crypto/evp/evp_lib.c:366: error: NULL_DEREFERENCE
  pointer `to` last assigned on line 364 could be null and is dereferenced by call to `memcpy()` at line 366, column 9.
Showing all 23 steps of the trace


crypto/evp/evp_lib.c:362:1: start of procedure EVP_MD_meth_dup()
360.       return md;
361.   }
362. > EVP_MD *EVP_MD_meth_dup(const EVP_MD *md)
363.   {
364.       EVP_MD *to = EVP_MD_meth_new(md->type, md->pkey_type);

crypto/evp/evp_lib.c:364:5: 
362.   EVP_MD *EVP_MD_meth_dup(const EVP_MD *md)
363.   {
364. >     EVP_MD *to = EVP_MD_meth_new(md->type, md->pkey_type);
365.       if (md != NULL)
366.           memcpy(to, md, sizeof(*to));

crypto/evp/evp_lib.c:353:1: start of procedure EVP_MD_meth_new()
  351.   }
  352.   
  353. > EVP_MD *EVP_MD_meth_new(int md_type, int pkey_type)
  354.   {
  355.       EVP_MD *md = (EVP_MD *)OPENSSL_zalloc(sizeof(EVP_MD));

crypto/evp/evp_lib.c:355:5: 
  353.   EVP_MD *EVP_MD_meth_new(int md_type, int pkey_type)
  354.   {
  355. >     EVP_MD *md = (EVP_MD *)OPENSSL_zalloc(sizeof(EVP_MD));
  356.       if (md != NULL) {
  357.           md->type = md_type;

crypto/mem.c:156:1: start of procedure CRYPTO_zalloc()
    154.   }
    155.   
    156. > void *CRYPTO_zalloc(size_t num, const char *file, int line)
    157.   {
    158.       void *ret = CRYPTO_malloc(num, file, line);

crypto/mem.c:158:5: 
    156.   void *CRYPTO_zalloc(size_t num, const char *file, int line)
    157.   {
    158. >     void *ret = CRYPTO_malloc(num, file, line);
    159.   
    160.       if (ret != NULL)

crypto/mem.c:119:1: start of procedure CRYPTO_malloc()
      117.   }
      118.   
      119. > void *CRYPTO_malloc(size_t num, const char *file, int line)
      120.   {
      121.       void *ret = NULL;

crypto/mem.c:121:5: 
      119.   void *CRYPTO_malloc(size_t num, const char *file, int line)
      120.   {
      121. >     void *ret = NULL;
      122.   
      123.       if (num <= 0)

crypto/mem.c:123:9: Taking false branch
      121.       void *ret = NULL;
      122.   
      123.       if (num <= 0)
                     ^
      124.           return NULL;
      125.   

crypto/mem.c:126:5: 
      124.           return NULL;
      125.   
      126. >     allow_customize = 0;
      127.   #ifndef OPENSSL_NO_CRYPTO_MDEBUG
      128.       if (call_malloc_debug) {

crypto/mem.c:136:5: 
      134.       }
      135.   #else
      136. >     (void)file;
      137.       (void)line;
      138.       ret = malloc(num);

crypto/mem.c:137:5: 
      135.   #else
      136.       (void)file;
      137. >     (void)line;
      138.       ret = malloc(num);
      139.   #endif

crypto/mem.c:138:5: 
      136.       (void)file;
      137.       (void)line;
      138. >     ret = malloc(num);
      139.   #endif
      140.   

crypto/mem.c:153:5: 
      151.   #endif
      152.   
      153. >     return ret;
      154.   }
      155.   

crypto/mem.c:154:1: return from a call to CRYPTO_malloc
      152.   
      153.       return ret;
      154. > }
      155.   
      156.   void *CRYPTO_zalloc(size_t num, const char *file, int line)

crypto/mem.c:160:9: Taking false branch
    158.       void *ret = CRYPTO_malloc(num, file, line);
    159.   
    160.       if (ret != NULL)
                   ^
    161.           memset(ret, 0, num);
    162.       return ret;

crypto/mem.c:162:5: 
    160.       if (ret != NULL)
    161.           memset(ret, 0, num);
    162. >     return ret;
    163.   }
    164.   

