apps/ca.c:2946: error: NULL_DEREFERENCE
  pointer `tmp` last assigned on line 2944 could be null and is dereferenced by call to `strchr()` at line 2946, column 6.
Showing all 13 steps of the trace


apps/ca.c:2935:1: start of procedure unpack_revinfo()
2933.   	}
2934.   
2935. > int unpack_revinfo(ASN1_TIME **prevtm, int *preason, ASN1_OBJECT **phold, ASN1_GENERALIZEDTIME **pinvtm, const char *str)
2936.   	{
2937.   	char *tmp = NULL;

apps/ca.c:2937:2: 
2935.   int unpack_revinfo(ASN1_TIME **prevtm, int *preason, ASN1_OBJECT **phold, ASN1_GENERALIZEDTIME **pinvtm, const char *str)
2936.   	{
2937. > 	char *tmp = NULL;
2938.   	char *rtime_str, *reason_str = NULL, *arg_str = NULL, *p;
2939.   	int reason_code = -1;

apps/ca.c:2938:2: 
2936.   	{
2937.   	char *tmp = NULL;
2938. > 	char *rtime_str, *reason_str = NULL, *arg_str = NULL, *p;
2939.   	int reason_code = -1;
2940.   	int ret = 0;

apps/ca.c:2939:2: 
2937.   	char *tmp = NULL;
2938.   	char *rtime_str, *reason_str = NULL, *arg_str = NULL, *p;
2939. > 	int reason_code = -1;
2940.   	int ret = 0;
2941.   	unsigned int i;

apps/ca.c:2940:2: 
2938.   	char *rtime_str, *reason_str = NULL, *arg_str = NULL, *p;
2939.   	int reason_code = -1;
2940. > 	int ret = 0;
2941.   	unsigned int i;
2942.   	ASN1_OBJECT *hold = NULL;

apps/ca.c:2942:2: 
2940.   	int ret = 0;
2941.   	unsigned int i;
2942. > 	ASN1_OBJECT *hold = NULL;
2943.   	ASN1_GENERALIZEDTIME *comp_time = NULL;
2944.   	tmp = BUF_strdup(str);

apps/ca.c:2943:2: 
2941.   	unsigned int i;
2942.   	ASN1_OBJECT *hold = NULL;
2943. > 	ASN1_GENERALIZEDTIME *comp_time = NULL;
2944.   	tmp = BUF_strdup(str);
2945.   

apps/ca.c:2944:2: 
2942.   	ASN1_OBJECT *hold = NULL;
2943.   	ASN1_GENERALIZEDTIME *comp_time = NULL;
2944. > 	tmp = BUF_strdup(str);
2945.   
2946.   	p = strchr(tmp, ',');

crypto/buffer/buf_str.c:75:1: start of procedure BUF_strdup()
  73.   	}
  74.   
  75. > char *BUF_strdup(const char *str)
  76.   	{
  77.   	if (str == NULL) return(NULL);

crypto/buffer/buf_str.c:77:6: Taking true branch
  75.   char *BUF_strdup(const char *str)
  76.   	{
  77.   	if (str == NULL) return(NULL);
             ^
  78.   	return BUF_strndup(str, strlen(str));
  79.   	}

crypto/buffer/buf_str.c:77:19: 
  75.   char *BUF_strdup(const char *str)
  76.   	{
  77. > 	if (str == NULL) return(NULL);
  78.   	return BUF_strndup(str, strlen(str));
  79.   	}

crypto/buffer/buf_str.c:79:2: return from a call to BUF_strdup
  77.   	if (str == NULL) return(NULL);
  78.   	return BUF_strndup(str, strlen(str));
  79.   	}
         ^
  80.   
  81.   char *BUF_strndup(const char *str, size_t siz)

apps/ca.c:2946:2: 
2944.   	tmp = BUF_strdup(str);
2945.   
2946. > 	p = strchr(tmp, ',');
2947.   
2948.   	rtime_str = tmp;

