crypto/x509/x509_vfy.c:893: error: NULL_DEREFERENCE
  pointer `x` last assigned on line 882 could be null and is dereferenced by call to `get_crl_delta()` at line 893, column 18.
Showing all 29 steps of the trace


crypto/x509/x509_vfy.c:875:1: start of procedure check_cert()
873.   }
874.   
875. > static int check_cert(X509_STORE_CTX *ctx)
876.   {
877.       X509_CRL *crl = NULL, *dcrl = NULL;

crypto/x509/x509_vfy.c:877:5: 
875.   static int check_cert(X509_STORE_CTX *ctx)
876.   {
877. >     X509_CRL *crl = NULL, *dcrl = NULL;
878.       X509 *x = NULL;
879.       int ok = 0, cnum = 0;

crypto/x509/x509_vfy.c:878:5: 
876.   {
877.       X509_CRL *crl = NULL, *dcrl = NULL;
878. >     X509 *x = NULL;
879.       int ok = 0, cnum = 0;
880.       unsigned int last_reasons = 0;

crypto/x509/x509_vfy.c:879:5: 
877.       X509_CRL *crl = NULL, *dcrl = NULL;
878.       X509 *x = NULL;
879. >     int ok = 0, cnum = 0;
880.       unsigned int last_reasons = 0;
881.       cnum = ctx->error_depth;

crypto/x509/x509_vfy.c:880:5: 
878.       X509 *x = NULL;
879.       int ok = 0, cnum = 0;
880. >     unsigned int last_reasons = 0;
881.       cnum = ctx->error_depth;
882.       x = sk_X509_value(ctx->chain, cnum);

crypto/x509/x509_vfy.c:881:5: 
879.       int ok = 0, cnum = 0;
880.       unsigned int last_reasons = 0;
881. >     cnum = ctx->error_depth;
882.       x = sk_X509_value(ctx->chain, cnum);
883.       ctx->current_cert = x;

crypto/x509/x509_vfy.c:882:9: Condition is true
880.       unsigned int last_reasons = 0;
881.       cnum = ctx->error_depth;
882.       x = sk_X509_value(ctx->chain, cnum);
               ^
883.       ctx->current_cert = x;
884.       ctx->current_issuer = NULL;

crypto/x509/x509_vfy.c:882:5: 
880.       unsigned int last_reasons = 0;
881.       cnum = ctx->error_depth;
882. >     x = sk_X509_value(ctx->chain, cnum);
883.       ctx->current_cert = x;
884.       ctx->current_issuer = NULL;

crypto/stack/stack.c:328:1: start of procedure sk_value()
  326.   }
  327.   
  328. > void *sk_value(const _STACK *st, int i)
  329.   {
  330.       if (!st || (i < 0) || (i >= st->num))

crypto/stack/stack.c:330:10: Taking false branch
  328.   void *sk_value(const _STACK *st, int i)
  329.   {
  330.       if (!st || (i < 0) || (i >= st->num))
                  ^
  331.           return NULL;
  332.       return st->data[i];

crypto/stack/stack.c:330:17: Taking false branch
  328.   void *sk_value(const _STACK *st, int i)
  329.   {
  330.       if (!st || (i < 0) || (i >= st->num))
                         ^
  331.           return NULL;
  332.       return st->data[i];

crypto/stack/stack.c:330:28: Taking true branch
  328.   void *sk_value(const _STACK *st, int i)
  329.   {
  330.       if (!st || (i < 0) || (i >= st->num))
                                    ^
  331.           return NULL;
  332.       return st->data[i];

crypto/stack/stack.c:331:9: 
  329.   {
  330.       if (!st || (i < 0) || (i >= st->num))
  331. >         return NULL;
  332.       return st->data[i];
  333.   }

crypto/stack/stack.c:333:1: return from a call to sk_value
  331.           return NULL;
  332.       return st->data[i];
  333. > }
  334.   
  335.   void *sk_set(_STACK *st, int i, void *value)

crypto/x509/x509_vfy.c:883:5: 
881.       cnum = ctx->error_depth;
882.       x = sk_X509_value(ctx->chain, cnum);
883. >     ctx->current_cert = x;
884.       ctx->current_issuer = NULL;
885.       ctx->current_crl_score = 0;

crypto/x509/x509_vfy.c:884:5: 
882.       x = sk_X509_value(ctx->chain, cnum);
883.       ctx->current_cert = x;
884. >     ctx->current_issuer = NULL;
885.       ctx->current_crl_score = 0;
886.       ctx->current_reasons = 0;

crypto/x509/x509_vfy.c:885:5: 
883.       ctx->current_cert = x;
884.       ctx->current_issuer = NULL;
885. >     ctx->current_crl_score = 0;
886.       ctx->current_reasons = 0;
887.       while (ctx->current_reasons != CRLDP_ALL_REASONS) {

