apps/req.c:1555: error: NULL_DEREFERENCE
  pointer `mctx` last assigned on line 1547 could be null and is dereferenced by call to `EVP_MD_CTX_free()` at line 1555, column 9.
Showing all 27 steps of the trace


apps/req.c:1543:1: start of procedure do_X509_CRL_sign()
1541.   }
1542.   
1543. > int do_X509_CRL_sign(X509_CRL *x, EVP_PKEY *pkey, const EVP_MD *md,
1544.                        STACK_OF(OPENSSL_STRING) *sigopts)
1545.   {

apps/req.c:1547:5: 
1545.   {
1546.       int rv;
1547. >     EVP_MD_CTX *mctx = EVP_MD_CTX_new();
1548.       rv = do_sign_init(mctx, pkey, md, sigopts);
1549.       /* Note: X509_CRL_sign_ctx() calls ASN1_item_sign_ctx(), which destroys

crypto/evp/digest.c:153:1: start of procedure EVP_MD_CTX_new()
  151.   }
  152.   
  153. > EVP_MD_CTX *EVP_MD_CTX_new(void)
  154.   {
  155.       return OPENSSL_zalloc(sizeof(EVP_MD_CTX));

crypto/evp/digest.c:155:5: 
  153.   EVP_MD_CTX *EVP_MD_CTX_new(void)
  154.   {
  155. >     return OPENSSL_zalloc(sizeof(EVP_MD_CTX));
  156.   }
  157.   

crypto/mem.c:312:1: start of procedure CRYPTO_zalloc()
    310.   }
    311.   
    312. > void *CRYPTO_zalloc(size_t num, const char *file, int line)
    313.   {
    314.       void *ret = CRYPTO_malloc(num, file, line);

crypto/mem.c:314:5: 
    312.   void *CRYPTO_zalloc(size_t num, const char *file, int line)
    313.   {
    314. >     void *ret = CRYPTO_malloc(num, file, line);
    315.   
    316.       if (ret != NULL)

crypto/mem.c:279:1: start of procedure CRYPTO_malloc()
      277.   }
      278.   
      279. > void *CRYPTO_malloc(size_t num, const char *file, int line)
      280.   {
      281.       void *ret = NULL;

crypto/mem.c:281:5: 
      279.   void *CRYPTO_malloc(size_t num, const char *file, int line)
      280.   {
      281. >     void *ret = NULL;
      282.   
      283.       if (num <= 0)

crypto/mem.c:283:9: Taking false branch
      281.       void *ret = NULL;
      282.   
      283.       if (num <= 0)
                     ^
      284.           return NULL;
      285.   

crypto/mem.c:286:9: Taking false branch
      284.           return NULL;
      285.   
      286.       if (allow_customize)
                     ^
      287.           allow_customize = 0;
      288.       if (malloc_debug_func != NULL) {

crypto/mem.c:288:9: Taking false branch
      286.       if (allow_customize)
      287.           allow_customize = 0;
      288.       if (malloc_debug_func != NULL) {
                     ^
      289.           if (allow_customize_debug)
      290.               allow_customize_debug = 0;

crypto/mem.c:293:5: Skipping __function_pointer__(): unresolved function pointer
      291.           malloc_debug_func(NULL, num, file, line, 0);
      292.       }
      293.       ret = malloc_ex_func(num, file, line);
                 ^
      294.       if (malloc_debug_func != NULL)
      295.           malloc_debug_func(ret, num, file, line, 1);

crypto/mem.c:294:9: Taking false branch
      292.       }
      293.       ret = malloc_ex_func(num, file, line);
      294.       if (malloc_debug_func != NULL)
                     ^
      295.           malloc_debug_func(ret, num, file, line, 1);
      296.   

crypto/mem.c:309:5: 
      307.   #endif
      308.   
      309. >     return ret;
      310.   }
      311.   

crypto/mem.c:310:1: return from a call to CRYPTO_malloc
      308.   
      309.       return ret;
      310. > }
      311.   
      312.   void *CRYPTO_zalloc(size_t num, const char *file, int line)

crypto/mem.c:316:9: Taking false branch
    314.       void *ret = CRYPTO_malloc(num, file, line);
    315.   
    316.       if (ret != NULL)
                   ^
    317.           memset(ret, 0, num);
    318.       return ret;

crypto/mem.c:318:5: 
    316.       if (ret != NULL)
    317.           memset(ret, 0, num);
    318. >     return ret;
    319.   }
    320.   

crypto/mem.c:319:1: return from a call to CRYPTO_zalloc
    317.           memset(ret, 0, num);
    318.       return ret;
    319. > }
    320.   
    321.   void *CRYPTO_realloc(void *str, size_t num, const char *file, int line)

crypto/evp/digest.c:156:1: return from a call to EVP_MD_CTX_new
  154.   {
  155.       return OPENSSL_zalloc(sizeof(EVP_MD_CTX));
  156. > }
  157.   
  158.   void EVP_MD_CTX_free(EVP_MD_CTX *ctx)

apps/req.c:1548:5: 
1546.       int rv;
1547.       EVP_MD_CTX *mctx = EVP_MD_CTX_new();
1548. >     rv = do_sign_init(mctx, pkey, md, sigopts);
1549.       /* Note: X509_CRL_sign_ctx() calls ASN1_item_sign_ctx(), which destroys
1550.        * the EVP_MD_CTX we send it, so only destroy it here if the former

apps/req.c:1489:1: start of procedure do_sign_init()
  1487.   }
  1488.   
  1489. > static int do_sign_init(EVP_MD_CTX *ctx, EVP_PKEY *pkey,
  1490.                           const EVP_MD *md, STACK_OF(OPENSSL_STRING) *sigopts)
  1491.   {

apps/req.c:1492:5: 
  1490.                           const EVP_MD *md, STACK_OF(OPENSSL_STRING) *sigopts)
  1491.   {
  1492. >     EVP_PKEY_CTX *pkctx = NULL;
  1493.       int i;
  1494.   

