crypto/x509/x509_r2x.c:105: error: NULL_DEREFERENCE
  pointer `ret` last assigned on line 74 could be null and is dereferenced by call to `X509_free()` at line 105, column 3.
Showing all 17 steps of the trace


crypto/x509/x509_r2x.c:68:1: start of procedure X509_REQ_to_X509()
66.   #include <openssl/buffer.h>
67.   
68. > X509 *X509_REQ_to_X509(X509_REQ *r, int days, EVP_PKEY *pkey)
69.   	{
70.   	X509 *ret=NULL;

crypto/x509/x509_r2x.c:70:2: 
68.   X509 *X509_REQ_to_X509(X509_REQ *r, int days, EVP_PKEY *pkey)
69.   	{
70. > 	X509 *ret=NULL;
71.   	X509_CINF *xi=NULL;
72.   	X509_NAME *xn;

crypto/x509/x509_r2x.c:71:2: 
69.   	{
70.   	X509 *ret=NULL;
71. > 	X509_CINF *xi=NULL;
72.   	X509_NAME *xn;
73.   

crypto/x509/x509_r2x.c:74:6: Taking true branch
72.   	X509_NAME *xn;
73.   
74.   	if ((ret=X509_new()) == NULL)
           ^
75.   		{
76.   		X509err(X509_F_X509_REQ_TO_X509,ERR_R_MALLOC_FAILURE);

crypto/x509/x509_r2x.c:76:3: 
74.   	if ((ret=X509_new()) == NULL)
75.   		{
76. > 		X509err(X509_F_X509_REQ_TO_X509,ERR_R_MALLOC_FAILURE);
77.   		goto err;
78.   		}

crypto/err/err.c:246:1: start of procedure ERR_put_error()
  244.   /********************************************************/
  245.   
  246. > void ERR_put_error(int lib, int func, int reason, const char *file,
  247.   	     int line)
  248.   	{

crypto/err/err.c:270:2: Skipping ERR_get_state(): empty list of specs
  268.   	}
  269.   #endif
  270.   	es=ERR_get_state();
          ^
  271.   
  272.   	es->top=(es->top+1)%ERR_NUM_ERRORS;

crypto/err/err.c:272:2: 
  270.   	es=ERR_get_state();
  271.   
  272. > 	es->top=(es->top+1)%ERR_NUM_ERRORS;
  273.   	if (es->top == es->bottom)
  274.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;

crypto/err/err.c:273:6: Taking false branch
  271.   
  272.   	es->top=(es->top+1)%ERR_NUM_ERRORS;
  273.   	if (es->top == es->bottom)
              ^
  274.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
  275.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);

crypto/err/err.c:275:2: 
  273.   	if (es->top == es->bottom)
  274.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
  275. > 	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
  276.   	es->err_file[es->top]=file;
  277.   	es->err_line[es->top]=line;

crypto/err/err.c:276:2: 
  274.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
  275.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
  276. > 	es->err_file[es->top]=file;
  277.   	es->err_line[es->top]=line;
  278.   	err_clear_data(es,es->top);

crypto/err/err.c:277:2: 
  275.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
  276.   	es->err_file[es->top]=file;
  277. > 	es->err_line[es->top]=line;
  278.   	err_clear_data(es,es->top);
  279.   	}

crypto/err/err.c:278:2: Taking true branch
  276.   	es->err_file[es->top]=file;
  277.   	es->err_line[es->top]=line;
  278.   	err_clear_data(es,es->top);
          ^
  279.   	}
  280.   

crypto/err/err.c:278:2: Taking false branch
  276.   	es->err_file[es->top]=file;
  277.   	es->err_line[es->top]=line;
  278.   	err_clear_data(es,es->top);
          ^
  279.   	}
  280.   

crypto/err/err.c:279:2: return from a call to ERR_put_error
  277.   	es->err_line[es->top]=line;
  278.   	err_clear_data(es,es->top);
  279.   	}
          ^
  280.   
  281.   void ERR_clear_error(void)

crypto/x509/x509_r2x.c:104:1: 
102.   	if (0)
103.   		{
104. > err:
105.   		X509_free(ret);
106.   		ret=NULL;

crypto/x509/x509_r2x.c:105:3: 
103.   		{
104.   err:
105. > 		X509_free(ret);
106.   		ret=NULL;
107.   		}

