apps/ocsp.c:1643: error: NULL_DEREFERENCE
  pointer `ctx` last assigned on line 1616 could be null and is dereferenced by call to `SSL_CTX_free()` at line 1643, column 5.
Showing all 31 steps of the trace


apps/ocsp.c:1609:1: start of procedure process_responder()
1607.   }
1608.   
1609. > OCSP_RESPONSE *process_responder(OCSP_REQUEST *req,
1610.                                    const char *host, const char *path,
1611.                                    const char *port, int use_ssl,

apps/ocsp.c:1615:5: 
1613.                                    int req_timeout)
1614.   {
1615. >     BIO *cbio = NULL;
1616.       SSL_CTX *ctx = NULL;
1617.       OCSP_RESPONSE *resp = NULL;

apps/ocsp.c:1616:5: 
1614.   {
1615.       BIO *cbio = NULL;
1616. >     SSL_CTX *ctx = NULL;
1617.       OCSP_RESPONSE *resp = NULL;
1618.   

apps/ocsp.c:1617:5: 
1615.       BIO *cbio = NULL;
1616.       SSL_CTX *ctx = NULL;
1617. >     OCSP_RESPONSE *resp = NULL;
1618.   
1619.       cbio = BIO_new_connect(host);

apps/ocsp.c:1619:5: 
1617.       OCSP_RESPONSE *resp = NULL;
1618.   
1619. >     cbio = BIO_new_connect(host);
1620.       if (cbio == NULL) {
1621.           BIO_printf(bio_err, "Error creating connect BIO\n");

crypto/bio/bss_conn.c:527:1: start of procedure BIO_new_connect()
  525.   }
  526.   
  527. > BIO *BIO_new_connect(const char *str)
  528.   {
  529.       BIO *ret;

crypto/bio/bss_conn.c:531:5: 
  529.       BIO *ret;
  530.   
  531. >     ret = BIO_new(BIO_s_connect());
  532.       if (ret == NULL)
  533.           return NULL;

crypto/bio/bss_conn.c:245:1: start of procedure BIO_s_connect()
    243.   }
    244.   
    245. > const BIO_METHOD *BIO_s_connect(void)
    246.   {
    247.       return &methods_connectp;

crypto/bio/bss_conn.c:247:5: 
    245.   const BIO_METHOD *BIO_s_connect(void)
    246.   {
    247. >     return &methods_connectp;
    248.   }
    249.   

crypto/bio/bss_conn.c:248:1: return from a call to BIO_s_connect
    246.   {
    247.       return &methods_connectp;
    248. > }
    249.   
    250.   static int conn_new(BIO *bi)

crypto/bio/bss_conn.c:531:5: Skipping BIO_new(): empty list of specs
  529.       BIO *ret;
  530.   
  531.       ret = BIO_new(BIO_s_connect());
             ^
  532.       if (ret == NULL)
  533.           return NULL;

crypto/bio/bss_conn.c:532:9: Taking true branch
  530.   
  531.       ret = BIO_new(BIO_s_connect());
  532.       if (ret == NULL)
                 ^
  533.           return NULL;
  534.       if (BIO_set_conn_hostname(ret, str))

crypto/bio/bss_conn.c:533:9: 
  531.       ret = BIO_new(BIO_s_connect());
  532.       if (ret == NULL)
  533. >         return NULL;
  534.       if (BIO_set_conn_hostname(ret, str))
  535.           return ret;

crypto/bio/bss_conn.c:538:1: return from a call to BIO_new_connect
  536.       BIO_free(ret);
  537.       return NULL;
  538. > }
  539.   
  540.   #endif

apps/ocsp.c:1620:9: Taking true branch
1618.   
1619.       cbio = BIO_new_connect(host);
1620.       if (cbio == NULL) {
                ^
1621.           BIO_printf(bio_err, "Error creating connect BIO\n");
1622.           goto end;

apps/ocsp.c:1621:9: Skipping BIO_printf(): empty list of specs
1619.       cbio = BIO_new_connect(host);
1620.       if (cbio == NULL) {
1621.           BIO_printf(bio_err, "Error creating connect BIO\n");
                ^
1622.           goto end;
1623.       }

