crypto/x509/x509_lu.c:302: error: NULL_DEREFERENCE
  pointer `lu` last assigned on line 301 could be null and is dereferenced by call to `X509_LOOKUP_by_subject()` at line 302, column 17.
Showing all 54 steps of the trace


crypto/x509/x509_lu.c:286:1: start of procedure X509_STORE_get_by_subject()
284.   }
285.   
286. > int X509_STORE_get_by_subject(X509_STORE_CTX *vs, X509_LOOKUP_TYPE type,
287.                                 X509_NAME *name, X509_OBJECT *ret)
288.   {

crypto/x509/x509_lu.c:289:5: 
287.                                 X509_NAME *name, X509_OBJECT *ret)
288.   {
289. >     X509_STORE *ctx = vs->ctx;
290.       X509_LOOKUP *lu;
291.       X509_OBJECT stmp, *tmp;

crypto/x509/x509_lu.c:294:5: 
292.       int i, j;
293.   
294. >     CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);
295.       tmp = X509_OBJECT_retrieve_by_subject(ctx->objs, type, name);
296.       CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);

crypto/lock.c:413:1: start of procedure CRYPTO_lock()
  411.   }
  412.   
  413. > void CRYPTO_lock(int mode, int type, const char *file, int line)
  414.   {
  415.   #ifdef LOCK_DEBUG

crypto/lock.c:440:9: Taking false branch
  438.       }
  439.   #endif
  440.       if (type < 0) {
                 ^
  441.           if (dynlock_lock_callback != NULL) {
  442.               struct CRYPTO_dynlock_value *pointer

crypto/lock.c:451:16: Taking true branch
  449.               CRYPTO_destroy_dynlockid(type);
  450.           }
  451.       } else if (locking_callback != NULL)
                        ^
  452.           locking_callback(mode, type, file, line);
  453.   }

crypto/lock.c:452:9: Skipping __function_pointer__(): unresolved function pointer
  450.           }
  451.       } else if (locking_callback != NULL)
  452.           locking_callback(mode, type, file, line);
                 ^
  453.   }
  454.   

crypto/lock.c:440:5: 
  438.       }
  439.   #endif
  440. >     if (type < 0) {
  441.           if (dynlock_lock_callback != NULL) {
  442.               struct CRYPTO_dynlock_value *pointer

crypto/lock.c:453:1: return from a call to CRYPTO_lock
  451.       } else if (locking_callback != NULL)
  452.           locking_callback(mode, type, file, line);
  453. > }
  454.   
  455.   int CRYPTO_add_lock(int *pointer, int amount, int type, const char *file,

crypto/x509/x509_lu.c:295:5: 
293.   
294.       CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);
295. >     tmp = X509_OBJECT_retrieve_by_subject(ctx->objs, type, name);
296.       CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
297.   

crypto/x509/x509_lu.c:467:1: start of procedure X509_OBJECT_retrieve_by_subject()
  465.   }
  466.   
  467. > X509_OBJECT *X509_OBJECT_retrieve_by_subject(STACK_OF(X509_OBJECT) *h,
  468.                                                int type, X509_NAME *name)
  469.   {

crypto/x509/x509_lu.c:471:5: 
  469.   {
  470.       int idx;
  471. >     idx = X509_OBJECT_idx_by_subject(h, type, name);
  472.       if (idx == -1)
  473.           return NULL;

crypto/x509/x509_lu.c:461:1: start of procedure X509_OBJECT_idx_by_subject()
    459.   }
    460.   
    461. > int X509_OBJECT_idx_by_subject(STACK_OF(X509_OBJECT) *h, int type,
    462.                                  X509_NAME *name)
    463.   {

crypto/x509/x509_lu.c:464:5: Skipping x509_object_idx_cnt(): empty list of specs
    462.                                  X509_NAME *name)
    463.   {
    464.       return x509_object_idx_cnt(h, type, name, NULL);
               ^
    465.   }
    466.   

