ssl/ssl_rsa.c:910: error: NULL_DEREFERENCE
  pointer `current_key->authz` last assigned on line 908 could be null and is dereferenced by call to `memcpy()` at line 910, column 2.
Showing all 48 steps of the trace


ssl/ssl_rsa.c:898:1: start of procedure ssl_set_authz()
896.   	}
897.   
898. > static int ssl_set_authz(CERT *c, unsigned char *authz, size_t authz_length)
899.   	{
900.   	CERT_PKEY *current_key = c->key;

ssl/ssl_rsa.c:900:2: 
898.   static int ssl_set_authz(CERT *c, unsigned char *authz, size_t authz_length)
899.   	{
900. > 	CERT_PKEY *current_key = c->key;
901.   	if (current_key == NULL)
902.   		return 0;

ssl/ssl_rsa.c:901:6: Taking false branch
899.   	{
900.   	CERT_PKEY *current_key = c->key;
901.   	if (current_key == NULL)
            ^
902.   		return 0;
903.   	if (!authz_validate(authz, authz_length))

ssl/ssl_rsa.c:903:7: 
901.   	if (current_key == NULL)
902.   		return 0;
903. > 	if (!authz_validate(authz, authz_length))
904.   		{
905.   		SSLerr(SSL_F_SSL_SET_AUTHZ,SSL_R_INVALID_AUTHZ_DATA);

ssl/ssl_rsa.c:817:1: start of procedure authz_validate()
  815.    * wire format as documented in the CERT_PKEY structure and that there are no
  816.    * duplicate entries. */
  817. > static char authz_validate(const unsigned char *authz, size_t length)
  818.   	{
  819.   	unsigned char types_seen_bitmap[32];

ssl/ssl_rsa.c:821:7: Taking false branch
  819.   	unsigned char types_seen_bitmap[32];
  820.   
  821.   	if (!authz)
               ^
  822.   		return 1;
  823.   

ssl/ssl_rsa.c:824:2: 
  822.   		return 1;
  823.   
  824. > 	memset(types_seen_bitmap, 0, sizeof(types_seen_bitmap));
  825.   
  826.   	for (;;)

ssl/ssl_rsa.c:855:3: Loop condition is true. Entering loop body
  853.   		authz += len;
  854.   		length -= len;
  855.   		}
           ^
  856.   	}
  857.   

ssl/ssl_rsa.c:831:8: Taking false branch
  829.   		unsigned short len;
  830.   
  831.   		if (!length)
                ^
  832.   			return 1;
  833.   

ssl/ssl_rsa.c:834:3: 
  832.   			return 1;
  833.   
  834. > 		type = *(authz++);
  835.   		length--;
  836.   

ssl/ssl_rsa.c:835:3: 
  833.   
  834.   		type = *(authz++);
  835. > 		length--;
  836.   
  837.   		byte = type / 8;

ssl/ssl_rsa.c:837:3: 
  835.   		length--;
  836.   
  837. > 		byte = type / 8;
  838.   		bit = type & 7;
  839.   		if (types_seen_bitmap[byte] & (1 << bit))

ssl/ssl_rsa.c:838:3: 
  836.   
  837.   		byte = type / 8;
  838. > 		bit = type & 7;
  839.   		if (types_seen_bitmap[byte] & (1 << bit))
  840.   			return 0;

ssl/ssl_rsa.c:839:7: Taking false branch
  837.   		byte = type / 8;
  838.   		bit = type & 7;
  839.   		if (types_seen_bitmap[byte] & (1 << bit))
               ^
  840.   			return 0;
  841.   		types_seen_bitmap[byte] |= (1 << bit);

ssl/ssl_rsa.c:841:3: 
  839.   		if (types_seen_bitmap[byte] & (1 << bit))
  840.   			return 0;
  841. > 		types_seen_bitmap[byte] |= (1 << bit);
  842.   
  843.   		if (length < 2)

ssl/ssl_rsa.c:843:7: Taking false branch
  841.   		types_seen_bitmap[byte] |= (1 << bit);
  842.   
  843.   		if (length < 2)
               ^
  844.   			return 0;
  845.   		len = ((unsigned short) authz[0]) << 8 |