crypto/x509/x509_vfy.c:886:5: 
884.       ctx->current_issuer = NULL;
885.       ctx->current_crl_score = 0;
886. >     ctx->current_reasons = 0;
887.       while (ctx->current_reasons != CRLDP_ALL_REASONS) {
888.           last_reasons = ctx->current_reasons;

crypto/x509/x509_vfy.c:887:12: Loop condition is true. Entering loop body
885.       ctx->current_crl_score = 0;
886.       ctx->current_reasons = 0;
887.       while (ctx->current_reasons != CRLDP_ALL_REASONS) {
                  ^
888.           last_reasons = ctx->current_reasons;
889.           /* Try to retrieve relevant CRL */

crypto/x509/x509_vfy.c:888:9: 
886.       ctx->current_reasons = 0;
887.       while (ctx->current_reasons != CRLDP_ALL_REASONS) {
888. >         last_reasons = ctx->current_reasons;
889.           /* Try to retrieve relevant CRL */
890.           if (ctx->get_crl)

crypto/x509/x509_vfy.c:890:13: Taking false branch
888.           last_reasons = ctx->current_reasons;
889.           /* Try to retrieve relevant CRL */
890.           if (ctx->get_crl)
                   ^
891.               ok = ctx->get_crl(ctx, &crl, x);
892.           else

crypto/x509/x509_vfy.c:893:13: 
891.               ok = ctx->get_crl(ctx, &crl, x);
892.           else
893. >             ok = get_crl_delta(ctx, &crl, &dcrl, x);
894.           /*
895.            * If error looking up CRL, nothing we can do except notify callback

crypto/x509/x509_vfy.c:1439:1: start of procedure get_crl_delta()
  1437.    */
  1438.   
  1439. > static int get_crl_delta(X509_STORE_CTX *ctx,
  1440.                            X509_CRL **pcrl, X509_CRL **pdcrl, X509 *x)
  1441.   {

crypto/x509/x509_vfy.c:1443:5: 
  1441.   {
  1442.       int ok;
  1443. >     X509 *issuer = NULL;
  1444.       int crl_score = 0;
  1445.       unsigned int reasons;

crypto/x509/x509_vfy.c:1444:5: 
  1442.       int ok;
  1443.       X509 *issuer = NULL;
  1444. >     int crl_score = 0;
  1445.       unsigned int reasons;
  1446.       X509_CRL *crl = NULL, *dcrl = NULL;

crypto/x509/x509_vfy.c:1446:5: 
  1444.       int crl_score = 0;
  1445.       unsigned int reasons;
  1446. >     X509_CRL *crl = NULL, *dcrl = NULL;
  1447.       STACK_OF(X509_CRL) *skcrl;
  1448.       X509_NAME *nm = X509_get_issuer_name(x);

crypto/x509/x509_vfy.c:1448:5: 
  1446.       X509_CRL *crl = NULL, *dcrl = NULL;
  1447.       STACK_OF(X509_CRL) *skcrl;
  1448. >     X509_NAME *nm = X509_get_issuer_name(x);
  1449.       reasons = ctx->current_reasons;
  1450.       ok = get_crl_sk(ctx, &crl, &dcrl,

crypto/x509/x509_cmp.c:131:1: start of procedure X509_get_issuer_name()
    129.   }
    130.   
    131. > X509_NAME *X509_get_issuer_name(X509 *a)
    132.   {
    133.       return (a->cert_info->issuer);

crypto/x509/x509_cmp.c:133:5: 
    131.   X509_NAME *X509_get_issuer_name(X509 *a)
    132.   {
    133. >     return (a->cert_info->issuer);
    134.   }
    135.   

