crypto/cms/cms_env.c:166: error: NULL_DEREFERENCE
  pointer `null` is dereferenced by call to `cms_EncryptedContent_init()` at line 166, column 10.
Showing all 67 steps of the trace


crypto/cms/cms_env.c:156:1: start of procedure CMS_EnvelopedData_create()
154.   }
155.   
156. > CMS_ContentInfo *CMS_EnvelopedData_create(const EVP_CIPHER *cipher)
157.   {
158.       CMS_ContentInfo *cms;

crypto/cms/cms_env.c:160:5: 
158.       CMS_ContentInfo *cms;
159.       CMS_EnvelopedData *env;
160. >     cms = CMS_ContentInfo_new();
161.       if (!cms)
162.           goto merr;

crypto/cms/cms_lib.c:64:1: start of procedure CMS_ContentInfo_new()
  62.   #include "cms_lcl.h"
  63.   
  64. > IMPLEMENT_ASN1_FUNCTIONS(CMS_ContentInfo)
  65.   IMPLEMENT_ASN1_PRINT_FUNCTION(CMS_ContentInfo)
  66.   

crypto/asn1/tasn_new.c:74:1: start of procedure ASN1_item_new()
    72.   static void asn1_primitive_clear(ASN1_VALUE **pval, const ASN1_ITEM *it);
    73.   
    74. > ASN1_VALUE *ASN1_item_new(const ASN1_ITEM *it)
    75.   {
    76.       ASN1_VALUE *ret = NULL;

crypto/asn1/tasn_new.c:76:5: 
    74.   ASN1_VALUE *ASN1_item_new(const ASN1_ITEM *it)
    75.   {
    76. >     ASN1_VALUE *ret = NULL;
    77.       if (ASN1_item_ex_new(&ret, it) > 0)
    78.           return ret;

crypto/asn1/tasn_new.c:77:9: Taking true branch
    75.   {
    76.       ASN1_VALUE *ret = NULL;
    77.       if (ASN1_item_ex_new(&ret, it) > 0)
                  ^
    78.           return ret;
    79.       return NULL;

crypto/asn1/tasn_new.c:78:9: 
    76.       ASN1_VALUE *ret = NULL;
    77.       if (ASN1_item_ex_new(&ret, it) > 0)
    78. >         return ret;
    79.       return NULL;
    80.   }

crypto/asn1/tasn_new.c:80:1: return from a call to ASN1_item_new
    78.           return ret;
    79.       return NULL;
    80. > }
    81.   
    82.   /* Allocate an ASN1 structure */

crypto/cms/cms_lib.c:64:1: return from a call to CMS_ContentInfo_new
  62.   #include "cms_lcl.h"
  63.   
  64. > IMPLEMENT_ASN1_FUNCTIONS(CMS_ContentInfo)
  65.   IMPLEMENT_ASN1_PRINT_FUNCTION(CMS_ContentInfo)
  66.   

crypto/cms/cms_env.c:161:10: Taking false branch
159.       CMS_EnvelopedData *env;
160.       cms = CMS_ContentInfo_new();
161.       if (!cms)
                ^
162.           goto merr;
163.       env = cms_enveloped_data_init(cms);

crypto/cms/cms_env.c:163:5: 
161.       if (!cms)
162.           goto merr;
163. >     env = cms_enveloped_data_init(cms);
164.       if (!env)
165.           goto merr;

crypto/cms/cms_env.c:85:1: start of procedure cms_enveloped_data_init()
  83.   }
  84.   
  85. > static CMS_EnvelopedData *cms_enveloped_data_init(CMS_ContentInfo *cms)
  86.   {
  87.       if (cms->d.other == NULL) {

crypto/cms/cms_env.c:87:9: Taking false branch
  85.   static CMS_EnvelopedData *cms_enveloped_data_init(CMS_ContentInfo *cms)
  86.   {
  87.       if (cms->d.other == NULL) {
                ^
  88.           cms->d.envelopedData = M_ASN1_new_of(CMS_EnvelopedData);
  89.           if (!cms->d.envelopedData) {

crypto/cms/cms_env.c:100:5: 
  98.           return cms->d.envelopedData;
  99.       }
  100. >     return cms_get0_enveloped(cms);
  101.   }
  102.   

