crypto/ts/ts_rsp_verify.c:571: error: NULL_DEREFERENCE
  pointer `md_ctx` last assigned on line 532 could be null and is dereferenced by call to `EVP_MD_CTX_free()` at line 571, column 5.
Showing all 17 steps of the trace


crypto/ts/ts_rsp_verify.c:525:1: start of procedure ts_compute_imprint()
523.   }
524.   
525. > static int ts_compute_imprint(BIO *data, TS_TST_INFO *tst_info,
526.                                 X509_ALGOR **md_alg,
527.                                 unsigned char **imprint, unsigned *imprint_len)

crypto/ts/ts_rsp_verify.c:529:5: 
527.                                 unsigned char **imprint, unsigned *imprint_len)
528.   {
529. >     TS_MSG_IMPRINT *msg_imprint = tst_info->msg_imprint;
530.       X509_ALGOR *md_alg_resp = msg_imprint->hash_algo;
531.       const EVP_MD *md;

crypto/ts/ts_rsp_verify.c:530:5: 
528.   {
529.       TS_MSG_IMPRINT *msg_imprint = tst_info->msg_imprint;
530. >     X509_ALGOR *md_alg_resp = msg_imprint->hash_algo;
531.       const EVP_MD *md;
532.       EVP_MD_CTX *md_ctx = NULL;

crypto/ts/ts_rsp_verify.c:532:5: 
530.       X509_ALGOR *md_alg_resp = msg_imprint->hash_algo;
531.       const EVP_MD *md;
532. >     EVP_MD_CTX *md_ctx = NULL;
533.       unsigned char buffer[4096];
534.       int length;

crypto/ts/ts_rsp_verify.c:536:5: 
534.       int length;
535.   
536. >     *md_alg = NULL;
537.       *imprint = NULL;
538.   

crypto/ts/ts_rsp_verify.c:537:5: 
535.   
536.       *md_alg = NULL;
537. >     *imprint = NULL;
538.   
539.       if ((*md_alg = X509_ALGOR_dup(md_alg_resp)) == NULL)

crypto/ts/ts_rsp_verify.c:539:9: 
537.       *imprint = NULL;
538.   
539. >     if ((*md_alg = X509_ALGOR_dup(md_alg_resp)) == NULL)
540.           goto err;
541.       if ((md = EVP_get_digestbyobj((*md_alg)->algorithm)) == NULL) {

crypto/asn1/x_algor.c:77:1: start of procedure X509_ALGOR_dup()
  75.   IMPLEMENT_ASN1_FUNCTIONS(X509_ALGOR)
  76.   IMPLEMENT_ASN1_ENCODE_FUNCTIONS_fname(X509_ALGORS, X509_ALGORS, X509_ALGORS)
  77. > IMPLEMENT_ASN1_DUP_FUNCTION(X509_ALGOR)
  78.   
  79.   int X509_ALGOR_set0(X509_ALGOR *alg, ASN1_OBJECT *aobj, int ptype, void *pval)

crypto/asn1/a_dup.c:98:1: start of procedure ASN1_item_dup()
    96.    */
    97.   
    98. > void *ASN1_item_dup(const ASN1_ITEM *it, void *x)
    99.   {
    100.       unsigned char *b = NULL;

crypto/asn1/a_dup.c:100:5: 
    98.   void *ASN1_item_dup(const ASN1_ITEM *it, void *x)
    99.   {
    100. >     unsigned char *b = NULL;
    101.       const unsigned char *p;
    102.       long i;

crypto/asn1/a_dup.c:105:9: Taking true branch
    103.       void *ret;
    104.   
    105.       if (x == NULL)
                   ^
    106.           return (NULL);
    107.   

crypto/asn1/a_dup.c:106:9: 
    104.   
    105.       if (x == NULL)
    106. >         return (NULL);
    107.   
    108.       i = ASN1_item_i2d(x, &b, it);

crypto/asn1/a_dup.c:117:1: return from a call to ASN1_item_dup
    115.       OPENSSL_free(b);
    116.       return (ret);
    117. > }

crypto/asn1/x_algor.c:77:1: return from a call to X509_ALGOR_dup
  75.   IMPLEMENT_ASN1_FUNCTIONS(X509_ALGOR)
  76.   IMPLEMENT_ASN1_ENCODE_FUNCTIONS_fname(X509_ALGORS, X509_ALGORS, X509_ALGORS)
  77. > IMPLEMENT_ASN1_DUP_FUNCTION(X509_ALGOR)
  78.   
  79.   int X509_ALGOR_set0(X509_ALGOR *alg, ASN1_OBJECT *aobj, int ptype, void *pval)

crypto/ts/ts_rsp_verify.c:539:9: Taking true branch
537.       *imprint = NULL;
538.   
539.       if ((*md_alg = X509_ALGOR_dup(md_alg_resp)) == NULL)
               ^
540.           goto err;
541.       if ((md = EVP_get_digestbyobj((*md_alg)->algorithm)) == NULL) {

crypto/ts/ts_rsp_verify.c:570:2: 
568.   
569.       return 1;
570. >  err:
571.       EVP_MD_CTX_free(md_ctx);
572.       X509_ALGOR_free(*md_alg);

crypto/ts/ts_rsp_verify.c:571:5: 
569.       return 1;
570.    err:
571. >     EVP_MD_CTX_free(md_ctx);
572.       X509_ALGOR_free(*md_alg);
573.       OPENSSL_free(*imprint);
