apps/speed.c:3131: error: NULL_DEREFERENCE
  pointer `fds` last assigned on line 3121 could be null and is dereferenced at line 3131, column 13.
Showing all 19 steps of the trace


apps/speed.c:3114:1: start of procedure do_multi()
3112.   }
3113.   
3114. > static int do_multi(int multi, int size_num)
3115.   {
3116.       int n;

apps/speed.c:3119:5: 
3117.       int fd[2];
3118.       int *fds;
3119. >     static char sep[] = ":";
3120.   
3121.       fds = malloc(sizeof(*fds) * multi);

apps/speed.c:3121:5: 
3119.       static char sep[] = ":";
3120.   
3121. >     fds = malloc(sizeof(*fds) * multi);
3122.       for (n = 0; n < multi; ++n) {
3123.           if (pipe(fd) == -1) {

apps/speed.c:3122:10: 
3120.   
3121.       fds = malloc(sizeof(*fds) * multi);
3122. >     for (n = 0; n < multi; ++n) {
3123.           if (pipe(fd) == -1) {
3124.               BIO_printf(bio_err, "pipe failure\n");

apps/speed.c:3122:17: Loop condition is true. Entering loop body
3120.   
3121.       fds = malloc(sizeof(*fds) * multi);
3122.       for (n = 0; n < multi; ++n) {
                        ^
3123.           if (pipe(fd) == -1) {
3124.               BIO_printf(bio_err, "pipe failure\n");

apps/speed.c:3123:13: Taking false branch
3121.       fds = malloc(sizeof(*fds) * multi);
3122.       for (n = 0; n < multi; ++n) {
3123.           if (pipe(fd) == -1) {
                    ^
3124.               BIO_printf(bio_err, "pipe failure\n");
3125.               exit(1);

apps/speed.c:3127:9: 
3125.               exit(1);
3126.           }
3127. >         fflush(stdout);
3128.           (void)BIO_flush(bio_err);
3129.           if (fork()) {

apps/speed.c:3128:15: 
3126.           }
3127.           fflush(stdout);
3128. >         (void)BIO_flush(bio_err);
3129.           if (fork()) {
3130.               close(fd[1]);

crypto/bio/bio_lib.c:509:1: start of procedure BIO_ctrl()
  507.   }
  508.   
  509. > long BIO_ctrl(BIO *b, int cmd, long larg, void *parg)
  510.   {
  511.       long ret;

crypto/bio/bio_lib.c:513:9: Taking false branch
  511.       long ret;
  512.   
  513.       if (b == NULL)
                 ^
  514.           return 0;
  515.   

crypto/bio/bio_lib.c:516:10: Taking false branch
  514.           return 0;
  515.   
  516.       if ((b->method == NULL) || (b->method->ctrl == NULL)) {
                  ^
  517.           BIOerr(BIO_F_BIO_CTRL, BIO_R_UNSUPPORTED_METHOD);
  518.           return -2;

crypto/bio/bio_lib.c:516:33: Taking true branch
  514.           return 0;
  515.   
  516.       if ((b->method == NULL) || (b->method->ctrl == NULL)) {
                                         ^
  517.           BIOerr(BIO_F_BIO_CTRL, BIO_R_UNSUPPORTED_METHOD);
  518.           return -2;

crypto/bio/bio_lib.c:517:9: Skipping ERR_put_error(): empty list of specs
  515.   
  516.       if ((b->method == NULL) || (b->method->ctrl == NULL)) {
  517.           BIOerr(BIO_F_BIO_CTRL, BIO_R_UNSUPPORTED_METHOD);
                 ^
  518.           return -2;
  519.       }

crypto/bio/bio_lib.c:518:9: 
  516.       if ((b->method == NULL) || (b->method->ctrl == NULL)) {
  517.           BIOerr(BIO_F_BIO_CTRL, BIO_R_UNSUPPORTED_METHOD);
  518. >         return -2;
  519.       }
  520.   

crypto/bio/bio_lib.c:534:1: return from a call to BIO_ctrl
  532.   
  533.       return ret;
  534. > }
  535.   
  536.   long BIO_callback_ctrl(BIO *b, int cmd, BIO_info_cb *fp)

apps/speed.c:3128:9: 
3126.           }
3127.           fflush(stdout);
3128. >         (void)BIO_flush(bio_err);
3129.           if (fork()) {
3130.               close(fd[1]);

apps/speed.c:3129:13: Taking true branch
3127.           fflush(stdout);
3128.           (void)BIO_flush(bio_err);
3129.           if (fork()) {
                    ^
3130.               close(fd[1]);
3131.               fds[n] = fd[0];

apps/speed.c:3130:13: 
3128.           (void)BIO_flush(bio_err);
3129.           if (fork()) {
3130. >             close(fd[1]);
3131.               fds[n] = fd[0];
3132.           } else {

apps/speed.c:3131:13: 
3129.           if (fork()) {
3130.               close(fd[1]);
3131. >             fds[n] = fd[0];
3132.           } else {
3133.               close(fd[0]);
