apps/ca.c:2906: error: NULL_DEREFERENCE
  pointer `tmp` last assigned on line 2904 could be null and is dereferenced by call to `strchr()` at line 2906, column 6.
Showing all 53 steps of the trace


apps/ca.c:2895:1: start of procedure unpack_revinfo()
2893.   	}
2894.   
2895. > int unpack_revinfo(ASN1_TIME **prevtm, int *preason, ASN1_OBJECT **phold, ASN1_GENERALIZEDTIME **pinvtm, const char *str)
2896.   	{
2897.   	char *tmp = NULL;

apps/ca.c:2897:2: 
2895.   int unpack_revinfo(ASN1_TIME **prevtm, int *preason, ASN1_OBJECT **phold, ASN1_GENERALIZEDTIME **pinvtm, const char *str)
2896.   	{
2897. > 	char *tmp = NULL;
2898.   	char *rtime_str, *reason_str = NULL, *arg_str = NULL, *p;
2899.   	int reason_code = -1;

apps/ca.c:2898:2: 
2896.   	{
2897.   	char *tmp = NULL;
2898. > 	char *rtime_str, *reason_str = NULL, *arg_str = NULL, *p;
2899.   	int reason_code = -1;
2900.   	int ret = 0;

apps/ca.c:2899:2: 
2897.   	char *tmp = NULL;
2898.   	char *rtime_str, *reason_str = NULL, *arg_str = NULL, *p;
2899. > 	int reason_code = -1;
2900.   	int ret = 0;
2901.   	unsigned int i;

apps/ca.c:2900:2: 
2898.   	char *rtime_str, *reason_str = NULL, *arg_str = NULL, *p;
2899.   	int reason_code = -1;
2900. > 	int ret = 0;
2901.   	unsigned int i;
2902.   	ASN1_OBJECT *hold = NULL;

apps/ca.c:2902:2: 
2900.   	int ret = 0;
2901.   	unsigned int i;
2902. > 	ASN1_OBJECT *hold = NULL;
2903.   	ASN1_GENERALIZEDTIME *comp_time = NULL;
2904.   	tmp = BUF_strdup(str);

apps/ca.c:2903:2: 
2901.   	unsigned int i;
2902.   	ASN1_OBJECT *hold = NULL;
2903. > 	ASN1_GENERALIZEDTIME *comp_time = NULL;
2904.   	tmp = BUF_strdup(str);
2905.   

apps/ca.c:2904:2: 
2902.   	ASN1_OBJECT *hold = NULL;
2903.   	ASN1_GENERALIZEDTIME *comp_time = NULL;
2904. > 	tmp = BUF_strdup(str);
2905.   
2906.   	p = strchr(tmp, ',');

crypto/buffer/buffer.c:165:1: start of procedure BUF_strdup()
  163.   	}
  164.   
  165. > char *BUF_strdup(const char *str)
  166.   	{
  167.   	if (str == NULL) return(NULL);

crypto/buffer/buffer.c:167:6: Taking false branch
  165.   char *BUF_strdup(const char *str)
  166.   	{
  167.   	if (str == NULL) return(NULL);
              ^
  168.   	return BUF_strndup(str, strlen(str));
  169.   	}

crypto/buffer/buffer.c:168:2: 
  166.   	{
  167.   	if (str == NULL) return(NULL);
  168. > 	return BUF_strndup(str, strlen(str));
  169.   	}
  170.   

crypto/buffer/buffer.c:171:1: start of procedure BUF_strndup()
    169.   	}
    170.   
    171. > char *BUF_strndup(const char *str, size_t siz)
    172.   	{
    173.   	char *ret;

crypto/buffer/buffer.c:175:6: Taking false branch
    173.   	char *ret;
    174.   
    175.   	if (str == NULL) return(NULL);
                ^
    176.   
    177.   	ret=OPENSSL_malloc(siz+1);

crypto/buffer/buffer.c:177:2: 
    175.   	if (str == NULL) return(NULL);
    176.   
    177. > 	ret=OPENSSL_malloc(siz+1);
    178.   	if (ret == NULL) 
    179.   		{

crypto/mem.c:294:1: start of procedure CRYPTO_malloc()
      292.   	}
      293.   
      294. > void *CRYPTO_malloc(int num, const char *file, int line)
      295.   	{
      296.   	void *ret = NULL;

crypto/mem.c:296:2: 
      294.   void *CRYPTO_malloc(int num, const char *file, int line)
      295.   	{
      296. > 	void *ret = NULL;
      297.   
      298.   	if (num <= 0) return NULL;

crypto/mem.c:298:6: Taking false branch
      296.   	void *ret = NULL;
      297.   
      298.   	if (num <= 0) return NULL;
                  ^
      299.   
      300.   	allow_customize = 0;

