crypto/conf/conf_mod.c:269: error: NULL_DEREFERENCE
  pointer `dso` last assigned on line 249 could be null and is dereferenced by call to `DSO_free()` at line 269, column 5.
Showing all 36 steps of the trace


crypto/conf/conf_mod.c:234:1: start of procedure module_load_dso()
232.   
233.   /* Load a module from a DSO */
234. > static CONF_MODULE *module_load_dso(const CONF *cnf, char *name, char *value,
235.                                       unsigned long flags)
236.   {

crypto/conf/conf_mod.c:237:5: 
235.                                       unsigned long flags)
236.   {
237. >     DSO *dso = NULL;
238.       conf_init_func *ifunc;
239.       conf_finish_func *ffunc;

crypto/conf/conf_mod.c:240:5: 
238.       conf_init_func *ifunc;
239.       conf_finish_func *ffunc;
240. >     char *path = NULL;
241.       int errcode = 0;
242.       CONF_MODULE *md;

crypto/conf/conf_mod.c:241:5: 
239.       conf_finish_func *ffunc;
240.       char *path = NULL;
241. >     int errcode = 0;
242.       CONF_MODULE *md;
243.       /* Look for alternative path in module section */

crypto/conf/conf_mod.c:244:5: 
242.       CONF_MODULE *md;
243.       /* Look for alternative path in module section */
244. >     path = NCONF_get_string(cnf, value, "path");
245.       if (!path) {
246.           ERR_clear_error();

crypto/conf/conf_lib.c:306:1: start of procedure NCONF_get_string()
  304.   }
  305.   
  306. > char *NCONF_get_string(const CONF *conf, const char *group, const char *name)
  307.   {
  308.       char *s = _CONF_get_string(conf, group, name);

crypto/conf/conf_lib.c:308:5: 
  306.   char *NCONF_get_string(const CONF *conf, const char *group, const char *name)
  307.   {
  308. >     char *s = _CONF_get_string(conf, group, name);
  309.   
  310.       /*

crypto/conf/conf_api.c:128:1: start of procedure _CONF_get_string()
    126.   }
    127.   
    128. > char *_CONF_get_string(const CONF *conf, const char *section,
    129.                          const char *name)
    130.   {

crypto/conf/conf_api.c:134:9: Taking false branch
    132.       char *p;
    133.   
    134.       if (name == NULL)
                   ^
    135.           return (NULL);
    136.       if (conf != NULL) {

crypto/conf/conf_api.c:136:9: Taking true branch
    134.       if (name == NULL)
    135.           return (NULL);
    136.       if (conf != NULL) {
                   ^
    137.           if (section != NULL) {
    138.               vv.name = (char *)name;

crypto/conf/conf_api.c:137:13: Taking false branch
    135.           return (NULL);
    136.       if (conf != NULL) {
    137.           if (section != NULL) {
                       ^
    138.               vv.name = (char *)name;
    139.               vv.section = (char *)section;

crypto/conf/conf_api.c:149:9: 
    147.               }
    148.           }
    149. >         vv.section = "default";
    150.           vv.name = (char *)name;
    151.           v = lh_CONF_VALUE_retrieve(conf->data, &vv);

crypto/conf/conf_api.c:150:9: 
    148.           }
    149.           vv.section = "default";
    150. >         vv.name = (char *)name;
    151.           v = lh_CONF_VALUE_retrieve(conf->data, &vv);
    152.           if (v != NULL)

crypto/conf/conf_api.c:151:13: Condition is true
    149.           vv.section = "default";
    150.           vv.name = (char *)name;
    151.           v = lh_CONF_VALUE_retrieve(conf->data, &vv);
                       ^
    152.           if (v != NULL)
    153.               return (v->value);

crypto/conf/conf_api.c:151:13: Condition is true
    149.           vv.section = "default";
    150.           vv.name = (char *)name;
    151.           v = lh_CONF_VALUE_retrieve(conf->data, &vv);
                       ^
    152.           if (v != NULL)
    153.               return (v->value);

crypto/conf/conf_api.c:151:9: 
    149.           vv.section = "default";
    150.           vv.name = (char *)name;
    151. >         v = lh_CONF_VALUE_retrieve(conf->data, &vv);
    152.           if (v != NULL)
    153.               return (v->value);

crypto/lhash/lhash.c:237:1: start of procedure lh_retrieve()
      235.   }
      236.   
      237. > void *lh_retrieve(_LHASH *lh, const void *data)
      238.   {
      239.       unsigned long hash;

crypto/lhash/lhash.c:243:5: 
      241.       void *ret;
      242.   
      243. >     lh->error = 0;
      244.       rn = getrn(lh, data, &hash);
      245.   