crypto/cms/cms_env.c:75:1: start of procedure cms_get0_enveloped()
    73.   DECLARE_STACK_OF(CMS_RecipientInfo)
    74.   
    75. > CMS_EnvelopedData *cms_get0_enveloped(CMS_ContentInfo *cms)
    76.   {
    77.       if (OBJ_obj2nid(cms->contentType) != NID_pkcs7_enveloped) {

crypto/cms/cms_env.c:77:9: 
    75.   CMS_EnvelopedData *cms_get0_enveloped(CMS_ContentInfo *cms)
    76.   {
    77. >     if (OBJ_obj2nid(cms->contentType) != NID_pkcs7_enveloped) {
    78.           CMSerr(CMS_F_CMS_GET0_ENVELOPED,
    79.                  CMS_R_CONTENT_TYPE_NOT_ENVELOPED_DATA);

crypto/objects/obj_dat.c:390:1: start of procedure OBJ_obj2nid()
      388.   IMPLEMENT_OBJ_BSEARCH_CMP_FN(const ASN1_OBJECT *, unsigned int, obj);
      389.   
      390. > int OBJ_obj2nid(const ASN1_OBJECT *a)
      391.   {
      392.       const unsigned int *op;

crypto/objects/obj_dat.c:395:9: Taking false branch
      393.       ADDED_OBJ ad, *adp;
      394.   
      395.       if (a == NULL)
                     ^
      396.           return (NID_undef);
      397.       if (a->nid != 0)

crypto/objects/obj_dat.c:397:9: Taking false branch
      395.       if (a == NULL)
      396.           return (NID_undef);
      397.       if (a->nid != 0)
                     ^
      398.           return (a->nid);
      399.   

crypto/objects/obj_dat.c:400:9: Taking false branch
      398.           return (a->nid);
      399.   
      400.       if (a->length == 0)
                     ^
      401.           return NID_undef;
      402.   

crypto/objects/obj_dat.c:403:9: Taking true branch
      401.           return NID_undef;
      402.   
      403.       if (added != NULL) {
                     ^
      404.           ad.type = ADDED_DATA;
      405.           ad.obj = (ASN1_OBJECT *)a; /* XXX: ugly but harmless */

crypto/objects/obj_dat.c:404:9: 
      402.   
      403.       if (added != NULL) {
      404. >         ad.type = ADDED_DATA;
      405.           ad.obj = (ASN1_OBJECT *)a; /* XXX: ugly but harmless */
      406.           adp = lh_ADDED_OBJ_retrieve(added, &ad);

crypto/objects/obj_dat.c:405:9: 
      403.       if (added != NULL) {
      404.           ad.type = ADDED_DATA;
      405. >         ad.obj = (ASN1_OBJECT *)a; /* XXX: ugly but harmless */
      406.           adp = lh_ADDED_OBJ_retrieve(added, &ad);
      407.           if (adp != NULL)

crypto/objects/obj_dat.c:406:15: Condition is true
      404.           ad.type = ADDED_DATA;
      405.           ad.obj = (ASN1_OBJECT *)a; /* XXX: ugly but harmless */
      406.           adp = lh_ADDED_OBJ_retrieve(added, &ad);
                           ^
      407.           if (adp != NULL)
      408.               return (adp->obj->nid);

crypto/objects/obj_dat.c:406:15: Condition is true
      404.           ad.type = ADDED_DATA;
      405.           ad.obj = (ASN1_OBJECT *)a; /* XXX: ugly but harmless */
      406.           adp = lh_ADDED_OBJ_retrieve(added, &ad);
                           ^
      407.           if (adp != NULL)
      408.               return (adp->obj->nid);

crypto/objects/obj_dat.c:406:9: 
      404.           ad.type = ADDED_DATA;
      405.           ad.obj = (ASN1_OBJECT *)a; /* XXX: ugly but harmless */
      406. >         adp = lh_ADDED_OBJ_retrieve(added, &ad);
      407.           if (adp != NULL)
      408.               return (adp->obj->nid);

crypto/lhash/lhash.c:217:1: start of procedure lh_retrieve()
        215.   }
        216.   
        217. > void *lh_retrieve(_LHASH *lh, const void *data)
        218.   {
        219.       unsigned long hash;

crypto/lhash/lhash.c:223:5: 
        221.       void *ret;
        222.   
        223. >     lh->error = 0;
        224.       rn = getrn(lh, data, &hash);
        225.   

