crypto/x509v3/pcy_tree.c:169: error: NULL_DEREFERENCE
  pointer `tree->levels` last assigned on line 157 could be null and is dereferenced by call to `memset()` at line 169, column 2.
Showing all 45 steps of the trace


crypto/x509v3/pcy_tree.c:74:1: start of procedure tree_init()
72.    */
73.   
74. > static int tree_init(X509_POLICY_TREE **ptree, STACK_OF(X509) *certs,
75.   			unsigned int flags)
76.   	{

crypto/x509v3/pcy_tree.c:80:2: 
78.   	X509_POLICY_LEVEL *level;
79.   	const X509_POLICY_CACHE *cache;
80. > 	X509_POLICY_DATA *data = NULL;
81.   	X509 *x;
82.   	int ret = 1;

crypto/x509v3/pcy_tree.c:82:2: 
80.   	X509_POLICY_DATA *data = NULL;
81.   	X509 *x;
82. > 	int ret = 1;
83.   	int i, n;
84.   	int explicit_policy;

crypto/x509v3/pcy_tree.c:87:2: 
85.   	int any_skip;
86.   	int map_skip;
87. > 	*ptree = NULL;
88.   	n = sk_X509_num(certs);
89.   

crypto/x509v3/pcy_tree.c:88:2: 
86.   	int map_skip;
87.   	*ptree = NULL;
88. > 	n = sk_X509_num(certs);
89.   
90.   	/* Disable policy mapping for now... */

crypto/x509/x509.h:304:1: start of procedure sk_X509_num()
  302.   	} /* X509 */;
  303.   
  304. > DECLARE_STACK_OF(X509)
  305.   DECLARE_ASN1_SET_OF(X509)
  306.   

crypto/x509/x509.h:304:1: Condition is false
  302.   	} /* X509 */;
  303.   
  304. > DECLARE_STACK_OF(X509)
  305.   DECLARE_ASN1_SET_OF(X509)
  306.   

crypto/x509/x509.h:304:1: return from a call to sk_X509_num
  302.   	} /* X509 */;
  303.   
  304. > DECLARE_STACK_OF(X509)
  305.   DECLARE_ASN1_SET_OF(X509)
  306.   

crypto/x509v3/pcy_tree.c:91:2: 
89.   
90.   	/* Disable policy mapping for now... */
91. > 	flags |= X509_V_FLAG_INHIBIT_MAP;
92.   
93.   	if (flags & X509_V_FLAG_EXPLICIT_POLICY)

crypto/x509v3/pcy_tree.c:93:6: Taking true branch
91.   	flags |= X509_V_FLAG_INHIBIT_MAP;
92.   
93.   	if (flags & X509_V_FLAG_EXPLICIT_POLICY)
           ^
94.   		explicit_policy = 0;
95.   	else

crypto/x509v3/pcy_tree.c:94:3: 
92.   
93.   	if (flags & X509_V_FLAG_EXPLICIT_POLICY)
94. > 		explicit_policy = 0;
95.   	else
96.   		explicit_policy = n + 1;

crypto/x509v3/pcy_tree.c:98:6: Taking true branch
96.   		explicit_policy = n + 1;
97.   
98.   	if (flags & X509_V_FLAG_INHIBIT_ANY)
            ^
99.   		any_skip = 0;
100.   	else

crypto/x509v3/pcy_tree.c:99:3: 
97.   
98.   	if (flags & X509_V_FLAG_INHIBIT_ANY)
99. > 		any_skip = 0;
100.   	else
101.   		any_skip = n + 1;

crypto/x509v3/pcy_tree.c:103:6: Taking true branch
101.   		any_skip = n + 1;
102.   
103.   	if (flags & X509_V_FLAG_INHIBIT_MAP)
            ^
104.   		map_skip = 0;
105.   	else

crypto/x509v3/pcy_tree.c:104:3: 
102.   
103.   	if (flags & X509_V_FLAG_INHIBIT_MAP)
104. > 		map_skip = 0;
105.   	else
106.   		map_skip = n + 1;

crypto/x509v3/pcy_tree.c:109:6: Taking false branch
107.   
108.   	/* Can't do anything with just a trust anchor */
109.   	if (n == 1)
            ^
110.   		return 1;
111.   	/* First setup policy cache in all certificates apart from the

