crypto/asn1/a_bytes.c:298: error: NULL_DEREFERENCE
  pointer `&b->data` last assigned on line 268 could be null and is dereferenced by call to `BUF_MEM_grow()` at line 298, column 8.
Showing all 32 steps of the trace


crypto/asn1/a_bytes.c:260:1: start of procedure asn1_collate_primative()
258.   /* There have been a few bug fixes for this function from
259.    * Paul Keogh <paul.keogh@sse.ie>, many thanks to him */
260. > static int asn1_collate_primative(ASN1_STRING *a, ASN1_CTX *c)
261.   	{
262.   	ASN1_STRING *os=NULL;

crypto/asn1/a_bytes.c:262:2: 
260.   static int asn1_collate_primative(ASN1_STRING *a, ASN1_CTX *c)
261.   	{
262. > 	ASN1_STRING *os=NULL;
263.   	BUF_MEM b;
264.   	int num;

crypto/asn1/a_bytes.c:266:2: 
264.   	int num;
265.   
266. > 	b.length=0;
267.   	b.max=0;
268.   	b.data=NULL;

crypto/asn1/a_bytes.c:267:2: 
265.   
266.   	b.length=0;
267. > 	b.max=0;
268.   	b.data=NULL;
269.   

crypto/asn1/a_bytes.c:268:2: 
266.   	b.length=0;
267.   	b.max=0;
268. > 	b.data=NULL;
269.   
270.   	if (a == NULL)

crypto/asn1/a_bytes.c:270:6: Taking false branch
268.   	b.data=NULL;
269.   
270.   	if (a == NULL)
            ^
271.   		{
272.   		c->error=ERR_R_PASSED_NULL_PARAMETER;

crypto/asn1/a_bytes.c:276:2: 
274.   		}
275.   
276. > 	num=0;
277.   	for (;;)
278.   		{

crypto/asn1/a_bytes.c:307:3: Loop condition is true. Entering loop body
305.   			c->slen-=(c->p-c->q);
306.   		num+=os->length;
307.   		}
         ^
308.   
309.   	if (!asn1_Finish(c)) goto err;

crypto/asn1/a_bytes.c:279:7: Taking true branch
277.   	for (;;)
278.   		{
279.   		if (c->inf & 1)
             ^
280.   			{
281.   			c->eos=ASN1_check_infinite_end(&c->p,

crypto/asn1/a_bytes.c:281:4: 
279.   		if (c->inf & 1)
280.   			{
281. > 			c->eos=ASN1_check_infinite_end(&c->p,
282.   				(long)(c->max-c->p));
283.   			if (c->eos) break;

crypto/asn1/asn1_lib.c:68:1: start of procedure ASN1_check_infinite_end()
  66.   const char *ASN1_version="ASN.1" OPENSSL_VERSION_PTEXT;
  67.   
  68. > int ASN1_check_infinite_end(unsigned char **p, long len)
  69.   	{
  70.   	/* If there is 0 or 1 byte left, the length check should pick

crypto/asn1/asn1_lib.c:72:6: Taking false branch
  70.   	/* If there is 0 or 1 byte left, the length check should pick
  71.   	 * things up */
  72.   	if (len <= 0)
             ^
  73.   		return(1);
  74.   	else if ((len >= 2) && ((*p)[0] == 0) && ((*p)[1] == 0))

crypto/asn1/asn1_lib.c:74:12: Taking true branch
  72.   	if (len <= 0)
  73.   		return(1);
  74.   	else if ((len >= 2) && ((*p)[0] == 0) && ((*p)[1] == 0))
                   ^
  75.   		{
  76.   		(*p)+=2;

crypto/asn1/asn1_lib.c:74:26: Taking false branch
  72.   	if (len <= 0)
  73.   		return(1);
  74.   	else if ((len >= 2) && ((*p)[0] == 0) && ((*p)[1] == 0))
                                 ^
  75.   		{
  76.   		(*p)+=2;

crypto/asn1/asn1_lib.c:79:2: 
  77.   		return(1);
  78.   		}
  79. > 	return(0);
  80.   	}
  81.   

