crypto/asn1/a_bytes.c:307: error: NULL_DEREFERENCE
  pointer `&b->data` last assigned on line 277 could be null and is dereferenced by call to `BUF_MEM_grow()` at line 307, column 8.
Showing all 32 steps of the trace


crypto/asn1/a_bytes.c:269:1: start of procedure asn1_collate_primative()
267.   /* There have been a few bug fixes for this function from
268.    * Paul Keogh <paul.keogh@sse.ie>, many thanks to him */
269. > static int asn1_collate_primative(ASN1_STRING *a, ASN1_CTX *c)
270.   	{
271.   	ASN1_STRING *os=NULL;

crypto/asn1/a_bytes.c:271:2: 
269.   static int asn1_collate_primative(ASN1_STRING *a, ASN1_CTX *c)
270.   	{
271. > 	ASN1_STRING *os=NULL;
272.   	BUF_MEM b;
273.   	int num;

crypto/asn1/a_bytes.c:275:2: 
273.   	int num;
274.   
275. > 	b.length=0;
276.   	b.max=0;
277.   	b.data=NULL;

crypto/asn1/a_bytes.c:276:2: 
274.   
275.   	b.length=0;
276. > 	b.max=0;
277.   	b.data=NULL;
278.   

crypto/asn1/a_bytes.c:277:2: 
275.   	b.length=0;
276.   	b.max=0;
277. > 	b.data=NULL;
278.   
279.   	if (a == NULL)

crypto/asn1/a_bytes.c:279:6: Taking false branch
277.   	b.data=NULL;
278.   
279.   	if (a == NULL)
            ^
280.   		{
281.   		c->error=ERR_R_PASSED_NULL_PARAMETER;

crypto/asn1/a_bytes.c:285:2: 
283.   		}
284.   
285. > 	num=0;
286.   	for (;;)
287.   		{

crypto/asn1/a_bytes.c:316:3: Loop condition is true. Entering loop body
314.   			c->slen-=(c->p-c->q);
315.   		num+=os->length;
316.   		}
         ^
317.   
318.   	if (!asn1_Finish(c)) goto err;

crypto/asn1/a_bytes.c:288:7: Taking true branch
286.   	for (;;)
287.   		{
288.   		if (c->inf & 1)
             ^
289.   			{
290.   			c->eos=ASN1_check_infinite_end(&c->p,

crypto/asn1/a_bytes.c:290:4: 
288.   		if (c->inf & 1)
289.   			{
290. > 			c->eos=ASN1_check_infinite_end(&c->p,
291.   				(long)(c->max-c->p));
292.   			if (c->eos) break;

crypto/asn1/asn1_lib.c:74:1: start of procedure ASN1_check_infinite_end()
  72.   const char *ASN1_version="ASN.1" OPENSSL_VERSION_PTEXT;
  73.   
  74. > int ASN1_check_infinite_end(unsigned char **p, long len)
  75.   	{
  76.   	/* If there is 0 or 1 byte left, the length check should pick

crypto/asn1/asn1_lib.c:78:6: Taking false branch
  76.   	/* If there is 0 or 1 byte left, the length check should pick
  77.   	 * things up */
  78.   	if (len <= 0)
             ^
  79.   		return(1);
  80.   	else if ((len >= 2) && ((*p)[0] == 0) && ((*p)[1] == 0))

crypto/asn1/asn1_lib.c:80:12: Taking true branch
  78.   	if (len <= 0)
  79.   		return(1);
  80.   	else if ((len >= 2) && ((*p)[0] == 0) && ((*p)[1] == 0))
                   ^
  81.   		{
  82.   		(*p)+=2;

crypto/asn1/asn1_lib.c:80:26: Taking false branch
  78.   	if (len <= 0)
  79.   		return(1);
  80.   	else if ((len >= 2) && ((*p)[0] == 0) && ((*p)[1] == 0))
                                 ^
  81.   		{
  82.   		(*p)+=2;

crypto/asn1/asn1_lib.c:85:2: 
  83.   		return(1);
  84.   		}
  85. > 	return(0);
  86.   	}
  87.   

crypto/asn1/asn1_lib.c:86:2: return from a call to ASN1_check_infinite_end
  84.   		}
  85.   	return(0);
  86.   	}
         ^
  87.   
  88.   