crypto/mem.c:300:2: 
      298.   	if (num <= 0) return NULL;
      299.   
      300. > 	allow_customize = 0;
      301.   	if (malloc_debug_func != NULL)
      302.   		{

crypto/mem.c:301:6: Taking true branch
      299.   
      300.   	allow_customize = 0;
      301.   	if (malloc_debug_func != NULL)
                  ^
      302.   		{
      303.   		allow_customize_debug = 0;

crypto/mem.c:303:3: 
      301.   	if (malloc_debug_func != NULL)
      302.   		{
      303. > 		allow_customize_debug = 0;
      304.   		malloc_debug_func(NULL, num, file, line, 0);
      305.   		}

crypto/mem.c:304:3: Skipping __function_pointer__(): unresolved function pointer
      302.   		{
      303.   		allow_customize_debug = 0;
      304.   		malloc_debug_func(NULL, num, file, line, 0);
               ^
      305.   		}
      306.   	ret = malloc_ex_func(num,file,line);

crypto/mem.c:306:2: Skipping __function_pointer__(): unresolved function pointer
      304.   		malloc_debug_func(NULL, num, file, line, 0);
      305.   		}
      306.   	ret = malloc_ex_func(num,file,line);
              ^
      307.   #ifdef LEVITTE_DEBUG_MEM
      308.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);

crypto/mem.c:310:6: Taking true branch
      308.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);
      309.   #endif
      310.   	if (malloc_debug_func != NULL)
                  ^
      311.   		malloc_debug_func(ret, num, file, line, 1);
      312.   

crypto/mem.c:311:3: Skipping __function_pointer__(): unresolved function pointer
      309.   #endif
      310.   	if (malloc_debug_func != NULL)
      311.   		malloc_debug_func(ret, num, file, line, 1);
               ^
      312.   
      313.   #ifndef OPENSSL_CPUID_OBJ

crypto/mem.c:317:12: Taking false branch
      315.            * sanitisation function can't be optimised out. NB: We only do
      316.            * this for >2Kb so the overhead doesn't bother us. */
      317.           if(ret && (num > 2048))
                        ^
      318.   	{	extern unsigned char cleanse_ctr;
      319.                   ((unsigned char *)ret)[0] = cleanse_ctr;

crypto/mem.c:323:2: 
      321.   #endif
      322.   
      323. > 	return ret;
      324.   	}
      325.   

crypto/mem.c:324:2: return from a call to CRYPTO_malloc
      322.   
      323.   	return ret;
      324.   	}
              ^
      325.   
      326.   void *CRYPTO_realloc(void *str, int num, const char *file, int line)

crypto/buffer/buffer.c:178:6: Taking true branch
    176.   
    177.   	ret=OPENSSL_malloc(siz+1);
    178.   	if (ret == NULL) 
                ^
    179.   		{
    180.   		BUFerr(BUF_F_BUF_STRNDUP,ERR_R_MALLOC_FAILURE);

crypto/buffer/buffer.c:180:3: 
    178.   	if (ret == NULL) 
    179.   		{
    180. > 		BUFerr(BUF_F_BUF_STRNDUP,ERR_R_MALLOC_FAILURE);
    181.   		return(NULL);
    182.   		}

crypto/err/err.c:705:1: start of procedure ERR_put_error()
      703.   /********************************************************/
      704.   
      705. > void ERR_put_error(int lib, int func, int reason, const char *file,
      706.   	     int line)
      707.   	{

crypto/err/err.c:729:2: Skipping ERR_get_state(): empty list of specs
      727.   	}
      728.   #endif
      729.   	es=ERR_get_state();
              ^
      730.   
      731.   	es->top=(es->top+1)%ERR_NUM_ERRORS;

crypto/err/err.c:731:2: 
      729.   	es=ERR_get_state();
      730.   
      731. > 	es->top=(es->top+1)%ERR_NUM_ERRORS;
      732.   	if (es->top == es->bottom)
      733.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;

crypto/err/err.c:732:6: Taking false branch
      730.   
      731.   	es->top=(es->top+1)%ERR_NUM_ERRORS;
      732.   	if (es->top == es->bottom)
                  ^
      733.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
      734.   	es->err_flags[es->top]=0;

crypto/err/err.c:734:2: 
      732.   	if (es->top == es->bottom)
      733.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
      734. > 	es->err_flags[es->top]=0;
      735.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
      736.   	es->err_file[es->top]=file;

crypto/err/err.c:735:2: 
      733.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
      734.   	es->err_flags[es->top]=0;
      735. > 	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
      736.   	es->err_file[es->top]=file;
      737.   	es->err_line[es->top]=line;

