crypto/x509/by_dir.c:388: error: NULL_DEREFERENCE
  pointer `b` last assigned on line 214 could be null and is dereferenced by call to `BUF_MEM_free()` at line 388, column 5.
Showing all 13 steps of the trace


crypto/x509/by_dir.c:203:1: start of procedure get_cert_by_subject()
201.   }
202.   
203. > static int get_cert_by_subject(X509_LOOKUP *xl, X509_LOOKUP_TYPE type,
204.                                  X509_NAME *name, X509_OBJECT *ret)
205.   {

crypto/x509/by_dir.c:211:5: 
209.           X509_CRL crl;
210.       } data;
211. >     int ok = 0;
212.       int i, j, k;
213.       unsigned long h;

crypto/x509/by_dir.c:214:5: 
212.       int i, j, k;
213.       unsigned long h;
214. >     BUF_MEM *b = NULL;
215.       X509_OBJECT stmp, *tmp;
216.       const char *postfix = "";

crypto/x509/by_dir.c:216:5: 
214.       BUF_MEM *b = NULL;
215.       X509_OBJECT stmp, *tmp;
216. >     const char *postfix = "";
217.   
218.       if (name == NULL)

crypto/x509/by_dir.c:218:9: Taking false branch
216.       const char *postfix = "";
217.   
218.       if (name == NULL)
               ^
219.           return 0;
220.   

crypto/x509/by_dir.c:221:5: 
219.           return 0;
220.   
221. >     stmp.type = type;
222.       if (type == X509_LU_X509) {
223.           data.st_x509.cert_info.subject = name;

crypto/x509/by_dir.c:222:9: Taking false branch
220.   
221.       stmp.type = type;
222.       if (type == X509_LU_X509) {
               ^
223.           data.st_x509.cert_info.subject = name;
224.           stmp.data.x509 = &data.st_x509;

crypto/x509/by_dir.c:226:16: Taking false branch
224.           stmp.data.x509 = &data.st_x509;
225.           postfix = "";
226.       } else if (type == X509_LU_CRL) {
                      ^
227.           data.crl.crl.issuer = name;
228.           stmp.data.crl = &data.crl;

crypto/x509/by_dir.c:231:9: Skipping ERR_put_error(): empty list of specs
229.           postfix = "r";
230.       } else {
231.           X509err(X509_F_GET_CERT_BY_SUBJECT, X509_R_WRONG_LOOKUP_TYPE);
               ^
232.           goto finish;
233.       }

crypto/x509/by_dir.c:387:2: 
385.           }
386.       }
387. >  finish:
388.       BUF_MEM_free(b);
389.       return ok;

crypto/x509/by_dir.c:388:5: 
386.       }
387.    finish:
388. >     BUF_MEM_free(b);
389.       return ok;
390.   }

crypto/buffer/buffer.c:43:1: start of procedure BUF_MEM_free()
  41.   }
  42.   
  43. > void BUF_MEM_free(BUF_MEM *a)
  44.   {
  45.       if (a->data != NULL) {

crypto/buffer/buffer.c:45:9: 
  43.   void BUF_MEM_free(BUF_MEM *a)
  44.   {
  45. >     if (a->data != NULL) {
  46.           if (a->flags & BUF_MEM_FLAG_SECURE)
  47.               OPENSSL_secure_clear_free(a->data, a->max);