crypto/asn1/asn1_lib.c:80:2: return from a call to ASN1_check_infinite_end
  78.   		}
  79.   	return(0);
  80.   	}
         ^
  81.   
  82.   

crypto/asn1/a_bytes.c:283:8: Taking false branch
281.   			c->eos=ASN1_check_infinite_end(&c->p,
282.   				(long)(c->max-c->p));
283.   			if (c->eos) break;
              ^
284.   			}
285.   		else

crypto/asn1/a_bytes.c:290:3: 
288.   			}
289.   
290. > 		c->q=c->p;
291.   		if (d2i_ASN1_bytes(&os,&c->p,c->max-c->p,c->tag,c->xclass)
292.   			== NULL)

crypto/asn1/a_bytes.c:291:7: Taking false branch
289.   
290.   		c->q=c->p;
291.   		if (d2i_ASN1_bytes(&os,&c->p,c->max-c->p,c->tag,c->xclass)
             ^
292.   			== NULL)
293.   			{

crypto/asn1/a_bytes.c:298:8: 
296.   			}
297.   
298. > 		if (!BUF_MEM_grow(&b,num+os->length))
299.   			{
300.   			c->error=ERR_R_BUF_LIB;

crypto/buffer/buffer.c:92:1: start of procedure BUF_MEM_grow()
  90.   	}
  91.   
  92. > int BUF_MEM_grow(BUF_MEM *str, int len)
  93.   	{
  94.   	char *ret;

crypto/buffer/buffer.c:97:6: Taking false branch
  95.   	unsigned int n;
  96.   
  97.   	if (str->length >= len)
              ^
  98.   		{
  99.   		str->length=len;

crypto/buffer/buffer.c:102:6: Taking false branch
  100.   		return(len);
  101.   		}
  102.   	if (str->max >= len)
              ^
  103.   		{
  104.   		memset(&str->data[str->length],0,len-str->length);

crypto/buffer/buffer.c:108:2: 
  106.   		return(len);
  107.   		}
  108. > 	n=(len+3)/3*4;
  109.   	if (str->data == NULL)
  110.   		ret=Malloc(n);

crypto/buffer/buffer.c:109:6: Taking false branch
  107.   		}
  108.   	n=(len+3)/3*4;
  109.   	if (str->data == NULL)
              ^
  110.   		ret=Malloc(n);
  111.   	else

crypto/buffer/buffer.c:112:3: 
  110.   		ret=Malloc(n);
  111.   	else
  112. > 		ret=Realloc(str->data,n);
  113.   	if (ret == NULL)
  114.   		{

crypto/buffer/buffer.c:113:6: Taking false branch
  111.   	else
  112.   		ret=Realloc(str->data,n);
  113.   	if (ret == NULL)
              ^
  114.   		{
  115.   		BUFerr(BUF_F_BUF_MEM_GROW,ERR_R_MALLOC_FAILURE);

crypto/buffer/buffer.c:120:3: 
  118.   	else
  119.   		{
  120. > 		str->data=ret;
  121.   		str->length=len;
  122.   		str->max=n;

crypto/buffer/buffer.c:121:3: 
  119.   		{
  120.   		str->data=ret;
  121. > 		str->length=len;
  122.   		str->max=n;
  123.   		}

crypto/buffer/buffer.c:122:3: 
  120.   		str->data=ret;
  121.   		str->length=len;
  122. > 		str->max=n;
  123.   		}
  124.   	return(len);

crypto/buffer/buffer.c:124:2: 
  122.   		str->max=n;
  123.   		}
  124. > 	return(len);
  125.   	}
  126.   

crypto/buffer/buffer.c:125:2: return from a call to BUF_MEM_grow
  123.   		}
  124.   	return(len);
  125.   	}
          ^
  126.   
  127.   char *BUF_strdup(const char *str)
