apps/speed.c:2977: error: NULL_DEREFERENCE
  pointer `fds` last assigned on line 2967 could be null and is dereferenced at line 2977, column 13.
Showing all 35 steps of the trace


apps/speed.c:2960:1: start of procedure do_multi()
2958.   }
2959.   
2960. > static int do_multi(int multi)
2961.   {
2962.       int n;

apps/speed.c:2965:5: 
2963.       int fd[2];
2964.       int *fds;
2965. >     static char sep[] = ":";
2966.   
2967.       fds = malloc(sizeof(*fds) * multi);

apps/speed.c:2967:5: 
2965.       static char sep[] = ":";
2966.   
2967. >     fds = malloc(sizeof(*fds) * multi);
2968.       for (n = 0; n < multi; ++n) {
2969.           if (pipe(fd) == -1) {

apps/speed.c:2968:10: 
2966.   
2967.       fds = malloc(sizeof(*fds) * multi);
2968. >     for (n = 0; n < multi; ++n) {
2969.           if (pipe(fd) == -1) {
2970.               BIO_printf(bio_err, "pipe failure\n");

apps/speed.c:2968:17: Loop condition is true. Entering loop body
2966.   
2967.       fds = malloc(sizeof(*fds) * multi);
2968.       for (n = 0; n < multi; ++n) {
                        ^
2969.           if (pipe(fd) == -1) {
2970.               BIO_printf(bio_err, "pipe failure\n");

apps/speed.c:2969:13: Taking false branch
2967.       fds = malloc(sizeof(*fds) * multi);
2968.       for (n = 0; n < multi; ++n) {
2969.           if (pipe(fd) == -1) {
                    ^
2970.               BIO_printf(bio_err, "pipe failure\n");
2971.               exit(1);

apps/speed.c:2973:9: 
2971.               exit(1);
2972.           }
2973. >         fflush(stdout);
2974.           (void)BIO_flush(bio_err);
2975.           if (fork()) {

apps/speed.c:2974:15: 
2972.           }
2973.           fflush(stdout);
2974. >         (void)BIO_flush(bio_err);
2975.           if (fork()) {
2976.               close(fd[1]);

crypto/bio/bio_lib.c:509:1: start of procedure BIO_ctrl()
  507.   }
  508.   
  509. > long BIO_ctrl(BIO *b, int cmd, long larg, void *parg)
  510.   {
  511.       long ret;

crypto/bio/bio_lib.c:513:9: Taking false branch
  511.       long ret;
  512.   
  513.       if (b == NULL)
                 ^
  514.           return 0;
  515.   

crypto/bio/bio_lib.c:516:10: Taking false branch
  514.           return 0;
  515.   
  516.       if ((b->method == NULL) || (b->method->ctrl == NULL)) {
                  ^
  517.           BIOerr(BIO_F_BIO_CTRL, BIO_R_UNSUPPORTED_METHOD);
  518.           return -2;

crypto/bio/bio_lib.c:516:33: Taking true branch
  514.           return 0;
  515.   
  516.       if ((b->method == NULL) || (b->method->ctrl == NULL)) {
                                         ^
  517.           BIOerr(BIO_F_BIO_CTRL, BIO_R_UNSUPPORTED_METHOD);
  518.           return -2;

crypto/bio/bio_lib.c:517:9: 
  515.   
  516.       if ((b->method == NULL) || (b->method->ctrl == NULL)) {
  517. >         BIOerr(BIO_F_BIO_CTRL, BIO_R_UNSUPPORTED_METHOD);
  518.           return -2;
  519.       }

crypto/err/err.c:365:1: start of procedure ERR_put_error()
    363.   /********************************************************/
    364.   
    365. > void ERR_put_error(int lib, int func, int reason, const char *file, int line)
    366.   {
    367.       ERR_STATE *es;

crypto/err/err.c:388:5: 
    386.       }
    387.   #endif
    388. >     es = ERR_get_state();
    389.       if (es == NULL)
    390.           return;

crypto/err/err.c:679:1: start of procedure ERR_get_state()
      677.   }
      678.   
      679. > ERR_STATE *ERR_get_state(void)
      680.   {
      681.       ERR_STATE *state = NULL;

crypto/err/err.c:681:5: 
      679.   ERR_STATE *ERR_get_state(void)
      680.   {
      681. >     ERR_STATE *state = NULL;
      682.   
      683.       if (!RUN_ONCE(&err_init, err_do_init))

crypto/err/err.c:683:10: 
      681.       ERR_STATE *state = NULL;
      682.   
      683. >     if (!RUN_ONCE(&err_init, err_do_init))
      684.           return NULL;
      685.   

