engines/e_4758cca.c:640: error: NULL_DEREFERENCE
  pointer `keyToken` last assigned on line 631 could be null and is dereferenced at line 640, column 19.
Showing all 27 steps of the trace


engines/e_4758cca.c:620:1: start of procedure cca_rsa_verify()
618.   #define SSL_SIG_LEN 36
619.   
620. > static int cca_rsa_verify(int type, const unsigned char *m, unsigned int m_len,
621.   		unsigned char *sigbuf, unsigned int siglen, const RSA *rsa)
622.   	{

engines/e_4758cca.c:625:2: 
623.   	long returnCode;
624.   	long reasonCode;
625. > 	long lsiglen = siglen;
626.   	long exitDataLength = 0;
627.   	unsigned char exitData[8];

engines/e_4758cca.c:626:2: 
624.   	long reasonCode;
625.   	long lsiglen = siglen;
626. > 	long exitDataLength = 0;
627.   	unsigned char exitData[8];
628.   	long ruleArrayLength = 1;

engines/e_4758cca.c:628:2: 
626.   	long exitDataLength = 0;
627.   	unsigned char exitData[8];
628. > 	long ruleArrayLength = 1;
629.   	unsigned char ruleArray[8] = "PKCS-1.1";
630.   	long keyTokenLength;

engines/e_4758cca.c:629:2: 
627.   	unsigned char exitData[8];
628.   	long ruleArrayLength = 1;
629. > 	unsigned char ruleArray[8] = "PKCS-1.1";
630.   	long keyTokenLength;
631.   	unsigned char* keyToken = (unsigned char*)RSA_get_ex_data(rsa, hndidx);

engines/e_4758cca.c:631:2: 
629.   	unsigned char ruleArray[8] = "PKCS-1.1";
630.   	long keyTokenLength;
631. > 	unsigned char* keyToken = (unsigned char*)RSA_get_ex_data(rsa, hndidx);
632.   	long length = SSL_SIG_LEN;
633.   	long keyLength ;

crypto/rsa/rsa_lib.c:269:1: start of procedure RSA_get_ex_data()
  267.   	}
  268.   
  269. > void *RSA_get_ex_data(const RSA *r, int idx)
  270.   	{
  271.   	return(CRYPTO_get_ex_data(&r->ex_data,idx));

crypto/rsa/rsa_lib.c:271:2: 
  269.   void *RSA_get_ex_data(const RSA *r, int idx)
  270.   	{
  271. > 	return(CRYPTO_get_ex_data(&r->ex_data,idx));
  272.   	}
  273.   

crypto/ex_data.c:622:1: start of procedure CRYPTO_get_ex_data()
    620.   /* For a given CRYPTO_EX_DATA_ variable, get the value corresponding to a
    621.    * particular index in the class used by this variable */
    622. > void *CRYPTO_get_ex_data(const CRYPTO_EX_DATA *ad, int idx)
    623.   	{
    624.   	if (ad->sk == NULL)

crypto/ex_data.c:624:6: Taking false branch
    622.   void *CRYPTO_get_ex_data(const CRYPTO_EX_DATA *ad, int idx)
    623.   	{
    624.   	if (ad->sk == NULL)
                ^
    625.   		return(0);
    626.   	else if (idx >= sk_num(ad->sk))

crypto/ex_data.c:626:11: 
    624.   	if (ad->sk == NULL)
    625.   		return(0);
    626. > 	else if (idx >= sk_num(ad->sk))
    627.   		return(0);
    628.   	else

crypto/stack/stack.c:301:1: start of procedure sk_num()
      299.   	}
      300.   
      301. > int sk_num(const STACK *st)
      302.   {
      303.   	if(st == NULL) return -1;

crypto/stack/stack.c:303:5: Taking false branch
      301.   int sk_num(const STACK *st)
      302.   {
      303.   	if(st == NULL) return -1;
                 ^
      304.   	return st->num;
      305.   }

crypto/stack/stack.c:304:2: 
      302.   {
      303.   	if(st == NULL) return -1;
      304. > 	return st->num;
      305.   }
      306.   