apps/req.c:1495:9: Taking true branch
  1493.       int i;
  1494.   
  1495.       if (ctx == NULL)
                  ^
  1496.           return 0;
  1497.       if (!EVP_DigestSignInit(ctx, &pkctx, md, NULL, pkey))

apps/req.c:1496:9: 
  1494.   
  1495.       if (ctx == NULL)
  1496. >         return 0;
  1497.       if (!EVP_DigestSignInit(ctx, &pkctx, md, NULL, pkey))
  1498.           return 0;

apps/req.c:1508:1: return from a call to do_sign_init
  1506.       }
  1507.       return 1;
  1508. > }
  1509.   
  1510.   int do_X509_sign(X509 *x, EVP_PKEY *pkey, const EVP_MD *md,

apps/req.c:1552:9: Taking false branch
1550.        * the EVP_MD_CTX we send it, so only destroy it here if the former
1551.        * isn't called */
1552.       if (rv > 0)
                ^
1553.           rv = X509_CRL_sign_ctx(x, mctx);
1554.       else

apps/req.c:1555:9: 
1553.           rv = X509_CRL_sign_ctx(x, mctx);
1554.       else
1555. >         EVP_MD_CTX_free(mctx);
1556.       return rv > 0 ? 1 : 0;
1557.   }

int do_X509_CRL_sign(X509_CRL *x, EVP_PKEY *pkey, const EVP_MD *md,
                     STACK_OF(OPENSSL_STRING) *sigopts)
{
    int rv;
    EVP_MD_CTX *mctx = EVP_MD_CTX_new();
    rv = do_sign_init(mctx, pkey, md, sigopts);
    if (rv > 0)
        rv = X509_CRL_sign_ctx(x, mctx);
    else
        EVP_MD_CTX_free(mctx);
    return rv > 0 ? 1 : 0;
}
['int do_X509_CRL_sign(X509_CRL *x, EVP_PKEY *pkey, const EVP_MD *md,\n                     STACK_OF(OPENSSL_STRING) *sigopts)\n{\n    int rv;\n    EVP_MD_CTX *mctx = EVP_MD_CTX_new();\n    rv = do_sign_init(mctx, pkey, md, sigopts);\n    if (rv > 0)\n        rv = X509_CRL_sign_ctx(x, mctx);\n    else\n        EVP_MD_CTX_free(mctx);\n    return rv > 0 ? 1 : 0;\n}', 'EVP_MD_CTX *EVP_MD_CTX_new(void)\n{\n    return OPENSSL_zalloc(sizeof(EVP_MD_CTX));\n}', 'void *CRYPTO_zalloc(size_t num, const char *file, int line)\n{\n    void *ret = CRYPTO_malloc(num, file, line);\n    if (ret != NULL)\n        memset(ret, 0, num);\n    return ret;\n}', 'void *CRYPTO_malloc(size_t num, const char *file, int line)\n{\n    void *ret = NULL;\n    if (num <= 0)\n        return NULL;\n    if (allow_customize)\n        allow_customize = 0;\n    if (malloc_debug_func != NULL) {\n        if (allow_customize_debug)\n            allow_customize_debug = 0;\n        malloc_debug_func(NULL, num, file, line, 0);\n    }\n    ret = malloc_ex_func(num, file, line);\n    if (malloc_debug_func != NULL)\n        malloc_debug_func(ret, num, file, line, 1);\n#ifndef OPENSSL_CPUID_OBJ\n    if (ret && (num > 2048)) {\n        extern unsigned char cleanse_ctr;\n        ((unsigned char *)ret)[0] = cleanse_ctr;\n    }\n#endif\n    return ret;\n}', 'static int do_sign_init(EVP_MD_CTX *ctx, EVP_PKEY *pkey,\n                        const EVP_MD *md, STACK_OF(OPENSSL_STRING) *sigopts)\n{\n    EVP_PKEY_CTX *pkctx = NULL;\n    int i;\n    if (ctx == NULL)\n        return 0;\n    if (!EVP_DigestSignInit(ctx, &pkctx, md, NULL, pkey))\n        return 0;\n    for (i = 0; i < sk_OPENSSL_STRING_num(sigopts); i++) {\n        char *sigopt = sk_OPENSSL_STRING_value(sigopts, i);\n        if (pkey_ctrl_string(pkctx, sigopt) <= 0) {\n            BIO_printf(bio_err, "parameter error \\"%s\\"\\n", sigopt);\n            ERR_print_errors(bio_err);\n            return 0;\n        }\n    }\n    return 1;\n}']