crypto/rsa/rsa_sign.c:217: error: NULL_DEREFERENCE
  pointer `s` last assigned on line 156 could be null and is dereferenced by call to `memset()` at line 217, column 2.
Showing all 49 steps of the trace


crypto/rsa/rsa_sign.c:140:1: start of procedure RSA_verify()
138.   	}
139.   
140. > int RSA_verify(int dtype, unsigned char *m, unsigned int m_len,
141.   	     unsigned char *sigbuf, unsigned int siglen, RSA *rsa)
142.   	{

crypto/rsa/rsa_sign.c:143:2: 
141.   	     unsigned char *sigbuf, unsigned int siglen, RSA *rsa)
142.   	{
143. > 	int i,ret=0,sigtype;
144.   	unsigned char *p,*s;
145.   	X509_SIG *sig=NULL;

crypto/rsa/rsa_sign.c:145:2: 
143.   	int i,ret=0,sigtype;
144.   	unsigned char *p,*s;
145. > 	X509_SIG *sig=NULL;
146.   
147.   	if (siglen != (unsigned int)RSA_size(rsa))

crypto/rsa/rsa_sign.c:147:6: 
145.   	X509_SIG *sig=NULL;
146.   
147. > 	if (siglen != (unsigned int)RSA_size(rsa))
148.   		{
149.   		RSAerr(RSA_F_RSA_VERIFY,RSA_R_WRONG_SIGNATURE_LENGTH);

crypto/rsa/rsa_lib.c:212:1: start of procedure RSA_size()
  210.   	}
  211.   
  212. > int RSA_size(RSA *r)
  213.   	{
  214.   	return(BN_num_bytes(r->n));

crypto/rsa/rsa_lib.c:214:2: 
  212.   int RSA_size(RSA *r)
  213.   	{
  214. > 	return(BN_num_bytes(r->n));
  215.   	}
  216.   

crypto/bn/bn_lib.c:238:1: start of procedure BN_num_bits()
    236.   	}
    237.   
    238. > int BN_num_bits(const BIGNUM *a)
    239.   	{
    240.   	BN_ULONG l;

crypto/bn/bn_lib.c:245:6: Taking false branch
    243.   	bn_check_top(a);
    244.   
    245.   	if (a->top == 0) return(0);
                ^
    246.   	l=a->d[a->top-1];
    247.   	i=(a->top-1)*BN_BITS2;

crypto/bn/bn_lib.c:246:2: 
    244.   
    245.   	if (a->top == 0) return(0);
    246. > 	l=a->d[a->top-1];
    247.   	i=(a->top-1)*BN_BITS2;
    248.   	if (l == 0)

crypto/bn/bn_lib.c:247:2: 
    245.   	if (a->top == 0) return(0);
    246.   	l=a->d[a->top-1];
    247. > 	i=(a->top-1)*BN_BITS2;
    248.   	if (l == 0)
    249.   		{

crypto/bn/bn_lib.c:248:6: Taking false branch
    246.   	l=a->d[a->top-1];
    247.   	i=(a->top-1)*BN_BITS2;
    248.   	if (l == 0)
                ^
    249.   		{
    250.   #if !defined(NO_STDIO) && !defined(WIN16)

crypto/bn/bn_lib.c:255:2: Skipping BN_num_bits_word(): empty list of specs
    253.   		abort();
    254.   		}
    255.   	return(i+BN_num_bits_word(l));
            ^
    256.   	}
    257.   

crypto/bn/bn_lib.c:256:2: return from a call to BN_num_bits
    254.   		}
    255.   	return(i+BN_num_bits_word(l));
    256.   	}
            ^
    257.   
    258.   void BN_clear_free(BIGNUM *a)

crypto/rsa/rsa_lib.c:215:2: return from a call to RSA_size
  213.   	{
  214.   	return(BN_num_bytes(r->n));
  215.   	}
          ^
  216.   
  217.   int RSA_public_encrypt(int flen, unsigned char *from, unsigned char *to,

crypto/rsa/rsa_sign.c:147:6: Taking false branch
145.   	X509_SIG *sig=NULL;
146.   
147.   	if (siglen != (unsigned int)RSA_size(rsa))
            ^
148.   		{
149.   		RSAerr(RSA_F_RSA_VERIFY,RSA_R_WRONG_SIGNATURE_LENGTH);

crypto/rsa/rsa_sign.c:153:5: Taking false branch
151.   		}
152.   
153.   	if(rsa->flags & RSA_FLAG_SIGN_VER)
           ^
154.   	    return rsa->meth->rsa_verify(dtype, m, m_len, sigbuf, siglen, rsa);
155.   

