crypto/ui/ui_lib.c:435: error: NULL_DEREFERENCE
  pointer `prompt` last assigned on line 433 could be null and is dereferenced by call to `BUF_strlcat()` at line 435, column 3.
Showing all 32 steps of the trace


crypto/ui/ui_lib.c:411:1: start of procedure UI_construct_prompt()
409.   	}
410.   
411. > char *UI_construct_prompt(UI *ui, const char *object_desc,
412.   	const char *object_name)
413.   	{

crypto/ui/ui_lib.c:414:2: 
412.   	const char *object_name)
413.   	{
414. > 	char *prompt = NULL;
415.   
416.   	if (ui->meth->ui_construct_prompt)

crypto/ui/ui_lib.c:416:6: Taking false branch
414.   	char *prompt = NULL;
415.   
416.   	if (ui->meth->ui_construct_prompt)
            ^
417.   		prompt = ui->meth->ui_construct_prompt(ui,
418.   			object_desc, object_name);

crypto/ui/ui_lib.c:421:3: 
419.   	else
420.   		{
421. > 		char prompt1[] = "Enter ";
422.   		char prompt2[] = " for ";
423.   		char prompt3[] = ":";

crypto/ui/ui_lib.c:422:3: 
420.   		{
421.   		char prompt1[] = "Enter ";
422. > 		char prompt2[] = " for ";
423.   		char prompt3[] = ":";
424.   		int len = 0;

crypto/ui/ui_lib.c:423:3: 
421.   		char prompt1[] = "Enter ";
422.   		char prompt2[] = " for ";
423. > 		char prompt3[] = ":";
424.   		int len = 0;
425.   

crypto/ui/ui_lib.c:424:3: 
422.   		char prompt2[] = " for ";
423.   		char prompt3[] = ":";
424. > 		int len = 0;
425.   
426.   		if (object_desc == NULL)

crypto/ui/ui_lib.c:426:7: Taking false branch
424.   		int len = 0;
425.   
426.   		if (object_desc == NULL)
             ^
427.   			return NULL;
428.   		len = sizeof(prompt1) - 1 + strlen(object_desc);

crypto/ui/ui_lib.c:428:3: 
426.   		if (object_desc == NULL)
427.   			return NULL;
428. > 		len = sizeof(prompt1) - 1 + strlen(object_desc);
429.   		if (object_name)
430.   			len += sizeof(prompt2) - 1 + strlen(object_name);

crypto/ui/ui_lib.c:429:7: Taking true branch
427.   			return NULL;
428.   		len = sizeof(prompt1) - 1 + strlen(object_desc);
429.   		if (object_name)
             ^
430.   			len += sizeof(prompt2) - 1 + strlen(object_name);
431.   		len += sizeof(prompt3) - 1;

crypto/ui/ui_lib.c:430:4: 
428.   		len = sizeof(prompt1) - 1 + strlen(object_desc);
429.   		if (object_name)
430. > 			len += sizeof(prompt2) - 1 + strlen(object_name);
431.   		len += sizeof(prompt3) - 1;
432.   

crypto/ui/ui_lib.c:431:3: 
429.   		if (object_name)
430.   			len += sizeof(prompt2) - 1 + strlen(object_name);
431. > 		len += sizeof(prompt3) - 1;
432.   
433.   		prompt = (char *)OPENSSL_malloc(len + 1);

crypto/ui/ui_lib.c:433:3: 
431.   		len += sizeof(prompt3) - 1;
432.   
433. > 		prompt = (char *)OPENSSL_malloc(len + 1);
434.   		BUF_strlcpy(prompt, prompt1, len + 1);
435.   		BUF_strlcat(prompt, object_desc, len + 1);

crypto/mem.c:294:1: start of procedure CRYPTO_malloc()
  292.   	}
  293.   
  294. > void *CRYPTO_malloc(int num, const char *file, int line)
  295.   	{
  296.   	void *ret = NULL;

crypto/mem.c:296:2: 
  294.   void *CRYPTO_malloc(int num, const char *file, int line)
  295.   	{
  296. > 	void *ret = NULL;
  297.   
  298.   	if (num <= 0) return NULL;