crypto/x509v3/pcy_tree.c:115:7: 
113.   	 * calculate explicit_policy value at this point.
114.   	 */
115. > 	for (i = n - 2; i >= 0; i--)
116.   		{
117.   		x = sk_X509_value(certs, i);

crypto/x509v3/pcy_tree.c:115:18: Loop condition is false. Leaving loop
113.   	 * calculate explicit_policy value at this point.
114.   	 */
115.   	for (i = n - 2; i >= 0; i--)
                        ^
116.   		{
117.   		x = sk_X509_value(certs, i);

crypto/x509v3/pcy_tree.c:141:6: Taking false branch
139.   		}
140.   
141.   	if (ret != 1)
            ^
142.   		{
143.   		if (ret == 2 && !explicit_policy)

crypto/x509v3/pcy_tree.c:151:2: 
149.   	/* If we get this far initialize the tree */
150.   
151. > 	tree = OPENSSL_malloc(sizeof(X509_POLICY_TREE));
152.   
153.   	if (!tree)

crypto/mem.c:294:1: start of procedure CRYPTO_malloc()
  292.   	}
  293.   
  294. > void *CRYPTO_malloc(int num, const char *file, int line)
  295.   	{
  296.   	void *ret = NULL;

crypto/mem.c:296:2: 
  294.   void *CRYPTO_malloc(int num, const char *file, int line)
  295.   	{
  296. > 	void *ret = NULL;
  297.   
  298.   	if (num <= 0) return NULL;

crypto/mem.c:298:6: Taking false branch
  296.   	void *ret = NULL;
  297.   
  298.   	if (num <= 0) return NULL;
              ^
  299.   
  300.   	allow_customize = 0;

crypto/mem.c:300:2: 
  298.   	if (num <= 0) return NULL;
  299.   
  300. > 	allow_customize = 0;
  301.   	if (malloc_debug_func != NULL)
  302.   		{

crypto/mem.c:301:6: Taking false branch
  299.   
  300.   	allow_customize = 0;
  301.   	if (malloc_debug_func != NULL)
              ^
  302.   		{
  303.   		allow_customize_debug = 0;

crypto/mem.c:306:2: Skipping __function_pointer__(): unresolved function pointer
  304.   		malloc_debug_func(NULL, num, file, line, 0);
  305.   		}
  306.   	ret = malloc_ex_func(num,file,line);
          ^
  307.   #ifdef LEVITTE_DEBUG_MEM
  308.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);

crypto/mem.c:310:6: Taking false branch
  308.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);
  309.   #endif
  310.   	if (malloc_debug_func != NULL)
              ^
  311.   		malloc_debug_func(ret, num, file, line, 1);
  312.   

crypto/mem.c:317:12: Taking true branch
  315.            * sanitisation function can't be optimised out. NB: We only do
  316.            * this for >2Kb so the overhead doesn't bother us. */
  317.           if(ret && (num > 2048))
                    ^
  318.   	{	extern unsigned char cleanse_ctr;
  319.                   ((unsigned char *)ret)[0] = cleanse_ctr;

crypto/mem.c:317:20: Taking false branch
  315.            * sanitisation function can't be optimised out. NB: We only do
  316.            * this for >2Kb so the overhead doesn't bother us. */
  317.           if(ret && (num > 2048))
                            ^
  318.   	{	extern unsigned char cleanse_ctr;
  319.                   ((unsigned char *)ret)[0] = cleanse_ctr;

crypto/mem.c:323:2: 
  321.   #endif
  322.   
  323. > 	return ret;
  324.   	}
  325.   

crypto/mem.c:324:2: return from a call to CRYPTO_malloc
  322.   
  323.   	return ret;
  324.   	}
          ^
  325.   
  326.   void *CRYPTO_realloc(void *str, int num, const char *file, int line)

crypto/x509v3/pcy_tree.c:153:7: Taking false branch
151.   	tree = OPENSSL_malloc(sizeof(X509_POLICY_TREE));
152.   
153.   	if (!tree)
             ^
154.   		return 0;
155.   

