ssl/ssl_cert.c:431: error: NULL_DEREFERENCE
  pointer `ret` last assigned on line 427 could be null and is dereferenced by call to `sk_push()` at line 431, column 26.
Showing all 29 steps of the trace


ssl/ssl_cert.c:421:1: start of procedure SSL_dup_CA_list()
419.   	}
420.   
421. > STACK *SSL_dup_CA_list(STACK *sk)
422.   	{
423.   	int i;

ssl/ssl_cert.c:427:2: 
425.   	X509_NAME *name;
426.   
427. > 	ret=sk_new_null();
428.   	for (i=0; i<sk_num(sk); i++)
429.   		{

crypto/stack/stack.c:112:1: start of procedure sk_new()
  110.   	}
  111.   
  112. > STACK *sk_new(int (*c)())
  113.   	{
  114.   	STACK *ret;

crypto/stack/stack.c:117:6: Taking true branch
  115.   	int i;
  116.   
  117.   	if ((ret=(STACK *)Malloc(sizeof(STACK))) == NULL)
              ^
  118.   		goto err0;
  119.   	if ((ret->data=(char **)Malloc(sizeof(char *)*MIN_NODES)) == NULL)

crypto/stack/stack.c:130:1: 
  128.   err1:
  129.   	Free((char *)ret);
  130. > err0:
  131.   	return(NULL);
  132.   	}

crypto/stack/stack.c:131:2: 
  129.   	Free((char *)ret);
  130.   err0:
  131. > 	return(NULL);
  132.   	}
  133.   

crypto/stack/stack.c:132:2: return from a call to sk_new
  130.   err0:
  131.   	return(NULL);
  132.   	}
          ^
  133.   
  134.   int sk_insert(STACK *st, char *data, int loc)

ssl/ssl_cert.c:428:7: 
426.   
427.   	ret=sk_new_null();
428. > 	for (i=0; i<sk_num(sk); i++)
429.   		{
430.   		name=X509_NAME_dup((X509_NAME *)sk_value(sk,i));

ssl/ssl_cert.c:428:12: Loop condition is true. Entering loop body
426.   
427.   	ret=sk_new_null();
428.   	for (i=0; i<sk_num(sk); i++)
                  ^
429.   		{
430.   		name=X509_NAME_dup((X509_NAME *)sk_value(sk,i));

ssl/ssl_cert.c:430:3: 
428.   	for (i=0; i<sk_num(sk); i++)
429.   		{
430. > 		name=X509_NAME_dup((X509_NAME *)sk_value(sk,i));
431.   		if ((name == NULL) || !sk_push(ret,(char *)name))
432.   			{

crypto/x509/x_all.c:353:1: start of procedure X509_NAME_dup()
  351.   	}
  352.   
  353. > X509_NAME *X509_NAME_dup(X509_NAME *xn)
  354.   	{
  355.   	return((X509_NAME *)ASN1_dup((int (*)())i2d_X509_NAME,

crypto/x509/x_all.c:355:2: 
  353.   X509_NAME *X509_NAME_dup(X509_NAME *xn)
  354.   	{
  355. > 	return((X509_NAME *)ASN1_dup((int (*)())i2d_X509_NAME,
  356.   		(char *(*)())d2i_X509_NAME,(char *)xn));
  357.   	}

crypto/asn1/a_dup.c:65:1: start of procedure ASN1_dup()
    63.   #define READ_CHUNK   2048
    64.   
    65. > char *ASN1_dup(int (*i2d)(), char *(*d2i)(), char *x)
    66.   	{
    67.   	unsigned char *b,*p;

crypto/asn1/a_dup.c:71:6: Taking false branch
    69.   	char *ret;
    70.   
    71.   	if (x == NULL) return(NULL);
               ^
    72.   
    73.   	i=(long)i2d(x,NULL);

crypto/asn1/a_dup.c:73:2: Skipping __function_pointer__(): unresolved function pointer
    71.   	if (x == NULL) return(NULL);
    72.   
    73.   	i=(long)i2d(x,NULL);
           ^
    74.   	b=(unsigned char *)Malloc((unsigned int)i+10);
    75.   	if (b == NULL)

