crypto/x509v3/pcy_tree.c:614: error: NULL_DEREFERENCE
  pointer `cache` last assigned on line 613 could be null and is dereferenced by call to `tree_link_nodes()` at line 614, column 14.
Showing all 46 steps of the trace


crypto/x509v3/pcy_tree.c:606:1: start of procedure tree_evaluate()
604.   }
605.   
606. > static int tree_evaluate(X509_POLICY_TREE *tree)
607.   {
608.       int ret, i;

crypto/x509v3/pcy_tree.c:609:5: 
607.   {
608.       int ret, i;
609. >     X509_POLICY_LEVEL *curr = tree->levels + 1;
610.       const X509_POLICY_CACHE *cache;
611.   

crypto/x509v3/pcy_tree.c:612:10: 
610.       const X509_POLICY_CACHE *cache;
611.   
612. >     for (i = 1; i < tree->nlevel; i++, curr++) {
613.           cache = policy_cache_set(curr->cert);
614.           if (!tree_link_nodes(curr, cache))

crypto/x509v3/pcy_tree.c:612:17: Loop condition is true. Entering loop body
610.       const X509_POLICY_CACHE *cache;
611.   
612.       for (i = 1; i < tree->nlevel; i++, curr++) {
                       ^
613.           cache = policy_cache_set(curr->cert);
614.           if (!tree_link_nodes(curr, cache))

crypto/x509v3/pcy_tree.c:613:9: 
611.   
612.       for (i = 1; i < tree->nlevel; i++, curr++) {
613. >         cache = policy_cache_set(curr->cert);
614.           if (!tree_link_nodes(curr, cache))
615.               return 0;

crypto/x509v3/pcy_cache.c:224:1: start of procedure policy_cache_set()
  222.   }
  223.   
  224. > const X509_POLICY_CACHE *policy_cache_set(X509 *x)
  225.   {
  226.   

crypto/x509v3/pcy_cache.c:227:9: Taking true branch
  225.   {
  226.   
  227.       if (x->policy_cache == NULL) {
                 ^
  228.           CRYPTO_w_lock(CRYPTO_LOCK_X509);
  229.           policy_cache_new(x);

crypto/x509v3/pcy_cache.c:228:9: 
  226.   
  227.       if (x->policy_cache == NULL) {
  228. >         CRYPTO_w_lock(CRYPTO_LOCK_X509);
  229.           policy_cache_new(x);
  230.           CRYPTO_w_unlock(CRYPTO_LOCK_X509);

crypto/lock.c:414:1: start of procedure CRYPTO_lock()
    412.   }
    413.   
    414. > void CRYPTO_lock(int mode, int type, const char *file, int line)
    415.   {
    416.   #ifdef LOCK_DEBUG

crypto/lock.c:441:9: Taking false branch
    439.       }
    440.   #endif
    441.       if (type < 0) {
                   ^
    442.           if (dynlock_lock_callback != NULL) {
    443.               struct CRYPTO_dynlock_value *pointer

crypto/lock.c:452:16: Taking true branch
    450.               CRYPTO_destroy_dynlockid(type);
    451.           }
    452.       } else if (locking_callback != NULL)
                          ^
    453.           locking_callback(mode, type, file, line);
    454.   }

crypto/lock.c:453:9: Skipping __function_pointer__(): unresolved function pointer
    451.           }
    452.       } else if (locking_callback != NULL)
    453.           locking_callback(mode, type, file, line);
                   ^
    454.   }
    455.   

