crypto/x509/x509_req.c:105: error: NULL_DEREFERENCE
  pointer `ret` last assigned on line 76 could be null and is dereferenced by call to `X509_REQ_free()` at line 105, column 2.
Showing all 24 steps of the trace


crypto/x509/x509_req.c:69:1: start of procedure X509_to_X509_REQ()
67.   #include <openssl/pem.h>
68.   
69. > X509_REQ *X509_to_X509_REQ(X509 *x, EVP_PKEY *pkey, const EVP_MD *md)
70.   	{
71.   	X509_REQ *ret;

crypto/x509/x509_req.c:76:2: Skipping X509_REQ_new(): empty list of specs
74.   	EVP_PKEY *pktmp;
75.   
76.   	ret=X509_REQ_new();
       ^
77.   	if (ret == NULL)
78.   		{

crypto/x509/x509_req.c:77:6: Taking true branch
75.   
76.   	ret=X509_REQ_new();
77.   	if (ret == NULL)
           ^
78.   		{
79.   		X509err(X509_F_X509_TO_X509_REQ,ERR_R_MALLOC_FAILURE);

crypto/x509/x509_req.c:79:3: 
77.   	if (ret == NULL)
78.   		{
79. > 		X509err(X509_F_X509_TO_X509_REQ,ERR_R_MALLOC_FAILURE);
80.   		goto err;
81.   		}

crypto/err/err.c:353:1: start of procedure ERR_put_error()
  351.   /********************************************************/
  352.   
  353. > void ERR_put_error(int lib, int func, int reason, const char *file,
  354.   	     int line)
  355.   	{

crypto/err/err.c:377:2: Skipping ERR_get_state(): empty list of specs
  375.   	}
  376.   #endif
  377.   	es=ERR_get_state();
          ^
  378.   
  379.   	es->top=(es->top+1)%ERR_NUM_ERRORS;

crypto/err/err.c:379:2: 
  377.   	es=ERR_get_state();
  378.   
  379. > 	es->top=(es->top+1)%ERR_NUM_ERRORS;
  380.   	if (es->top == es->bottom)
  381.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;

crypto/err/err.c:380:6: Taking false branch
  378.   
  379.   	es->top=(es->top+1)%ERR_NUM_ERRORS;
  380.   	if (es->top == es->bottom)
              ^
  381.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
  382.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);

crypto/err/err.c:382:2: 
  380.   	if (es->top == es->bottom)
  381.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
  382. > 	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
  383.   	es->err_file[es->top]=file;
  384.   	es->err_line[es->top]=line;

crypto/err/err.c:383:2: 
  381.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
  382.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
  383. > 	es->err_file[es->top]=file;
  384.   	es->err_line[es->top]=line;
  385.   	err_clear_data(es,es->top);

crypto/err/err.c:384:2: 
  382.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
  383.   	es->err_file[es->top]=file;
  384. > 	es->err_line[es->top]=line;
  385.   	err_clear_data(es,es->top);
  386.   	}

crypto/err/err.c:385:2: Taking true branch
  383.   	es->err_file[es->top]=file;
  384.   	es->err_line[es->top]=line;
  385.   	err_clear_data(es,es->top);
          ^
  386.   	}
  387.   

crypto/err/err.c:385:2: Taking false branch
  383.   	es->err_file[es->top]=file;
  384.   	es->err_line[es->top]=line;
  385.   	err_clear_data(es,es->top);
          ^
  386.   	}
  387.   