crypto/asn1/a_dup.c:74:2: 
    72.   
    73.   	i=(long)i2d(x,NULL);
    74. > 	b=(unsigned char *)Malloc((unsigned int)i+10);
    75.   	if (b == NULL)
    76.   		{ ASN1err(ASN1_F_ASN1_DUP,ERR_R_MALLOC_FAILURE); return(NULL); }

crypto/asn1/a_dup.c:75:6: Taking false branch
    73.   	i=(long)i2d(x,NULL);
    74.   	b=(unsigned char *)Malloc((unsigned int)i+10);
    75.   	if (b == NULL)
               ^
    76.   		{ ASN1err(ASN1_F_ASN1_DUP,ERR_R_MALLOC_FAILURE); return(NULL); }
    77.   	p= b;

crypto/asn1/a_dup.c:77:2: 
    75.   	if (b == NULL)
    76.   		{ ASN1err(ASN1_F_ASN1_DUP,ERR_R_MALLOC_FAILURE); return(NULL); }
    77. > 	p= b;
    78.   	i=i2d(x,&p);
    79.   	p= b;

crypto/asn1/a_dup.c:78:2: Skipping __function_pointer__(): unresolved function pointer
    76.   		{ ASN1err(ASN1_F_ASN1_DUP,ERR_R_MALLOC_FAILURE); return(NULL); }
    77.   	p= b;
    78.   	i=i2d(x,&p);
           ^
    79.   	p= b;
    80.   	ret=d2i(NULL,&p,i);

crypto/asn1/a_dup.c:79:2: 
    77.   	p= b;
    78.   	i=i2d(x,&p);
    79. > 	p= b;
    80.   	ret=d2i(NULL,&p,i);
    81.   	Free((char *)b);

crypto/asn1/a_dup.c:80:2: Skipping __function_pointer__(): unresolved function pointer
    78.   	i=i2d(x,&p);
    79.   	p= b;
    80.   	ret=d2i(NULL,&p,i);
           ^
    81.   	Free((char *)b);
    82.   	return(ret);

crypto/asn1/a_dup.c:81:2: 
    79.   	p= b;
    80.   	ret=d2i(NULL,&p,i);
    81. > 	Free((char *)b);
    82.   	return(ret);
    83.   	}

crypto/asn1/a_dup.c:82:2: 
    80.   	ret=d2i(NULL,&p,i);
    81.   	Free((char *)b);
    82. > 	return(ret);
    83.   	}

crypto/asn1/a_dup.c:83:2: return from a call to ASN1_dup
    81.   	Free((char *)b);
    82.   	return(ret);
    83.   	}
           ^

crypto/x509/x_all.c:357:2: return from a call to X509_NAME_dup
  355.   	return((X509_NAME *)ASN1_dup((int (*)())i2d_X509_NAME,
  356.   		(char *(*)())d2i_X509_NAME,(char *)xn));
  357.   	}
          ^
  358.   
  359.   X509_NAME_ENTRY *X509_NAME_ENTRY_dup(X509_NAME_ENTRY *ne)

ssl/ssl_cert.c:431:8: Taking false branch
429.   		{
430.   		name=X509_NAME_dup((X509_NAME *)sk_value(sk,i));
431.   		if ((name == NULL) || !sk_push(ret,(char *)name))
              ^
432.   			{
433.   			sk_pop_free(ret,X509_NAME_free);

ssl/ssl_cert.c:431:26: 
429.   		{
430.   		name=X509_NAME_dup((X509_NAME *)sk_value(sk,i));
431. > 		if ((name == NULL) || !sk_push(ret,(char *)name))
432.   			{
433.   			sk_pop_free(ret,X509_NAME_free);

crypto/stack/stack.c:237:1: start of procedure sk_push()
  235.   	}
  236.   
  237. > int sk_push(STACK *st, char *data)
  238.   	{
  239.   	return(sk_insert(st,data,st->num));

crypto/stack/stack.c:239:2: Skipping sk_insert(): empty list of specs
  237.   int sk_push(STACK *st, char *data)
  238.   	{
  239.   	return(sk_insert(st,data,st->num));
          ^
  240.   	}
  241.   
