crypto/evp/evp_pbe.c:128: error: NULL_DEREFERENCE
  pointer `pbe_algs` last assigned on line 119 could be null and is dereferenced by call to `sk_push()` at line 128, column 2.
Showing all 38 steps of the trace


crypto/evp/evp_pbe.c:115:1: start of procedure EVP_PBE_alg_add()
113.   /* Add a PBE algorithm */
114.   
115. > int EVP_PBE_alg_add(int nid, const EVP_CIPHER *cipher, const EVP_MD *md,
116.   	     EVP_PBE_KEYGEN *keygen)
117.   {

crypto/evp/evp_pbe.c:119:7: Taking true branch
117.   {
118.   	EVP_PBE_CTL *pbe_tmp;
119.   	if (!pbe_algs) pbe_algs = sk_new(pbe_cmp);
             ^
120.   	if (!(pbe_tmp = (EVP_PBE_CTL*) OPENSSL_malloc (sizeof(EVP_PBE_CTL)))) {
121.   		EVPerr(EVP_F_EVP_PBE_ALG_ADD,ERR_R_MALLOC_FAILURE);

crypto/evp/evp_pbe.c:119:17: 
117.   {
118.   	EVP_PBE_CTL *pbe_tmp;
119. > 	if (!pbe_algs) pbe_algs = sk_new(pbe_cmp);
120.   	if (!(pbe_tmp = (EVP_PBE_CTL*) OPENSSL_malloc (sizeof(EVP_PBE_CTL)))) {
121.   		EVPerr(EVP_F_EVP_PBE_ALG_ADD,ERR_R_MALLOC_FAILURE);

crypto/stack/stack.c:119:1: start of procedure sk_new()
  117.   	}
  118.   
  119. > STACK *sk_new(int (*c)(const char * const *, const char * const *))
  120.   	{
  121.   	STACK *ret;

crypto/stack/stack.c:124:6: 
  122.   	int i;
  123.   
  124. > 	if ((ret=(STACK *)OPENSSL_malloc(sizeof(STACK))) == NULL)
  125.   		goto err;
  126.   	if ((ret->data=(char **)OPENSSL_malloc(sizeof(char *)*MIN_NODES)) == NULL)

crypto/mem.c:289:1: start of procedure CRYPTO_malloc()
    287.   	}
    288.   
    289. > void *CRYPTO_malloc(int num, const char *file, int line)
    290.   	{
    291.   	void *ret = NULL;

crypto/mem.c:291:2: 
    289.   void *CRYPTO_malloc(int num, const char *file, int line)
    290.   	{
    291. > 	void *ret = NULL;
    292.   	extern unsigned char cleanse_ctr;
    293.   

crypto/mem.c:294:2: 
    292.   	extern unsigned char cleanse_ctr;
    293.   
    294. > 	allow_customize = 0;
    295.   	if (malloc_debug_func != NULL)
    296.   		{

crypto/mem.c:295:6: Taking false branch
    293.   
    294.   	allow_customize = 0;
    295.   	if (malloc_debug_func != NULL)
                ^
    296.   		{
    297.   		allow_customize_debug = 0;

crypto/mem.c:300:2: Skipping __function_pointer__(): unresolved function pointer
    298.   		malloc_debug_func(NULL, num, file, line, 0);
    299.   		}
    300.   	ret = malloc_ex_func(num,file,line);
            ^
    301.   #ifdef LEVITTE_DEBUG_MEM
    302.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);

crypto/mem.c:304:6: Taking false branch
    302.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);
    303.   #endif
    304.   	if (malloc_debug_func != NULL)
                ^
    305.   		malloc_debug_func(ret, num, file, line, 1);
    306.   

crypto/mem.c:310:12: Taking false branch
    308.            * sanitisation function can't be optimised out. NB: We only do
    309.            * this for >2Kb so the overhead doesn't bother us. */
    310.           if(ret && (num > 2048))
                      ^
    311.                   ((unsigned char *)ret)[0] = cleanse_ctr;
    312.   

crypto/mem.c:313:2: 
    311.                   ((unsigned char *)ret)[0] = cleanse_ctr;
    312.   
    313. > 	return ret;
    314.   	}
    315.   

crypto/mem.c:314:2: return from a call to CRYPTO_malloc
    312.   
    313.   	return ret;
    314.   	}
            ^
    315.   
    316.   void *CRYPTO_realloc(void *str, int num, const char *file, int line)

crypto/stack/stack.c:124:6: Taking true branch
  122.   	int i;
  123.   
  124.   	if ((ret=(STACK *)OPENSSL_malloc(sizeof(STACK))) == NULL)
              ^
  125.   		goto err;
  126.   	if ((ret->data=(char **)OPENSSL_malloc(sizeof(char *)*MIN_NODES)) == NULL)

crypto/stack/stack.c:135:1: 
  133.   	ret->sorted=0;
  134.   	return(ret);
  135. > err:
  136.   	if(ret)
  137.   		OPENSSL_free(ret);

crypto/stack/stack.c:136:5: Taking false branch
  134.   	return(ret);
  135.   err:
  136.   	if(ret)
             ^
  137.   		OPENSSL_free(ret);
  138.   	return(NULL);

crypto/stack/stack.c:138:2: 
  136.   	if(ret)
  137.   		OPENSSL_free(ret);
  138. > 	return(NULL);
  139.   	}
  140.   