crypto/asn1/a_bytes.c:292:8: Taking false branch
290.   			c->eos=ASN1_check_infinite_end(&c->p,
291.   				(long)(c->max-c->p));
292.   			if (c->eos) break;
              ^
293.   			}
294.   		else

crypto/asn1/a_bytes.c:299:3: 
297.   			}
298.   
299. > 		c->q=c->p;
300.   		if (d2i_ASN1_bytes(&os,&c->p,c->max-c->p,c->tag,c->xclass)
301.   			== NULL)

crypto/asn1/a_bytes.c:300:7: Taking false branch
298.   
299.   		c->q=c->p;
300.   		if (d2i_ASN1_bytes(&os,&c->p,c->max-c->p,c->tag,c->xclass)
             ^
301.   			== NULL)
302.   			{

crypto/asn1/a_bytes.c:307:8: 
305.   			}
306.   
307. > 		if (!BUF_MEM_grow(&b,num+os->length))
308.   			{
309.   			c->error=ERR_R_BUF_LIB;

crypto/buffer/buffer.c:92:1: start of procedure BUF_MEM_grow()
  90.   	}
  91.   
  92. > int BUF_MEM_grow(BUF_MEM *str, int len)
  93.   	{
  94.   	char *ret;

crypto/buffer/buffer.c:97:6: Taking false branch
  95.   	unsigned int n;
  96.   
  97.   	if (str->length >= len)
              ^
  98.   		{
  99.   		str->length=len;

crypto/buffer/buffer.c:102:6: Taking false branch
  100.   		return(len);
  101.   		}
  102.   	if (str->max >= len)
              ^
  103.   		{
  104.   		memset(&(str->data[str->length]),0,len-str->length);

crypto/buffer/buffer.c:108:2: 
  106.   		return(len);
  107.   		}
  108. > 	n=(len+3)/3*4;
  109.   	if (str->data == NULL)
  110.   		ret=(char *)Malloc(n);

crypto/buffer/buffer.c:109:6: Taking false branch
  107.   		}
  108.   	n=(len+3)/3*4;
  109.   	if (str->data == NULL)
              ^
  110.   		ret=(char *)Malloc(n);
  111.   	else

crypto/buffer/buffer.c:112:3: 
  110.   		ret=(char *)Malloc(n);
  111.   	else
  112. > 		ret=(char *)Realloc(str->data,n);
  113.   	if (ret == NULL)
  114.   		{

crypto/buffer/buffer.c:113:6: Taking false branch
  111.   	else
  112.   		ret=(char *)Realloc(str->data,n);
  113.   	if (ret == NULL)
              ^
  114.   		{
  115.   		BUFerr(BUF_F_BUF_MEM_GROW,ERR_R_MALLOC_FAILURE);

crypto/buffer/buffer.c:120:3: 
  118.   	else
  119.   		{
  120. > 		str->data=ret;
  121.   		str->length=len;
  122.   		str->max=n;

crypto/buffer/buffer.c:121:3: 
  119.   		{
  120.   		str->data=ret;
  121. > 		str->length=len;
  122.   		str->max=n;
  123.   		}

crypto/buffer/buffer.c:122:3: 
  120.   		str->data=ret;
  121.   		str->length=len;
  122. > 		str->max=n;
  123.   		}
  124.   	return(len);

crypto/buffer/buffer.c:124:2: 
  122.   		str->max=n;
  123.   		}
  124. > 	return(len);
  125.   	}
  126.   

crypto/buffer/buffer.c:125:2: return from a call to BUF_MEM_grow
  123.   		}
  124.   	return(len);
  125.   	}
          ^
  126.   
  127.   char *BUF_strdup(const char *str)

