crypto/pem/pem_all.c:191: error: NULL_DEREFERENCE
  pointer `pktmp` last assigned on line 190 could be null and is dereferenced by call to `pkey_get_rsa()` at line 191, column 9.
Showing all 56 steps of the trace


crypto/pem/pem_all.c:186:1: start of procedure PEM_read_RSAPrivateKey()
184.   #ifndef OPENSSL_NO_FP_API
185.   
186. > RSA *PEM_read_RSAPrivateKey(FILE *fp, RSA **rsa, pem_password_cb *cb,
187.   								void *u)
188.   {

crypto/pem/pem_all.c:190:2: 
188.   {
189.   	EVP_PKEY *pktmp;
190. > 	pktmp = PEM_read_PrivateKey(fp, NULL, cb, u);
191.   	return pkey_get_rsa(pktmp, rsa);
192.   }

crypto/pem/pem_pkey.c:209:1: start of procedure PEM_read_PrivateKey()
  207.   
  208.   #ifndef OPENSSL_NO_FP_API
  209. > EVP_PKEY *PEM_read_PrivateKey(FILE *fp, EVP_PKEY **x, pem_password_cb *cb, void *u)
  210.   	{
  211.           BIO *b;

crypto/pem/pem_pkey.c:214:13: 
  212.           EVP_PKEY *ret;
  213.   
  214. >         if ((b=BIO_new(BIO_s_file())) == NULL)
  215.   		{
  216.   		PEMerr(PEM_F_PEM_READ_PRIVATEKEY,ERR_R_BUF_LIB);

crypto/bio/bss_file.c:157:1: start of procedure BIO_s_file()
    155.   	}
    156.   
    157. > BIO_METHOD *BIO_s_file(void)
    158.   	{
    159.   	return(&methods_filep);

crypto/bio/bss_file.c:159:2: 
    157.   BIO_METHOD *BIO_s_file(void)
    158.   	{
    159. > 	return(&methods_filep);
    160.   	}
    161.   

crypto/bio/bss_file.c:160:2: return from a call to BIO_s_file
    158.   	{
    159.   	return(&methods_filep);
    160.   	}
            ^
    161.   
    162.   static int MS_CALLBACK file_new(BIO *bi)

crypto/bio/bio_lib.c:66:1: start of procedure BIO_new()
    64.   #include <openssl/stack.h>
    65.   
    66. > BIO *BIO_new(BIO_METHOD *method)
    67.   	{
    68.   	BIO *ret=NULL;

crypto/bio/bio_lib.c:68:2: 
    66.   BIO *BIO_new(BIO_METHOD *method)
    67.   	{
    68. > 	BIO *ret=NULL;
    69.   
    70.   	ret=(BIO *)OPENSSL_malloc(sizeof(BIO));

crypto/bio/bio_lib.c:70:2: 
    68.   	BIO *ret=NULL;
    69.   
    70. > 	ret=(BIO *)OPENSSL_malloc(sizeof(BIO));
    71.   	if (ret == NULL)
    72.   		{

crypto/mem.c:294:1: start of procedure CRYPTO_malloc()
      292.   	}
      293.   
      294. > void *CRYPTO_malloc(int num, const char *file, int line)
      295.   	{
      296.   	void *ret = NULL;

crypto/mem.c:296:2: 
      294.   void *CRYPTO_malloc(int num, const char *file, int line)
      295.   	{
      296. > 	void *ret = NULL;
      297.   
      298.   	if (num <= 0) return NULL;

crypto/mem.c:298:6: Taking false branch
      296.   	void *ret = NULL;
      297.   
      298.   	if (num <= 0) return NULL;
                  ^
      299.   
      300.   	allow_customize = 0;

crypto/mem.c:300:2: 
      298.   	if (num <= 0) return NULL;
      299.   
      300. > 	allow_customize = 0;
      301.   	if (malloc_debug_func != NULL)
      302.   		{

crypto/mem.c:301:6: Taking true branch
      299.   
      300.   	allow_customize = 0;
      301.   	if (malloc_debug_func != NULL)
                  ^
      302.   		{
      303.   		allow_customize_debug = 0;

crypto/mem.c:303:3: 
      301.   	if (malloc_debug_func != NULL)
      302.   		{
      303. > 		allow_customize_debug = 0;
      304.   		malloc_debug_func(NULL, num, file, line, 0);
      305.   		}

crypto/mem.c:304:3: Skipping __function_pointer__(): unresolved function pointer
      302.   		{
      303.   		allow_customize_debug = 0;
      304.   		malloc_debug_func(NULL, num, file, line, 0);
               ^
      305.   		}
      306.   	ret = malloc_ex_func(num,file,line);

crypto/mem.c:306:2: Skipping __function_pointer__(): unresolved function pointer
      304.   		malloc_debug_func(NULL, num, file, line, 0);
      305.   		}
      306.   	ret = malloc_ex_func(num,file,line);
              ^
      307.   #ifdef LEVITTE_DEBUG_MEM
      308.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);

crypto/mem.c:310:6: Taking true branch
      308.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);
      309.   #endif
      310.   	if (malloc_debug_func != NULL)
                  ^
      311.   		malloc_debug_func(ret, num, file, line, 1);
      312.   

