crypto/ui/ui_lib.c:432: error: NULL_DEREFERENCE
  pointer `prompt` last assigned on line 431 could be null and is dereferenced by call to `strcpy()` at line 432, column 3.
Showing all 26 steps of the trace


crypto/ui/ui_lib.c:409:1: start of procedure UI_construct_prompt()
407.   	}
408.   
409. > char *UI_construct_prompt(UI *ui, const char *object_desc,
410.   	const char *object_name)
411.   	{

crypto/ui/ui_lib.c:412:2: 
410.   	const char *object_name)
411.   	{
412. > 	char *prompt = NULL;
413.   
414.   	if (ui->meth->ui_construct_prompt)

crypto/ui/ui_lib.c:414:6: Taking false branch
412.   	char *prompt = NULL;
413.   
414.   	if (ui->meth->ui_construct_prompt)
            ^
415.   		prompt = ui->meth->ui_construct_prompt(ui,
416.   			object_desc, object_name);

crypto/ui/ui_lib.c:419:3: 
417.   	else
418.   		{
419. > 		char prompt1[] = "Enter ";
420.   		char prompt2[] = " for ";
421.   		char prompt3[] = ":";

crypto/ui/ui_lib.c:420:3: 
418.   		{
419.   		char prompt1[] = "Enter ";
420. > 		char prompt2[] = " for ";
421.   		char prompt3[] = ":";
422.   		int len = 0;

crypto/ui/ui_lib.c:421:3: 
419.   		char prompt1[] = "Enter ";
420.   		char prompt2[] = " for ";
421. > 		char prompt3[] = ":";
422.   		int len = 0;
423.   

crypto/ui/ui_lib.c:422:3: 
420.   		char prompt2[] = " for ";
421.   		char prompt3[] = ":";
422. > 		int len = 0;
423.   
424.   		if (object_desc == NULL)

crypto/ui/ui_lib.c:424:7: Taking false branch
422.   		int len = 0;
423.   
424.   		if (object_desc == NULL)
             ^
425.   			return NULL;
426.   		len = sizeof(prompt1) - 1 + strlen(object_desc);

crypto/ui/ui_lib.c:426:3: 
424.   		if (object_desc == NULL)
425.   			return NULL;
426. > 		len = sizeof(prompt1) - 1 + strlen(object_desc);
427.   		if (object_name)
428.   			len += sizeof(prompt2) - 1 + strlen(object_name);

crypto/ui/ui_lib.c:427:7: Taking true branch
425.   			return NULL;
426.   		len = sizeof(prompt1) - 1 + strlen(object_desc);
427.   		if (object_name)
             ^
428.   			len += sizeof(prompt2) - 1 + strlen(object_name);
429.   		len += sizeof(prompt3) - 1;

crypto/ui/ui_lib.c:428:4: 
426.   		len = sizeof(prompt1) - 1 + strlen(object_desc);
427.   		if (object_name)
428. > 			len += sizeof(prompt2) - 1 + strlen(object_name);
429.   		len += sizeof(prompt3) - 1;
430.   

crypto/ui/ui_lib.c:429:3: 
427.   		if (object_name)
428.   			len += sizeof(prompt2) - 1 + strlen(object_name);
429. > 		len += sizeof(prompt3) - 1;
430.   
431.   		prompt = (char *)OPENSSL_malloc(len + 1);

crypto/ui/ui_lib.c:431:3: 
429.   		len += sizeof(prompt3) - 1;
430.   
431. > 		prompt = (char *)OPENSSL_malloc(len + 1);
432.   		strcpy(prompt, prompt1);
433.   		strcat(prompt, object_desc);

crypto/mem.c:289:1: start of procedure CRYPTO_malloc()
  287.   	}
  288.   
  289. > void *CRYPTO_malloc(int num, const char *file, int line)
  290.   	{
  291.   	void *ret = NULL;

crypto/mem.c:291:2: 
  289.   void *CRYPTO_malloc(int num, const char *file, int line)
  290.   	{
  291. > 	void *ret = NULL;
  292.   	extern unsigned char cleanse_ctr;
  293.   

crypto/mem.c:294:2: 
  292.   	extern unsigned char cleanse_ctr;
  293.   
  294. > 	allow_customize = 0;
  295.   	if (malloc_debug_func != NULL)
  296.   		{

crypto/mem.c:295:6: Taking true branch
  293.   
  294.   	allow_customize = 0;
  295.   	if (malloc_debug_func != NULL)
              ^
  296.   		{
  297.   		allow_customize_debug = 0;

crypto/mem.c:297:3: 
  295.   	if (malloc_debug_func != NULL)
  296.   		{
  297. > 		allow_customize_debug = 0;
  298.   		malloc_debug_func(NULL, num, file, line, 0);
  299.   		}

crypto/mem.c:298:3: Skipping __function_pointer__(): unresolved function pointer
  296.   		{
  297.   		allow_customize_debug = 0;
  298.   		malloc_debug_func(NULL, num, file, line, 0);
           ^
  299.   		}
  300.   	ret = malloc_ex_func(num,file,line);

crypto/mem.c:300:2: Skipping __function_pointer__(): unresolved function pointer
  298.   		malloc_debug_func(NULL, num, file, line, 0);
  299.   		}
  300.   	ret = malloc_ex_func(num,file,line);
          ^
  301.   #ifdef LEVITTE_DEBUG_MEM
  302.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);

crypto/mem.c:304:6: Taking true branch
  302.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);
  303.   #endif
  304.   	if (malloc_debug_func != NULL)
              ^
  305.   		malloc_debug_func(ret, num, file, line, 1);
  306.   

