crypto/x509/x509_vfy.c:410: error: NULL_DEREFERENCE
  pointer `x` last assigned on line 408 could be null and is dereferenced at line 410, column 17.
Showing all 21 steps of the trace


crypto/x509/x509_vfy.c:370:1: start of procedure check_chain_extensions()
368.    */
369.   
370. > static int check_chain_extensions(X509_STORE_CTX *ctx)
371.   {
372.       int i, ok = 0, must_be_ca, plen = 0;

crypto/x509/x509_vfy.c:372:5: 
370.   static int check_chain_extensions(X509_STORE_CTX *ctx)
371.   {
372. >     int i, ok = 0, must_be_ca, plen = 0;
373.       X509 *x;
374.       int proxy_path_length = 0;

crypto/x509/x509_vfy.c:374:5: 
372.       int i, ok = 0, must_be_ca, plen = 0;
373.       X509 *x;
374. >     int proxy_path_length = 0;
375.       int purpose;
376.       int allow_proxy_certs;

crypto/x509/x509_vfy.c:387:5: 
385.        *     all certificates in the chain except the leaf certificate.
386.        */
387. >     must_be_ca = -1;
388.   
389.       /* CRL path validation */

crypto/x509/x509_vfy.c:390:9: Taking false branch
388.   
389.       /* CRL path validation */
390.       if (ctx->parent) {
               ^
391.           allow_proxy_certs = 0;
392.           purpose = X509_PURPOSE_CRL_SIGN;

crypto/x509/x509_vfy.c:395:17: Condition is true
393.       } else {
394.           allow_proxy_certs =
395.               ! !(ctx->param->flags & X509_V_FLAG_ALLOW_PROXY_CERTS);
                       ^
396.           /*
397.            * A hack to keep people who don't want to modify their software

crypto/x509/x509_vfy.c:395:13: 
393.       } else {
394.           allow_proxy_certs =
395. >             ! !(ctx->param->flags & X509_V_FLAG_ALLOW_PROXY_CERTS);
396.           /*
397.            * A hack to keep people who don't want to modify their software

crypto/x509/x509_vfy.c:394:9: 
392.           purpose = X509_PURPOSE_CRL_SIGN;
393.       } else {
394. >         allow_proxy_certs =
395.               ! !(ctx->param->flags & X509_V_FLAG_ALLOW_PROXY_CERTS);
396.           /*

crypto/x509/x509_vfy.c:400:13: Taking false branch
398.            * happy
399.            */
400.           if (getenv("OPENSSL_ALLOW_PROXY_CERTS"))
                   ^
401.               allow_proxy_certs = 1;
402.           purpose = ctx->param->purpose;

crypto/x509/x509_vfy.c:402:9: 
400.           if (getenv("OPENSSL_ALLOW_PROXY_CERTS"))
401.               allow_proxy_certs = 1;
402. >         purpose = ctx->param->purpose;
403.       }
404.   

crypto/x509/x509_vfy.c:406:10: 
404.   
405.       /* Check all untrusted certificates */
406. >     for (i = 0; i == 0 || i < ctx->num_untrusted; i++) {
407.           int ret;
408.           x = sk_X509_value(ctx->chain, i);

crypto/x509/x509_vfy.c:406:17: Loop condition is true. Entering loop body
404.   
405.       /* Check all untrusted certificates */
406.       for (i = 0; i == 0 || i < ctx->num_untrusted; i++) {
                       ^
407.           int ret;
408.           x = sk_X509_value(ctx->chain, i);

crypto/x509/x509_vfy.c:408:9: 
406.       for (i = 0; i == 0 || i < ctx->num_untrusted; i++) {
407.           int ret;
408. >         x = sk_X509_value(ctx->chain, i);
409.           if (!(ctx->param->flags & X509_V_FLAG_IGNORE_CRITICAL)
410.               && (x->ex_flags & EXFLAG_CRITICAL)) {

include/openssl/x509.h:169:1: start of procedure sk_X509_value()
  167.   typedef struct x509_cinf_st X509_CINF;
  168.   
  169. > DEFINE_STACK_OF(X509)
  170.   
  171.   /* This is used for a table of trust checking functions */

crypto/stack/stack.c:323:1: start of procedure sk_value()
    321.   }
    322.   
    323. > void *sk_value(const _STACK *st, int i)
    324.   {
    325.       if (!st || (i < 0) || (i >= st->num))

crypto/stack/stack.c:325:10: Taking true branch
    323.   void *sk_value(const _STACK *st, int i)
    324.   {
    325.       if (!st || (i < 0) || (i >= st->num))
                    ^
    326.           return NULL;
    327.       return st->data[i];

crypto/stack/stack.c:326:9: 
    324.   {
    325.       if (!st || (i < 0) || (i >= st->num))
    326. >         return NULL;
    327.       return st->data[i];
    328.   }

crypto/stack/stack.c:328:1: return from a call to sk_value
    326.           return NULL;
    327.       return st->data[i];
    328. > }
    329.   
    330.   void *sk_set(_STACK *st, int i, void *value)