crypto/stack/stack.c:305:1: return from a call to sk_num
      303.   	if(st == NULL) return -1;
      304.   	return st->num;
      305. > }
      306.   
      307.   char *sk_value(const STACK *st, int i)

crypto/ex_data.c:626:11: Taking false branch
    624.   	if (ad->sk == NULL)
    625.   		return(0);
    626.   	else if (idx >= sk_num(ad->sk))
                     ^
    627.   		return(0);
    628.   	else

crypto/ex_data.c:629:3: 
    627.   		return(0);
    628.   	else
    629. > 		return(sk_value(ad->sk,idx));
    630.   	}
    631.   

crypto/stack/stack.c:307:1: start of procedure sk_value()
      305.   }
      306.   
      307. > char *sk_value(const STACK *st, int i)
      308.   {
      309.   	if(!st || (i < 0) || (i >= st->num)) return NULL;

crypto/stack/stack.c:309:6: Taking false branch
      307.   char *sk_value(const STACK *st, int i)
      308.   {
      309.   	if(!st || (i < 0) || (i >= st->num)) return NULL;
                  ^
      310.   	return st->data[i];
      311.   }

crypto/stack/stack.c:309:13: Taking true branch
      307.   char *sk_value(const STACK *st, int i)
      308.   {
      309.   	if(!st || (i < 0) || (i >= st->num)) return NULL;
                         ^
      310.   	return st->data[i];
      311.   }

crypto/stack/stack.c:309:39: 
      307.   char *sk_value(const STACK *st, int i)
      308.   {
      309. > 	if(!st || (i < 0) || (i >= st->num)) return NULL;
      310.   	return st->data[i];
      311.   }

crypto/stack/stack.c:311:1: return from a call to sk_value
      309.   	if(!st || (i < 0) || (i >= st->num)) return NULL;
      310.   	return st->data[i];
      311. > }
      312.   
      313.   char *sk_set(STACK *st, int i, char *value)

crypto/ex_data.c:630:2: return from a call to CRYPTO_get_ex_data
    628.   	else
    629.   		return(sk_value(ad->sk,idx));
    630.   	}
            ^
    631.   
    632.   IMPLEMENT_STACK_OF(CRYPTO_EX_DATA_FUNCS)

crypto/rsa/rsa_lib.c:272:2: return from a call to RSA_get_ex_data
  270.   	{
  271.   	return(CRYPTO_get_ex_data(&r->ex_data,idx));
  272.   	}
          ^
  273.   
  274.   int RSA_size(const RSA *r)

engines/e_4758cca.c:632:2: 
630.   	long keyTokenLength;
631.   	unsigned char* keyToken = (unsigned char*)RSA_get_ex_data(rsa, hndidx);
632. > 	long length = SSL_SIG_LEN;
633.   	long keyLength ;
634.   	unsigned char *hashBuffer = NULL;

engines/e_4758cca.c:634:2: 
632.   	long length = SSL_SIG_LEN;
633.   	long keyLength ;
634. > 	unsigned char *hashBuffer = NULL;
635.   	X509_SIG sig;
636.   	ASN1_TYPE parameter;

engines/e_4758cca.c:640:2: 
638.   	ASN1_OCTET_STRING digest;
639.   
640. > 	keyTokenLength = *(long*)keyToken;
641.   	keyToken+=sizeof(long);
642.   

