apps/apps.c:1545: error: NULL_DEREFERENCE
  pointer `p` last assigned on line 1542 could be null and is dereferenced by call to `BUF_strlcat()` at line 1545, column 2.
Showing all 26 steps of the trace


apps/apps.c:1535:1: start of procedure make_config_name()
1533.   	}
1534.   
1535. > char *make_config_name()
1536.   	{
1537.   	const char *t=X509_get_default_cert_area();

apps/apps.c:1537:2: 
1535.   char *make_config_name()
1536.   	{
1537. > 	const char *t=X509_get_default_cert_area();
1538.   	size_t len;
1539.   	char *p;

crypto/x509/x509_def.c:67:1: start of procedure X509_get_default_cert_area()
  65.   	{ return(X509_PRIVATE_DIR); }
  66.   	
  67. > const char *X509_get_default_cert_area(void)
  68.   	{ return(X509_CERT_AREA); }
  69.   

crypto/x509/x509_def.c:68:4: 
  66.   	
  67.   const char *X509_get_default_cert_area(void)
  68. > 	{ return(X509_CERT_AREA); }
  69.   
  70.   const char *X509_get_default_cert_dir(void)

crypto/x509/x509_def.c:68:28: return from a call to X509_get_default_cert_area
  66.   	
  67.   const char *X509_get_default_cert_area(void)
  68.   	{ return(X509_CERT_AREA); }
                                   ^
  69.   
  70.   const char *X509_get_default_cert_dir(void)

apps/apps.c:1541:2: 
1539.   	char *p;
1540.   
1541. > 	len=strlen(t)+strlen(OPENSSL_CONF)+2;
1542.   	p=OPENSSL_malloc(len);
1543.   	BUF_strlcpy(p,t,len);

apps/apps.c:1542:2: 
1540.   
1541.   	len=strlen(t)+strlen(OPENSSL_CONF)+2;
1542. > 	p=OPENSSL_malloc(len);
1543.   	BUF_strlcpy(p,t,len);
1544.   #ifndef OPENSSL_SYS_VMS

crypto/mem.c:294:1: start of procedure CRYPTO_malloc()
  292.   	}
  293.   
  294. > void *CRYPTO_malloc(int num, const char *file, int line)
  295.   	{
  296.   	void *ret = NULL;

crypto/mem.c:296:2: 
  294.   void *CRYPTO_malloc(int num, const char *file, int line)
  295.   	{
  296. > 	void *ret = NULL;
  297.   
  298.   	if (num <= 0) return NULL;

crypto/mem.c:298:6: Taking false branch
  296.   	void *ret = NULL;
  297.   
  298.   	if (num <= 0) return NULL;
              ^
  299.   
  300.   	allow_customize = 0;

crypto/mem.c:300:2: 
  298.   	if (num <= 0) return NULL;
  299.   
  300. > 	allow_customize = 0;
  301.   	if (malloc_debug_func != NULL)
  302.   		{

crypto/mem.c:301:6: Taking true branch
  299.   
  300.   	allow_customize = 0;
  301.   	if (malloc_debug_func != NULL)
              ^
  302.   		{
  303.   		allow_customize_debug = 0;

crypto/mem.c:303:3: 
  301.   	if (malloc_debug_func != NULL)
  302.   		{
  303. > 		allow_customize_debug = 0;
  304.   		malloc_debug_func(NULL, num, file, line, 0);
  305.   		}

crypto/mem.c:304:3: Skipping __function_pointer__(): unresolved function pointer
  302.   		{
  303.   		allow_customize_debug = 0;
  304.   		malloc_debug_func(NULL, num, file, line, 0);
           ^
  305.   		}
  306.   	ret = malloc_ex_func(num,file,line);

crypto/mem.c:306:2: Skipping __function_pointer__(): unresolved function pointer
  304.   		malloc_debug_func(NULL, num, file, line, 0);
  305.   		}
  306.   	ret = malloc_ex_func(num,file,line);
          ^
  307.   #ifdef LEVITTE_DEBUG_MEM
  308.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);

crypto/mem.c:310:6: Taking true branch
  308.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);
  309.   #endif
  310.   	if (malloc_debug_func != NULL)
              ^
  311.   		malloc_debug_func(ret, num, file, line, 1);
  312.   

