apps/verify.c:305: error: NULL_DEREFERENCE
  pointer `in` last assigned on line 268 could be null and is dereferenced by call to `BIO_free()` at line 305, column 2.
Showing all 19 steps of the trace


apps/verify.c:264:1: start of procedure load_untrusted()
262.   	}
263.   
264. > static STACK_OF(X509) *load_untrusted(char *certfile)
265.   {
266.   	STACK_OF(X509_INFO) *sk=NULL;

apps/verify.c:266:2: 
264.   static STACK_OF(X509) *load_untrusted(char *certfile)
265.   {
266. > 	STACK_OF(X509_INFO) *sk=NULL;
267.   	STACK_OF(X509) *stack=NULL, *ret=NULL;
268.   	BIO *in=NULL;

apps/verify.c:267:2: 
265.   {
266.   	STACK_OF(X509_INFO) *sk=NULL;
267. > 	STACK_OF(X509) *stack=NULL, *ret=NULL;
268.   	BIO *in=NULL;
269.   	X509_INFO *xi;

apps/verify.c:268:2: 
266.   	STACK_OF(X509_INFO) *sk=NULL;
267.   	STACK_OF(X509) *stack=NULL, *ret=NULL;
268. > 	BIO *in=NULL;
269.   	X509_INFO *xi;
270.   

apps/verify.c:271:7: 
269.   	X509_INFO *xi;
270.   
271. > 	if(!(stack = sk_X509_new_null())) {
272.   		BIO_printf(bio_err,"memory allocation failure\n");
273.   		goto end;

crypto/x509/x509_vfy.c:809:1: start of procedure sk_X509_new_null()
  807.   
  808.   
  809. > IMPLEMENT_STACK_OF(X509)
  810.   IMPLEMENT_ASN1_SET_OF(X509)
  811.   

crypto/x509/x509_vfy.c:809:1: return from a call to sk_X509_new_null
  807.   
  808.   
  809. > IMPLEMENT_STACK_OF(X509)
  810.   IMPLEMENT_ASN1_SET_OF(X509)
  811.   

apps/verify.c:271:7: Taking true branch
269.   	X509_INFO *xi;
270.   
271.   	if(!(stack = sk_X509_new_null())) {
             ^
272.   		BIO_printf(bio_err,"memory allocation failure\n");
273.   		goto end;

apps/verify.c:272:3: Skipping BIO_printf(): empty list of specs
270.   
271.   	if(!(stack = sk_X509_new_null())) {
272.   		BIO_printf(bio_err,"memory allocation failure\n");
         ^
273.   		goto end;
274.   	}

apps/verify.c:304:1: 
302.   	}
303.   	ret=stack;
304. > end:
305.   	BIO_free(in);
306.   	sk_X509_INFO_free(sk);

apps/verify.c:305:2: 
303.   	ret=stack;
304.   end:
305. > 	BIO_free(in);
306.   	sk_X509_INFO_free(sk);
307.   	return(ret);

crypto/bio/bio_lib.c:110:1: start of procedure BIO_free()
  108.   	}
  109.   
  110. > int BIO_free(BIO *a)
  111.   	{
  112.   	int ret=0,i;

crypto/bio/bio_lib.c:112:2: 
  110.   int BIO_free(BIO *a)
  111.   	{
  112. > 	int ret=0,i;
  113.   
  114.   	if (a == NULL) return(0);

crypto/bio/bio_lib.c:114:6: Taking false branch
  112.   	int ret=0,i;
  113.   
  114.   	if (a == NULL) return(0);
              ^
  115.   
  116.   	i=CRYPTO_add(&a->references,-1,CRYPTO_LOCK_BIO);

crypto/bio/bio_lib.c:116:2: 
  114.   	if (a == NULL) return(0);
  115.   
  116. > 	i=CRYPTO_add(&a->references,-1,CRYPTO_LOCK_BIO);
  117.   #ifdef REF_PRINT
  118.   	REF_PRINT("BIO",a);

crypto/cryptlib.c:227:1: start of procedure CRYPTO_add_lock()
    225.   	}
    226.   
    227. > int CRYPTO_add_lock(int *pointer, int amount, int type, const char *file,
    228.   	     int line)
    229.   	{

crypto/cryptlib.c:232:6: Taking true branch
    230.   	int ret;
    231.   
    232.   	if (add_lock_callback != NULL)
                ^
    233.   		{
    234.   #ifdef LOCK_DEBUG

crypto/cryptlib.c:238:3: Skipping __function_pointer__(): unresolved function pointer
    236.   #endif
    237.   
    238.   		ret=add_lock_callback(pointer,amount,type,file,line);
             ^
    239.   #ifdef LOCK_DEBUG
    240.   		fprintf(stderr,"ladd:%08lx:%2d+%2d->%2d %-18s %s:%d\n",

crypto/cryptlib.c:246:3: 
    244.   			file,line);
    245.   #endif
    246. > 		*pointer=ret;
    247.   		}
    248.   	else

