crypto/x509/x509_req.c:105: error: NULL_DEREFERENCE
  pointer `ret` last assigned on line 76 could be null and is dereferenced by call to `X509_REQ_free()` at line 105, column 2.
Showing all 16 steps of the trace


crypto/x509/x509_req.c:69:1: start of procedure X509_to_X509_REQ()
67.   #include <openssl/pem.h>
68.   
69. > X509_REQ *X509_to_X509_REQ(X509 *x, EVP_PKEY *pkey, const EVP_MD *md)
70.   	{
71.   	X509_REQ *ret;

crypto/x509/x509_req.c:76:2: Skipping X509_REQ_new(): empty list of specs
74.   	EVP_PKEY *pktmp;
75.   
76.   	ret=X509_REQ_new();
       ^
77.   	if (ret == NULL)
78.   		{

crypto/x509/x509_req.c:77:6: Taking true branch
75.   
76.   	ret=X509_REQ_new();
77.   	if (ret == NULL)
           ^
78.   		{
79.   		X509err(X509_F_X509_TO_X509_REQ,ERR_R_MALLOC_FAILURE);

crypto/x509/x509_req.c:79:3: 
77.   	if (ret == NULL)
78.   		{
79. > 		X509err(X509_F_X509_TO_X509_REQ,ERR_R_MALLOC_FAILURE);
80.   		goto err;
81.   		}

crypto/err/err.c:245:1: start of procedure ERR_put_error()
  243.   /********************************************************/
  244.   
  245. > void ERR_put_error(int lib, int func, int reason, const char *file,
  246.   	     int line)
  247.   	{

crypto/err/err.c:269:2: Skipping ERR_get_state(): empty list of specs
  267.   	}
  268.   #endif
  269.   	es=ERR_get_state();
          ^
  270.   
  271.   	es->top=(es->top+1)%ERR_NUM_ERRORS;

crypto/err/err.c:271:2: 
  269.   	es=ERR_get_state();
  270.   
  271. > 	es->top=(es->top+1)%ERR_NUM_ERRORS;
  272.   	if (es->top == es->bottom)
  273.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;

crypto/err/err.c:272:6: Taking false branch
  270.   
  271.   	es->top=(es->top+1)%ERR_NUM_ERRORS;
  272.   	if (es->top == es->bottom)
              ^
  273.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
  274.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);

crypto/err/err.c:274:2: 
  272.   	if (es->top == es->bottom)
  273.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
  274. > 	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
  275.   	es->err_file[es->top]=file;
  276.   	es->err_line[es->top]=line;

crypto/err/err.c:275:2: 
  273.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
  274.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
  275. > 	es->err_file[es->top]=file;
  276.   	es->err_line[es->top]=line;
  277.   	err_clear_data(es,es->top);

crypto/err/err.c:276:2: 
  274.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
  275.   	es->err_file[es->top]=file;
  276. > 	es->err_line[es->top]=line;
  277.   	err_clear_data(es,es->top);
  278.   	}

crypto/err/err.c:277:2: Taking true branch
  275.   	es->err_file[es->top]=file;
  276.   	es->err_line[es->top]=line;
  277.   	err_clear_data(es,es->top);
          ^
  278.   	}
  279.   

crypto/err/err.c:277:2: Taking false branch
  275.   	es->err_file[es->top]=file;
  276.   	es->err_line[es->top]=line;
  277.   	err_clear_data(es,es->top);
          ^
  278.   	}
  279.   

crypto/err/err.c:278:2: return from a call to ERR_put_error
  276.   	es->err_line[es->top]=line;
  277.   	err_clear_data(es,es->top);
  278.   	}
          ^
  279.   
  280.   void ERR_clear_error(void)

crypto/x509/x509_req.c:104:1: 
102.   		}
103.   	return(ret);
104. > err:
105.   	X509_REQ_free(ret);
106.   	return(NULL);

crypto/x509/x509_req.c:105:2: 
103.   	return(ret);
104.   err:
105. > 	X509_REQ_free(ret);
106.   	return(NULL);
107.   	}

X509_REQ *X509_to_X509_REQ(X509 *x, EVP_PKEY *pkey, const EVP_MD *md)
	{
	X509_REQ *ret;
	X509_REQ_INFO *ri;
	int i;
	EVP_PKEY *pktmp;
	ret=X509_REQ_new();
	if (ret == NULL)
		{
		X509err(X509_F_X509_TO_X509_REQ,ERR_R_MALLOC_FAILURE);
		goto err;
		}
	ri=ret->req_info;
	ri->version->length=1;
	ri->version->data=(unsigned char *)Malloc(1);
	if (ri->version->data == NULL) goto err;
	ri->version->data[0]=0;
	if (!X509_REQ_set_subject_name(ret,X509_get_subject_name(x)))
		goto err;
	pktmp = X509_get_pubkey(x);
	i=X509_REQ_set_pubkey(ret,pktmp);
	EVP_PKEY_free(pktmp);
	if (!i) goto err;
	if (pkey != NULL)
		{
		if (!X509_REQ_sign(ret,pkey,md))
			goto err;
		}
	return(ret);
err:
	X509_REQ_free(ret);
	return(NULL);
	}
['X509_REQ *X509_to_X509_REQ(X509 *x, EVP_PKEY *pkey, const EVP_MD *md)\n\t{\n\tX509_REQ *ret;\n\tX509_REQ_INFO *ri;\n\tint i;\n\tEVP_PKEY *pktmp;\n\tret=X509_REQ_new();\n\tif (ret == NULL)\n\t\t{\n\t\tX509err(X509_F_X509_TO_X509_REQ,ERR_R_MALLOC_FAILURE);\n\t\tgoto err;\n\t\t}\n\tri=ret->req_info;\n\tri->version->length=1;\n\tri->version->data=(unsigned char *)Malloc(1);\n\tif (ri->version->data == NULL) goto err;\n\tri->version->data[0]=0;\n\tif (!X509_REQ_set_subject_name(ret,X509_get_subject_name(x)))\n\t\tgoto err;\n\tpktmp = X509_get_pubkey(x);\n\ti=X509_REQ_set_pubkey(ret,pktmp);\n\tEVP_PKEY_free(pktmp);\n\tif (!i) goto err;\n\tif (pkey != NULL)\n\t\t{\n\t\tif (!X509_REQ_sign(ret,pkey,md))\n\t\t\tgoto err;\n\t\t}\n\treturn(ret);\nerr:\n\tX509_REQ_free(ret);\n\treturn(NULL);\n\t}', 'void ERR_put_error(int lib, int func, int reason, const char *file,\n\t     int line)\n\t{\n\tERR_STATE *es;\n#ifdef _OSD_POSIX\n\tif (strncmp(file,"*POSIX(", sizeof("*POSIX(")-1) == 0) {\n\t\tchar *end;\n\t\tfile += sizeof("*POSIX(")-1;\n\t\tend = &file[strlen(file)-1];\n\t\tif (*end == \')\')\n\t\t\t*end = \'\\0\';\n\t\tif ((end = strrchr(file, \'/\')) != NULL)\n\t\t\tfile = &end[1];\n\t}\n#endif\n\tes=ERR_get_state();\n\tes->top=(es->top+1)%ERR_NUM_ERRORS;\n\tif (es->top == es->bottom)\n\t\tes->bottom=(es->bottom+1)%ERR_NUM_ERRORS;\n\tes->err_buffer[es->top]=ERR_PACK(lib,func,reason);\n\tes->err_file[es->top]=file;\n\tes->err_line[es->top]=line;\n\terr_clear_data(es,es->top);\n\t}']