crypto/pem/pem_all.c:191: error: NULL_DEREFERENCE
  pointer `pktmp` last assigned on line 190 could be null and is dereferenced by call to `pkey_get_rsa()` at line 191, column 9.
Showing all 56 steps of the trace


crypto/pem/pem_all.c:186:1: start of procedure PEM_read_RSAPrivateKey()
184.   #ifndef OPENSSL_NO_FP_API
185.   
186. > RSA *PEM_read_RSAPrivateKey(FILE *fp, RSA **rsa, pem_password_cb *cb,
187.   								void *u)
188.   {

crypto/pem/pem_all.c:190:2: 
188.   {
189.   	EVP_PKEY *pktmp;
190. > 	pktmp = PEM_read_PrivateKey(fp, NULL, cb, u);
191.   	return pkey_get_rsa(pktmp, rsa);
192.   }

crypto/pem/pem_pkey.c:208:1: start of procedure PEM_read_PrivateKey()
  206.   
  207.   #ifndef OPENSSL_NO_FP_API
  208. > EVP_PKEY *PEM_read_PrivateKey(FILE *fp, EVP_PKEY **x, pem_password_cb *cb, void *u)
  209.   	{
  210.           BIO *b;

crypto/pem/pem_pkey.c:213:13: 
  211.           EVP_PKEY *ret;
  212.   
  213. >         if ((b=BIO_new(BIO_s_file())) == NULL)
  214.   		{
  215.   		PEMerr(PEM_F_PEM_READ_PRIVATEKEY,ERR_R_BUF_LIB);

crypto/bio/bss_file.c:153:1: start of procedure BIO_s_file()
    151.   	}
    152.   
    153. > BIO_METHOD *BIO_s_file(void)
    154.   	{
    155.   	return(&methods_filep);

crypto/bio/bss_file.c:155:2: 
    153.   BIO_METHOD *BIO_s_file(void)
    154.   	{
    155. > 	return(&methods_filep);
    156.   	}
    157.   

crypto/bio/bss_file.c:156:2: return from a call to BIO_s_file
    154.   	{
    155.   	return(&methods_filep);
    156.   	}
            ^
    157.   
    158.   static int MS_CALLBACK file_new(BIO *bi)

crypto/bio/bio_lib.c:66:1: start of procedure BIO_new()
    64.   #include <openssl/stack.h>
    65.   
    66. > BIO *BIO_new(BIO_METHOD *method)
    67.   	{
    68.   	BIO *ret=NULL;

crypto/bio/bio_lib.c:68:2: 
    66.   BIO *BIO_new(BIO_METHOD *method)
    67.   	{
    68. > 	BIO *ret=NULL;
    69.   
    70.   	ret=(BIO *)OPENSSL_malloc(sizeof(BIO));

crypto/bio/bio_lib.c:70:2: 
    68.   	BIO *ret=NULL;
    69.   
    70. > 	ret=(BIO *)OPENSSL_malloc(sizeof(BIO));
    71.   	if (ret == NULL)
    72.   		{

crypto/mem.c:291:1: start of procedure CRYPTO_malloc()
      289.   	}
      290.   
      291. > void *CRYPTO_malloc(int num, const char *file, int line)
      292.   	{
      293.   	void *ret = NULL;

crypto/mem.c:293:2: 
      291.   void *CRYPTO_malloc(int num, const char *file, int line)
      292.   	{
      293. > 	void *ret = NULL;
      294.   	extern unsigned char cleanse_ctr;
      295.   

crypto/mem.c:296:6: Taking false branch
      294.   	extern unsigned char cleanse_ctr;
      295.   
      296.   	if (num <= 0) return NULL;
                  ^
      297.   
      298.   	allow_customize = 0;

crypto/mem.c:298:2: 
      296.   	if (num <= 0) return NULL;
      297.   
      298. > 	allow_customize = 0;
      299.   	if (malloc_debug_func != NULL)
      300.   		{

crypto/mem.c:299:6: Taking true branch
      297.   
      298.   	allow_customize = 0;
      299.   	if (malloc_debug_func != NULL)
                  ^
      300.   		{
      301.   		allow_customize_debug = 0;

crypto/mem.c:301:3: 
      299.   	if (malloc_debug_func != NULL)
      300.   		{
      301. > 		allow_customize_debug = 0;
      302.   		malloc_debug_func(NULL, num, file, line, 0);
      303.   		}

crypto/mem.c:302:3: Skipping __function_pointer__(): unresolved function pointer
      300.   		{
      301.   		allow_customize_debug = 0;
      302.   		malloc_debug_func(NULL, num, file, line, 0);
               ^
      303.   		}
      304.   	ret = malloc_ex_func(num,file,line);

crypto/mem.c:304:2: Skipping __function_pointer__(): unresolved function pointer
      302.   		malloc_debug_func(NULL, num, file, line, 0);
      303.   		}
      304.   	ret = malloc_ex_func(num,file,line);
              ^
      305.   #ifdef LEVITTE_DEBUG_MEM
      306.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);

crypto/mem.c:308:6: Taking true branch
      306.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);
      307.   #endif
      308.   	if (malloc_debug_func != NULL)
                  ^
      309.   		malloc_debug_func(ret, num, file, line, 1);
      310.   

