engines/e_4758cca.c:744: error: NULL_DEREFERENCE
  pointer `keyToken` last assigned on line 736 could be null and is dereferenced at line 744, column 22.
Showing all 29 steps of the trace


engines/e_4758cca.c:722:1: start of procedure cca_rsa_sign()
720.   #   define SSL_SIG_LEN 36
721.   
722. > static int cca_rsa_sign(int type, const unsigned char *m, unsigned int m_len,
723.                           unsigned char *sigret, unsigned int *siglen,
724.                           const RSA *rsa)

engines/e_4758cca.c:728:5: 
726.       long returnCode;
727.       long reasonCode;
728. >     long exitDataLength = 0;
729.       unsigned char exitData[8];
730.       long ruleArrayLength = 1;

engines/e_4758cca.c:730:5: 
728.       long exitDataLength = 0;
729.       unsigned char exitData[8];
730. >     long ruleArrayLength = 1;
731.       unsigned char ruleArray[8] = "PKCS-1.1";
732.       long outputLength = 256;

engines/e_4758cca.c:731:5: 
729.       unsigned char exitData[8];
730.       long ruleArrayLength = 1;
731. >     unsigned char ruleArray[8] = "PKCS-1.1";
732.       long outputLength = 256;
733.       long outputBitLength;

engines/e_4758cca.c:732:5: 
730.       long ruleArrayLength = 1;
731.       unsigned char ruleArray[8] = "PKCS-1.1";
732. >     long outputLength = 256;
733.       long outputBitLength;
734.       long keyTokenLength;

engines/e_4758cca.c:735:5: 
733.       long outputBitLength;
734.       long keyTokenLength;
735. >     unsigned char *hashBuffer = NULL;
736.       unsigned char *keyToken = (unsigned char *)RSA_get_ex_data(rsa, hndidx);
737.       long length = SSL_SIG_LEN;

engines/e_4758cca.c:736:5: 
734.       long keyTokenLength;
735.       unsigned char *hashBuffer = NULL;
736. >     unsigned char *keyToken = (unsigned char *)RSA_get_ex_data(rsa, hndidx);
737.       long length = SSL_SIG_LEN;
738.       long keyLength;

crypto/rsa/rsa_lib.c:278:1: start of procedure RSA_get_ex_data()
  276.   }
  277.   
  278. > void *RSA_get_ex_data(const RSA *r, int idx)
  279.   {
  280.       return (CRYPTO_get_ex_data(&r->ex_data, idx));

crypto/rsa/rsa_lib.c:280:5: 
  278.   void *RSA_get_ex_data(const RSA *r, int idx)
  279.   {
  280. >     return (CRYPTO_get_ex_data(&r->ex_data, idx));
  281.   }
  282.   

crypto/ex_data.c:634:1: start of procedure CRYPTO_get_ex_data()
    632.    * particular index in the class used by this variable
    633.    */
    634. > void *CRYPTO_get_ex_data(const CRYPTO_EX_DATA *ad, int idx)
    635.   {
    636.       if (ad->sk == NULL)

crypto/ex_data.c:636:9: Taking false branch
    634.   void *CRYPTO_get_ex_data(const CRYPTO_EX_DATA *ad, int idx)
    635.   {
    636.       if (ad->sk == NULL)
                   ^
    637.           return (0);
    638.       else if (idx >= sk_void_num(ad->sk))

crypto/ex_data.c:638:21: Condition is true
    636.       if (ad->sk == NULL)
    637.           return (0);
    638.       else if (idx >= sk_void_num(ad->sk))
                               ^
    639.           return (0);
    640.       else

crypto/ex_data.c:638:14: 
    636.       if (ad->sk == NULL)
    637.           return (0);
    638. >     else if (idx >= sk_void_num(ad->sk))
    639.           return (0);
    640.       else

crypto/stack/stack.c:319:1: start of procedure sk_num()
      317.   }
      318.   
      319. > int sk_num(const _STACK *st)
      320.   {
      321.       if (st == NULL)

crypto/stack/stack.c:321:9: Taking false branch
      319.   int sk_num(const _STACK *st)
      320.   {
      321.       if (st == NULL)
                     ^
      322.           return -1;
      323.       return st->num;

crypto/stack/stack.c:323:5: 
      321.       if (st == NULL)
      322.           return -1;
      323. >     return st->num;
      324.   }
      325.   