int unpack_revinfo(ASN1_TIME **prevtm, int *preason, ASN1_OBJECT **phold, ASN1_GENERALIZEDTIME **pinvtm, const char *str)
	{
	char *tmp = NULL;
	char *rtime_str, *reason_str = NULL, *arg_str = NULL, *p;
	int reason_code = -1;
	int ret = 0;
	unsigned int i;
	ASN1_OBJECT *hold = NULL;
	ASN1_GENERALIZEDTIME *comp_time = NULL;
	tmp = BUF_strdup(str);
	p = strchr(tmp, ',');
	rtime_str = tmp;
	if (p)
		{
		*p = '\0';
		p++;
		reason_str = p;
		p = strchr(p, ',');
		if (p)
			{
			*p = '\0';
			arg_str = p + 1;
			}
		}
	if (prevtm)
		{
		*prevtm = ASN1_UTCTIME_new();
		if (!ASN1_UTCTIME_set_string(*prevtm, rtime_str))
			{
			BIO_printf(bio_err, "invalid revocation date %s\n", rtime_str);
			goto err;
			}
		}
	if (reason_str)
		{
		for (i = 0; i < NUM_REASONS; i++)
			{
			if(!strcasecmp(reason_str, crl_reasons[i]))
				{
				reason_code = i;
				break;
				}
			}
		if (reason_code == OCSP_REVOKED_STATUS_NOSTATUS)
			{
			BIO_printf(bio_err, "invalid reason code %s\n", reason_str);
			goto err;
			}
		if (reason_code == 7)
			reason_code = OCSP_REVOKED_STATUS_REMOVEFROMCRL;
		else if (reason_code == 8)
			{
			if (!arg_str)
				{
				BIO_printf(bio_err, "missing hold instruction\n");
				goto err;
				}
			reason_code = OCSP_REVOKED_STATUS_CERTIFICATEHOLD;
			hold = OBJ_txt2obj(arg_str, 0);
			if (!hold)
				{
				BIO_printf(bio_err, "invalid object identifier %s\n", arg_str);
				goto err;
				}
			if (phold) *phold = hold;
			}
		else if ((reason_code == 9) || (reason_code == 10))
			{
			if (!arg_str)
				{
				BIO_printf(bio_err, "missing compromised time\n");
				goto err;
				}
			comp_time = ASN1_GENERALIZEDTIME_new();
			if (!ASN1_GENERALIZEDTIME_set_string(comp_time, arg_str))
				{
				BIO_printf(bio_err, "invalid compromised time %s\n", arg_str);
				goto err;
				}
			if (reason_code == 9)
				reason_code = OCSP_REVOKED_STATUS_KEYCOMPROMISE;
			else
				reason_code = OCSP_REVOKED_STATUS_CACOMPROMISE;
			}
		}
	if (preason) *preason = reason_code;
	if (pinvtm) *pinvtm = comp_time;
	else ASN1_GENERALIZEDTIME_free(comp_time);
	ret = 1;
	err:
	if (tmp) OPENSSL_free(tmp);
	if (!phold) ASN1_OBJECT_free(hold);
	if (!pinvtm) ASN1_GENERALIZEDTIME_free(comp_time);
	return ret;
	}
