apps/s_server.c:495: error: NULL_DEREFERENCE
  pointer `x` last assigned on line 494 could be null and is dereferenced by call to `X509_get1_ocsp()` at line 495, column 11.
Showing all 14 steps of the trace


apps/s_server.c:478:1: start of procedure get_ocsp_resp_from_responder()
476.    * them until they were considered "expired".
477.    */
478. > static int get_ocsp_resp_from_responder(SSL *s, tlsextstatusctx *srctx,
479.                                           OCSP_RESPONSE **resp)
480.   {

apps/s_server.c:481:5: 
479.                                           OCSP_RESPONSE **resp)
480.   {
481. >     char *host = NULL, *port = NULL, *path = NULL;
482.       int use_ssl;
483.       STACK_OF(OPENSSL_STRING) *aia = NULL;

apps/s_server.c:483:5: 
481.       char *host = NULL, *port = NULL, *path = NULL;
482.       int use_ssl;
483. >     STACK_OF(OPENSSL_STRING) *aia = NULL;
484.       X509 *x = NULL;
485.       X509_STORE_CTX *inctx = NULL;

apps/s_server.c:484:5: 
482.       int use_ssl;
483.       STACK_OF(OPENSSL_STRING) *aia = NULL;
484. >     X509 *x = NULL;
485.       X509_STORE_CTX *inctx = NULL;
486.       X509_OBJECT *obj;

apps/s_server.c:485:5: 
483.       STACK_OF(OPENSSL_STRING) *aia = NULL;
484.       X509 *x = NULL;
485. >     X509_STORE_CTX *inctx = NULL;
486.       X509_OBJECT *obj;
487.       OCSP_REQUEST *req = NULL;

apps/s_server.c:487:5: 
485.       X509_STORE_CTX *inctx = NULL;
486.       X509_OBJECT *obj;
487. >     OCSP_REQUEST *req = NULL;
488.       OCSP_CERTID *id = NULL;
489.       STACK_OF(X509_EXTENSION) *exts;

apps/s_server.c:488:5: 
486.       X509_OBJECT *obj;
487.       OCSP_REQUEST *req = NULL;
488. >     OCSP_CERTID *id = NULL;
489.       STACK_OF(X509_EXTENSION) *exts;
490.       int ret = SSL_TLSEXT_ERR_NOACK;

apps/s_server.c:490:5: 
488.       OCSP_CERTID *id = NULL;
489.       STACK_OF(X509_EXTENSION) *exts;
490. >     int ret = SSL_TLSEXT_ERR_NOACK;
491.       int i;
492.   

apps/s_server.c:494:5: 
492.   
493.       /* Build up OCSP query from server certificate */
494. >     x = SSL_get_certificate(s);
495.       aia = X509_get1_ocsp(x);
496.       if (aia) {

ssl/ssl_lib.c:3451:1: start of procedure SSL_get_certificate()
  3449.   }
  3450.   
  3451. > X509 *SSL_get_certificate(const SSL *s)
  3452.   {
  3453.       if (s->cert != NULL)

ssl/ssl_lib.c:3453:9: Taking false branch
  3451.   X509 *SSL_get_certificate(const SSL *s)
  3452.   {
  3453.       if (s->cert != NULL)
                  ^
  3454.           return (s->cert->key->x509);
  3455.       else

ssl/ssl_lib.c:3456:9: 
  3454.           return (s->cert->key->x509);
  3455.       else
  3456. >         return (NULL);
  3457.   }
  3458.   

ssl/ssl_lib.c:3457:1: return from a call to SSL_get_certificate
  3455.       else
  3456.           return (NULL);
  3457. > }
  3458.   
  3459.   EVP_PKEY *SSL_get_privatekey(const SSL *s)

apps/s_server.c:495:5: 
493.       /* Build up OCSP query from server certificate */
494.       x = SSL_get_certificate(s);
495. >     aia = X509_get1_ocsp(x);
496.       if (aia) {
497.           if (!OCSP_parse_url(sk_OPENSSL_STRING_value(aia, 0),