crypto/x509/x509_lu.c:465:1: return from a call to X509_OBJECT_idx_by_subject
    463.   {
    464.       return x509_object_idx_cnt(h, type, name, NULL);
    465. > }
    466.   
    467.   X509_OBJECT *X509_OBJECT_retrieve_by_subject(STACK_OF(X509_OBJECT) *h,

crypto/x509/x509_lu.c:472:9: Taking false branch
  470.       int idx;
  471.       idx = X509_OBJECT_idx_by_subject(h, type, name);
  472.       if (idx == -1)
                 ^
  473.           return NULL;
  474.       return sk_X509_OBJECT_value(h, idx);

crypto/x509/x509_lu.c:474:5: 
  472.       if (idx == -1)
  473.           return NULL;
  474. >     return sk_X509_OBJECT_value(h, idx);
  475.   }
  476.   

include/openssl/x509_vfy.h:123:1: start of procedure sk_X509_OBJECT_value()
    121.   
    122.   DEFINE_STACK_OF(X509_LOOKUP)
    123. > DEFINE_STACK_OF(X509_OBJECT)
    124.   
    125.   /* This is a static that defines the function interface */

crypto/stack/stack.c:323:1: start of procedure sk_value()
      321.   }
      322.   
      323. > void *sk_value(const _STACK *st, int i)
      324.   {
      325.       if (!st || (i < 0) || (i >= st->num))

crypto/stack/stack.c:325:10: Taking false branch
      323.   void *sk_value(const _STACK *st, int i)
      324.   {
      325.       if (!st || (i < 0) || (i >= st->num))
                      ^
      326.           return NULL;
      327.       return st->data[i];

crypto/stack/stack.c:325:17: Taking false branch
      323.   void *sk_value(const _STACK *st, int i)
      324.   {
      325.       if (!st || (i < 0) || (i >= st->num))
                             ^
      326.           return NULL;
      327.       return st->data[i];

crypto/stack/stack.c:325:28: Taking false branch
      323.   void *sk_value(const _STACK *st, int i)
      324.   {
      325.       if (!st || (i < 0) || (i >= st->num))
                                        ^
      326.           return NULL;
      327.       return st->data[i];

crypto/stack/stack.c:327:5: 
      325.       if (!st || (i < 0) || (i >= st->num))
      326.           return NULL;
      327. >     return st->data[i];
      328.   }
      329.   

crypto/stack/stack.c:328:1: return from a call to sk_value
      326.           return NULL;
      327.       return st->data[i];
      328. > }
      329.   
      330.   void *sk_set(_STACK *st, int i, void *value)

include/openssl/x509_vfy.h:123:1: return from a call to sk_X509_OBJECT_value
    121.   
    122.   DEFINE_STACK_OF(X509_LOOKUP)
    123. > DEFINE_STACK_OF(X509_OBJECT)
    124.   
    125.   /* This is a static that defines the function interface */

crypto/x509/x509_lu.c:475:1: return from a call to X509_OBJECT_retrieve_by_subject
  473.           return NULL;
  474.       return sk_X509_OBJECT_value(h, idx);
  475. > }
  476.   
  477.   STACK_OF(X509) *X509_STORE_get1_certs(X509_STORE_CTX *ctx, X509_NAME *nm)

crypto/x509/x509_lu.c:296:5: 
294.       CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);
295.       tmp = X509_OBJECT_retrieve_by_subject(ctx->objs, type, name);
296. >     CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
297.   
298.       if (tmp == NULL || type == X509_LU_CRL) {

crypto/lock.c:413:1: start of procedure CRYPTO_lock()
  411.   }
  412.   
  413. > void CRYPTO_lock(int mode, int type, const char *file, int line)
  414.   {
  415.   #ifdef LOCK_DEBUG

crypto/lock.c:440:9: Taking false branch
  438.       }
  439.   #endif
  440.       if (type < 0) {
                 ^
  441.           if (dynlock_lock_callback != NULL) {
  442.               struct CRYPTO_dynlock_value *pointer

crypto/lock.c:451:16: Taking true branch
  449.               CRYPTO_destroy_dynlockid(type);
  450.           }
  451.       } else if (locking_callback != NULL)
                        ^
  452.           locking_callback(mode, type, file, line);
  453.   }

crypto/lock.c:452:9: Skipping __function_pointer__(): unresolved function pointer
  450.           }
  451.       } else if (locking_callback != NULL)
  452.           locking_callback(mode, type, file, line);
                 ^
  453.   }
  454.   

