apps/s_server.c:851: error: NULL_DEREFERENCE
  pointer `x` last assigned on line 850 could be null and is dereferenced by call to `X509_get1_ocsp()` at line 851, column 11.
Showing all 31 steps of the trace


apps/s_server.c:823:1: start of procedure cert_status_cb()
821.    */
822.   
823. > static int cert_status_cb(SSL *s, void *arg)
824.   {
825.       tlsextstatusctx *srctx = arg;

apps/s_server.c:825:5: 
823.   static int cert_status_cb(SSL *s, void *arg)
824.   {
825. >     tlsextstatusctx *srctx = arg;
826.       BIO *err = srctx->err;
827.       char *host, *port, *path;

apps/s_server.c:826:5: 
824.   {
825.       tlsextstatusctx *srctx = arg;
826. >     BIO *err = srctx->err;
827.       char *host, *port, *path;
828.       int use_ssl;

apps/s_server.c:829:5: 
827.       char *host, *port, *path;
828.       int use_ssl;
829. >     unsigned char *rspder = NULL;
830.       int rspderlen;
831.       STACK_OF(OPENSSL_STRING) *aia = NULL;

apps/s_server.c:831:5: 
829.       unsigned char *rspder = NULL;
830.       int rspderlen;
831. >     STACK_OF(OPENSSL_STRING) *aia = NULL;
832.       X509 *x = NULL;
833.       X509_STORE_CTX inctx;

apps/s_server.c:832:5: 
830.       int rspderlen;
831.       STACK_OF(OPENSSL_STRING) *aia = NULL;
832. >     X509 *x = NULL;
833.       X509_STORE_CTX inctx;
834.       X509_OBJECT obj;

apps/s_server.c:835:5: 
833.       X509_STORE_CTX inctx;
834.       X509_OBJECT obj;
835. >     OCSP_REQUEST *req = NULL;
836.       OCSP_RESPONSE *resp = NULL;
837.       OCSP_CERTID *id = NULL;

apps/s_server.c:836:5: 
834.       X509_OBJECT obj;
835.       OCSP_REQUEST *req = NULL;
836. >     OCSP_RESPONSE *resp = NULL;
837.       OCSP_CERTID *id = NULL;
838.       STACK_OF(X509_EXTENSION) *exts;

apps/s_server.c:837:5: 
835.       OCSP_REQUEST *req = NULL;
836.       OCSP_RESPONSE *resp = NULL;
837. >     OCSP_CERTID *id = NULL;
838.       STACK_OF(X509_EXTENSION) *exts;
839.       int ret = SSL_TLSEXT_ERR_NOACK;

apps/s_server.c:839:5: 
837.       OCSP_CERTID *id = NULL;
838.       STACK_OF(X509_EXTENSION) *exts;
839. >     int ret = SSL_TLSEXT_ERR_NOACK;
840.       int i;
841.   # if 0

apps/s_server.c:847:9: Taking true branch
845.                  sk_OCSP_RESPID_num(ids));
846.   # endif
847.       if (srctx->verbose)
               ^
848.           BIO_puts(err, "cert_status: callback called\n");
849.       /* Build up OCSP query from server certificate */

apps/s_server.c:848:9: 
846.   # endif
847.       if (srctx->verbose)
848. >         BIO_puts(err, "cert_status: callback called\n");
849.       /* Build up OCSP query from server certificate */
850.       x = SSL_get_certificate(s);

crypto/bio/bio_lib.c:253:1: start of procedure BIO_puts()
  251.   }
  252.   
  253. > int BIO_puts(BIO *b, const char *in)
  254.   {
  255.       int i;

crypto/bio/bio_lib.c:258:10: Taking false branch
  256.       long (*cb) (BIO *, int, const char *, int, long, long);
  257.   
  258.       if ((b == NULL) || (b->method == NULL) || (b->method->bputs == NULL)) {
                  ^
  259.           BIOerr(BIO_F_BIO_PUTS, BIO_R_UNSUPPORTED_METHOD);
  260.           return (-2);

crypto/bio/bio_lib.c:258:25: Taking false branch
  256.       long (*cb) (BIO *, int, const char *, int, long, long);
  257.   
  258.       if ((b == NULL) || (b->method == NULL) || (b->method->bputs == NULL)) {
                                 ^
  259.           BIOerr(BIO_F_BIO_PUTS, BIO_R_UNSUPPORTED_METHOD);
  260.           return (-2);

crypto/bio/bio_lib.c:258:48: Taking false branch
  256.       long (*cb) (BIO *, int, const char *, int, long, long);
  257.   
  258.       if ((b == NULL) || (b->method == NULL) || (b->method->bputs == NULL)) {
                                                        ^
  259.           BIOerr(BIO_F_BIO_PUTS, BIO_R_UNSUPPORTED_METHOD);
  260.           return (-2);

crypto/bio/bio_lib.c:263:5: 
  261.       }
  262.   
  263. >     cb = b->callback;
  264.   
  265.       if ((cb != NULL) && ((i = (int)cb(b, BIO_CB_PUTS, in, 0, 0L, 1L)) <= 0))

crypto/bio/bio_lib.c:265:10: Taking false branch
  263.       cb = b->callback;
  264.   
  265.       if ((cb != NULL) && ((i = (int)cb(b, BIO_CB_PUTS, in, 0, 0L, 1L)) <= 0))
                  ^
  266.           return (i);
  267.   

