src/os/unix/ngx_readv_chain.c:96: error: Null Dereference
  pointer `iov` last assigned on line 71 could be null and is dereferenced at line 96, column 13.

src/os/unix/ngx_readv_chain.c:13:1: start of procedure ngx_readv_chain()
11. 
12. 
13. ssize_t
    ^
14. ngx_readv_chain(ngx_connection_t *c, ngx_chain_t *chain, off_t limit)
15. {

src/os/unix/ngx_readv_chain.c:23:5: 
21.     struct iovec  *iov, iovs[NGX_IOVS_PREALLOCATE];
22. 
23.     rev = c->read;
        ^
24. 
25. #if (NGX_HAVE_KQUEUE)

src/os/unix/ngx_readv_chain.c:58:9: Taking true branch
56. #if (NGX_HAVE_EPOLLRDHUP)
57. 
58.     if (ngx_event_flags & NGX_USE_EPOLL_EVENT) {
            ^
59.         ngx_log_debug2(NGX_LOG_DEBUG_EVENT, c->log, 0,
60.                        "readv: eof:%d, avail:%d",

src/os/unix/ngx_readv_chain.c:63:14: Taking false branch
61.                        rev->pending_eof, rev->available);
62. 
63.         if (!rev->available && !rev->pending_eof) {
                 ^
64.             return NGX_AGAIN;
65.         }

src/os/unix/ngx_readv_chain.c:70:5: 
68. #endif
69. 
70.     prev = NULL;
        ^
71.     iov = NULL;
72.     size = 0;

src/os/unix/ngx_readv_chain.c:71:5: 
69. 
70.     prev = NULL;
71.     iov = NULL;
        ^
72.     size = 0;
73. 

src/os/unix/ngx_readv_chain.c:72:5: 
70.     prev = NULL;
71.     iov = NULL;
72.     size = 0;
        ^
73. 
74.     vec.elts = iovs;

src/os/unix/ngx_readv_chain.c:74:5: 
72.     size = 0;
73. 
74.     vec.elts = iovs;
        ^
75.     vec.nelts = 0;
76.     vec.size = sizeof(struct iovec);

src/os/unix/ngx_readv_chain.c:75:5: 
73. 
74.     vec.elts = iovs;
75.     vec.nelts = 0;
        ^
76.     vec.size = sizeof(struct iovec);
77.     vec.nalloc = NGX_IOVS_PREALLOCATE;

src/os/unix/ngx_readv_chain.c:76:5: 
74.     vec.elts = iovs;
75.     vec.nelts = 0;
76.     vec.size = sizeof(struct iovec);
        ^
77.     vec.nalloc = NGX_IOVS_PREALLOCATE;
78.     vec.pool = c->pool;

src/os/unix/ngx_readv_chain.c:77:5: 
75.     vec.nelts = 0;
76.     vec.size = sizeof(struct iovec);
77.     vec.nalloc = NGX_IOVS_PREALLOCATE;
        ^
78.     vec.pool = c->pool;
79. 

src/os/unix/ngx_readv_chain.c:78:5: 
76.     vec.size = sizeof(struct iovec);
77.     vec.nalloc = NGX_IOVS_PREALLOCATE;
78.     vec.pool = c->pool;
        ^
79. 
80.     /* coalesce the neighbouring bufs */

src/os/unix/ngx_readv_chain.c:82:12: Loop condition is true. Entering loop body
80.     /* coalesce the neighbouring bufs */
81. 
82.     while (chain) {
               ^
83.         n = chain->buf->end - chain->buf->last;
84. 

src/os/unix/ngx_readv_chain.c:83:9: 
81. 
82.     while (chain) {
83.         n = chain->buf->end - chain->buf->last;
            ^
84. 
85.         if (limit) {

src/os/unix/ngx_readv_chain.c:85:13: Taking true branch
83.         n = chain->buf->end - chain->buf->last;
84. 
85.         if (limit) {
                ^
86.             if (size >= limit) {
87.                 break;

src/os/unix/ngx_readv_chain.c:86:17: Taking false branch
84. 
85.         if (limit) {
86.             if (size >= limit) {
                    ^
87.                 break;
88.             }

src/os/unix/ngx_readv_chain.c:90:17: Taking false branch
88.             }
89. 
90.             if (size + n > limit) {
                    ^
91.                 n = (ssize_t) (limit - size);
92.             }

src/os/unix/ngx_readv_chain.c:95:13: Taking true branch
93.         }
94. 
95.         if (prev == chain->buf->last) {
                ^
96.             iov->iov_len += n;
97. 

