crypto/x509/x509_vfy.c:715: error: NULL_DEREFERENCE
  pointer `x` last assigned on line 704 could be null and is dereferenced by call to `get_crl_delta()` at line 715, column 18.
Showing all 22 steps of the trace


crypto/x509/x509_vfy.c:697:1: start of procedure check_cert()
695.   }
696.   
697. > static int check_cert(X509_STORE_CTX *ctx)
698.   {
699.       X509_CRL *crl = NULL, *dcrl = NULL;

crypto/x509/x509_vfy.c:699:5: 
697.   static int check_cert(X509_STORE_CTX *ctx)
698.   {
699. >     X509_CRL *crl = NULL, *dcrl = NULL;
700.       X509 *x = NULL;
701.       int ok = 0, cnum = 0;

crypto/x509/x509_vfy.c:700:5: 
698.   {
699.       X509_CRL *crl = NULL, *dcrl = NULL;
700. >     X509 *x = NULL;
701.       int ok = 0, cnum = 0;
702.       unsigned int last_reasons = 0;

crypto/x509/x509_vfy.c:701:5: 
699.       X509_CRL *crl = NULL, *dcrl = NULL;
700.       X509 *x = NULL;
701. >     int ok = 0, cnum = 0;
702.       unsigned int last_reasons = 0;
703.       cnum = ctx->error_depth;

crypto/x509/x509_vfy.c:702:5: 
700.       X509 *x = NULL;
701.       int ok = 0, cnum = 0;
702. >     unsigned int last_reasons = 0;
703.       cnum = ctx->error_depth;
704.       x = sk_X509_value(ctx->chain, cnum);

crypto/x509/x509_vfy.c:703:5: 
701.       int ok = 0, cnum = 0;
702.       unsigned int last_reasons = 0;
703. >     cnum = ctx->error_depth;
704.       x = sk_X509_value(ctx->chain, cnum);
705.       ctx->current_cert = x;

crypto/x509/x509_vfy.c:704:5: 
702.       unsigned int last_reasons = 0;
703.       cnum = ctx->error_depth;
704. >     x = sk_X509_value(ctx->chain, cnum);
705.       ctx->current_cert = x;
706.       ctx->current_issuer = NULL;

include/openssl/x509.h:170:1: start of procedure sk_X509_value()
  168.   typedef struct x509_cinf_st X509_CINF;
  169.   
  170. > DEFINE_STACK_OF(X509)
  171.   
  172.   /* This is used for a table of trust checking functions */

crypto/stack/stack.c:324:1: start of procedure sk_value()
    322.   }
    323.   
    324. > void *sk_value(const _STACK *st, int i)
    325.   {
    326.       if (!st || (i < 0) || (i >= st->num))

crypto/stack/stack.c:326:10: Taking false branch
    324.   void *sk_value(const _STACK *st, int i)
    325.   {
    326.       if (!st || (i < 0) || (i >= st->num))
                    ^
    327.           return NULL;
    328.       return st->data[i];

crypto/stack/stack.c:326:17: Taking true branch
    324.   void *sk_value(const _STACK *st, int i)
    325.   {
    326.       if (!st || (i < 0) || (i >= st->num))
                           ^
    327.           return NULL;
    328.       return st->data[i];

crypto/stack/stack.c:327:9: 
    325.   {
    326.       if (!st || (i < 0) || (i >= st->num))
    327. >         return NULL;
    328.       return st->data[i];
    329.   }

crypto/stack/stack.c:329:1: return from a call to sk_value
    327.           return NULL;
    328.       return st->data[i];
    329. > }
    330.   
    331.   void *sk_set(_STACK *st, int i, void *value)

include/openssl/x509.h:170:1: return from a call to sk_X509_value
  168.   typedef struct x509_cinf_st X509_CINF;
  169.   
  170. > DEFINE_STACK_OF(X509)
  171.   
  172.   /* This is used for a table of trust checking functions */

crypto/x509/x509_vfy.c:705:5: 
703.       cnum = ctx->error_depth;
704.       x = sk_X509_value(ctx->chain, cnum);
705. >     ctx->current_cert = x;
706.       ctx->current_issuer = NULL;
707.       ctx->current_crl_score = 0;

crypto/x509/x509_vfy.c:706:5: 
704.       x = sk_X509_value(ctx->chain, cnum);
705.       ctx->current_cert = x;
706. >     ctx->current_issuer = NULL;
707.       ctx->current_crl_score = 0;
708.       ctx->current_reasons = 0;

crypto/x509/x509_vfy.c:707:5: 
705.       ctx->current_cert = x;
706.       ctx->current_issuer = NULL;
707. >     ctx->current_crl_score = 0;
708.       ctx->current_reasons = 0;
709.       while (ctx->current_reasons != CRLDP_ALL_REASONS) {

crypto/x509/x509_vfy.c:708:5: 
706.       ctx->current_issuer = NULL;
707.       ctx->current_crl_score = 0;
708. >     ctx->current_reasons = 0;
709.       while (ctx->current_reasons != CRLDP_ALL_REASONS) {
710.           last_reasons = ctx->current_reasons;

crypto/x509/x509_vfy.c:709:12: Loop condition is true. Entering loop body
707.       ctx->current_crl_score = 0;
708.       ctx->current_reasons = 0;
709.       while (ctx->current_reasons != CRLDP_ALL_REASONS) {
                  ^
710.           last_reasons = ctx->current_reasons;
711.           /* Try to retrieve relevant CRL */

