crypto/ui/ui_lib.c:433: error: NULL_DEREFERENCE
  pointer `prompt` last assigned on line 432 could be null and is dereferenced by call to `strcpy()` at line 433, column 3.
Showing all 27 steps of the trace


crypto/ui/ui_lib.c:410:1: start of procedure UI_construct_prompt()
408.   	}
409.   
410. > char *UI_construct_prompt(UI *ui, const char *object_desc,
411.   	const char *object_name)
412.   	{

crypto/ui/ui_lib.c:413:2: 
411.   	const char *object_name)
412.   	{
413. > 	char *prompt = NULL;
414.   
415.   	if (ui->meth->ui_construct_prompt)

crypto/ui/ui_lib.c:415:6: Taking false branch
413.   	char *prompt = NULL;
414.   
415.   	if (ui->meth->ui_construct_prompt)
            ^
416.   		prompt = ui->meth->ui_construct_prompt(ui,
417.   			object_desc, object_name);

crypto/ui/ui_lib.c:420:3: 
418.   	else
419.   		{
420. > 		char prompt1[] = "Enter ";
421.   		char prompt2[] = " for ";
422.   		char prompt3[] = ":";

crypto/ui/ui_lib.c:421:3: 
419.   		{
420.   		char prompt1[] = "Enter ";
421. > 		char prompt2[] = " for ";
422.   		char prompt3[] = ":";
423.   		int len = 0;

crypto/ui/ui_lib.c:422:3: 
420.   		char prompt1[] = "Enter ";
421.   		char prompt2[] = " for ";
422. > 		char prompt3[] = ":";
423.   		int len = 0;
424.   

crypto/ui/ui_lib.c:423:3: 
421.   		char prompt2[] = " for ";
422.   		char prompt3[] = ":";
423. > 		int len = 0;
424.   
425.   		if (object_desc == NULL)

crypto/ui/ui_lib.c:425:7: Taking false branch
423.   		int len = 0;
424.   
425.   		if (object_desc == NULL)
             ^
426.   			return NULL;
427.   		len = sizeof(prompt1) - 1 + strlen(object_desc);

crypto/ui/ui_lib.c:427:3: 
425.   		if (object_desc == NULL)
426.   			return NULL;
427. > 		len = sizeof(prompt1) - 1 + strlen(object_desc);
428.   		if (object_name)
429.   			len += sizeof(prompt2) - 1 + strlen(object_name);

crypto/ui/ui_lib.c:428:7: Taking true branch
426.   			return NULL;
427.   		len = sizeof(prompt1) - 1 + strlen(object_desc);
428.   		if (object_name)
             ^
429.   			len += sizeof(prompt2) - 1 + strlen(object_name);
430.   		len += sizeof(prompt3) - 1;

crypto/ui/ui_lib.c:429:4: 
427.   		len = sizeof(prompt1) - 1 + strlen(object_desc);
428.   		if (object_name)
429. > 			len += sizeof(prompt2) - 1 + strlen(object_name);
430.   		len += sizeof(prompt3) - 1;
431.   

crypto/ui/ui_lib.c:430:3: 
428.   		if (object_name)
429.   			len += sizeof(prompt2) - 1 + strlen(object_name);
430. > 		len += sizeof(prompt3) - 1;
431.   
432.   		prompt = (char *)OPENSSL_malloc(len + 1);

crypto/ui/ui_lib.c:432:3: 
430.   		len += sizeof(prompt3) - 1;
431.   
432. > 		prompt = (char *)OPENSSL_malloc(len + 1);
433.   		strcpy(prompt, prompt1);
434.   		strcat(prompt, object_desc);

crypto/mem.c:291:1: start of procedure CRYPTO_malloc()
  289.   	}
  290.   
  291. > void *CRYPTO_malloc(int num, const char *file, int line)
  292.   	{
  293.   	void *ret = NULL;

crypto/mem.c:293:2: 
  291.   void *CRYPTO_malloc(int num, const char *file, int line)
  292.   	{
  293. > 	void *ret = NULL;
  294.   	extern unsigned char cleanse_ctr;
  295.   

crypto/mem.c:296:6: Taking false branch
  294.   	extern unsigned char cleanse_ctr;
  295.   
  296.   	if (num < 0) return NULL;
              ^
  297.   
  298.   	allow_customize = 0;

crypto/mem.c:298:2: 
  296.   	if (num < 0) return NULL;
  297.   
  298. > 	allow_customize = 0;
  299.   	if (malloc_debug_func != NULL)
  300.   		{

crypto/mem.c:299:6: Taking true branch
  297.   
  298.   	allow_customize = 0;
  299.   	if (malloc_debug_func != NULL)
              ^
  300.   		{
  301.   		allow_customize_debug = 0;

crypto/mem.c:301:3: 
  299.   	if (malloc_debug_func != NULL)
  300.   		{
  301. > 		allow_customize_debug = 0;
  302.   		malloc_debug_func(NULL, num, file, line, 0);
  303.   		}

crypto/mem.c:302:3: Skipping __function_pointer__(): unresolved function pointer
  300.   		{
  301.   		allow_customize_debug = 0;
  302.   		malloc_debug_func(NULL, num, file, line, 0);
           ^
  303.   		}
  304.   	ret = malloc_ex_func(num,file,line);

crypto/mem.c:304:2: Skipping __function_pointer__(): unresolved function pointer
  302.   		malloc_debug_func(NULL, num, file, line, 0);
  303.   		}
  304.   	ret = malloc_ex_func(num,file,line);
          ^
  305.   #ifdef LEVITTE_DEBUG_MEM
  306.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);

crypto/mem.c:308:6: Taking true branch
  306.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);
  307.   #endif
  308.   	if (malloc_debug_func != NULL)
              ^
  309.   		malloc_debug_func(ret, num, file, line, 1);
  310.   

crypto/mem.c:309:3: Skipping __function_pointer__(): unresolved function pointer
  307.   #endif
  308.   	if (malloc_debug_func != NULL)
  309.   		malloc_debug_func(ret, num, file, line, 1);
           ^
  310.   
  311.           /* Create a dependency on the value of 'cleanse_ctr' so our memory

crypto/mem.c:314:12: Taking false branch
  312.            * sanitisation function can't be optimised out. NB: We only do
  313.            * this for >2Kb so the overhead doesn't bother us. */
  314.           if(ret && (num > 2048))
                    ^
  315.                   ((unsigned char *)ret)[0] = cleanse_ctr;
  316.   

crypto/mem.c:317:2: 
  315.                   ((unsigned char *)ret)[0] = cleanse_ctr;
  316.   
  317. > 	return ret;
  318.   	}
  319.   

crypto/mem.c:318:2: return from a call to CRYPTO_malloc
  316.   
  317.   	return ret;
  318.   	}
          ^
  319.   
  320.   void *CRYPTO_realloc(void *str, int num, const char *file, int line)

crypto/ui/ui_lib.c:433:3: 
431.   
432.   		prompt = (char *)OPENSSL_malloc(len + 1);
433. > 		strcpy(prompt, prompt1);
434.   		strcat(prompt, object_desc);
435.   		if (object_name)
