apps/dgst.c:410: error: NULL_DEREFERENCE
  pointer `sigkey` last assigned on line 100 could be null and is dereferenced by call to `EVP_PKEY_free()` at line 410, column 2.
Showing all 51 steps of the trace


apps/dgst.c:82:1: start of procedure dgst_main()
80.   int MAIN(int, char **);
81.   
82. > int MAIN(int argc, char **argv)
83.   	{
84.   	ENGINE *e = NULL;

apps/dgst.c:84:2: 
82.   int MAIN(int argc, char **argv)
83.   	{
84. > 	ENGINE *e = NULL;
85.   	unsigned char *buf=NULL;
86.   	int i,err=0;

apps/dgst.c:85:2: 
83.   	{
84.   	ENGINE *e = NULL;
85. > 	unsigned char *buf=NULL;
86.   	int i,err=0;
87.   	const EVP_MD *md=NULL,*m;

apps/dgst.c:86:2: 
84.   	ENGINE *e = NULL;
85.   	unsigned char *buf=NULL;
86. > 	int i,err=0;
87.   	const EVP_MD *md=NULL,*m;
88.   	BIO *in=NULL,*inp;

apps/dgst.c:87:2: 
85.   	unsigned char *buf=NULL;
86.   	int i,err=0;
87. > 	const EVP_MD *md=NULL,*m;
88.   	BIO *in=NULL,*inp;
89.   	BIO *bmd=NULL;

apps/dgst.c:88:2: 
86.   	int i,err=0;
87.   	const EVP_MD *md=NULL,*m;
88. > 	BIO *in=NULL,*inp;
89.   	BIO *bmd=NULL;
90.   	BIO *out = NULL;

apps/dgst.c:89:2: 
87.   	const EVP_MD *md=NULL,*m;
88.   	BIO *in=NULL,*inp;
89. > 	BIO *bmd=NULL;
90.   	BIO *out = NULL;
91.   	const char *name;

apps/dgst.c:90:2: 
88.   	BIO *in=NULL,*inp;
89.   	BIO *bmd=NULL;
90. > 	BIO *out = NULL;
91.   	const char *name;
92.   #define PROG_NAME_SIZE  39

apps/dgst.c:94:2: 
92.   #define PROG_NAME_SIZE  39
93.   	char pname[PROG_NAME_SIZE+1];
94. > 	int separator=0;
95.   	int debug=0;
96.   	int keyform=FORMAT_PEM;

apps/dgst.c:95:2: 
93.   	char pname[PROG_NAME_SIZE+1];
94.   	int separator=0;
95. > 	int debug=0;
96.   	int keyform=FORMAT_PEM;
97.   	const char *outfile = NULL, *keyfile = NULL;

apps/dgst.c:96:2: 
94.   	int separator=0;
95.   	int debug=0;
96. > 	int keyform=FORMAT_PEM;
97.   	const char *outfile = NULL, *keyfile = NULL;
98.   	const char *sigfile = NULL, *randfile = NULL;

apps/dgst.c:97:2: 
95.   	int debug=0;
96.   	int keyform=FORMAT_PEM;
97. > 	const char *outfile = NULL, *keyfile = NULL;
98.   	const char *sigfile = NULL, *randfile = NULL;
99.   	int out_bin = -1, want_pub = 0, do_verify = 0;

apps/dgst.c:98:2: 
96.   	int keyform=FORMAT_PEM;
97.   	const char *outfile = NULL, *keyfile = NULL;
98. > 	const char *sigfile = NULL, *randfile = NULL;
99.   	int out_bin = -1, want_pub = 0, do_verify = 0;
100.   	EVP_PKEY *sigkey = NULL;

apps/dgst.c:99:2: 
97.   	const char *outfile = NULL, *keyfile = NULL;
98.   	const char *sigfile = NULL, *randfile = NULL;
99. > 	int out_bin = -1, want_pub = 0, do_verify = 0;
100.   	EVP_PKEY *sigkey = NULL;
101.   	unsigned char *sigbuf = NULL;

apps/dgst.c:100:2: 
98.   	const char *sigfile = NULL, *randfile = NULL;
99.   	int out_bin = -1, want_pub = 0, do_verify = 0;
100. > 	EVP_PKEY *sigkey = NULL;
101.   	unsigned char *sigbuf = NULL;
102.   	int siglen = 0;