crypto/mem.c:309:3: Skipping __function_pointer__(): unresolved function pointer
      307.   #endif
      308.   	if (malloc_debug_func != NULL)
      309.   		malloc_debug_func(ret, num, file, line, 1);
               ^
      310.   
      311.           /* Create a dependency on the value of 'cleanse_ctr' so our memory

crypto/mem.c:314:12: Taking false branch
      312.            * sanitisation function can't be optimised out. NB: We only do
      313.            * this for >2Kb so the overhead doesn't bother us. */
      314.           if(ret && (num > 2048))
                        ^
      315.                   ((unsigned char *)ret)[0] = cleanse_ctr;
      316.   

crypto/mem.c:317:2: 
      315.                   ((unsigned char *)ret)[0] = cleanse_ctr;
      316.   
      317. > 	return ret;
      318.   	}
      319.   

crypto/mem.c:318:2: return from a call to CRYPTO_malloc
      316.   
      317.   	return ret;
      318.   	}
              ^
      319.   
      320.   void *CRYPTO_realloc(void *str, int num, const char *file, int line)

crypto/bio/bio_lib.c:71:6: Taking true branch
    69.   
    70.   	ret=(BIO *)OPENSSL_malloc(sizeof(BIO));
    71.   	if (ret == NULL)
               ^
    72.   		{
    73.   		BIOerr(BIO_F_BIO_NEW,ERR_R_MALLOC_FAILURE);

crypto/bio/bio_lib.c:73:3: 
    71.   	if (ret == NULL)
    72.   		{
    73. > 		BIOerr(BIO_F_BIO_NEW,ERR_R_MALLOC_FAILURE);
    74.   		return(NULL);
    75.   		}

crypto/err/err.c:679:1: start of procedure ERR_put_error()
      677.   /********************************************************/
      678.   
      679. > void ERR_put_error(int lib, int func, int reason, const char *file,
      680.   	     int line)
      681.   	{

crypto/err/err.c:703:2: Skipping ERR_get_state(): empty list of specs
      701.   	}
      702.   #endif
      703.   	es=ERR_get_state();
              ^
      704.   
      705.   	es->top=(es->top+1)%ERR_NUM_ERRORS;

crypto/err/err.c:705:2: 
      703.   	es=ERR_get_state();
      704.   
      705. > 	es->top=(es->top+1)%ERR_NUM_ERRORS;
      706.   	if (es->top == es->bottom)
      707.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;

crypto/err/err.c:706:6: Taking false branch
      704.   
      705.   	es->top=(es->top+1)%ERR_NUM_ERRORS;
      706.   	if (es->top == es->bottom)
                  ^
      707.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
      708.   	es->err_flags[es->top]=0;

crypto/err/err.c:708:2: 
      706.   	if (es->top == es->bottom)
      707.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
      708. > 	es->err_flags[es->top]=0;
      709.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
      710.   	es->err_file[es->top]=file;

crypto/err/err.c:709:2: 
      707.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
      708.   	es->err_flags[es->top]=0;
      709. > 	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
      710.   	es->err_file[es->top]=file;
      711.   	es->err_line[es->top]=line;

crypto/err/err.c:710:2: 
      708.   	es->err_flags[es->top]=0;
      709.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
      710. > 	es->err_file[es->top]=file;
      711.   	es->err_line[es->top]=line;
      712.   	err_clear_data(es,es->top);

crypto/err/err.c:711:2: 
      709.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
      710.   	es->err_file[es->top]=file;
      711. > 	es->err_line[es->top]=line;
      712.   	err_clear_data(es,es->top);
      713.   	}

crypto/err/err.c:712:2: Taking true branch
      710.   	es->err_file[es->top]=file;
      711.   	es->err_line[es->top]=line;
      712.   	err_clear_data(es,es->top);
              ^
      713.   	}
      714.   

crypto/err/err.c:712:2: Taking false branch
      710.   	es->err_file[es->top]=file;
      711.   	es->err_line[es->top]=line;
      712.   	err_clear_data(es,es->top);
              ^
      713.   	}
      714.   

crypto/err/err.c:712:2: Loop condition is false. Leaving loop
      710.   	es->err_file[es->top]=file;
      711.   	es->err_line[es->top]=line;
      712.   	err_clear_data(es,es->top);
              ^
      713.   	}
      714.   

