crypto/conf/conf.c:522: error: NULL_DEREFERENCE
  pointer `buf->data` last assigned on line 519 could be null and is dereferenced by call to `BUF_MEM_grow()` at line 522, column 7.
Showing all 26 steps of the trace


crypto/conf/conf.c:513:1: start of procedure str_copy()
511.   	}
512.   
513. > static int str_copy(LHASH *conf, char *section, char **pto, char *from)
514.   	{
515.   	int q,r,rr=0,to=0,len=0;

crypto/conf/conf.c:515:2: 
513.   static int str_copy(LHASH *conf, char *section, char **pto, char *from)
514.   	{
515. > 	int q,r,rr=0,to=0,len=0;
516.   	char *s,*e,*rp,*p,*rrp,*np,*cp,v;
517.   	BUF_MEM *buf;

crypto/conf/conf.c:519:6: 
517.   	BUF_MEM *buf;
518.   
519. > 	if ((buf=BUF_MEM_new()) == NULL) return(0);
520.   
521.   	len=strlen(from)+1;

crypto/buffer/buffer.c:63:1: start of procedure BUF_MEM_new()
  61.   #include <openssl/buffer.h>
  62.   
  63. > BUF_MEM *BUF_MEM_new(void)
  64.   	{
  65.   	BUF_MEM *ret;

crypto/buffer/buffer.c:67:2: 
  65.   	BUF_MEM *ret;
  66.   
  67. > 	ret=Malloc(sizeof(BUF_MEM));
  68.   	if (ret == NULL)
  69.   		{

crypto/buffer/buffer.c:68:6: Taking false branch
  66.   
  67.   	ret=Malloc(sizeof(BUF_MEM));
  68.   	if (ret == NULL)
             ^
  69.   		{
  70.   		BUFerr(BUF_F_BUF_MEM_NEW,ERR_R_MALLOC_FAILURE);

crypto/buffer/buffer.c:73:2: 
  71.   		return(NULL);
  72.   		}
  73. > 	ret->length=0;
  74.   	ret->max=0;
  75.   	ret->data=NULL;

crypto/buffer/buffer.c:74:2: 
  72.   		}
  73.   	ret->length=0;
  74. > 	ret->max=0;
  75.   	ret->data=NULL;
  76.   	return(ret);

crypto/buffer/buffer.c:75:2: 
  73.   	ret->length=0;
  74.   	ret->max=0;
  75. > 	ret->data=NULL;
  76.   	return(ret);
  77.   	}

crypto/buffer/buffer.c:76:2: 
  74.   	ret->max=0;
  75.   	ret->data=NULL;
  76. > 	return(ret);
  77.   	}
  78.   

crypto/buffer/buffer.c:77:2: return from a call to BUF_MEM_new
  75.   	ret->data=NULL;
  76.   	return(ret);
  77.   	}
         ^
  78.   
  79.   void BUF_MEM_free(BUF_MEM *a)

crypto/conf/conf.c:519:6: Taking false branch
517.   	BUF_MEM *buf;
518.   
519.   	if ((buf=BUF_MEM_new()) == NULL) return(0);
            ^
520.   
521.   	len=strlen(from)+1;

crypto/conf/conf.c:521:2: 
519.   	if ((buf=BUF_MEM_new()) == NULL) return(0);
520.   
521. > 	len=strlen(from)+1;
522.   	if (!BUF_MEM_grow(buf,len)) goto err;
523.   

crypto/conf/conf.c:522:7: 
520.   
521.   	len=strlen(from)+1;
522. > 	if (!BUF_MEM_grow(buf,len)) goto err;
523.   
524.   	for (;;)

crypto/buffer/buffer.c:92:1: start of procedure BUF_MEM_grow()
  90.   	}
  91.   
  92. > int BUF_MEM_grow(BUF_MEM *str, int len)
  93.   	{
  94.   	char *ret;

crypto/buffer/buffer.c:97:6: Taking false branch
  95.   	unsigned int n;
  96.   
  97.   	if (str->length >= len)
              ^
  98.   		{
  99.   		str->length=len;

crypto/buffer/buffer.c:102:6: Taking false branch
  100.   		return(len);
  101.   		}
  102.   	if (str->max >= len)
              ^
  103.   		{
  104.   		memset(&str->data[str->length],0,len-str->length);

crypto/buffer/buffer.c:108:2: 
  106.   		return(len);
  107.   		}
  108. > 	n=(len+3)/3*4;
  109.   	if (str->data == NULL)
  110.   		ret=Malloc(n);

crypto/buffer/buffer.c:109:6: Taking false branch
  107.   		}
  108.   	n=(len+3)/3*4;
  109.   	if (str->data == NULL)
              ^
  110.   		ret=Malloc(n);
  111.   	else