crypto/stack/stack.c:324:1: return from a call to sk_num
      322.           return -1;
      323.       return st->num;
      324. > }
      325.   
      326.   void *sk_value(const _STACK *st, int i)

crypto/ex_data.c:638:14: Taking false branch
    636.       if (ad->sk == NULL)
    637.           return (0);
    638.       else if (idx >= sk_void_num(ad->sk))
                        ^
    639.           return (0);
    640.       else

crypto/ex_data.c:641:17: Condition is true
    639.           return (0);
    640.       else
    641.           return (sk_void_value(ad->sk, idx));
                           ^
    642.   }

crypto/ex_data.c:641:9: 
    639.           return (0);
    640.       else
    641. >         return (sk_void_value(ad->sk, idx));
    642.   }

crypto/stack/stack.c:326:1: start of procedure sk_value()
      324.   }
      325.   
      326. > void *sk_value(const _STACK *st, int i)
      327.   {
      328.       if (!st || (i < 0) || (i >= st->num))

crypto/stack/stack.c:328:10: Taking false branch
      326.   void *sk_value(const _STACK *st, int i)
      327.   {
      328.       if (!st || (i < 0) || (i >= st->num))
                      ^
      329.           return NULL;
      330.       return st->data[i];

crypto/stack/stack.c:328:17: Taking true branch
      326.   void *sk_value(const _STACK *st, int i)
      327.   {
      328.       if (!st || (i < 0) || (i >= st->num))
                             ^
      329.           return NULL;
      330.       return st->data[i];

crypto/stack/stack.c:329:9: 
      327.   {
      328.       if (!st || (i < 0) || (i >= st->num))
      329. >         return NULL;
      330.       return st->data[i];
      331.   }

crypto/stack/stack.c:331:1: return from a call to sk_value
      329.           return NULL;
      330.       return st->data[i];
      331. > }
      332.   
      333.   void *sk_set(_STACK *st, int i, void *value)

crypto/ex_data.c:642:1: return from a call to CRYPTO_get_ex_data
    640.       else
    641.           return (sk_void_value(ad->sk, idx));
    642. > }

crypto/rsa/rsa_lib.c:281:1: return from a call to RSA_get_ex_data
  279.   {
  280.       return (CRYPTO_get_ex_data(&r->ex_data, idx));
  281. > }
  282.   
  283.   int RSA_memory_lock(RSA *r)

engines/e_4758cca.c:737:5: 
735.       unsigned char *hashBuffer = NULL;
736.       unsigned char *keyToken = (unsigned char *)RSA_get_ex_data(rsa, hndidx);
737. >     long length = SSL_SIG_LEN;
738.       long keyLength;
739.       X509_SIG sig;

engines/e_4758cca.c:744:5: 
742.       ASN1_OCTET_STRING digest;
743.   
744. >     keyTokenLength = *(long *)keyToken;
745.       keyToken += sizeof(long);
746.   