crypto/bio/bio_lib.c:268:10: Taking false branch
  266.           return (i);
  267.   
  268.       if (!b->init) {
                  ^
  269.           BIOerr(BIO_F_BIO_PUTS, BIO_R_UNINITIALIZED);
  270.           return (-2);

crypto/bio/bio_lib.c:273:5: Skipping __function_pointer__(): unresolved function pointer
  271.       }
  272.   
  273.       i = b->method->bputs(b, in);
             ^
  274.   
  275.       if (i > 0)

crypto/bio/bio_lib.c:275:9: Taking true branch
  273.       i = b->method->bputs(b, in);
  274.   
  275.       if (i > 0)
                 ^
  276.           b->num_write += (unsigned long)i;
  277.   

crypto/bio/bio_lib.c:276:9: 
  274.   
  275.       if (i > 0)
  276. >         b->num_write += (unsigned long)i;
  277.   
  278.       if (cb != NULL)

crypto/bio/bio_lib.c:278:9: Taking false branch
  276.           b->num_write += (unsigned long)i;
  277.   
  278.       if (cb != NULL)
                 ^
  279.           i = (int)cb(b, BIO_CB_PUTS | BIO_CB_RETURN, in, 0, 0L, (long)i);
  280.       return (i);

crypto/bio/bio_lib.c:280:5: 
  278.       if (cb != NULL)
  279.           i = (int)cb(b, BIO_CB_PUTS | BIO_CB_RETURN, in, 0, 0L, (long)i);
  280. >     return (i);
  281.   }
  282.   

crypto/bio/bio_lib.c:281:1: return from a call to BIO_puts
  279.           i = (int)cb(b, BIO_CB_PUTS | BIO_CB_RETURN, in, 0, 0L, (long)i);
  280.       return (i);
  281. > }
  282.   
  283.   int BIO_gets(BIO *b, char *in, int inl)

apps/s_server.c:850:5: 
848.           BIO_puts(err, "cert_status: callback called\n");
849.       /* Build up OCSP query from server certificate */
850. >     x = SSL_get_certificate(s);
851.       aia = X509_get1_ocsp(x);
852.       if (aia) {

ssl/ssl_lib.c:2981:1: start of procedure SSL_get_certificate()
  2979.   }
  2980.   
  2981. > X509 *SSL_get_certificate(const SSL *s)
  2982.   {
  2983.       if (s->cert != NULL)

ssl/ssl_lib.c:2983:9: Taking false branch
  2981.   X509 *SSL_get_certificate(const SSL *s)
  2982.   {
  2983.       if (s->cert != NULL)
                  ^
  2984.           return (s->cert->key->x509);
  2985.       else

ssl/ssl_lib.c:2986:9: 
  2984.           return (s->cert->key->x509);
  2985.       else
  2986. >         return (NULL);
  2987.   }
  2988.   

ssl/ssl_lib.c:2987:1: return from a call to SSL_get_certificate
  2985.       else
  2986.           return (NULL);
  2987. > }
  2988.   
  2989.   EVP_PKEY *SSL_get_privatekey(const SSL *s)

apps/s_server.c:851:5: 
849.       /* Build up OCSP query from server certificate */
850.       x = SSL_get_certificate(s);
851. >     aia = X509_get1_ocsp(x);
852.       if (aia) {
853.           if (!OCSP_parse_url(sk_OPENSSL_STRING_value(aia, 0),