crypto/mem.c:298:6: Taking false branch
  296.   	void *ret = NULL;
  297.   
  298.   	if (num <= 0) return NULL;
              ^
  299.   
  300.   	allow_customize = 0;

crypto/mem.c:300:2: 
  298.   	if (num <= 0) return NULL;
  299.   
  300. > 	allow_customize = 0;
  301.   	if (malloc_debug_func != NULL)
  302.   		{

crypto/mem.c:301:6: Taking true branch
  299.   
  300.   	allow_customize = 0;
  301.   	if (malloc_debug_func != NULL)
              ^
  302.   		{
  303.   		allow_customize_debug = 0;

crypto/mem.c:303:3: 
  301.   	if (malloc_debug_func != NULL)
  302.   		{
  303. > 		allow_customize_debug = 0;
  304.   		malloc_debug_func(NULL, num, file, line, 0);
  305.   		}

crypto/mem.c:304:3: Skipping __function_pointer__(): unresolved function pointer
  302.   		{
  303.   		allow_customize_debug = 0;
  304.   		malloc_debug_func(NULL, num, file, line, 0);
           ^
  305.   		}
  306.   	ret = malloc_ex_func(num,file,line);

crypto/mem.c:306:2: Skipping __function_pointer__(): unresolved function pointer
  304.   		malloc_debug_func(NULL, num, file, line, 0);
  305.   		}
  306.   	ret = malloc_ex_func(num,file,line);
          ^
  307.   #ifdef LEVITTE_DEBUG_MEM
  308.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);

crypto/mem.c:310:6: Taking true branch
  308.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);
  309.   #endif
  310.   	if (malloc_debug_func != NULL)
              ^
  311.   		malloc_debug_func(ret, num, file, line, 1);
  312.   

crypto/mem.c:311:3: Skipping __function_pointer__(): unresolved function pointer
  309.   #endif
  310.   	if (malloc_debug_func != NULL)
  311.   		malloc_debug_func(ret, num, file, line, 1);
           ^
  312.   
  313.   #ifndef OPENSSL_CPUID_OBJ

crypto/mem.c:317:12: Taking false branch
  315.            * sanitisation function can't be optimised out. NB: We only do
  316.            * this for >2Kb so the overhead doesn't bother us. */
  317.           if(ret && (num > 2048))
                    ^
  318.   	{	extern unsigned char cleanse_ctr;
  319.                   ((unsigned char *)ret)[0] = cleanse_ctr;

crypto/mem.c:323:2: 
  321.   #endif
  322.   
  323. > 	return ret;
  324.   	}
  325.   char *CRYPTO_strdup(const char *str, const char *file, int line)

crypto/mem.c:324:2: return from a call to CRYPTO_malloc
  322.   
  323.   	return ret;
  324.   	}
          ^
  325.   char *CRYPTO_strdup(const char *str, const char *file, int line)
  326.   	{

crypto/ui/ui_lib.c:434:3: Skipping BUF_strlcpy(): empty list of specs
432.   
433.   		prompt = (char *)OPENSSL_malloc(len + 1);
434.   		BUF_strlcpy(prompt, prompt1, len + 1);
         ^
435.   		BUF_strlcat(prompt, object_desc, len + 1);
436.   		if (object_name)

crypto/ui/ui_lib.c:435:3: 
433.   		prompt = (char *)OPENSSL_malloc(len + 1);
434.   		BUF_strlcpy(prompt, prompt1, len + 1);
435. > 		BUF_strlcat(prompt, object_desc, len + 1);
436.   		if (object_name)
437.   			{

crypto/buffer/buffer.c:215:1: start of procedure BUF_strlcat()
  213.   	}
  214.   
  215. > size_t BUF_strlcat(char *dst, const char *src, size_t size)
  216.   	{
  217.   	size_t l = 0;

crypto/buffer/buffer.c:217:2: 
  215.   size_t BUF_strlcat(char *dst, const char *src, size_t size)
  216.   	{
  217. > 	size_t l = 0;
  218.   	for(; size > 0 && *dst; size--, dst++)
  219.   		l++;

crypto/buffer/buffer.c:218:8: Loop condition is true. Entering loop body
  216.   	{
  217.   	size_t l = 0;
  218.   	for(; size > 0 && *dst; size--, dst++)
                ^
  219.   		l++;
  220.   	return l + BUF_strlcpy(dst, src, size);

