crypto/evp/evp_key.c:194: error: NULL_DEREFERENCE
  pointer `c` last assigned on line 139 could be null and is dereferenced by call to `EVP_MD_CTX_free()` at line 194, column 5.
Showing all 31 steps of the trace


crypto/evp/evp_key.c:121:1: start of procedure EVP_BytesToKey()
119.   }
120.   
121. > int EVP_BytesToKey(const EVP_CIPHER *type, const EVP_MD *md,
122.                      const unsigned char *salt, const unsigned char *data,
123.                      int datal, int count, unsigned char *key,

crypto/evp/evp_key.c:128:5: 
126.       EVP_MD_CTX *c;
127.       unsigned char md_buf[EVP_MAX_MD_SIZE];
128. >     int niv, nkey, addmd = 0;
129.       unsigned int mds = 0, i;
130.       int rv = 0;

crypto/evp/evp_key.c:129:5: 
127.       unsigned char md_buf[EVP_MAX_MD_SIZE];
128.       int niv, nkey, addmd = 0;
129. >     unsigned int mds = 0, i;
130.       int rv = 0;
131.       nkey = type->key_len;

crypto/evp/evp_key.c:130:5: 
128.       int niv, nkey, addmd = 0;
129.       unsigned int mds = 0, i;
130. >     int rv = 0;
131.       nkey = type->key_len;
132.       niv = type->iv_len;

crypto/evp/evp_key.c:131:5: 
129.       unsigned int mds = 0, i;
130.       int rv = 0;
131. >     nkey = type->key_len;
132.       niv = type->iv_len;
133.       OPENSSL_assert(nkey <= EVP_MAX_KEY_LENGTH);

crypto/evp/evp_key.c:132:5: 
130.       int rv = 0;
131.       nkey = type->key_len;
132. >     niv = type->iv_len;
133.       OPENSSL_assert(nkey <= EVP_MAX_KEY_LENGTH);
134.       OPENSSL_assert(niv <= EVP_MAX_IV_LENGTH);

crypto/evp/evp_key.c:133:5: Condition is true
131.       nkey = type->key_len;
132.       niv = type->iv_len;
133.       OPENSSL_assert(nkey <= EVP_MAX_KEY_LENGTH);
           ^
134.       OPENSSL_assert(niv <= EVP_MAX_IV_LENGTH);
135.   

crypto/evp/evp_key.c:134:5: Condition is true
132.       niv = type->iv_len;
133.       OPENSSL_assert(nkey <= EVP_MAX_KEY_LENGTH);
134.       OPENSSL_assert(niv <= EVP_MAX_IV_LENGTH);
           ^
135.   
136.       if (data == NULL)

crypto/evp/evp_key.c:136:9: Taking false branch
134.       OPENSSL_assert(niv <= EVP_MAX_IV_LENGTH);
135.   
136.       if (data == NULL)
               ^
137.           return (nkey);
138.   

crypto/evp/evp_key.c:139:5: 
137.           return (nkey);
138.   
139. >     c = EVP_MD_CTX_new();
140.       if (c == NULL)
141.           goto err;

crypto/evp/digest.c:153:1: start of procedure EVP_MD_CTX_new()
  151.   }
  152.   
  153. > EVP_MD_CTX *EVP_MD_CTX_new(void)
  154.   {
  155.       return OPENSSL_zalloc(sizeof(EVP_MD_CTX));

crypto/evp/digest.c:155:5: 
  153.   EVP_MD_CTX *EVP_MD_CTX_new(void)
  154.   {
  155. >     return OPENSSL_zalloc(sizeof(EVP_MD_CTX));
  156.   }
  157.   

crypto/mem.c:315:1: start of procedure CRYPTO_zalloc()
    313.   }
    314.   
    315. > void *CRYPTO_zalloc(int num, const char *file, int line)
    316.   {
    317.       void *ret = CRYPTO_malloc(num, file, line);

crypto/mem.c:317:5: 
    315.   void *CRYPTO_zalloc(int num, const char *file, int line)
    316.   {
    317. >     void *ret = CRYPTO_malloc(num, file, line);
    318.   
    319.       if (ret != NULL)

crypto/mem.c:279:1: start of procedure CRYPTO_malloc()
      277.   }
      278.   
      279. > void *CRYPTO_malloc(int num, const char *file, int line)
      280.   {
      281.       void *ret = NULL;

crypto/mem.c:281:5: 
      279.   void *CRYPTO_malloc(int num, const char *file, int line)
      280.   {
      281. >     void *ret = NULL;
      282.   
      283.       if (num <= 0)

crypto/mem.c:283:9: Taking false branch
      281.       void *ret = NULL;
      282.   
      283.       if (num <= 0)
                     ^
      284.           return NULL;
      285.   