apps/ocsp.c:1641:2: 
1639.       if (resp == NULL)
1640.           BIO_printf(bio_err, "Error querying OCSP responder\n");
1641. >  end:
1642.       BIO_free_all(cbio);
1643.       SSL_CTX_free(ctx);

apps/ocsp.c:1642:5: Skipping BIO_free_all(): empty list of specs
1640.           BIO_printf(bio_err, "Error querying OCSP responder\n");
1641.    end:
1642.       BIO_free_all(cbio);
            ^
1643.       SSL_CTX_free(ctx);
1644.       return resp;

apps/ocsp.c:1643:5: 
1641.    end:
1642.       BIO_free_all(cbio);
1643. >     SSL_CTX_free(ctx);
1644.       return resp;
1645.   }

ssl/ssl_lib.c:3239:1: start of procedure SSL_CTX_free()
  3237.   }
  3238.   
  3239. > void SSL_CTX_free(SSL_CTX *a)
  3240.   {
  3241.       int i;

ssl/ssl_lib.c:3243:9: Taking false branch
  3241.       int i;
  3242.   
  3243.       if (a == NULL)
                  ^
  3244.           return;
  3245.   

ssl/ssl_lib.c:3246:5: 
  3244.           return;
  3245.   
  3246. >     CRYPTO_DOWN_REF(&a->references, &i, a->lock);
  3247.       REF_PRINT_COUNT("SSL_CTX", a);
  3248.       if (i > 0)

include/internal/refcount.h:49:1: start of procedure CRYPTO_DOWN_REF()
    47.    * otherwise imply an acquire fence. Hence conditional acquire fence...
    48.    */
    49. > static inline int CRYPTO_DOWN_REF(_Atomic int *val, int *ret, void *lock)
    50.   {
    51.       *ret = atomic_fetch_sub_explicit(val, 1, memory_order_relaxed) - 1;

include/internal/refcount.h:51:5: 
    49.   static inline int CRYPTO_DOWN_REF(_Atomic int *val, int *ret, void *lock)
    50.   {
    51. >     *ret = atomic_fetch_sub_explicit(val, 1, memory_order_relaxed) - 1;
    52.       if (*ret == 0)
    53.           atomic_thread_fence(memory_order_acquire);

include/internal/refcount.h:52:9: Taking true branch
    50.   {
    51.       *ret = atomic_fetch_sub_explicit(val, 1, memory_order_relaxed) - 1;
    52.       if (*ret == 0)
                  ^
    53.           atomic_thread_fence(memory_order_acquire);
    54.       return 1;

include/internal/refcount.h:53:9: Skipping __c11_atomic_thread_fence(): method has no implementation
    51.       *ret = atomic_fetch_sub_explicit(val, 1, memory_order_relaxed) - 1;
    52.       if (*ret == 0)
    53.           atomic_thread_fence(memory_order_acquire);
                  ^
    54.       return 1;
    55.   }

include/internal/refcount.h:54:5: 
    52.       if (*ret == 0)
    53.           atomic_thread_fence(memory_order_acquire);
    54. >     return 1;
    55.   }
    56.   

include/internal/refcount.h:55:1: return from a call to CRYPTO_DOWN_REF
    53.           atomic_thread_fence(memory_order_acquire);
    54.       return 1;
    55. > }
    56.   
    57.   #  elif defined(__GNUC__) && defined(__ATOMIC_RELAXED) && __GCC_ATOMIC_INT_LOCK_FREE > 0

ssl/ssl_lib.c:3248:9: Taking true branch
  3246.       CRYPTO_DOWN_REF(&a->references, &i, a->lock);
  3247.       REF_PRINT_COUNT("SSL_CTX", a);
  3248.       if (i > 0)
                  ^
  3249.           return;
  3250.       REF_ASSERT_ISNT(i < 0);

ssl/ssl_lib.c:3249:9: 
  3247.       REF_PRINT_COUNT("SSL_CTX", a);
  3248.       if (i > 0)
  3249. >         return;
  3250.       REF_ASSERT_ISNT(i < 0);
  3251.   

ssl/ssl_lib.c:3301:1: return from a call to SSL_CTX_free
  3299.   
  3300.       OPENSSL_free(a);
  3301. > }
  3302.   
  3303.   void SSL_CTX_set_default_passwd_cb(SSL_CTX *ctx, pem_password_cb *cb)
