crypto/evp/evp_pbe.c:232: error: NULL_DEREFERENCE
  pointer `pbe_algs` last assigned on line 219 could be null and is dereferenced by call to `sk_push()` at line 232, column 2.
Showing all 43 steps of the trace


crypto/evp/evp_pbe.c:214:1: start of procedure EVP_PBE_alg_add_type()
212.   /* Add a PBE algorithm */
213.   
214. > int EVP_PBE_alg_add_type(int pbe_type, int pbe_nid, int cipher_nid, int md_nid,
215.   			 EVP_PBE_KEYGEN *keygen)
216.   	{

crypto/evp/evp_pbe.c:218:7: Taking true branch
216.   	{
217.   	EVP_PBE_CTL *pbe_tmp;
218.   	if (!pbe_algs)
             ^
219.   		pbe_algs = sk_EVP_PBE_CTL_new(pbe_cmp);
220.   	if (!(pbe_tmp = (EVP_PBE_CTL*) OPENSSL_malloc (sizeof(EVP_PBE_CTL))))

crypto/evp/evp_pbe.c:219:14: Condition is true
217.   	EVP_PBE_CTL *pbe_tmp;
218.   	if (!pbe_algs)
219.   		pbe_algs = sk_EVP_PBE_CTL_new(pbe_cmp);
                    ^
220.   	if (!(pbe_tmp = (EVP_PBE_CTL*) OPENSSL_malloc (sizeof(EVP_PBE_CTL))))
221.   		{

crypto/evp/evp_pbe.c:219:3: 
217.   	EVP_PBE_CTL *pbe_tmp;
218.   	if (!pbe_algs)
219. > 		pbe_algs = sk_EVP_PBE_CTL_new(pbe_cmp);
220.   	if (!(pbe_tmp = (EVP_PBE_CTL*) OPENSSL_malloc (sizeof(EVP_PBE_CTL))))
221.   		{

crypto/stack/stack.c:121:1: start of procedure sk_new()
  119.   	}
  120.   
  121. > _STACK *sk_new(int (*c)(const void * const *, const void * const *))
  122.   	{
  123.   	_STACK *ret;

crypto/stack/stack.c:126:6: 
  124.   	int i;
  125.   
  126. > 	if ((ret=OPENSSL_malloc(sizeof(_STACK))) == NULL)
  127.   		goto err;
  128.   	if ((ret->data=OPENSSL_malloc(sizeof(char *)*MIN_NODES)) == NULL)

crypto/mem.c:294:1: start of procedure CRYPTO_malloc()
    292.   	}
    293.   
    294. > void *CRYPTO_malloc(int num, const char *file, int line)
    295.   	{
    296.   	void *ret = NULL;

crypto/mem.c:296:2: 
    294.   void *CRYPTO_malloc(int num, const char *file, int line)
    295.   	{
    296. > 	void *ret = NULL;
    297.   
    298.   	if (num <= 0) return NULL;

crypto/mem.c:298:6: Taking false branch
    296.   	void *ret = NULL;
    297.   
    298.   	if (num <= 0) return NULL;
                ^
    299.   
    300.   	allow_customize = 0;

crypto/mem.c:300:2: 
    298.   	if (num <= 0) return NULL;
    299.   
    300. > 	allow_customize = 0;
    301.   	if (malloc_debug_func != NULL)
    302.   		{

crypto/mem.c:301:6: Taking false branch
    299.   
    300.   	allow_customize = 0;
    301.   	if (malloc_debug_func != NULL)
                ^
    302.   		{
    303.   		allow_customize_debug = 0;

crypto/mem.c:306:2: Skipping __function_pointer__(): unresolved function pointer
    304.   		malloc_debug_func(NULL, num, file, line, 0);
    305.   		}
    306.   	ret = malloc_ex_func(num,file,line);
            ^
    307.   #ifdef LEVITTE_DEBUG_MEM
    308.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);

crypto/mem.c:310:6: Taking false branch
    308.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);
    309.   #endif
    310.   	if (malloc_debug_func != NULL)
                ^
    311.   		malloc_debug_func(ret, num, file, line, 1);
    312.   