crypto/err/err.c:386:2: return from a call to ERR_put_error
  384.   	es->err_line[es->top]=line;
  385.   	err_clear_data(es,es->top);
  386.   	}
          ^
  387.   
  388.   void ERR_clear_error(void)

crypto/x509/x509_req.c:104:1: 
102.   		}
103.   	return(ret);
104. > err:
105.   	X509_REQ_free(ret);
106.   	return(NULL);

crypto/x509/x509_req.c:105:2: 
103.   	return(ret);
104.   err:
105. > 	X509_REQ_free(ret);
106.   	return(NULL);
107.   	}

crypto/asn1/x_req.c:211:1: start of procedure X509_REQ_free()
  209.   	}
  210.   
  211. > void X509_REQ_free(X509_REQ *a)
  212.   	{
  213.   	int i;

crypto/asn1/x_req.c:215:6: Taking false branch
  213.   	int i;
  214.   
  215.   	if (a == NULL) return;
              ^
  216.   
  217.   	i=CRYPTO_add(&a->references,-1,CRYPTO_LOCK_X509_REQ);

crypto/asn1/x_req.c:217:2: 
  215.   	if (a == NULL) return;
  216.   
  217. > 	i=CRYPTO_add(&a->references,-1,CRYPTO_LOCK_X509_REQ);
  218.   #ifdef REF_PRINT
  219.   	REF_PRINT("X509_REQ",a);

crypto/cryptlib.c:414:1: start of procedure CRYPTO_add_lock()
    412.   	}
    413.   
    414. > int CRYPTO_add_lock(int *pointer, int amount, int type, const char *file,
    415.   	     int line)
    416.   	{

crypto/cryptlib.c:417:2: 
    415.   	     int line)
    416.   	{
    417. > 	int ret = 0;
    418.   
    419.   	if (add_lock_callback != NULL)

crypto/cryptlib.c:419:6: Taking true branch
    417.   	int ret = 0;
    418.   
    419.   	if (add_lock_callback != NULL)
                ^
    420.   		{
    421.   #ifdef LOCK_DEBUG

crypto/cryptlib.c:425:3: Skipping __function_pointer__(): unresolved function pointer
    423.   #endif
    424.   
    425.   		ret=add_lock_callback(pointer,amount,type,file,line);
             ^
    426.   #ifdef LOCK_DEBUG
    427.   		fprintf(stderr,"ladd:%08lx:%2d+%2d->%2d %-18s %s:%d\n",

crypto/cryptlib.c:433:3: 
    431.   			file,line);
    432.   #endif
    433. > 		*pointer=ret;
    434.   		}
    435.   	else