crypto/lock.c:440:5: 
  438.       }
  439.   #endif
  440. >     if (type < 0) {
  441.           if (dynlock_lock_callback != NULL) {
  442.               struct CRYPTO_dynlock_value *pointer

crypto/lock.c:453:1: return from a call to CRYPTO_lock
  451.       } else if (locking_callback != NULL)
  452.           locking_callback(mode, type, file, line);
  453. > }
  454.   
  455.   int CRYPTO_add_lock(int *pointer, int amount, int type, const char *file,

crypto/x509/x509_lu.c:298:9: Taking false branch
296.       CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
297.   
298.       if (tmp == NULL || type == X509_LU_CRL) {
               ^
299.           for (i = vs->current_method;
300.                i < sk_X509_LOOKUP_num(ctx->get_cert_methods); i++) {

crypto/x509/x509_lu.c:298:24: Taking true branch
296.       CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
297.   
298.       if (tmp == NULL || type == X509_LU_CRL) {
                              ^
299.           for (i = vs->current_method;
300.                i < sk_X509_LOOKUP_num(ctx->get_cert_methods); i++) {

crypto/x509/x509_lu.c:299:14: 
297.   
298.       if (tmp == NULL || type == X509_LU_CRL) {
299. >         for (i = vs->current_method;
300.                i < sk_X509_LOOKUP_num(ctx->get_cert_methods); i++) {
301.               lu = sk_X509_LOOKUP_value(ctx->get_cert_methods, i);

crypto/x509/x509_lu.c:300:14: 
298.       if (tmp == NULL || type == X509_LU_CRL) {
299.           for (i = vs->current_method;
300. >              i < sk_X509_LOOKUP_num(ctx->get_cert_methods); i++) {
301.               lu = sk_X509_LOOKUP_value(ctx->get_cert_methods, i);
302.               j = X509_LOOKUP_by_subject(lu, type, name, &stmp);

include/openssl/x509_vfy.h:122:1: start of procedure sk_X509_LOOKUP_num()
  120.   typedef struct x509_lookup_st X509_LOOKUP;
  121.   
  122. > DEFINE_STACK_OF(X509_LOOKUP)
  123.   DEFINE_STACK_OF(X509_OBJECT)
  124.   

crypto/stack/stack.c:316:1: start of procedure sk_num()
    314.   }
    315.   
    316. > int sk_num(const _STACK *st)
    317.   {
    318.       if (st == NULL)

crypto/stack/stack.c:318:9: Taking true branch
    316.   int sk_num(const _STACK *st)
    317.   {
    318.       if (st == NULL)
                   ^
    319.           return -1;
    320.       return st->num;

crypto/stack/stack.c:319:9: 
    317.   {
    318.       if (st == NULL)
    319. >         return -1;
    320.       return st->num;
    321.   }

crypto/stack/stack.c:321:1: return from a call to sk_num
    319.           return -1;
    320.       return st->num;
    321. > }
    322.   
    323.   void *sk_value(const _STACK *st, int i)

include/openssl/x509_vfy.h:122:1: return from a call to sk_X509_LOOKUP_num
  120.   typedef struct x509_lookup_st X509_LOOKUP;
  121.   
  122. > DEFINE_STACK_OF(X509_LOOKUP)
  123.   DEFINE_STACK_OF(X509_OBJECT)
  124.   

