engines/ccgost/gost_pmeth.c:506: error: NULL_DEREFERENCE
  pointer `keydata` last assigned on line 505 could be null and is dereferenced by call to `memcpy()` at line 506, column 3.
Showing all 21 steps of the trace


engines/ccgost/gost_pmeth.c:496:1: start of procedure pkey_gost_mac_keygen()
494.   	}	
495.   
496. > static int pkey_gost_mac_keygen(EVP_PKEY_CTX *ctx, EVP_PKEY *pkey)
497.   	{
498.   		struct gost_mac_pmeth_data *data = EVP_PKEY_CTX_get_data(ctx);

engines/ccgost/gost_pmeth.c:498:3: 
496.   static int pkey_gost_mac_keygen(EVP_PKEY_CTX *ctx, EVP_PKEY *pkey)
497.   	{
498. > 		struct gost_mac_pmeth_data *data = EVP_PKEY_CTX_get_data(ctx);
499.   		unsigned char *keydata;
500.   		if (!data->key_set) 

crypto/evp/pmeth_lib.c:388:1: start of procedure EVP_PKEY_CTX_get_data()
  386.   	}
  387.   
  388. > void *EVP_PKEY_CTX_get_data(EVP_PKEY_CTX *ctx)
  389.   	{
  390.   	return ctx->data;

crypto/evp/pmeth_lib.c:390:2: 
  388.   void *EVP_PKEY_CTX_get_data(EVP_PKEY_CTX *ctx)
  389.   	{
  390. > 	return ctx->data;
  391.   	}
  392.   

crypto/evp/pmeth_lib.c:391:2: return from a call to EVP_PKEY_CTX_get_data
  389.   	{
  390.   	return ctx->data;
  391.   	}
          ^
  392.   
  393.   EVP_PKEY *EVP_PKEY_CTX_get0_pkey(EVP_PKEY_CTX *ctx)

engines/ccgost/gost_pmeth.c:500:8: Taking false branch
498.   		struct gost_mac_pmeth_data *data = EVP_PKEY_CTX_get_data(ctx);
499.   		unsigned char *keydata;
500.   		if (!data->key_set) 
              ^
501.   		{
502.   			GOSTerr(GOST_F_PKEY_GOST_MAC_KEYGEN,GOST_R_MAC_KEY_NOT_SET);

engines/ccgost/gost_pmeth.c:505:3: 
503.   			return 0;
504.   		}
505. > 		keydata = OPENSSL_malloc(32);
506.   		memcpy(keydata,data->key,32);
507.   		EVP_PKEY_assign(pkey, NID_id_Gost28147_89_MAC, keydata);

crypto/mem.c:294:1: start of procedure CRYPTO_malloc()
  292.   	}
  293.   
  294. > void *CRYPTO_malloc(size_t num, const char *file, int line)
  295.   	{
  296.   	void *ret = NULL;

crypto/mem.c:296:2: 
  294.   void *CRYPTO_malloc(size_t num, const char *file, int line)
  295.   	{
  296. > 	void *ret = NULL;
  297.   
  298.   	if (num <= 0) return NULL;

crypto/mem.c:298:6: Taking false branch
  296.   	void *ret = NULL;
  297.   
  298.   	if (num <= 0) return NULL;
              ^
  299.   
  300.   	allow_customize = 0;

crypto/mem.c:300:2: 
  298.   	if (num <= 0) return NULL;
  299.   
  300. > 	allow_customize = 0;
  301.   	if (malloc_debug_func != NULL)
  302.   		{

crypto/mem.c:301:6: Taking true branch
  299.   
  300.   	allow_customize = 0;
  301.   	if (malloc_debug_func != NULL)
              ^
  302.   		{
  303.   		allow_customize_debug = 0;

crypto/mem.c:303:3: 
  301.   	if (malloc_debug_func != NULL)
  302.   		{
  303. > 		allow_customize_debug = 0;
  304.   		malloc_debug_func(NULL, num, file, line, 0);
  305.   		}

crypto/mem.c:304:3: Skipping __function_pointer__(): unresolved function pointer
  302.   		{
  303.   		allow_customize_debug = 0;
  304.   		malloc_debug_func(NULL, num, file, line, 0);
           ^
  305.   		}
  306.   	ret = malloc_ex_func(num,file,line);

crypto/mem.c:306:2: Skipping __function_pointer__(): unresolved function pointer
  304.   		malloc_debug_func(NULL, num, file, line, 0);
  305.   		}
  306.   	ret = malloc_ex_func(num,file,line);
          ^
  307.   #ifdef LEVITTE_DEBUG_MEM
  308.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);

crypto/mem.c:310:6: Taking true branch
  308.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);
  309.   #endif
  310.   	if (malloc_debug_func != NULL)
              ^
  311.   		malloc_debug_func(ret, num, file, line, 1);
  312.   

