apps/verify.c:305: error: NULL_DEREFERENCE
  pointer `in` last assigned on line 276 could be null and is dereferenced by call to `BIO_free()` at line 305, column 2.
Showing all 61 steps of the trace


apps/verify.c:264:1: start of procedure load_untrusted()
262.   	}
263.   
264. > static STACK_OF(X509) *load_untrusted(char *certfile)
265.   {
266.   	STACK_OF(X509_INFO) *sk=NULL;

apps/verify.c:266:2: 
264.   static STACK_OF(X509) *load_untrusted(char *certfile)
265.   {
266. > 	STACK_OF(X509_INFO) *sk=NULL;
267.   	STACK_OF(X509) *stack=NULL, *ret=NULL;
268.   	BIO *in=NULL;

apps/verify.c:267:2: 
265.   {
266.   	STACK_OF(X509_INFO) *sk=NULL;
267. > 	STACK_OF(X509) *stack=NULL, *ret=NULL;
268.   	BIO *in=NULL;
269.   	X509_INFO *xi;

apps/verify.c:268:2: 
266.   	STACK_OF(X509_INFO) *sk=NULL;
267.   	STACK_OF(X509) *stack=NULL, *ret=NULL;
268. > 	BIO *in=NULL;
269.   	X509_INFO *xi;
270.   

apps/verify.c:271:7: 
269.   	X509_INFO *xi;
270.   
271. > 	if(!(stack = sk_X509_new_null())) {
272.   		BIO_printf(bio_err,"memory allocation failure\n");
273.   		goto end;

crypto/x509/x509_vfy.c:799:1: start of procedure sk_X509_new_null()
  797.   
  798.   
  799. > IMPLEMENT_STACK_OF(X509)
  800.   IMPLEMENT_ASN1_SET_OF(X509)
  801.   

crypto/x509/x509_vfy.c:799:1: return from a call to sk_X509_new_null
  797.   
  798.   
  799. > IMPLEMENT_STACK_OF(X509)
  800.   IMPLEMENT_ASN1_SET_OF(X509)
  801.   

apps/verify.c:271:7: Taking false branch
269.   	X509_INFO *xi;
270.   
271.   	if(!(stack = sk_X509_new_null())) {
             ^
272.   		BIO_printf(bio_err,"memory allocation failure\n");
273.   		goto end;

apps/verify.c:276:7: 
274.   	}
275.   
276. > 	if(!(in=BIO_new_file(certfile, "r"))) {
277.   		BIO_printf(bio_err,"error opening the file, %s\n",certfile);
278.   		goto end;

crypto/bio/bss_file.c:97:1: start of procedure BIO_new_file()
  95.   	};
  96.   
  97. > BIO *BIO_new_file(const char *filename, const char *mode)
  98.   	{
  99.   	BIO *ret;

crypto/bio/bss_file.c:102:6: Taking true branch
  100.   	FILE *file;
  101.   
  102.   	if ((file=fopen(filename,mode)) == NULL)
              ^
  103.   		{
  104.   		SYSerr(SYS_F_FOPEN,get_last_sys_error());

crypto/bio/bss_file.c:104:3: 
  102.   	if ((file=fopen(filename,mode)) == NULL)
  103.   		{
  104. > 		SYSerr(SYS_F_FOPEN,get_last_sys_error());
  105.   		ERR_add_error_data(5,"fopen('",filename,"','",mode,"')");
  106.   		BIOerr(BIO_F_BIO_NEW_FILE,ERR_R_SYS_LIB);

crypto/err/err.c:246:1: start of procedure ERR_put_error()
    244.   /********************************************************/
    245.   
    246. > void ERR_put_error(int lib, int func, int reason, const char *file,
    247.   	     int line)
    248.   	{

crypto/err/err.c:270:2: Skipping ERR_get_state(): empty list of specs
    268.   	}
    269.   #endif
    270.   	es=ERR_get_state();
            ^
    271.   
    272.   	es->top=(es->top+1)%ERR_NUM_ERRORS;

