false branch
  66.   
  67.   	ret=(BUF_MEM *)Malloc(sizeof(BUF_MEM));
  68.   	if (ret == NULL)
             ^
  69.   		{
  70.   		BUFerr(BUF_F_BUF_MEM_NEW,ERR_R_MALLOC_FAILURE);

crypto/buffer/buffer.c:73:2: 
  71.   		return(NULL);
  72.   		}
  73. > 	ret->length=0;
  74.   	ret->max=0;
  75.   	ret->data=NULL;

crypto/buffer/buffer.c:74:2: 
  72.   		}
  73.   	ret->length=0;
  74. > 	ret->max=0;
  75.   	ret->data=NULL;
  76.   	return(ret);

crypto/buffer/buffer.c:75:2: 
  73.   	ret->length=0;
  74.   	ret->max=0;
  75. > 	ret->data=NULL;
  76.   	return(ret);
  77.   	}

crypto/buffer/buffer.c:76:2: 
  74.   	ret->max=0;
  75.   	ret->data=NULL;
  76. > 	return(ret);
  77.   	}
  78.   

crypto/buffer/buffer.c:77:2: return from a call to BUF_MEM_new
  75.   	ret->data=NULL;
  76.   	return(ret);
  77.   	}
         ^
  78.   
  79.   void BUF_MEM_free(BUF_MEM *a)

crypto/txt_db/txt_db.c:83:6: Taking false branch
81.   	BUF_MEM *buf=NULL;
82.   
83.   	if ((buf=BUF_MEM_new()) == NULL) goto err;
           ^
84.   	if (!BUF_MEM_grow(buf,size)) goto err;
85.   

crypto/txt_db/txt_db.c:84:7: 
82.   
83.   	if ((buf=BUF_MEM_new()) == NULL) goto err;
84. > 	if (!BUF_MEM_grow(buf,size)) goto err;
85.   
86.   	if ((ret=(TXT_DB *)Malloc(sizeof(TXT_DB))) == NULL)

crypto/buffer/buffer.c:92:1: start of procedure BUF_MEM_grow()
  90.   	}
  91.   
  92. > int BUF_MEM_grow(BUF_MEM *str, int len)
  93.   	{
  94.   	char *ret;

crypto/buffer/buffer.c:97:6: Taking false branch
  95.   	unsigned int n;
  96.   
  97.   	if (str->length >= len)
              ^
  98.   		{
  99.   		str->length=len;

crypto/buffer/buffer.c:102:6: Taking false branch
  100.   		return(len);
  101.   		}
  102.   	if (str->max >= len)
              ^
  103.   		{
  104.   		memset(&(str->data[str->length]),0,len-str->length);

crypto/buffer/buffer.c:108:2: 
  106.   		return(len);
  107.   		}
  108. > 	n=(len+3)/3*4;
  109.   	if (str->data == NULL)
  110.   		ret=(char *)Malloc(n);

crypto/buffer/buffer.c:109:6: Taking false branch
  107.   		}
  108.   	n=(len+3)/3*4;
  109.   	if (str->data == NULL)
              ^
  110.   		ret=(char *)Malloc(n);
  111.   	else

crypto/buffer/buffer.c:112:3: 
  110.   		ret=(char *)Malloc(n);
  111.   	else
  112. > 		ret=(char *)Realloc(str->data,n);
  113.   	if (ret == NULL)
  114.   		{

crypto/buffer/buffer.c:113:6: Taking false branch
  111.   	else
  112.   		ret=(char *)Realloc(str->data,n);
  113.   	if (ret == NULL)
              ^
  114.   		{
  115.   		BUFerr(BUF_F_BUF_MEM_GROW,ERR_R_MALLOC_FAILURE);

crypto/buffer/buffer.c:120:3: 
  118.   	else
  119.   		{
  120. > 		str->data=ret;
  121.   		str->length=len;
  122.   		str->max=n;

crypto/buffer/buffer.c:121:3: 
  119.   		{
  120.   		str->data=ret;
  121. > 		str->length=len;
  122.   		str->max=n;
  123.   		}

crypto/buffer/buffer.c:122:3: 
  120.   		str->data=ret;
  121.   		str->length=len;
  122. > 		str->max=n;
  123.   		}
  124.   	return(len);

crypto/buffer/buffer.c:124:2: 
  122.   		str->max=n;
  123.   		}
  124. > 	return(len);
  125.   	}
  126.   

crypto/buffer/buffer.c:125:2: return from a call to BUF_MEM_grow
  123.   		}
  124.   	return(len);
  125.   	}
          ^
  126.   
  127.   char *BUF_strdup(const char *str)