crypto/mem.c:163:1: return from a call to CRYPTO_zalloc
    161.           memset(ret, 0, num);
    162.       return ret;
    163. > }
    164.   
    165.   void *CRYPTO_realloc(void *str, size_t num, const char *file, int line)

crypto/evp/evp_lib.c:356:9: Taking false branch
  354.   {
  355.       EVP_MD *md = (EVP_MD *)OPENSSL_zalloc(sizeof(EVP_MD));
  356.       if (md != NULL) {
                 ^
  357.           md->type = md_type;
  358.           md->pkey_type = pkey_type;

crypto/evp/evp_lib.c:360:5: 
  358.           md->pkey_type = pkey_type;
  359.       }
  360. >     return md;
  361.   }
  362.   EVP_MD *EVP_MD_meth_dup(const EVP_MD *md)

crypto/evp/evp_lib.c:361:1: return from a call to EVP_MD_meth_new
  359.       }
  360.       return md;
  361. > }
  362.   EVP_MD *EVP_MD_meth_dup(const EVP_MD *md)
  363.   {

crypto/evp/evp_lib.c:365:9: Taking true branch
363.   {
364.       EVP_MD *to = EVP_MD_meth_new(md->type, md->pkey_type);
365.       if (md != NULL)
               ^
366.           memcpy(to, md, sizeof(*to));
367.       return to;

crypto/evp/evp_lib.c:366:9: 
364.       EVP_MD *to = EVP_MD_meth_new(md->type, md->pkey_type);
365.       if (md != NULL)
366. >         memcpy(to, md, sizeof(*to));
367.       return to;
368.   }

EVP_MD *EVP_MD_meth_dup(const EVP_MD *md)
{
    EVP_MD *to = EVP_MD_meth_new(md->type, md->pkey_type);
    if (md != NULL)
        memcpy(to, md, sizeof(*to));
    return to;
}
['EVP_MD *EVP_MD_meth_dup(const EVP_MD *md)\n{\n    EVP_MD *to = EVP_MD_meth_new(md->type, md->pkey_type);\n    if (md != NULL)\n        memcpy(to, md, sizeof(*to));\n    return to;\n}', 'EVP_MD *EVP_MD_meth_new(int md_type, int pkey_type)\n{\n    EVP_MD *md = (EVP_MD *)OPENSSL_zalloc(sizeof(EVP_MD));\n    if (md != NULL) {\n        md->type = md_type;\n        md->pkey_type = pkey_type;\n    }\n    return md;\n}', 'void *CRYPTO_zalloc(size_t num, const char *file, int line)\n{\n    void *ret = CRYPTO_malloc(num, file, line);\n    if (ret != NULL)\n        memset(ret, 0, num);\n    return ret;\n}', 'void *CRYPTO_malloc(size_t num, const char *file, int line)\n{\n    void *ret = NULL;\n    if (num <= 0)\n        return NULL;\n    allow_customize = 0;\n#ifndef OPENSSL_NO_CRYPTO_MDEBUG\n    if (call_malloc_debug) {\n        CRYPTO_mem_debug_malloc(NULL, num, 0, file, line);\n        ret = malloc(num);\n        CRYPTO_mem_debug_malloc(ret, num, 1, file, line);\n    } else {\n        ret = malloc(num);\n    }\n#else\n    (void)file;\n    (void)line;\n    ret = malloc(num);\n#endif\n#ifndef OPENSSL_CPUID_OBJ\n    if (ret && (num > 2048)) {\n        extern unsigned char cleanse_ctr;\n        ((unsigned char *)ret)[0] = cleanse_ctr;\n    }\n#endif\n    return ret;\n}']