crypto/evp/evp_pbe.c:233: error: NULL_DEREFERENCE
  pointer `pbe_algs` last assigned on line 220 could be null and is dereferenced by call to `sk_push()` at line 233, column 2.
Showing all 41 steps of the trace


crypto/evp/evp_pbe.c:215:1: start of procedure EVP_PBE_alg_add_type()
213.   /* Add a PBE algorithm */
214.   
215. > int EVP_PBE_alg_add_type(int pbe_type, int pbe_nid, int cipher_nid, int md_nid,
216.   	     EVP_PBE_KEYGEN *keygen)
217.   	{

crypto/evp/evp_pbe.c:219:7: Taking true branch
217.   	{
218.   	EVP_PBE_CTL *pbe_tmp;
219.   	if (!pbe_algs)
             ^
220.   		pbe_algs = sk_new(pbe_cmp);
221.   	if (!(pbe_tmp = (EVP_PBE_CTL*) OPENSSL_malloc (sizeof(EVP_PBE_CTL))))

crypto/evp/evp_pbe.c:220:3: 
218.   	EVP_PBE_CTL *pbe_tmp;
219.   	if (!pbe_algs)
220. > 		pbe_algs = sk_new(pbe_cmp);
221.   	if (!(pbe_tmp = (EVP_PBE_CTL*) OPENSSL_malloc (sizeof(EVP_PBE_CTL))))
222.   		{

crypto/stack/stack.c:120:1: start of procedure sk_new()
  118.   	}
  119.   
  120. > STACK *sk_new(int (*c)(const char * const *, const char * const *))
  121.   	{
  122.   	STACK *ret;

crypto/stack/stack.c:125:6: 
  123.   	int i;
  124.   
  125. > 	if ((ret=(STACK *)OPENSSL_malloc(sizeof(STACK))) == NULL)
  126.   		goto err;
  127.   	if ((ret->data=(char **)OPENSSL_malloc(sizeof(char *)*MIN_NODES)) == NULL)

crypto/mem.c:291:1: start of procedure CRYPTO_malloc()
    289.   	}
    290.   
    291. > void *CRYPTO_malloc(int num, const char *file, int line)
    292.   	{
    293.   	void *ret = NULL;

crypto/mem.c:293:2: 
    291.   void *CRYPTO_malloc(int num, const char *file, int line)
    292.   	{
    293. > 	void *ret = NULL;
    294.   	extern unsigned char cleanse_ctr;
    295.   

crypto/mem.c:296:6: Taking false branch
    294.   	extern unsigned char cleanse_ctr;
    295.   
    296.   	if (num <= 0) return NULL;
                ^
    297.   
    298.   	allow_customize = 0;

crypto/mem.c:298:2: 
    296.   	if (num <= 0) return NULL;
    297.   
    298. > 	allow_customize = 0;
    299.   	if (malloc_debug_func != NULL)
    300.   		{

crypto/mem.c:299:6: Taking false branch
    297.   
    298.   	allow_customize = 0;
    299.   	if (malloc_debug_func != NULL)
                ^
    300.   		{
    301.   		allow_customize_debug = 0;

crypto/mem.c:304:2: Skipping __function_pointer__(): unresolved function pointer
    302.   		malloc_debug_func(NULL, num, file, line, 0);
    303.   		}
    304.   	ret = malloc_ex_func(num,file,line);
            ^
    305.   #ifdef LEVITTE_DEBUG_MEM
    306.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);

crypto/mem.c:308:6: Taking false branch
    306.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);
    307.   #endif
    308.   	if (malloc_debug_func != NULL)
                ^
    309.   		malloc_debug_func(ret, num, file, line, 1);
    310.   

crypto/mem.c:314:12: Taking false branch
    312.            * sanitisation function can't be optimised out. NB: We only do
    313.            * this for >2Kb so the overhead doesn't bother us. */
    314.           if(ret && (num > 2048))
                      ^
    315.                   ((unsigned char *)ret)[0] = cleanse_ctr;
    316.   

crypto/mem.c:317:2: 
    315.                   ((unsigned char *)ret)[0] = cleanse_ctr;
    316.   
    317. > 	return ret;
    318.   	}
    319.   

crypto/mem.c:318:2: return from a call to CRYPTO_malloc
    316.   
    317.   	return ret;
    318.   	}
            ^
    319.   
    320.   void *CRYPTO_realloc(void *str, int num, const char *file, int line)

crypto/stack/stack.c:125:6: Taking true branch
  123.   	int i;
  124.   
  125.   	if ((ret=(STACK *)OPENSSL_malloc(sizeof(STACK))) == NULL)
              ^
  126.   		goto err;
  127.   	if ((ret->data=(char **)OPENSSL_malloc(sizeof(char *)*MIN_NODES)) == NULL)

crypto/stack/stack.c:136:1: 
  134.   	ret->sorted=0;
  135.   	return(ret);
  136. > err:
  137.   	if(ret)
  138.   		OPENSSL_free(ret);

crypto/stack/stack.c:137:5: Taking false branch
  135.   	return(ret);
  136.   err:
  137.   	if(ret)
             ^
  138.   		OPENSSL_free(ret);
  139.   	return(NULL);

crypto/stack/stack.c:139:2: 
  137.   	if(ret)
  138.   		OPENSSL_free(ret);
  139. > 	return(NULL);
  140.   	}
  141.   