static STACK_OF(X509) *load_untrusted(char *certfile)
{
	STACK_OF(X509_INFO) *sk=NULL;
	STACK_OF(X509) *stack=NULL, *ret=NULL;
	BIO *in=NULL;
	X509_INFO *xi;
	if(!(stack = sk_X509_new_null())) {
		BIO_printf(bio_err,"memory allocation failure\n");
		goto end;
	}
	if(!(in=BIO_new_file(certfile, "r"))) {
		BIO_printf(bio_err,"error opening the file, %s\n",certfile);
		goto end;
	}
	if(!(sk=PEM_X509_INFO_read_bio(in,NULL,NULL,NULL))) {
		BIO_printf(bio_err,"error reading the file, %s\n",certfile);
		goto end;
	}
	while (sk_X509_INFO_num(sk))
		{
		xi=sk_X509_INFO_shift(sk);
		if (xi->x509 != NULL)
			{
			sk_X509_push(stack,xi->x509);
			xi->x509=NULL;
			}
		X509_INFO_free(xi);
		}
	if(!sk_X509_num(stack)) {
		BIO_printf(bio_err,"no certificates in file, %s\n",certfile);
		sk_X509_free(stack);
		goto end;
	}
	ret=stack;
end:
	BIO_free(in);
	sk_X509_INFO_free(sk);
	return(ret);
	}
['static STACK_OF(X509) *load_untrusted(char *certfile)\n{\n\tSTACK_OF(X509_INFO) *sk=NULL;\n\tSTACK_OF(X509) *stack=NULL, *ret=NULL;\n\tBIO *in=NULL;\n\tX509_INFO *xi;\n\tif(!(stack = sk_X509_new_null())) {\n\t\tBIO_printf(bio_err,"memory allocation failure\\n");\n\t\tgoto end;\n\t}\n\tif(!(in=BIO_new_file(certfile, "r"))) {\n\t\tBIO_printf(bio_err,"error opening the file, %s\\n",certfile);\n\t\tgoto end;\n\t}\n\tif(!(sk=PEM_X509_INFO_read_bio(in,NULL,NULL,NULL))) {\n\t\tBIO_printf(bio_err,"error reading the file, %s\\n",certfile);\n\t\tgoto end;\n\t}\n\twhile (sk_X509_INFO_num(sk))\n\t\t{\n\t\txi=sk_X509_INFO_shift(sk);\n\t\tif (xi->x509 != NULL)\n\t\t\t{\n\t\t\tsk_X509_push(stack,xi->x509);\n\t\t\txi->x509=NULL;\n\t\t\t}\n\t\tX509_INFO_free(xi);\n\t\t}\n\tif(!sk_X509_num(stack)) {\n\t\tBIO_printf(bio_err,"no certificates in file, %s\\n",certfile);\n\t\tsk_X509_free(stack);\n\t\tgoto end;\n\t}\n\tret=stack;\nend:\n\tBIO_free(in);\n\tsk_X509_INFO_free(sk);\n\treturn(ret);\n\t}', 'IMPLEMENT_STACK_OF(X509)', 'int BIO_free(BIO *a)\n\t{\n\tint ret=0,i;\n\tif (a == NULL) return(0);\n\ti=CRYPTO_add(&a->references,-1,CRYPTO_LOCK_BIO);\n#ifdef REF_PRINT\n\tREF_PRINT("BIO",a);\n#endif\n\tif (i > 0) return(1);\n#ifdef REF_CHECK\n\tif (i < 0)\n\t\t{\n\t\tfprintf(stderr,"BIO_free, bad reference count\\n");\n\t\tabort();\n\t\t}\n#endif\n\tif ((a->callback != NULL) &&\n\t\t((i=(int)a->callback(a,BIO_CB_FREE,NULL,0,0L,1L)) <= 0))\n\t\t\treturn(i);\n\tCRYPTO_free_ex_data(bio_meth,a,&a->ex_data);\n\tif ((a->method == NULL) || (a->method->destroy == NULL)) return(1);\n\tret=a->method->destroy(a);\n\tFree(a);\n\treturn(1);\n\t}', 'int CRYPTO_add_lock(int *pointer, int amount, int type, const char *file,\n\t     int line)\n\t{\n\tint ret;\n\tif (add_lock_callback != NULL)\n\t\t{\n#ifdef LOCK_DEBUG\n\t\tint before= *pointer;\n#endif\n\t\tret=add_lock_callback(pointer,amount,type,file,line);\n#ifdef LOCK_DEBUG\n\t\tfprintf(stderr,"ladd:%08lx:%2d+%2d->%2d %-18s %s:%d\\n",\n\t\t\tCRYPTO_thread_id(),\n\t\t\tbefore,amount,ret,\n\t\t\tCRYPTO_get_lock_name(type),\n\t\t\tfile,line);\n#endif\n\t\t*pointer=ret;\n\t\t}\n\telse\n\t\t{\n\t\tCRYPTO_lock(CRYPTO_LOCK|CRYPTO_WRITE,type,file,line);\n\t\tret= *pointer+amount;\n#ifdef LOCK_DEBUG\n\t\tfprintf(stderr,"ladd:%08lx:%2d+%2d->%2d %-18s %s:%d\\n",\n\t\t\tCRYPTO_thread_id(),\n\t\t\t*pointer,amount,ret,\n\t\t\tCRYPTO_get_lock_name(type),\n\t\t\tfile,line);\n#endif\n\t\t*pointer=ret;\n\t\tCRYPTO_lock(CRYPTO_UNLOCK|CRYPTO_WRITE,type,file,line);\n\t\t}\n\treturn(ret);\n\t}']