crypto/lhash/lhash.c:224:5: Skipping getrn(): empty list of specs
        222.   
        223.       lh->error = 0;
        224.       rn = getrn(lh, data, &hash);
                   ^
        225.   
        226.       if (*rn == NULL) {

crypto/lhash/lhash.c:226:9: Taking false branch
        224.       rn = getrn(lh, data, &hash);
        225.   
        226.       if (*rn == NULL) {
                       ^
        227.           lh->num_retrieve_miss++;
        228.           return (NULL);

crypto/lhash/lhash.c:230:9: 
        228.           return (NULL);
        229.       } else {
        230. >         ret = (*rn)->data;
        231.           lh->num_retrieve++;
        232.       }

crypto/lhash/lhash.c:231:9: 
        229.       } else {
        230.           ret = (*rn)->data;
        231. >         lh->num_retrieve++;
        232.       }
        233.       return (ret);

crypto/lhash/lhash.c:233:5: 
        231.           lh->num_retrieve++;
        232.       }
        233. >     return (ret);
        234.   }
        235.   

crypto/lhash/lhash.c:234:1: return from a call to lh_retrieve
        232.       }
        233.       return (ret);
        234. > }
        235.   
        236.   static void doall_util_fn(_LHASH *lh, int use_arg, LHASH_DOALL_FN_TYPE func,

crypto/objects/obj_dat.c:407:13: Taking true branch
      405.           ad.obj = (ASN1_OBJECT *)a; /* XXX: ugly but harmless */
      406.           adp = lh_ADDED_OBJ_retrieve(added, &ad);
      407.           if (adp != NULL)
                         ^
      408.               return (adp->obj->nid);
      409.       }

crypto/objects/obj_dat.c:408:13: 
      406.           adp = lh_ADDED_OBJ_retrieve(added, &ad);
      407.           if (adp != NULL)
      408. >             return (adp->obj->nid);
      409.       }
      410.       op = OBJ_bsearch_obj(&a, obj_objs, NUM_OBJ);

crypto/objects/obj_dat.c:414:1: return from a call to OBJ_obj2nid
      412.           return (NID_undef);
      413.       return (nid_objs[*op].nid);
      414. > }
      415.   
      416.   /*

crypto/cms/cms_env.c:77:9: Taking false branch
    75.   CMS_EnvelopedData *cms_get0_enveloped(CMS_ContentInfo *cms)
    76.   {
    77.       if (OBJ_obj2nid(cms->contentType) != NID_pkcs7_enveloped) {
                  ^
    78.           CMSerr(CMS_F_CMS_GET0_ENVELOPED,
    79.                  CMS_R_CONTENT_TYPE_NOT_ENVELOPED_DATA);

crypto/cms/cms_env.c:82:5: 
    80.           return NULL;
    81.       }
    82. >     return cms->d.envelopedData;
    83.   }
    84.   

crypto/cms/cms_env.c:83:1: return from a call to cms_get0_enveloped
    81.       }
    82.       return cms->d.envelopedData;
    83. > }
    84.   
    85.   static CMS_EnvelopedData *cms_enveloped_data_init(CMS_ContentInfo *cms)

crypto/cms/cms_env.c:101:1: return from a call to cms_enveloped_data_init
  99.       }
  100.       return cms_get0_enveloped(cms);
  101. > }
  102.   
  103.   int cms_env_asn1_ctrl(CMS_RecipientInfo *ri, int cmd)

crypto/cms/cms_env.c:164:10: Taking false branch
162.           goto merr;
163.       env = cms_enveloped_data_init(cms);
164.       if (!env)
                ^
165.           goto merr;
166.       if (!cms_EncryptedContent_init(env->encryptedContentInfo,