crypto/mem.c:311:3: Skipping __function_pointer__(): unresolved function pointer
      309.   #endif
      310.   	if (malloc_debug_func != NULL)
      311.   		malloc_debug_func(ret, num, file, line, 1);
               ^
      312.   
      313.   #ifndef OPENSSL_CPUID_OBJ

crypto/mem.c:317:12: Taking false branch
      315.            * sanitisation function can't be optimised out. NB: We only do
      316.            * this for >2Kb so the overhead doesn't bother us. */
      317.           if(ret && (num > 2048))
                        ^
      318.   	{	extern unsigned char cleanse_ctr;
      319.                   ((unsigned char *)ret)[0] = cleanse_ctr;

crypto/mem.c:323:2: 
      321.   #endif
      322.   
      323. > 	return ret;
      324.   	}
      325.   

crypto/mem.c:324:2: return from a call to CRYPTO_malloc
      322.   
      323.   	return ret;
      324.   	}
              ^
      325.   
      326.   void *CRYPTO_realloc(void *str, int num, const char *file, int line)

crypto/bio/bio_lib.c:71:6: Taking true branch
    69.   
    70.   	ret=(BIO *)OPENSSL_malloc(sizeof(BIO));
    71.   	if (ret == NULL)
               ^
    72.   		{
    73.   		BIOerr(BIO_F_BIO_NEW,ERR_R_MALLOC_FAILURE);

crypto/bio/bio_lib.c:73:3: 
    71.   	if (ret == NULL)
    72.   		{
    73. > 		BIOerr(BIO_F_BIO_NEW,ERR_R_MALLOC_FAILURE);
    74.   		return(NULL);
    75.   		}

crypto/err/err.c:706:1: start of procedure ERR_put_error()
      704.   /********************************************************/
      705.   
      706. > void ERR_put_error(int lib, int func, int reason, const char *file,
      707.   	     int line)
      708.   	{

crypto/err/err.c:730:2: Skipping ERR_get_state(): empty list of specs
      728.   	}
      729.   #endif
      730.   	es=ERR_get_state();
              ^
      731.   
      732.   	es->top=(es->top+1)%ERR_NUM_ERRORS;

crypto/err/err.c:732:2: 
      730.   	es=ERR_get_state();
      731.   
      732. > 	es->top=(es->top+1)%ERR_NUM_ERRORS;
      733.   	if (es->top == es->bottom)
      734.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;

crypto/err/err.c:733:6: Taking false branch
      731.   
      732.   	es->top=(es->top+1)%ERR_NUM_ERRORS;
      733.   	if (es->top == es->bottom)
                  ^
      734.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
      735.   	es->err_flags[es->top]=0;

crypto/err/err.c:735:2: 
      733.   	if (es->top == es->bottom)
      734.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
      735. > 	es->err_flags[es->top]=0;
      736.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
      737.   	es->err_file[es->top]=file;

crypto/err/err.c:736:2: 
      734.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
      735.   	es->err_flags[es->top]=0;
      736. > 	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
      737.   	es->err_file[es->top]=file;
      738.   	es->err_line[es->top]=line;

crypto/err/err.c:737:2: 
      735.   	es->err_flags[es->top]=0;
      736.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
      737. > 	es->err_file[es->top]=file;
      738.   	es->err_line[es->top]=line;
      739.   	err_clear_data(es,es->top);

crypto/err/err.c:738:2: 
      736.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
      737.   	es->err_file[es->top]=file;
      738. > 	es->err_line[es->top]=line;
      739.   	err_clear_data(es,es->top);
      740.   	}

crypto/err/err.c:739:2: Taking true branch
      737.   	es->err_file[es->top]=file;
      738.   	es->err_line[es->top]=line;
      739.   	err_clear_data(es,es->top);
              ^
      740.   	}
      741.   

crypto/err/err.c:739:2: Taking false branch
      737.   	es->err_file[es->top]=file;
      738.   	es->err_line[es->top]=line;
      739.   	err_clear_data(es,es->top);
              ^
      740.   	}
      741.   

crypto/err/err.c:739:2: Loop condition is false. Leaving loop
      737.   	es->err_file[es->top]=file;
      738.   	es->err_line[es->top]=line;
      739.   	err_clear_data(es,es->top);
              ^
      740.   	}
      741.   