crypto/err/err.c:713:2: return from a call to ERR_put_error
      711.   	es->err_line[es->top]=line;
      712.   	err_clear_data(es,es->top);
      713.   	}
              ^
      714.   
      715.   void ERR_clear_error(void)

crypto/bio/bio_lib.c:74:3: 
    72.   		{
    73.   		BIOerr(BIO_F_BIO_NEW,ERR_R_MALLOC_FAILURE);
    74. > 		return(NULL);
    75.   		}
    76.   	if (!BIO_set(ret,method))

crypto/bio/bio_lib.c:82:2: return from a call to BIO_new
    80.   		}
    81.   	return(ret);
    82.   	}
           ^
    83.   
    84.   int BIO_set(BIO *bio, BIO_METHOD *method)

crypto/pem/pem_pkey.c:213:13: Taking true branch
  211.           EVP_PKEY *ret;
  212.   
  213.           if ((b=BIO_new(BIO_s_file())) == NULL)
                     ^
  214.   		{
  215.   		PEMerr(PEM_F_PEM_READ_PRIVATEKEY,ERR_R_BUF_LIB);

crypto/pem/pem_pkey.c:215:3: 
  213.           if ((b=BIO_new(BIO_s_file())) == NULL)
  214.   		{
  215. > 		PEMerr(PEM_F_PEM_READ_PRIVATEKEY,ERR_R_BUF_LIB);
  216.                   return(0);
  217.   		}

crypto/err/err.c:679:1: start of procedure ERR_put_error()
    677.   /********************************************************/
    678.   
    679. > void ERR_put_error(int lib, int func, int reason, const char *file,
    680.   	     int line)
    681.   	{

crypto/err/err.c:703:2: Skipping ERR_get_state(): empty list of specs
    701.   	}
    702.   #endif
    703.   	es=ERR_get_state();
            ^
    704.   
    705.   	es->top=(es->top+1)%ERR_NUM_ERRORS;

crypto/err/err.c:705:2: 
    703.   	es=ERR_get_state();
    704.   
    705. > 	es->top=(es->top+1)%ERR_NUM_ERRORS;
    706.   	if (es->top == es->bottom)
    707.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;

crypto/err/err.c:706:6: Taking false branch
    704.   
    705.   	es->top=(es->top+1)%ERR_NUM_ERRORS;
    706.   	if (es->top == es->bottom)
                ^
    707.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
    708.   	es->err_flags[es->top]=0;

crypto/err/err.c:708:2: 
    706.   	if (es->top == es->bottom)
    707.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
    708. > 	es->err_flags[es->top]=0;
    709.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
    710.   	es->err_file[es->top]=file;

crypto/err/err.c:709:2: 
    707.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
    708.   	es->err_flags[es->top]=0;
    709. > 	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
    710.   	es->err_file[es->top]=file;
    711.   	es->err_line[es->top]=line;

crypto/err/err.c:710:2: 
    708.   	es->err_flags[es->top]=0;
    709.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
    710. > 	es->err_file[es->top]=file;
    711.   	es->err_line[es->top]=line;
    712.   	err_clear_data(es,es->top);

crypto/err/err.c:711:2: 
    709.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
    710.   	es->err_file[es->top]=file;
    711. > 	es->err_line[es->top]=line;
    712.   	err_clear_data(es,es->top);
    713.   	}

crypto/err/err.c:712:2: Taking true branch
    710.   	es->err_file[es->top]=file;
    711.   	es->err_line[es->top]=line;
    712.   	err_clear_data(es,es->top);
            ^
    713.   	}
    714.   

crypto/err/err.c:712:2: Taking false branch
    710.   	es->err_file[es->top]=file;
    711.   	es->err_line[es->top]=line;
    712.   	err_clear_data(es,es->top);
            ^
    713.   	}
    714.   

crypto/err/err.c:712:2: Loop condition is false. Leaving loop
    710.   	es->err_file[es->top]=file;
    711.   	es->err_line[es->top]=line;
    712.   	err_clear_data(es,es->top);
            ^
    713.   	}
    714.   

crypto/err/err.c:713:2: return from a call to ERR_put_error
    711.   	es->err_line[es->top]=line;
    712.   	err_clear_data(es,es->top);
    713.   	}
            ^
    714.   
    715.   void ERR_clear_error(void)

crypto/pem/pem_pkey.c:216:17: 
  214.   		{
  215.   		PEMerr(PEM_F_PEM_READ_PRIVATEKEY,ERR_R_BUF_LIB);
  216. >                 return(0);
  217.   		}
  218.           BIO_set_fp(b,fp,BIO_NOCLOSE);

crypto/pem/pem_pkey.c:222:2: return from a call to PEM_read_PrivateKey
  220.           BIO_free(b);
  221.           return(ret);
  222.   	}
          ^
  223.   
  224.   int PEM_write_PrivateKey(FILE *fp, EVP_PKEY *x, const EVP_CIPHER *enc,

crypto/pem/pem_all.c:191:2: 
189.   	EVP_PKEY *pktmp;
190.   	pktmp = PEM_read_PrivateKey(fp, NULL, cb, u);
191. > 	return pkey_get_rsa(pktmp, rsa);
192.   }
193.   

