crypto/bio/b_print.c:742: error: NULL_DEREFERENCE
  pointer `*buffer` last assigned on line 739 could be null and is dereferenced by call to `memcpy()` at line 742, column 7.
Showing all 23 steps of the trace


crypto/bio/b_print.c:723:1: start of procedure doapr_outch()
721.   }
722.   
723. > static void
724.   doapr_outch(
725.       char **sbuffer,

crypto/bio/b_print.c:732:5: 
730.   {
731.       /* If we haven't at least one buffer, someone has doe a big booboo */
732. >     assert(*sbuffer != NULL || buffer != NULL);
733.   
734.       if (buffer) {

crypto/bio/b_print.c:734:9: Taking true branch
732.       assert(*sbuffer != NULL || buffer != NULL);
733.   
734.       if (buffer) {
               ^
735.   	while (*currlen >= *maxlen) {
736.   	    if (*buffer == NULL) {

crypto/bio/b_print.c:735:9: Loop condition is true. Entering loop body
733.   
734.       if (buffer) {
735.   	while (*currlen >= *maxlen) {
               ^
736.   	    if (*buffer == NULL) {
737.   		if (*maxlen == 0)

crypto/bio/b_print.c:736:10: Taking true branch
734.       if (buffer) {
735.   	while (*currlen >= *maxlen) {
736.   	    if (*buffer == NULL) {
                ^
737.   		if (*maxlen == 0)
738.   		    *maxlen = 1024;

crypto/bio/b_print.c:737:7: Taking false branch
735.   	while (*currlen >= *maxlen) {
736.   	    if (*buffer == NULL) {
737.   		if (*maxlen == 0)
             ^
738.   		    *maxlen = 1024;
739.   		*buffer = OPENSSL_malloc(*maxlen);

crypto/bio/b_print.c:739:3: 
737.   		if (*maxlen == 0)
738.   		    *maxlen = 1024;
739. > 		*buffer = OPENSSL_malloc(*maxlen);
740.   		if (*currlen > 0) {
741.   		    assert(*sbuffer != NULL);

crypto/mem.c:291:1: start of procedure CRYPTO_malloc()
  289.   	}
  290.   
  291. > void *CRYPTO_malloc(int num, const char *file, int line)
  292.   	{
  293.   	void *ret = NULL;

crypto/mem.c:293:2: 
  291.   void *CRYPTO_malloc(int num, const char *file, int line)
  292.   	{
  293. > 	void *ret = NULL;
  294.   	extern unsigned char cleanse_ctr;
  295.   

crypto/mem.c:296:6: Taking false branch
  294.   	extern unsigned char cleanse_ctr;
  295.   
  296.   	if (num < 0) return NULL;
              ^
  297.   
  298.   	allow_customize = 0;

crypto/mem.c:298:2: 
  296.   	if (num < 0) return NULL;
  297.   
  298. > 	allow_customize = 0;
  299.   	if (malloc_debug_func != NULL)
  300.   		{

crypto/mem.c:299:6: Taking true branch
  297.   
  298.   	allow_customize = 0;
  299.   	if (malloc_debug_func != NULL)
              ^
  300.   		{
  301.   		allow_customize_debug = 0;

crypto/mem.c:301:3: 
  299.   	if (malloc_debug_func != NULL)
  300.   		{
  301. > 		allow_customize_debug = 0;
  302.   		malloc_debug_func(NULL, num, file, line, 0);
  303.   		}

crypto/mem.c:302:3: Skipping __function_pointer__(): unresolved function pointer
  300.   		{
  301.   		allow_customize_debug = 0;
  302.   		malloc_debug_func(NULL, num, file, line, 0);
           ^
  303.   		}
  304.   	ret = malloc_ex_func(num,file,line);

crypto/mem.c:304:2: Skipping __function_pointer__(): unresolved function pointer
  302.   		malloc_debug_func(NULL, num, file, line, 0);
  303.   		}
  304.   	ret = malloc_ex_func(num,file,line);
          ^
  305.   #ifdef LEVITTE_DEBUG_MEM
  306.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);

crypto/mem.c:308:6: Taking true branch
  306.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);
  307.   #endif
  308.   	if (malloc_debug_func != NULL)
              ^
  309.   		malloc_debug_func(ret, num, file, line, 1);
  310.   

crypto/mem.c:309:3: Skipping __function_pointer__(): unresolved function pointer
  307.   #endif
  308.   	if (malloc_debug_func != NULL)
  309.   		malloc_debug_func(ret, num, file, line, 1);
           ^
  310.   
  311.           /* Create a dependency on the value of 'cleanse_ctr' so our memory

crypto/mem.c:314:12: Taking false branch
  312.            * sanitisation function can't be optimised out. NB: We only do
  313.            * this for >2Kb so the overhead doesn't bother us. */
  314.           if(ret && (num > 2048))
                    ^
  315.                   ((unsigned char *)ret)[0] = cleanse_ctr;
  316.   