crypto/rsa/rsa_sign.c:156:2: 
154.   	    return rsa->meth->rsa_verify(dtype, m, m_len, sigbuf, siglen, rsa);
155.   
156. > 	s=(unsigned char *)Malloc((unsigned int)siglen);
157.   	if (s == NULL)
158.   		{

crypto/mem.c:194:1: start of procedure CRYPTO_malloc()
  192.   	}
  193.   
  194. > void *CRYPTO_malloc(int num, const char *file, int line)
  195.   	{
  196.   	char *ret = NULL;

crypto/mem.c:196:2: 
  194.   void *CRYPTO_malloc(int num, const char *file, int line)
  195.   	{
  196. > 	char *ret = NULL;
  197.   
  198.   	allow_customize = 0;

crypto/mem.c:198:2: 
  196.   	char *ret = NULL;
  197.   
  198. > 	allow_customize = 0;
  199.   	if (malloc_debug_func != NULL)
  200.   		{

crypto/mem.c:199:6: Taking false branch
  197.   
  198.   	allow_customize = 0;
  199.   	if (malloc_debug_func != NULL)
              ^
  200.   		{
  201.   		allow_customize_debug = 0;

crypto/mem.c:204:2: Skipping __function_pointer__(): unresolved function pointer
  202.   		malloc_debug_func(NULL, num, file, line, 0);
  203.   		}
  204.   	ret = malloc_func(num);
          ^
  205.   #ifdef LEVITTE_DEBUG
  206.   	fprintf(stderr, "LEVITTE_DEBUG:         > 0x%p (%d)\n", ret, num);

crypto/mem.c:208:6: Taking false branch
  206.   	fprintf(stderr, "LEVITTE_DEBUG:         > 0x%p (%d)\n", ret, num);
  207.   #endif
  208.   	if (malloc_debug_func != NULL)
              ^
  209.   		malloc_debug_func(ret, num, file, line, 1);
  210.   

crypto/mem.c:211:2: 
  209.   		malloc_debug_func(ret, num, file, line, 1);
  210.   
  211. > 	return ret;
  212.   	}
  213.   

crypto/mem.c:212:2: return from a call to CRYPTO_malloc
  210.   
  211.   	return ret;
  212.   	}
          ^
  213.   
  214.   void *CRYPTO_realloc(void *str, int num, const char *file, int line)

crypto/rsa/rsa_sign.c:157:6: Taking true branch
155.   
156.   	s=(unsigned char *)Malloc((unsigned int)siglen);
157.   	if (s == NULL)
            ^
158.   		{
159.   		RSAerr(RSA_F_RSA_VERIFY,ERR_R_MALLOC_FAILURE);

crypto/rsa/rsa_sign.c:159:3: 
157.   	if (s == NULL)
158.   		{
159. > 		RSAerr(RSA_F_RSA_VERIFY,ERR_R_MALLOC_FAILURE);
160.   		goto err;
161.   		}

crypto/err/err.c:246:1: start of procedure ERR_put_error()
  244.   /********************************************************/
  245.   
  246. > void ERR_put_error(int lib, int func, int reason, const char *file,
  247.   	     int line)
  248.   	{

crypto/err/err.c:270:2: Skipping ERR_get_state(): empty list of specs
  268.   	}
  269.   #endif
  270.   	es=ERR_get_state();
          ^
  271.   
  272.   	es->top=(es->top+1)%ERR_NUM_ERRORS;

crypto/err/err.c:272:2: 
  270.   	es=ERR_get_state();
  271.   
  272. > 	es->top=(es->top+1)%ERR_NUM_ERRORS;
  273.   	if (es->top == es->bottom)
  274.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;

crypto/err/err.c:273:6: Taking false branch
  271.   
  272.   	es->top=(es->top+1)%ERR_NUM_ERRORS;
  273.   	if (es->top == es->bottom)
              ^
  274.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
  275.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);

crypto/err/err.c:275:2: 
  273.   	if (es->top == es->bottom)
  274.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
  275. > 	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
  276.   	es->err_file[es->top]=file;
  277.   	es->err_line[es->top]=line;

