crypto/rsa/rsa_saos.c:142: error: NULL_DEREFERENCE
  pointer `s` last assigned on line 119 could be null and is dereferenced by call to `memset()` at line 142, column 2.
Showing all 48 steps of the trace


crypto/rsa/rsa_saos.c:104:1: start of procedure RSA_verify_ASN1_OCTET_STRING()
102.   	}
103.   
104. > int RSA_verify_ASN1_OCTET_STRING(int dtype,
105.   	const unsigned char *m,
106.   	unsigned int m_len, unsigned char *sigbuf, unsigned int siglen,

crypto/rsa/rsa_saos.c:109:2: 
107.   	RSA *rsa)
108.   	{
109. > 	int i,ret=0;
110.   	unsigned char *p,*s;
111.   	ASN1_OCTET_STRING *sig=NULL;

crypto/rsa/rsa_saos.c:111:2: 
109.   	int i,ret=0;
110.   	unsigned char *p,*s;
111. > 	ASN1_OCTET_STRING *sig=NULL;
112.   
113.   	if (siglen != (unsigned int)RSA_size(rsa))

crypto/rsa/rsa_saos.c:113:6: 
111.   	ASN1_OCTET_STRING *sig=NULL;
112.   
113. > 	if (siglen != (unsigned int)RSA_size(rsa))
114.   		{
115.   		RSAerr(RSA_F_RSA_VERIFY_ASN1_OCTET_STRING,RSA_R_WRONG_SIGNATURE_LENGTH);

crypto/rsa/rsa_lib.c:262:1: start of procedure RSA_size()
  260.   	}
  261.   
  262. > int RSA_size(const RSA *r)
  263.   	{
  264.   	return(BN_num_bytes(r->n));

crypto/rsa/rsa_lib.c:264:2: 
  262.   int RSA_size(const RSA *r)
  263.   	{
  264. > 	return(BN_num_bytes(r->n));
  265.   	}
  266.   

crypto/bn/bn_lib.c:244:1: start of procedure BN_num_bits()
    242.   	}
    243.   
    244. > int BN_num_bits(const BIGNUM *a)
    245.   	{
    246.   	BN_ULONG l;

crypto/bn/bn_lib.c:251:6: Taking false branch
    249.   	bn_check_top(a);
    250.   
    251.   	if (a->top == 0) return(0);
                ^
    252.   	l=a->d[a->top-1];
    253.   	assert(l != 0);

crypto/bn/bn_lib.c:252:2: 
    250.   
    251.   	if (a->top == 0) return(0);
    252. > 	l=a->d[a->top-1];
    253.   	assert(l != 0);
    254.   	i=(a->top-1)*BN_BITS2;

crypto/bn/bn_lib.c:253:2: 
    251.   	if (a->top == 0) return(0);
    252.   	l=a->d[a->top-1];
    253. > 	assert(l != 0);
    254.   	i=(a->top-1)*BN_BITS2;
    255.   	return(i+BN_num_bits_word(l));

crypto/bn/bn_lib.c:254:2: 
    252.   	l=a->d[a->top-1];
    253.   	assert(l != 0);
    254. > 	i=(a->top-1)*BN_BITS2;
    255.   	return(i+BN_num_bits_word(l));
    256.   	}

crypto/bn/bn_lib.c:255:2: Skipping BN_num_bits_word(): empty list of specs
    253.   	assert(l != 0);
    254.   	i=(a->top-1)*BN_BITS2;
    255.   	return(i+BN_num_bits_word(l));
            ^
    256.   	}
    257.   

crypto/bn/bn_lib.c:256:2: return from a call to BN_num_bits
    254.   	i=(a->top-1)*BN_BITS2;
    255.   	return(i+BN_num_bits_word(l));
    256.   	}
            ^
    257.   
    258.   void BN_clear_free(BIGNUM *a)

crypto/rsa/rsa_lib.c:265:2: return from a call to RSA_size
  263.   	{
  264.   	return(BN_num_bytes(r->n));
  265.   	}
          ^
  266.   
  267.   int RSA_public_encrypt(int flen, const unsigned char *from, unsigned char *to,

crypto/rsa/rsa_saos.c:113:6: Taking false branch
111.   	ASN1_OCTET_STRING *sig=NULL;
112.   
113.   	if (siglen != (unsigned int)RSA_size(rsa))
            ^
114.   		{
115.   		RSAerr(RSA_F_RSA_VERIFY_ASN1_OCTET_STRING,RSA_R_WRONG_SIGNATURE_LENGTH);