crypto/cms/cms_env.c:166:10: 
164.       if (!env)
165.           goto merr;
166. >     if (!cms_EncryptedContent_init(env->encryptedContentInfo,
167.                                      cipher, NULL, 0))
168.           goto merr;

crypto/cms/cms_enc.c:208:1: start of procedure cms_EncryptedContent_init()
  206.   }
  207.   
  208. > int cms_EncryptedContent_init(CMS_EncryptedContentInfo *ec,
  209.                                 const EVP_CIPHER *cipher,
  210.                                 const unsigned char *key, size_t keylen)

crypto/cms/cms_enc.c:212:5: 
  210.                                 const unsigned char *key, size_t keylen)
  211.   {
  212. >     ec->cipher = cipher;
  213.       if (key) {
  214.           ec->key = OPENSSL_malloc(keylen);

crypto/cms/cms_enc.c:213:9: Taking true branch
  211.   {
  212.       ec->cipher = cipher;
  213.       if (key) {
                 ^
  214.           ec->key = OPENSSL_malloc(keylen);
  215.           if (!ec->key)

crypto/cms/cms_enc.c:214:9: 
  212.       ec->cipher = cipher;
  213.       if (key) {
  214. >         ec->key = OPENSSL_malloc(keylen);
  215.           if (!ec->key)
  216.               return 0;

crypto/mem.c:279:1: start of procedure CRYPTO_malloc()
    277.   }
    278.   
    279. > void *CRYPTO_malloc(int num, const char *file, int line)
    280.   {
    281.       void *ret = NULL;

crypto/mem.c:281:5: 
    279.   void *CRYPTO_malloc(int num, const char *file, int line)
    280.   {
    281. >     void *ret = NULL;
    282.   
    283.       if (num <= 0)

crypto/mem.c:283:9: Taking false branch
    281.       void *ret = NULL;
    282.   
    283.       if (num <= 0)
                   ^
    284.           return NULL;
    285.   

crypto/mem.c:286:9: Taking true branch
    284.           return NULL;
    285.   
    286.       if (allow_customize)
                   ^
    287.           allow_customize = 0;
    288.       if (malloc_debug_func != NULL) {

crypto/mem.c:287:9: 
    285.   
    286.       if (allow_customize)
    287. >         allow_customize = 0;
    288.       if (malloc_debug_func != NULL) {
    289.           if (allow_customize_debug)

crypto/mem.c:288:9: Taking true branch
    286.       if (allow_customize)
    287.           allow_customize = 0;
    288.       if (malloc_debug_func != NULL) {
                   ^
    289.           if (allow_customize_debug)
    290.               allow_customize_debug = 0;

crypto/mem.c:289:13: Taking true branch
    287.           allow_customize = 0;
    288.       if (malloc_debug_func != NULL) {
    289.           if (allow_customize_debug)
                       ^
    290.               allow_customize_debug = 0;
    291.           malloc_debug_func(NULL, num, file, line, 0);

crypto/mem.c:290:13: 
    288.       if (malloc_debug_func != NULL) {
    289.           if (allow_customize_debug)
    290. >             allow_customize_debug = 0;
    291.           malloc_debug_func(NULL, num, file, line, 0);
    292.       }

crypto/mem.c:291:9: Skipping __function_pointer__(): unresolved function pointer
    289.           if (allow_customize_debug)
    290.               allow_customize_debug = 0;
    291.           malloc_debug_func(NULL, num, file, line, 0);
                   ^
    292.       }
    293.       ret = malloc_ex_func(num, file, line);

crypto/mem.c:293:5: Skipping __function_pointer__(): unresolved function pointer
    291.           malloc_debug_func(NULL, num, file, line, 0);
    292.       }
    293.       ret = malloc_ex_func(num, file, line);
               ^
    294.   #ifdef LEVITTE_DEBUG_MEM
    295.       fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);

crypto/mem.c:297:9: Taking true branch
    295.       fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);
    296.   #endif
    297.       if (malloc_debug_func != NULL)
                   ^
    298.           malloc_debug_func(ret, num, file, line, 1);
    299.   