crypto/err/err.c:272:2: 
    270.   	es=ERR_get_state();
    271.   
    272. > 	es->top=(es->top+1)%ERR_NUM_ERRORS;
    273.   	if (es->top == es->bottom)
    274.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;

crypto/err/err.c:273:6: Taking false branch
    271.   
    272.   	es->top=(es->top+1)%ERR_NUM_ERRORS;
    273.   	if (es->top == es->bottom)
                ^
    274.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
    275.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);

crypto/err/err.c:275:2: 
    273.   	if (es->top == es->bottom)
    274.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
    275. > 	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
    276.   	es->err_file[es->top]=file;
    277.   	es->err_line[es->top]=line;

crypto/err/err.c:276:2: 
    274.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
    275.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
    276. > 	es->err_file[es->top]=file;
    277.   	es->err_line[es->top]=line;
    278.   	err_clear_data(es,es->top);

crypto/err/err.c:277:2: 
    275.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
    276.   	es->err_file[es->top]=file;
    277. > 	es->err_line[es->top]=line;
    278.   	err_clear_data(es,es->top);
    279.   	}

crypto/err/err.c:278:2: Taking true branch
    276.   	es->err_file[es->top]=file;
    277.   	es->err_line[es->top]=line;
    278.   	err_clear_data(es,es->top);
            ^
    279.   	}
    280.   

crypto/err/err.c:278:2: Taking false branch
    276.   	es->err_file[es->top]=file;
    277.   	es->err_line[es->top]=line;
    278.   	err_clear_data(es,es->top);
            ^
    279.   	}
    280.   

crypto/err/err.c:279:2: return from a call to ERR_put_error
    277.   	es->err_line[es->top]=line;
    278.   	err_clear_data(es,es->top);
    279.   	}
            ^
    280.   
    281.   void ERR_clear_error(void)

crypto/bio/bss_file.c:105:3: Skipping ERR_add_error_data(): empty list of specs
  103.   		{
  104.   		SYSerr(SYS_F_FOPEN,get_last_sys_error());
  105.   		ERR_add_error_data(5,"fopen('",filename,"','",mode,"')");
           ^
  106.   		BIOerr(BIO_F_BIO_NEW_FILE,ERR_R_SYS_LIB);
  107.   		return(NULL);

crypto/bio/bss_file.c:106:3: 
  104.   		SYSerr(SYS_F_FOPEN,get_last_sys_error());
  105.   		ERR_add_error_data(5,"fopen('",filename,"','",mode,"')");
  106. > 		BIOerr(BIO_F_BIO_NEW_FILE,ERR_R_SYS_LIB);
  107.   		return(NULL);
  108.   		}

crypto/err/err.c:246:1: start of procedure ERR_put_error()
    244.   /********************************************************/
    245.   
    246. > void ERR_put_error(int lib, int func, int reason, const char *file,
    247.   	     int line)
    248.   	{

crypto/err/err.c:270:2: Skipping ERR_get_state(): empty list of specs
    268.   	}
    269.   #endif
    270.   	es=ERR_get_state();
            ^
    271.   
    272.   	es->top=(es->top+1)%ERR_NUM_ERRORS;

crypto/err/err.c:272:2: 
    270.   	es=ERR_get_state();
    271.   
    272. > 	es->top=(es->top+1)%ERR_NUM_ERRORS;
    273.   	if (es->top == es->bottom)
    274.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;

crypto/err/err.c:273:6: Taking false branch
    271.   
    272.   	es->top=(es->top+1)%ERR_NUM_ERRORS;
    273.   	if (es->top == es->bottom)
                ^
    274.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
    275.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);

crypto/err/err.c:275:2: 
    273.   	if (es->top == es->bottom)
    274.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
    275. > 	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
    276.   	es->err_file[es->top]=file;
    277.   	es->err_line[es->top]=line;