crypto/x509/x509_lu.c:300:14: Loop condition is true. Entering loop body
298.       if (tmp == NULL || type == X509_LU_CRL) {
299.           for (i = vs->current_method;
300.                i < sk_X509_LOOKUP_num(ctx->get_cert_methods); i++) {
                    ^
301.               lu = sk_X509_LOOKUP_value(ctx->get_cert_methods, i);
302.               j = X509_LOOKUP_by_subject(lu, type, name, &stmp);

crypto/x509/x509_lu.c:301:13: 
299.           for (i = vs->current_method;
300.                i < sk_X509_LOOKUP_num(ctx->get_cert_methods); i++) {
301. >             lu = sk_X509_LOOKUP_value(ctx->get_cert_methods, i);
302.               j = X509_LOOKUP_by_subject(lu, type, name, &stmp);
303.               if (j < 0) {

include/openssl/x509_vfy.h:122:1: start of procedure sk_X509_LOOKUP_value()
  120.   typedef struct x509_lookup_st X509_LOOKUP;
  121.   
  122. > DEFINE_STACK_OF(X509_LOOKUP)
  123.   DEFINE_STACK_OF(X509_OBJECT)
  124.   

crypto/stack/stack.c:323:1: start of procedure sk_value()
    321.   }
    322.   
    323. > void *sk_value(const _STACK *st, int i)
    324.   {
    325.       if (!st || (i < 0) || (i >= st->num))

crypto/stack/stack.c:325:10: Taking true branch
    323.   void *sk_value(const _STACK *st, int i)
    324.   {
    325.       if (!st || (i < 0) || (i >= st->num))
                    ^
    326.           return NULL;
    327.       return st->data[i];

crypto/stack/stack.c:326:9: 
    324.   {
    325.       if (!st || (i < 0) || (i >= st->num))
    326. >         return NULL;
    327.       return st->data[i];
    328.   }

crypto/stack/stack.c:328:1: return from a call to sk_value
    326.           return NULL;
    327.       return st->data[i];
    328. > }
    329.   
    330.   void *sk_set(_STACK *st, int i, void *value)

include/openssl/x509_vfy.h:122:1: return from a call to sk_X509_LOOKUP_value
  120.   typedef struct x509_lookup_st X509_LOOKUP;
  121.   
  122. > DEFINE_STACK_OF(X509_LOOKUP)
  123.   DEFINE_STACK_OF(X509_OBJECT)
  124.   

crypto/x509/x509_lu.c:302:13: 
300.                i < sk_X509_LOOKUP_num(ctx->get_cert_methods); i++) {
301.               lu = sk_X509_LOOKUP_value(ctx->get_cert_methods, i);
302. >             j = X509_LOOKUP_by_subject(lu, type, name, &stmp);
303.               if (j < 0) {
304.                   vs->current_method = j;

crypto/x509/x509_lu.c:122:1: start of procedure X509_LOOKUP_by_subject()
  120.   }
  121.   
  122. > int X509_LOOKUP_by_subject(X509_LOOKUP *ctx, int type, X509_NAME *name,
  123.                              X509_OBJECT *ret)
  124.   {

crypto/x509/x509_lu.c:125:10: 
  123.                              X509_OBJECT *ret)
  124.   {
  125. >     if ((ctx->method == NULL) || (ctx->method->get_by_subject == NULL))
  126.           return X509_LU_FAIL;
  127.       if (ctx->skip)