crypto/stack/stack.c:139:2: return from a call to sk_new
  137.   		OPENSSL_free(ret);
  138.   	return(NULL);
  139.   	}
          ^
  140.   
  141.   int sk_insert(STACK *st, char *data, int loc)

crypto/evp/evp_pbe.c:120:8: 
118.   	EVP_PBE_CTL *pbe_tmp;
119.   	if (!pbe_algs) pbe_algs = sk_new(pbe_cmp);
120. > 	if (!(pbe_tmp = (EVP_PBE_CTL*) OPENSSL_malloc (sizeof(EVP_PBE_CTL)))) {
121.   		EVPerr(EVP_F_EVP_PBE_ALG_ADD,ERR_R_MALLOC_FAILURE);
122.   		return 0;

crypto/mem.c:289:1: start of procedure CRYPTO_malloc()
  287.   	}
  288.   
  289. > void *CRYPTO_malloc(int num, const char *file, int line)
  290.   	{
  291.   	void *ret = NULL;

crypto/mem.c:291:2: 
  289.   void *CRYPTO_malloc(int num, const char *file, int line)
  290.   	{
  291. > 	void *ret = NULL;
  292.   	extern unsigned char cleanse_ctr;
  293.   

crypto/mem.c:294:2: 
  292.   	extern unsigned char cleanse_ctr;
  293.   
  294. > 	allow_customize = 0;
  295.   	if (malloc_debug_func != NULL)
  296.   		{

crypto/mem.c:295:6: Taking false branch
  293.   
  294.   	allow_customize = 0;
  295.   	if (malloc_debug_func != NULL)
              ^
  296.   		{
  297.   		allow_customize_debug = 0;

crypto/mem.c:300:2: Skipping __function_pointer__(): unresolved function pointer
  298.   		malloc_debug_func(NULL, num, file, line, 0);
  299.   		}
  300.   	ret = malloc_ex_func(num,file,line);
          ^
  301.   #ifdef LEVITTE_DEBUG_MEM
  302.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);

crypto/mem.c:304:6: Taking false branch
  302.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);
  303.   #endif
  304.   	if (malloc_debug_func != NULL)
              ^
  305.   		malloc_debug_func(ret, num, file, line, 1);
  306.   

crypto/mem.c:310:12: Taking true branch
  308.            * sanitisation function can't be optimised out. NB: We only do
  309.            * this for >2Kb so the overhead doesn't bother us. */
  310.           if(ret && (num > 2048))
                    ^
  311.                   ((unsigned char *)ret)[0] = cleanse_ctr;
  312.   

crypto/mem.c:310:20: Taking false branch
  308.            * sanitisation function can't be optimised out. NB: We only do
  309.            * this for >2Kb so the overhead doesn't bother us. */
  310.           if(ret && (num > 2048))
                            ^
  311.                   ((unsigned char *)ret)[0] = cleanse_ctr;
  312.   

crypto/mem.c:313:2: 
  311.                   ((unsigned char *)ret)[0] = cleanse_ctr;
  312.   
  313. > 	return ret;
  314.   	}
  315.   

crypto/mem.c:314:2: return from a call to CRYPTO_malloc
  312.   
  313.   	return ret;
  314.   	}
          ^
  315.   
  316.   void *CRYPTO_realloc(void *str, int num, const char *file, int line)

crypto/evp/evp_pbe.c:120:8: Taking false branch
118.   	EVP_PBE_CTL *pbe_tmp;
119.   	if (!pbe_algs) pbe_algs = sk_new(pbe_cmp);
120.   	if (!(pbe_tmp = (EVP_PBE_CTL*) OPENSSL_malloc (sizeof(EVP_PBE_CTL)))) {
              ^
121.   		EVPerr(EVP_F_EVP_PBE_ALG_ADD,ERR_R_MALLOC_FAILURE);
122.   		return 0;

crypto/evp/evp_pbe.c:124:2: 
122.   		return 0;
123.   	}
124. > 	pbe_tmp->pbe_nid = nid;
125.   	pbe_tmp->cipher = cipher;
126.   	pbe_tmp->md = md;

crypto/evp/evp_pbe.c:125:2: 
123.   	}
124.   	pbe_tmp->pbe_nid = nid;
125. > 	pbe_tmp->cipher = cipher;
126.   	pbe_tmp->md = md;
127.   	pbe_tmp->keygen = keygen;

crypto/evp/evp_pbe.c:126:2: 
124.   	pbe_tmp->pbe_nid = nid;
125.   	pbe_tmp->cipher = cipher;
126. > 	pbe_tmp->md = md;
127.   	pbe_tmp->keygen = keygen;
128.   	sk_push (pbe_algs, (char *)pbe_tmp);

crypto/evp/evp_pbe.c:127:2: 
125.   	pbe_tmp->cipher = cipher;
126.   	pbe_tmp->md = md;
127. > 	pbe_tmp->keygen = keygen;
128.   	sk_push (pbe_algs, (char *)pbe_tmp);
129.   	return 1;

crypto/evp/evp_pbe.c:128:2: 
126.   	pbe_tmp->md = md;
127.   	pbe_tmp->keygen = keygen;
128. > 	sk_push (pbe_algs, (char *)pbe_tmp);
129.   	return 1;
130.   }

crypto/stack/stack.c:251:1: start of procedure sk_push()
  249.   	}
  250.   
  251. > int sk_push(STACK *st, char *data)
  252.   	{
  253.   	return(sk_insert(st,data,st->num));

crypto/stack/stack.c:253:2: Skipping sk_insert(): empty list of specs
  251.   int sk_push(STACK *st, char *data)
  252.   	{
  253.   	return(sk_insert(st,data,st->num));
          ^
  254.   	}
  255.   