crypto/rsa/rsa_saos.c:119:2: 
117.   		}
118.   
119. > 	s=(unsigned char *)OPENSSL_malloc((unsigned int)siglen);
120.   	if (s == NULL)
121.   		{

crypto/mem.c:205:1: start of procedure CRYPTO_malloc()
  203.   	}
  204.   
  205. > void *CRYPTO_malloc(int num, const char *file, int line)
  206.   	{
  207.   	void *ret = NULL;

crypto/mem.c:207:2: 
  205.   void *CRYPTO_malloc(int num, const char *file, int line)
  206.   	{
  207. > 	void *ret = NULL;
  208.   
  209.   	allow_customize = 0;

crypto/mem.c:209:2: 
  207.   	void *ret = NULL;
  208.   
  209. > 	allow_customize = 0;
  210.   	if (malloc_debug_func != NULL)
  211.   		{

crypto/mem.c:210:6: Taking false branch
  208.   
  209.   	allow_customize = 0;
  210.   	if (malloc_debug_func != NULL)
              ^
  211.   		{
  212.   		allow_customize_debug = 0;

crypto/mem.c:215:2: Skipping __function_pointer__(): unresolved function pointer
  213.   		malloc_debug_func(NULL, num, file, line, 0);
  214.   		}
  215.   	ret = malloc_func(num);
          ^
  216.   #ifdef LEVITTE_DEBUG
  217.   	fprintf(stderr, "LEVITTE_DEBUG:         > 0x%p (%d)\n", ret, num);

crypto/mem.c:219:6: Taking false branch
  217.   	fprintf(stderr, "LEVITTE_DEBUG:         > 0x%p (%d)\n", ret, num);
  218.   #endif
  219.   	if (malloc_debug_func != NULL)
              ^
  220.   		malloc_debug_func(ret, num, file, line, 1);
  221.   

crypto/mem.c:222:2: 
  220.   		malloc_debug_func(ret, num, file, line, 1);
  221.   
  222. > 	return ret;
  223.   	}
  224.   

crypto/mem.c:223:2: return from a call to CRYPTO_malloc
  221.   
  222.   	return ret;
  223.   	}
          ^
  224.   
  225.   void *CRYPTO_realloc(void *str, int num, const char *file, int line)

crypto/rsa/rsa_saos.c:120:6: Taking true branch
118.   
119.   	s=(unsigned char *)OPENSSL_malloc((unsigned int)siglen);
120.   	if (s == NULL)
            ^
121.   		{
122.   		RSAerr(RSA_F_RSA_VERIFY_ASN1_OCTET_STRING,ERR_R_MALLOC_FAILURE);

crypto/rsa/rsa_saos.c:122:3: 
120.   	if (s == NULL)
121.   		{
122. > 		RSAerr(RSA_F_RSA_VERIFY_ASN1_OCTET_STRING,ERR_R_MALLOC_FAILURE);
123.   		goto err;
124.   		}

crypto/err/err.c:355:1: start of procedure ERR_put_error()
  353.   /********************************************************/
  354.   
  355. > void ERR_put_error(int lib, int func, int reason, const char *file,
  356.   	     int line)
  357.   	{

crypto/err/err.c:379:2: Skipping ERR_get_state(): empty list of specs
  377.   	}
  378.   #endif
  379.   	es=ERR_get_state();
          ^
  380.   
  381.   	es->top=(es->top+1)%ERR_NUM_ERRORS;

crypto/err/err.c:381:2: 
  379.   	es=ERR_get_state();
  380.   
  381. > 	es->top=(es->top+1)%ERR_NUM_ERRORS;
  382.   	if (es->top == es->bottom)
  383.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;

crypto/err/err.c:382:6: Taking false branch
  380.   
  381.   	es->top=(es->top+1)%ERR_NUM_ERRORS;
  382.   	if (es->top == es->bottom)
              ^
  383.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
  384.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);

crypto/err/err.c:384:2: 
  382.   	if (es->top == es->bottom)
  383.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
  384. > 	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
  385.   	es->err_file[es->top]=file;
  386.   	es->err_line[es->top]=line;

crypto/err/err.c:385:2: 
  383.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
  384.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
  385. > 	es->err_file[es->top]=file;
  386.   	es->err_line[es->top]=line;
  387.   	err_clear_data(es,es->top);

crypto/err/err.c:386:2: 
  384.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
  385.   	es->err_file[es->top]=file;
  386. > 	es->err_line[es->top]=line;
  387.   	err_clear_data(es,es->top);
  388.   	}

crypto/err/err.c:387:2: Taking true branch
  385.   	es->err_file[es->top]=file;
  386.   	es->err_line[es->top]=line;
  387.   	err_clear_data(es,es->top);
          ^
  388.   	}
  389.   