crypto/lock.c:441:5: 
    439.       }
    440.   #endif
    441. >     if (type < 0) {
    442.           if (dynlock_lock_callback != NULL) {
    443.               struct CRYPTO_dynlock_value *pointer

crypto/lock.c:454:1: return from a call to CRYPTO_lock
    452.       } else if (locking_callback != NULL)
    453.           locking_callback(mode, type, file, line);
    454. > }
    455.   
    456.   int CRYPTO_add_lock(int *pointer, int amount, int type, const char *file,

crypto/x509v3/pcy_cache.c:229:9: 
  227.       if (x->policy_cache == NULL) {
  228.           CRYPTO_w_lock(CRYPTO_LOCK_X509);
  229. >         policy_cache_new(x);
  230.           CRYPTO_w_unlock(CRYPTO_LOCK_X509);
  231.       }

crypto/x509v3/pcy_cache.c:123:1: start of procedure policy_cache_new()
    121.   }
    122.   
    123. > static int policy_cache_new(X509 *x)
    124.   {
    125.       X509_POLICY_CACHE *cache;

crypto/x509v3/pcy_cache.c:126:5: 
    124.   {
    125.       X509_POLICY_CACHE *cache;
    126. >     ASN1_INTEGER *ext_any = NULL;
    127.       POLICY_CONSTRAINTS *ext_pcons = NULL;
    128.       CERTIFICATEPOLICIES *ext_cpols = NULL;

crypto/x509v3/pcy_cache.c:127:5: 
    125.       X509_POLICY_CACHE *cache;
    126.       ASN1_INTEGER *ext_any = NULL;
    127. >     POLICY_CONSTRAINTS *ext_pcons = NULL;
    128.       CERTIFICATEPOLICIES *ext_cpols = NULL;
    129.       POLICY_MAPPINGS *ext_pmaps = NULL;

crypto/x509v3/pcy_cache.c:128:5: 
    126.       ASN1_INTEGER *ext_any = NULL;
    127.       POLICY_CONSTRAINTS *ext_pcons = NULL;
    128. >     CERTIFICATEPOLICIES *ext_cpols = NULL;
    129.       POLICY_MAPPINGS *ext_pmaps = NULL;
    130.       int i;

crypto/x509v3/pcy_cache.c:129:5: 
    127.       POLICY_CONSTRAINTS *ext_pcons = NULL;
    128.       CERTIFICATEPOLICIES *ext_cpols = NULL;
    129. >     POLICY_MAPPINGS *ext_pmaps = NULL;
    130.       int i;
    131.       cache = OPENSSL_malloc(sizeof(*cache));

crypto/x509v3/pcy_cache.c:131:5: 
    129.       POLICY_MAPPINGS *ext_pmaps = NULL;
    130.       int i;
    131. >     cache = OPENSSL_malloc(sizeof(*cache));
    132.       if (cache == NULL)
    133.           return 0;

crypto/mem.c:120:1: start of procedure CRYPTO_malloc()
      118.   }
      119.   
      120. > void *CRYPTO_malloc(size_t num, const char *file, int line)
      121.   {
      122.       void *ret = NULL;

crypto/mem.c:122:5: 
      120.   void *CRYPTO_malloc(size_t num, const char *file, int line)
      121.   {
      122. >     void *ret = NULL;
      123.   
      124.       if (num <= 0)

crypto/mem.c:124:9: Taking false branch
      122.       void *ret = NULL;
      123.   
      124.       if (num <= 0)
                     ^
      125.           return NULL;
      126.   

crypto/mem.c:127:5: 
      125.           return NULL;
      126.   
      127. >     allow_customize = 0;
      128.   #ifndef OPENSSL_NO_CRYPTO_MDEBUG
      129.       if (call_malloc_debug) {

crypto/mem.c:137:5: 
      135.       }
      136.   #else
      137. >     (void)file;
      138.       (void)line;
      139.       ret = malloc(num);

crypto/mem.c:138:5: 
      136.   #else
      137.       (void)file;
      138. >     (void)line;
      139.       ret = malloc(num);
      140.   #endif

crypto/mem.c:139:5: 
      137.       (void)file;
      138.       (void)line;
      139. >     ret = malloc(num);
      140.   #endif
      141.   

crypto/mem.c:154:5: 
      152.   #endif
      153.   
      154. >     return ret;
      155.   }
      156.   