static int check_cert(X509_STORE_CTX *ctx)
{
    X509_CRL *crl = NULL, *dcrl = NULL;
    X509 *x = NULL;
    int ok = 0, cnum = 0;
    unsigned int last_reasons = 0;
    cnum = ctx->error_depth;
    x = sk_X509_value(ctx->chain, cnum);
    ctx->current_cert = x;
    ctx->current_issuer = NULL;
    ctx->current_crl_score = 0;
    ctx->current_reasons = 0;
    while (ctx->current_reasons != CRLDP_ALL_REASONS) {
        last_reasons = ctx->current_reasons;
        if (ctx->get_crl)
            ok = ctx->get_crl(ctx, &crl, x);
        else
            ok = get_crl_delta(ctx, &crl, &dcrl, x);
        if (!ok) {
            ctx->error = X509_V_ERR_UNABLE_TO_GET_CRL;
            ok = ctx->verify_cb(0, ctx);
            goto err;
        }
        ctx->current_crl = crl;
        ok = ctx->check_crl(ctx, crl);
        if (!ok)
            goto err;
        if (dcrl) {
            ok = ctx->check_crl(ctx, dcrl);
            if (!ok)
                goto err;
            ok = ctx->cert_crl(ctx, dcrl, x);
            if (!ok)
                goto err;
        } else
            ok = 1;
        if (ok != 2) {
            ok = ctx->cert_crl(ctx, crl, x);
            if (!ok)
                goto err;
        }
        X509_CRL_free(crl);
        X509_CRL_free(dcrl);
        crl = NULL;
        dcrl = NULL;
        if (last_reasons == ctx->current_reasons) {
            ctx->error = X509_V_ERR_UNABLE_TO_GET_CRL;
            ok = ctx->verify_cb(0, ctx);
            goto err;
        }
    }
 err:
    X509_CRL_free(crl);
    X509_CRL_free(dcrl);
    ctx->current_crl = NULL;
    return ok;
}
['static int check_cert(X509_STORE_CTX *ctx)\n{\n    X509_CRL *crl = NULL, *dcrl = NULL;\n    X509 *x = NULL;\n    int ok = 0, cnum = 0;\n    unsigned int last_reasons = 0;\n    cnum = ctx->error_depth;\n    x = sk_X509_value(ctx->chain, cnum);\n    ctx->current_cert = x;\n    ctx->current_issuer = NULL;\n    ctx->current_crl_score = 0;\n    ctx->current_reasons = 0;\n    while (ctx->current_reasons != CRLDP_ALL_REASONS) {\n        last_reasons = ctx->current_reasons;\n        if (ctx->get_crl)\n            ok = ctx->get_crl(ctx, &crl, x);\n        else\n            ok = get_crl_delta(ctx, &crl, &dcrl, x);\n        if (!ok) {\n            ctx->error = X509_V_ERR_UNABLE_TO_GET_CRL;\n            ok = ctx->verify_cb(0, ctx);\n            goto err;\n        }\n        ctx->current_crl = crl;\n        ok = ctx->check_crl(ctx, crl);\n        if (!ok)\n            goto err;\n        if (dcrl) {\n            ok = ctx->check_crl(ctx, dcrl);\n            if (!ok)\n                goto err;\n            ok = ctx->cert_crl(ctx, dcrl, x);\n            if (!ok)\n                goto err;\n        } else\n            ok = 1;\n        if (ok != 2) {\n            ok = ctx->cert_crl(ctx, crl, x);\n            if (!ok)\n                goto err;\n        }\n        X509_CRL_free(crl);\n        X509_CRL_free(dcrl);\n        crl = NULL;\n        dcrl = NULL;\n        if (last_reasons == ctx->current_reasons) {\n            ctx->error = X509_V_ERR_UNABLE_TO_GET_CRL;\n            ok = ctx->verify_cb(0, ctx);\n            goto err;\n        }\n    }\n err:\n    X509_CRL_free(crl);\n    X509_CRL_free(dcrl);\n    ctx->current_crl = NULL;\n    return ok;\n}', 'void *sk_value(const _STACK *st, int i)\n{\n    if (!st || (i < 0) || (i >= st->num))\n        return NULL;\n    return st->data[i];\n}', 'static int get_crl_delta(X509_STORE_CTX *ctx,\n                         X509_CRL **pcrl, X509_CRL **pdcrl, X509 *x)\n{\n    int ok;\n    X509 *issuer = NULL;\n    int crl_score = 0;\n    unsigned int reasons;\n    X509_CRL *crl = NULL, *dcrl = NULL;\n    STACK_OF(X509_CRL) *skcrl;\n    X509_NAME *nm = X509_get_issuer_name(x);\n    reasons = ctx->current_reasons;\n    ok = get_crl_sk(ctx, &crl, &dcrl,\n                    &issuer, &crl_score, &reasons, ctx->crls);\n    if (ok)\n        goto done;\n    skcrl = ctx->lookup_crls(ctx, nm);\n    if (!skcrl && crl)\n        goto done;\n    get_crl_sk(ctx, &crl, &dcrl, &issuer, &crl_score, &reasons, skcrl);\n    sk_X509_CRL_pop_free(skcrl, X509_CRL_free);\n done:\n    if (crl) {\n        ctx->current_issuer = issuer;\n        ctx->current_crl_score = crl_score;\n        ctx->current_reasons = reasons;\n        *pcrl = crl;\n        *pdcrl = dcrl;\n        return 1;\n    }\n    return 0;\n}', 'X509_NAME *X509_get_issuer_name(X509 *a)\n{\n    return (a->cert_info->issuer);\n}']