ssl/ssl_rsa.c:845:3: 
  843.   		if (length < 2)
  844.   			return 0;
  845. > 		len = ((unsigned short) authz[0]) << 8 |
  846.   		      ((unsigned short) authz[1]);
  847.   		authz += 2;

ssl/ssl_rsa.c:847:3: 
  845.   		len = ((unsigned short) authz[0]) << 8 |
  846.   		      ((unsigned short) authz[1]);
  847. > 		authz += 2;
  848.   		length -= 2;
  849.   

ssl/ssl_rsa.c:848:3: 
  846.   		      ((unsigned short) authz[1]);
  847.   		authz += 2;
  848. > 		length -= 2;
  849.   
  850.   		if (length < len)

ssl/ssl_rsa.c:850:7: Taking false branch
  848.   		length -= 2;
  849.   
  850.   		if (length < len)
               ^
  851.   			return 0;
  852.   

ssl/ssl_rsa.c:853:3: 
  851.   			return 0;
  852.   
  853. > 		authz += len;
  854.   		length -= len;
  855.   		}

ssl/ssl_rsa.c:854:3: 
  852.   
  853.   		authz += len;
  854. > 		length -= len;
  855.   		}
  856.   	}

ssl/ssl_rsa.c:855:3: Loop condition is true. Entering loop body
  853.   		authz += len;
  854.   		length -= len;
  855.   		}
           ^
  856.   	}
  857.   

ssl/ssl_rsa.c:831:8: Taking true branch
  829.   		unsigned short len;
  830.   
  831.   		if (!length)
                ^
  832.   			return 1;
  833.   

ssl/ssl_rsa.c:832:4: 
  830.   
  831.   		if (!length)
  832. > 			return 1;
  833.   
  834.   		type = *(authz++);

ssl/ssl_rsa.c:856:2: return from a call to authz_validate
  854.   		length -= len;
  855.   		}
  856.   	}
          ^
  857.   
  858.   static const unsigned char *authz_find_data(const unsigned char *authz,

ssl/ssl_rsa.c:903:7: Taking false branch
901.   	if (current_key == NULL)
902.   		return 0;
903.   	if (!authz_validate(authz, authz_length))
             ^
904.   		{
905.   		SSLerr(SSL_F_SSL_SET_AUTHZ,SSL_R_INVALID_AUTHZ_DATA);

ssl/ssl_rsa.c:908:2: 
906.   		return(0);
907.   		}
908. > 	current_key->authz = OPENSSL_realloc(current_key->authz, authz_length);
909.   	current_key->authz_length = authz_length;
910.   	memcpy(current_key->authz, authz, authz_length);

crypto/mem.c:334:1: start of procedure CRYPTO_realloc()
  332.   	}
  333.   
  334. > void *CRYPTO_realloc(void *str, int num, const char *file, int line)
  335.   	{
  336.   	void *ret = NULL;

crypto/mem.c:336:2: 
  334.   void *CRYPTO_realloc(void *str, int num, const char *file, int line)
  335.   	{
  336. > 	void *ret = NULL;
  337.   
  338.   	if (str == NULL)

crypto/mem.c:338:6: Taking true branch
  336.   	void *ret = NULL;
  337.   
  338.   	if (str == NULL)
              ^
  339.   		return CRYPTO_malloc(num, file, line);
  340.   

