crypto/rsa/rsa_sign.c:222: error: NULL_DEREFERENCE
  pointer `s` last assigned on line 161 could be null and is dereferenced by call to `memset()` at line 222, column 2.
Showing all 49 steps of the trace


crypto/rsa/rsa_sign.c:144:1: start of procedure RSA_verify()
142.   	}
143.   
144. > int RSA_verify(int dtype, const unsigned char *m, unsigned int m_len,
145.   	     unsigned char *sigbuf, unsigned int siglen, RSA *rsa)
146.   	{

crypto/rsa/rsa_sign.c:147:2: 
145.   	     unsigned char *sigbuf, unsigned int siglen, RSA *rsa)
146.   	{
147. > 	int i,ret=0,sigtype;
148.   	unsigned char *p,*s;
149.   	X509_SIG *sig=NULL;

crypto/rsa/rsa_sign.c:149:2: 
147.   	int i,ret=0,sigtype;
148.   	unsigned char *p,*s;
149. > 	X509_SIG *sig=NULL;
150.   
151.   	if (siglen != (unsigned int)RSA_size(rsa))

crypto/rsa/rsa_sign.c:151:6: 
149.   	X509_SIG *sig=NULL;
150.   
151. > 	if (siglen != (unsigned int)RSA_size(rsa))
152.   		{
153.   		RSAerr(RSA_F_RSA_VERIFY,RSA_R_WRONG_SIGNATURE_LENGTH);

crypto/rsa/rsa_lib.c:262:1: start of procedure RSA_size()
  260.   	}
  261.   
  262. > int RSA_size(const RSA *r)
  263.   	{
  264.   	return(BN_num_bytes(r->n));

crypto/rsa/rsa_lib.c:264:2: 
  262.   int RSA_size(const RSA *r)
  263.   	{
  264. > 	return(BN_num_bytes(r->n));
  265.   	}
  266.   

crypto/bn/bn_lib.c:245:1: start of procedure BN_num_bits()
    243.   	}
    244.   
    245. > int BN_num_bits(const BIGNUM *a)
    246.   	{
    247.   	BN_ULONG l;

crypto/bn/bn_lib.c:252:6: Taking false branch
    250.   	bn_check_top(a);
    251.   
    252.   	if (a->top == 0) return(0);
                ^
    253.   	l=a->d[a->top-1];
    254.   	assert(l != 0);

crypto/bn/bn_lib.c:253:2: 
    251.   
    252.   	if (a->top == 0) return(0);
    253. > 	l=a->d[a->top-1];
    254.   	assert(l != 0);
    255.   	i=(a->top-1)*BN_BITS2;

crypto/bn/bn_lib.c:254:2: 
    252.   	if (a->top == 0) return(0);
    253.   	l=a->d[a->top-1];
    254. > 	assert(l != 0);
    255.   	i=(a->top-1)*BN_BITS2;
    256.   	return(i+BN_num_bits_word(l));

crypto/bn/bn_lib.c:255:2: 
    253.   	l=a->d[a->top-1];
    254.   	assert(l != 0);
    255. > 	i=(a->top-1)*BN_BITS2;
    256.   	return(i+BN_num_bits_word(l));
    257.   	}

crypto/bn/bn_lib.c:256:2: Skipping BN_num_bits_word(): empty list of specs
    254.   	assert(l != 0);
    255.   	i=(a->top-1)*BN_BITS2;
    256.   	return(i+BN_num_bits_word(l));
            ^
    257.   	}
    258.   

crypto/bn/bn_lib.c:257:2: return from a call to BN_num_bits
    255.   	i=(a->top-1)*BN_BITS2;
    256.   	return(i+BN_num_bits_word(l));
    257.   	}
            ^
    258.   
    259.   void BN_clear_free(BIGNUM *a)

crypto/rsa/rsa_lib.c:265:2: return from a call to RSA_size
  263.   	{
  264.   	return(BN_num_bytes(r->n));
  265.   	}
          ^
  266.   
  267.   int RSA_public_encrypt(int flen, const unsigned char *from, unsigned char *to,

crypto/rsa/rsa_sign.c:151:6: Taking false branch
149.   	X509_SIG *sig=NULL;
150.   
151.   	if (siglen != (unsigned int)RSA_size(rsa))
            ^
152.   		{
153.   		RSAerr(RSA_F_RSA_VERIFY,RSA_R_WRONG_SIGNATURE_LENGTH);

