ssl/t1_enc.c:233: error: NULL_DEREFERENCE
  pointer `ctx` last assigned on line 169 could be null and is dereferenced by call to `EVP_MD_CTX_free()` at line 233, column 5.
Showing all 75 steps of the trace


ssl/t1_enc.c:149:1: start of procedure tls1_P_hash()
147.   
148.   /* seed1 through seed5 are virtually concatenated */
149. > static int tls1_P_hash(const EVP_MD *md, const unsigned char *sec,
150.                          int sec_len,
151.                          const void *seed1, int seed1_len,

ssl/t1_enc.c:160:5: 
158.       int chunk;
159.       size_t j;
160. >     EVP_MD_CTX *ctx = NULL, *ctx_tmp = NULL, *ctx_init = NULL;
161.       EVP_PKEY *mac_key = NULL;
162.       unsigned char A1[EVP_MAX_MD_SIZE];

ssl/t1_enc.c:161:5: 
159.       size_t j;
160.       EVP_MD_CTX *ctx = NULL, *ctx_tmp = NULL, *ctx_init = NULL;
161. >     EVP_PKEY *mac_key = NULL;
162.       unsigned char A1[EVP_MAX_MD_SIZE];
163.       size_t A1_len;

ssl/t1_enc.c:164:5: 
162.       unsigned char A1[EVP_MAX_MD_SIZE];
163.       size_t A1_len;
164. >     int ret = 0;
165.   
166.       chunk = EVP_MD_size(md);

ssl/t1_enc.c:166:5: 
164.       int ret = 0;
165.   
166. >     chunk = EVP_MD_size(md);
167.       OPENSSL_assert(chunk >= 0);
168.   

crypto/evp/evp_lib.c:300:1: start of procedure EVP_MD_size()
  298.   }
  299.   
  300. > int EVP_MD_size(const EVP_MD *md)
  301.   {
  302.       if (!md) {

crypto/evp/evp_lib.c:302:10: Taking false branch
  300.   int EVP_MD_size(const EVP_MD *md)
  301.   {
  302.       if (!md) {
                  ^
  303.           EVPerr(EVP_F_EVP_MD_SIZE, EVP_R_MESSAGE_DIGEST_IS_NULL);
  304.           return -1;

crypto/evp/evp_lib.c:306:5: 
  304.           return -1;
  305.       }
  306. >     return md->md_size;
  307.   }
  308.   

crypto/evp/evp_lib.c:307:1: return from a call to EVP_MD_size
  305.       }
  306.       return md->md_size;
  307. > }
  308.   
  309.   unsigned long EVP_MD_flags(const EVP_MD *md)

ssl/t1_enc.c:167:5: Condition is true
165.   
166.       chunk = EVP_MD_size(md);
167.       OPENSSL_assert(chunk >= 0);
           ^
168.   
169.       ctx = EVP_MD_CTX_new();

ssl/t1_enc.c:169:5: 
167.       OPENSSL_assert(chunk >= 0);
168.   
169. >     ctx = EVP_MD_CTX_new();
170.       ctx_tmp = EVP_MD_CTX_new();
171.       ctx_init = EVP_MD_CTX_new();

crypto/evp/digest.c:153:1: start of procedure EVP_MD_CTX_new()
  151.   }
  152.   
  153. > EVP_MD_CTX *EVP_MD_CTX_new(void)
  154.   {
  155.       return OPENSSL_zalloc(sizeof(EVP_MD_CTX));

crypto/evp/digest.c:155:5: 
  153.   EVP_MD_CTX *EVP_MD_CTX_new(void)
  154.   {
  155. >     return OPENSSL_zalloc(sizeof(EVP_MD_CTX));
  156.   }
  157.   

crypto/mem.c:315:1: start of procedure CRYPTO_zalloc()
    313.   }
    314.   
    315. > void *CRYPTO_zalloc(int num, const char *file, int line)
    316.   {
    317.       void *ret = CRYPTO_malloc(num, file, line);

crypto/mem.c:317:5: 
    315.   void *CRYPTO_zalloc(int num, const char *file, int line)
    316.   {
    317. >     void *ret = CRYPTO_malloc(num, file, line);
    318.   
    319.       if (ret != NULL)

crypto/mem.c:279:1: start of procedure CRYPTO_malloc()
      277.   }
      278.   
      279. > void *CRYPTO_malloc(int num, const char *file, int line)
      280.   {
      281.       void *ret = NULL;

crypto/mem.c:281:5: 
      279.   void *CRYPTO_malloc(int num, const char *file, int line)
      280.   {
      281. >     void *ret = NULL;
      282.   
      283.       if (num <= 0)

crypto/mem.c:283:9: Taking false branch
      281.       void *ret = NULL;
      282.   
      283.       if (num <= 0)
                     ^
      284.           return NULL;
      285.   