['int unpack_revinfo(ASN1_TIME **prevtm, int *preason, ASN1_OBJECT **phold, ASN1_GENERALIZEDTIME **pinvtm, const char *str)\n\t{\n\tchar *tmp = NULL;\n\tchar *rtime_str, *reason_str = NULL, *arg_str = NULL, *p;\n\tint reason_code = -1;\n\tint ret = 0;\n\tunsigned int i;\n\tASN1_OBJECT *hold = NULL;\n\tASN1_GENERALIZEDTIME *comp_time = NULL;\n\ttmp = BUF_strdup(str);\n\tp = strchr(tmp, \',\');\n\trtime_str = tmp;\n\tif (p)\n\t\t{\n\t\t*p = \'\\0\';\n\t\tp++;\n\t\treason_str = p;\n\t\tp = strchr(p, \',\');\n\t\tif (p)\n\t\t\t{\n\t\t\t*p = \'\\0\';\n\t\t\targ_str = p + 1;\n\t\t\t}\n\t\t}\n\tif (prevtm)\n\t\t{\n\t\t*prevtm = ASN1_UTCTIME_new();\n\t\tif (!ASN1_UTCTIME_set_string(*prevtm, rtime_str))\n\t\t\t{\n\t\t\tBIO_printf(bio_err, "invalid revocation date %s\\n", rtime_str);\n\t\t\tgoto err;\n\t\t\t}\n\t\t}\n\tif (reason_str)\n\t\t{\n\t\tfor (i = 0; i < NUM_REASONS; i++)\n\t\t\t{\n\t\t\tif(!strcasecmp(reason_str, crl_reasons[i]))\n\t\t\t\t{\n\t\t\t\treason_code = i;\n\t\t\t\tbreak;\n\t\t\t\t}\n\t\t\t}\n\t\tif (reason_code == OCSP_REVOKED_STATUS_NOSTATUS)\n\t\t\t{\n\t\t\tBIO_printf(bio_err, "invalid reason code %s\\n", reason_str);\n\t\t\tgoto err;\n\t\t\t}\n\t\tif (reason_code == 7)\n\t\t\treason_code = OCSP_REVOKED_STATUS_REMOVEFROMCRL;\n\t\telse if (reason_code == 8)\n\t\t\t{\n\t\t\tif (!arg_str)\n\t\t\t\t{\n\t\t\t\tBIO_printf(bio_err, "missing hold instruction\\n");\n\t\t\t\tgoto err;\n\t\t\t\t}\n\t\t\treason_code = OCSP_REVOKED_STATUS_CERTIFICATEHOLD;\n\t\t\thold = OBJ_txt2obj(arg_str, 0);\n\t\t\tif (!hold)\n\t\t\t\t{\n\t\t\t\tBIO_printf(bio_err, "invalid object identifier %s\\n", arg_str);\n\t\t\t\tgoto err;\n\t\t\t\t}\n\t\t\tif (phold) *phold = hold;\n\t\t\t}\n\t\telse if ((reason_code == 9) || (reason_code == 10))\n\t\t\t{\n\t\t\tif (!arg_str)\n\t\t\t\t{\n\t\t\t\tBIO_printf(bio_err, "missing compromised time\\n");\n\t\t\t\tgoto err;\n\t\t\t\t}\n\t\t\tcomp_time = ASN1_GENERALIZEDTIME_new();\n\t\t\tif (!ASN1_GENERALIZEDTIME_set_string(comp_time, arg_str))\n\t\t\t\t{\n\t\t\t\tBIO_printf(bio_err, "invalid compromised time %s\\n", arg_str);\n\t\t\t\tgoto err;\n\t\t\t\t}\n\t\t\tif (reason_code == 9)\n\t\t\t\treason_code = OCSP_REVOKED_STATUS_KEYCOMPROMISE;\n\t\t\telse\n\t\t\t\treason_code = OCSP_REVOKED_STATUS_CACOMPROMISE;\n\t\t\t}\n\t\t}\n\tif (preason) *preason = reason_code;\n\tif (pinvtm) *pinvtm = comp_time;\n\telse ASN1_GENERALIZEDTIME_free(comp_time);\n\tret = 1;\n\terr:\n\tif (tmp) OPENSSL_free(tmp);\n\tif (!phold) ASN1_OBJECT_free(hold);\n\tif (!pinvtm) ASN1_GENERALIZEDTIME_free(comp_time);\n\treturn ret;\n\t}', 'char *BUF_strdup(const char *str)\n\t{\n\tif (str == NULL) return(NULL);\n\treturn BUF_strndup(str, strlen(str));\n\t}']