crypto/rsa/rsa_sign.c:157:5: Taking false branch
155.   		}
156.   
157.   	if(rsa->flags & RSA_FLAG_SIGN_VER)
           ^
158.   	    return ENGINE_get_RSA(rsa->engine)->rsa_verify(dtype,
159.   			m, m_len, sigbuf, siglen, rsa);

crypto/rsa/rsa_sign.c:161:2: 
159.   			m, m_len, sigbuf, siglen, rsa);
160.   
161. > 	s=(unsigned char *)OPENSSL_malloc((unsigned int)siglen);
162.   	if (s == NULL)
163.   		{

crypto/mem.c:282:1: start of procedure CRYPTO_malloc()
  280.   	}
  281.   
  282. > void *CRYPTO_malloc(int num, const char *file, int line)
  283.   	{
  284.   	void *ret = NULL;

crypto/mem.c:284:2: 
  282.   void *CRYPTO_malloc(int num, const char *file, int line)
  283.   	{
  284. > 	void *ret = NULL;
  285.   
  286.   	allow_customize = 0;

crypto/mem.c:286:2: 
  284.   	void *ret = NULL;
  285.   
  286. > 	allow_customize = 0;
  287.   	if (malloc_debug_func != NULL)
  288.   		{

crypto/mem.c:287:6: Taking false branch
  285.   
  286.   	allow_customize = 0;
  287.   	if (malloc_debug_func != NULL)
              ^
  288.   		{
  289.   		allow_customize_debug = 0;

crypto/mem.c:292:2: Skipping __function_pointer__(): unresolved function pointer
  290.   		malloc_debug_func(NULL, num, file, line, 0);
  291.   		}
  292.   	ret = malloc_ex_func(num,file,line);
          ^
  293.   #ifdef LEVITTE_DEBUG_MEM
  294.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);

crypto/mem.c:296:6: Taking false branch
  294.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);
  295.   #endif
  296.   	if (malloc_debug_func != NULL)
              ^
  297.   		malloc_debug_func(ret, num, file, line, 1);
  298.   

crypto/mem.c:299:2: 
  297.   		malloc_debug_func(ret, num, file, line, 1);
  298.   
  299. > 	return ret;
  300.   	}
  301.   

crypto/mem.c:300:2: return from a call to CRYPTO_malloc
  298.   
  299.   	return ret;
  300.   	}
          ^
  301.   
  302.   void *CRYPTO_realloc(void *str, int num, const char *file, int line)

crypto/rsa/rsa_sign.c:162:6: Taking true branch
160.   
161.   	s=(unsigned char *)OPENSSL_malloc((unsigned int)siglen);
162.   	if (s == NULL)
            ^
163.   		{
164.   		RSAerr(RSA_F_RSA_VERIFY,ERR_R_MALLOC_FAILURE);

crypto/rsa/rsa_sign.c:164:3: 
162.   	if (s == NULL)
163.   		{
164. > 		RSAerr(RSA_F_RSA_VERIFY,ERR_R_MALLOC_FAILURE);
165.   		goto err;
166.   		}

crypto/err/err.c:361:1: start of procedure ERR_put_error()
  359.   /********************************************************/
  360.   
  361. > void ERR_put_error(int lib, int func, int reason, const char *file,
  362.   	     int line)
  363.   	{

crypto/err/err.c:385:2: Skipping ERR_get_state(): empty list of specs
  383.   	}
  384.   #endif
  385.   	es=ERR_get_state();
          ^
  386.   
  387.   	es->top=(es->top+1)%ERR_NUM_ERRORS;

crypto/err/err.c:387:2: 
  385.   	es=ERR_get_state();
  386.   
  387. > 	es->top=(es->top+1)%ERR_NUM_ERRORS;
  388.   	if (es->top == es->bottom)
  389.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;

crypto/err/err.c:388:6: Taking false branch
  386.   
  387.   	es->top=(es->top+1)%ERR_NUM_ERRORS;
  388.   	if (es->top == es->bottom)
              ^
  389.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
  390.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);

crypto/err/err.c:390:2: 
  388.   	if (es->top == es->bottom)
  389.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
  390. > 	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
  391.   	es->err_file[es->top]=file;
  392.   	es->err_line[es->top]=line;

