crypto/x509/x509_obj.c:179: error: NULL_DEREFERENCE
  pointer `b` last assigned on line 41 could be null and is dereferenced by call to `BUF_MEM_free()` at line 179, column 5.
Showing all 29 steps of the trace


crypto/x509/x509_obj.c:24:1: start of procedure X509_NAME_oneline()
22.   #define NAME_ONELINE_MAX    (1024 * 1024)
23.   
24. > char *X509_NAME_oneline(const X509_NAME *a, char *buf, int len)
25.   {
26.       const X509_NAME_ENTRY *ne;

crypto/x509/x509_obj.c:32:5: 
30.       char *p;
31.       unsigned char *q;
32. >     BUF_MEM *b = NULL;
33.       static const char hex[17] = "0123456789ABCDEF";
34.       int gs_doit[4];

crypto/x509/x509_obj.c:33:5: 
31.       unsigned char *q;
32.       BUF_MEM *b = NULL;
33. >     static const char hex[17] = "0123456789ABCDEF";
34.       int gs_doit[4];
35.       char tmp_buf[80];

crypto/x509/x509_obj.c:40:9: Taking true branch
38.   #endif
39.   
40.       if (buf == NULL) {
              ^
41.           if ((b = BUF_MEM_new()) == NULL)
42.               goto err;

crypto/x509/x509_obj.c:41:13: 
39.   
40.       if (buf == NULL) {
41. >         if ((b = BUF_MEM_new()) == NULL)
42.               goto err;
43.           if (!BUF_MEM_grow(b, 200))

crypto/buffer/buffer.c:31:1: start of procedure BUF_MEM_new()
  29.   }
  30.   
  31. > BUF_MEM *BUF_MEM_new(void)
  32.   {
  33.       BUF_MEM *ret;

crypto/buffer/buffer.c:35:5: 
  33.       BUF_MEM *ret;
  34.   
  35. >     ret = OPENSSL_zalloc(sizeof(*ret));
  36.       if (ret == NULL) {
  37.           BUFerr(BUF_F_BUF_MEM_NEW, ERR_R_MALLOC_FAILURE);

crypto/mem.c:228:1: start of procedure CRYPTO_zalloc()
    226.   }
    227.   
    228. > void *CRYPTO_zalloc(size_t num, const char *file, int line)
    229.   {
    230.       void *ret = CRYPTO_malloc(num, file, line);

crypto/mem.c:230:5: 
    228.   void *CRYPTO_zalloc(size_t num, const char *file, int line)
    229.   {
    230. >     void *ret = CRYPTO_malloc(num, file, line);
    231.   
    232.       FAILTEST();

crypto/mem.c:192:1: start of procedure CRYPTO_malloc()
      190.   #endif
      191.   
      192. > void *CRYPTO_malloc(size_t num, const char *file, int line)
      193.   {
      194.       void *ret = NULL;

crypto/mem.c:194:5: 
      192.   void *CRYPTO_malloc(size_t num, const char *file, int line)
      193.   {
      194. >     void *ret = NULL;
      195.   
      196.       INCREMENT(malloc_count);

crypto/mem.c:197:9: Taking true branch
      195.   
      196.       INCREMENT(malloc_count);
      197.       if (malloc_impl != NULL && malloc_impl != CRYPTO_malloc)
                     ^
      198.           return malloc_impl(num, file, line);
      199.   

crypto/mem.c:197:32: Taking true branch
      195.   
      196.       INCREMENT(malloc_count);
      197.       if (malloc_impl != NULL && malloc_impl != CRYPTO_malloc)
                                            ^
      198.           return malloc_impl(num, file, line);
      199.   