crypto/err/err.c:387:2: Taking true branch
  385.   	es->err_file[es->top]=file;
  386.   	es->err_line[es->top]=line;
  387.   	err_clear_data(es,es->top);
          ^
  388.   	}
  389.   

crypto/mem.c:241:1: start of procedure CRYPTO_free()
    239.   	}
    240.   
    241. > void CRYPTO_free(void *str)
    242.   	{
    243.   	if (free_debug_func != NULL)

crypto/mem.c:243:6: Taking true branch
    241.   void CRYPTO_free(void *str)
    242.   	{
    243.   	if (free_debug_func != NULL)
                ^
    244.   		free_debug_func(str, 0);
    245.   #ifdef LEVITTE_DEBUG

crypto/mem.c:244:3: Skipping __function_pointer__(): unresolved function pointer
    242.   	{
    243.   	if (free_debug_func != NULL)
    244.   		free_debug_func(str, 0);
             ^
    245.   #ifdef LEVITTE_DEBUG
    246.   	fprintf(stderr, "LEVITTE_DEBUG:         < 0x%p\n", str);

crypto/mem.c:248:2: Skipping __function_pointer__(): unresolved function pointer
    246.   	fprintf(stderr, "LEVITTE_DEBUG:         < 0x%p\n", str);
    247.   #endif
    248.   	free_func(str);
            ^
    249.   	if (free_debug_func != NULL)
    250.   		free_debug_func(NULL, 1);

crypto/mem.c:249:6: Taking true branch
    247.   #endif
    248.   	free_func(str);
    249.   	if (free_debug_func != NULL)
                ^
    250.   		free_debug_func(NULL, 1);
    251.   	}

crypto/mem.c:250:3: Skipping __function_pointer__(): unresolved function pointer
    248.   	free_func(str);
    249.   	if (free_debug_func != NULL)
    250.   		free_debug_func(NULL, 1);
             ^
    251.   	}
    252.   

crypto/mem.c:249:2: 
    247.   #endif
    248.   	free_func(str);
    249. > 	if (free_debug_func != NULL)
    250.   		free_debug_func(NULL, 1);
    251.   	}

crypto/mem.c:251:2: return from a call to CRYPTO_free
    249.   	if (free_debug_func != NULL)
    250.   		free_debug_func(NULL, 1);
    251.   	}
            ^
    252.   
    253.   void *CRYPTO_remalloc(void *a, int num, const char *file, int line)

crypto/err/err.c:387:2: 
  385.   	es->err_file[es->top]=file;
  386.   	es->err_line[es->top]=line;
  387. > 	err_clear_data(es,es->top);
  388.   	}
  389.   

crypto/err/err.c:388:2: return from a call to ERR_put_error
  386.   	es->err_line[es->top]=line;
  387.   	err_clear_data(es,es->top);
  388.   	}
          ^
  389.   
  390.   void ERR_clear_error(void)

crypto/rsa/rsa_saos.c:140:1: 
138.   	else
139.   		ret=1;
140. > err:
141.   	if (sig != NULL) M_ASN1_OCTET_STRING_free(sig);
142.   	memset(s,0,(unsigned int)siglen);

crypto/rsa/rsa_saos.c:141:6: Taking false branch
139.   		ret=1;
140.   err:
141.   	if (sig != NULL) M_ASN1_OCTET_STRING_free(sig);
            ^
142.   	memset(s,0,(unsigned int)siglen);
143.   	OPENSSL_free(s);

crypto/rsa/rsa_saos.c:142:2: 
140.   err:
141.   	if (sig != NULL) M_ASN1_OCTET_STRING_free(sig);
142. > 	memset(s,0,(unsigned int)siglen);
143.   	OPENSSL_free(s);
144.   	return(ret);