crypto/x509/x509_vfy.c:710:9: 
708.       ctx->current_reasons = 0;
709.       while (ctx->current_reasons != CRLDP_ALL_REASONS) {
710. >         last_reasons = ctx->current_reasons;
711.           /* Try to retrieve relevant CRL */
712.           if (ctx->get_crl)

crypto/x509/x509_vfy.c:712:13: Taking false branch
710.           last_reasons = ctx->current_reasons;
711.           /* Try to retrieve relevant CRL */
712.           if (ctx->get_crl)
                   ^
713.               ok = ctx->get_crl(ctx, &crl, x);
714.           else

crypto/x509/x509_vfy.c:715:13: 
713.               ok = ctx->get_crl(ctx, &crl, x);
714.           else
715. >             ok = get_crl_delta(ctx, &crl, &dcrl, x);
716.           /*
717.            * If error looking up CRL, nothing we can do except notify callback

static int check_cert(X509_STORE_CTX *ctx)
{
    X509_CRL *crl = NULL, *dcrl = NULL;
    X509 *x = NULL;
    int ok = 0, cnum = 0;
    unsigned int last_reasons = 0;
    cnum = ctx->error_depth;
    x = sk_X509_value(ctx->chain, cnum);
    ctx->current_cert = x;
    ctx->current_issuer = NULL;
    ctx->current_crl_score = 0;
    ctx->current_reasons = 0;
    while (ctx->current_reasons != CRLDP_ALL_REASONS) {
        last_reasons = ctx->current_reasons;
        if (ctx->get_crl)
            ok = ctx->get_crl(ctx, &crl, x);
        else
            ok = get_crl_delta(ctx, &crl, &dcrl, x);
        if (!ok) {
            ctx->error = X509_V_ERR_UNABLE_TO_GET_CRL;
            ok = ctx->verify_cb(0, ctx);
            goto err;
        }
        ctx->current_crl = crl;
        ok = ctx->check_crl(ctx, crl);
        if (!ok)
            goto err;
        if (dcrl) {
            ok = ctx->check_crl(ctx, dcrl);
            if (!ok)
                goto err;
            ok = ctx->cert_crl(ctx, dcrl, x);
            if (!ok)
                goto err;
        } else
            ok = 1;
        if (ok != 2) {
            ok = ctx->cert_crl(ctx, crl, x);
            if (!ok)
                goto err;
        }
        X509_CRL_free(crl);
        X509_CRL_free(dcrl);
        crl = NULL;
        dcrl = NULL;
        if (last_reasons == ctx->current_reasons) {
            ctx->error = X509_V_ERR_UNABLE_TO_GET_CRL;
            ok = ctx->verify_cb(0, ctx);
            goto err;
        }
    }
 err:
    X509_CRL_free(crl);
    X509_CRL_free(dcrl);
    ctx->current_crl = NULL;
    return ok;
}
['static int check_cert(X509_STORE_CTX *ctx)\n{\n    X509_CRL *crl = NULL, *dcrl = NULL;\n    X509 *x = NULL;\n    int ok = 0, cnum = 0;\n    unsigned int last_reasons = 0;\n    cnum = ctx->error_depth;\n    x = sk_X509_value(ctx->chain, cnum);\n    ctx->current_cert = x;\n    ctx->current_issuer = NULL;\n    ctx->current_crl_score = 0;\n    ctx->current_reasons = 0;\n    while (ctx->current_reasons != CRLDP_ALL_REASONS) {\n        last_reasons = ctx->current_reasons;\n        if (ctx->get_crl)\n            ok = ctx->get_crl(ctx, &crl, x);\n        else\n            ok = get_crl_delta(ctx, &crl, &dcrl, x);\n        if (!ok) {\n            ctx->error = X509_V_ERR_UNABLE_TO_GET_CRL;\n            ok = ctx->verify_cb(0, ctx);\n            goto err;\n        }\n        ctx->current_crl = crl;\n        ok = ctx->check_crl(ctx, crl);\n        if (!ok)\n            goto err;\n        if (dcrl) {\n            ok = ctx->check_crl(ctx, dcrl);\n            if (!ok)\n                goto err;\n            ok = ctx->cert_crl(ctx, dcrl, x);\n            if (!ok)\n                goto err;\n        } else\n            ok = 1;\n        if (ok != 2) {\n            ok = ctx->cert_crl(ctx, crl, x);\n            if (!ok)\n                goto err;\n        }\n        X509_CRL_free(crl);\n        X509_CRL_free(dcrl);\n        crl = NULL;\n        dcrl = NULL;\n        if (last_reasons == ctx->current_reasons) {\n            ctx->error = X509_V_ERR_UNABLE_TO_GET_CRL;\n            ok = ctx->verify_cb(0, ctx);\n            goto err;\n        }\n    }\n err:\n    X509_CRL_free(crl);\n    X509_CRL_free(dcrl);\n    ctx->current_crl = NULL;\n    return ok;\n}', 'DEFINE_STACK_OF(X509)', 'void *sk_value(const _STACK *st, int i)\n{\n    if (!st || (i < 0) || (i >= st->num))\n        return NULL;\n    return st->data[i];\n}']