crypto/mem.c:198:9: Skipping __function_pointer__(): unresolved function pointer
      196.       INCREMENT(malloc_count);
      197.       if (malloc_impl != NULL && malloc_impl != CRYPTO_malloc)
      198.           return malloc_impl(num, file, line);
                     ^
      199.   
      200.       if (num == 0)

crypto/mem.c:226:1: return from a call to CRYPTO_malloc
      224.   
      225.       return ret;
      226. > }
      227.   
      228.   void *CRYPTO_zalloc(size_t num, const char *file, int line)

crypto/mem.c:233:9: Taking false branch
    231.   
    232.       FAILTEST();
    233.       if (ret != NULL)
                   ^
    234.           memset(ret, 0, num);
    235.       return ret;

crypto/mem.c:235:5: 
    233.       if (ret != NULL)
    234.           memset(ret, 0, num);
    235. >     return ret;
    236.   }
    237.   

crypto/mem.c:236:1: return from a call to CRYPTO_zalloc
    234.           memset(ret, 0, num);
    235.       return ret;
    236. > }
    237.   
    238.   void *CRYPTO_realloc(void *str, size_t num, const char *file, int line)

crypto/buffer/buffer.c:36:9: Taking true branch
  34.   
  35.       ret = OPENSSL_zalloc(sizeof(*ret));
  36.       if (ret == NULL) {
                ^
  37.           BUFerr(BUF_F_BUF_MEM_NEW, ERR_R_MALLOC_FAILURE);
  38.           return NULL;

crypto/buffer/buffer.c:37:9: Skipping ERR_put_error(): empty list of specs
  35.       ret = OPENSSL_zalloc(sizeof(*ret));
  36.       if (ret == NULL) {
  37.           BUFerr(BUF_F_BUF_MEM_NEW, ERR_R_MALLOC_FAILURE);
                ^
  38.           return NULL;
  39.       }

crypto/buffer/buffer.c:38:9: 
  36.       if (ret == NULL) {
  37.           BUFerr(BUF_F_BUF_MEM_NEW, ERR_R_MALLOC_FAILURE);
  38. >         return NULL;
  39.       }
  40.       return ret;

crypto/buffer/buffer.c:41:1: return from a call to BUF_MEM_new
  39.       }
  40.       return ret;
  41. > }
  42.   
  43.   void BUF_MEM_free(BUF_MEM *a)

crypto/x509/x509_obj.c:41:13: Taking true branch
39.   
40.       if (buf == NULL) {
41.           if ((b = BUF_MEM_new()) == NULL)
                  ^
42.               goto err;
43.           if (!BUF_MEM_grow(b, 200))

crypto/x509/x509_obj.c:176:2: 
174.           *p = '\0';
175.       return p;
176. >  err:
177.       X509err(X509_F_X509_NAME_ONELINE, ERR_R_MALLOC_FAILURE);
178.    end:

crypto/x509/x509_obj.c:177:5: Skipping ERR_put_error(): empty list of specs
175.       return p;
176.    err:
177.       X509err(X509_F_X509_NAME_ONELINE, ERR_R_MALLOC_FAILURE);
           ^
178.    end:
179.       BUF_MEM_free(b);

crypto/x509/x509_obj.c:178:2: 
176.    err:
177.       X509err(X509_F_X509_NAME_ONELINE, ERR_R_MALLOC_FAILURE);
178. >  end:
179.       BUF_MEM_free(b);
180.       return NULL;

crypto/x509/x509_obj.c:179:5: 
177.       X509err(X509_F_X509_NAME_ONELINE, ERR_R_MALLOC_FAILURE);
178.    end:
179. >     BUF_MEM_free(b);
180.       return NULL;
181.   }

crypto/buffer/buffer.c:43:1: start of procedure BUF_MEM_free()
  41.   }
  42.   
  43. > void BUF_MEM_free(BUF_MEM *a)
  44.   {
  45.       if (a->data != NULL) {

crypto/buffer/buffer.c:45:9: 
  43.   void BUF_MEM_free(BUF_MEM *a)
  44.   {
  45. >     if (a->data != NULL) {
  46.           if (a->flags & BUF_MEM_FLAG_SECURE)
  47.               OPENSSL_secure_clear_free(a->data, a->max);