apps/dgst.c:101:2: 
99.   	int out_bin = -1, want_pub = 0, do_verify = 0;
100.   	EVP_PKEY *sigkey = NULL;
101. > 	unsigned char *sigbuf = NULL;
102.   	int siglen = 0;
103.   	char *passargin = NULL, *passin = NULL;

apps/dgst.c:102:2: 
100.   	EVP_PKEY *sigkey = NULL;
101.   	unsigned char *sigbuf = NULL;
102. > 	int siglen = 0;
103.   	char *passargin = NULL, *passin = NULL;
104.   #ifndef OPENSSL_NO_ENGINE

apps/dgst.c:103:2: 
101.   	unsigned char *sigbuf = NULL;
102.   	int siglen = 0;
103. > 	char *passargin = NULL, *passin = NULL;
104.   #ifndef OPENSSL_NO_ENGINE
105.   	char *engine=NULL;

apps/dgst.c:105:2: 
103.   	char *passargin = NULL, *passin = NULL;
104.   #ifndef OPENSSL_NO_ENGINE
105. > 	char *engine=NULL;
106.   #endif
107.   

apps/dgst.c:108:2: 
106.   #endif
107.   
108. > 	apps_startup();
109.   
110.   	if ((buf=(unsigned char *)OPENSSL_malloc(BUFSIZE)) == NULL)

apps/dgst.c:110:6: 
108.   	apps_startup();
109.   
110. > 	if ((buf=(unsigned char *)OPENSSL_malloc(BUFSIZE)) == NULL)
111.   		{
112.   		BIO_printf(bio_err,"out of memory\n");

crypto/mem.c:291:1: start of procedure CRYPTO_malloc()
  289.   	}
  290.   
  291. > void *CRYPTO_malloc(int num, const char *file, int line)
  292.   	{
  293.   	void *ret = NULL;

crypto/mem.c:293:2: 
  291.   void *CRYPTO_malloc(int num, const char *file, int line)
  292.   	{
  293. > 	void *ret = NULL;
  294.   	extern unsigned char cleanse_ctr;
  295.   

crypto/mem.c:296:6: Taking false branch
  294.   	extern unsigned char cleanse_ctr;
  295.   
  296.   	if (num <= 0) return NULL;
              ^
  297.   
  298.   	allow_customize = 0;

crypto/mem.c:298:2: 
  296.   	if (num <= 0) return NULL;
  297.   
  298. > 	allow_customize = 0;
  299.   	if (malloc_debug_func != NULL)
  300.   		{

crypto/mem.c:299:6: Taking true branch
  297.   
  298.   	allow_customize = 0;
  299.   	if (malloc_debug_func != NULL)
              ^
  300.   		{
  301.   		allow_customize_debug = 0;

crypto/mem.c:301:3: 
  299.   	if (malloc_debug_func != NULL)
  300.   		{
  301. > 		allow_customize_debug = 0;
  302.   		malloc_debug_func(NULL, num, file, line, 0);
  303.   		}

crypto/mem.c:302:3: Skipping __function_pointer__(): unresolved function pointer
  300.   		{
  301.   		allow_customize_debug = 0;
  302.   		malloc_debug_func(NULL, num, file, line, 0);
           ^
  303.   		}
  304.   	ret = malloc_ex_func(num,file,line);

crypto/mem.c:304:2: Skipping __function_pointer__(): unresolved function pointer
  302.   		malloc_debug_func(NULL, num, file, line, 0);
  303.   		}
  304.   	ret = malloc_ex_func(num,file,line);
          ^
  305.   #ifdef LEVITTE_DEBUG_MEM
  306.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);

crypto/mem.c:308:6: Taking true branch
  306.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);
  307.   #endif
  308.   	if (malloc_debug_func != NULL)
              ^
  309.   		malloc_debug_func(ret, num, file, line, 1);
  310.   

crypto/mem.c:309:3: Skipping __function_pointer__(): unresolved function pointer
  307.   #endif
  308.   	if (malloc_debug_func != NULL)
  309.   		malloc_debug_func(ret, num, file, line, 1);
           ^
  310.   
  311.           /* Create a dependency on the value of 'cleanse_ctr' so our memory

crypto/mem.c:314:12: Taking false branch
  312.            * sanitisation function can't be optimised out. NB: We only do
  313.            * this for >2Kb so the overhead doesn't bother us. */
  314.           if(ret && (num > 2048))
                    ^
  315.                   ((unsigned char *)ret)[0] = cleanse_ctr;
  316.   

