apps/ca.c:2994: error: NULL_DEREFERENCE
  pointer `tmp` last assigned on line 2992 could be null and is dereferenced by call to `strchr()` at line 2994, column 6.
Showing all 52 steps of the trace


apps/ca.c:2984:1: start of procedure unpack_revinfo()
2982.   	}
2983.   
2984. > int unpack_revinfo(ASN1_TIME **prevtm, int *preason, ASN1_OBJECT **phold, ASN1_GENERALIZEDTIME **pinvtm, char *str)
2985.   	{
2986.   	char *tmp = NULL;

apps/ca.c:2986:2: 
2984.   int unpack_revinfo(ASN1_TIME **prevtm, int *preason, ASN1_OBJECT **phold, ASN1_GENERALIZEDTIME **pinvtm, char *str)
2985.   	{
2986. > 	char *tmp = NULL;
2987.   	char *rtime_str, *reason_str = NULL, *arg_str = NULL, *p;
2988.   	int reason_code = -1;

apps/ca.c:2987:2: 
2985.   	{
2986.   	char *tmp = NULL;
2987. > 	char *rtime_str, *reason_str = NULL, *arg_str = NULL, *p;
2988.   	int reason_code = -1;
2989.   	int i, ret = 0;

apps/ca.c:2988:2: 
2986.   	char *tmp = NULL;
2987.   	char *rtime_str, *reason_str = NULL, *arg_str = NULL, *p;
2988. > 	int reason_code = -1;
2989.   	int i, ret = 0;
2990.   	ASN1_OBJECT *hold = NULL;

apps/ca.c:2989:2: 
2987.   	char *rtime_str, *reason_str = NULL, *arg_str = NULL, *p;
2988.   	int reason_code = -1;
2989. > 	int i, ret = 0;
2990.   	ASN1_OBJECT *hold = NULL;
2991.   	ASN1_GENERALIZEDTIME *comp_time = NULL;

apps/ca.c:2990:2: 
2988.   	int reason_code = -1;
2989.   	int i, ret = 0;
2990. > 	ASN1_OBJECT *hold = NULL;
2991.   	ASN1_GENERALIZEDTIME *comp_time = NULL;
2992.   	tmp = BUF_strdup(str);

apps/ca.c:2991:2: 
2989.   	int i, ret = 0;
2990.   	ASN1_OBJECT *hold = NULL;
2991. > 	ASN1_GENERALIZEDTIME *comp_time = NULL;
2992.   	tmp = BUF_strdup(str);
2993.   

apps/ca.c:2992:2: 
2990.   	ASN1_OBJECT *hold = NULL;
2991.   	ASN1_GENERALIZEDTIME *comp_time = NULL;
2992. > 	tmp = BUF_strdup(str);
2993.   
2994.   	p = strchr(tmp, ',');

crypto/buffer/buffer.c:165:1: start of procedure BUF_strdup()
  163.   	}
  164.   
  165. > char *BUF_strdup(const char *str)
  166.   	{
  167.   	if (str == NULL) return(NULL);

crypto/buffer/buffer.c:167:6: Taking false branch
  165.   char *BUF_strdup(const char *str)
  166.   	{
  167.   	if (str == NULL) return(NULL);
              ^
  168.   	return BUF_strndup(str, strlen(str));
  169.   	}

crypto/buffer/buffer.c:168:2: 
  166.   	{
  167.   	if (str == NULL) return(NULL);
  168. > 	return BUF_strndup(str, strlen(str));
  169.   	}
  170.   

crypto/buffer/buffer.c:171:1: start of procedure BUF_strndup()
    169.   	}
    170.   
    171. > char *BUF_strndup(const char *str, size_t siz)
    172.   	{
    173.   	char *ret;

crypto/buffer/buffer.c:175:6: Taking false branch
    173.   	char *ret;
    174.   
    175.   	if (str == NULL) return(NULL);
                ^
    176.   
    177.   	ret=OPENSSL_malloc(siz+1);

crypto/buffer/buffer.c:177:2: 
    175.   	if (str == NULL) return(NULL);
    176.   
    177. > 	ret=OPENSSL_malloc(siz+1);
    178.   	if (ret == NULL) 
    179.   		{

crypto/mem.c:291:1: start of procedure CRYPTO_malloc()
      289.   	}
      290.   
      291. > void *CRYPTO_malloc(int num, const char *file, int line)
      292.   	{
      293.   	void *ret = NULL;

crypto/mem.c:293:2: 
      291.   void *CRYPTO_malloc(int num, const char *file, int line)
      292.   	{
      293. > 	void *ret = NULL;
      294.   	extern unsigned char cleanse_ctr;
      295.   