crypto/mem.c:286:9: Taking true branch
      284.           return NULL;
      285.   
      286.       if (allow_customize)
                     ^
      287.           allow_customize = 0;
      288.       if (malloc_debug_func != NULL) {

crypto/mem.c:287:9: 
      285.   
      286.       if (allow_customize)
      287. >         allow_customize = 0;
      288.       if (malloc_debug_func != NULL) {
      289.           if (allow_customize_debug)

crypto/mem.c:288:9: Taking false branch
      286.       if (allow_customize)
      287.           allow_customize = 0;
      288.       if (malloc_debug_func != NULL) {
                     ^
      289.           if (allow_customize_debug)
      290.               allow_customize_debug = 0;

crypto/mem.c:293:5: Skipping __function_pointer__(): unresolved function pointer
      291.           malloc_debug_func(NULL, num, file, line, 0);
      292.       }
      293.       ret = malloc_ex_func(num, file, line);
                 ^
      294.   #ifdef LEVITTE_DEBUG_MEM
      295.       fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);

crypto/mem.c:297:9: Taking false branch
      295.       fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);
      296.   #endif
      297.       if (malloc_debug_func != NULL)
                     ^
      298.           malloc_debug_func(ret, num, file, line, 1);
      299.   

crypto/mem.c:312:5: 
      310.   #endif
      311.   
      312. >     return ret;
      313.   }
      314.   

crypto/mem.c:313:1: return from a call to CRYPTO_malloc
      311.   
      312.       return ret;
      313. > }
      314.   
      315.   void *CRYPTO_zalloc(int num, const char *file, int line)

crypto/mem.c:319:9: Taking false branch
    317.       void *ret = CRYPTO_malloc(num, file, line);
    318.   
    319.       if (ret != NULL)
                   ^
    320.           memset(ret, 0, num);
    321.       return ret;

crypto/mem.c:321:5: 
    319.       if (ret != NULL)
    320.           memset(ret, 0, num);
    321. >     return ret;
    322.   }
    323.   

crypto/mem.c:322:1: return from a call to CRYPTO_zalloc
    320.           memset(ret, 0, num);
    321.       return ret;
    322. > }
    323.   
    324.   char *CRYPTO_strdup(const char *str, const char *file, int line)

crypto/evp/digest.c:156:1: return from a call to EVP_MD_CTX_new
  154.   {
  155.       return OPENSSL_zalloc(sizeof(EVP_MD_CTX));
  156. > }
  157.   
  158.   void EVP_MD_CTX_free(EVP_MD_CTX *ctx)

ssl/t1_enc.c:170:5: 
168.   
169.       ctx = EVP_MD_CTX_new();
170. >     ctx_tmp = EVP_MD_CTX_new();
171.       ctx_init = EVP_MD_CTX_new();
172.       if (ctx == NULL || ctx_tmp == NULL || ctx_init == NULL)

crypto/evp/digest.c:153:1: start of procedure EVP_MD_CTX_new()
  151.   }
  152.   
  153. > EVP_MD_CTX *EVP_MD_CTX_new(void)
  154.   {
  155.       return OPENSSL_zalloc(sizeof(EVP_MD_CTX));

crypto/evp/digest.c:155:5: 
  153.   EVP_MD_CTX *EVP_MD_CTX_new(void)
  154.   {
  155. >     return OPENSSL_zalloc(sizeof(EVP_MD_CTX));
  156.   }
  157.   

crypto/mem.c:315:1: start of procedure CRYPTO_zalloc()
    313.   }
    314.   
    315. > void *CRYPTO_zalloc(int num, const char *file, int line)
    316.   {
    317.       void *ret = CRYPTO_malloc(num, file, line);

crypto/mem.c:317:5: 
    315.   void *CRYPTO_zalloc(int num, const char *file, int line)
    316.   {
    317. >     void *ret = CRYPTO_malloc(num, file, line);
    318.   
    319.       if (ret != NULL)

crypto/mem.c:279:1: start of procedure CRYPTO_malloc()
      277.   }
      278.   
      279. > void *CRYPTO_malloc(int num, const char *file, int line)
      280.   {
      281.       void *ret = NULL;

crypto/mem.c:281:5: 
      279.   void *CRYPTO_malloc(int num, const char *file, int line)
      280.   {
      281. >     void *ret = NULL;
      282.   
      283.       if (num <= 0)

crypto/mem.c:283:9: Taking false branch
      281.       void *ret = NULL;
      282.   
      283.       if (num <= 0)
                     ^
      284.           return NULL;
      285.   