RSA *PEM_read_RSAPrivateKey(FILE *fp, RSA **rsa, pem_password_cb *cb,
								void *u)
{
	EVP_PKEY *pktmp;
	pktmp = PEM_read_PrivateKey(fp, NULL, cb, u);
	return pkey_get_rsa(pktmp, rsa);
}
['RSA *PEM_read_RSAPrivateKey(FILE *fp, RSA **rsa, pem_password_cb *cb,\n\t\t\t\t\t\t\t\tvoid *u)\n{\n\tEVP_PKEY *pktmp;\n\tpktmp = PEM_read_PrivateKey(fp, NULL, cb, u);\n\treturn pkey_get_rsa(pktmp, rsa);\n}', 'EVP_PKEY *PEM_read_PrivateKey(FILE *fp, EVP_PKEY **x, pem_password_cb *cb, void *u)\n\t{\n        BIO *b;\n        EVP_PKEY *ret;\n        if ((b=BIO_new(BIO_s_file())) == NULL)\n\t\t{\n\t\tPEMerr(PEM_F_PEM_READ_PRIVATEKEY,ERR_R_BUF_LIB);\n                return(0);\n\t\t}\n        BIO_set_fp(b,fp,BIO_NOCLOSE);\n        ret=PEM_read_bio_PrivateKey(b,x,cb,u);\n        BIO_free(b);\n        return(ret);\n\t}', 'BIO_METHOD *BIO_s_file(void)\n\t{\n\treturn(&methods_filep);\n\t}', 'BIO *BIO_new(BIO_METHOD *method)\n\t{\n\tBIO *ret=NULL;\n\tret=(BIO *)OPENSSL_malloc(sizeof(BIO));\n\tif (ret == NULL)\n\t\t{\n\t\tBIOerr(BIO_F_BIO_NEW,ERR_R_MALLOC_FAILURE);\n\t\treturn(NULL);\n\t\t}\n\tif (!BIO_set(ret,method))\n\t\t{\n\t\tOPENSSL_free(ret);\n\t\tret=NULL;\n\t\t}\n\treturn(ret);\n\t}', 'void *CRYPTO_malloc(int num, const char *file, int line)\n\t{\n\tvoid *ret = NULL;\n\textern unsigned char cleanse_ctr;\n\tif (num <= 0) return NULL;\n\tallow_customize = 0;\n\tif (malloc_debug_func != NULL)\n\t\t{\n\t\tallow_customize_debug = 0;\n\t\tmalloc_debug_func(NULL, num, file, line, 0);\n\t\t}\n\tret = malloc_ex_func(num,file,line);\n#ifdef LEVITTE_DEBUG_MEM\n\tfprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\\n", ret, num);\n#endif\n\tif (malloc_debug_func != NULL)\n\t\tmalloc_debug_func(ret, num, file, line, 1);\n        if(ret && (num > 2048))\n                ((unsigned char *)ret)[0] = cleanse_ctr;\n\treturn ret;\n\t}', 'void ERR_put_error(int lib, int func, int reason, const char *file,\n\t     int line)\n\t{\n\tERR_STATE *es;\n#ifdef _OSD_POSIX\n\tif (strncmp(file,"*POSIX(", sizeof("*POSIX(")-1) == 0) {\n\t\tchar *end;\n\t\tfile += sizeof("*POSIX(")-1;\n\t\tend = &file[strlen(file)-1];\n\t\tif (*end == \')\')\n\t\t\t*end = \'\\0\';\n\t\tif ((end = strrchr(file, \'/\')) != NULL)\n\t\t\tfile = &end[1];\n\t}\n#endif\n\tes=ERR_get_state();\n\tes->top=(es->top+1)%ERR_NUM_ERRORS;\n\tif (es->top == es->bottom)\n\t\tes->bottom=(es->bottom+1)%ERR_NUM_ERRORS;\n\tes->err_flags[es->top]=0;\n\tes->err_buffer[es->top]=ERR_PACK(lib,func,reason);\n\tes->err_file[es->top]=file;\n\tes->err_line[es->top]=line;\n\terr_clear_data(es,es->top);\n\t}']