crypto/mem.c:296:6: Taking false branch
      294.   	extern unsigned char cleanse_ctr;
      295.   
      296.   	if (num < 0) return NULL;
                  ^
      297.   
      298.   	allow_customize = 0;

crypto/mem.c:298:2: 
      296.   	if (num < 0) return NULL;
      297.   
      298. > 	allow_customize = 0;
      299.   	if (malloc_debug_func != NULL)
      300.   		{

crypto/mem.c:299:6: Taking true branch
      297.   
      298.   	allow_customize = 0;
      299.   	if (malloc_debug_func != NULL)
                  ^
      300.   		{
      301.   		allow_customize_debug = 0;

crypto/mem.c:301:3: 
      299.   	if (malloc_debug_func != NULL)
      300.   		{
      301. > 		allow_customize_debug = 0;
      302.   		malloc_debug_func(NULL, num, file, line, 0);
      303.   		}

crypto/mem.c:302:3: Skipping __function_pointer__(): unresolved function pointer
      300.   		{
      301.   		allow_customize_debug = 0;
      302.   		malloc_debug_func(NULL, num, file, line, 0);
               ^
      303.   		}
      304.   	ret = malloc_ex_func(num,file,line);

crypto/mem.c:304:2: Skipping __function_pointer__(): unresolved function pointer
      302.   		malloc_debug_func(NULL, num, file, line, 0);
      303.   		}
      304.   	ret = malloc_ex_func(num,file,line);
              ^
      305.   #ifdef LEVITTE_DEBUG_MEM
      306.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);

crypto/mem.c:308:6: Taking true branch
      306.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);
      307.   #endif
      308.   	if (malloc_debug_func != NULL)
                  ^
      309.   		malloc_debug_func(ret, num, file, line, 1);
      310.   

crypto/mem.c:309:3: Skipping __function_pointer__(): unresolved function pointer
      307.   #endif
      308.   	if (malloc_debug_func != NULL)
      309.   		malloc_debug_func(ret, num, file, line, 1);
               ^
      310.   
      311.           /* Create a dependency on the value of 'cleanse_ctr' so our memory

crypto/mem.c:314:12: Taking false branch
      312.            * sanitisation function can't be optimised out. NB: We only do
      313.            * this for >2Kb so the overhead doesn't bother us. */
      314.           if(ret && (num > 2048))
                        ^
      315.                   ((unsigned char *)ret)[0] = cleanse_ctr;
      316.   

crypto/mem.c:317:2: 
      315.                   ((unsigned char *)ret)[0] = cleanse_ctr;
      316.   
      317. > 	return ret;
      318.   	}
      319.   

crypto/mem.c:318:2: return from a call to CRYPTO_malloc
      316.   
      317.   	return ret;
      318.   	}
              ^
      319.   
      320.   void *CRYPTO_realloc(void *str, int num, const char *file, int line)

crypto/buffer/buffer.c:178:6: Taking true branch
    176.   
    177.   	ret=OPENSSL_malloc(siz+1);
    178.   	if (ret == NULL) 
                ^
    179.   		{
    180.   		BUFerr(BUF_F_BUF_STRNDUP,ERR_R_MALLOC_FAILURE);

crypto/buffer/buffer.c:180:3: 
    178.   	if (ret == NULL) 
    179.   		{
    180. > 		BUFerr(BUF_F_BUF_STRNDUP,ERR_R_MALLOC_FAILURE);
    181.   		return(NULL);
    182.   		}

crypto/err/err.c:619:1: start of procedure ERR_put_error()
      617.   /********************************************************/
      618.   
      619. > void ERR_put_error(int lib, int func, int reason, const char *file,
      620.   	     int line)
      621.   	{

crypto/err/err.c:643:2: Skipping ERR_get_state(): empty list of specs
      641.   	}
      642.   #endif
      643.   	es=ERR_get_state();
              ^
      644.   
      645.   	es->top=(es->top+1)%ERR_NUM_ERRORS;

crypto/err/err.c:645:2: 
      643.   	es=ERR_get_state();
      644.   
      645. > 	es->top=(es->top+1)%ERR_NUM_ERRORS;
      646.   	if (es->top == es->bottom)
      647.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;

crypto/err/err.c:646:6: Taking false branch
      644.   
      645.   	es->top=(es->top+1)%ERR_NUM_ERRORS;
      646.   	if (es->top == es->bottom)
                  ^
      647.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
      648.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);

crypto/err/err.c:648:2: 
      646.   	if (es->top == es->bottom)
      647.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
      648. > 	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
      649.   	es->err_file[es->top]=file;
      650.   	es->err_line[es->top]=line;