crypto/mem.c:317:12: Taking false branch
    315.            * sanitisation function can't be optimised out. NB: We only do
    316.            * this for >2Kb so the overhead doesn't bother us. */
    317.           if(ret && (num > 2048))
                      ^
    318.   	{	extern unsigned char cleanse_ctr;
    319.                   ((unsigned char *)ret)[0] = cleanse_ctr;

crypto/mem.c:323:2: 
    321.   #endif
    322.   
    323. > 	return ret;
    324.   	}
    325.   

crypto/mem.c:324:2: return from a call to CRYPTO_malloc
    322.   
    323.   	return ret;
    324.   	}
            ^
    325.   
    326.   void *CRYPTO_realloc(void *str, int num, const char *file, int line)

crypto/stack/stack.c:126:6: Taking true branch
  124.   	int i;
  125.   
  126.   	if ((ret=OPENSSL_malloc(sizeof(_STACK))) == NULL)
              ^
  127.   		goto err;
  128.   	if ((ret->data=OPENSSL_malloc(sizeof(char *)*MIN_NODES)) == NULL)

crypto/stack/stack.c:137:1: 
  135.   	ret->sorted=0;
  136.   	return(ret);
  137. > err:
  138.   	if(ret)
  139.   		OPENSSL_free(ret);

crypto/stack/stack.c:138:5: Taking false branch
  136.   	return(ret);
  137.   err:
  138.   	if(ret)
             ^
  139.   		OPENSSL_free(ret);
  140.   	return(NULL);

crypto/stack/stack.c:140:2: 
  138.   	if(ret)
  139.   		OPENSSL_free(ret);
  140. > 	return(NULL);
  141.   	}
  142.   

crypto/stack/stack.c:141:2: return from a call to sk_new
  139.   		OPENSSL_free(ret);
  140.   	return(NULL);
  141.   	}
          ^
  142.   
  143.   int sk_insert(_STACK *st, void *data, int loc)

crypto/evp/evp_pbe.c:220:8: 
218.   	if (!pbe_algs)
219.   		pbe_algs = sk_EVP_PBE_CTL_new(pbe_cmp);
220. > 	if (!(pbe_tmp = (EVP_PBE_CTL*) OPENSSL_malloc (sizeof(EVP_PBE_CTL))))
221.   		{
222.   		EVPerr(EVP_F_EVP_PBE_ALG_ADD_TYPE,ERR_R_MALLOC_FAILURE);

crypto/mem.c:294:1: start of procedure CRYPTO_malloc()
  292.   	}
  293.   
  294. > void *CRYPTO_malloc(int num, const char *file, int line)
  295.   	{
  296.   	void *ret = NULL;

crypto/mem.c:296:2: 
  294.   void *CRYPTO_malloc(int num, const char *file, int line)
  295.   	{
  296. > 	void *ret = NULL;
  297.   
  298.   	if (num <= 0) return NULL;

crypto/mem.c:298:6: Taking false branch
  296.   	void *ret = NULL;
  297.   
  298.   	if (num <= 0) return NULL;
              ^
  299.   
  300.   	allow_customize = 0;

crypto/mem.c:300:2: 
  298.   	if (num <= 0) return NULL;
  299.   
  300. > 	allow_customize = 0;
  301.   	if (malloc_debug_func != NULL)
  302.   		{

crypto/mem.c:301:6: Taking false branch
  299.   
  300.   	allow_customize = 0;
  301.   	if (malloc_debug_func != NULL)
              ^
  302.   		{
  303.   		allow_customize_debug = 0;

crypto/mem.c:306:2: Skipping __function_pointer__(): unresolved function pointer
  304.   		malloc_debug_func(NULL, num, file, line, 0);
  305.   		}
  306.   	ret = malloc_ex_func(num,file,line);
          ^
  307.   #ifdef LEVITTE_DEBUG_MEM
  308.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);

crypto/mem.c:310:6: Taking false branch
  308.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);
  309.   #endif
  310.   	if (malloc_debug_func != NULL)
              ^
  311.   		malloc_debug_func(ret, num, file, line, 1);
  312.   