crypto/lhash/lhash.c:244:5: Skipping getrn(): empty list of specs
      242.   
      243.       lh->error = 0;
      244.       rn = getrn(lh, data, &hash);
                 ^
      245.   
      246.       if (*rn == NULL) {

crypto/lhash/lhash.c:246:9: Taking false branch
      244.       rn = getrn(lh, data, &hash);
      245.   
      246.       if (*rn == NULL) {
                     ^
      247.           lh->num_retrieve_miss++;
      248.           return (NULL);

crypto/lhash/lhash.c:250:9: 
      248.           return (NULL);
      249.       } else {
      250. >         ret = (*rn)->data;
      251.           lh->num_retrieve++;
      252.       }

crypto/lhash/lhash.c:251:9: 
      249.       } else {
      250.           ret = (*rn)->data;
      251. >         lh->num_retrieve++;
      252.       }
      253.       return (ret);

crypto/lhash/lhash.c:253:5: 
      251.           lh->num_retrieve++;
      252.       }
      253. >     return (ret);
      254.   }
      255.   

crypto/lhash/lhash.c:254:1: return from a call to lh_retrieve
      252.       }
      253.       return (ret);
      254. > }
      255.   
      256.   static void doall_util_fn(_LHASH *lh, int use_arg, LHASH_DOALL_FN_TYPE func,

crypto/conf/conf_api.c:152:13: Taking true branch
    150.           vv.name = (char *)name;
    151.           v = lh_CONF_VALUE_retrieve(conf->data, &vv);
    152.           if (v != NULL)
                       ^
    153.               return (v->value);
    154.           else

crypto/conf/conf_api.c:153:13: 
    151.           v = lh_CONF_VALUE_retrieve(conf->data, &vv);
    152.           if (v != NULL)
    153. >             return (v->value);
    154.           else
    155.               return (NULL);

crypto/conf/conf_api.c:158:1: return from a call to _CONF_get_string
    156.       } else
    157.           return (getenv(name));
    158. > }
    159.   
    160.   static unsigned long conf_value_hash(const CONF_VALUE *v)

crypto/conf/conf_lib.c:314:9: Taking true branch
  312.        * NULL, let's check the value first
  313.        */
  314.       if (s)
                 ^
  315.           return s;
  316.   

crypto/conf/conf_lib.c:315:9: 
  313.        */
  314.       if (s)
  315. >         return s;
  316.   
  317.       if (conf == NULL) {

crypto/conf/conf_lib.c:325:1: return from a call to NCONF_get_string
  323.       ERR_add_error_data(4, "group=", group, " name=", name);
  324.       return NULL;
  325. > }
  326.   
  327.   int NCONF_get_number_e(const CONF *conf, const char *group, const char *name,

crypto/conf/conf_mod.c:245:10: Taking false branch
243.       /* Look for alternative path in module section */
244.       path = NCONF_get_string(cnf, value, "path");
245.       if (!path) {
                ^
246.           ERR_clear_error();
247.           path = name;

crypto/conf/conf_mod.c:249:5: Skipping DSO_load(): empty list of specs
247.           path = name;
248.       }
249.       dso = DSO_load(NULL, path, NULL, 0);
           ^
250.       if (!dso) {
251.           errcode = CONF_R_ERROR_LOADING_DSO;

crypto/conf/conf_mod.c:250:10: Taking true branch
248.       }
249.       dso = DSO_load(NULL, path, NULL, 0);
250.       if (!dso) {
                ^
251.           errcode = CONF_R_ERROR_LOADING_DSO;
252.           goto err;

crypto/conf/conf_mod.c:251:9: 
249.       dso = DSO_load(NULL, path, NULL, 0);
250.       if (!dso) {
251. >         errcode = CONF_R_ERROR_LOADING_DSO;
252.           goto err;
253.       }

crypto/conf/conf_mod.c:268:2: 
266.       return md;
267.   
268. >  err:
269.       DSO_free(dso);
270.       CONFerr(CONF_F_MODULE_LOAD_DSO, errcode);

crypto/conf/conf_mod.c:269:5: 
267.   
268.    err:
269. >     DSO_free(dso);
270.       CONFerr(CONF_F_MODULE_LOAD_DSO, errcode);
271.       ERR_add_error_data(4, "module=", name, ", path=", path);
