engines/ccgost/gost_pmeth.c:85: error: NULL_DEREFERENCE
  pointer `pctx->shared_ukm` last assigned on line 84 could be null and is dereferenced by call to `memcpy()` at line 85, column 4.
Showing all 27 steps of the trace


engines/ccgost/gost_pmeth.c:58:1: start of procedure pkey_gost_ctrl()
56.   
57.   /* --------------------- control functions  ------------------------------*/
58. > static int pkey_gost_ctrl (EVP_PKEY_CTX *ctx, int type, int p1, void *p2)
59.   	{
60.   	struct gost_pmeth_data *pctx = (struct gost_pmeth_data*)EVP_PKEY_CTX_get_data(ctx);

engines/ccgost/gost_pmeth.c:60:2: 
58.   static int pkey_gost_ctrl (EVP_PKEY_CTX *ctx, int type, int p1, void *p2)
59.   	{
60. > 	struct gost_pmeth_data *pctx = (struct gost_pmeth_data*)EVP_PKEY_CTX_get_data(ctx);
61.   	switch (type)
62.   		{

crypto/evp/pmeth_lib.c:383:1: start of procedure EVP_PKEY_CTX_get_data()
  381.   	}
  382.   
  383. > void *EVP_PKEY_CTX_get_data(EVP_PKEY_CTX *ctx)
  384.   	{
  385.   	return ctx->data;

crypto/evp/pmeth_lib.c:385:2: 
  383.   void *EVP_PKEY_CTX_get_data(EVP_PKEY_CTX *ctx)
  384.   	{
  385. > 	return ctx->data;
  386.   	}
  387.   

crypto/evp/pmeth_lib.c:386:2: return from a call to EVP_PKEY_CTX_get_data
  384.   	{
  385.   	return ctx->data;
  386.   	}
          ^
  387.   
  388.   EVP_PKEY *EVP_PKEY_CTX_get0_pkey(EVP_PKEY_CTX *ctx)

engines/ccgost/gost_pmeth.c:61:2: 
59.   	{
60.   	struct gost_pmeth_data *pctx = (struct gost_pmeth_data*)EVP_PKEY_CTX_get_data(ctx);
61. > 	switch (type)
62.   		{
63.   		case EVP_PKEY_CTRL_MD:

engines/ccgost/gost_pmeth.c:63:3: Switch condition is false. Skipping switch case
61.   	switch (type)
62.   		{
63.   		case EVP_PKEY_CTRL_MD:
        ^
64.   		{
65.   		if (EVP_MD_type((const EVP_MD *)p2) != NID_id_GostR3411_94)

engines/ccgost/gost_pmeth.c:75:3: Switch condition is false. Skipping switch case
73.   		break;
74.   
75.   		case EVP_PKEY_CTRL_PKCS7_ENCRYPT:
        ^
76.   		case EVP_PKEY_CTRL_PKCS7_DECRYPT:
77.   		case EVP_PKEY_CTRL_PKCS7_SIGN:

engines/ccgost/gost_pmeth.c:76:3: Switch condition is false. Skipping switch case
74.   
75.   		case EVP_PKEY_CTRL_PKCS7_ENCRYPT:
76.   		case EVP_PKEY_CTRL_PKCS7_DECRYPT:
        ^
77.   		case EVP_PKEY_CTRL_PKCS7_SIGN:
78.   			return 1;

engines/ccgost/gost_pmeth.c:77:3: Switch condition is false. Skipping switch case
75.   		case EVP_PKEY_CTRL_PKCS7_ENCRYPT:
76.   		case EVP_PKEY_CTRL_PKCS7_DECRYPT:
77.   		case EVP_PKEY_CTRL_PKCS7_SIGN:
        ^
78.   			return 1;
79.   