int X509_STORE_get_by_subject(X509_STORE_CTX *vs, X509_LOOKUP_TYPE type,
                              X509_NAME *name, X509_OBJECT *ret)
{
    X509_STORE *ctx = vs->ctx;
    X509_LOOKUP *lu;
    X509_OBJECT stmp, *tmp;
    int i, j;
    CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);
    tmp = X509_OBJECT_retrieve_by_subject(ctx->objs, type, name);
    CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
    if (tmp == NULL || type == X509_LU_CRL) {
        for (i = vs->current_method;
             i < sk_X509_LOOKUP_num(ctx->get_cert_methods); i++) {
            lu = sk_X509_LOOKUP_value(ctx->get_cert_methods, i);
            j = X509_LOOKUP_by_subject(lu, type, name, &stmp);
            if (j < 0) {
                vs->current_method = j;
                return j;
            } else if (j) {
                tmp = &stmp;
                break;
            }
        }
        vs->current_method = 0;
        if (tmp == NULL)
            return 0;
    }
    ret->type = tmp->type;
    ret->data.ptr = tmp->data.ptr;
    X509_OBJECT_up_ref_count(ret);
    return 1;
}
['int X509_STORE_get_by_subject(X509_STORE_CTX *vs, X509_LOOKUP_TYPE type,\n                              X509_NAME *name, X509_OBJECT *ret)\n{\n    X509_STORE *ctx = vs->ctx;\n    X509_LOOKUP *lu;\n    X509_OBJECT stmp, *tmp;\n    int i, j;\n    CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);\n    tmp = X509_OBJECT_retrieve_by_subject(ctx->objs, type, name);\n    CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);\n    if (tmp == NULL || type == X509_LU_CRL) {\n        for (i = vs->current_method;\n             i < sk_X509_LOOKUP_num(ctx->get_cert_methods); i++) {\n            lu = sk_X509_LOOKUP_value(ctx->get_cert_methods, i);\n            j = X509_LOOKUP_by_subject(lu, type, name, &stmp);\n            if (j < 0) {\n                vs->current_method = j;\n                return j;\n            } else if (j) {\n                tmp = &stmp;\n                break;\n            }\n        }\n        vs->current_method = 0;\n        if (tmp == NULL)\n            return 0;\n    }\n    ret->type = tmp->type;\n    ret->data.ptr = tmp->data.ptr;\n    X509_OBJECT_up_ref_count(ret);\n    return 1;\n}', 'void CRYPTO_lock(int mode, int type, const char *file, int line)\n{\n#ifdef LOCK_DEBUG\n    {\n        CRYPTO_THREADID id;\n        char *rw_text, *operation_text;\n        if (mode & CRYPTO_LOCK)\n            operation_text = "lock  ";\n        else if (mode & CRYPTO_UNLOCK)\n            operation_text = "unlock";\n        else\n            operation_text = "ERROR ";\n        if (mode & CRYPTO_READ)\n            rw_text = "r";\n        else if (mode & CRYPTO_WRITE)\n            rw_text = "w";\n        else\n            rw_text = "ERROR";\n        CRYPTO_THREADID_current(&id);\n        fprintf(stderr, "lock:%08lx:(%s)%s %-18s %s:%d\\n",\n                CRYPTO_THREADID_hash(&id), rw_text, operation_text,\n                CRYPTO_get_lock_name(type), file, line);\n    }\n#endif\n    if (type < 0) {\n        if (dynlock_lock_callback != NULL) {\n            struct CRYPTO_dynlock_value *pointer\n                = CRYPTO_get_dynlock_value(type);\n            OPENSSL_assert(pointer != NULL);\n            dynlock_lock_callback(mode, pointer, file, line);\n            CRYPTO_destroy_dynlockid(type);\n        }\n    } else if (locking_callback != NULL)\n        locking_callback(mode, type, file, line);\n}', 'X509_OBJECT *X509_OBJECT_retrieve_by_subject(STACK_OF(X509_OBJECT) *h,\n                                             int type, X509_NAME *name)\n{\n    int idx;\n    idx = X509_OBJECT_idx_by_subject(h, type, name);\n    if (idx == -1)\n        return NULL;\n    return sk_X509_OBJECT_value(h, idx);\n}', 'int X509_OBJECT_idx_by_subject(STACK_OF(X509_OBJECT) *h, int type,\n                               X509_NAME *name)\n{\n    return x509_object_idx_cnt(h, type, name, NULL);\n}', 'void *sk_value(const _STACK *st, int i)\n{\n    if (!st || (i < 0) || (i >= st->num))\n        return NULL;\n    return st->data[i];\n}', 'int sk_num(const _STACK *st)\n{\n    if (st == NULL)\n        return -1;\n    return st->num;\n}', 'int X509_LOOKUP_by_subject(X509_LOOKUP *ctx, int type, X509_NAME *name,\n                           X509_OBJECT *ret)\n{\n    if ((ctx->method == NULL) || (ctx->method->get_by_subject == NULL))\n        return X509_LU_FAIL;\n    if (ctx->skip)\n        return 0;\n    return ctx->method->get_by_subject(ctx, type, name, ret);\n}']