crypto/mem.c:339:3: 
  337.   
  338.   	if (str == NULL)
  339. > 		return CRYPTO_malloc(num, file, line);
  340.   
  341.   	if (num <= 0) return NULL;

crypto/mem.c:295:1: start of procedure CRYPTO_malloc()
    293.   	}
    294.   
    295. > void *CRYPTO_malloc(int num, const char *file, int line)
    296.   	{
    297.   	void *ret = NULL;

crypto/mem.c:297:2: 
    295.   void *CRYPTO_malloc(int num, const char *file, int line)
    296.   	{
    297. > 	void *ret = NULL;
    298.   
    299.   	if (num <= 0) return NULL;

crypto/mem.c:299:6: Taking false branch
    297.   	void *ret = NULL;
    298.   
    299.   	if (num <= 0) return NULL;
                ^
    300.   
    301.   	allow_customize = 0;

crypto/mem.c:301:2: 
    299.   	if (num <= 0) return NULL;
    300.   
    301. > 	allow_customize = 0;
    302.   	if (malloc_debug_func != NULL)
    303.   		{

crypto/mem.c:302:6: Taking true branch
    300.   
    301.   	allow_customize = 0;
    302.   	if (malloc_debug_func != NULL)
                ^
    303.   		{
    304.   		allow_customize_debug = 0;

crypto/mem.c:304:3: 
    302.   	if (malloc_debug_func != NULL)
    303.   		{
    304. > 		allow_customize_debug = 0;
    305.   		malloc_debug_func(NULL, num, file, line, 0);
    306.   		}

crypto/mem.c:305:3: Skipping __function_pointer__(): unresolved function pointer
    303.   		{
    304.   		allow_customize_debug = 0;
    305.   		malloc_debug_func(NULL, num, file, line, 0);
             ^
    306.   		}
    307.   	ret = malloc_ex_func(num,file,line);

crypto/mem.c:307:2: Skipping __function_pointer__(): unresolved function pointer
    305.   		malloc_debug_func(NULL, num, file, line, 0);
    306.   		}
    307.   	ret = malloc_ex_func(num,file,line);
            ^
    308.   #ifdef LEVITTE_DEBUG_MEM
    309.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);

crypto/mem.c:311:6: Taking true branch
    309.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);
    310.   #endif
    311.   	if (malloc_debug_func != NULL)
                ^
    312.   		malloc_debug_func(ret, num, file, line, 1);
    313.   

crypto/mem.c:312:3: Skipping __function_pointer__(): unresolved function pointer
    310.   #endif
    311.   	if (malloc_debug_func != NULL)
    312.   		malloc_debug_func(ret, num, file, line, 1);
             ^
    313.   
    314.   #ifndef OPENSSL_CPUID_OBJ

crypto/mem.c:318:12: Taking false branch
    316.            * sanitisation function can't be optimised out. NB: We only do
    317.            * this for >2Kb so the overhead doesn't bother us. */
    318.           if(ret && (num > 2048))
                      ^
    319.   	{	extern unsigned char cleanse_ctr;
    320.                   ((unsigned char *)ret)[0] = cleanse_ctr;

crypto/mem.c:324:2: 
    322.   #endif
    323.   
    324. > 	return ret;
    325.   	}
    326.   char *CRYPTO_strdup(const char *str, const char *file, int line)

crypto/mem.c:325:2: return from a call to CRYPTO_malloc
    323.   
    324.   	return ret;
    325.   	}
            ^
    326.   char *CRYPTO_strdup(const char *str, const char *file, int line)
    327.   	{

crypto/mem.c:353:2: return from a call to CRYPTO_realloc
  351.   
  352.   	return ret;
  353.   	}
          ^
  354.   
  355.   void *CRYPTO_realloc_clean(void *str, int old_len, int num, const char *file,

ssl/ssl_rsa.c:909:2: 
907.   		}
908.   	current_key->authz = OPENSSL_realloc(current_key->authz, authz_length);
909. > 	current_key->authz_length = authz_length;
910.   	memcpy(current_key->authz, authz, authz_length);
911.   	return 1;

ssl/ssl_rsa.c:910:2: 
908.   	current_key->authz = OPENSSL_realloc(current_key->authz, authz_length);
909.   	current_key->authz_length = authz_length;
910. > 	memcpy(current_key->authz, authz, authz_length);
911.   	return 1;
912.   	}