engines/ccgost/gost_pmeth.c:80:3: Switch condition is false. Skipping switch case
78.   			return 1;
79.   
80.   		case EVP_PKEY_CTRL_GOST_PARAMSET:
        ^
81.   			pctx->sign_param_nid = (int)p1;
82.   			return 1;

engines/ccgost/gost_pmeth.c:83:3: Switch condition is true. Entering switch case
81.   			pctx->sign_param_nid = (int)p1;
82.   			return 1;
83.   		case EVP_PKEY_CTRL_SET_IV:
        ^
84.   			pctx->shared_ukm=OPENSSL_malloc((int)p1);
85.   			memcpy(pctx->shared_ukm,p2,(int) p1);

engines/ccgost/gost_pmeth.c:84:4: 
82.   			return 1;
83.   		case EVP_PKEY_CTRL_SET_IV:
84. > 			pctx->shared_ukm=OPENSSL_malloc((int)p1);
85.   			memcpy(pctx->shared_ukm,p2,(int) p1);
86.   			return 1;

crypto/mem.c:294:1: start of procedure CRYPTO_malloc()
  292.   	}
  293.   
  294. > void *CRYPTO_malloc(int num, const char *file, int line)
  295.   	{
  296.   	void *ret = NULL;

crypto/mem.c:296:2: 
  294.   void *CRYPTO_malloc(int num, const char *file, int line)
  295.   	{
  296. > 	void *ret = NULL;
  297.   
  298.   	if (num <= 0) return NULL;

crypto/mem.c:298:6: Taking false branch
  296.   	void *ret = NULL;
  297.   
  298.   	if (num <= 0) return NULL;
              ^
  299.   
  300.   	allow_customize = 0;

crypto/mem.c:300:2: 
  298.   	if (num <= 0) return NULL;
  299.   
  300. > 	allow_customize = 0;
  301.   	if (malloc_debug_func != NULL)
  302.   		{

crypto/mem.c:301:6: Taking true branch
  299.   
  300.   	allow_customize = 0;
  301.   	if (malloc_debug_func != NULL)
              ^
  302.   		{
  303.   		allow_customize_debug = 0;

crypto/mem.c:303:3: 
  301.   	if (malloc_debug_func != NULL)
  302.   		{
  303. > 		allow_customize_debug = 0;
  304.   		malloc_debug_func(NULL, num, file, line, 0);
  305.   		}

crypto/mem.c:304:3: Skipping __function_pointer__(): unresolved function pointer
  302.   		{
  303.   		allow_customize_debug = 0;
  304.   		malloc_debug_func(NULL, num, file, line, 0);
           ^
  305.   		}
  306.   	ret = malloc_ex_func(num,file,line);

crypto/mem.c:306:2: Skipping __function_pointer__(): unresolved function pointer
  304.   		malloc_debug_func(NULL, num, file, line, 0);
  305.   		}
  306.   	ret = malloc_ex_func(num,file,line);
          ^
  307.   #ifdef LEVITTE_DEBUG_MEM
  308.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);

crypto/mem.c:310:6: Taking true branch
  308.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);
  309.   #endif
  310.   	if (malloc_debug_func != NULL)
              ^
  311.   		malloc_debug_func(ret, num, file, line, 1);
  312.   

crypto/mem.c:311:3: Skipping __function_pointer__(): unresolved function pointer
  309.   #endif
  310.   	if (malloc_debug_func != NULL)
  311.   		malloc_debug_func(ret, num, file, line, 1);
           ^
  312.   
  313.   #ifndef OPENSSL_CPUID_OBJ

crypto/mem.c:317:12: Taking false branch
  315.            * sanitisation function can't be optimised out. NB: We only do
  316.            * this for >2Kb so the overhead doesn't bother us. */
  317.           if(ret && (num > 2048))
                    ^
  318.   	{	extern unsigned char cleanse_ctr;
  319.                   ((unsigned char *)ret)[0] = cleanse_ctr;

crypto/mem.c:323:2: 
  321.   #endif
  322.   
  323. > 	return ret;
  324.   	}
  325.   

crypto/mem.c:324:2: return from a call to CRYPTO_malloc
  322.   
  323.   	return ret;
  324.   	}
          ^
  325.   
  326.   void *CRYPTO_realloc(void *str, int num, const char *file, int line)

engines/ccgost/gost_pmeth.c:85:4: 
83.   		case EVP_PKEY_CTRL_SET_IV:
84.   			pctx->shared_ukm=OPENSSL_malloc((int)p1);
85. > 			memcpy(pctx->shared_ukm,p2,(int) p1);
86.   			return 1;
87.   			

