crypto/asn1/a_bytes.c:307: error: NULL_DEREFERENCE
  pointer `&b->data` last assigned on line 277 could be null and is dereferenced by call to `BUF_MEM_grow()` at line 307, column 8.
Showing all 32 steps of the trace


crypto/asn1/a_bytes.c:269:1: start of procedure asn1_collate_primative()
267.   /* There have been a few bug fixes for this function from
268.    * Paul Keogh <paul.keogh@sse.ie>, many thanks to him */
269. > static int asn1_collate_primative(ASN1_STRING *a, ASN1_CTX *c)
270.   	{
271.   	ASN1_STRING *os=NULL;

crypto/asn1/a_bytes.c:271:2: 
269.   static int asn1_collate_primative(ASN1_STRING *a, ASN1_CTX *c)
270.   	{
271. > 	ASN1_STRING *os=NULL;
272.   	BUF_MEM b;
273.   	int num;

crypto/asn1/a_bytes.c:275:2: 
273.   	int num;
274.   
275. > 	b.length=0;
276.   	b.max=0;
277.   	b.data=NULL;

crypto/asn1/a_bytes.c:276:2: 
274.   
275.   	b.length=0;
276. > 	b.max=0;
277.   	b.data=NULL;
278.   

crypto/asn1/a_bytes.c:277:2: 
275.   	b.length=0;
276.   	b.max=0;
277. > 	b.data=NULL;
278.   
279.   	if (a == NULL)

crypto/asn1/a_bytes.c:279:6: Taking false branch
277.   	b.data=NULL;
278.   
279.   	if (a == NULL)
            ^
280.   		{
281.   		c->error=ERR_R_PASSED_NULL_PARAMETER;

crypto/asn1/a_bytes.c:285:2: 
283.   		}
284.   
285. > 	num=0;
286.   	for (;;)
287.   		{

crypto/asn1/a_bytes.c:316:3: Loop condition is true. Entering loop body
314.   			c->slen-=(c->p-c->q);
315.   		num+=os->length;
316.   		}
         ^
317.   
318.   	if (!asn1_Finish(c)) goto err;

crypto/asn1/a_bytes.c:288:7: Taking true branch
286.   	for (;;)
287.   		{
288.   		if (c->inf & 1)
             ^
289.   			{
290.   			c->eos=ASN1_check_infinite_end(&c->p,

crypto/asn1/a_bytes.c:290:4: 
288.   		if (c->inf & 1)
289.   			{
290. > 			c->eos=ASN1_check_infinite_end(&c->p,
291.   				(long)(c->max-c->p));
292.   			if (c->eos) break;

crypto/asn1/asn1_lib.c:74:1: start of procedure ASN1_check_infinite_end()
  72.   const char *ASN1_version="ASN.1" OPENSSL_VERSION_PTEXT;
  73.   
  74. > int ASN1_check_infinite_end(unsigned char **p, long len)
  75.   	{
  76.   	/* If there is 0 or 1 byte left, the length check should pick

crypto/asn1/asn1_lib.c:78:6: Taking false branch
  76.   	/* If there is 0 or 1 byte left, the length check should pick
  77.   	 * things up */
  78.   	if (len <= 0)
             ^
  79.   		return(1);
  80.   	else if ((len >= 2) && ((*p)[0] == 0) && ((*p)[1] == 0))

crypto/asn1/asn1_lib.c:80:12: Taking true branch
  78.   	if (len <= 0)
  79.   		return(1);
  80.   	else if ((len >= 2) && ((*p)[0] == 0) && ((*p)[1] == 0))
                   ^
  81.   		{
  82.   		(*p)+=2;

crypto/asn1/asn1_lib.c:80:26: Taking false branch
  78.   	if (len <= 0)
  79.   		return(1);
  80.   	else if ((len >= 2) && ((*p)[0] == 0) && ((*p)[1] == 0))
                                 ^
  81.   		{
  82.   		(*p)+=2;

crypto/asn1/asn1_lib.c:85:2: 
  83.   		return(1);
  84.   		}
  85. > 	return(0);
  86.   	}
  87.   