crypto/mem.c:286:9: Taking false branch
      284.           return NULL;
      285.   
      286.       if (allow_customize)
                     ^
      287.           allow_customize = 0;
      288.       if (malloc_debug_func != NULL) {

crypto/mem.c:288:9: Taking false branch
      286.       if (allow_customize)
      287.           allow_customize = 0;
      288.       if (malloc_debug_func != NULL) {
                     ^
      289.           if (allow_customize_debug)
      290.               allow_customize_debug = 0;

crypto/mem.c:293:5: Skipping __function_pointer__(): unresolved function pointer
      291.           malloc_debug_func(NULL, num, file, line, 0);
      292.       }
      293.       ret = malloc_ex_func(num, file, line);
                 ^
      294.   #ifdef LEVITTE_DEBUG_MEM
      295.       fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);

crypto/mem.c:297:9: Taking false branch
      295.       fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);
      296.   #endif
      297.       if (malloc_debug_func != NULL)
                     ^
      298.           malloc_debug_func(ret, num, file, line, 1);
      299.   

crypto/mem.c:312:5: 
      310.   #endif
      311.   
      312. >     return ret;
      313.   }
      314.   

crypto/mem.c:313:1: return from a call to CRYPTO_malloc
      311.   
      312.       return ret;
      313. > }
      314.   
      315.   void *CRYPTO_zalloc(int num, const char *file, int line)

crypto/mem.c:319:9: Taking true branch
    317.       void *ret = CRYPTO_malloc(num, file, line);
    318.   
    319.       if (ret != NULL)
                   ^
    320.           memset(ret, 0, num);
    321.       return ret;

crypto/mem.c:320:9: 
    318.   
    319.       if (ret != NULL)
    320. >         memset(ret, 0, num);
    321.       return ret;
    322.   }

crypto/mem.c:321:5: 
    319.       if (ret != NULL)
    320.           memset(ret, 0, num);
    321. >     return ret;
    322.   }
    323.   

crypto/mem.c:322:1: return from a call to CRYPTO_zalloc
    320.           memset(ret, 0, num);
    321.       return ret;
    322. > }
    323.   
    324.   char *CRYPTO_strdup(const char *str, const char *file, int line)

crypto/evp/digest.c:156:1: return from a call to EVP_MD_CTX_new
  154.   {
  155.       return OPENSSL_zalloc(sizeof(EVP_MD_CTX));
  156. > }
  157.   
  158.   void EVP_MD_CTX_free(EVP_MD_CTX *ctx)

ssl/t1_enc.c:171:5: 
169.       ctx = EVP_MD_CTX_new();
170.       ctx_tmp = EVP_MD_CTX_new();
171. >     ctx_init = EVP_MD_CTX_new();
172.       if (ctx == NULL || ctx_tmp == NULL || ctx_init == NULL)
173.           goto err;

crypto/evp/digest.c:153:1: start of procedure EVP_MD_CTX_new()
  151.   }
  152.   
  153. > EVP_MD_CTX *EVP_MD_CTX_new(void)
  154.   {
  155.       return OPENSSL_zalloc(sizeof(EVP_MD_CTX));

crypto/evp/digest.c:155:5: 
  153.   EVP_MD_CTX *EVP_MD_CTX_new(void)
  154.   {
  155. >     return OPENSSL_zalloc(sizeof(EVP_MD_CTX));
  156.   }
  157.   

crypto/mem.c:315:1: start of procedure CRYPTO_zalloc()
    313.   }
    314.   
    315. > void *CRYPTO_zalloc(int num, const char *file, int line)
    316.   {
    317.       void *ret = CRYPTO_malloc(num, file, line);

crypto/mem.c:317:5: 
    315.   void *CRYPTO_zalloc(int num, const char *file, int line)
    316.   {
    317. >     void *ret = CRYPTO_malloc(num, file, line);
    318.   
    319.       if (ret != NULL)

crypto/mem.c:279:1: start of procedure CRYPTO_malloc()
      277.   }
      278.   
      279. > void *CRYPTO_malloc(int num, const char *file, int line)
      280.   {
      281.       void *ret = NULL;

crypto/mem.c:281:5: 
      279.   void *CRYPTO_malloc(int num, const char *file, int line)
      280.   {
      281. >     void *ret = NULL;
      282.   
      283.       if (num <= 0)

crypto/mem.c:283:9: Taking false branch
      281.       void *ret = NULL;
      282.   
      283.       if (num <= 0)
                     ^
      284.           return NULL;
      285.   

