crypto/txt_db/txt_db.c:233: error: NULL_DEREFERENCE
  pointer `buf` last assigned on line 197 could be null and is dereferenced by call to `BUF_MEM_free()` at line 233, column 5.
Showing all 31 steps of the trace


crypto/txt_db/txt_db.c:190:1: start of procedure TXT_DB_write()
188.   }
189.   
190. > long TXT_DB_write(BIO *out, TXT_DB *db)
191.   {
192.       long i, j, n, nn, l, tot = 0;

crypto/txt_db/txt_db.c:192:5: 
190.   long TXT_DB_write(BIO *out, TXT_DB *db)
191.   {
192. >     long i, j, n, nn, l, tot = 0;
193.       char *p, **pp, *f;
194.       BUF_MEM *buf = NULL;

crypto/txt_db/txt_db.c:194:5: 
192.       long i, j, n, nn, l, tot = 0;
193.       char *p, **pp, *f;
194. >     BUF_MEM *buf = NULL;
195.       long ret = -1;
196.   

crypto/txt_db/txt_db.c:195:5: 
193.       char *p, **pp, *f;
194.       BUF_MEM *buf = NULL;
195. >     long ret = -1;
196.   
197.       if ((buf = BUF_MEM_new()) == NULL)

crypto/txt_db/txt_db.c:197:9: 
195.       long ret = -1;
196.   
197. >     if ((buf = BUF_MEM_new()) == NULL)
198.           goto err;
199.       n = sk_OPENSSL_PSTRING_num(db->data);

crypto/buffer/buffer.c:31:1: start of procedure BUF_MEM_new()
  29.   }
  30.   
  31. > BUF_MEM *BUF_MEM_new(void)
  32.   {
  33.       BUF_MEM *ret;

crypto/buffer/buffer.c:35:5: 
  33.       BUF_MEM *ret;
  34.   
  35. >     ret = OPENSSL_zalloc(sizeof(*ret));
  36.       if (ret == NULL) {
  37.           BUFerr(BUF_F_BUF_MEM_NEW, ERR_R_MALLOC_FAILURE);

crypto/mem.c:228:1: start of procedure CRYPTO_zalloc()
    226.   }
    227.   
    228. > void *CRYPTO_zalloc(size_t num, const char *file, int line)
    229.   {
    230.       void *ret = CRYPTO_malloc(num, file, line);

crypto/mem.c:230:5: 
    228.   void *CRYPTO_zalloc(size_t num, const char *file, int line)
    229.   {
    230. >     void *ret = CRYPTO_malloc(num, file, line);
    231.   
    232.       FAILTEST();

crypto/mem.c:192:1: start of procedure CRYPTO_malloc()
      190.   #endif
      191.   
      192. > void *CRYPTO_malloc(size_t num, const char *file, int line)
      193.   {
      194.       void *ret = NULL;

crypto/mem.c:194:5: 
      192.   void *CRYPTO_malloc(size_t num, const char *file, int line)
      193.   {
      194. >     void *ret = NULL;
      195.   
      196.       INCREMENT(malloc_count);

crypto/mem.c:197:9: Taking false branch
      195.   
      196.       INCREMENT(malloc_count);
      197.       if (malloc_impl != NULL && malloc_impl != CRYPTO_malloc)
                     ^
      198.           return malloc_impl(num, file, line);
      199.   

crypto/mem.c:200:9: Taking false branch
      198.           return malloc_impl(num, file, line);
      199.   
      200.       if (num == 0)
                     ^
      201.           return NULL;
      202.   

crypto/mem.c:204:9: Taking false branch
      202.   
      203.       FAILTEST();
      204.       if (allow_customize) {
                     ^
      205.           /*
      206.            * Disallow customization after the first allocation. We only set this

crypto/mem.c:221:5: 
      219.       }
      220.   #else
      221. >     (void)(file); (void)(line);
      222.       ret = malloc(num);
      223.   #endif

crypto/mem.c:221:19: 
      219.       }
      220.   #else
      221. >     (void)(file); (void)(line);
      222.       ret = malloc(num);
      223.   #endif

crypto/mem.c:222:5: 
      220.   #else
      221.       (void)(file); (void)(line);
      222. >     ret = malloc(num);
      223.   #endif
      224.   

crypto/mem.c:225:5: 
      223.   #endif
      224.   
      225. >     return ret;
      226.   }
      227.   

crypto/mem.c:226:1: return from a call to CRYPTO_malloc
      224.   
      225.       return ret;
      226. > }
      227.   
      228.   void *CRYPTO_zalloc(size_t num, const char *file, int line)

crypto/mem.c:233:9: Taking false branch
    231.   
    232.       FAILTEST();
    233.       if (ret != NULL)
                   ^
    234.           memset(ret, 0, num);
    235.       return ret;

crypto/mem.c:235:5: 
    233.       if (ret != NULL)
    234.           memset(ret, 0, num);
    235. >     return ret;
    236.   }
    237.   

crypto/mem.c:236:1: return from a call to CRYPTO_zalloc
    234.           memset(ret, 0, num);
    235.       return ret;
    236. > }
    237.   
    238.   void *CRYPTO_realloc(void *str, size_t num, const char *file, int line)

crypto/buffer/buffer.c:36:9: Taking true branch
  34.   
  35.       ret = OPENSSL_zalloc(sizeof(*ret));
  36.       if (ret == NULL) {
                ^
  37.           BUFerr(BUF_F_BUF_MEM_NEW, ERR_R_MALLOC_FAILURE);
  38.           return NULL;

crypto/buffer/buffer.c:37:9: Skipping ERR_put_error(): empty list of specs
  35.       ret = OPENSSL_zalloc(sizeof(*ret));
  36.       if (ret == NULL) {
  37.           BUFerr(BUF_F_BUF_MEM_NEW, ERR_R_MALLOC_FAILURE);
                ^
  38.           return NULL;
  39.       }

crypto/buffer/buffer.c:38:9: 
  36.       if (ret == NULL) {
  37.           BUFerr(BUF_F_BUF_MEM_NEW, ERR_R_MALLOC_FAILURE);
  38. >         return NULL;
  39.       }
  40.       return ret;

crypto/buffer/buffer.c:41:1: return from a call to BUF_MEM_new
  39.       }
  40.       return ret;
  41. > }
  42.   
  43.   void BUF_MEM_free(BUF_MEM *a)

crypto/txt_db/txt_db.c:197:9: Taking true branch
195.       long ret = -1;
196.   
197.       if ((buf = BUF_MEM_new()) == NULL)
               ^
198.           goto err;
199.       n = sk_OPENSSL_PSTRING_num(db->data);

crypto/txt_db/txt_db.c:232:2: 
230.       }
231.       ret = tot;
232. >  err:
233.       BUF_MEM_free(buf);
234.       return ret;

crypto/txt_db/txt_db.c:233:5: 
231.       ret = tot;
232.    err:
233. >     BUF_MEM_free(buf);
234.       return ret;
235.   }

crypto/buffer/buffer.c:43:1: start of procedure BUF_MEM_free()
  41.   }
  42.   
  43. > void BUF_MEM_free(BUF_MEM *a)
  44.   {
  45.       if (a->data != NULL) {

crypto/buffer/buffer.c:45:9: 
  43.   void BUF_MEM_free(BUF_MEM *a)
  44.   {
  45. >     if (a->data != NULL) {
  46.           if (a->flags & BUF_MEM_FLAG_SECURE)
  47.               OPENSSL_secure_clear_free(a->data, a->max);