crypto/mem.c:311:3: Skipping __function_pointer__(): unresolved function pointer
  309.   #endif
  310.   	if (malloc_debug_func != NULL)
  311.   		malloc_debug_func(ret, num, file, line, 1);
           ^
  312.   
  313.   #ifndef OPENSSL_CPUID_OBJ

crypto/mem.c:317:12: Taking false branch
  315.            * sanitisation function can't be optimised out. NB: We only do
  316.            * this for >2Kb so the overhead doesn't bother us. */
  317.           if(ret && (num > 2048))
                    ^
  318.   	{	extern unsigned char cleanse_ctr;
  319.                   ((unsigned char *)ret)[0] = cleanse_ctr;

crypto/mem.c:323:2: 
  321.   #endif
  322.   
  323. > 	return ret;
  324.   	}
  325.   char *CRYPTO_strdup(const char *str, const char *file, int line)

crypto/mem.c:324:2: return from a call to CRYPTO_malloc
  322.   
  323.   	return ret;
  324.   	}
          ^
  325.   char *CRYPTO_strdup(const char *str, const char *file, int line)
  326.   	{

apps/apps.c:1543:2: Skipping BUF_strlcpy(): empty list of specs
1541.   	len=strlen(t)+strlen(OPENSSL_CONF)+2;
1542.   	p=OPENSSL_malloc(len);
1543.   	BUF_strlcpy(p,t,len);
         ^
1544.   #ifndef OPENSSL_SYS_VMS
1545.   	BUF_strlcat(p,"/",len);

apps/apps.c:1545:2: 
1543.   	BUF_strlcpy(p,t,len);
1544.   #ifndef OPENSSL_SYS_VMS
1545. > 	BUF_strlcat(p,"/",len);
1546.   #endif
1547.   	BUF_strlcat(p,OPENSSL_CONF,len);

crypto/buffer/buf_str.c:115:1: start of procedure BUF_strlcat()
  113.   	}
  114.   
  115. > size_t BUF_strlcat(char *dst, const char *src, size_t size)
  116.   	{
  117.   	size_t l = 0;

crypto/buffer/buf_str.c:117:2: 
  115.   size_t BUF_strlcat(char *dst, const char *src, size_t size)
  116.   	{
  117. > 	size_t l = 0;
  118.   	for(; size > 0 && *dst; size--, dst++)
  119.   		l++;

crypto/buffer/buf_str.c:118:8: Loop condition is true. Entering loop body
  116.   	{
  117.   	size_t l = 0;
  118.   	for(; size > 0 && *dst; size--, dst++)
                ^
  119.   		l++;
  120.   	return l + BUF_strlcpy(dst, src, size);

crypto/buffer/buf_str.c:118:20: Loop condition is false. Leaving loop
  116.   	{
  117.   	size_t l = 0;
  118.   	for(; size > 0 && *dst; size--, dst++)
                            ^
  119.   		l++;
  120.   	return l + BUF_strlcpy(dst, src, size);

char *make_config_name()
	{
	const char *t=X509_get_default_cert_area();
	size_t len;
	char *p;
	len=strlen(t)+strlen(OPENSSL_CONF)+2;
	p=OPENSSL_malloc(len);
	BUF_strlcpy(p,t,len);
#ifndef OPENSSL_SYS_VMS
	BUF_strlcat(p,"/",len);
#endif
	BUF_strlcat(p,OPENSSL_CONF,len);
	return p;
	}
['char *make_config_name()\n\t{\n\tconst char *t=X509_get_default_cert_area();\n\tsize_t len;\n\tchar *p;\n\tlen=strlen(t)+strlen(OPENSSL_CONF)+2;\n\tp=OPENSSL_malloc(len);\n\tBUF_strlcpy(p,t,len);\n#ifndef OPENSSL_SYS_VMS\n\tBUF_strlcat(p,"/",len);\n#endif\n\tBUF_strlcat(p,OPENSSL_CONF,len);\n\treturn p;\n\t}', 'const char *X509_get_default_cert_area(void)\n\t{ return(X509_CERT_AREA); }', 'void *CRYPTO_malloc(int num, const char *file, int line)\n\t{\n\tvoid *ret = NULL;\n\tif (num <= 0) return NULL;\n\tallow_customize = 0;\n\tif (malloc_debug_func != NULL)\n\t\t{\n\t\tallow_customize_debug = 0;\n\t\tmalloc_debug_func(NULL, num, file, line, 0);\n\t\t}\n\tret = malloc_ex_func(num,file,line);\n#ifdef LEVITTE_DEBUG_MEM\n\tfprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\\n", ret, num);\n#endif\n\tif (malloc_debug_func != NULL)\n\t\tmalloc_debug_func(ret, num, file, line, 1);\n#ifndef OPENSSL_CPUID_OBJ\n        if(ret && (num > 2048))\n\t{\textern unsigned char cleanse_ctr;\n                ((unsigned char *)ret)[0] = cleanse_ctr;\n\t}\n#endif\n\treturn ret;\n\t}', 'size_t BUF_strlcat(char *dst, const char *src, size_t size)\n\t{\n\tsize_t l = 0;\n\tfor(; size > 0 && *dst; size--, dst++)\n\t\tl++;\n\treturn l + BUF_strlcpy(dst, src, size);\n\t}']