crypto/err/err.c:276:2: 
  274.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
  275.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
  276. > 	es->err_file[es->top]=file;
  277.   	es->err_line[es->top]=line;
  278.   	err_clear_data(es,es->top);

crypto/err/err.c:277:2: 
  275.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
  276.   	es->err_file[es->top]=file;
  277. > 	es->err_line[es->top]=line;
  278.   	err_clear_data(es,es->top);
  279.   	}

crypto/err/err.c:278:2: Taking true branch
  276.   	es->err_file[es->top]=file;
  277.   	es->err_line[es->top]=line;
  278.   	err_clear_data(es,es->top);
          ^
  279.   	}
  280.   

crypto/err/err.c:278:2: Taking true branch
  276.   	es->err_file[es->top]=file;
  277.   	es->err_line[es->top]=line;
  278.   	err_clear_data(es,es->top);
          ^
  279.   	}
  280.   

crypto/mem.c:230:1: start of procedure CRYPTO_free()
    228.   	}
    229.   
    230. > void CRYPTO_free(void *str)
    231.   	{
    232.   	if (free_debug_func != NULL)

crypto/mem.c:232:6: Taking true branch
    230.   void CRYPTO_free(void *str)
    231.   	{
    232.   	if (free_debug_func != NULL)
                ^
    233.   		free_debug_func(str, 0);
    234.   #ifdef LEVITTE_DEBUG

crypto/mem.c:233:3: Skipping __function_pointer__(): unresolved function pointer
    231.   	{
    232.   	if (free_debug_func != NULL)
    233.   		free_debug_func(str, 0);
             ^
    234.   #ifdef LEVITTE_DEBUG
    235.   	fprintf(stderr, "LEVITTE_DEBUG:         < 0x%p\n", str);

crypto/mem.c:237:2: Skipping __function_pointer__(): unresolved function pointer
    235.   	fprintf(stderr, "LEVITTE_DEBUG:         < 0x%p\n", str);
    236.   #endif
    237.   	free_func(str);
            ^
    238.   	if (free_debug_func != NULL)
    239.   		free_debug_func(NULL, 1);

crypto/mem.c:238:6: Taking true branch
    236.   #endif
    237.   	free_func(str);
    238.   	if (free_debug_func != NULL)
                ^
    239.   		free_debug_func(NULL, 1);
    240.   	}

crypto/mem.c:239:3: Skipping __function_pointer__(): unresolved function pointer
    237.   	free_func(str);
    238.   	if (free_debug_func != NULL)
    239.   		free_debug_func(NULL, 1);
             ^
    240.   	}
    241.   

crypto/mem.c:238:2: 
    236.   #endif
    237.   	free_func(str);
    238. > 	if (free_debug_func != NULL)
    239.   		free_debug_func(NULL, 1);
    240.   	}

crypto/mem.c:240:2: return from a call to CRYPTO_free
    238.   	if (free_debug_func != NULL)
    239.   		free_debug_func(NULL, 1);
    240.   	}
            ^
    241.   
    242.   void *CRYPTO_remalloc(void *a, int num, const char *file, int line)

crypto/err/err.c:278:2: 
  276.   	es->err_file[es->top]=file;
  277.   	es->err_line[es->top]=line;
  278. > 	err_clear_data(es,es->top);
  279.   	}
  280.   

crypto/err/err.c:279:2: return from a call to ERR_put_error
  277.   	es->err_line[es->top]=line;
  278.   	err_clear_data(es,es->top);
  279.   	}
          ^
  280.   
  281.   void ERR_clear_error(void)

crypto/rsa/rsa_sign.c:215:1: 
213.   			ret=1;
214.   	}
215. > err:
216.   	if (sig != NULL) X509_SIG_free(sig);
217.   	memset(s,0,(unsigned int)siglen);

crypto/rsa/rsa_sign.c:216:6: Taking false branch
214.   	}
215.   err:
216.   	if (sig != NULL) X509_SIG_free(sig);
            ^
217.   	memset(s,0,(unsigned int)siglen);
218.   	Free(s);

crypto/rsa/rsa_sign.c:217:2: 
215.   err:
216.   	if (sig != NULL) X509_SIG_free(sig);
217. > 	memset(s,0,(unsigned int)siglen);
218.   	Free(s);
219.   	return(ret);