include/openssl/x509.h:169:1: return from a call to sk_X509_value
  167.   typedef struct x509_cinf_st X509_CINF;
  168.   
  169. > DEFINE_STACK_OF(X509)
  170.   
  171.   /* This is used for a table of trust checking functions */

crypto/x509/x509_vfy.c:409:15: Taking true branch
407.           int ret;
408.           x = sk_X509_value(ctx->chain, i);
409.           if (!(ctx->param->flags & X509_V_FLAG_IGNORE_CRITICAL)
                     ^
410.               && (x->ex_flags & EXFLAG_CRITICAL)) {
411.               ctx->error = X509_V_ERR_UNHANDLED_CRITICAL_EXTENSION;

crypto/x509/x509_vfy.c:410:17: 
408.           x = sk_X509_value(ctx->chain, i);
409.           if (!(ctx->param->flags & X509_V_FLAG_IGNORE_CRITICAL)
410. >             && (x->ex_flags & EXFLAG_CRITICAL)) {
411.               ctx->error = X509_V_ERR_UNHANDLED_CRITICAL_EXTENSION;
412.               ctx->error_depth = i;

static int check_chain_extensions(X509_STORE_CTX *ctx)
{
    int i, ok = 0, must_be_ca, plen = 0;
    X509 *x;
    int proxy_path_length = 0;
    int purpose;
    int allow_proxy_certs;
    must_be_ca = -1;
    if (ctx->parent) {
        allow_proxy_certs = 0;
        purpose = X509_PURPOSE_CRL_SIGN;
    } else {
        allow_proxy_certs =
            ! !(ctx->param->flags & X509_V_FLAG_ALLOW_PROXY_CERTS);
        if (getenv("OPENSSL_ALLOW_PROXY_CERTS"))
            allow_proxy_certs = 1;
        purpose = ctx->param->purpose;
    }
    for (i = 0; i == 0 || i < ctx->num_untrusted; i++) {
        int ret;
        x = sk_X509_value(ctx->chain, i);
        if (!(ctx->param->flags & X509_V_FLAG_IGNORE_CRITICAL)
            && (x->ex_flags & EXFLAG_CRITICAL)) {
            ctx->error = X509_V_ERR_UNHANDLED_CRITICAL_EXTENSION;
            ctx->error_depth = i;
            ctx->current_cert = x;
            ok = ctx->verify_cb(0, ctx);
            if (!ok)
                goto end;
        }
        if (!allow_proxy_certs && (x->ex_flags & EXFLAG_PROXY)) {
            ctx->error = X509_V_ERR_PROXY_CERTIFICATES_NOT_ALLOWED;
            ctx->error_depth = i;
            ctx->current_cert = x;
            ok = ctx->verify_cb(0, ctx);
            if (!ok)
                goto end;
        }
        ret = X509_check_ca(x);
        switch (must_be_ca) {
        case -1:
            if ((ctx->param->flags & X509_V_FLAG_X509_STRICT)
                && (ret != 1) && (ret != 0)) {
                ret = 0;
                ctx->error = X509_V_ERR_INVALID_CA;
            } else
                ret = 1;
            break;
        case 0:
            if (ret != 0) {
                ret = 0;
                ctx->error = X509_V_ERR_INVALID_NON_CA;
            } else
                ret = 1;
            break;
        default:
            if ((ret == 0)
                || ((ctx->param->flags & X509_V_FLAG_X509_STRICT)
                    && (ret != 1))) {
                ret = 0;
                ctx->error = X509_V_ERR_INVALID_CA;
            } else
                ret = 1;
            break;
        }
        if (ret == 0) {
            ctx->error_depth = i;
            ctx->current_cert = x;
            ok = ctx->verify_cb(0, ctx);
            if (!ok)
                goto end;
        }
        if (ctx->param->purpose > 0) {
            ret = X509_check_purpose(x, purpose, must_be_ca > 0);
            if ((ret == 0)
                || ((ctx->param->flags & X509_V_FLAG_X509_STRICT)
                    && (ret != 1))) {
                ctx->error = X509_V_ERR_INVALID_PURPOSE;
                ctx->error_depth = i;
                ctx->current_cert = x;
                ok = ctx->verify_cb(0, ctx);
                if (!ok)
                    goto end;
            }
        }
        if ((i > 1) && !(x->ex_flags & EXFLAG_SI)
            && (x->ex_pathlen != -1)
            && (plen > (x->ex_pathlen + proxy_path_length + 1))) {
            ctx->error = X509_V_ERR_PATH_LENGTH_EXCEEDED;
            ctx->error_depth = i;
            ctx->current_cert = x;
            ok = ctx->verify_cb(0, ctx);
            if (!ok)
                goto end;
        }
        if (!(x->ex_flags & EXFLAG_SI))
            plen++;
        if (x->ex_flags & EXFLAG_PROXY) {
            if (x->ex_pcpathlen != -1 && i > x->ex_pcpathlen) {
                ctx->error = X509_V_ERR_PROXY_PATH_LENGTH_EXCEEDED;
                ctx->error_depth = i;