static int cca_rsa_sign(int type, const unsigned char *m, unsigned int m_len,
                        unsigned char *sigret, unsigned int *siglen,
                        const RSA *rsa)
{
    long returnCode;
    long reasonCode;
    long exitDataLength = 0;
    unsigned char exitData[8];
    long ruleArrayLength = 1;
    unsigned char ruleArray[8] = "PKCS-1.1";
    long outputLength = 256;
    long outputBitLength;
    long keyTokenLength;
    unsigned char *hashBuffer = NULL;
    unsigned char *keyToken = (unsigned char *)RSA_get_ex_data(rsa, hndidx);
    long length = SSL_SIG_LEN;
    long keyLength;
    X509_SIG sig;
    ASN1_TYPE parameter;
    X509_ALGOR algorithm;
    ASN1_OCTET_STRING digest;
    keyTokenLength = *(long *)keyToken;
    keyToken += sizeof(long);
    if (type == NID_md5 || type == NID_sha1) {
        sig.algor = &algorithm;
        algorithm.algorithm = OBJ_nid2obj(type);
        if (!algorithm.algorithm) {
            CCA4758err(CCA4758_F_CCA_RSA_SIGN,
                       CCA4758_R_UNKNOWN_ALGORITHM_TYPE);
            return 0;
        }
        if (!algorithm.algorithm->length) {
            CCA4758err(CCA4758_F_CCA_RSA_SIGN,
                       CCA4758_R_ASN1_OID_UNKNOWN_FOR_MD);
            return 0;
        }
        parameter.type = V_ASN1_NULL;
        parameter.value.ptr = NULL;
        algorithm.parameter = &parameter;
        sig.digest = &digest;
        sig.digest->data = (unsigned char *)m;
        sig.digest->length = m_len;
        length = i2d_X509_SIG(&sig, NULL);
    }
    keyLength = RSA_size(rsa);
    if (length - RSA_PKCS1_PADDING > keyLength) {
        CCA4758err(CCA4758_F_CCA_RSA_SIGN,
                   CCA4758_R_SIZE_TOO_LARGE_OR_TOO_SMALL);
        return 0;
    }
    switch (type) {
    case NID_md5_sha1:
        if (m_len != SSL_SIG_LEN) {
            CCA4758err(CCA4758_F_CCA_RSA_SIGN,
                       CCA4758_R_SIZE_TOO_LARGE_OR_TOO_SMALL);
            return 0;
        }
        hashBuffer = (unsigned char *)m;
        length = m_len;
        break;
    case NID_md5:
        {
            unsigned char *ptr;
            ptr = hashBuffer = OPENSSL_malloc((unsigned int)keyLength + 1);
            if (!hashBuffer) {
                CCA4758err(CCA4758_F_CCA_RSA_SIGN, ERR_R_MALLOC_FAILURE);
                return 0;
            }
            i2d_X509_SIG(&sig, &ptr);
        }
        break;
    case NID_sha1:
        {
            unsigned char *ptr;
            ptr = hashBuffer = OPENSSL_malloc((unsigned int)keyLength + 1);
            if (!hashBuffer) {
                CCA4758err(CCA4758_F_CCA_RSA_SIGN, ERR_R_MALLOC_FAILURE);
                return 0;
            }
            i2d_X509_SIG(&sig, &ptr);
        }
        break;
    default:
        return 0;
    }
    digitalSignatureGenerate(&returnCode, &reasonCode, &exitDataLength,
                             exitData, &ruleArrayLength, ruleArray,
                             &keyTokenLength, keyToken, &length, hashBuffer,
                             &outputLength, &outputBitLength, sigret);
    if (type == NID_sha1 || type == NID_md5) {
        OPENSSL_cleanse(hashBuffer, keyLength + 1);
        OPENSSL_free(hashBuffer);
    }
    *siglen = outputLength;
    return ((returnCode || reasonCode) ? 0 : 1);
}