TXT_DB *TXT_DB_read(BIO *in, int num)
	{
	TXT_DB *ret=NULL;
	int er=1;
	int esc=0;
	long ln=0;
	int i,add,n;
	int size=BUFSIZE;
	int offset=0;
	char *p,**pp,*f;
	BUF_MEM *buf=NULL;
	if ((buf=BUF_MEM_new()) == NULL) goto err;
	if (!BUF_MEM_grow(buf,size)) goto err;
	if ((ret=(TXT_DB *)Malloc(sizeof(TXT_DB))) == NULL)
		goto err;
	ret->num_fields=num;
	ret->index=NULL;
	ret->qual=NULL;
	if ((ret->data=sk_new_null()) == NULL)
		goto err;
	if ((ret->index=(LHASH **)Malloc(sizeof(LHASH *)*num)) == NULL)
		goto err;
	if ((ret->qual=(int (**)())Malloc(sizeof(int (**)())*num)) == NULL)
		goto err;
	for (i=0; i<num; i++)
		{
		ret->index[i]=NULL;
		ret->qual[i]=NULL;
		}
	add=(num+1)*sizeof(char *);
	buf->data[size-1]='\0';
	offset=0;
	for (;;)
		{
		if (offset != 0)
			{
			size+=BUFSIZE;
			if (!BUF_MEM_grow(buf,size)) goto err;
			}
		buf->data[offset]='\0';
		BIO_gets(in,&(buf->data[offset]),size-offset);
		ln++;
		if (buf->data[offset] == '\0') break;
		if ((offset == 0) && (buf->data[0] == '#')) continue;
		i=strlen(&(buf->data[offset]));
		offset+=i;
		if (buf->data[offset-1] != '\n')
			continue;
		else
			{
			buf->data[offset-1]='\0';
			p=(char *)Malloc(add+offset);
			offset=0;
			}
		pp=(char **)p;
		p+=add;
		n=0;
		pp[n++]=p;
		i=0;
		f=buf->data;
		esc=0;
		for (;;)
			{
			if (*f == '\0') break;
			if (*f == '\t')
				{
				if (esc)
					p--;
				else
					{
					*(p++)='\0';
					f++;
					if (n >=  num) break;
					pp[n++]=p;
					continue;
					}
				}
			esc=(*f == '\\');
			*(p++)= *(f++);
			}
		*(p++)='\0';
		if ((n != num) || (*f != '\0'))
			{
#if !defined(NO_STDIO) && !defined(WIN16)
			fprintf(stderr,"wrong number of fields on line %ld (looking for field %d, got %d, '%s' left)\n",ln,num,n,f);
#endif
			er=2;
			goto err;
			}
		pp[n]=p;
		if (!sk_push(ret->data,(char *)pp))
			{
#if !defined(NO_STDIO) && !defined(WIN16)
			fprintf(stderr,"failure in sk_push\n");
#endif
			er=2;
			goto err;
			}
		}
	er=0;
err:
	BUF_MEM_free(buf);
	if (er)
		{
#if !defined(NO_STDIO) && !defined(WIN16)
		if (er == 1) fprintf(stderr,"Malloc failure\n");
#endif
		if (ret->data != NULL) sk_free(ret->data);
		if (ret->index != NULL) Free(ret->index);
		if (ret->qual != NULL) Free((char *)ret->qual);
		if (ret != NULL) Free(ret);
		return(NULL);
		}
	else
		return(ret);
	}
['TXT_DB *TXT_DB_read(BIO *in, int num)\n\t{\n\tTXT_DB *ret=NULL;\n\tint er=1;\n\tint esc=0;\n\tlong ln=0;\n\tint i,add,n;\n\tint size=BUFSIZE;\n\tint offset=0;\n\tchar *p,**pp,*f;\n\tBUF_MEM *buf=NULL;\n\tif ((buf=BUF_MEM_new()) == NULL) goto err;\n\tif (!BUF_MEM_grow(buf,size)) goto err;\n\tif ((ret=(TXT_DB *)Malloc(sizeof(TXT_DB))) == NULL)\n\t\tgoto err;\n\tret->num_fields=num;\n\tret->index=NULL;\n\tret->qual=NULL;\n\tif ((ret->data=sk_new_null()) == NULL)\n\t\tgoto err;\n\tif ((ret->index=(LHASH **)Malloc(sizeof(LHASH *)*num)) == NULL)\n\t\tgoto err;\n\tif ((ret->qual=(int (**)())Malloc(sizeof(int (**)())*num)) == NULL)\n\t\tgoto err;\n\tfor (i=0; i<num; i++)\n\t\t{\n\t\tret->index[i]=NULL;\n\t\tret->qual[i]=NULL;\n\t\t}\n\tadd=(num+1)*sizeof(char *);\n\tbuf->data[size-1]=\'\\0\';\n\toffset=0;\n\tfor (;;)\n\t\t{\n\t\tif (offset != 0)\n\t\t\t{\n\t\t\tsize+=BUFSIZE;\n\t\t\tif (!BUF_MEM_grow(buf,size)) goto err;\n\t\t\t}\n\t\tbuf->data[offset]=\'\\0\';\n\t\tBIO_gets(in,&(buf->data[offset]),size-offset);\n\t\tln++;\n\t\tif (buf->data[offset] == \'\\0\') break;\n\t\tif ((offset == 0) && (buf->data[0] == \'#\')) continue;\n\t\ti=strlen(&(buf->data[offset]));\n\t\toffset+=i;\n\t\tif (buf->data[offset-1] != \'\\n\')\n\t\t\tcontinue;\n\t\telse\n\t\t\t{\n\t\t\tbuf->data[offset-1]=\'\\0\';\n\t\t\tp=(char *)Malloc(add+offset);\n\t\t\toffset=0;\n\t\t\t}\n\t\tpp=(char **)p;\n\t\tp+=add;\n\t\tn=0;\n\t\tpp[n++]=p;\n\t\ti=0;\n\t\tf=buf->data;\n\t\tesc=0;\n\t\tfor (;;)\n\t\t\t{\n\t\t\tif (*f == \'\\0\') break;\n\t\t\tif (*f == \'\\t\')\n\t\t\t\t{\n\t\t\t\tif (esc)\n\t\t\t\t\tp--;\n\t\t\t\telse\n\t\t\t\t\t{\n\t\t\t\t\t*(p++)=\'\\0\';\n\t\t\t\t\tf++;\n\t\t\t\t\tif (n >=  num) break;\n\t\t\t\t\tpp[n++]=p;\n\t\t\t\t\tcontinue;\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\tesc=(*f == \'\\\\\');\n\t\t\t*(p++)= *(f++);\n\t\t\t}\n\t\t*(p++)=\'\\0\';\n\t\tif ((n != num) || (*f != \'\\0\'))\n\t\t\t{\n#if !defined(NO_STDIO) && !defined(WIN16)\n\t\t\tfprintf(stderr,"wrong number of fields on line %ld (looking for field %d, got %d, \'%s\' left)\\n",ln,num,n,f);\n#endif\n\t\t\ter=2;\n\t\t\tgoto err;\n\t\t\t}\n\t\tpp[n]=p;\n\t\tif (!sk_push(ret->data,(char *)pp))\n\t\t\t{\n#if !defined(NO_STDIO) && !defined(WIN16)\n\t\t\tfprintf(stderr,"failure in sk_push\\n");\n#endif\n\t\t\ter=2;\n\t\t\tgoto err;\n\t\t\t}\n\t\t}\n\ter=0;\nerr:\n\tBUF_MEM_free(buf);\n\tif (er)\n\t\t{\n#if !defined(NO_STDIO) && !defined(WIN16)\n\t\tif (er == 1) fprintf(stderr,"Malloc failure\\n");\n#endif\n\t\tif (ret->data != NULL) sk_free(ret->data);\n\t\tif (ret->index != NULL) Free(ret->index);\n\t\tif (ret->qual != NULL) Free((char *)ret->qual);\n\t\tif (ret != NULL) Free(ret);\n\t\treturn(NULL);\n\t\t}\n\telse\n\t\treturn(ret);\n\t}', 'BUF_MEM *BUF_MEM_new(void)\n\t{\n\tBUF_MEM *ret;\n\tret=(BUF_MEM *)Malloc(sizeof(BUF_MEM));\n\tif (ret == NULL)\n\t\t{\n\t\tBUFerr(BUF_F_BUF_MEM_NEW,ERR_R_MALLOC_FAILURE);\n\t\treturn(NULL);\n\t\t}\n\tret->length=0;\n\tret->max=0;\n\tret->data=NULL;\n\treturn(ret);\n\t}', 'int BUF_MEM_grow(BUF_MEM *str, int len)\n\t{\n\tchar *ret;\n\tunsigned int n;\n\tif (str->length >= len)\n\t\t{\n\t\tstr->length=len;\n\t\treturn(len);\n\t\t}\n\tif (str->max >= len)\n\t\t{\n\t\tmemset(&(str->data[str->length]),0,len-str->length);\n\t\tstr->length=len;\n\t\treturn(len);\n\t\t}\n\tn=(len+3)/3*4;\n\tif (str->data == NULL)\n\t\tret=(char *)Malloc(n);\n\telse\n\t\tret=(char *)Realloc(str->data,n);\n\tif (ret == NULL)\n\t\t{\n\t\tBUFerr(BUF_F_BUF_MEM_GROW,ERR_R_MALLOC_FAILURE);\n\t\tlen=0;\n\t\t}\n\telse\n\t\t{\n\t\tstr->data=ret;\n\t\tstr->length=len;\n\t\tstr->max=n;\n\t\t}\n\treturn(len);\n\t}']