crypto/mem.c:298:9: Skipping __function_pointer__(): unresolved function pointer
    296.   #endif
    297.       if (malloc_debug_func != NULL)
    298.           malloc_debug_func(ret, num, file, line, 1);
                   ^
    299.   
    300.   #ifndef OPENSSL_CPUID_OBJ

crypto/mem.c:312:5: 
    310.   #endif
    311.   
    312. >     return ret;
    313.   }
    314.   

crypto/mem.c:313:1: return from a call to CRYPTO_malloc
    311.   
    312.       return ret;
    313. > }
    314.   
    315.   void *CRYPTO_zalloc(int num, const char *file, int line)

crypto/cms/cms_enc.c:215:14: Taking false branch
  213.       if (key) {
  214.           ec->key = OPENSSL_malloc(keylen);
  215.           if (!ec->key)
                      ^
  216.               return 0;
  217.           memcpy(ec->key, key, keylen);

crypto/cms/cms_enc.c:217:9: 
  215.           if (!ec->key)
  216.               return 0;
  217. >         memcpy(ec->key, key, keylen);
  218.       }
  219.       ec->keylen = keylen;

crypto/cms/cms_enc.c:219:5: 
  217.           memcpy(ec->key, key, keylen);
  218.       }
  219. >     ec->keylen = keylen;
  220.       if (cipher)
  221.           ec->contentType = OBJ_nid2obj(NID_pkcs7_data);

crypto/cms/cms_enc.c:220:9: Taking false branch
  218.       }
  219.       ec->keylen = keylen;
  220.       if (cipher)
                 ^
  221.           ec->contentType = OBJ_nid2obj(NID_pkcs7_data);
  222.       return 1;

crypto/cms/cms_enc.c:222:5: 
  220.       if (cipher)
  221.           ec->contentType = OBJ_nid2obj(NID_pkcs7_data);
  222. >     return 1;
  223.   }
  224.   

crypto/cms/cms_enc.c:223:1: return from a call to cms_EncryptedContent_init
  221.           ec->contentType = OBJ_nid2obj(NID_pkcs7_data);
  222.       return 1;
  223. > }
  224.   
  225.   int CMS_EncryptedData_set1_key(CMS_ContentInfo *cms, const EVP_CIPHER *ciph,