crypto/x509v3/pcy_tree.c:156:2: 
154.   		return 0;
155.   
156. > 	tree->flags = 0;
157.   	tree->levels = OPENSSL_malloc(sizeof(X509_POLICY_LEVEL) * n);
158.   	tree->nlevel = 0;

crypto/x509v3/pcy_tree.c:157:2: 
155.   
156.   	tree->flags = 0;
157. > 	tree->levels = OPENSSL_malloc(sizeof(X509_POLICY_LEVEL) * n);
158.   	tree->nlevel = 0;
159.   	tree->extra_data = NULL;

crypto/mem.c:294:1: start of procedure CRYPTO_malloc()
  292.   	}
  293.   
  294. > void *CRYPTO_malloc(int num, const char *file, int line)
  295.   	{
  296.   	void *ret = NULL;

crypto/mem.c:296:2: 
  294.   void *CRYPTO_malloc(int num, const char *file, int line)
  295.   	{
  296. > 	void *ret = NULL;
  297.   
  298.   	if (num <= 0) return NULL;

crypto/mem.c:298:6: Taking true branch
  296.   	void *ret = NULL;
  297.   
  298.   	if (num <= 0) return NULL;
              ^
  299.   
  300.   	allow_customize = 0;

crypto/mem.c:298:16: 
  296.   	void *ret = NULL;
  297.   
  298. > 	if (num <= 0) return NULL;
  299.   
  300.   	allow_customize = 0;

crypto/mem.c:324:2: return from a call to CRYPTO_malloc
  322.   
  323.   	return ret;
  324.   	}
          ^
  325.   
  326.   void *CRYPTO_realloc(void *str, int num, const char *file, int line)

crypto/x509v3/pcy_tree.c:158:2: 
156.   	tree->flags = 0;
157.   	tree->levels = OPENSSL_malloc(sizeof(X509_POLICY_LEVEL) * n);
158. > 	tree->nlevel = 0;
159.   	tree->extra_data = NULL;
160.   	tree->auth_policies = NULL;

crypto/x509v3/pcy_tree.c:159:2: 
157.   	tree->levels = OPENSSL_malloc(sizeof(X509_POLICY_LEVEL) * n);
158.   	tree->nlevel = 0;
159. > 	tree->extra_data = NULL;
160.   	tree->auth_policies = NULL;
161.   	tree->user_policies = NULL;

crypto/x509v3/pcy_tree.c:160:2: 
158.   	tree->nlevel = 0;
159.   	tree->extra_data = NULL;
160. > 	tree->auth_policies = NULL;
161.   	tree->user_policies = NULL;
162.   

crypto/x509v3/pcy_tree.c:161:2: 
159.   	tree->extra_data = NULL;
160.   	tree->auth_policies = NULL;
161. > 	tree->user_policies = NULL;
162.   
163.   	if (!tree)

crypto/x509v3/pcy_tree.c:163:7: Taking false branch
161.   	tree->user_policies = NULL;
162.   
163.   	if (!tree)
             ^
164.   		{
165.   		OPENSSL_free(tree);

crypto/x509v3/pcy_tree.c:169:2: 
167.   		}
168.   
169. > 	memset(tree->levels, 0, n * sizeof(X509_POLICY_LEVEL));
170.   
171.   	tree->nlevel = n;

