apps/speed.c:3135: error: NULL_DEREFERENCE
  pointer `fds` last assigned on line 3125 could be null and is dereferenced at line 3135, column 13.
Showing all 19 steps of the trace


apps/speed.c:3118:1: start of procedure do_multi()
3116.   }
3117.   
3118. > static int do_multi(int multi, int size_num)
3119.   {
3120.       int n;

apps/speed.c:3123:5: 
3121.       int fd[2];
3122.       int *fds;
3123. >     static char sep[] = ":";
3124.   
3125.       fds = malloc(sizeof(*fds) * multi);

apps/speed.c:3125:5: 
3123.       static char sep[] = ":";
3124.   
3125. >     fds = malloc(sizeof(*fds) * multi);
3126.       for (n = 0; n < multi; ++n) {
3127.           if (pipe(fd) == -1) {

apps/speed.c:3126:10: 
3124.   
3125.       fds = malloc(sizeof(*fds) * multi);
3126. >     for (n = 0; n < multi; ++n) {
3127.           if (pipe(fd) == -1) {
3128.               BIO_printf(bio_err, "pipe failure\n");

apps/speed.c:3126:17: Loop condition is true. Entering loop body
3124.   
3125.       fds = malloc(sizeof(*fds) * multi);
3126.       for (n = 0; n < multi; ++n) {
                        ^
3127.           if (pipe(fd) == -1) {
3128.               BIO_printf(bio_err, "pipe failure\n");

apps/speed.c:3127:13: Taking false branch
3125.       fds = malloc(sizeof(*fds) * multi);
3126.       for (n = 0; n < multi; ++n) {
3127.           if (pipe(fd) == -1) {
                    ^
3128.               BIO_printf(bio_err, "pipe failure\n");
3129.               exit(1);

apps/speed.c:3131:9: 
3129.               exit(1);
3130.           }
3131. >         fflush(stdout);
3132.           (void)BIO_flush(bio_err);
3133.           if (fork()) {

apps/speed.c:3132:15: 
3130.           }
3131.           fflush(stdout);
3132. >         (void)BIO_flush(bio_err);
3133.           if (fork()) {
3134.               close(fd[1]);

crypto/bio/bio_lib.c:511:1: start of procedure BIO_ctrl()
  509.   }
  510.   
  511. > long BIO_ctrl(BIO *b, int cmd, long larg, void *parg)
  512.   {
  513.       long ret;

crypto/bio/bio_lib.c:515:9: Taking false branch
  513.       long ret;
  514.   
  515.       if (b == NULL)
                 ^
  516.           return 0;
  517.   

crypto/bio/bio_lib.c:518:10: Taking false branch
  516.           return 0;
  517.   
  518.       if ((b->method == NULL) || (b->method->ctrl == NULL)) {
                  ^
  519.           BIOerr(BIO_F_BIO_CTRL, BIO_R_UNSUPPORTED_METHOD);
  520.           return -2;

crypto/bio/bio_lib.c:518:33: Taking true branch
  516.           return 0;
  517.   
  518.       if ((b->method == NULL) || (b->method->ctrl == NULL)) {
                                         ^
  519.           BIOerr(BIO_F_BIO_CTRL, BIO_R_UNSUPPORTED_METHOD);
  520.           return -2;

crypto/bio/bio_lib.c:519:9: Skipping ERR_put_error(): empty list of specs
  517.   
  518.       if ((b->method == NULL) || (b->method->ctrl == NULL)) {
  519.           BIOerr(BIO_F_BIO_CTRL, BIO_R_UNSUPPORTED_METHOD);
                 ^
  520.           return -2;
  521.       }

crypto/bio/bio_lib.c:520:9: 
  518.       if ((b->method == NULL) || (b->method->ctrl == NULL)) {
  519.           BIOerr(BIO_F_BIO_CTRL, BIO_R_UNSUPPORTED_METHOD);
  520. >         return -2;
  521.       }
  522.   

crypto/bio/bio_lib.c:536:1: return from a call to BIO_ctrl
  534.   
  535.       return ret;
  536. > }
  537.   
  538.   long BIO_callback_ctrl(BIO *b, int cmd, BIO_info_cb *fp)

apps/speed.c:3132:9: 
3130.           }
3131.           fflush(stdout);
3132. >         (void)BIO_flush(bio_err);
3133.           if (fork()) {
3134.               close(fd[1]);

apps/speed.c:3133:13: Taking true branch
3131.           fflush(stdout);
3132.           (void)BIO_flush(bio_err);
3133.           if (fork()) {
                    ^
3134.               close(fd[1]);
3135.               fds[n] = fd[0];

apps/speed.c:3134:13: 
3132.           (void)BIO_flush(bio_err);
3133.           if (fork()) {
3134. >             close(fd[1]);
3135.               fds[n] = fd[0];
3136.           } else {

apps/speed.c:3135:13: 
3133.           if (fork()) {
3134.               close(fd[1]);
3135. >             fds[n] = fd[0];
3136.           } else {
3137.               close(fd[0]);