crypto/err/err.c:649:2: 
      647.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
      648.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
      649. > 	es->err_file[es->top]=file;
      650.   	es->err_line[es->top]=line;
      651.   	err_clear_data(es,es->top);

crypto/err/err.c:650:2: 
      648.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
      649.   	es->err_file[es->top]=file;
      650. > 	es->err_line[es->top]=line;
      651.   	err_clear_data(es,es->top);
      652.   	}

crypto/err/err.c:651:2: Taking true branch
      649.   	es->err_file[es->top]=file;
      650.   	es->err_line[es->top]=line;
      651.   	err_clear_data(es,es->top);
              ^
      652.   	}
      653.   

crypto/err/err.c:651:2: Taking true branch
      649.   	es->err_file[es->top]=file;
      650.   	es->err_line[es->top]=line;
      651.   	err_clear_data(es,es->top);
              ^
      652.   	}
      653.   

crypto/mem.c:367:1: start of procedure CRYPTO_free()
        365.   	}
        366.   
        367. > void CRYPTO_free(void *str)
        368.   	{
        369.   	if (free_debug_func != NULL)

crypto/mem.c:369:6: Taking true branch
        367.   void CRYPTO_free(void *str)
        368.   	{
        369.   	if (free_debug_func != NULL)
                    ^
        370.   		free_debug_func(str, 0);
        371.   #ifdef LEVITTE_DEBUG_MEM

crypto/mem.c:370:3: Skipping __function_pointer__(): unresolved function pointer
        368.   	{
        369.   	if (free_debug_func != NULL)
        370.   		free_debug_func(str, 0);
                 ^
        371.   #ifdef LEVITTE_DEBUG_MEM
        372.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         < 0x%p\n", str);

crypto/mem.c:374:2: Skipping __function_pointer__(): unresolved function pointer
        372.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         < 0x%p\n", str);
        373.   #endif
        374.   	free_func(str);
                ^
        375.   	if (free_debug_func != NULL)
        376.   		free_debug_func(NULL, 1);

crypto/mem.c:375:6: Taking true branch
        373.   #endif
        374.   	free_func(str);
        375.   	if (free_debug_func != NULL)
                    ^
        376.   		free_debug_func(NULL, 1);
        377.   	}

crypto/mem.c:376:3: Skipping __function_pointer__(): unresolved function pointer
        374.   	free_func(str);
        375.   	if (free_debug_func != NULL)
        376.   		free_debug_func(NULL, 1);
                 ^
        377.   	}
        378.   

crypto/mem.c:375:2: 
        373.   #endif
        374.   	free_func(str);
        375. > 	if (free_debug_func != NULL)
        376.   		free_debug_func(NULL, 1);
        377.   	}

crypto/mem.c:377:2: return from a call to CRYPTO_free
        375.   	if (free_debug_func != NULL)
        376.   		free_debug_func(NULL, 1);
        377.   	}
                ^
        378.   
        379.   void *CRYPTO_remalloc(void *a, int num, const char *file, int line)

crypto/err/err.c:651:2: 
      649.   	es->err_file[es->top]=file;
      650.   	es->err_line[es->top]=line;
      651. > 	err_clear_data(es,es->top);
      652.   	}
      653.   

crypto/err/err.c:652:2: return from a call to ERR_put_error
      650.   	es->err_line[es->top]=line;
      651.   	err_clear_data(es,es->top);
      652.   	}
              ^
      653.   
      654.   void ERR_clear_error(void)

crypto/buffer/buffer.c:181:3: 
    179.   		{
    180.   		BUFerr(BUF_F_BUF_STRNDUP,ERR_R_MALLOC_FAILURE);
    181. > 		return(NULL);
    182.   		}
    183.   	BUF_strlcpy(ret,str,siz+1);

crypto/buffer/buffer.c:185:2: return from a call to BUF_strndup
    183.   	BUF_strlcpy(ret,str,siz+1);
    184.   	return(ret);
    185.   	}
            ^
    186.   
    187.   void *BUF_memdup(const void *data, size_t siz)

crypto/buffer/buffer.c:169:2: return from a call to BUF_strdup
  167.   	if (str == NULL) return(NULL);
  168.   	return BUF_strndup(str, strlen(str));
  169.   	}
          ^
  170.   
  171.   char *BUF_strndup(const char *str, size_t siz)

apps/ca.c:2994:2: 
2992.   	tmp = BUF_strdup(str);
2993.   
2994. > 	p = strchr(tmp, ',');
2995.   
2996.   	rtime_str = tmp;