static int tree_init(X509_POLICY_TREE **ptree, STACK_OF(X509) *certs,
			unsigned int flags)
	{
	X509_POLICY_TREE *tree;
	X509_POLICY_LEVEL *level;
	const X509_POLICY_CACHE *cache;
	X509_POLICY_DATA *data = NULL;
	X509 *x;
	int ret = 1;
	int i, n;
	int explicit_policy;
	int any_skip;
	int map_skip;
	*ptree = NULL;
	n = sk_X509_num(certs);
	flags |= X509_V_FLAG_INHIBIT_MAP;
	if (flags & X509_V_FLAG_EXPLICIT_POLICY)
		explicit_policy = 0;
	else
		explicit_policy = n + 1;
	if (flags & X509_V_FLAG_INHIBIT_ANY)
		any_skip = 0;
	else
		any_skip = n + 1;
	if (flags & X509_V_FLAG_INHIBIT_MAP)
		map_skip = 0;
	else
		map_skip = n + 1;
	if (n == 1)
		return 1;
	for (i = n - 2; i >= 0; i--)
		{
		x = sk_X509_value(certs, i);
		X509_check_purpose(x, -1, -1);
		cache = policy_cache_set(x);
		if (cache == NULL)
			return 0;
		if (x->ex_flags & EXFLAG_INVALID_POLICY)
			ret = -1;
		else if ((ret == 1) && !cache->data)
			ret = 2;
		if (explicit_policy > 0)
			{
			explicit_policy--;
			if (!(x->ex_flags & EXFLAG_SS)
				&& (cache->explicit_skip != -1)
				&& (cache->explicit_skip < explicit_policy))
				explicit_policy = cache->explicit_skip;
			}
		}
	if (ret != 1)
		{
		if (ret == 2 && !explicit_policy)
			return 6;
		return ret;
		}
	tree = OPENSSL_malloc(sizeof(X509_POLICY_TREE));
	if (!tree)
		return 0;
	tree->flags = 0;
	tree->levels = OPENSSL_malloc(sizeof(X509_POLICY_LEVEL) * n);
	tree->nlevel = 0;
	tree->extra_data = NULL;
	tree->auth_policies = NULL;
	tree->user_policies = NULL;
	if (!tree)
		{
		OPENSSL_free(tree);
		return 0;
		}
	memset(tree->levels, 0, n * sizeof(X509_POLICY_LEVEL));
	tree->nlevel = n;
	level = tree->levels;
	data = policy_data_new(NULL, OBJ_nid2obj(NID_any_policy), 0);
	if (!data || !level_add_node(level, data, NULL, tree))
		goto bad_tree;
	for (i = n - 2; i >= 0; i--)
		{
		level++;
		x = sk_X509_value(certs, i);
		cache = policy_cache_set(x);
		CRYPTO_add(&x->references, 1, CRYPTO_LOCK_X509);
		level->cert = x;
		if (!cache->anyPolicy)
				level->flags |= X509_V_FLAG_INHIBIT_ANY;
		if (any_skip == 0)
			{
			if (!(x->ex_flags & EXFLAG_SS) || (i == 0))
				level->flags |= X509_V_FLAG_INHIBIT_ANY;
			}
		else
			{
			any_skip--;
			if ((cache->any_skip > 0)
				&& (cache->any_skip < any_skip))
				any_skip = cache->any_skip;
			}
		if (map_skip == 0)
			level->flags |= X509_V_FLAG_INHIBIT_MAP;
		else
			{
			map_skip--;
			if ((cache->map_skip > 0)
				&& (cache->map_skip < map_skip))
				map_skip = cache->map_skip;
			}
		}
	*ptree = tree;
	if (explicit_policy)
		return 1;
	else
		return 5;
	bad_tree:
	X509_policy_tree_free(tree);
	return 0;
	}
['static int tree_init(X509_POLICY_TREE **ptree, STACK_OF(X509) *certs,\n\t\t\tunsigned int flags)\n\t{\n\tX509_POLICY_TREE *tree;\n\tX509_POLICY_LEVEL *level;\n\tconst X509_POLICY_CACHE *cache;\n\tX509_POLICY_DATA *data = NULL;\n\tX509 *x;\n\tint ret = 1;\n\tint i, n;\n\tint explicit_policy;\n\tint any_skip;\n\tint map_skip;\n\t*ptree = NULL;\n\tn = sk_X509_num(certs);\n\tflags |= X509_V_FLAG_INHIBIT_MAP;\n\tif (flags & X509_V_FLAG_EXPLICIT_POLICY)\n\t\texplicit_policy = 0;\n\telse\n\t\texplicit_policy = n + 