crypto/mem.c:155:1: return from a call to CRYPTO_malloc
      153.   
      154.       return ret;
      155. > }
      156.   
      157.   void *CRYPTO_zalloc(size_t num, const char *file, int line)

crypto/x509v3/pcy_cache.c:132:9: Taking true branch
    130.       int i;
    131.       cache = OPENSSL_malloc(sizeof(*cache));
    132.       if (cache == NULL)
                   ^
    133.           return 0;
    134.       cache->anyPolicy = NULL;

crypto/x509v3/pcy_cache.c:133:9: 
    131.       cache = OPENSSL_malloc(sizeof(*cache));
    132.       if (cache == NULL)
    133. >         return 0;
    134.       cache->anyPolicy = NULL;
    135.       cache->data = NULL;

crypto/x509v3/pcy_cache.c:213:1: return from a call to policy_cache_new
    211.       return 1;
    212.   
    213. > }
    214.   
    215.   void policy_cache_free(X509_POLICY_CACHE *cache)

crypto/x509v3/pcy_cache.c:230:9: 
  228.           CRYPTO_w_lock(CRYPTO_LOCK_X509);
  229.           policy_cache_new(x);
  230. >         CRYPTO_w_unlock(CRYPTO_LOCK_X509);
  231.       }
  232.   

crypto/lock.c:414:1: start of procedure CRYPTO_lock()
    412.   }
    413.   
    414. > void CRYPTO_lock(int mode, int type, const char *file, int line)
    415.   {
    416.   #ifdef LOCK_DEBUG

crypto/lock.c:441:9: Taking false branch
    439.       }
    440.   #endif
    441.       if (type < 0) {
                   ^
    442.           if (dynlock_lock_callback != NULL) {
    443.               struct CRYPTO_dynlock_value *pointer

crypto/lock.c:452:16: Taking true branch
    450.               CRYPTO_destroy_dynlockid(type);
    451.           }
    452.       } else if (locking_callback != NULL)
                          ^
    453.           locking_callback(mode, type, file, line);
    454.   }

crypto/lock.c:453:9: Skipping __function_pointer__(): unresolved function pointer
    451.           }
    452.       } else if (locking_callback != NULL)
    453.           locking_callback(mode, type, file, line);
                   ^
    454.   }
    455.   

crypto/lock.c:441:5: 
    439.       }
    440.   #endif
    441. >     if (type < 0) {
    442.           if (dynlock_lock_callback != NULL) {
    443.               struct CRYPTO_dynlock_value *pointer

crypto/lock.c:454:1: return from a call to CRYPTO_lock
    452.       } else if (locking_callback != NULL)
    453.           locking_callback(mode, type, file, line);
    454. > }
    455.   
    456.   int CRYPTO_add_lock(int *pointer, int amount, int type, const char *file,

crypto/x509v3/pcy_cache.c:233:5: 
  231.       }
  232.   
  233. >     return x->policy_cache;
  234.   
  235.   }

crypto/x509v3/pcy_cache.c:235:1: return from a call to policy_cache_set
  233.       return x->policy_cache;
  234.   
  235. > }
  236.   
  237.   X509_POLICY_DATA *policy_cache_find_data(const X509_POLICY_CACHE *cache,

crypto/x509v3/pcy_tree.c:614:14: 
612.       for (i = 1; i < tree->nlevel; i++, curr++) {
613.           cache = policy_cache_set(curr->cert);
614. >         if (!tree_link_nodes(curr, cache))
615.               return 0;
616.   