crypto/buffer/buffer.c:112:3: 
  110.   		ret=Malloc(n);
  111.   	else
  112. > 		ret=Realloc(str->data,n);
  113.   	if (ret == NULL)
  114.   		{

crypto/buffer/buffer.c:113:6: Taking false branch
  111.   	else
  112.   		ret=Realloc(str->data,n);
  113.   	if (ret == NULL)
              ^
  114.   		{
  115.   		BUFerr(BUF_F_BUF_MEM_GROW,ERR_R_MALLOC_FAILURE);

crypto/buffer/buffer.c:120:3: 
  118.   	else
  119.   		{
  120. > 		str->data=ret;
  121.   		str->length=len;
  122.   		str->max=n;

crypto/buffer/buffer.c:121:3: 
  119.   		{
  120.   		str->data=ret;
  121. > 		str->length=len;
  122.   		str->max=n;
  123.   		}

crypto/buffer/buffer.c:122:3: 
  120.   		str->data=ret;
  121.   		str->length=len;
  122. > 		str->max=n;
  123.   		}
  124.   	return(len);

crypto/buffer/buffer.c:124:2: 
  122.   		str->max=n;
  123.   		}
  124. > 	return(len);
  125.   	}
  126.   

crypto/buffer/buffer.c:125:2: return from a call to BUF_MEM_grow
  123.   		}
  124.   	return(len);
  125.   	}
          ^
  126.   
  127.   char *BUF_strdup(const char *str)