crypto/buffer/buffer.c:218:20: Loop condition is false. Leaving loop
  216.   	{
  217.   	size_t l = 0;
  218.   	for(; size > 0 && *dst; size--, dst++)
                            ^
  219.   		l++;
  220.   	return l + BUF_strlcpy(dst, src, size);

char *UI_construct_prompt(UI *ui, const char *object_desc,
	const char *object_name)
	{
	char *prompt = NULL;
	if (ui->meth->ui_construct_prompt)
		prompt = ui->meth->ui_construct_prompt(ui,
			object_desc, object_name);
	else
		{
		char prompt1[] = "Enter ";
		char prompt2[] = " for ";
		char prompt3[] = ":";
		int len = 0;
		if (object_desc == NULL)
			return NULL;
		len = sizeof(prompt1) - 1 + strlen(object_desc);
		if (object_name)
			len += sizeof(prompt2) - 1 + strlen(object_name);
		len += sizeof(prompt3) - 1;
		prompt = (char *)OPENSSL_malloc(len + 1);
		BUF_strlcpy(prompt, prompt1, len + 1);
		BUF_strlcat(prompt, object_desc, len + 1);
		if (object_name)
			{
			BUF_strlcat(prompt, prompt2, len + 1);
			BUF_strlcat(prompt, object_name, len + 1);
			}
		BUF_strlcat(prompt, prompt3, len + 1);
		}
	return prompt;
	}
['char *UI_construct_prompt(UI *ui, const char *object_desc,\n\tconst char *object_name)\n\t{\n\tchar *prompt = NULL;\n\tif (ui->meth->ui_construct_prompt)\n\t\tprompt = ui->meth->ui_construct_prompt(ui,\n\t\t\tobject_desc, object_name);\n\telse\n\t\t{\n\t\tchar prompt1[] = "Enter ";\n\t\tchar prompt2[] = " for ";\n\t\tchar prompt3[] = ":";\n\t\tint len = 0;\n\t\tif (object_desc == NULL)\n\t\t\treturn NULL;\n\t\tlen = sizeof(prompt1) - 1 + strlen(object_desc);\n\t\tif (object_name)\n\t\t\tlen += sizeof(prompt2) - 1 + strlen(object_name);\n\t\tlen += sizeof(prompt3) - 1;\n\t\tprompt = (char *)OPENSSL_malloc(len + 1);\n\t\tBUF_strlcpy(prompt, prompt1, len + 1);\n\t\tBUF_strlcat(prompt, object_desc, len + 1);\n\t\tif (object_name)\n\t\t\t{\n\t\t\tBUF_strlcat(prompt, prompt2, len + 1);\n\t\t\tBUF_strlcat(prompt, object_name, len + 1);\n\t\t\t}\n\t\tBUF_strlcat(prompt, prompt3, len + 1);\n\t\t}\n\treturn prompt;\n\t}', 'void *CRYPTO_malloc(int num, const char *file, int line)\n\t{\n\tvoid *ret = NULL;\n\tif (num <= 0) return NULL;\n\tallow_customize = 0;\n\tif (malloc_debug_func != NULL)\n\t\t{\n\t\tallow_customize_debug = 0;\n\t\tmalloc_debug_func(NULL, num, file, line, 0);\n\t\t}\n\tret = malloc_ex_func(num,file,line);\n#ifdef LEVITTE_DEBUG_MEM\n\tfprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\\n", ret, num);\n#endif\n\tif (malloc_debug_func != NULL)\n\t\tmalloc_debug_func(ret, num, file, line, 1);\n#ifndef OPENSSL_CPUID_OBJ\n        if(ret && (num > 2048))\n\t{\textern unsigned char cleanse_ctr;\n                ((unsigned char *)ret)[0] = cleanse_ctr;\n\t}\n#endif\n\treturn ret;\n\t}', 'size_t BUF_strlcat(char *dst, const char *src, size_t size)\n\t{\n\tsize_t l = 0;\n\tfor(; size > 0 && *dst; size--, dst++)\n\t\tl++;\n\treturn l + BUF_strlcpy(dst, src, size);\n\t}']