static int cca_rsa_verify(int type, const unsigned char *m, unsigned int m_len,
		unsigned char *sigbuf, unsigned int siglen, const RSA *rsa)
	{
	long returnCode;
	long reasonCode;
	long lsiglen = siglen;
	long exitDataLength = 0;
	unsigned char exitData[8];
	long ruleArrayLength = 1;
	unsigned char ruleArray[8] = "PKCS-1.1";
	long keyTokenLength;
	unsigned char* keyToken = (unsigned char*)RSA_get_ex_data(rsa, hndidx);
	long length = SSL_SIG_LEN;
	long keyLength ;
	unsigned char *hashBuffer = NULL;
	X509_SIG sig;
	ASN1_TYPE parameter;
	X509_ALGOR algorithm;
	ASN1_OCTET_STRING digest;
	keyTokenLength = *(long*)keyToken;
	keyToken+=sizeof(long);
	if (type == NID_md5 || type == NID_sha1)
		{
		sig.algor = &algorithm;
		algorithm.algorithm = OBJ_nid2obj(type);
		if (!algorithm.algorithm)
			{
			CCA4758err(CCA4758_F_CCA_RSA_VERIFY,
				CCA4758_R_UNKNOWN_ALGORITHM_TYPE);
			return 0;
			}
		if (!algorithm.algorithm->length)
			{
			CCA4758err(CCA4758_F_CCA_RSA_VERIFY,
				CCA4758_R_ASN1_OID_UNKNOWN_FOR_MD);
			return 0;
			}
		parameter.type = V_ASN1_NULL;
		parameter.value.ptr = NULL;
		algorithm.parameter = &parameter;
		sig.digest = &digest;
		sig.digest->data = (unsigned char*)m;
		sig.digest->length = m_len;
		length = i2d_X509_SIG(&sig, NULL);
		}
	keyLength = RSA_size(rsa);
	if (length - RSA_PKCS1_PADDING > keyLength)
		{
		CCA4758err(CCA4758_F_CCA_RSA_VERIFY,
			CCA4758_R_SIZE_TOO_LARGE_OR_TOO_SMALL);
		return 0;
		}
	switch (type)
		{
		case NID_md5_sha1 :
			if (m_len != SSL_SIG_LEN)
				{
				CCA4758err(CCA4758_F_CCA_RSA_VERIFY,
				CCA4758_R_SIZE_TOO_LARGE_OR_TOO_SMALL);
				return 0;
				}
			hashBuffer = (unsigned char *)m;
			length = m_len;
			break;
		case NID_md5 :
			{
			unsigned char *ptr;
			ptr = hashBuffer = OPENSSL_malloc(
					(unsigned int)keyLength+1);
			if (!hashBuffer)
				{
				CCA4758err(CCA4758_F_CCA_RSA_VERIFY,
						ERR_R_MALLOC_FAILURE);
				return 0;
				}
			i2d_X509_SIG(&sig, &ptr);
			}
			break;
		case NID_sha1 :
			{
			unsigned char *ptr;
			ptr = hashBuffer = OPENSSL_malloc(
					(unsigned int)keyLength+1);
			if (!hashBuffer)
				{
				CCA4758err(CCA4758_F_CCA_RSA_VERIFY,
						ERR_R_MALLOC_FAILURE);
				return 0;
				}
			i2d_X509_SIG(&sig, &ptr);
			}
			break;
		default:
			return 0;
		}
	digitalSignatureVerify(&returnCode, &reasonCode, &exitDataLength,
		exitData, &ruleArrayLength, ruleArray, &keyTokenLength,
		keyToken, &length, hashBuffer, &lsiglen, sigbuf);
	if (type == NID_sha1 || type == NID_md5)
		{
		OPENSSL_cleanse(hashBuffer, keyLength+1);
		OPENSSL_free(hashBuffer);
		}
	return ((returnCode || reasonCode) ? 0 : 1);
	}