1;\n\tif (flags & X509_V_FLAG_INHIBIT_ANY)\n\t\tany_skip = 0;\n\telse\n\t\tany_skip = n + 1;\n\tif (flags & X509_V_FLAG_INHIBIT_MAP)\n\t\tmap_skip = 0;\n\telse\n\t\tmap_skip = n + 1;\n\tif (n == 1)\n\t\treturn 1;\n\tfor (i = n - 2; i >= 0; i--)\n\t\t{\n\t\tx = sk_X509_value(certs, i);\n\t\tX509_check_purpose(x, -1, -1);\n\t\tcache = policy_cache_set(x);\n\t\tif (cache == NULL)\n\t\t\treturn 0;\n\t\tif (x->ex_flags & EXFLAG_INVALID_POLICY)\n\t\t\tret = -1;\n\t\telse if ((ret == 1) && !cache->data)\n\t\t\tret = 2;\n\t\tif (explicit_policy > 0)\n\t\t\t{\n\t\t\texplicit_policy--;\n\t\t\tif (!(x->ex_flags & EXFLAG_SS)\n\t\t\t\t&& (cache->explicit_skip != -1)\n\t\t\t\t&& (cache->explicit_skip < explicit_policy))\n\t\t\t\texplicit_policy = cache->explicit_skip;\n\t\t\t}\n\t\t}\n\tif (ret != 1)\n\t\t{\n\t\tif (ret == 2 && !explicit_policy)\n\t\t\treturn 6;\n\t\treturn ret;\n\t\t}\n\ttree = OPENSSL_malloc(sizeof(X509_POLICY_TREE));\n\tif (!tree)\n\t\treturn 0;\n\ttree->flags = 0;\n\ttree->levels = OPENSSL_malloc(sizeof(X509_POLICY_LEVEL) * n);\n\ttree->nlevel = 0;\n\ttree->extra_data = NULL;\n\ttree->auth_policies = NULL;\n\ttree->user_policies = NULL;\n\tif (!tree)\n\t\t{\n\t\tOPENSSL_free(tree);\n\t\treturn 0;\n\t\t}\n\tmemset(tree->levels, 0, n * sizeof(X509_POLICY_LEVEL));\n\ttree->nlevel = n;\n\tlevel = tree->levels;\n\tdata = policy_data_new(NULL, OBJ_nid2obj(NID_any_policy), 0);\n\tif (!data || !level_add_node(level, data, NULL, tree))\n\t\tgoto bad_tree;\n\tfor (i = n - 2; i >= 0; i--)\n\t\t{\n\t\tlevel++;\n\t\tx = sk_X509_value(certs, i);\n\t\tcache = policy_cache_set(x);\n\t\tCRYPTO_add(&x->references, 1, CRYPTO_LOCK_X509);\n\t\tlevel->cert = x;\n\t\tif (!cache->anyPolicy)\n\t\t\t\tlevel->flags |= X509_V_FLAG_INHIBIT_ANY;\n\t\tif (any_skip == 0)\n\t\t\t{\n\t\t\tif (!(x->ex_flags & EXFLAG_SS) || (i == 0))\n\t\t\t\tlevel->flags |= X509_V_FLAG_INHIBIT_ANY;\n\t\t\t}\n\t\telse\n\t\t\t{\n\t\t\tany_skip--;\n\t\t\tif ((cache->any_skip > 0)\n\t\t\t\t&& (cache->any_skip < any_skip))\n\t\t\t\tany_skip = cache->any_skip;\n\t\t\t}\n\t\tif (map_skip == 0)\n\t\t\tlevel->flags |= X509_V_FLAG_INHIBIT_MAP;\n\t\telse\n\t\t\t{\n\t\t\tmap_skip--;\n\t\t\tif ((cache->map_skip > 0)\n\t\t\t\t&& (cache->map_skip < map_skip))\n\t\t\t\tmap_skip = cache->map_skip;\n\t\t\t}\n\t\t}\n\t*ptree = tree;\n\tif (explicit_policy)\n\t\treturn 1;\n\telse\n\t\treturn 5;\n\tbad_tree:\n\tX509_policy_tree_free(tree);\n\treturn 0;\n\t}', 'void *CRYPTO_malloc(int num, const char *file, int line)\n\t{\n\tvoid *ret = NULL;\n\tif (num <= 0) return NULL;\n\tallow_customize = 0;\n\tif (malloc_debug_func != NULL)\n\t\t{\n\t\tallow_customize_debug = 0;\n\t\tmalloc_debug_func(NULL, num, file, line, 0);\n\t\t}\n\tret = malloc_ex_func(num,file,line);\n#ifdef LEVITTE_DEBUG_MEM\n\tfprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\\n", ret, num);\n#endif\n\tif (malloc_debug_func != NULL)\n\t\tmalloc_debug_func(ret, num, file, line, 1);\n#ifndef OPENSSL_CPUID_OBJ\n        if(ret && (num > 2048))\n\t{\textern unsigned char cleanse_ctr;\n                ((unsigned char *)ret)[0] = cleanse_ctr;\n\t}\n#endif\n\treturn ret;\n\t}']