static int pkey_gost_ctrl (EVP_PKEY_CTX *ctx, int type, int p1, void *p2)
	{
	struct gost_pmeth_data *pctx = (struct gost_pmeth_data*)EVP_PKEY_CTX_get_data(ctx);
	switch (type)
		{
		case EVP_PKEY_CTRL_MD:
		{
		if (EVP_MD_type((const EVP_MD *)p2) != NID_id_GostR3411_94)
			{
			GOSTerr(GOST_F_PKEY_GOST_CTRL, GOST_R_INVALID_DIGEST_TYPE);
			return 0;
			}
		pctx->md = (EVP_MD *)p2;
		return 1;
		}
		break;
		case EVP_PKEY_CTRL_PKCS7_ENCRYPT:
		case EVP_PKEY_CTRL_PKCS7_DECRYPT:
		case EVP_PKEY_CTRL_PKCS7_SIGN:
			return 1;
		case EVP_PKEY_CTRL_GOST_PARAMSET:
			pctx->sign_param_nid = (int)p1;
			return 1;
		case EVP_PKEY_CTRL_SET_IV:
			pctx->shared_ukm=OPENSSL_malloc((int)p1);
			memcpy(pctx->shared_ukm,p2,(int) p1);
			return 1;
		}
	return -2;
	}
['static int pkey_gost_ctrl (EVP_PKEY_CTX *ctx, int type, int p1, void *p2)\n\t{\n\tstruct gost_pmeth_data *pctx = (struct gost_pmeth_data*)EVP_PKEY_CTX_get_data(ctx);\n\tswitch (type)\n\t\t{\n\t\tcase EVP_PKEY_CTRL_MD:\n\t\t{\n\t\tif (EVP_MD_type((const EVP_MD *)p2) != NID_id_GostR3411_94)\n\t\t\t{\n\t\t\tGOSTerr(GOST_F_PKEY_GOST_CTRL, GOST_R_INVALID_DIGEST_TYPE);\n\t\t\treturn 0;\n\t\t\t}\n\t\tpctx->md = (EVP_MD *)p2;\n\t\treturn 1;\n\t\t}\n\t\tbreak;\n\t\tcase EVP_PKEY_CTRL_PKCS7_ENCRYPT:\n\t\tcase EVP_PKEY_CTRL_PKCS7_DECRYPT:\n\t\tcase EVP_PKEY_CTRL_PKCS7_SIGN:\n\t\t\treturn 1;\n\t\tcase EVP_PKEY_CTRL_GOST_PARAMSET:\n\t\t\tpctx->sign_param_nid = (int)p1;\n\t\t\treturn 1;\n\t\tcase EVP_PKEY_CTRL_SET_IV:\n\t\t\tpctx->shared_ukm=OPENSSL_malloc((int)p1);\n\t\t\tmemcpy(pctx->shared_ukm,p2,(int) p1);\n\t\t\treturn 1;\n\t\t}\n\treturn -2;\n\t}', 'void *EVP_PKEY_CTX_get_data(EVP_PKEY_CTX *ctx)\n\t{\n\treturn ctx->data;\n\t}', 'void *CRYPTO_malloc(int num, const char *file, int line)\n\t{\n\tvoid *ret = NULL;\n\tif (num <= 0) return NULL;\n\tallow_customize = 0;\n\tif (malloc_debug_func != NULL)\n\t\t{\n\t\tallow_customize_debug = 0;\n\t\tmalloc_debug_func(NULL, num, file, line, 0);\n\t\t}\n\tret = malloc_ex_func(num,file,line);\n#ifdef LEVITTE_DEBUG_MEM\n\tfprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\\n", ret, num);\n#endif\n\tif (malloc_debug_func != NULL)\n\t\tmalloc_debug_func(ret, num, file, line, 1);\n#ifndef OPENSSL_CPUID_OBJ\n        if(ret && (num > 2048))\n\t{\textern unsigned char cleanse_ctr;\n                ((unsigned char *)ret)[0] = cleanse_ctr;\n\t}\n#endif\n\treturn ret;\n\t}']