crypto/x509/x509_req.c:105: error: NULL_DEREFERENCE
  pointer `ret` last assigned on line 76 could be null and is dereferenced by call to `X509_REQ_free()` at line 105, column 2.
Showing all 24 steps of the trace


crypto/x509/x509_req.c:69:1: start of procedure X509_to_X509_REQ()
67.   #include <openssl/pem.h>
68.   
69. > X509_REQ *X509_to_X509_REQ(X509 *x, EVP_PKEY *pkey, const EVP_MD *md)
70.   	{
71.   	X509_REQ *ret;

crypto/x509/x509_req.c:76:2: Skipping X509_REQ_new(): empty list of specs
74.   	EVP_PKEY *pktmp;
75.   
76.   	ret=X509_REQ_new();
       ^
77.   	if (ret == NULL)
78.   		{

crypto/x509/x509_req.c:77:6: Taking true branch
75.   
76.   	ret=X509_REQ_new();
77.   	if (ret == NULL)
           ^
78.   		{
79.   		X509err(X509_F_X509_TO_X509_REQ,ERR_R_MALLOC_FAILURE);

crypto/x509/x509_req.c:79:3: 
77.   	if (ret == NULL)
78.   		{
79. > 		X509err(X509_F_X509_TO_X509_REQ,ERR_R_MALLOC_FAILURE);
80.   		goto err;
81.   		}

crypto/err/err.c:353:1: start of procedure ERR_put_error()
  351.   /********************************************************/
  352.   
  353. > void ERR_put_error(int lib, int func, int reason, const char *file,
  354.   	     int line)
  355.   	{

crypto/err/err.c:377:2: Skipping ERR_get_state(): empty list of specs
  375.   	}
  376.   #endif
  377.   	es=ERR_get_state();
          ^
  378.   
  379.   	es->top=(es->top+1)%ERR_NUM_ERRORS;

crypto/err/err.c:379:2: 
  377.   	es=ERR_get_state();
  378.   
  379. > 	es->top=(es->top+1)%ERR_NUM_ERRORS;
  380.   	if (es->top == es->bottom)
  381.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;

crypto/err/err.c:380:6: Taking false branch
  378.   
  379.   	es->top=(es->top+1)%ERR_NUM_ERRORS;
  380.   	if (es->top == es->bottom)
              ^
  381.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
  382.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);

crypto/err/err.c:382:2: 
  380.   	if (es->top == es->bottom)
  381.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
  382. > 	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
  383.   	es->err_file[es->top]=file;
  384.   	es->err_line[es->top]=line;

crypto/err/err.c:383:2: 
  381.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
  382.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
  383. > 	es->err_file[es->top]=file;
  384.   	es->err_line[es->top]=line;
  385.   	err_clear_data(es,es->top);

crypto/err/err.c:384:2: 
  382.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
  383.   	es->err_file[es->top]=file;
  384. > 	es->err_line[es->top]=line;
  385.   	err_clear_data(es,es->top);
  386.   	}

crypto/err/err.c:385:2: Taking true branch
  383.   	es->err_file[es->top]=file;
  384.   	es->err_line[es->top]=line;
  385.   	err_clear_data(es,es->top);
          ^
  386.   	}
  387.   

crypto/err/err.c:385:2: Taking false branch
  383.   	es->err_file[es->top]=file;
  384.   	es->err_line[es->top]=line;
  385.   	err_clear_data(es,es->top);
          ^
  386.   	}
  387.   

crypto/err/err.c:386:2: return from a call to ERR_put_error
  384.   	es->err_line[es->top]=line;
  385.   	err_clear_data(es,es->top);
  386.   	}
          ^
  387.   
  388.   void ERR_clear_error(void)

crypto/x509/x509_req.c:104:1: 
102.   		}
103.   	return(ret);
104. > err:
105.   	X509_REQ_free(ret);
106.   	return(NULL);

crypto/x509/x509_req.c:105:2: 
103.   	return(ret);
104.   err:
105. > 	X509_REQ_free(ret);
106.   	return(NULL);
107.   	}

crypto/asn1/x_req.c:211:1: start of procedure X509_REQ_free()
  209.   	}
  210.   
  211. > void X509_REQ_free(X509_REQ *a)
  212.   	{
  213.   	int i;

crypto/asn1/x_req.c:215:6: Taking false branch
  213.   	int i;
  214.   
  215.   	if (a == NULL) return;
              ^
  216.   
  217.   	i=CRYPTO_add(&a->references,-1,CRYPTO_LOCK_X509_REQ);

crypto/asn1/x_req.c:217:2: 
  215.   	if (a == NULL) return;
  216.   
  217. > 	i=CRYPTO_add(&a->references,-1,CRYPTO_LOCK_X509_REQ);
  218.   #ifdef REF_PRINT
  219.   	REF_PRINT("X509_REQ",a);

crypto/cryptlib.c:414:1: start of procedure CRYPTO_add_lock()
    412.   	}
    413.   
    414. > int CRYPTO_add_lock(int *pointer, int amount, int type, const char *file,
    415.   	     int line)
    416.   	{

crypto/cryptlib.c:417:2: 
    415.   	     int line)
    416.   	{
    417. > 	int ret = 0;
    418.   
    419.   	if (add_lock_callback != NULL)

crypto/cryptlib.c:419:6: Taking true branch
    417.   	int ret = 0;
    418.   
    419.   	if (add_lock_callback != NULL)
                ^
    420.   		{
    421.   #ifdef LOCK_DEBUG

crypto/cryptlib.c:425:3: Skipping __function_pointer__(): unresolved function pointer
    423.   #endif
    424.   
    425.   		ret=add_lock_callback(pointer,amount,type,file,line);
             ^
    426.   #ifdef LOCK_DEBUG
    427.   		fprintf(stderr,"ladd:%08lx:%2d+%2d->%2d %-18s %s:%d\n",

crypto/cryptlib.c:433:3: 
    431.   			file,line);
    432.   #endif
    433. > 		*pointer=ret;
    434.   		}
    435.   	else
