crypto/ts/ts_rsp_verify.c:572: error: NULL_DEREFERENCE
  pointer `md_ctx` last assigned on line 533 could be null and is dereferenced by call to `EVP_MD_CTX_free()` at line 572, column 5.
Showing all 17 steps of the trace


crypto/ts/ts_rsp_verify.c:526:1: start of procedure ts_compute_imprint()
524.   }
525.   
526. > static int ts_compute_imprint(BIO *data, TS_TST_INFO *tst_info,
527.                                 X509_ALGOR **md_alg,
528.                                 unsigned char **imprint, unsigned *imprint_len)

crypto/ts/ts_rsp_verify.c:530:5: 
528.                                 unsigned char **imprint, unsigned *imprint_len)
529.   {
530. >     TS_MSG_IMPRINT *msg_imprint = tst_info->msg_imprint;
531.       X509_ALGOR *md_alg_resp = msg_imprint->hash_algo;
532.       const EVP_MD *md;

crypto/ts/ts_rsp_verify.c:531:5: 
529.   {
530.       TS_MSG_IMPRINT *msg_imprint = tst_info->msg_imprint;
531. >     X509_ALGOR *md_alg_resp = msg_imprint->hash_algo;
532.       const EVP_MD *md;
533.       EVP_MD_CTX *md_ctx = NULL;

crypto/ts/ts_rsp_verify.c:533:5: 
531.       X509_ALGOR *md_alg_resp = msg_imprint->hash_algo;
532.       const EVP_MD *md;
533. >     EVP_MD_CTX *md_ctx = NULL;
534.       unsigned char buffer[4096];
535.       int length;

crypto/ts/ts_rsp_verify.c:537:5: 
535.       int length;
536.   
537. >     *md_alg = NULL;
538.       *imprint = NULL;
539.   

crypto/ts/ts_rsp_verify.c:538:5: 
536.   
537.       *md_alg = NULL;
538. >     *imprint = NULL;
539.   
540.       if ((*md_alg = X509_ALGOR_dup(md_alg_resp)) == NULL)

crypto/ts/ts_rsp_verify.c:540:9: 
538.       *imprint = NULL;
539.   
540. >     if ((*md_alg = X509_ALGOR_dup(md_alg_resp)) == NULL)
541.           goto err;
542.       if ((md = EVP_get_digestbyobj((*md_alg)->algorithm)) == NULL) {

crypto/asn1/x_algor.c:77:1: start of procedure X509_ALGOR_dup()
  75.   IMPLEMENT_ASN1_FUNCTIONS(X509_ALGOR)
  76.   IMPLEMENT_ASN1_ENCODE_FUNCTIONS_fname(X509_ALGORS, X509_ALGORS, X509_ALGORS)
  77. > IMPLEMENT_ASN1_DUP_FUNCTION(X509_ALGOR)
  78.   
  79.   int X509_ALGOR_set0(X509_ALGOR *alg, ASN1_OBJECT *aobj, int ptype, void *pval)

crypto/asn1/a_dup.c:98:1: start of procedure ASN1_item_dup()
    96.    */
    97.   
    98. > void *ASN1_item_dup(const ASN1_ITEM *it, void *x)
    99.   {
    100.       unsigned char *b = NULL;

crypto/asn1/a_dup.c:100:5: 
    98.   void *ASN1_item_dup(const ASN1_ITEM *it, void *x)
    99.   {
    100. >     unsigned char *b = NULL;
    101.       const unsigned char *p;
    102.       long i;

crypto/asn1/a_dup.c:105:9: Taking true branch
    103.       void *ret;
    104.   
    105.       if (x == NULL)
                   ^
    106.           return (NULL);
    107.   

crypto/asn1/a_dup.c:106:9: 
    104.   
    105.       if (x == NULL)
    106. >         return (NULL);
    107.   
    108.       i = ASN1_item_i2d(x, &b, it);

crypto/asn1/a_dup.c:117:1: return from a call to ASN1_item_dup
    115.       OPENSSL_free(b);
    116.       return (ret);
    117. > }

crypto/asn1/x_algor.c:77:1: return from a call to X509_ALGOR_dup
  75.   IMPLEMENT_ASN1_FUNCTIONS(X509_ALGOR)
  76.   IMPLEMENT_ASN1_ENCODE_FUNCTIONS_fname(X509_ALGORS, X509_ALGORS, X509_ALGORS)
  77. > IMPLEMENT_ASN1_DUP_FUNCTION(X509_ALGOR)
  78.   
  79.   int X509_ALGOR_set0(X509_ALGOR *alg, ASN1_OBJECT *aobj, int ptype, void *pval)

crypto/ts/ts_rsp_verify.c:540:9: Taking true branch
538.       *imprint = NULL;
539.   
540.       if ((*md_alg = X509_ALGOR_dup(md_alg_resp)) == NULL)
               ^
541.           goto err;
542.       if ((md = EVP_get_digestbyobj((*md_alg)->algorithm)) == NULL) {

crypto/ts/ts_rsp_verify.c:571:2: 
569.   
570.       return 1;
571. >  err:
572.       EVP_MD_CTX_free(md_ctx);
573.       X509_ALGOR_free(*md_alg);

crypto/ts/ts_rsp_verify.c:572:5: 
570.       return 1;
571.    err:
572. >     EVP_MD_CTX_free(md_ctx);
573.       X509_ALGOR_free(*md_alg);
574.       OPENSSL_free(*imprint);