crypto/err/err.c:736:2: 
      734.   	es->err_flags[es->top]=0;
      735.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
      736. > 	es->err_file[es->top]=file;
      737.   	es->err_line[es->top]=line;
      738.   	err_clear_data(es,es->top);

crypto/err/err.c:737:2: 
      735.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
      736.   	es->err_file[es->top]=file;
      737. > 	es->err_line[es->top]=line;
      738.   	err_clear_data(es,es->top);
      739.   	}

crypto/err/err.c:738:2: Taking true branch
      736.   	es->err_file[es->top]=file;
      737.   	es->err_line[es->top]=line;
      738.   	err_clear_data(es,es->top);
              ^
      739.   	}
      740.   

crypto/err/err.c:738:2: Taking true branch
      736.   	es->err_file[es->top]=file;
      737.   	es->err_line[es->top]=line;
      738.   	err_clear_data(es,es->top);
              ^
      739.   	}
      740.   

crypto/mem.c:377:1: start of procedure CRYPTO_free()
        375.   	}
        376.   
        377. > void CRYPTO_free(void *str)
        378.   	{
        379.   	if (free_debug_func != NULL)

crypto/mem.c:379:6: Taking true branch
        377.   void CRYPTO_free(void *str)
        378.   	{
        379.   	if (free_debug_func != NULL)
                    ^
        380.   		free_debug_func(str, 0);
        381.   #ifdef LEVITTE_DEBUG_MEM

crypto/mem.c:380:3: Skipping __function_pointer__(): unresolved function pointer
        378.   	{
        379.   	if (free_debug_func != NULL)
        380.   		free_debug_func(str, 0);
                 ^
        381.   #ifdef LEVITTE_DEBUG_MEM
        382.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         < 0x%p\n", str);

crypto/mem.c:384:2: Skipping __function_pointer__(): unresolved function pointer
        382.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         < 0x%p\n", str);
        383.   #endif
        384.   	free_func(str);
                ^
        385.   	if (free_debug_func != NULL)
        386.   		free_debug_func(NULL, 1);

crypto/mem.c:385:6: Taking true branch
        383.   #endif
        384.   	free_func(str);
        385.   	if (free_debug_func != NULL)
                    ^
        386.   		free_debug_func(NULL, 1);
        387.   	}

crypto/mem.c:386:3: Skipping __function_pointer__(): unresolved function pointer
        384.   	free_func(str);
        385.   	if (free_debug_func != NULL)
        386.   		free_debug_func(NULL, 1);
                 ^
        387.   	}
        388.   

crypto/mem.c:385:2: 
        383.   #endif
        384.   	free_func(str);
        385. > 	if (free_debug_func != NULL)
        386.   		free_debug_func(NULL, 1);
        387.   	}

crypto/mem.c:387:2: return from a call to CRYPTO_free
        385.   	if (free_debug_func != NULL)
        386.   		free_debug_func(NULL, 1);
        387.   	}
                ^
        388.   
        389.   void *CRYPTO_remalloc(void *a, int num, const char *file, int line)

crypto/err/err.c:738:2: Loop condition is false. Leaving loop
      736.   	es->err_file[es->top]=file;
      737.   	es->err_line[es->top]=line;
      738.   	err_clear_data(es,es->top);
              ^
      739.   	}
      740.   

crypto/err/err.c:739:2: return from a call to ERR_put_error
      737.   	es->err_line[es->top]=line;
      738.   	err_clear_data(es,es->top);
      739.   	}
              ^
      740.   
      741.   void ERR_clear_error(void)

crypto/buffer/buffer.c:181:3: 
    179.   		{
    180.   		BUFerr(BUF_F_BUF_STRNDUP,ERR_R_MALLOC_FAILURE);
    181. > 		return(NULL);
    182.   		}
    183.   	BUF_strlcpy(ret,str,siz+1);

crypto/buffer/buffer.c:185:2: return from a call to BUF_strndup
    183.   	BUF_strlcpy(ret,str,siz+1);
    184.   	return(ret);
    185.   	}
            ^
    186.   
    187.   void *BUF_memdup(const void *data, size_t siz)

crypto/buffer/buffer.c:169:2: return from a call to BUF_strdup
  167.   	if (str == NULL) return(NULL);
  168.   	return BUF_strndup(str, strlen(str));
  169.   	}
          ^
  170.   
  171.   char *BUF_strndup(const char *str, size_t siz)

apps/ca.c:2906:2: 
2904.   	tmp = BUF_strdup(str);
2905.   
2906. > 	p = strchr(tmp, ',');
2907.   
2908.   	rtime_str = tmp;
