test/evp_test.c:716: error: NULL_DEREFERENCE
  pointer `mctx` last assigned on line 694 could be null and is dereferenced by call to `EVP_MD_CTX_free()` at line 716, column 5.
Showing all 24 steps of the trace


test/evp_test.c:686:1: start of procedure digest_test_run()
684.   }
685.   
686. > static int digest_test_run(struct evp_test *t)
687.   {
688.       struct digest_data *mdata = t->data;

test/evp_test.c:688:5: 
686.   static int digest_test_run(struct evp_test *t)
687.   {
688. >     struct digest_data *mdata = t->data;
689.       size_t i;
690.       const char *err = "INTERNAL_ERROR";

test/evp_test.c:690:5: 
688.       struct digest_data *mdata = t->data;
689.       size_t i;
690. >     const char *err = "INTERNAL_ERROR";
691.       EVP_MD_CTX *mctx;
692.       unsigned char md[EVP_MAX_MD_SIZE];

test/evp_test.c:694:5: 
692.       unsigned char md[EVP_MAX_MD_SIZE];
693.       unsigned int md_len;
694. >     mctx = EVP_MD_CTX_new();
695.       if (!mctx)
696.           goto err;

crypto/evp/digest.c:153:1: start of procedure EVP_MD_CTX_new()
  151.   }
  152.   
  153. > EVP_MD_CTX *EVP_MD_CTX_new(void)
  154.   {
  155.       return OPENSSL_zalloc(sizeof(EVP_MD_CTX));

crypto/evp/digest.c:155:5: 
  153.   EVP_MD_CTX *EVP_MD_CTX_new(void)
  154.   {
  155. >     return OPENSSL_zalloc(sizeof(EVP_MD_CTX));
  156.   }
  157.   

crypto/mem.c:315:1: start of procedure CRYPTO_zalloc()
    313.   }
    314.   
    315. > void *CRYPTO_zalloc(int num, const char *file, int line)
    316.   {
    317.       void *ret = CRYPTO_malloc(num, file, line);

crypto/mem.c:317:5: 
    315.   void *CRYPTO_zalloc(int num, const char *file, int line)
    316.   {
    317. >     void *ret = CRYPTO_malloc(num, file, line);
    318.   
    319.       if (ret != NULL)

crypto/mem.c:279:1: start of procedure CRYPTO_malloc()
      277.   }
      278.   
      279. > void *CRYPTO_malloc(int num, const char *file, int line)
      280.   {
      281.       void *ret = NULL;

crypto/mem.c:281:5: 
      279.   void *CRYPTO_malloc(int num, const char *file, int line)
      280.   {
      281. >     void *ret = NULL;
      282.   
      283.       if (num <= 0)

crypto/mem.c:283:9: Taking false branch
      281.       void *ret = NULL;
      282.   
      283.       if (num <= 0)
                     ^
      284.           return NULL;
      285.   

crypto/mem.c:286:9: Taking false branch
      284.           return NULL;
      285.   
      286.       if (allow_customize)
                     ^
      287.           allow_customize = 0;
      288.       if (malloc_debug_func != NULL) {

crypto/mem.c:288:9: Taking false branch
      286.       if (allow_customize)
      287.           allow_customize = 0;
      288.       if (malloc_debug_func != NULL) {
                     ^
      289.           if (allow_customize_debug)
      290.               allow_customize_debug = 0;

crypto/mem.c:293:5: Skipping __function_pointer__(): unresolved function pointer
      291.           malloc_debug_func(NULL, num, file, line, 0);
      292.       }
      293.       ret = malloc_ex_func(num, file, line);
                 ^
      294.   #ifdef LEVITTE_DEBUG_MEM
      295.       fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);

crypto/mem.c:297:9: Taking false branch
      295.       fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);
      296.   #endif
      297.       if (malloc_debug_func != NULL)
                     ^
      298.           malloc_debug_func(ret, num, file, line, 1);
      299.   

crypto/mem.c:312:5: 
      310.   #endif
      311.   
      312. >     return ret;
      313.   }
      314.   

crypto/mem.c:313:1: return from a call to CRYPTO_malloc
      311.   
      312.       return ret;
      313. > }
      314.   
      315.   void *CRYPTO_zalloc(int num, const char *file, int line)

crypto/mem.c:319:9: Taking false branch
    317.       void *ret = CRYPTO_malloc(num, file, line);
    318.   
    319.       if (ret != NULL)
                   ^
    320.           memset(ret, 0, num);
    321.       return ret;

crypto/mem.c:321:5: 
    319.       if (ret != NULL)
    320.           memset(ret, 0, num);
    321. >     return ret;
    322.   }
    323.   