crypto/stack/stack.c:140:2: return from a call to sk_new
  138.   		OPENSSL_free(ret);
  139.   	return(NULL);
  140.   	}
          ^
  141.   
  142.   int sk_insert(STACK *st, char *data, int loc)

crypto/evp/evp_pbe.c:221:8: 
219.   	if (!pbe_algs)
220.   		pbe_algs = sk_new(pbe_cmp);
221. > 	if (!(pbe_tmp = (EVP_PBE_CTL*) OPENSSL_malloc (sizeof(EVP_PBE_CTL))))
222.   		{
223.   		EVPerr(EVP_F_EVP_PBE_ALG_ADD_TYPE,ERR_R_MALLOC_FAILURE);

crypto/mem.c:291:1: start of procedure CRYPTO_malloc()
  289.   	}
  290.   
  291. > void *CRYPTO_malloc(int num, const char *file, int line)
  292.   	{
  293.   	void *ret = NULL;

crypto/mem.c:293:2: 
  291.   void *CRYPTO_malloc(int num, const char *file, int line)
  292.   	{
  293. > 	void *ret = NULL;
  294.   	extern unsigned char cleanse_ctr;
  295.   

crypto/mem.c:296:6: Taking false branch
  294.   	extern unsigned char cleanse_ctr;
  295.   
  296.   	if (num <= 0) return NULL;
              ^
  297.   
  298.   	allow_customize = 0;

crypto/mem.c:298:2: 
  296.   	if (num <= 0) return NULL;
  297.   
  298. > 	allow_customize = 0;
  299.   	if (malloc_debug_func != NULL)
  300.   		{

crypto/mem.c:299:6: Taking false branch
  297.   
  298.   	allow_customize = 0;
  299.   	if (malloc_debug_func != NULL)
              ^
  300.   		{
  301.   		allow_customize_debug = 0;

crypto/mem.c:304:2: Skipping __function_pointer__(): unresolved function pointer
  302.   		malloc_debug_func(NULL, num, file, line, 0);
  303.   		}
  304.   	ret = malloc_ex_func(num,file,line);
          ^
  305.   #ifdef LEVITTE_DEBUG_MEM
  306.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);

crypto/mem.c:308:6: Taking false branch
  306.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);
  307.   #endif
  308.   	if (malloc_debug_func != NULL)
              ^
  309.   		malloc_debug_func(ret, num, file, line, 1);
  310.   

crypto/mem.c:314:12: Taking true branch
  312.            * sanitisation function can't be optimised out. NB: We only do
  313.            * this for >2Kb so the overhead doesn't bother us. */
  314.           if(ret && (num > 2048))
                    ^
  315.                   ((unsigned char *)ret)[0] = cleanse_ctr;
  316.   

crypto/mem.c:314:20: Taking false branch
  312.            * sanitisation function can't be optimised out. NB: We only do
  313.            * this for >2Kb so the overhead doesn't bother us. */
  314.           if(ret && (num > 2048))
                            ^
  315.                   ((unsigned char *)ret)[0] = cleanse_ctr;
  316.   

crypto/mem.c:317:2: 
  315.                   ((unsigned char *)ret)[0] = cleanse_ctr;
  316.   
  317. > 	return ret;
  318.   	}
  319.   

crypto/mem.c:318:2: return from a call to CRYPTO_malloc
  316.   
  317.   	return ret;
  318.   	}
          ^
  319.   
  320.   void *CRYPTO_realloc(void *str, int num, const char *file, int line)

crypto/evp/evp_pbe.c:221:8: Taking false branch
219.   	if (!pbe_algs)
220.   		pbe_algs = sk_new(pbe_cmp);
221.   	if (!(pbe_tmp = (EVP_PBE_CTL*) OPENSSL_malloc (sizeof(EVP_PBE_CTL))))
              ^
222.   		{
223.   		EVPerr(EVP_F_EVP_PBE_ALG_ADD_TYPE,ERR_R_MALLOC_FAILURE);

crypto/evp/evp_pbe.c:226:2: 
224.   		return 0;
225.   		}
226. > 	pbe_tmp->pbe_type = pbe_type;
227.   	pbe_tmp->pbe_nid = pbe_nid;
228.   	pbe_tmp->cipher_nid = cipher_nid;

crypto/evp/evp_pbe.c:227:2: 
225.   		}
226.   	pbe_tmp->pbe_type = pbe_type;
227. > 	pbe_tmp->pbe_nid = pbe_nid;
228.   	pbe_tmp->cipher_nid = cipher_nid;
229.   	pbe_tmp->md_nid = md_nid;

crypto/evp/evp_pbe.c:228:2: 
226.   	pbe_tmp->pbe_type = pbe_type;
227.   	pbe_tmp->pbe_nid = pbe_nid;
228. > 	pbe_tmp->cipher_nid = cipher_nid;
229.   	pbe_tmp->md_nid = md_nid;
230.   	pbe_tmp->keygen = keygen;

crypto/evp/evp_pbe.c:229:2: 
227.   	pbe_tmp->pbe_nid = pbe_nid;
228.   	pbe_tmp->cipher_nid = cipher_nid;
229. > 	pbe_tmp->md_nid = md_nid;
230.   	pbe_tmp->keygen = keygen;
231.   

crypto/evp/evp_pbe.c:230:2: 
228.   	pbe_tmp->cipher_nid = cipher_nid;
229.   	pbe_tmp->md_nid = md_nid;
230. > 	pbe_tmp->keygen = keygen;
231.   
232.   

crypto/evp/evp_pbe.c:233:2: 
231.   
232.   
233. > 	sk_push (pbe_algs, (char *)pbe_tmp);
234.   	return 1;
235.   	}

crypto/stack/stack.c:251:1: start of procedure sk_push()
  249.   	}
  250.   
  251. > int sk_push(STACK *st, char *data)
  252.   	{
  253.   	return(sk_insert(st,data,st->num));

crypto/stack/stack.c:253:2: Skipping sk_insert(): empty list of specs
  251.   int sk_push(STACK *st, char *data)
  252.   	{
  253.   	return(sk_insert(st,data,st->num));
          ^
  254.   	}
  255.   