                ctx->current_cert = x;
                ok = ctx->verify_cb(0, ctx);
                if (!ok)
                    goto end;
            }
            proxy_path_length++;
            must_be_ca = 0;
        } else
            must_be_ca = 1;
    }
    ok = 1;
 end:
    return ok;
}
['static int check_chain_extensions(X509_STORE_CTX *ctx)\n{\n    int i, ok = 0, must_be_ca, plen = 0;\n    X509 *x;\n    int proxy_path_length = 0;\n    int purpose;\n    int allow_proxy_certs;\n    must_be_ca = -1;\n    if (ctx->parent) {\n        allow_proxy_certs = 0;\n        purpose = X509_PURPOSE_CRL_SIGN;\n    } else {\n        allow_proxy_certs =\n            ! !(ctx->param->flags & X509_V_FLAG_ALLOW_PROXY_CERTS);\n        if (getenv("OPENSSL_ALLOW_PROXY_CERTS"))\n            allow_proxy_certs = 1;\n        purpose = ctx->param->purpose;\n    }\n    for (i = 0; i == 0 || i < ctx->num_untrusted; i++) {\n        int ret;\n        x = sk_X509_value(ctx->chain, i);\n        if (!(ctx->param->flags & X509_V_FLAG_IGNORE_CRITICAL)\n            && (x->ex_flags & EXFLAG_CRITICAL)) {\n            ctx->error = X509_V_ERR_UNHANDLED_CRITICAL_EXTENSION;\n            ctx->error_depth = i;\n            ctx->current_cert = x;\n            ok = ctx->verify_cb(0, ctx);\n            if (!ok)\n                goto end;\n        }\n        if (!allow_proxy_certs && (x->ex_flags & EXFLAG_PROXY)) {\n            ctx->error = X509_V_ERR_PROXY_CERTIFICATES_NOT_ALLOWED;\n            ctx->error_depth = i;\n            ctx->current_cert = x;\n            ok = ctx->verify_cb(0, ctx);\n            if (!ok)\n                goto end;\n        }\n        ret = X509_check_ca(x);\n        switch (must_be_ca) {\n        case -1:\n            if ((ctx->param->flags & X509_V_FLAG_X509_STRICT)\n                && (ret != 1) && (ret != 0)) {\n                ret = 0;\n                ctx->error = X509_V_ERR_INVALID_CA;\n            } else\n                ret = 1;\n            break;\n        case 0:\n            if (ret != 0) {\n                ret = 0;\n                ctx->error = X509_V_ERR_INVALID_NON_CA;\n            } else\n                ret = 1;\n            break;\n        default:\n            if ((ret == 0)\n                || ((ctx->param->flags & X509_V_FLAG_X509_STRICT)\n                    && (ret != 1))) {\n                ret = 0;\n                ctx->error = X509_V_ERR_INVALID_CA;\n            } else\n                ret = 1;\n            break;\n        }\n        if (ret == 0) {\n            ctx->error_depth = i;\n            ctx->current_cert = x;\n            ok = ctx->verify_cb(0, ctx);\n            if (!ok)\n                goto end;\n        }\n        if (ctx->param->purpose > 0) {\n            ret = X509_check_purpose(x, purpose, must_be_ca > 0);\n            if ((ret == 0)\n                || ((ctx->param->flags & X509_V_FLAG_X509_STRICT)\n                    && (ret != 1))) {\n                ctx->error = X509_V_ERR_INVALID_PURPOSE;\n                ctx->error_depth = i;\n                ctx->current_cert = x;\n                ok = ctx->verify_cb(0, ctx);\n                if (!ok)\n                    goto end;\n            }\n        }\n        if ((i > 1) && !(x->ex_flags & EXFLAG_SI)\n            && (x->ex_pathlen != -1)\n            && (plen > (x->ex_pathlen + proxy_path_length + 1))) {\n            ctx->error = X509_V_ERR_PATH_LENGTH_EXCEEDED;\n            ctx->error_depth = i;\n            ctx->current_cert = x;\n            ok = ctx->verify_cb(0, ctx);\n            if (!ok)\n                goto end;\n        }\n        if (!(x->ex_flags & EXFLAG_SI))\n            plen++;\n        if (x->ex_flags & EXFLAG_PROXY) {\n            if (x->ex_pcpathlen != -1 && i > x->ex_pcpathlen) {\n                ctx->error = X509_V_ERR_PROXY_PATH_LENGTH_EXCEEDED;\n                ctx->error_depth = i;\n                ctx->current_cert = x;\n                ok = ctx->verify_cb(0, ctx);\n                if (!ok)\n                    goto end;\n            }\n            proxy_path_length++;\n            must_be_ca = 0;\n        } else\n            must_be_ca = 1;\n    }\n    ok = 1;\n end:\n    return ok;\n}', 'DEFINE_STACK_OF(X509)', 'void *sk_value(const _STACK *st, int i)\n{\n    if (!st || (i < 0) || (i >= st->num))\n        return NULL;\n    return st->data[i];\n}']