crypto/mem.c:322:1: return from a call to CRYPTO_zalloc
    320.           memset(ret, 0, num);
    321.       return ret;
    322. > }
    323.   
    324.   char *CRYPTO_strdup(const char *str, const char *file, int line)

crypto/evp/digest.c:156:1: return from a call to EVP_MD_CTX_new
  154.   {
  155.       return OPENSSL_zalloc(sizeof(EVP_MD_CTX));
  156. > }
  157.   
  158.   void EVP_MD_CTX_free(EVP_MD_CTX *ctx)

test/evp_test.c:695:10: Taking true branch
693.       unsigned int md_len;
694.       mctx = EVP_MD_CTX_new();
695.       if (!mctx)
                ^
696.           goto err;
697.       err = "DIGESTINIT_ERROR";

test/evp_test.c:715:2: 
713.           goto err;
714.       err = NULL;
715. >  err:
716.       EVP_MD_CTX_free(mctx);
717.       t->err = err;

test/evp_test.c:716:5: 
714.       err = NULL;
715.    err:
716. >     EVP_MD_CTX_free(mctx);
717.       t->err = err;
718.       return 1;

static int digest_test_run(struct evp_test *t)
{
    struct digest_data *mdata = t->data;
    size_t i;
    const char *err = "INTERNAL_ERROR";
    EVP_MD_CTX *mctx;
    unsigned char md[EVP_MAX_MD_SIZE];
    unsigned int md_len;
    mctx = EVP_MD_CTX_new();
    if (!mctx)
        goto err;
    err = "DIGESTINIT_ERROR";
    if (!EVP_DigestInit_ex(mctx, mdata->digest, NULL))
        goto err;
    err = "DIGESTUPDATE_ERROR";
    for (i = 0; i < mdata->nrpt; i++) {
        if (!EVP_DigestUpdate(mctx, mdata->input, mdata->input_len))
            goto err;
    }
    err = "DIGESTFINAL_ERROR";
    if (!EVP_DigestFinal(mctx, md, &md_len))
        goto err;
    err = "DIGEST_LENGTH_MISMATCH";
    if (md_len != mdata->output_len)
        goto err;
    err = "DIGEST_MISMATCH";
    if (check_output(t, mdata->output, md, md_len))
        goto err;
    err = NULL;
 err:
    EVP_MD_CTX_free(mctx);
    t->err = err;
    return 1;
}
['static int digest_test_run(struct evp_test *t)\n{\n    struct digest_data *mdata = t->data;\n    size_t i;\n    const char *err = "INTERNAL_ERROR";\n    EVP_MD_CTX *mctx;\n    unsigned char md[EVP_MAX_MD_SIZE];\n    unsigned int md_len;\n    mctx = EVP_MD_CTX_new();\n    if (!mctx)\n        goto err;\n    err = "DIGESTINIT_ERROR";\n    if (!EVP_DigestInit_ex(mctx, mdata->digest, NULL))\n        goto err;\n    err = "DIGESTUPDATE_ERROR";\n    for (i = 0; i < mdata->nrpt; i++) {\n        if (!EVP_DigestUpdate(mctx, mdata->input, mdata->input_len))\n            goto err;\n    }\n    err = "DIGESTFINAL_ERROR";\n    if (!EVP_DigestFinal(mctx, md, &md_len))\n        goto err;\n    err = "DIGEST_LENGTH_MISMATCH";\n    if (md_len != mdata->output_len)\n        goto err;\n    err = "DIGEST_MISMATCH";\n    if (check_output(t, mdata->output, md, md_len))\n        goto err;\n    err = NULL;\n err:\n    EVP_MD_CTX_free(mctx);\n    t->err = err;\n    return 1;\n}', 'EVP_MD_CTX *EVP_MD_CTX_new(void)\n{\n    return OPENSSL_zalloc(sizeof(EVP_MD_CTX));\n}', 'void *CRYPTO_zalloc(int num, const char *file, int line)\n{\n    void *ret = CRYPTO_malloc(num, file, line);\n    if (ret != NULL)\n        memset(ret, 0, num);\n    return ret;\n}', 'void *CRYPTO_malloc(int num, const char *file, int line)\n{\n    void *ret = NULL;\n    if (num <= 0)\n        return NULL;\n    if (allow_customize)\n        allow_customize = 0;\n    if (malloc_debug_func != NULL) {\n        if (allow_customize_debug)\n            allow_customize_debug = 0;\n        malloc_debug_func(NULL, num, file, line, 0);\n    }\n    ret = malloc_ex_func(num, file, line);\n#ifdef LEVITTE_DEBUG_MEM\n    fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\\n", ret, num);\n#endif\n    if (malloc_debug_func != NULL)\n        malloc_debug_func(ret, num, file, line, 1);\n#ifndef OPENSSL_CPUID_OBJ\n    if (ret && (num > 2048)) {\n        extern unsigned char cleanse_ctr;\n        ((unsigned char *)ret)[0] = cleanse_ctr;\n    }\n#endif\n    return ret;\n}']