static int cert_status_cb(SSL *s, void *arg)
{
    tlsextstatusctx *srctx = arg;
    BIO *err = srctx->err;
    char *host, *port, *path;
    int use_ssl;
    unsigned char *rspder = NULL;
    int rspderlen;
    STACK_OF(OPENSSL_STRING) *aia = NULL;
    X509 *x = NULL;
    X509_STORE_CTX inctx;
    X509_OBJECT obj;
    OCSP_REQUEST *req = NULL;
    OCSP_RESPONSE *resp = NULL;
    OCSP_CERTID *id = NULL;
    STACK_OF(X509_EXTENSION) *exts;
    int ret = SSL_TLSEXT_ERR_NOACK;
    int i;
# if 0
    STACK_OF(OCSP_RESPID) *ids;
    SSL_get_tlsext_status_ids(s, &ids);
    BIO_printf(err, "cert_status: received %d ids\n",
               sk_OCSP_RESPID_num(ids));
# endif
    if (srctx->verbose)
        BIO_puts(err, "cert_status: callback called\n");
    x = SSL_get_certificate(s);
    aia = X509_get1_ocsp(x);
    if (aia) {
        if (!OCSP_parse_url(sk_OPENSSL_STRING_value(aia, 0),
                            &host, &port, &path, &use_ssl)) {
            BIO_puts(err, "cert_status: can't parse AIA URL\n");
            goto err;
        }
        if (srctx->verbose)
            BIO_printf(err, "cert_status: AIA URL: %s\n",
                       sk_OPENSSL_STRING_value(aia, 0));
    } else {
        if (!srctx->host) {
            BIO_puts(srctx->err,
                     "cert_status: no AIA and no default responder URL\n");
            goto done;
        }
        host = srctx->host;
        path = srctx->path;
        port = srctx->port;
        use_ssl = srctx->use_ssl;
    }
    if (!X509_STORE_CTX_init(&inctx,
                             SSL_CTX_get_cert_store(SSL_get_SSL_CTX(s)),
                             NULL, NULL))
        goto err;
    if (X509_STORE_get_by_subject(&inctx, X509_LU_X509,
                                  X509_get_issuer_name(x), &obj) <= 0) {
        BIO_puts(err, "cert_status: Can't retrieve issuer certificate.\n");
        X509_STORE_CTX_cleanup(&inctx);
        goto done;
    }
    req = OCSP_REQUEST_new();
    if (!req)
        goto err;
    id = OCSP_cert_to_id(NULL, x, obj.data.x509);
    X509_free(obj.data.x509);
    X509_STORE_CTX_cleanup(&inctx);
    if (!id)
        goto err;
    if (!OCSP_request_add0_id(req, id))
        goto err;
    id = NULL;
    SSL_get_tlsext_status_exts(s, &exts);
    for (i = 0; i < sk_X509_EXTENSION_num(exts); i++) {
        X509_EXTENSION *ext = sk_X509_EXTENSION_value(exts, i);
        if (!OCSP_REQUEST_add_ext(req, ext, -1))
            goto err;
    }
    resp = process_responder(err, req, host, path, port, use_ssl, NULL,
                             srctx->timeout);
    if (!resp) {
        BIO_puts(err, "cert_status: error querying responder\n");
        goto done;
    }
    rspderlen = i2d_OCSP_RESPONSE(resp, &rspder);
    if (rspderlen <= 0)
        goto err;
    SSL_set_tlsext_status_ocsp_resp(s, rspder, rspderlen);
    if (srctx->verbose) {
        BIO_puts(err, "cert_status: ocsp response sent:\n");
        OCSP_RESPONSE_print(err, resp, 2);
    }
    ret = SSL_TLSEXT_ERR_OK;
 done:
    if (ret != SSL_TLSEXT_ERR_OK)
        ERR_print_errors(err);
    if (aia) {
        OPENSSL_free(host);
        OPENSSL_free(path);
        OPENSSL_free(port);
        X509_email_free(aia);
    }
    if (id)
        OCSP_CERTID_free(id);
    if (req)
        OCSP_REQUEST_free(req);
    if (resp)
        OCSP_RESPONSE_free(resp);
    return ret;
 err:
    ret = SSL_TLSEXT_ERR_ALERT_FATAL;
    goto done;
}