static int str_copy(LHASH *conf, char *section, char **pto, char *from)
	{
	int q,r,rr=0,to=0,len=0;
	char *s,*e,*rp,*p,*rrp,*np,*cp,v;
	BUF_MEM *buf;
	if ((buf=BUF_MEM_new()) == NULL) return(0);
	len=strlen(from)+1;
	if (!BUF_MEM_grow(buf,len)) goto err;
	for (;;)
		{
		if (IS_QUOTE(*from))
			{
			q= *from;
			from++;
			while ((*from != '\0') && (*from != q))
				{
				if (*from == '\\')
					{
					from++;
					if (*from == '\0') break;
					}
				buf->data[to++]= *(from++);
				}
			}
		else if (*from == '\\')
			{
			from++;
			v= *(from++);
			if (v == '\0') break;
			else if (v == 'r') v='\r';
			else if (v == 'n') v='\n';
			else if (v == 'b') v='\b';
			else if (v == 't') v='\t';
			buf->data[to++]= v;
			}
		else if (*from == '\0')
			break;
		else if (*from == '$')
			{
			rrp=NULL;
			s= &(from[1]);
			if (*s == '{')
				q='}';
			else if (*s == '(')
				q=')';
			else q=0;
			if (q) s++;
			cp=section;
			e=np=s;
			while (IS_ALPHA_NUMERIC(*e))
				e++;
			if ((e[0] == ':') && (e[1] == ':'))
				{
				cp=np;
				rrp=e;
				rr= *e;
				*rrp='\0';
				e+=2;
				np=e;
				while (IS_ALPHA_NUMERIC(*e))
					e++;
				}
			r= *e;
			*e='\0';
			rp=e;
			if (q)
				{
				if (r != q)
					{
					CONFerr(CONF_F_STR_COPY,CONF_R_NO_CLOSE_BRACE);
					goto err;
					}
				e++;
				}
			p=CONF_get_string(conf,cp,np);
			if (rrp != NULL) *rrp=rr;
			*rp=r;
			if (p == NULL)
				{
				CONFerr(CONF_F_STR_COPY,CONF_R_VARIABLE_HAS_NO_VALUE);
				goto err;
				}
			BUF_MEM_grow(buf,(strlen(p)+len-(e-from)));
			while (*p)
				buf->data[to++]= *(p++);
			from=e;
			}
		else
			buf->data[to++]= *(from++);
		}
	buf->data[to]='\0';
	if (*pto != NULL) Free(*pto);
	*pto=buf->data;
	Free(buf);
	return(1);
err:
	if (buf != NULL) BUF_MEM_free(buf);
	return(0);
	}
["static int str_copy(LHASH *conf, char *section, char **pto, char *from)\n\t{\n\tint q,r,rr=0,to=0,len=0;\n\tchar *s,*e,*rp,*p,*rrp,*np,*cp,v;\n\tBUF_MEM *buf;\n\tif ((buf=BUF_MEM_new()) == NULL) return(0);\n\tlen=strlen(from)+1;\n\tif (!BUF_MEM_grow(buf,len)) goto err;\n\tfor (;;)\n\t\t{\n\t\tif (IS_QUOTE(*from))\n\t\t\t{\n\t\t\tq= *from;\n\t\t\tfrom++;\n\t\t\twhile ((*from != '\\0') && (*from != q))\n\t\t\t\t{\n\t\t\t\tif (*from == '\\\\')\n\t\t\t\t\t{\n\t\t\t\t\tfrom++;\n\t\t\t\t\tif (*from == '\\0') break;\n\t\t\t\t\t}\n\t\t\t\tbuf->data[to++]= *(from++);\n\t\t\t\t}\n\t\t\t}\n\t\telse if (*from == '\\\\')\n\t\t\t{\n\t\t\tfrom++;\n\t\t\tv= *(from++);\n\t\t\tif (v == '\\0') break;\n\t\t\telse if (v == 'r') v='\\r';\n\t\t\telse if (v == 'n') v='\\n';\n\t\t\telse if (v == 'b') v='\\b';\n\t\t\telse if (v == 't') v='\\t';\n\t\t\tbuf->data[to++]= v;\n\t\t\t}\n\t\telse if (*from == '\\0')\n\t\t\tbreak;\n\t\telse if (*from == '$')\n\t\t\t{\n\t\t\trrp=NULL;\n\t\t\ts= &(from[1]);\n\t\t\tif (*s == '{')\n\t\t\t\tq='}';\n\t\t\telse if (*s == '(')\n\t\t\t\tq=')';\n\t\t\telse q=0;\n\t\t\tif (q) s++;\n\t\t\tcp=section;\n\t\t\te=np=s;\n\t\t\twhile (IS_ALPHA_NUMERIC(*e))\n\t\t\t\te++;\n\t\t\tif ((e[0] == ':') && (e[1] == ':'))\n\t\t\t\t{\n\t\t\t\tcp=np;\n\t\t\t\trrp=e;\n\t\t\t\trr= *e;\n\t\t\t\t*rrp='\\0';\n\t\t\t\te+=2;\n\t\t\t\tnp=e;\n\t\t\t\twhile (IS_ALPHA_NUMERIC(*e))\n\t\t\t\t\te++;\n\t\t\t\t}\n\t\t\tr= *e;\n\t\t\t*e='\\0';\n\t\t\trp=e;\n\t\t\tif (q)\n\t\t\t\t{\n\t\t\t\tif (r != q)\n\t\t\t\t\t{\n\t\t\t\t\tCONFerr(CONF_F_STR_COPY,CONF_R_NO_CLOSE_BRACE);\n\t\t\t\t\tgoto err;\n\t\t\t\t\t}\n\t\t\t\te++;\n\t\t\t\t}\n\t\t\tp=CONF_get_string(conf,cp,np);\n\t\t\tif (rrp != NULL) *rrp=rr;\n\t\t\t*rp=r;\n\t\t\tif (p == NULL)\n\t\t\t\t{\n\t\t\t\tCONFerr(CONF_F_STR_COPY,CONF_R_VARIABLE_HAS_NO_VALUE);\n\t\t\t\tgoto err;\n\t\t\t\t}\n\t\t\tBUF_MEM_grow(buf,(strlen(p)+len-(e-from)));\n\t\t\twhile (*p)\n\t\t\t\tbuf->data[to++]= *(p++);\n\t\t\tfrom=e;\n\t\t\t}\n\t\telse\n\t\t\tbuf->data[to++]= *(from++);\n\t\t}\n\tbuf->data[to]='\\0';\n\tif (*pto != NULL) Free(*pto);\n\t*pto=buf->data;\n\tFree(buf);\n\treturn(1);\nerr:\n\tif (buf != NULL) BUF_MEM_free(buf);\n\treturn(0);\n\t}", 'BUF_MEM *BUF_MEM_new(void)\n\t{\n\tBUF_MEM *ret;\n\tret=Malloc(sizeof(BUF_MEM));\n\tif (ret == NULL)\n\t\t{\n\t\tBUFerr(BUF_F_BUF_MEM_NEW,ERR_R_MALLOC_FAILURE);\n\t\treturn(NULL);\n\t\t}\n\tret->length=0;\n\tret->max=0;\n\tret->data=NULL;\n\treturn(ret);\n\t}', 'int BUF_MEM_grow(BUF_MEM *str, int len)\n\t{\n\tchar *ret;\n\tunsigned int n;\n\tif (str->length >= len)\n\t\t{\n\t\tstr->length=len;\n\t\treturn(len);\n\t\t}\n\tif (str->max >= len)\n\t\t{\n\t\tmemset(&str->data[str->length],0,len-str->length);\n\t\tstr->length=len;\n\t\treturn(len);\n\t\t}\n\tn=(len+3)/3*4;\n\tif (str->data == NULL)\n\t\tret=Malloc(n);\n\telse\n\t\tret=Realloc(str->data,n);\n\tif (ret == NULL)\n\t\t{\n\t\tBUFerr(BUF_F_BUF_MEM_GROW,ERR_R_MALLOC_FAILURE);\n\t\tlen=0;\n\t\t}\n\telse\n\t\t{\n\t\tstr->data=ret;\n\t\tstr->length=len;\n\t\tstr->max=n;\n\t\t}\n\treturn(len);\n\t}']