static int asn1_collate_primative(ASN1_STRING *a, ASN1_CTX *c)
	{
	ASN1_STRING *os=NULL;
	BUF_MEM b;
	int num;
	b.length=0;
	b.max=0;
	b.data=NULL;
	if (a == NULL)
		{
		c->error=ERR_R_PASSED_NULL_PARAMETER;
		goto err;
		}
	num=0;
	for (;;)
		{
		if (c->inf & 1)
			{
			c->eos=ASN1_check_infinite_end(&c->p,
				(long)(c->max-c->p));
			if (c->eos) break;
			}
		else
			{
			if (c->slen <= 0) break;
			}
		c->q=c->p;
		if (d2i_ASN1_bytes(&os,&c->p,c->max-c->p,c->tag,c->xclass)
			== NULL)
			{
			c->error=ERR_R_ASN1_LIB;
			goto err;
			}
		if (!BUF_MEM_grow(&b,num+os->length))
			{
			c->error=ERR_R_BUF_LIB;
			goto err;
			}
		memcpy(&(b.data[num]),os->data,os->length);
		if (!(c->inf & 1))
			c->slen-=(c->p-c->q);
		num+=os->length;
		}
	if (!asn1_Finish(c)) goto err;
	a->length=num;
	if (a->data != NULL) Free(a->data);
	a->data=(unsigned char *)b.data;
	if (os != NULL) ASN1_STRING_free(os);
	return(1);
err:
	ASN1err(ASN1_F_ASN1_COLLATE_PRIMATIVE,c->error);
	if (os != NULL) ASN1_STRING_free(os);
	if (b.data != NULL) Free(b.data);
	return(0);
	}
['static int asn1_collate_primative(ASN1_STRING *a, ASN1_CTX *c)\n\t{\n\tASN1_STRING *os=NULL;\n\tBUF_MEM b;\n\tint num;\n\tb.length=0;\n\tb.max=0;\n\tb.data=NULL;\n\tif (a == NULL)\n\t\t{\n\t\tc->error=ERR_R_PASSED_NULL_PARAMETER;\n\t\tgoto err;\n\t\t}\n\tnum=0;\n\tfor (;;)\n\t\t{\n\t\tif (c->inf & 1)\n\t\t\t{\n\t\t\tc->eos=ASN1_check_infinite_end(&c->p,\n\t\t\t\t(long)(c->max-c->p));\n\t\t\tif (c->eos) break;\n\t\t\t}\n\t\telse\n\t\t\t{\n\t\t\tif (c->slen <= 0) break;\n\t\t\t}\n\t\tc->q=c->p;\n\t\tif (d2i_ASN1_bytes(&os,&c->p,c->max-c->p,c->tag,c->xclass)\n\t\t\t== NULL)\n\t\t\t{\n\t\t\tc->error=ERR_R_ASN1_LIB;\n\t\t\tgoto err;\n\t\t\t}\n\t\tif (!BUF_MEM_grow(&b,num+os->length))\n\t\t\t{\n\t\t\tc->error=ERR_R_BUF_LIB;\n\t\t\tgoto err;\n\t\t\t}\n\t\tmemcpy(&(b.data[num]),os->data,os->length);\n\t\tif (!(c->inf & 1))\n\t\t\tc->slen-=(c->p-c->q);\n\t\tnum+=os->length;\n\t\t}\n\tif (!asn1_Finish(c)) goto err;\n\ta->length=num;\n\tif (a->data != NULL) Free(a->data);\n\ta->data=(unsigned char *)b.data;\n\tif (os != NULL) ASN1_STRING_free(os);\n\treturn(1);\nerr:\n\tASN1err(ASN1_F_ASN1_COLLATE_PRIMATIVE,c->error);\n\tif (os != NULL) ASN1_STRING_free(os);\n\tif (b.data != NULL) Free(b.data);\n\treturn(0);\n\t}', 'int ASN1_check_infinite_end(unsigned char **p, long len)\n\t{\n\tif (len <= 0)\n\t\treturn(1);\n\telse if ((len >= 2) && ((*p)[0] == 0) && ((*p)[1] == 0))\n\t\t{\n\t\t(*p)+=2;\n\t\treturn(1);\n\t\t}\n\treturn(0);\n\t}', 'int BUF_MEM_grow(BUF_MEM *str, int len)\n\t{\n\tchar *ret;\n\tunsigned int n;\n\tif (str->length >= len)\n\t\t{\n\t\tstr->length=len;\n\t\treturn(len);\n\t\t}\n\tif (str->max >= len)\n\t\t{\n\t\tmemset(&(str->data[str->length]),0,len-str->length);\n\t\tstr->length=len;\n\t\treturn(len);\n\t\t}\n\tn=(len+3)/3*4;\n\tif (str->data == NULL)\n\t\tret=(char *)Malloc(n);\n\telse\n\t\tret=(char *)Realloc(str->data,n);\n\tif (ret == NULL)\n\t\t{\n\t\tBUFerr(BUF_F_BUF_MEM_GROW,ERR_R_MALLOC_FAILURE);\n\t\tlen=0;\n\t\t}\n\telse\n\t\t{\n\t\tstr->data=ret;\n\t\tstr->length=len;\n\t\tstr->max=n;\n\t\t}\n\treturn(len);\n\t}']