['static int cca_rsa_sign(int type, const unsigned char *m, unsigned int m_len,\n                        unsigned char *sigret, unsigned int *siglen,\n                        const RSA *rsa)\n{\n    long returnCode;\n    long reasonCode;\n    long exitDataLength = 0;\n    unsigned char exitData[8];\n    long ruleArrayLength = 1;\n    unsigned char ruleArray[8] = "PKCS-1.1";\n    long outputLength = 256;\n    long outputBitLength;\n    long keyTokenLength;\n    unsigned char *hashBuffer = NULL;\n    unsigned char *keyToken = (unsigned char *)RSA_get_ex_data(rsa, hndidx);\n    long length = SSL_SIG_LEN;\n    long keyLength;\n    X509_SIG sig;\n    ASN1_TYPE parameter;\n    X509_ALGOR algorithm;\n    ASN1_OCTET_STRING digest;\n    keyTokenLength = *(long *)keyToken;\n    keyToken += sizeof(long);\n    if (type == NID_md5 || type == NID_sha1) {\n        sig.algor = &algorithm;\n        algorithm.algorithm = OBJ_nid2obj(type);\n        if (!algorithm.algorithm) {\n            CCA4758err(CCA4758_F_CCA_RSA_SIGN,\n                       CCA4758_R_UNKNOWN_ALGORITHM_TYPE);\n            return 0;\n        }\n        if (!algorithm.algorithm->length) {\n            CCA4758err(CCA4758_F_CCA_RSA_SIGN,\n                       CCA4758_R_ASN1_OID_UNKNOWN_FOR_MD);\n            return 0;\n        }\n        parameter.type = V_ASN1_NULL;\n        parameter.value.ptr = NULL;\n        algorithm.parameter = &parameter;\n        sig.digest = &digest;\n        sig.digest->data = (unsigned char *)m;\n        sig.digest->length = m_len;\n        length = i2d_X509_SIG(&sig, NULL);\n    }\n    keyLength = RSA_size(rsa);\n    if (length - RSA_PKCS1_PADDING > keyLength) {\n        CCA4758err(CCA4758_F_CCA_RSA_SIGN,\n                   CCA4758_R_SIZE_TOO_LARGE_OR_TOO_SMALL);\n        return 0;\n    }\n    switch (type) {\n    case NID_md5_sha1:\n        if (m_len != SSL_SIG_LEN) {\n            CCA4758err(CCA4758_F_CCA_RSA_SIGN,\n                       CCA4758_R_SIZE_TOO_LARGE_OR_TOO_SMALL);\n            return 0;\n        }\n        hashBuffer = (unsigned char *)m;\n        length = m_len;\n        break;\n    case NID_md5:\n        {\n            unsigned char *ptr;\n            ptr = hashBuffer = OPENSSL_malloc((unsigned int)keyLength + 1);\n            if (!hashBuffer) {\n                CCA4758err(CCA4758_F_CCA_RSA_SIGN, ERR_R_MALLOC_FAILURE);\n                return 0;\n            }\n            i2d_X509_SIG(&sig, &ptr);\n        }\n        break;\n    case NID_sha1:\n        {\n            unsigned char *ptr;\n            ptr = hashBuffer = OPENSSL_malloc((unsigned int)keyLength + 1);\n            if (!hashBuffer) {\n                CCA4758err(CCA4758_F_CCA_RSA_SIGN, ERR_R_MALLOC_FAILURE);\n                return 0;\n            }\n            i2d_X509_SIG(&sig, &ptr);\n        }\n        break;\n    default:\n        return 0;\n    }\n    digitalSignatureGenerate(&returnCode, &reasonCode, &exitDataLength,\n                             exitData, &ruleArrayLength, ruleArray,\n                             &keyTokenLength, keyToken, &length, hashBuffer,\n                             &outputLength, &outputBitLength, sigret);\n    if (type == NID_sha1 || type == NID_md5) {\n        OPENSSL_cleanse(hashBuffer, keyLength + 1);\n        OPENSSL_free(hashBuffer);\n    }\n    *siglen = outputLength;\n    return ((returnCode || reasonCode) ? 0 : 1);\n}', 'void *RSA_get_ex_data(const RSA *r, int idx)\n{\n    return (CRYPTO_get_ex_data(&r->ex_data, idx));\n}', 'void *CRYPTO_get_ex_data(const CRYPTO_EX_DATA *ad, int idx)\n{\n    if (ad->sk == NULL)\n        return (0);\n    else if (idx >= sk_void_num(ad->sk))\n        return (0);\n    else\n        return (sk_void_value(ad->sk, idx));\n}', 'int sk_num(const _STACK *st)\n{\n    if (st == NULL)\n        return -1;\n    return st->num;\n}', 'void *sk_value(const _STACK *st, int i)\n{\n    if (!st || (i < 0) || (i >= st->num))\n        return NULL;\n    return st->data[i];\n}']