src/os/unix/ngx_readv_chain.c:96:13: 
94. 
95.         if (prev == chain->buf->last) {
96.             iov->iov_len += n;
                ^
97. 
98.         } else {

ssize_t
ngx_readv_chain(ngx_connection_t *c, ngx_chain_t *chain, off_t limit)
{
    u_char        *prev;
    ssize_t        n, size;
    ngx_err_t      err;
    ngx_array_t    vec;
    ngx_event_t   *rev;
    struct iovec  *iov, iovs[NGX_IOVS_PREALLOCATE];
    rev = c->read;
#if (NGX_HAVE_KQUEUE)
    if (ngx_event_flags & NGX_USE_KQUEUE_EVENT) {
        ngx_log_debug3(NGX_LOG_DEBUG_EVENT, c->log, 0,
                       "readv: eof:%d, avail:%d, err:%d",
                       rev->pending_eof, rev->available, rev->kq_errno);
        if (rev->available == 0) {
            if (rev->pending_eof) {
                rev->ready = 0;
                rev->eof = 1;
                ngx_log_error(NGX_LOG_INFO, c->log, rev->kq_errno,
                              "kevent() reported about an closed connection");
                if (rev->kq_errno) {
                    rev->error = 1;
                    ngx_set_socket_errno(rev->kq_errno);
                    return NGX_ERROR;
                }
                return 0;
            } else {
                return NGX_AGAIN;
            }
        }
    }
#endif
#if (NGX_HAVE_EPOLLRDHUP)
    if (ngx_event_flags & NGX_USE_EPOLL_EVENT) {
        ngx_log_debug2(NGX_LOG_DEBUG_EVENT, c->log, 0,
                       "readv: eof:%d, avail:%d",
                       rev->pending_eof, rev->available);
        if (!rev->available && !rev->pending_eof) {
            return NGX_AGAIN;
        }
    }
#endif
    prev = NULL;
    iov = NULL;
    size = 0;
    vec.elts = iovs;
    vec.nelts = 0;
    vec.size = sizeof(struct iovec);
    vec.nalloc = NGX_IOVS_PREALLOCATE;
    vec.pool = c->pool;
    while (chain) {
        n = chain->buf->end - chain->buf->last;
        if (limit) {
            if (size >= limit) {
                break;
            }
            if (size + n > limit) {
                n = (ssize_t) (limit - size);
            }
        }
        if (prev == chain->buf->last) {
            iov->iov_len += n;
        } else {
            if (vec.nelts >= IOV_MAX) {
                break;
            }
            iov = ngx_array_push(&vec);
            if (iov == NULL) {
                return NGX_ERROR;
            }
            iov->iov_base = (void *) chain->buf->last;
            iov->iov_len = n;
        }
        size += n;
        prev = chain->buf->end;
        chain = chain->next;
    }
    ngx_log_debug2(NGX_LOG_DEBUG_EVENT, c->log, 0,
                   "readv: %ui, last:%uz", vec.nelts, iov->iov_len);
    do {
        n = readv(c->fd, (struct iovec *) vec.elts, vec.nelts);
        if (n == 0) {
            rev->ready = 0;
            rev->eof = 1;
#if (NGX_HAVE_KQUEUE)
            if (ngx_event_flags & NGX_USE_KQUEUE_EVENT) {
                rev->available = 0;
            }
#endif
            return 0;
        }
        if (n > 0) {
#if (NGX_HAVE_KQUEUE)
            if (ngx_event_flags & NGX_USE_KQUEUE_EVENT) {
                rev->available -= n;
                if (rev->available <= 0) {
                    if (!rev->pending_eof) {
                        rev->ready = 0;
                    }
                    rev->available = 0;
                }
                return n;
            }
#endif
#if (NGX_HAVE_EPOLLRDHUP)
            if ((ngx_event_flags & NGX_USE_EPOLL_EVENT)
                && ngx_use_epoll_rdhup)
            {
                if (n < size) {
                    if (!rev->pending_eof) {
                        rev->ready = 0;
                    }
                    rev->available = 0;
                }
                return n;
            }
#endif
            if (n < size && !(ngx_event_flags & NGX_USE_GREEDY_EVENT)) {
                rev->ready = 0;
            }
            return n;
        }
        err = ngx_socket_errno;
        if (err == NGX_EAGAIN || err == NGX_EINTR) {
            ngx_log_debug0(NGX_LOG_DEBUG_EVENT, c->log, err,
                           "readv() not ready");
            n = NGX_AGAIN;
        } else {
            n = ngx_connection_error(c, err, "readv() failed");
            break;
        }
    } while (err == NGX_EINTR);
    rev->ready = 0;
    if (n == NGX_ERROR) {
        c->read->error = 1;
    }