crypto/asn1/asn1_lib.c:86:2: return from a call to ASN1_check_infinite_end
  84.   		}
  85.   	return(0);
  86.   	}
         ^
  87.   
  88.   

crypto/asn1/a_bytes.c:292:8: Taking false branch
290.   			c->eos=ASN1_check_infinite_end(&c->p,
291.   				(long)(c->max-c->p));
292.   			if (c->eos) break;
              ^
293.   			}
294.   		else

crypto/asn1/a_bytes.c:299:3: 
297.   			}
298.   
299. > 		c->q=c->p;
300.   		if (d2i_ASN1_bytes(&os,&c->p,c->max-c->p,c->tag,c->xclass)
301.   			== NULL)

crypto/asn1/a_bytes.c:300:7: Taking false branch
298.   
299.   		c->q=c->p;
300.   		if (d2i_ASN1_bytes(&os,&c->p,c->max-c->p,c->tag,c->xclass)
             ^
301.   			== NULL)
302.   			{

crypto/asn1/a_bytes.c:307:8: 
305.   			}
306.   
307. > 		if (!BUF_MEM_grow(&b,num+os->length))
308.   			{
309.   			c->error=ERR_R_BUF_LIB;

crypto/buffer/buffer.c:92:1: start of procedure BUF_MEM_grow()
  90.   	}
  91.   
  92. > int BUF_MEM_grow(BUF_MEM *str, int len)
  93.   	{
  94.   	char *ret;

crypto/buffer/buffer.c:97:6: Taking false branch
  95.   	unsigned int n;
  96.   
  97.   	if (str->length >= len)
              ^
  98.   		{
  99.   		str->length=len;

crypto/buffer/buffer.c:102:6: Taking false branch
  100.   		return(len);
  101.   		}
  102.   	if (str->max >= len)
              ^
  103.   		{
  104.   		memset(&(str->data[str->length]),0,len-str->length);

crypto/buffer/buffer.c:108:2: 
  106.   		return(len);
  107.   		}
  108. > 	n=(len+3)/3*4;
  109.   	if (str->data == NULL)
  110.   		ret=(char *)Malloc(n);

crypto/buffer/buffer.c:109:6: Taking false branch
  107.   		}
  108.   	n=(len+3)/3*4;
  109.   	if (str->data == NULL)
              ^
  110.   		ret=(char *)Malloc(n);
  111.   	else

crypto/buffer/buffer.c:112:3: 
  110.   		ret=(char *)Malloc(n);
  111.   	else
  112. > 		ret=(char *)Realloc(str->data,n);
  113.   	if (ret == NULL)
  114.   		{

crypto/buffer/buffer.c:113:6: Taking false branch
  111.   	else
  112.   		ret=(char *)Realloc(str->data,n);
  113.   	if (ret == NULL)
              ^
  114.   		{
  115.   		BUFerr(BUF_F_BUF_MEM_GROW,ERR_R_MALLOC_FAILURE);

crypto/buffer/buffer.c:120:3: 
  118.   	else
  119.   		{
  120. > 		str->data=ret;
  121.   		str->length=len;
  122.   		str->max=n;

crypto/buffer/buffer.c:121:3: 
  119.   		{
  120.   		str->data=ret;
  121. > 		str->length=len;
  122.   		str->max=n;
  123.   		}

crypto/buffer/buffer.c:122:3: 
  120.   		str->data=ret;
  121.   		str->length=len;
  122. > 		str->max=n;
  123.   		}
  124.   	return(len);

crypto/buffer/buffer.c:124:2: 
  122.   		str->max=n;
  123.   		}
  124. > 	return(len);
  125.   	}
  126.   

crypto/buffer/buffer.c:125:2: return from a call to BUF_MEM_grow
  123.   		}
  124.   	return(len);
  125.   	}
          ^
  126.   
  127.   char *BUF_strdup(const char *str)