crypto/mem.c:317:2: 
  315.                   ((unsigned char *)ret)[0] = cleanse_ctr;
  316.   
  317. > 	return ret;
  318.   	}
  319.   

crypto/mem.c:318:2: return from a call to CRYPTO_malloc
  316.   
  317.   	return ret;
  318.   	}
          ^
  319.   
  320.   void *CRYPTO_realloc(void *str, int num, const char *file, int line)

apps/dgst.c:110:6: Taking true branch
108.   	apps_startup();
109.   
110.   	if ((buf=(unsigned char *)OPENSSL_malloc(BUFSIZE)) == NULL)
            ^
111.   		{
112.   		BIO_printf(bio_err,"out of memory\n");

apps/dgst.c:112:3: 
110.   	if ((buf=(unsigned char *)OPENSSL_malloc(BUFSIZE)) == NULL)
111.   		{
112. > 		BIO_printf(bio_err,"out of memory\n");
113.   		goto end;
114.   		}

crypto/bio/b_print.c:768:1: start of procedure BIO_printf()
  766.   /***************************************************************************/
  767.   
  768. > int BIO_printf (BIO *bio, const char *format, ...)
  769.   	{
  770.   	va_list args;

crypto/bio/b_print.c:773:2: 
  771.   	int ret;
  772.   
  773. > 	va_start(args, format);
  774.   
  775.   	ret = BIO_vprintf(bio, format, args);

crypto/bio/b_print.c:775:2: Skipping BIO_vprintf(): empty list of specs
  773.   	va_start(args, format);
  774.   
  775.   	ret = BIO_vprintf(bio, format, args);
          ^
  776.   
  777.   	va_end(args);

crypto/bio/b_print.c:777:2: 
  775.   	ret = BIO_vprintf(bio, format, args);
  776.   
  777. > 	va_end(args);
  778.   	return(ret);
  779.   	}

crypto/bio/b_print.c:778:2: 
  776.   
  777.   	va_end(args);
  778. > 	return(ret);
  779.   	}
  780.   

crypto/bio/b_print.c:779:2: return from a call to BIO_printf
  777.   	va_end(args);
  778.   	return(ret);
  779.   	}
          ^
  780.   
  781.   int BIO_vprintf (BIO *bio, const char *format, va_list args)

apps/dgst.c:400:1: 
398.   			}
399.   		}
400. > end:
401.   	if (buf != NULL)
402.   		{

apps/dgst.c:401:6: Taking false branch
399.   		}
400.   end:
401.   	if (buf != NULL)
            ^
402.   		{
403.   		OPENSSL_cleanse(buf,BUFSIZE);

apps/dgst.c:406:6: Taking false branch
404.   		OPENSSL_free(buf);
405.   		}
406.   	if (in != NULL) BIO_free(in);
            ^
407.   	if (passin)
408.   		OPENSSL_free(passin);

apps/dgst.c:407:6: Taking false branch
405.   		}
406.   	if (in != NULL) BIO_free(in);
407.   	if (passin)
            ^
408.   		OPENSSL_free(passin);
409.   	BIO_free_all(out);

apps/dgst.c:409:2: 
407.   	if (passin)
408.   		OPENSSL_free(passin);
409. > 	BIO_free_all(out);
410.   	EVP_PKEY_free(sigkey);
411.   	if(sigbuf) OPENSSL_free(sigbuf);

crypto/bio/bio_lib.c:460:1: start of procedure BIO_free_all()
  458.   	}
  459.   
  460. > void BIO_free_all(BIO *bio)
  461.   	{
  462.   	BIO *b;

crypto/bio/bio_lib.c:465:9: Loop condition is false. Leaving loop
  463.   	int ref;
  464.   
  465.   	while (bio != NULL)
                 ^
  466.   		{
  467.   		b=bio;

crypto/bio/bio_lib.c:474:2: return from a call to BIO_free_all
  472.   		if (ref > 1) break;
  473.   		}
  474.   	}
          ^
  475.   
  476.   BIO *BIO_dup_chain(BIO *in)

apps/dgst.c:410:2: 
408.   		OPENSSL_free(passin);
409.   	BIO_free_all(out);
410. > 	EVP_PKEY_free(sigkey);
411.   	if(sigbuf) OPENSSL_free(sigbuf);
412.   	if (bmd != NULL) BIO_free(bmd);