crypto/mem.c:286:9: Taking false branch
      284.           return NULL;
      285.   
      286.       if (allow_customize)
                     ^
      287.           allow_customize = 0;
      288.       if (malloc_debug_func != NULL) {

crypto/mem.c:288:9: Taking false branch
      286.       if (allow_customize)
      287.           allow_customize = 0;
      288.       if (malloc_debug_func != NULL) {
                     ^
      289.           if (allow_customize_debug)
      290.               allow_customize_debug = 0;

crypto/mem.c:293:5: Skipping __function_pointer__(): unresolved function pointer
      291.           malloc_debug_func(NULL, num, file, line, 0);
      292.       }
      293.       ret = malloc_ex_func(num, file, line);
                 ^
      294.   #ifdef LEVITTE_DEBUG_MEM
      295.       fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);

crypto/mem.c:297:9: Taking false branch
      295.       fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);
      296.   #endif
      297.       if (malloc_debug_func != NULL)
                     ^
      298.           malloc_debug_func(ret, num, file, line, 1);
      299.   

crypto/mem.c:312:5: 
      310.   #endif
      311.   
      312. >     return ret;
      313.   }
      314.   

crypto/mem.c:313:1: return from a call to CRYPTO_malloc
      311.   
      312.       return ret;
      313. > }
      314.   
      315.   void *CRYPTO_zalloc(int num, const char *file, int line)

crypto/mem.c:319:9: Taking true branch
    317.       void *ret = CRYPTO_malloc(num, file, line);
    318.   
    319.       if (ret != NULL)
                   ^
    320.           memset(ret, 0, num);
    321.       return ret;

crypto/mem.c:320:9: 
    318.   
    319.       if (ret != NULL)
    320. >         memset(ret, 0, num);
    321.       return ret;
    322.   }

crypto/mem.c:321:5: 
    319.       if (ret != NULL)
    320.           memset(ret, 0, num);
    321. >     return ret;
    322.   }
    323.   

crypto/mem.c:322:1: return from a call to CRYPTO_zalloc
    320.           memset(ret, 0, num);
    321.       return ret;
    322. > }
    323.   
    324.   char *CRYPTO_strdup(const char *str, const char *file, int line)

crypto/evp/digest.c:156:1: return from a call to EVP_MD_CTX_new
  154.   {
  155.       return OPENSSL_zalloc(sizeof(EVP_MD_CTX));
  156. > }
  157.   
  158.   void EVP_MD_CTX_free(EVP_MD_CTX *ctx)

ssl/t1_enc.c:172:9: Taking true branch
170.       ctx_tmp = EVP_MD_CTX_new();
171.       ctx_init = EVP_MD_CTX_new();
172.       if (ctx == NULL || ctx_tmp == NULL || ctx_init == NULL)
               ^
173.           goto err;
174.       EVP_MD_CTX_set_flags(ctx_init, EVP_MD_CTX_FLAG_NON_FIPS_ALLOW);

ssl/t1_enc.c:231:2: 
229.       }
230.       ret = 1;
231. >  err:
232.       EVP_PKEY_free(mac_key);
233.       EVP_MD_CTX_free(ctx);

ssl/t1_enc.c:232:5: 
230.       ret = 1;
231.    err:
232. >     EVP_PKEY_free(mac_key);
233.       EVP_MD_CTX_free(ctx);
234.       EVP_MD_CTX_free(ctx_tmp);

crypto/evp/p_lib.c:384:1: start of procedure EVP_PKEY_free()
  382.   }
  383.   
  384. > void EVP_PKEY_free(EVP_PKEY *x)
  385.   {
  386.       int i;

crypto/evp/p_lib.c:388:9: Taking true branch
  386.       int i;
  387.   
  388.       if (x == NULL)
                 ^
  389.           return;
  390.   

crypto/evp/p_lib.c:389:9: 
  387.   
  388.       if (x == NULL)
  389. >         return;
  390.   
  391.       i = CRYPTO_add(&x->references, -1, CRYPTO_LOCK_EVP_PKEY);

crypto/evp/p_lib.c:406:1: return from a call to EVP_PKEY_free
  404.       sk_X509_ATTRIBUTE_pop_free(x->attributes, X509_ATTRIBUTE_free);
  405.       OPENSSL_free(x);
  406. > }
  407.   
  408.   static void EVP_PKEY_free_it(EVP_PKEY *x)

ssl/t1_enc.c:233:5: 
231.    err:
232.       EVP_PKEY_free(mac_key);
233. >     EVP_MD_CTX_free(ctx);
234.       EVP_MD_CTX_free(ctx_tmp);
235.       EVP_MD_CTX_free(ctx_init);