X509 *X509_REQ_to_X509(X509_REQ *r, int days, EVP_PKEY *pkey)
	{
	X509 *ret=NULL;
	X509_CINF *xi=NULL;
	X509_NAME *xn;
	if ((ret=X509_new()) == NULL)
		{
		X509err(X509_F_X509_REQ_TO_X509,ERR_R_MALLOC_FAILURE);
		goto err;
		}
	xi=ret->cert_info;
	if (sk_X509_ATTRIBUTE_num(r->req_info->attributes) != 0)
		{
		if ((xi->version=M_ASN1_INTEGER_new()) == NULL) goto err;
		if (!ASN1_INTEGER_set(xi->version,2)) goto err;
		}
	xn=X509_REQ_get_subject_name(r);
	X509_set_subject_name(ret,X509_NAME_dup(xn));
	X509_set_issuer_name(ret,X509_NAME_dup(xn));
	X509_gmtime_adj(xi->validity->notBefore,0);
	X509_gmtime_adj(xi->validity->notAfter,(long)60*60*24*days);
	X509_set_pubkey(ret,X509_REQ_get_pubkey(r));
	if (!X509_sign(ret,pkey,EVP_md5()))
		goto err;
	if (0)
		{
err:
		X509_free(ret);
		ret=NULL;
		}
	return(ret);
	}
['X509 *X509_REQ_to_X509(X509_REQ *r, int days, EVP_PKEY *pkey)\n\t{\n\tX509 *ret=NULL;\n\tX509_CINF *xi=NULL;\n\tX509_NAME *xn;\n\tif ((ret=X509_new()) == NULL)\n\t\t{\n\t\tX509err(X509_F_X509_REQ_TO_X509,ERR_R_MALLOC_FAILURE);\n\t\tgoto err;\n\t\t}\n\txi=ret->cert_info;\n\tif (sk_X509_ATTRIBUTE_num(r->req_info->attributes) != 0)\n\t\t{\n\t\tif ((xi->version=M_ASN1_INTEGER_new()) == NULL) goto err;\n\t\tif (!ASN1_INTEGER_set(xi->version,2)) goto err;\n\t\t}\n\txn=X509_REQ_get_subject_name(r);\n\tX509_set_subject_name(ret,X509_NAME_dup(xn));\n\tX509_set_issuer_name(ret,X509_NAME_dup(xn));\n\tX509_gmtime_adj(xi->validity->notBefore,0);\n\tX509_gmtime_adj(xi->validity->notAfter,(long)60*60*24*days);\n\tX509_set_pubkey(ret,X509_REQ_get_pubkey(r));\n\tif (!X509_sign(ret,pkey,EVP_md5()))\n\t\tgoto err;\n\tif (0)\n\t\t{\nerr:\n\t\tX509_free(ret);\n\t\tret=NULL;\n\t\t}\n\treturn(ret);\n\t}', 'void ERR_put_error(int lib, int func, int reason, const char *file,\n\t     int line)\n\t{\n\tERR_STATE *es;\n#ifdef _OSD_POSIX\n\tif (strncmp(file,"*POSIX(", sizeof("*POSIX(")-1) == 0) {\n\t\tchar *end;\n\t\tfile += sizeof("*POSIX(")-1;\n\t\tend = &file[strlen(file)-1];\n\t\tif (*end == \')\')\n\t\t\t*end = \'\\0\';\n\t\tif ((end = strrchr(file, \'/\')) != NULL)\n\t\t\tfile = &end[1];\n\t}\n#endif\n\tes=ERR_get_state();\n\tes->top=(es->top+1)%ERR_NUM_ERRORS;\n\tif (es->top == es->bottom)\n\t\tes->bottom=(es->bottom+1)%ERR_NUM_ERRORS;\n\tes->err_buffer[es->top]=ERR_PACK(lib,func,reason);\n\tes->err_file[es->top]=file;\n\tes->err_line[es->top]=line;\n\terr_clear_data(es,es->top);\n\t}']