['static int cca_rsa_verify(int type, const unsigned char *m, unsigned int m_len,\n\t\tunsigned char *sigbuf, unsigned int siglen, const RSA *rsa)\n\t{\n\tlong returnCode;\n\tlong reasonCode;\n\tlong lsiglen = siglen;\n\tlong exitDataLength = 0;\n\tunsigned char exitData[8];\n\tlong ruleArrayLength = 1;\n\tunsigned char ruleArray[8] = "PKCS-1.1";\n\tlong keyTokenLength;\n\tunsigned char* keyToken = (unsigned char*)RSA_get_ex_data(rsa, hndidx);\n\tlong length = SSL_SIG_LEN;\n\tlong keyLength ;\n\tunsigned char *hashBuffer = NULL;\n\tX509_SIG sig;\n\tASN1_TYPE parameter;\n\tX509_ALGOR algorithm;\n\tASN1_OCTET_STRING digest;\n\tkeyTokenLength = *(long*)keyToken;\n\tkeyToken+=sizeof(long);\n\tif (type == NID_md5 || type == NID_sha1)\n\t\t{\n\t\tsig.algor = &algorithm;\n\t\talgorithm.algorithm = OBJ_nid2obj(type);\n\t\tif (!algorithm.algorithm)\n\t\t\t{\n\t\t\tCCA4758err(CCA4758_F_CCA_RSA_VERIFY,\n\t\t\t\tCCA4758_R_UNKNOWN_ALGORITHM_TYPE);\n\t\t\treturn 0;\n\t\t\t}\n\t\tif (!algorithm.algorithm->length)\n\t\t\t{\n\t\t\tCCA4758err(CCA4758_F_CCA_RSA_VERIFY,\n\t\t\t\tCCA4758_R_ASN1_OID_UNKNOWN_FOR_MD);\n\t\t\treturn 0;\n\t\t\t}\n\t\tparameter.type = V_ASN1_NULL;\n\t\tparameter.value.ptr = NULL;\n\t\talgorithm.parameter = &parameter;\n\t\tsig.digest = &digest;\n\t\tsig.digest->data = (unsigned char*)m;\n\t\tsig.digest->length = m_len;\n\t\tlength = i2d_X509_SIG(&sig, NULL);\n\t\t}\n\tkeyLength = RSA_size(rsa);\n\tif (length - RSA_PKCS1_PADDING > keyLength)\n\t\t{\n\t\tCCA4758err(CCA4758_F_CCA_RSA_VERIFY,\n\t\t\tCCA4758_R_SIZE_TOO_LARGE_OR_TOO_SMALL);\n\t\treturn 0;\n\t\t}\n\tswitch (type)\n\t\t{\n\t\tcase NID_md5_sha1 :\n\t\t\tif (m_len != SSL_SIG_LEN)\n\t\t\t\t{\n\t\t\t\tCCA4758err(CCA4758_F_CCA_RSA_VERIFY,\n\t\t\t\tCCA4758_R_SIZE_TOO_LARGE_OR_TOO_SMALL);\n\t\t\t\treturn 0;\n\t\t\t\t}\n\t\t\thashBuffer = (unsigned char *)m;\n\t\t\tlength = m_len;\n\t\t\tbreak;\n\t\tcase NID_md5 :\n\t\t\t{\n\t\t\tunsigned char *ptr;\n\t\t\tptr = hashBuffer = OPENSSL_malloc(\n\t\t\t\t\t(unsigned int)keyLength+1);\n\t\t\tif (!hashBuffer)\n\t\t\t\t{\n\t\t\t\tCCA4758err(CCA4758_F_CCA_RSA_VERIFY,\n\t\t\t\t\t\tERR_R_MALLOC_FAILURE);\n\t\t\t\treturn 0;\n\t\t\t\t}\n\t\t\ti2d_X509_SIG(&sig, &ptr);\n\t\t\t}\n\t\t\tbreak;\n\t\tcase NID_sha1 :\n\t\t\t{\n\t\t\tunsigned char *ptr;\n\t\t\tptr = hashBuffer = OPENSSL_malloc(\n\t\t\t\t\t(unsigned int)keyLength+1);\n\t\t\tif (!hashBuffer)\n\t\t\t\t{\n\t\t\t\tCCA4758err(CCA4758_F_CCA_RSA_VERIFY,\n\t\t\t\t\t\tERR_R_MALLOC_FAILURE);\n\t\t\t\treturn 0;\n\t\t\t\t}\n\t\t\ti2d_X509_SIG(&sig, &ptr);\n\t\t\t}\n\t\t\tbreak;\n\t\tdefault:\n\t\t\treturn 0;\n\t\t}\n\tdigitalSignatureVerify(&returnCode, &reasonCode, &exitDataLength,\n\t\texitData, &ruleArrayLength, ruleArray, &keyTokenLength,\n\t\tkeyToken, &length, hashBuffer, &lsiglen, sigbuf);\n\tif (type == NID_sha1 || type == NID_md5)\n\t\t{\n\t\tOPENSSL_cleanse(hashBuffer, keyLength+1);\n\t\tOPENSSL_free(hashBuffer);\n\t\t}\n\treturn ((returnCode || reasonCode) ? 0 : 1);\n\t}', 'void *RSA_get_ex_data(const RSA *r, int idx)\n\t{\n\treturn(CRYPTO_get_ex_data(&r->ex_data,idx));\n\t}', 'void *CRYPTO_get_ex_data(const CRYPTO_EX_DATA *ad, int idx)\n\t{\n\tif (ad->sk == NULL)\n\t\treturn(0);\n\telse if (idx >= sk_num(ad->sk))\n\t\treturn(0);\n\telse\n\t\treturn(sk_value(ad->sk,idx));\n\t}', 'int sk_num(const STACK *st)\n{\n\tif(st == NULL) return -1;\n\treturn st->num;\n}', 'char *sk_value(const STACK *st, int i)\n{\n\tif(!st || (i < 0) || (i >= st->num)) return NULL;\n\treturn st->data[i];\n}']