crypto/mem.c:317:2: 
  315.                   ((unsigned char *)ret)[0] = cleanse_ctr;
  316.   
  317. > 	return ret;
  318.   	}
  319.   

crypto/mem.c:318:2: return from a call to CRYPTO_malloc
  316.   
  317.   	return ret;
  318.   	}
          ^
  319.   
  320.   void *CRYPTO_realloc(void *str, int num, const char *file, int line)

crypto/bio/b_print.c:740:7: Taking true branch
738.   		    *maxlen = 1024;
739.   		*buffer = OPENSSL_malloc(*maxlen);
740.   		if (*currlen > 0) {
             ^
741.   		    assert(*sbuffer != NULL);
742.   		    memcpy(*buffer, *sbuffer, *currlen);

crypto/bio/b_print.c:741:7: 
739.   		*buffer = OPENSSL_malloc(*maxlen);
740.   		if (*currlen > 0) {
741. > 		    assert(*sbuffer != NULL);
742.   		    memcpy(*buffer, *sbuffer, *currlen);
743.   		}

crypto/bio/b_print.c:742:7: 
740.   		if (*currlen > 0) {
741.   		    assert(*sbuffer != NULL);
742. > 		    memcpy(*buffer, *sbuffer, *currlen);
743.   		}
744.   		*sbuffer = NULL;

static void
doapr_outch(
    char **sbuffer,
    char **buffer,
    size_t *currlen,
    size_t *maxlen,
    int c)
{
    assert(*sbuffer != NULL || buffer != NULL);
    if (buffer) {
	while (*currlen >= *maxlen) {
	    if (*buffer == NULL) {
		if (*maxlen == 0)
		    *maxlen = 1024;
		*buffer = OPENSSL_malloc(*maxlen);
		if (*currlen > 0) {
		    assert(*sbuffer != NULL);
		    memcpy(*buffer, *sbuffer, *currlen);
		}
		*sbuffer = NULL;
	    } else {
		*maxlen += 1024;
		*buffer = OPENSSL_realloc(*buffer, *maxlen);
	    }
	}
	assert(*sbuffer != NULL || *buffer != NULL);
    }
    if (*currlen < *maxlen) {
	if (*sbuffer)
	    (*sbuffer)[(*currlen)++] = (char)c;
	else
	    (*buffer)[(*currlen)++] = (char)c;
    }
    return;
}
['static void\ndoapr_outch(\n    char **sbuffer,\n    char **buffer,\n    size_t *currlen,\n    size_t *maxlen,\n    int c)\n{\n    assert(*sbuffer != NULL || buffer != NULL);\n    if (buffer) {\n\twhile (*currlen >= *maxlen) {\n\t    if (*buffer == NULL) {\n\t\tif (*maxlen == 0)\n\t\t    *maxlen = 1024;\n\t\t*buffer = OPENSSL_malloc(*maxlen);\n\t\tif (*currlen > 0) {\n\t\t    assert(*sbuffer != NULL);\n\t\t    memcpy(*buffer, *sbuffer, *currlen);\n\t\t}\n\t\t*sbuffer = NULL;\n\t    } else {\n\t\t*maxlen += 1024;\n\t\t*buffer = OPENSSL_realloc(*buffer, *maxlen);\n\t    }\n\t}\n\tassert(*sbuffer != NULL || *buffer != NULL);\n    }\n    if (*currlen < *maxlen) {\n\tif (*sbuffer)\n\t    (*sbuffer)[(*currlen)++] = (char)c;\n\telse\n\t    (*buffer)[(*currlen)++] = (char)c;\n    }\n    return;\n}', 'void *CRYPTO_malloc(int num, const char *file, int line)\n\t{\n\tvoid *ret = NULL;\n\textern unsigned char cleanse_ctr;\n\tif (num < 0) return NULL;\n\tallow_customize = 0;\n\tif (malloc_debug_func != NULL)\n\t\t{\n\t\tallow_customize_debug = 0;\n\t\tmalloc_debug_func(NULL, num, file, line, 0);\n\t\t}\n\tret = malloc_ex_func(num,file,line);\n#ifdef LEVITTE_DEBUG_MEM\n\tfprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\\n", ret, num);\n#endif\n\tif (malloc_debug_func != NULL)\n\t\tmalloc_debug_func(ret, num, file, line, 1);\n        if(ret && (num > 2048))\n                ((unsigned char *)ret)[0] = cleanse_ctr;\n\treturn ret;\n\t}']