crypto/x509/x509_obj.c:85: error: NULL_DEREFERENCE
  pointer `b->data` last assigned on line 84 could be null and is dereferenced by call to `BUF_MEM_grow()` at line 85, column 8.
Showing all 27 steps of the trace


crypto/x509/x509_obj.c:66:1: start of procedure X509_NAME_oneline()
64.   #include <openssl/buffer.h>
65.   
66. > char *X509_NAME_oneline(X509_NAME *a, char *buf, int len)
67.   	{
68.   	X509_NAME_ENTRY *ne;

crypto/x509/x509_obj.c:74:2: 
72.   	char *p;
73.   	unsigned char *q;
74. > 	BUF_MEM *b=NULL;
75.   	static char hex[17]="0123456789ABCDEF";
76.   	int gs_doit[4];

crypto/x509/x509_obj.c:75:2: 
73.   	unsigned char *q;
74.   	BUF_MEM *b=NULL;
75. > 	static char hex[17]="0123456789ABCDEF";
76.   	int gs_doit[4];
77.   	char tmp_buf[80];

crypto/x509/x509_obj.c:82:6: Taking true branch
80.   #endif
81.   
82.   	if (buf == NULL)
           ^
83.   		{
84.   		if ((b=BUF_MEM_new()) == NULL) goto err;

crypto/x509/x509_obj.c:84:7: 
82.   	if (buf == NULL)
83.   		{
84. > 		if ((b=BUF_MEM_new()) == NULL) goto err;
85.   		if (!BUF_MEM_grow(b,200)) goto err;
86.   		b->data[0]='\0';

crypto/buffer/buffer.c:63:1: start of procedure BUF_MEM_new()
  61.   #include <openssl/buffer.h>
  62.   
  63. > BUF_MEM *BUF_MEM_new(void)
  64.   	{
  65.   	BUF_MEM *ret;

crypto/buffer/buffer.c:67:2: 
  65.   	BUF_MEM *ret;
  66.   
  67. > 	ret=Malloc(sizeof(BUF_MEM));
  68.   	if (ret == NULL)
  69.   		{

crypto/buffer/buffer.c:68:6: Taking false branch
  66.   
  67.   	ret=Malloc(sizeof(BUF_MEM));
  68.   	if (ret == NULL)
             ^
  69.   		{
  70.   		BUFerr(BUF_F_BUF_MEM_NEW,ERR_R_MALLOC_FAILURE);

crypto/buffer/buffer.c:73:2: 
  71.   		return(NULL);
  72.   		}
  73. > 	ret->length=0;
  74.   	ret->max=0;
  75.   	ret->data=NULL;

crypto/buffer/buffer.c:74:2: 
  72.   		}
  73.   	ret->length=0;
  74. > 	ret->max=0;
  75.   	ret->data=NULL;
  76.   	return(ret);

crypto/buffer/buffer.c:75:2: 
  73.   	ret->length=0;
  74.   	ret->max=0;
  75. > 	ret->data=NULL;
  76.   	return(ret);
  77.   	}

crypto/buffer/buffer.c:76:2: 
  74.   	ret->max=0;
  75.   	ret->data=NULL;
  76. > 	return(ret);
  77.   	}
  78.   

crypto/buffer/buffer.c:77:2: return from a call to BUF_MEM_new
  75.   	ret->data=NULL;
  76.   	return(ret);
  77.   	}
         ^
  78.   
  79.   void BUF_MEM_free(BUF_MEM *a)

crypto/x509/x509_obj.c:84:7: Taking false branch
82.   	if (buf == NULL)
83.   		{
84.   		if ((b=BUF_MEM_new()) == NULL) goto err;
            ^
85.   		if (!BUF_MEM_grow(b,200)) goto err;
86.   		b->data[0]='\0';

crypto/x509/x509_obj.c:85:8: 
83.   		{
84.   		if ((b=BUF_MEM_new()) == NULL) goto err;
85. > 		if (!BUF_MEM_grow(b,200)) goto err;
86.   		b->data[0]='\0';
87.   		len=200;

crypto/buffer/buffer.c:92:1: start of procedure BUF_MEM_grow()
  90.   	}
  91.   
  92. > int BUF_MEM_grow(BUF_MEM *str, int len)
  93.   	{
  94.   	char *ret;

crypto/buffer/buffer.c:97:6: Taking false branch
  95.   	unsigned int n;
  96.   
  97.   	if (str->length >= len)
              ^
  98.   		{
  99.   		str->length=len;

crypto/buffer/buffer.c:102:6: Taking false branch
  100.   		return(len);
  101.   		}
  102.   	if (str->max >= len)
              ^
  103.   		{
  104.   		memset(&str->data[str->length],0,len-str->length);

crypto/buffer/buffer.c:108:2: 
  106.   		return(len);
  107.   		}
  108. > 	n=(len+3)/3*4;
  109.   	if (str->data == NULL)
  110.   		ret=Malloc(n);

crypto/buffer/buffer.c:109:6: Taking false branch
  107.   		}
  108.   	n=(len+3)/3*4;
  109.   	if (str->data == NULL)
              ^
  110.   		ret=Malloc(n);
  111.   	else

crypto/buffer/buffer.c:112:3: 
  110.   		ret=Malloc(n);
  111.   	else
  112. > 		ret=Realloc(str->data,n);
  113.   	if (ret == NULL)
  114.   		{

crypto/buffer/buffer.c:113:6: Taking false branch
  111.   	else
  112.   		ret=Realloc(str->data,n);
  113.   	if (ret == NULL)
              ^
  114.   		{
  115.   		BUFerr(BUF_F_BUF_MEM_GROW,ERR_R_MALLOC_FAILURE);

crypto/buffer/buffer.c:120:3: 
  118.   	else
  119.   		{
  120. > 		str->data=ret;
  121.   		str->length=len;
  122.   		str->max=n;

crypto/buffer/buffer.c:121:3: 
  119.   		{
  120.   		str->data=ret;
  121. > 		str->length=len;
  122.   		str->max=n;
  123.   		}

crypto/buffer/buffer.c:122:3: 
  120.   		str->data=ret;
  121.   		str->length=len;
  122. > 		str->max=n;
  123.   		}
  124.   	return(len);

crypto/buffer/buffer.c:124:2: 
  122.   		str->max=n;
  123.   		}
  124. > 	return(len);
  125.   	}
  126.   

crypto/buffer/buffer.c:125:2: return from a call to BUF_MEM_grow
  123.   		}
  124.   	return(len);
  125.   	}
          ^
  126.   
  127.   char *BUF_strdup(const char *str)