crypto/mem.c:317:12: Taking true branch
  315.            * sanitisation function can't be optimised out. NB: We only do
  316.            * this for >2Kb so the overhead doesn't bother us. */
  317.           if(ret && (num > 2048))
                    ^
  318.   	{	extern unsigned char cleanse_ctr;
  319.                   ((unsigned char *)ret)[0] = cleanse_ctr;

crypto/mem.c:317:20: Taking false branch
  315.            * sanitisation function can't be optimised out. NB: We only do
  316.            * this for >2Kb so the overhead doesn't bother us. */
  317.           if(ret && (num > 2048))
                            ^
  318.   	{	extern unsigned char cleanse_ctr;
  319.                   ((unsigned char *)ret)[0] = cleanse_ctr;

crypto/mem.c:323:2: 
  321.   #endif
  322.   
  323. > 	return ret;
  324.   	}
  325.   

crypto/mem.c:324:2: return from a call to CRYPTO_malloc
  322.   
  323.   	return ret;
  324.   	}
          ^
  325.   
  326.   void *CRYPTO_realloc(void *str, int num, const char *file, int line)

crypto/evp/evp_pbe.c:220:8: Taking false branch
218.   	if (!pbe_algs)
219.   		pbe_algs = sk_EVP_PBE_CTL_new(pbe_cmp);
220.   	if (!(pbe_tmp = (EVP_PBE_CTL*) OPENSSL_malloc (sizeof(EVP_PBE_CTL))))
              ^
221.   		{
222.   		EVPerr(EVP_F_EVP_PBE_ALG_ADD_TYPE,ERR_R_MALLOC_FAILURE);

crypto/evp/evp_pbe.c:225:2: 
223.   		return 0;
224.   		}
225. > 	pbe_tmp->pbe_type = pbe_type;
226.   	pbe_tmp->pbe_nid = pbe_nid;
227.   	pbe_tmp->cipher_nid = cipher_nid;

crypto/evp/evp_pbe.c:226:2: 
224.   		}
225.   	pbe_tmp->pbe_type = pbe_type;
226. > 	pbe_tmp->pbe_nid = pbe_nid;
227.   	pbe_tmp->cipher_nid = cipher_nid;
228.   	pbe_tmp->md_nid = md_nid;

crypto/evp/evp_pbe.c:227:2: 
225.   	pbe_tmp->pbe_type = pbe_type;
226.   	pbe_tmp->pbe_nid = pbe_nid;
227. > 	pbe_tmp->cipher_nid = cipher_nid;
228.   	pbe_tmp->md_nid = md_nid;
229.   	pbe_tmp->keygen = keygen;

crypto/evp/evp_pbe.c:228:2: 
226.   	pbe_tmp->pbe_nid = pbe_nid;
227.   	pbe_tmp->cipher_nid = cipher_nid;
228. > 	pbe_tmp->md_nid = md_nid;
229.   	pbe_tmp->keygen = keygen;
230.   

crypto/evp/evp_pbe.c:229:2: 
227.   	pbe_tmp->cipher_nid = cipher_nid;
228.   	pbe_tmp->md_nid = md_nid;
229. > 	pbe_tmp->keygen = keygen;
230.   
231.   

crypto/evp/evp_pbe.c:232:2: Condition is true
230.   
231.   
232.   	sk_EVP_PBE_CTL_push (pbe_algs, pbe_tmp);
        ^
233.   	return 1;
234.   	}

crypto/evp/evp_pbe.c:232:2: Condition is true
230.   
231.   
232.   	sk_EVP_PBE_CTL_push (pbe_algs, pbe_tmp);
        ^
233.   	return 1;
234.   	}

crypto/stack/stack.c:252:1: start of procedure sk_push()
  250.   	}
  251.   
  252. > int sk_push(_STACK *st, void *data)
  253.   	{
  254.   	return(sk_insert(st,data,st->num));

crypto/stack/stack.c:254:2: Skipping sk_insert(): empty list of specs
  252.   int sk_push(_STACK *st, void *data)
  253.   	{
  254.   	return(sk_insert(st,data,st->num));
          ^
  255.   	}
  256.   