crypto/err/err.c:391:2: 
  389.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
  390.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
  391. > 	es->err_file[es->top]=file;
  392.   	es->err_line[es->top]=line;
  393.   	err_clear_data(es,es->top);

crypto/err/err.c:392:2: 
  390.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
  391.   	es->err_file[es->top]=file;
  392. > 	es->err_line[es->top]=line;
  393.   	err_clear_data(es,es->top);
  394.   	}

crypto/err/err.c:393:2: Taking true branch
  391.   	es->err_file[es->top]=file;
  392.   	es->err_line[es->top]=line;
  393.   	err_clear_data(es,es->top);
          ^
  394.   	}
  395.   

crypto/err/err.c:393:2: Taking true branch
  391.   	es->err_file[es->top]=file;
  392.   	es->err_line[es->top]=line;
  393.   	err_clear_data(es,es->top);
          ^
  394.   	}
  395.   

crypto/mem.c:318:1: start of procedure CRYPTO_free()
    316.   	}
    317.   
    318. > void CRYPTO_free(void *str)
    319.   	{
    320.   	if (free_debug_func != NULL)

crypto/mem.c:320:6: Taking true branch
    318.   void CRYPTO_free(void *str)
    319.   	{
    320.   	if (free_debug_func != NULL)
                ^
    321.   		free_debug_func(str, 0);
    322.   #ifdef LEVITTE_DEBUG_MEM

crypto/mem.c:321:3: Skipping __function_pointer__(): unresolved function pointer
    319.   	{
    320.   	if (free_debug_func != NULL)
    321.   		free_debug_func(str, 0);
             ^
    322.   #ifdef LEVITTE_DEBUG_MEM
    323.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         < 0x%p\n", str);

crypto/mem.c:325:2: Skipping __function_pointer__(): unresolved function pointer
    323.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         < 0x%p\n", str);
    324.   #endif
    325.   	free_func(str);
            ^
    326.   	if (free_debug_func != NULL)
    327.   		free_debug_func(NULL, 1);

crypto/mem.c:326:6: Taking true branch
    324.   #endif
    325.   	free_func(str);
    326.   	if (free_debug_func != NULL)
                ^
    327.   		free_debug_func(NULL, 1);
    328.   	}

crypto/mem.c:327:3: Skipping __function_pointer__(): unresolved function pointer
    325.   	free_func(str);
    326.   	if (free_debug_func != NULL)
    327.   		free_debug_func(NULL, 1);
             ^
    328.   	}
    329.   

crypto/mem.c:326:2: 
    324.   #endif
    325.   	free_func(str);
    326. > 	if (free_debug_func != NULL)
    327.   		free_debug_func(NULL, 1);
    328.   	}

crypto/mem.c:328:2: return from a call to CRYPTO_free
    326.   	if (free_debug_func != NULL)
    327.   		free_debug_func(NULL, 1);
    328.   	}
            ^
    329.   
    330.   void *CRYPTO_remalloc(void *a, int num, const char *file, int line)

crypto/err/err.c:393:2: 
  391.   	es->err_file[es->top]=file;
  392.   	es->err_line[es->top]=line;
  393. > 	err_clear_data(es,es->top);
  394.   	}
  395.   

crypto/err/err.c:394:2: return from a call to ERR_put_error
  392.   	es->err_line[es->top]=line;
  393.   	err_clear_data(es,es->top);
  394.   	}
          ^
  395.   
  396.   void ERR_clear_error(void)

crypto/rsa/rsa_sign.c:220:1: 
218.   			ret=1;
219.   	}
220. > err:
221.   	if (sig != NULL) X509_SIG_free(sig);
222.   	memset(s,0,(unsigned int)siglen);

crypto/rsa/rsa_sign.c:221:6: Taking false branch
219.   	}
220.   err:
221.   	if (sig != NULL) X509_SIG_free(sig);
            ^
222.   	memset(s,0,(unsigned int)siglen);
223.   	OPENSSL_free(s);

crypto/rsa/rsa_sign.c:222:2: 
220.   err:
221.   	if (sig != NULL) X509_SIG_free(sig);
222. > 	memset(s,0,(unsigned int)siglen);
223.   	OPENSSL_free(s);
224.   	return(ret);
