crypto/bio/b_print.c:731: error: NULL_DEREFERENCE
  pointer `*buffer` last assigned on line 728 could be null and is dereferenced by call to `memcpy()` at line 731, column 7.
Showing all 22 steps of the trace


crypto/bio/b_print.c:712:1: start of procedure doapr_outch()
710.   }
711.   
712. > static void
713.   doapr_outch(
714.       char **sbuffer,

crypto/bio/b_print.c:721:5: 
719.   {
720.       /* If we haven't at least one buffer, someone has doe a big booboo */
721. >     assert(*sbuffer != NULL || buffer != NULL);
722.   
723.       if (buffer) {

crypto/bio/b_print.c:723:9: Taking true branch
721.       assert(*sbuffer != NULL || buffer != NULL);
722.   
723.       if (buffer) {
               ^
724.   	while (*currlen >= *maxlen) {
725.   	    if (*buffer == NULL) {

crypto/bio/b_print.c:724:9: Loop condition is true. Entering loop body
722.   
723.       if (buffer) {
724.   	while (*currlen >= *maxlen) {
               ^
725.   	    if (*buffer == NULL) {
726.   		if (*maxlen == 0)

crypto/bio/b_print.c:725:10: Taking true branch
723.       if (buffer) {
724.   	while (*currlen >= *maxlen) {
725.   	    if (*buffer == NULL) {
                ^
726.   		if (*maxlen == 0)
727.   		    *maxlen = 1024;

crypto/bio/b_print.c:726:7: Taking false branch
724.   	while (*currlen >= *maxlen) {
725.   	    if (*buffer == NULL) {
726.   		if (*maxlen == 0)
             ^
727.   		    *maxlen = 1024;
728.   		*buffer = OPENSSL_malloc(*maxlen);

crypto/bio/b_print.c:728:3: 
726.   		if (*maxlen == 0)
727.   		    *maxlen = 1024;
728. > 		*buffer = OPENSSL_malloc(*maxlen);
729.   		if (*currlen > 0) {
730.   		    assert(*sbuffer != NULL);

crypto/mem.c:289:1: start of procedure CRYPTO_malloc()
  287.   	}
  288.   
  289. > void *CRYPTO_malloc(int num, const char *file, int line)
  290.   	{
  291.   	void *ret = NULL;

crypto/mem.c:291:2: 
  289.   void *CRYPTO_malloc(int num, const char *file, int line)
  290.   	{
  291. > 	void *ret = NULL;
  292.   	extern unsigned char cleanse_ctr;
  293.   

crypto/mem.c:294:2: 
  292.   	extern unsigned char cleanse_ctr;
  293.   
  294. > 	allow_customize = 0;
  295.   	if (malloc_debug_func != NULL)
  296.   		{

crypto/mem.c:295:6: Taking true branch
  293.   
  294.   	allow_customize = 0;
  295.   	if (malloc_debug_func != NULL)
              ^
  296.   		{
  297.   		allow_customize_debug = 0;

crypto/mem.c:297:3: 
  295.   	if (malloc_debug_func != NULL)
  296.   		{
  297. > 		allow_customize_debug = 0;
  298.   		malloc_debug_func(NULL, num, file, line, 0);
  299.   		}

crypto/mem.c:298:3: Skipping __function_pointer__(): unresolved function pointer
  296.   		{
  297.   		allow_customize_debug = 0;
  298.   		malloc_debug_func(NULL, num, file, line, 0);
           ^
  299.   		}
  300.   	ret = malloc_ex_func(num,file,line);

crypto/mem.c:300:2: Skipping __function_pointer__(): unresolved function pointer
  298.   		malloc_debug_func(NULL, num, file, line, 0);
  299.   		}
  300.   	ret = malloc_ex_func(num,file,line);
          ^
  301.   #ifdef LEVITTE_DEBUG_MEM
  302.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);

crypto/mem.c:304:6: Taking true branch
  302.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);
  303.   #endif
  304.   	if (malloc_debug_func != NULL)
              ^
  305.   		malloc_debug_func(ret, num, file, line, 1);
  306.   

crypto/mem.c:305:3: Skipping __function_pointer__(): unresolved function pointer
  303.   #endif
  304.   	if (malloc_debug_func != NULL)
  305.   		malloc_debug_func(ret, num, file, line, 1);
           ^
  306.   
  307.           /* Create a dependency on the value of 'cleanse_ctr' so our memory

crypto/mem.c:310:12: Taking false branch
  308.            * sanitisation function can't be optimised out. NB: We only do
  309.            * this for >2Kb so the overhead doesn't bother us. */
  310.           if(ret && (num > 2048))
                    ^
  311.                   ((unsigned char *)ret)[0] = cleanse_ctr;
  312.   

crypto/mem.c:313:2: 
  311.                   ((unsigned char *)ret)[0] = cleanse_ctr;
  312.   
  313. > 	return ret;
  314.   	}
  315.   

crypto/mem.c:314:2: return from a call to CRYPTO_malloc
  312.   
  313.   	return ret;
  314.   	}
          ^
  315.   
  316.   void *CRYPTO_realloc(void *str, int num, const char *file, int line)

crypto/bio/b_print.c:729:7: Taking true branch
727.   		    *maxlen = 1024;
728.   		*buffer = OPENSSL_malloc(*maxlen);
729.   		if (*currlen > 0) {
             ^
730.   		    assert(*sbuffer != NULL);
731.   		    memcpy(*buffer, *sbuffer, *currlen);

crypto/bio/b_print.c:730:7: 
728.   		*buffer = OPENSSL_malloc(*maxlen);
729.   		if (*currlen > 0) {
730. > 		    assert(*sbuffer != NULL);
731.   		    memcpy(*buffer, *sbuffer, *currlen);
732.   		}

crypto/bio/b_print.c:731:7: 
729.   		if (*currlen > 0) {
730.   		    assert(*sbuffer != NULL);
731. > 		    memcpy(*buffer, *sbuffer, *currlen);
732.   		}
733.   		*sbuffer = NULL;