crypto/x509v3/pcy_tree.c:321:1: start of procedure tree_link_nodes()
  319.    */
  320.   
  321. > static int tree_link_nodes(X509_POLICY_LEVEL *curr,
  322.                              const X509_POLICY_CACHE *cache)
  323.   {

crypto/x509v3/pcy_tree.c:327:10: 
  325.       X509_POLICY_DATA *data;
  326.   
  327. >     for (i = 0; i < sk_X509_POLICY_DATA_num(cache->data); i++) {
  328.           data = sk_X509_POLICY_DATA_value(cache->data, i);
  329.           /* Look for matching nodes in previous level */

crypto/x509v3/pcy_tree.c:327:17: 
  325.       X509_POLICY_DATA *data;
  326.   
  327. >     for (i = 0; i < sk_X509_POLICY_DATA_num(cache->data); i++) {
  328.           data = sk_X509_POLICY_DATA_value(cache->data, i);
  329.           /* Look for matching nodes in previous level */

static int tree_evaluate(X509_POLICY_TREE *tree)
{
    int ret, i;
    X509_POLICY_LEVEL *curr = tree->levels + 1;
    const X509_POLICY_CACHE *cache;
    for (i = 1; i < tree->nlevel; i++, curr++) {
        cache = policy_cache_set(curr->cert);
        if (!tree_link_nodes(curr, cache))
            return 0;
        if (!(curr->flags & X509_V_FLAG_INHIBIT_ANY)
            && !tree_link_any(curr, cache, tree))
            return 0;
        tree_print("before tree_prune()", tree, curr);
        ret = tree_prune(tree, curr);
        if (ret != 1)
            return ret;
    }
    return 1;
}
['static int tree_evaluate(X509_POLICY_TREE *tree)\n{\n    int ret, i;\n    X509_POLICY_LEVEL *curr = tree->levels + 1;\n    const X509_POLICY_CACHE *cache;\n    for (i = 1; i < tree->nlevel; i++, curr++) {\n        cache = policy_cache_set(curr->cert);\n        if (!tree_link_nodes(curr, cache))\n            return 0;\n        if (!(curr->flags & X509_V_FLAG_INHIBIT_ANY)\n            && !tree_link_any(curr, cache, tree))\n            return 0;\n        tree_print("before tree_prune()", tree, curr);\n        ret = tree_prune(tree, curr);\n        if (ret != 1)\n            return ret;\n    }\n    return 1;\n}', 'const X509_POLICY_CACHE *policy_cache_set(X509 *x)\n{\n    if (x->policy_cache == NULL) {\n        CRYPTO_w_lock(CRYPTO_LOCK_X509);\n        policy_cache_new(x);\n        CRYPTO_w_unlock(CRYPTO_LOCK_X509);\n    }\n    return x->policy_cache;\n}', 'void CRYPTO_lock(int mode, int type, const char *file, int line)\n{\n#ifdef LOCK_DEBUG\n    {\n        CRYPTO_THREADID id;\n        char *rw_text, *operation_text;\n        if (mode & CRYPTO_LOCK)\n            operation_text = "lock  ";\n        else if (mode & CRYPTO_UNLOCK)\n            operation_text = "unlock";\n        else\n            operation_text = "ERROR ";\n        if (mode & CRYPTO_READ)\n            rw_text = "r";\n        else if (mode & CRYPTO_WRITE)\n            rw_text = "w";\n        else\n            rw_text = "ERROR";\n        CRYPTO_THREADID_current(&id);\n        fprintf(stderr, "lock:%08lx:(%s)%s %-18s %s:%d\\n",\n                CRYPTO_THREADID_hash(&id), rw_text, operation_text,\n                CRYPTO_get_lock_name(type), file, line);\n    }\n#endif\n    if (type < 0) {\n        if (dynlock_lock_callback != NULL) {\n            struct CRYPTO_dynlock_value *pointer\n                = CRYPTO_get_dynlock_value(type);\n            OPENSSL_assert(pointer != NULL);\n            