crypto/err/err.c:740:2: return from a call to ERR_put_error
      738.   	es->err_line[es->top]=line;
      739.   	err_clear_data(es,es->top);
      740.   	}
              ^
      741.   
      742.   void ERR_clear_error(void)

crypto/bio/bio_lib.c:74:3: 
    72.   		{
    73.   		BIOerr(BIO_F_BIO_NEW,ERR_R_MALLOC_FAILURE);
    74. > 		return(NULL);
    75.   		}
    76.   	if (!BIO_set(ret,method))

crypto/bio/bio_lib.c:82:2: return from a call to BIO_new
    80.   		}
    81.   	return(ret);
    82.   	}
           ^
    83.   
    84.   int BIO_set(BIO *bio, BIO_METHOD *method)

crypto/pem/pem_pkey.c:214:13: Taking true branch
  212.           EVP_PKEY *ret;
  213.   
  214.           if ((b=BIO_new(BIO_s_file())) == NULL)
                     ^
  215.   		{
  216.   		PEMerr(PEM_F_PEM_READ_PRIVATEKEY,ERR_R_BUF_LIB);

crypto/pem/pem_pkey.c:216:3: 
  214.           if ((b=BIO_new(BIO_s_file())) == NULL)
  215.   		{
  216. > 		PEMerr(PEM_F_PEM_READ_PRIVATEKEY,ERR_R_BUF_LIB);
  217.                   return(0);
  218.   		}

crypto/err/err.c:706:1: start of procedure ERR_put_error()
    704.   /********************************************************/
    705.   
    706. > void ERR_put_error(int lib, int func, int reason, const char *file,
    707.   	     int line)
    708.   	{

crypto/err/err.c:730:2: Skipping ERR_get_state(): empty list of specs
    728.   	}
    729.   #endif
    730.   	es=ERR_get_state();
            ^
    731.   
    732.   	es->top=(es->top+1)%ERR_NUM_ERRORS;

crypto/err/err.c:732:2: 
    730.   	es=ERR_get_state();
    731.   
    732. > 	es->top=(es->top+1)%ERR_NUM_ERRORS;
    733.   	if (es->top == es->bottom)
    734.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;

crypto/err/err.c:733:6: Taking false branch
    731.   
    732.   	es->top=(es->top+1)%ERR_NUM_ERRORS;
    733.   	if (es->top == es->bottom)
                ^
    734.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
    735.   	es->err_flags[es->top]=0;

crypto/err/err.c:735:2: 
    733.   	if (es->top == es->bottom)
    734.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
    735. > 	es->err_flags[es->top]=0;
    736.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
    737.   	es->err_file[es->top]=file;

crypto/err/err.c:736:2: 
    734.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
    735.   	es->err_flags[es->top]=0;
    736. > 	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
    737.   	es->err_file[es->top]=file;
    738.   	es->err_line[es->top]=line;

crypto/err/err.c:737:2: 
    735.   	es->err_flags[es->top]=0;
    736.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
    737. > 	es->err_file[es->top]=file;
    738.   	es->err_line[es->top]=line;
    739.   	err_clear_data(es,es->top);

crypto/err/err.c:738:2: 
    736.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
    737.   	es->err_file[es->top]=file;
    738. > 	es->err_line[es->top]=line;
    739.   	err_clear_data(es,es->top);
    740.   	}

crypto/err/err.c:739:2: Taking true branch
    737.   	es->err_file[es->top]=file;
    738.   	es->err_line[es->top]=line;
    739.   	err_clear_data(es,es->top);
            ^
    740.   	}
    741.   

crypto/err/err.c:739:2: Taking false branch
    737.   	es->err_file[es->top]=file;
    738.   	es->err_line[es->top]=line;
    739.   	err_clear_data(es,es->top);
            ^
    740.   	}
    741.   

crypto/err/err.c:739:2: Loop condition is false. Leaving loop
    737.   	es->err_file[es->top]=file;
    738.   	es->err_line[es->top]=line;
    739.   	err_clear_data(es,es->top);
            ^
    740.   	}
    741.   

crypto/err/err.c:740:2: return from a call to ERR_put_error
    738.   	es->err_line[es->top]=line;
    739.   	err_clear_data(es,es->top);
    740.   	}
            ^
    741.   
    742.   void ERR_clear_error(void)

crypto/pem/pem_pkey.c:217:17: 
  215.   		{
  216.   		PEMerr(PEM_F_PEM_READ_PRIVATEKEY,ERR_R_BUF_LIB);
  217. >                 return(0);
  218.   		}
  219.           BIO_set_fp(b,fp,BIO_NOCLOSE);

crypto/pem/pem_pkey.c:223:2: return from a call to PEM_read_PrivateKey
  221.           BIO_free(b);
  222.           return(ret);
  223.   	}
          ^
  224.   
  225.   int PEM_write_PrivateKey(FILE *fp, EVP_PKEY *x, const EVP_CIPHER *enc,

crypto/pem/pem_all.c:191:2: 
189.   	EVP_PKEY *pktmp;
190.   	pktmp = PEM_read_PrivateKey(fp, NULL, cb, u);
191. > 	return pkey_get_rsa(pktmp, rsa);
192.   }
193.   