CMS_ContentInfo *CMS_EnvelopedData_create(const EVP_CIPHER *cipher)
{
    CMS_ContentInfo *cms;
    CMS_EnvelopedData *env;
    cms = CMS_ContentInfo_new();
    if (!cms)
        goto merr;
    env = cms_enveloped_data_init(cms);
    if (!env)
        goto merr;
    if (!cms_EncryptedContent_init(env->encryptedContentInfo,
                                   cipher, NULL, 0))
        goto merr;
    return cms;
 merr:
    CMS_ContentInfo_free(cms);
    CMSerr(CMS_F_CMS_ENVELOPEDDATA_CREATE, ERR_R_MALLOC_FAILURE);
    return NULL;
}
['CMS_ContentInfo *CMS_EnvelopedData_create(const EVP_CIPHER *cipher)\n{\n    CMS_ContentInfo *cms;\n    CMS_EnvelopedData *env;\n    cms = CMS_ContentInfo_new();\n    if (!cms)\n        goto merr;\n    env = cms_enveloped_data_init(cms);\n    if (!env)\n        goto merr;\n    if (!cms_EncryptedContent_init(env->encryptedContentInfo,\n                                   cipher, NULL, 0))\n        goto merr;\n    return cms;\n merr:\n    CMS_ContentInfo_free(cms);\n    CMSerr(CMS_F_CMS_ENVELOPEDDATA_CREATE, ERR_R_MALLOC_FAILURE);\n    return NULL;\n}', 'IMPLEMENT_ASN1_FUNCTIONS(CMS_ContentInfo)', 'ASN1_VALUE *ASN1_item_new(const ASN1_ITEM *it)\n{\n    ASN1_VALUE *ret = NULL;\n    if (ASN1_item_ex_new(&ret, it) > 0)\n        return ret;\n    return NULL;\n}', 'static CMS_EnvelopedData *cms_enveloped_data_init(CMS_ContentInfo *cms)\n{\n    if (cms->d.other == NULL) {\n        cms->d.envelopedData = M_ASN1_new_of(CMS_EnvelopedData);\n        if (!cms->d.envelopedData) {\n            CMSerr(CMS_F_CMS_ENVELOPED_DATA_INIT, ERR_R_MALLOC_FAILURE);\n            return NULL;\n        }\n        cms->d.envelopedData->version = 0;\n        cms->d.envelopedData->encryptedContentInfo->contentType =\n            OBJ_nid2obj(NID_pkcs7_data);\n        ASN1_OBJECT_free(cms->contentType);\n        cms->contentType = OBJ_nid2obj(NID_pkcs7_enveloped);\n        return cms->d.envelopedData;\n    }\n    return cms_get0_enveloped(cms);\n}', 'CMS_EnvelopedData *cms_get0_enveloped(CMS_ContentInfo *cms)\n{\n    if (OBJ_obj2nid(cms->contentType) != NID_pkcs7_enveloped) {\n        CMSerr(CMS_F_CMS_GET0_ENVELOPED,\n               CMS_R_CONTENT_TYPE_NOT_ENVELOPED_DATA);\n        return NULL;\n    }\n    return cms->d.envelopedData;\n}', 'int OBJ_obj2nid(const ASN1_OBJECT *a)\n{\n    const unsigned int *op;\n    ADDED_OBJ ad, *adp;\n    if (a == NULL)\n        return (NID_undef);\n    if (a->nid != 0)\n        return (a->nid);\n    if (a->length == 0)\n        return NID_undef;\n    if (added != NULL) {\n        ad.type = ADDED_DATA;\n        ad.obj = (ASN1_OBJECT *)a;\n        adp = lh_ADDED_OBJ_retrieve(added, &ad);\n        if (adp != NULL)\n            return (adp->obj->nid);\n    }\n    op = OBJ_bsearch_obj(&a, obj_objs, NUM_OBJ);\n    if (op == NULL)\n        return (NID_undef);\n    return (nid_objs[*op].nid);\n}', 'void *lh_retrieve(_LHASH *lh, const void *data)\n{\n    unsigned long hash;\n    LHASH_NODE **rn;\n    void *ret;\n    lh->error = 0;\n    rn = getrn(lh, data, &hash);\n    if (*rn == NULL) {\n        lh->num_retrieve_miss++;\n        return (NULL);\n    } else {\n        ret = (*rn)->data;\n        lh->num_retrieve++;\n    }\n    return (ret);\n}', 'int cms_EncryptedContent_init(CMS_EncryptedContentInfo *ec,\n                              const EVP_CIPHER *cipher,\n                              const unsigned char *key, size_t keylen)\n{\n    ec->cipher = cipher;\n    if (key) {\n        ec->key = OPENSSL_malloc(keylen);\n        if (!ec->key)\n            return 0;\n        memcpy(ec->key, key, keylen);\n    }\n    ec->keylen = keylen;\n    if (cipher)\n        ec->contentType = OBJ_nid2obj(NID_pkcs7_data);\n    return 1;\n}', 'void *CRYPTO_malloc(int num, const char *file, int line)\n{\n    void *ret = NULL;\n    if (num <= 0)\n        return NULL;\n    if (allow_customize)\n        allow_customize = 0;\n    if (malloc_debug_func != NULL) {\n        if (allow_customize_debug)\n            allow_customize_debug = 0;\n        malloc_debug_func(NULL, num, file, line, 0);\n    }\n    ret = malloc_ex_func(num, file, line);\n#ifdef LEVITTE_DEBUG_MEM\n    fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\\n", ret, num);\n#endif\n    if (malloc_debug_func != NULL)\n        malloc_debug_func(ret, num, file, line, 1);\n#ifndef OPENSSL_CPUID_OBJ\n    if (ret && (num > 2048)) {\n        extern unsigned char cleanse_ctr;\n        ((unsigned char *)ret)[0] = cleanse_ctr;\n    }\n#endif\n    return ret;\n}']