X509_REQ *X509_to_X509_REQ(X509 *x, EVP_PKEY *pkey, const EVP_MD *md)
	{
	X509_REQ *ret;
	X509_REQ_INFO *ri;
	int i;
	EVP_PKEY *pktmp;
	ret=X509_REQ_new();
	if (ret == NULL)
		{
		X509err(X509_F_X509_TO_X509_REQ,ERR_R_MALLOC_FAILURE);
		goto err;
		}
	ri=ret->req_info;
	ri->version->length=1;
	ri->version->data=(unsigned char *)OPENSSL_malloc(1);
	if (ri->version->data == NULL) goto err;
	ri->version->data[0]=0;
	if (!X509_REQ_set_subject_name(ret,X509_get_subject_name(x)))
		goto err;
	pktmp = X509_get_pubkey(x);
	i=X509_REQ_set_pubkey(ret,pktmp);
	EVP_PKEY_free(pktmp);
	if (!i) goto err;
	if (pkey != NULL)
		{
		if (!X509_REQ_sign(ret,pkey,md))
			goto err;
		}
	return(ret);
err:
	X509_REQ_free(ret);
	return(NULL);
	}
['X509_REQ *X509_to_X509_REQ(X509 *x, EVP_PKEY *pkey, const EVP_MD *md)\n\t{\n\tX509_REQ *ret;\n\tX509_REQ_INFO *ri;\n\tint i;\n\tEVP_PKEY *pktmp;\n\tret=X509_REQ_new();\n\tif (ret == NULL)\n\t\t{\n\t\tX509err(X509_F_X509_TO_X509_REQ,ERR_R_MALLOC_FAILURE);\n\t\tgoto err;\n\t\t}\n\tri=ret->req_info;\n\tri->version->length=1;\n\tri->version->data=(unsigned char *)OPENSSL_malloc(1);\n\tif (ri->version->data == NULL) goto err;\n\tri->version->data[0]=0;\n\tif (!X509_REQ_set_subject_name(ret,X509_get_subject_name(x)))\n\t\tgoto err;\n\tpktmp = X509_get_pubkey(x);\n\ti=X509_REQ_set_pubkey(ret,pktmp);\n\tEVP_PKEY_free(pktmp);\n\tif (!i) goto err;\n\tif (pkey != NULL)\n\t\t{\n\t\tif (!X509_REQ_sign(ret,pkey,md))\n\t\t\tgoto err;\n\t\t}\n\treturn(ret);\nerr:\n\tX509_REQ_free(ret);\n\treturn(NULL);\n\t}', 'void ERR_put_error(int lib, int func, int reason, const char *file,\n\t     int line)\n\t{\n\tERR_STATE *es;\n#ifdef _OSD_POSIX\n\tif (strncmp(file,"*POSIX(", sizeof("*POSIX(")-1) == 0) {\n\t\tchar *end;\n\t\tfile += sizeof("*POSIX(")-1;\n\t\tend = &file[strlen(file)-1];\n\t\tif (*end == \')\')\n\t\t\t*end = \'\\0\';\n\t\tif ((end = strrchr(file, \'/\')) != NULL)\n\t\t\tfile = &end[1];\n\t}\n#endif\n\tes=ERR_get_state();\n\tes->top=(es->top+1)%ERR_NUM_ERRORS;\n\tif (es->top == es->bottom)\n\t\tes->bottom=(es->bottom+1)%ERR_NUM_ERRORS;\n\tes->err_buffer[es->top]=ERR_PACK(lib,func,reason);\n\tes->err_file[es->top]=file;\n\tes->err_line[es->top]=line;\n\terr_clear_data(es,es->top);\n\t}', 'void X509_REQ_free(X509_REQ *a)\n\t{\n\tint i;\n\tif (a == NULL) return;\n\ti=CRYPTO_add(&a->references,-1,CRYPTO_LOCK_X509_REQ);\n#ifdef REF_PRINT\n\tREF_PRINT("X509_REQ",a);\n#endif\n\tif (i > 0) return;\n#ifdef REF_CHECK\n\tif (i < 0)\n\t\t{\n\t\tfprintf(stderr,"X509_REQ_free, bad reference count\\n");\n\t\tabort();\n\t\t}\n#endif\n\tX509_REQ_INFO_free(a->req_info);\n\tX509_ALGOR_free(a->sig_alg);\n\tM_ASN1_BIT_STRING_free(a->signature);\n\tOPENSSL_free(a);\n\t}', 'int CRYPTO_add_lock(int *pointer, int amount, int type, const char *file,\n\t     int line)\n\t{\n\tint ret = 0;\n\tif (add_lock_callback != NULL)\n\t\t{\n#ifdef LOCK_DEBUG\n\t\tint before= *pointer;\n#endif\n\t\tret=add_lock_callback(pointer,amount,type,file,line);\n#ifdef LOCK_DEBUG\n\t\tfprintf(stderr,"ladd:%08lx:%2d+%2d->%2d %-18s %s:%d\\n",\n\t\t\tCRYPTO_thread_id(),\n\t\t\tbefore,amount,ret,\n\t\t\tCRYPTO_get_lock_name(type),\n\t\t\tfile,line);\n#endif\n\t\t*pointer=ret;\n\t\t}\n\telse\n\t\t{\n\t\tCRYPTO_lock(CRYPTO_LOCK|CRYPTO_WRITE,type,file,line);\n\t\tret= *pointer+amount;\n#ifdef LOCK_DEBUG\n\t\tfprintf(stderr,"ladd:%08lx:%2d+%2d->%2d %-18s %s:%d\\n",\n\t\t\tCRYPTO_thread_id(),\n\t\t\t*pointer,amount,ret,\n\t\t\tCRYPTO_get_lock_name(type),\n\t\t\tfile,line);\n#endif\n\t\t*pointer=ret;\n\t\tCRYPTO_lock(CRYPTO_UNLOCK|CRYPTO_WRITE,type,file,line);\n\t\t}\n\treturn(ret);\n\t}']