    return n;
}
['ssize_t\nngx_readv_chain(ngx_connection_t *c, ngx_chain_t *chain, off_t limit)\n{\n    u_char        *prev;\n    ssize_t        n, size;\n    ngx_err_t      err;\n    ngx_array_t    vec;\n    ngx_event_t   *rev;\n    struct iovec  *iov, iovs[NGX_IOVS_PREALLOCATE];\n    rev = c->read;\n#if (NGX_HAVE_KQUEUE)\n    if (ngx_event_flags & NGX_USE_KQUEUE_EVENT) {\n        ngx_log_debug3(NGX_LOG_DEBUG_EVENT, c->log, 0,\n                       "readv: eof:%d, avail:%d, err:%d",\n                       rev->pending_eof, rev->available, rev->kq_errno);\n        if (rev->available == 0) {\n            if (rev->pending_eof) {\n                rev->ready = 0;\n                rev->eof = 1;\n                ngx_log_error(NGX_LOG_INFO, c->log, rev->kq_errno,\n                              "kevent() reported about an closed connection");\n                if (rev->kq_errno) {\n                    rev->error = 1;\n                    ngx_set_socket_errno(rev->kq_errno);\n                    return NGX_ERROR;\n                }\n                return 0;\n            } else {\n                return NGX_AGAIN;\n            }\n        }\n    }\n#endif\n#if (NGX_HAVE_EPOLLRDHUP)\n    if (ngx_event_flags & NGX_USE_EPOLL_EVENT) {\n        ngx_log_debug2(NGX_LOG_DEBUG_EVENT, c->log, 0,\n                       "readv: eof:%d, avail:%d",\n                       rev->pending_eof, rev->available);\n        if (!rev->available && !rev->pending_eof) {\n            return NGX_AGAIN;\n        }\n    }\n#endif\n    prev = NULL;\n    iov = NULL;\n    size = 0;\n    vec.elts = iovs;\n    vec.nelts = 0;\n    vec.size = sizeof(struct iovec);\n    vec.nalloc = NGX_IOVS_PREALLOCATE;\n    vec.pool = c->pool;\n    while (chain) {\n        n = chain->buf->end - chain->buf->last;\n        if (limit) {\n            if (size >= limit) {\n                break;\n            }\n            if (size + n > limit) {\n                n = (ssize_t) (limit - size);\n            }\n        }\n        if (prev == chain->buf->last) {\n            iov->iov_len += n;\n        } else {\n            if (vec.nelts >= IOV_MAX) {\n                break;\n            }\n            iov = ngx_array_push(&vec);\n            if (iov == NULL) {\n                return NGX_ERROR;\n            }\n            iov->iov_base = (void *) chain->buf->last;\n            iov->iov_len = n;\n        }\n        size += n;\n        prev = chain->buf->end;\n        chain = chain->next;\n    }\n    ngx_log_debug2(NGX_LOG_DEBUG_EVENT, c->log, 0,\n                   "readv: %ui, last:%uz", vec.nelts, iov->iov_len);\n    do {\n        n = readv(c->fd, (struct iovec *) vec.elts, vec.nelts);\n        if (n == 0) {\n            rev->ready = 0;\n            rev->eof = 1;\n#if (NGX_HAVE_KQUEUE)\n            if (ngx_event_flags & NGX_USE_KQUEUE_EVENT) {\n                rev->available = 0;\n            }\n#endif\n            return 0;\n        }\n        if (n > 0) {\n#if (NGX_HAVE_KQUEUE)\n            if (ngx_event_flags & NGX_USE_KQUEUE_EVENT) {\n                rev->available -= n;\n                if (rev->available <= 0) {\n                    if (!rev->pending_eof) {\n                        rev->ready = 0;\n                    }\n                    rev->available = 0;\n                }\n                return n;\n            }\n#endif\n#if (NGX_HAVE_EPOLLRDHUP)\n            if ((ngx_event_flags & NGX_USE_EPOLL_EVENT)\n                && ngx_use_epoll_rdhup)\n            {\n                if (n < size) {\n                    if (!rev->pending_eof) {\n                        rev->ready = 0;\n                    }\n                    rev->available = 0;\n                }\n                return n;\n            }\n#endif\n            if (n < size && !(ngx_event_flags & NGX_USE_GREEDY_EVENT)) {\n                rev->ready = 0;\n            }\n            return n;\n        }\n        err = ngx_socket_errno;\n        if (err == NGX_EAGAIN || err == NGX_EINTR) {\n            ngx_log_debug0(NGX_LOG_DEBUG_EVENT, c->log, err,\n                           "readv() not ready");\n            n = NGX_AGAIN;\n        } else {\n            n = ngx_connection_error(c, err, "readv() failed");\n            break;\n        }\n    } while (err == NGX_EINTR);\n    rev->ready = 0;\n    if (n == NGX_ERROR) {\n        c->read->error = 1;\n    }\n    return n;\n}']