['static int cert_status_cb(SSL *s, void *arg)\n{\n    tlsextstatusctx *srctx = arg;\n    BIO *err = srctx->err;\n    char *host, *port, *path;\n    int use_ssl;\n    unsigned char *rspder = NULL;\n    int rspderlen;\n    STACK_OF(OPENSSL_STRING) *aia = NULL;\n    X509 *x = NULL;\n    X509_STORE_CTX inctx;\n    X509_OBJECT obj;\n    OCSP_REQUEST *req = NULL;\n    OCSP_RESPONSE *resp = NULL;\n    OCSP_CERTID *id = NULL;\n    STACK_OF(X509_EXTENSION) *exts;\n    int ret = SSL_TLSEXT_ERR_NOACK;\n    int i;\n# if 0\n    STACK_OF(OCSP_RESPID) *ids;\n    SSL_get_tlsext_status_ids(s, &ids);\n    BIO_printf(err, "cert_status: received %d ids\\n",\n               sk_OCSP_RESPID_num(ids));\n# endif\n    if (srctx->verbose)\n        BIO_puts(err, "cert_status: callback called\\n");\n    x = SSL_get_certificate(s);\n    aia = X509_get1_ocsp(x);\n    if (aia) {\n        if (!OCSP_parse_url(sk_OPENSSL_STRING_value(aia, 0),\n                            &host, &port, &path, &use_ssl)) {\n            BIO_puts(err, "cert_status: can\'t parse AIA URL\\n");\n            goto err;\n        }\n        if (srctx->verbose)\n            BIO_printf(err, "cert_status: AIA URL: %s\\n",\n                       sk_OPENSSL_STRING_value(aia, 0));\n    } else {\n        if (!srctx->host) {\n            BIO_puts(srctx->err,\n                     "cert_status: no AIA and no default responder URL\\n");\n            goto done;\n        }\n        host = srctx->host;\n        path = srctx->path;\n        port = srctx->port;\n        use_ssl = srctx->use_ssl;\n    }\n    if (!X509_STORE_CTX_init(&inctx,\n                             SSL_CTX_get_cert_store(SSL_get_SSL_CTX(s)),\n                             NULL, NULL))\n        goto err;\n    if (X509_STORE_get_by_subject(&inctx, X509_LU_X509,\n                                  X509_get_issuer_name(x), &obj) <= 0) {\n        BIO_puts(err, "cert_status: Can\'t retrieve issuer certificate.\\n");\n        X509_STORE_CTX_cleanup(&inctx);\n        goto done;\n    }\n    req = OCSP_REQUEST_new();\n    if (!req)\n        goto err;\n    id = OCSP_cert_to_id(NULL, x, obj.data.x509);\n    X509_free(obj.data.x509);\n    X509_STORE_CTX_cleanup(&inctx);\n    if (!id)\n        goto err;\n    if (!OCSP_request_add0_id(req, id))\n        goto err;\n    id = NULL;\n    SSL_get_tlsext_status_exts(s, &exts);\n    for (i = 0; i < sk_X509_EXTENSION_num(exts); i++) {\n        X509_EXTENSION *ext = sk_X509_EXTENSION_value(exts, i);\n        if (!OCSP_REQUEST_add_ext(req, ext, -1))\n            goto err;\n    }\n    resp = process_responder(err, req, host, path, port, use_ssl, NULL,\n                             srctx->timeout);\n    if (!resp) {\n        BIO_puts(err, "cert_status: error querying responder\\n");\n        goto done;\n    }\n    rspderlen = i2d_OCSP_RESPONSE(resp, &rspder);\n    if (rspderlen <= 0)\n        goto err;\n    SSL_set_tlsext_status_ocsp_resp(s, rspder, rspderlen);\n    if (srctx->verbose) {\n        BIO_puts(err, "cert_status: ocsp response sent:\\n");\n        OCSP_RESPONSE_print(err, resp, 2);\n    }\n    ret = SSL_TLSEXT_ERR_OK;\n done:\n    if (ret != SSL_TLSEXT_ERR_OK)\n        ERR_print_errors(err);\n    if (aia) {\n        OPENSSL_free(host);\n        OPENSSL_free(path);\n        OPENSSL_free(port);\n        X509_email_free(aia);\n    }\n    if (id)\n        OCSP_CERTID_free(id);\n    if (req)\n        OCSP_REQUEST_free(req);\n    if (resp)\n        OCSP_RESPONSE_free(resp);\n    return ret;\n err:\n    ret = SSL_TLSEXT_ERR_ALERT_FATAL;\n    goto done;\n}', 'int BIO_puts(BIO *b, const char *in)\n{\n    int i;\n    long (*cb) (BIO *, int, const char *, int, long, long);\n    if ((b == NULL) || (b->method == NULL) || (b->method->bputs == NULL)) {\n        BIOerr(BIO_F_BIO_PUTS, BIO_R_UNSUPPORTED_METHOD);\n        return (-2);\n    }\n    cb = b->callback;\n    if ((cb != NULL) && ((i = (int)cb(b, BIO_CB_PUTS, in, 0, 0L, 1L)) <= 0))\n        return (i);\n    if (!b->init) {\n        BIOerr(BIO_F_BIO_PUTS, BIO_R_UNINITIALIZED);\n        return (-2);\n    }\n    i = b->method->bputs(b, in);\n    if (i > 0)\n        b->num_write += (unsigned long)i;\n    if (cb != NULL)\n        i = (int)cb(b, BIO_CB_PUTS | BIO_CB_RETURN, in, 0, 0L, (long)i);\n    return (i);\n}', 'X509 *SSL_get_certificate(const SSL *s)\n{\n    if (s->cert != NULL)\n        return (s->cert->key->x509);\n    else\n        return (NULL);\n}']