int EVP_PBE_alg_add_type(int pbe_type, int pbe_nid, int cipher_nid, int md_nid,
			 EVP_PBE_KEYGEN *keygen)
	{
	EVP_PBE_CTL *pbe_tmp;
	if (!pbe_algs)
		pbe_algs = sk_EVP_PBE_CTL_new(pbe_cmp);
	if (!(pbe_tmp = (EVP_PBE_CTL*) OPENSSL_malloc (sizeof(EVP_PBE_CTL))))
		{
		EVPerr(EVP_F_EVP_PBE_ALG_ADD_TYPE,ERR_R_MALLOC_FAILURE);
		return 0;
		}
	pbe_tmp->pbe_type = pbe_type;
	pbe_tmp->pbe_nid = pbe_nid;
	pbe_tmp->cipher_nid = cipher_nid;
	pbe_tmp->md_nid = md_nid;
	pbe_tmp->keygen = keygen;
	sk_EVP_PBE_CTL_push (pbe_algs, pbe_tmp);
	return 1;
	}
['int EVP_PBE_alg_add_type(int pbe_type, int pbe_nid, int cipher_nid, int md_nid,\n\t\t\t EVP_PBE_KEYGEN *keygen)\n\t{\n\tEVP_PBE_CTL *pbe_tmp;\n\tif (!pbe_algs)\n\t\tpbe_algs = sk_EVP_PBE_CTL_new(pbe_cmp);\n\tif (!(pbe_tmp = (EVP_PBE_CTL*) OPENSSL_malloc (sizeof(EVP_PBE_CTL))))\n\t\t{\n\t\tEVPerr(EVP_F_EVP_PBE_ALG_ADD_TYPE,ERR_R_MALLOC_FAILURE);\n\t\treturn 0;\n\t\t}\n\tpbe_tmp->pbe_type = pbe_type;\n\tpbe_tmp->pbe_nid = pbe_nid;\n\tpbe_tmp->cipher_nid = cipher_nid;\n\tpbe_tmp->md_nid = md_nid;\n\tpbe_tmp->keygen = keygen;\n\tsk_EVP_PBE_CTL_push (pbe_algs, pbe_tmp);\n\treturn 1;\n\t}', '_STACK *sk_new(int (*c)(const void * const *, const void * const *))\n\t{\n\t_STACK *ret;\n\tint i;\n\tif ((ret=OPENSSL_malloc(sizeof(_STACK))) == NULL)\n\t\tgoto err;\n\tif ((ret->data=OPENSSL_malloc(sizeof(char *)*MIN_NODES)) == NULL)\n\t\tgoto err;\n\tfor (i=0; i<MIN_NODES; i++)\n\t\tret->data[i]=NULL;\n\tret->comp=c;\n\tret->num_alloc=MIN_NODES;\n\tret->num=0;\n\tret->sorted=0;\n\treturn(ret);\nerr:\n\tif(ret)\n\t\tOPENSSL_free(ret);\n\treturn(NULL);\n\t}', 'void *CRYPTO_malloc(int num, const char *file, int line)\n\t{\n\tvoid *ret = NULL;\n\tif (num <= 0) return NULL;\n\tallow_customize = 0;\n\tif (malloc_debug_func != NULL)\n\t\t{\n\t\tallow_customize_debug = 0;\n\t\tmalloc_debug_func(NULL, num, file, line, 0);\n\t\t}\n\tret = malloc_ex_func(num,file,line);\n#ifdef LEVITTE_DEBUG_MEM\n\tfprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\\n", ret, num);\n#endif\n\tif (malloc_debug_func != NULL)\n\t\tmalloc_debug_func(ret, num, file, line, 1);\n#ifndef OPENSSL_CPUID_OBJ\n        if(ret && (num > 2048))\n\t{\textern unsigned char cleanse_ctr;\n                ((unsigned char *)ret)[0] = cleanse_ctr;\n\t}\n#endif\n\treturn ret;\n\t}', 'int sk_push(_STACK *st, void *data)\n\t{\n\treturn(sk_insert(st,data,st->num));\n\t}']