crypto/mem.c:305:3: Skipping __function_pointer__(): unresolved function pointer
  303.   #endif
  304.   	if (malloc_debug_func != NULL)
  305.   		malloc_debug_func(ret, num, file, line, 1);
           ^
  306.   
  307.           /* Create a dependency on the value of 'cleanse_ctr' so our memory

crypto/mem.c:310:12: Taking false branch
  308.            * sanitisation function can't be optimised out. NB: We only do
  309.            * this for >2Kb so the overhead doesn't bother us. */
  310.           if(ret && (num > 2048))
                    ^
  311.                   ((unsigned char *)ret)[0] = cleanse_ctr;
  312.   

crypto/mem.c:313:2: 
  311.                   ((unsigned char *)ret)[0] = cleanse_ctr;
  312.   
  313. > 	return ret;
  314.   	}
  315.   

crypto/mem.c:314:2: return from a call to CRYPTO_malloc
  312.   
  313.   	return ret;
  314.   	}
          ^
  315.   
  316.   void *CRYPTO_realloc(void *str, int num, const char *file, int line)

crypto/ui/ui_lib.c:432:3: 
430.   
431.   		prompt = (char *)OPENSSL_malloc(len + 1);
432. > 		strcpy(prompt, prompt1);
433.   		strcat(prompt, object_desc);
434.   		if (object_name)

char *UI_construct_prompt(UI *ui, const char *object_desc,
	const char *object_name)
	{
	char *prompt = NULL;
	if (ui->meth->ui_construct_prompt)
		prompt = ui->meth->ui_construct_prompt(ui,
			object_desc, object_name);
	else
		{
		char prompt1[] = "Enter ";
		char prompt2[] = " for ";
		char prompt3[] = ":";
		int len = 0;
		if (object_desc == NULL)
			return NULL;
		len = sizeof(prompt1) - 1 + strlen(object_desc);
		if (object_name)
			len += sizeof(prompt2) - 1 + strlen(object_name);
		len += sizeof(prompt3) - 1;
		prompt = (char *)OPENSSL_malloc(len + 1);
		strcpy(prompt, prompt1);
		strcat(prompt, object_desc);
		if (object_name)
			{
			strcat(prompt, prompt2);
			strcat(prompt, object_name);
			}
		strcat(prompt, prompt3);
		}
	return prompt;
	}
['char *UI_construct_prompt(UI *ui, const char *object_desc,\n\tconst char *object_name)\n\t{\n\tchar *prompt = NULL;\n\tif (ui->meth->ui_construct_prompt)\n\t\tprompt = ui->meth->ui_construct_prompt(ui,\n\t\t\tobject_desc, object_name);\n\telse\n\t\t{\n\t\tchar prompt1[] = "Enter ";\n\t\tchar prompt2[] = " for ";\n\t\tchar prompt3[] = ":";\n\t\tint len = 0;\n\t\tif (object_desc == NULL)\n\t\t\treturn NULL;\n\t\tlen = sizeof(prompt1) - 1 + strlen(object_desc);\n\t\tif (object_name)\n\t\t\tlen += sizeof(prompt2) - 1 + strlen(object_name);\n\t\tlen += sizeof(prompt3) - 1;\n\t\tprompt = (char *)OPENSSL_malloc(len + 1);\n\t\tstrcpy(prompt, prompt1);\n\t\tstrcat(prompt, object_desc);\n\t\tif (object_name)\n\t\t\t{\n\t\t\tstrcat(prompt, prompt2);\n\t\t\tstrcat(prompt, object_name);\n\t\t\t}\n\t\tstrcat(prompt, prompt3);\n\t\t}\n\treturn prompt;\n\t}', 'void *CRYPTO_malloc(int num, const char *file, int line)\n\t{\n\tvoid *ret = NULL;\n\textern unsigned char cleanse_ctr;\n\tallow_customize = 0;\n\tif (malloc_debug_func != NULL)\n\t\t{\n\t\tallow_customize_debug = 0;\n\t\tmalloc_debug_func(NULL, num, file, line, 0);\n\t\t}\n\tret = malloc_ex_func(num,file,line);\n#ifdef LEVITTE_DEBUG_MEM\n\tfprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\\n", ret, num);\n#endif\n\tif (malloc_debug_func != NULL)\n\t\tmalloc_debug_func(ret, num, file, line, 1);\n        if(ret && (num > 2048))\n                ((unsigned char *)ret)[0] = cleanse_ctr;\n\treturn ret;\n\t}']