apps/speed.c:3165: error: NULL_DEREFERENCE
  pointer `fds` last assigned on line 3155 could be null and is dereferenced at line 3165, column 13.
Showing all 19 steps of the trace


apps/speed.c:3148:1: start of procedure do_multi()
3146.   }
3147.   
3148. > static int do_multi(int multi, int size_num)
3149.   {
3150.       int n;

apps/speed.c:3153:5: 
3151.       int fd[2];
3152.       int *fds;
3153. >     static char sep[] = ":";
3154.   
3155.       fds = malloc(sizeof(*fds) * multi);

apps/speed.c:3155:5: 
3153.       static char sep[] = ":";
3154.   
3155. >     fds = malloc(sizeof(*fds) * multi);
3156.       for (n = 0; n < multi; ++n) {
3157.           if (pipe(fd) == -1) {

apps/speed.c:3156:10: 
3154.   
3155.       fds = malloc(sizeof(*fds) * multi);
3156. >     for (n = 0; n < multi; ++n) {
3157.           if (pipe(fd) == -1) {
3158.               BIO_printf(bio_err, "pipe failure\n");

apps/speed.c:3156:17: Loop condition is true. Entering loop body
3154.   
3155.       fds = malloc(sizeof(*fds) * multi);
3156.       for (n = 0; n < multi; ++n) {
                        ^
3157.           if (pipe(fd) == -1) {
3158.               BIO_printf(bio_err, "pipe failure\n");

apps/speed.c:3157:13: Taking false branch
3155.       fds = malloc(sizeof(*fds) * multi);
3156.       for (n = 0; n < multi; ++n) {
3157.           if (pipe(fd) == -1) {
                    ^
3158.               BIO_printf(bio_err, "pipe failure\n");
3159.               exit(1);

apps/speed.c:3161:9: 
3159.               exit(1);
3160.           }
3161. >         fflush(stdout);
3162.           (void)BIO_flush(bio_err);
3163.           if (fork()) {

apps/speed.c:3162:15: 
3160.           }
3161.           fflush(stdout);
3162. >         (void)BIO_flush(bio_err);
3163.           if (fork()) {
3164.               close(fd[1]);

crypto/bio/bio_lib.c:510:1: start of procedure BIO_ctrl()
  508.   }
  509.   
  510. > long BIO_ctrl(BIO *b, int cmd, long larg, void *parg)
  511.   {
  512.       long ret;

crypto/bio/bio_lib.c:514:9: Taking false branch
  512.       long ret;
  513.   
  514.       if (b == NULL)
                 ^
  515.           return 0;
  516.   

crypto/bio/bio_lib.c:517:10: Taking false branch
  515.           return 0;
  516.   
  517.       if ((b->method == NULL) || (b->method->ctrl == NULL)) {
                  ^
  518.           BIOerr(BIO_F_BIO_CTRL, BIO_R_UNSUPPORTED_METHOD);
  519.           return -2;

crypto/bio/bio_lib.c:517:33: Taking true branch
  515.           return 0;
  516.   
  517.       if ((b->method == NULL) || (b->method->ctrl == NULL)) {
                                         ^
  518.           BIOerr(BIO_F_BIO_CTRL, BIO_R_UNSUPPORTED_METHOD);
  519.           return -2;

crypto/bio/bio_lib.c:518:9: Skipping ERR_put_error(): empty list of specs
  516.   
  517.       if ((b->method == NULL) || (b->method->ctrl == NULL)) {
  518.           BIOerr(BIO_F_BIO_CTRL, BIO_R_UNSUPPORTED_METHOD);
                 ^
  519.           return -2;
  520.       }

crypto/bio/bio_lib.c:519:9: 
  517.       if ((b->method == NULL) || (b->method->ctrl == NULL)) {
  518.           BIOerr(BIO_F_BIO_CTRL, BIO_R_UNSUPPORTED_METHOD);
  519. >         return -2;
  520.       }
  521.   

crypto/bio/bio_lib.c:535:1: return from a call to BIO_ctrl
  533.   
  534.       return ret;
  535. > }
  536.   
  537.   long BIO_callback_ctrl(BIO *b, int cmd, BIO_info_cb *fp)

apps/speed.c:3162:9: 
3160.           }
3161.           fflush(stdout);
3162. >         (void)BIO_flush(bio_err);
3163.           if (fork()) {
3164.               close(fd[1]);

apps/speed.c:3163:13: Taking true branch
3161.           fflush(stdout);
3162.           (void)BIO_flush(bio_err);
3163.           if (fork()) {
                    ^
3164.               close(fd[1]);
3165.               fds[n] = fd[0];

apps/speed.c:3164:13: 
3162.           (void)BIO_flush(bio_err);
3163.           if (fork()) {
3164. >             close(fd[1]);
3165.               fds[n] = fd[0];
3166.           } else {

apps/speed.c:3165:13: 
3163.           if (fork()) {
3164.               close(fd[1]);
3165. >             fds[n] = fd[0];
3166.           } else {
3167.               close(fd[0]);