crypto/mem.c:286:9: Taking true branch
      284.           return NULL;
      285.   
      286.       if (allow_customize)
                     ^
      287.           allow_customize = 0;
      288.       if (malloc_debug_func != NULL) {

crypto/mem.c:287:9: 
      285.   
      286.       if (allow_customize)
      287. >         allow_customize = 0;
      288.       if (malloc_debug_func != NULL) {
      289.           if (allow_customize_debug)

crypto/mem.c:288:9: Taking false branch
      286.       if (allow_customize)
      287.           allow_customize = 0;
      288.       if (malloc_debug_func != NULL) {
                     ^
      289.           if (allow_customize_debug)
      290.               allow_customize_debug = 0;

crypto/mem.c:293:5: Skipping __function_pointer__(): unresolved function pointer
      291.           malloc_debug_func(NULL, num, file, line, 0);
      292.       }
      293.       ret = malloc_ex_func(num, file, line);
                 ^
      294.   #ifdef LEVITTE_DEBUG_MEM
      295.       fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);

crypto/mem.c:297:9: Taking false branch
      295.       fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);
      296.   #endif
      297.       if (malloc_debug_func != NULL)
                     ^
      298.           malloc_debug_func(ret, num, file, line, 1);
      299.   

crypto/mem.c:312:5: 
      310.   #endif
      311.   
      312. >     return ret;
      313.   }
      314.   

crypto/mem.c:313:1: return from a call to CRYPTO_malloc
      311.   
      312.       return ret;
      313. > }
      314.   
      315.   void *CRYPTO_zalloc(int num, const char *file, int line)

crypto/mem.c:319:9: Taking false branch
    317.       void *ret = CRYPTO_malloc(num, file, line);
    318.   
    319.       if (ret != NULL)
                   ^
    320.           memset(ret, 0, num);
    321.       return ret;

crypto/mem.c:321:5: 
    319.       if (ret != NULL)
    320.           memset(ret, 0, num);
    321. >     return ret;
    322.   }
    323.   

crypto/mem.c:322:1: return from a call to CRYPTO_zalloc
    320.           memset(ret, 0, num);
    321.       return ret;
    322. > }
    323.   
    324.   char *CRYPTO_strdup(const char *str, const char *file, int line)

crypto/evp/digest.c:156:1: return from a call to EVP_MD_CTX_new
  154.   {
  155.       return OPENSSL_zalloc(sizeof(EVP_MD_CTX));
  156. > }
  157.   
  158.   void EVP_MD_CTX_free(EVP_MD_CTX *ctx)

crypto/evp/evp_key.c:140:9: Taking true branch
138.   
139.       c = EVP_MD_CTX_new();
140.       if (c == NULL)
               ^
141.           goto err;
142.       for (;;) {

crypto/evp/evp_key.c:193:2: 
191.       }
192.       rv = type->key_len;
193. >  err:
194.       EVP_MD_CTX_free(c);
195.       OPENSSL_cleanse(md_buf, sizeof(md_buf));

crypto/evp/evp_key.c:194:5: 
192.       rv = type->key_len;
193.    err:
194. >     EVP_MD_CTX_free(c);
195.       OPENSSL_cleanse(md_buf, sizeof(md_buf));
196.       return rv;