crypto/mem.c:311:3: Skipping __function_pointer__(): unresolved function pointer
  309.   #endif
  310.   	if (malloc_debug_func != NULL)
  311.   		malloc_debug_func(ret, num, file, line, 1);
           ^
  312.   
  313.   #ifndef OPENSSL_CPUID_OBJ

crypto/mem.c:317:12: Taking false branch
  315.            * sanitisation function can't be optimised out. NB: We only do
  316.            * this for >2Kb so the overhead doesn't bother us. */
  317.           if(ret && (num > 2048))
                    ^
  318.   	{	extern unsigned char cleanse_ctr;
  319.                   ((unsigned char *)ret)[0] = cleanse_ctr;

crypto/mem.c:323:2: 
  321.   #endif
  322.   
  323. > 	return ret;
  324.   	}
  325.   char *CRYPTO_strdup(const char *str, const char *file, int line)

crypto/mem.c:324:2: return from a call to CRYPTO_malloc
  322.   
  323.   	return ret;
  324.   	}
          ^
  325.   char *CRYPTO_strdup(const char *str, const char *file, int line)
  326.   	{

engines/ccgost/gost_pmeth.c:506:3: 
504.   		}
505.   		keydata = OPENSSL_malloc(32);
506. > 		memcpy(keydata,data->key,32);
507.   		EVP_PKEY_assign(pkey, NID_id_Gost28147_89_MAC, keydata);
508.   		return 1;

static int pkey_gost_mac_keygen(EVP_PKEY_CTX *ctx, EVP_PKEY *pkey)
	{
		struct gost_mac_pmeth_data *data = EVP_PKEY_CTX_get_data(ctx);
		unsigned char *keydata;
		if (!data->key_set)
		{
			GOSTerr(GOST_F_PKEY_GOST_MAC_KEYGEN,GOST_R_MAC_KEY_NOT_SET);
			return 0;
		}
		keydata = OPENSSL_malloc(32);
		memcpy(keydata,data->key,32);
		EVP_PKEY_assign(pkey, NID_id_Gost28147_89_MAC, keydata);
		return 1;
	}
['static int pkey_gost_mac_keygen(EVP_PKEY_CTX *ctx, EVP_PKEY *pkey)\n\t{\n\t\tstruct gost_mac_pmeth_data *data = EVP_PKEY_CTX_get_data(ctx);\n\t\tunsigned char *keydata;\n\t\tif (!data->key_set)\n\t\t{\n\t\t\tGOSTerr(GOST_F_PKEY_GOST_MAC_KEYGEN,GOST_R_MAC_KEY_NOT_SET);\n\t\t\treturn 0;\n\t\t}\n\t\tkeydata = OPENSSL_malloc(32);\n\t\tmemcpy(keydata,data->key,32);\n\t\tEVP_PKEY_assign(pkey, NID_id_Gost28147_89_MAC, keydata);\n\t\treturn 1;\n\t}', 'void *EVP_PKEY_CTX_get_data(EVP_PKEY_CTX *ctx)\n\t{\n\treturn ctx->data;\n\t}', 'void *CRYPTO_malloc(size_t num, const char *file, int line)\n\t{\n\tvoid *ret = NULL;\n\tif (num <= 0) return NULL;\n\tallow_customize = 0;\n\tif (malloc_debug_func != NULL)\n\t\t{\n\t\tallow_customize_debug = 0;\n\t\tmalloc_debug_func(NULL, num, file, line, 0);\n\t\t}\n\tret = malloc_ex_func(num,file,line);\n#ifdef LEVITTE_DEBUG_MEM\n\tfprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\\n", ret, num);\n#endif\n\tif (malloc_debug_func != NULL)\n\t\tmalloc_debug_func(ret, num, file, line, 1);\n#ifndef OPENSSL_CPUID_OBJ\n        if(ret && (num > 2048))\n\t{\textern unsigned char cleanse_ctr;\n                ((unsigned char *)ret)[0] = cleanse_ctr;\n\t}\n#endif\n\treturn ret;\n\t}']