crypto/err/err.c:276:2: 
    274.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
    275.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
    276. > 	es->err_file[es->top]=file;
    277.   	es->err_line[es->top]=line;
    278.   	err_clear_data(es,es->top);

crypto/err/err.c:277:2: 
    275.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
    276.   	es->err_file[es->top]=file;
    277. > 	es->err_line[es->top]=line;
    278.   	err_clear_data(es,es->top);
    279.   	}

crypto/err/err.c:278:2: Taking true branch
    276.   	es->err_file[es->top]=file;
    277.   	es->err_line[es->top]=line;
    278.   	err_clear_data(es,es->top);
            ^
    279.   	}
    280.   

crypto/err/err.c:278:2: Taking false branch
    276.   	es->err_file[es->top]=file;
    277.   	es->err_line[es->top]=line;
    278.   	err_clear_data(es,es->top);
            ^
    279.   	}
    280.   

crypto/err/err.c:279:2: return from a call to ERR_put_error
    277.   	es->err_line[es->top]=line;
    278.   	err_clear_data(es,es->top);
    279.   	}
            ^
    280.   
    281.   void ERR_clear_error(void)

crypto/bio/bss_file.c:107:3: 
  105.   		ERR_add_error_data(5,"fopen('",filename,"','",mode,"')");
  106.   		BIOerr(BIO_F_BIO_NEW_FILE,ERR_R_SYS_LIB);
  107. > 		return(NULL);
  108.   		}
  109.   	if ((ret=BIO_new(BIO_s_file_internal())) == NULL)

crypto/bio/bss_file.c:114:2: return from a call to BIO_new_file
  112.   	BIO_set_fp(ret,file,BIO_CLOSE);
  113.   	return(ret);
  114.   	}
          ^
  115.   
  116.   BIO *BIO_new_fp(FILE *stream, int close_flag)

apps/verify.c:276:7: Taking true branch
274.   	}
275.   
276.   	if(!(in=BIO_new_file(certfile, "r"))) {
             ^
277.   		BIO_printf(bio_err,"error opening the file, %s\n",certfile);
278.   		goto end;

apps/verify.c:277:3: 
275.   
276.   	if(!(in=BIO_new_file(certfile, "r"))) {
277. > 		BIO_printf(bio_err,"error opening the file, %s\n",certfile);
278.   		goto end;
279.   	}

crypto/bio/b_print.c:80:1: start of procedure BIO_printf()
  78.   	const char *format, va_list args);
  79.   
  80. > int BIO_printf (BIO *bio, ...)
  81.   	{
  82.   	va_list args;

crypto/bio/b_print.c:87:2: 
  85.   	MS_STATIC char hugebuf[1024*2]; /* 10k in one chunk is the limit */
  86.   
  87. > 	va_start(args, bio);
  88.   	format=va_arg(args, char *);
  89.   

crypto/bio/b_print.c:88:2: 
  86.   
  87.   	va_start(args, bio);
  88. > 	format=va_arg(args, char *);
  89.   
  90.   	hugebuf[0]='\0';

crypto/bio/b_print.c:90:2: 
  88.   	format=va_arg(args, char *);
  89.   
  90. > 	hugebuf[0]='\0';
  91.   	dopr(hugebuf, sizeof(hugebuf), &ret, format, args);
  92.   	ret=BIO_write(bio, hugebuf, ret);

crypto/bio/b_print.c:91:2: Skipping dopr(): empty list of specs
  89.   
  90.   	hugebuf[0]='\0';
  91.   	dopr(hugebuf, sizeof(hugebuf), &ret, format, args);
         ^
  92.   	ret=BIO_write(bio, hugebuf, ret);
  93.   