crypto/threads_pthread.c:105:1: start of procedure CRYPTO_THREAD_run_once()
        103.   }
        104.   
        105. > int CRYPTO_THREAD_run_once(CRYPTO_ONCE *once, void (*init)(void))
        106.   {
        107.       if (pthread_once(once, init) != 0)

crypto/threads_pthread.c:107:9: Taking true branch
        105.   int CRYPTO_THREAD_run_once(CRYPTO_ONCE *once, void (*init)(void))
        106.   {
        107.       if (pthread_once(once, init) != 0)
                       ^
        108.           return 0;
        109.   

crypto/threads_pthread.c:108:9: 
        106.   {
        107.       if (pthread_once(once, init) != 0)
        108. >         return 0;
        109.   
        110.       return 1;

crypto/threads_pthread.c:111:1: return from a call to CRYPTO_THREAD_run_once
        109.   
        110.       return 1;
        111. > }
        112.   
        113.   int CRYPTO_THREAD_init_local(CRYPTO_THREAD_LOCAL *key, void (*cleanup)(void *))

crypto/err/err.c:683:10: Condition is false
      681.       ERR_STATE *state = NULL;
      682.   
      683.       if (!RUN_ONCE(&err_init, err_do_init))
                      ^
      684.           return NULL;
      685.   

crypto/err/err.c:683:10: Taking true branch
      681.       ERR_STATE *state = NULL;
      682.   
      683.       if (!RUN_ONCE(&err_init, err_do_init))
                      ^
      684.           return NULL;
      685.   

crypto/err/err.c:684:9: 
      682.   
      683.       if (!RUN_ONCE(&err_init, err_do_init))
      684. >         return NULL;
      685.   
      686.       state = CRYPTO_THREAD_get_local(&err_thread_local);

crypto/err/err.c:704:1: return from a call to ERR_get_state
      702.   
      703.       return state;
      704. > }
      705.   
      706.   int ERR_get_next_error_library(void)

crypto/err/err.c:389:9: Taking true branch
    387.   #endif
    388.       es = ERR_get_state();
    389.       if (es == NULL)
                   ^
    390.           return;
    391.   

crypto/err/err.c:390:9: 
    388.       es = ERR_get_state();
    389.       if (es == NULL)
    390. >         return;
    391.   
    392.       es->top = (es->top + 1) % ERR_NUM_ERRORS;

crypto/err/err.c:400:1: return from a call to ERR_put_error
    398.       es->err_line[es->top] = line;
    399.       err_clear_data(es, es->top);
    400. > }
    401.   
    402.   void ERR_clear_error(void)

crypto/bio/bio_lib.c:518:9: 
  516.       if ((b->method == NULL) || (b->method->ctrl == NULL)) {
  517.           BIOerr(BIO_F_BIO_CTRL, BIO_R_UNSUPPORTED_METHOD);
  518. >         return -2;
  519.       }
  520.   

crypto/bio/bio_lib.c:534:1: return from a call to BIO_ctrl
  532.   
  533.       return ret;
  534. > }
  535.   
  536.   long BIO_callback_ctrl(BIO *b, int cmd,

apps/speed.c:2974:9: 
2972.           }
2973.           fflush(stdout);
2974. >         (void)BIO_flush(bio_err);
2975.           if (fork()) {
2976.               close(fd[1]);

apps/speed.c:2975:13: Taking true branch
2973.           fflush(stdout);
2974.           (void)BIO_flush(bio_err);
2975.           if (fork()) {
                    ^
2976.               close(fd[1]);
2977.               fds[n] = fd[0];

apps/speed.c:2976:13: 
2974.           (void)BIO_flush(bio_err);
2975.           if (fork()) {
2976. >             close(fd[1]);
2977.               fds[n] = fd[0];
2978.           } else {

apps/speed.c:2977:13: 
2975.           if (fork()) {
2976.               close(fd[1]);
2977. >             fds[n] = fd[0];
2978.           } else {
2979.               close(fd[0]);