static int ssl_set_authz(CERT *c, unsigned char *authz, size_t authz_length)
	{
	CERT_PKEY *current_key = c->key;
	if (current_key == NULL)
		return 0;
	if (!authz_validate(authz, authz_length))
		{
		SSLerr(SSL_F_SSL_SET_AUTHZ,SSL_R_INVALID_AUTHZ_DATA);
		return(0);
		}
	current_key->authz = OPENSSL_realloc(current_key->authz, authz_length);
	current_key->authz_length = authz_length;
	memcpy(current_key->authz, authz, authz_length);
	return 1;
	}
['static int ssl_set_authz(CERT *c, unsigned char *authz, size_t authz_length)\n\t{\n\tCERT_PKEY *current_key = c->key;\n\tif (current_key == NULL)\n\t\treturn 0;\n\tif (!authz_validate(authz, authz_length))\n\t\t{\n\t\tSSLerr(SSL_F_SSL_SET_AUTHZ,SSL_R_INVALID_AUTHZ_DATA);\n\t\treturn(0);\n\t\t}\n\tcurrent_key->authz = OPENSSL_realloc(current_key->authz, authz_length);\n\tcurrent_key->authz_length = authz_length;\n\tmemcpy(current_key->authz, authz, authz_length);\n\treturn 1;\n\t}', 'static char authz_validate(const unsigned char *authz, size_t length)\n\t{\n\tunsigned char types_seen_bitmap[32];\n\tif (!authz)\n\t\treturn 1;\n\tmemset(types_seen_bitmap, 0, sizeof(types_seen_bitmap));\n\tfor (;;)\n\t\t{\n\t\tunsigned char type, byte, bit;\n\t\tunsigned short len;\n\t\tif (!length)\n\t\t\treturn 1;\n\t\ttype = *(authz++);\n\t\tlength--;\n\t\tbyte = type / 8;\n\t\tbit = type & 7;\n\t\tif (types_seen_bitmap[byte] & (1 << bit))\n\t\t\treturn 0;\n\t\ttypes_seen_bitmap[byte] |= (1 << bit);\n\t\tif (length < 2)\n\t\t\treturn 0;\n\t\tlen = ((unsigned short) authz[0]) << 8 |\n\t\t      ((unsigned short) authz[1]);\n\t\tauthz += 2;\n\t\tlength -= 2;\n\t\tif (length < len)\n\t\t\treturn 0;\n\t\tauthz += len;\n\t\tlength -= len;\n\t\t}\n\t}', 'void *CRYPTO_realloc(void *str, int num, const char *file, int line)\n\t{\n\tvoid *ret = NULL;\n\tif (str == NULL)\n\t\treturn CRYPTO_malloc(num, file, line);\n\tif (num <= 0) return NULL;\n\tif (realloc_debug_func != NULL)\n\t\trealloc_debug_func(str, NULL, num, file, line, 0);\n\tret = realloc_ex_func(str,num,file,line);\n#ifdef LEVITTE_DEBUG_MEM\n\tfprintf(stderr, "LEVITTE_DEBUG_MEM:         | 0x%p -> 0x%p (%d)\\n", str, ret, num);\n#endif\n\tif (realloc_debug_func != NULL)\n\t\trealloc_debug_func(str, ret, num, file, line, 1);\n\treturn ret;\n\t}', 'void *CRYPTO_malloc(int num, const char *file, int line)\n\t{\n\tvoid *ret = NULL;\n\tif (num <= 0) return NULL;\n\tallow_customize = 0;\n\tif (malloc_debug_func != NULL)\n\t\t{\n\t\tallow_customize_debug = 0;\n\t\tmalloc_debug_func(NULL, num, file, line, 0);\n\t\t}\n\tret = malloc_ex_func(num,file,line);\n#ifdef LEVITTE_DEBUG_MEM\n\tfprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\\n", ret, num);\n#endif\n\tif (malloc_debug_func != NULL)\n\t\tmalloc_debug_func(ret, num, file, line, 1);\n#ifndef OPENSSL_CPUID_OBJ\n        if(ret && (num > 2048))\n\t{\textern unsigned char cleanse_ctr;\n                ((unsigned char *)ret)[0] = cleanse_ctr;\n\t}\n#endif\n\treturn ret;\n\t}']