dynlock_lock_callback(mode, pointer, file, line);\n            CRYPTO_destroy_dynlockid(type);\n        }\n    } else if (locking_callback != NULL)\n        locking_callback(mode, type, file, line);\n}', 'static int policy_cache_new(X509 *x)\n{\n    X509_POLICY_CACHE *cache;\n    ASN1_INTEGER *ext_any = NULL;\n    POLICY_CONSTRAINTS *ext_pcons = NULL;\n    CERTIFICATEPOLICIES *ext_cpols = NULL;\n    POLICY_MAPPINGS *ext_pmaps = NULL;\n    int i;\n    cache = OPENSSL_malloc(sizeof(*cache));\n    if (cache == NULL)\n        return 0;\n    cache->anyPolicy = NULL;\n    cache->data = NULL;\n    cache->any_skip = -1;\n    cache->explicit_skip = -1;\n    cache->map_skip = -1;\n    x->policy_cache = cache;\n    ext_pcons = X509_get_ext_d2i(x, NID_policy_constraints, &i, NULL);\n    if (!ext_pcons) {\n        if (i != -1)\n            goto bad_cache;\n    } else {\n        if (!ext_pcons->requireExplicitPolicy\n            && !ext_pcons->inhibitPolicyMapping)\n            goto bad_cache;\n        if (!policy_cache_set_int(&cache->explicit_skip,\n                                  ext_pcons->requireExplicitPolicy))\n            goto bad_cache;\n        if (!policy_cache_set_int(&cache->map_skip,\n                                  ext_pcons->inhibitPolicyMapping))\n            goto bad_cache;\n    }\n    ext_cpols = X509_get_ext_d2i(x, NID_certificate_policies, &i, NULL);\n    if (!ext_cpols) {\n        if (i != -1)\n            goto bad_cache;\n        return 1;\n    }\n    i = policy_cache_create(x, ext_cpols, i);\n    if (i <= 0)\n        return i;\n    ext_pmaps = X509_get_ext_d2i(x, NID_policy_mappings, &i, NULL);\n    if (!ext_pmaps) {\n        if (i != -1)\n            goto bad_cache;\n    } else {\n        i = policy_cache_set_mapping(x, ext_pmaps);\n        if (i <= 0)\n            goto bad_cache;\n    }\n    ext_any = X509_get_ext_d2i(x, NID_inhibit_any_policy, &i, NULL);\n    if (!ext_any) {\n        if (i != -1)\n            goto bad_cache;\n    } else if (!policy_cache_set_int(&cache->any_skip, ext_any))\n        goto bad_cache;\n    goto just_cleanup;\n bad_cache:\n    x->ex_flags |= EXFLAG_INVALID_POLICY;\n just_cleanup:\n    POLICY_CONSTRAINTS_free(ext_pcons);\n    ASN1_INTEGER_free(ext_any);\n    return 1;\n}', 'void *CRYPTO_malloc(size_t num, const char *file, int line)\n{\n    void *ret = NULL;\n    if (num <= 0)\n        return NULL;\n    allow_customize = 0;\n#ifndef OPENSSL_NO_CRYPTO_MDEBUG\n    if (call_malloc_debug) {\n        CRYPTO_mem_debug_malloc(NULL, num, 0, file, line);\n        ret = malloc(num);\n        CRYPTO_mem_debug_malloc(ret, num, 1, file, line);\n    } else {\n        ret = malloc(num);\n    }\n#else\n    (void)file;\n    (void)line;\n    ret = malloc(num);\n#endif\n#ifndef OPENSSL_CPUID_OBJ\n    if (ret && (num > 2048)) {\n        extern unsigned char cleanse_ctr;\n        ((unsigned char *)ret)[0] = cleanse_ctr;\n    }\n#endif\n    return ret;\n}', 'static int tree_link_nodes(X509_POLICY_LEVEL *curr,\n                           const X509_POLICY_CACHE *cache)\n{\n    int i;\n    X509_POLICY_DATA *data;\n    for (i = 0; i < sk_X509_POLICY_DATA_num(cache->data); i++) {\n        data = sk_X509_POLICY_DATA_value(cache->data, i);\n        if (!tree_link_matching_nodes(curr, data))\n            return 0;\n    }\n    return 1;\n}']