int EVP_BytesToKey(const EVP_CIPHER *type, const EVP_MD *md,
                   const unsigned char *salt, const unsigned char *data,
                   int datal, int count, unsigned char *key,
                   unsigned char *iv)
{
    EVP_MD_CTX *c;
    unsigned char md_buf[EVP_MAX_MD_SIZE];
    int niv, nkey, addmd = 0;
    unsigned int mds = 0, i;
    int rv = 0;
    nkey = type->key_len;
    niv = type->iv_len;
    OPENSSL_assert(nkey <= EVP_MAX_KEY_LENGTH);
    OPENSSL_assert(niv <= EVP_MAX_IV_LENGTH);
    if (data == NULL)
        return (nkey);
    c = EVP_MD_CTX_new();
    if (c == NULL)
        goto err;
    for (;;) {
        if (!EVP_DigestInit_ex(c, md, NULL))
            goto err;
        if (addmd++)
            if (!EVP_DigestUpdate(c, &(md_buf[0]), mds))
                goto err;
        if (!EVP_DigestUpdate(c, data, datal))
            goto err;
        if (salt != NULL)
            if (!EVP_DigestUpdate(c, salt, PKCS5_SALT_LEN))
                goto err;
        if (!EVP_DigestFinal_ex(c, &(md_buf[0]), &mds))
            goto err;
        for (i = 1; i < (unsigned int)count; i++) {
            if (!EVP_DigestInit_ex(c, md, NULL))
                goto err;
            if (!EVP_DigestUpdate(c, &(md_buf[0]), mds))
                goto err;
            if (!EVP_DigestFinal_ex(c, &(md_buf[0]), &mds))
                goto err;
        }
        i = 0;
        if (nkey) {
            for (;;) {
                if (nkey == 0)
                    break;
                if (i == mds)
                    break;
                if (key != NULL)
                    *(key++) = md_buf[i];
                nkey--;
                i++;
            }
        }
        if (niv && (i != mds)) {
            for (;;) {
                if (niv == 0)
                    break;
                if (i == mds)
                    break;
                if (iv != NULL)
                    *(iv++) = md_buf[i];
                niv--;
                i++;
            }
        }
        if ((nkey == 0) && (niv == 0))
            break;
    }
    rv = type->key_len;
 err:
    EVP_MD_CTX_free(c);
    OPENSSL_cleanse(md_buf, sizeof(md_buf));
    return rv;
}
['int EVP_BytesToKey(const EVP_CIPHER *type, const EVP_MD *md,\n                   const unsigned char *salt, const unsigned char *data,\n                   int datal, int count, unsigned char *key,\n                   unsigned char *iv)\n{\n    EVP_MD_CTX *c;\n    unsigned char md_buf[EVP_MAX_MD_SIZE];\n    int niv, nkey, addmd = 0;\n    unsigned int mds = 0, i;\n    int rv = 0;\n    nkey = type->key_len;\n    niv = type->iv_len;\n    OPENSSL_assert(nkey <= EVP_MAX_KEY_LENGTH);\n    OPENSSL_assert(niv <= EVP_MAX_IV_LENGTH);\n    if (data == NULL)\n        return (nkey);\n    c = EVP_MD_CTX_new();\n    if (c == NULL)\n        goto err;\n    for (;;) {\n        if (!EVP_DigestInit_ex(c, md, NULL))\n            goto err;\n        if (addmd++)\n            if (!EVP_DigestUpdate(c, &(md_buf[0]), mds))\n                goto err;\n        if (!EVP_DigestUpdate(c, data, datal))\n            goto err;\n        if (salt != NULL)\n            if (!EVP_DigestUpdate(c, salt, PKCS5_SALT_LEN))\n                goto err;\n        if (!EVP_DigestFinal_ex(c, &(md_buf[0]), &mds))\n            goto err;\n        for (i = 1; i < (unsigned int)count; i++) {\n            if (!EVP_DigestInit_ex(c, md, NULL))\n                goto err;\n            if (!EVP_DigestUpdate(c, &(md_buf[0]), mds))\n                goto err;\n            if (!EVP_DigestFinal_ex(c, &(md_buf[0]), &mds))\n                goto err;\n        }\n        i = 0;\n        if (nkey) {\n            for (;;) {\n                if (nkey == 0)\n                    break;\n                if (i == mds)\n                    break;\n                if (key != NULL)\n                    *(key++) = md_buf[i];\n                nkey--;\n                i++;\n            }\n        }\n        if (niv && (i != mds)) {\n            for (;;) {\n                if (niv == 0)\n                    break;\n                if (i == mds)\n                    break;\n                if (iv != NULL)\n                    *(iv++) = md_buf[i];\n                niv--;\n                i++;\n            }\n        }\n        if ((nkey == 0) && (niv == 0))\n            break;\n    }\n    rv = type->key_len;\n err:\n    EVP_MD_CTX_free(c);\n    OPENSSL_cleanse(md_buf, sizeof(md_buf));\n    return rv;\n}', 'EVP_MD_CTX *EVP_MD_CTX_new(void)\n{\n    return OPENSSL_zalloc(sizeof(EVP_MD_CTX));\n}', 'void *CRYPTO_zalloc(int num, const char *file, int line)\n{\n    void *ret = CRYPTO_malloc(num, file, line);\n    if (ret != NULL)\n        memset(ret, 0, num);\n    return ret;\n}', 'void *CRYPTO_malloc(int num, const char *file, int line)\n{\n    void *ret = NULL;\n    if (num <= 0)\n        return NULL;\n    if (allow_customize)\n        allow_customize = 0;\n    if (malloc_debug_func != NULL) {\n        if (allow_customize_debug)\n            allow_customize_debug = 0;\n        malloc_debug_func(NULL, num, file, line, 0);\n    }\n    ret = malloc_ex_func(num, file, line);\n#ifdef LEVITTE_DEBUG_MEM\n    fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\\n", ret, num);\n#endif\n    if (malloc_debug_func != NULL)\n        malloc_debug_func(ret, num, file, line, 1);\n#ifndef OPENSSL_CPUID_OBJ\n    if (ret && (num > 2048)) {\n        extern unsigned char cleanse_ctr;\n        ((unsigned char *)ret)[0] = cleanse_ctr;\n    }\n#endif\n    return ret;\n}']