crypto/bio/b_print.c:92:2: 
  90.   	hugebuf[0]='\0';
  91.   	dopr(hugebuf, sizeof(hugebuf), &ret, format, args);
  92. > 	ret=BIO_write(bio, hugebuf, ret);
  93.   
  94.   	va_end(args);

crypto/bio/bio_lib.c:172:1: start of procedure BIO_write()
    170.   	}
    171.   
    172. > int BIO_write(BIO *b, const char *in, int inl)
    173.   	{
    174.   	int i;

crypto/bio/bio_lib.c:177:6: Taking true branch
    175.   	long (*cb)();
    176.   
    177.   	if (b == NULL)
                ^
    178.   		return(0);
    179.   

crypto/bio/bio_lib.c:178:3: 
    176.   
    177.   	if (b == NULL)
    178. > 		return(0);
    179.   
    180.   	cb=b->callback;

crypto/bio/bio_lib.c:211:2: return from a call to BIO_write
    209.   			0L,(long)i);
    210.   	return(i);
    211.   	}
            ^
    212.   
    213.   int BIO_puts(BIO *b, const char *in)

crypto/bio/b_print.c:94:2: 
  92.   	ret=BIO_write(bio, hugebuf, ret);
  93.   
  94. > 	va_end(args);
  95.   	return(ret);
  96.   	}

crypto/bio/b_print.c:95:2: 
  93.   
  94.   	va_end(args);
  95. > 	return(ret);
  96.   	}
  97.   

crypto/bio/b_print.c:96:2: return from a call to BIO_printf
  94.   	va_end(args);
  95.   	return(ret);
  96.   	}
         ^
  97.   
  98.   /*

apps/verify.c:304:1: 
302.   	}
303.   	ret=stack;
304. > end:
305.   	BIO_free(in);
306.   	sk_X509_INFO_free(sk);

apps/verify.c:305:2: 
303.   	ret=stack;
304.   end:
305. > 	BIO_free(in);
306.   	sk_X509_INFO_free(sk);
307.   	return(ret);

crypto/bio/bio_lib.c:110:1: start of procedure BIO_free()
  108.   	}
  109.   
  110. > int BIO_free(BIO *a)
  111.   	{
  112.   	int ret=0,i;

crypto/bio/bio_lib.c:112:2: 
  110.   int BIO_free(BIO *a)
  111.   	{
  112. > 	int ret=0,i;
  113.   
  114.   	if (a == NULL) return(0);

crypto/bio/bio_lib.c:114:6: Taking false branch
  112.   	int ret=0,i;
  113.   
  114.   	if (a == NULL) return(0);
              ^
  115.   
  116.   	i=CRYPTO_add(&a->references,-1,CRYPTO_LOCK_BIO);

crypto/bio/bio_lib.c:116:2: 
  114.   	if (a == NULL) return(0);
  115.   
  116. > 	i=CRYPTO_add(&a->references,-1,CRYPTO_LOCK_BIO);
  117.   #ifdef REF_PRINT
  118.   	REF_PRINT("BIO",a);

crypto/cryptlib.c:226:1: start of procedure CRYPTO_add_lock()
    224.   	}
    225.   
    226. > int CRYPTO_add_lock(int *pointer, int amount, int type, const char *file,
    227.   	     int line)
    228.   	{

crypto/cryptlib.c:231:6: Taking true branch
    229.   	int ret;
    230.   
    231.   	if (add_lock_callback != NULL)
                ^
    232.   		{
    233.   #ifdef LOCK_DEBUG

crypto/cryptlib.c:237:3: Skipping __function_pointer__(): unresolved function pointer
    235.   #endif
    236.   
    237.   		ret=add_lock_callback(pointer,amount,type,file,line);
             ^
    238.   #ifdef LOCK_DEBUG
    239.   		fprintf(stderr,"ladd:%08lx:%2d+%2d->%2d %-18s %s:%d\n",

crypto/cryptlib.c:245:3: 
    243.   			file,line);
    244.   #endif
    245. > 		*pointer=ret;
    246.   		}
    247.   	else