static int get_ocsp_resp_from_responder(SSL *s, tlsextstatusctx *srctx,
                                        OCSP_RESPONSE **resp)
{
    char *host = NULL, *port = NULL, *path = NULL;
    int use_ssl;
    STACK_OF(OPENSSL_STRING) *aia = NULL;
    X509 *x = NULL;
    X509_STORE_CTX *inctx = NULL;
    X509_OBJECT *obj;
    OCSP_REQUEST *req = NULL;
    OCSP_CERTID *id = NULL;
    STACK_OF(X509_EXTENSION) *exts;
    int ret = SSL_TLSEXT_ERR_NOACK;
    int i;
    x = SSL_get_certificate(s);
    aia = X509_get1_ocsp(x);
    if (aia) {
        if (!OCSP_parse_url(sk_OPENSSL_STRING_value(aia, 0),
                            &host, &port, &path, &use_ssl)) {
            BIO_puts(bio_err, "cert_status: can't parse AIA URL\n");
            goto err;
        }
        if (srctx->verbose)
            BIO_printf(bio_err, "cert_status: AIA URL: %s\n",
                       sk_OPENSSL_STRING_value(aia, 0));
    } else {
        if (!srctx->host) {
            BIO_puts(bio_err,
                     "cert_status: no AIA and no default responder URL\n");
            goto done;
        }
        host = srctx->host;
        path = srctx->path;
        port = srctx->port;
        use_ssl = srctx->use_ssl;
    }
    inctx = X509_STORE_CTX_new();
    if (inctx == NULL)
        goto err;
    if (!X509_STORE_CTX_init(inctx,
                             SSL_CTX_get_cert_store(SSL_get_SSL_CTX(s)),
                             NULL, NULL))
        goto err;
    obj = X509_STORE_CTX_get_obj_by_subject(inctx, X509_LU_X509,
                                            X509_get_issuer_name(x));
    if (obj == NULL) {
        BIO_puts(bio_err, "cert_status: Can't retrieve issuer certificate.\n");
        goto done;
    }
    id = OCSP_cert_to_id(NULL, x, X509_OBJECT_get0_X509(obj));
    X509_OBJECT_free(obj);
    if (!id)
        goto err;
    req = OCSP_REQUEST_new();
    if (req == NULL)
        goto err;
    if (!OCSP_request_add0_id(req, id))
        goto err;
    id = NULL;
    SSL_get_tlsext_status_exts(s, &exts);
    for (i = 0; i < sk_X509_EXTENSION_num(exts); i++) {
        X509_EXTENSION *ext = sk_X509_EXTENSION_value(exts, i);
        if (!OCSP_REQUEST_add_ext(req, ext, -1))
            goto err;
    }
    *resp = process_responder(req, host, path, port, use_ssl, NULL,
                             srctx->timeout);
    if (*resp == NULL) {
        BIO_puts(bio_err, "cert_status: error querying responder\n");
        goto done;
    }
    ret = SSL_TLSEXT_ERR_OK;
    goto done;
 err:
    ret = SSL_TLSEXT_ERR_ALERT_FATAL;
 done:
    if (aia != NULL) {
        OPENSSL_free(host);
        OPENSSL_free(path);
        OPENSSL_free(port);
        X509_email_free(aia);
    }
    OCSP_CERTID_free(id);
    OCSP_REQUEST_free(req);
    X509_STORE_CTX_free(inctx);
    return ret;
}
['static int get_ocsp_resp_from_responder(SSL *s, tlsextstatusctx *srctx,\n                                        OCSP_RESPONSE **resp)\n{\n    char *host = NULL, *port = NULL, *path = NULL;\n    int use_ssl;\n    STACK_OF(OPENSSL_STRING) *aia = NULL;\n    X509 *x = NULL;\n    X509_STORE_CTX *inctx = NULL;\n    X509_OBJECT *obj;\n    OCSP_REQUEST *req = NULL;\n    OCSP_CERTID *id = NULL;\n    STACK_OF(X509_EXTENSION) *exts;\n    int ret = SSL_TLSEXT_ERR_NOACK;\n    int i;\n    x = SSL_get_certificate(s);\n    aia = X509_get1_ocsp(x);\n    if (aia) {\n        if (!OCSP_parse_url(sk_OPENSSL_STRING_value(aia, 0),\n                            &host, &port, &path, &use_ssl)) {\n            BIO_puts(bio_err, "cert_status: can\'t parse AIA URL\\n");\n            goto err;\n        }\n        if (srctx->verbose)\n            BIO_printf(bio_err, "cert_status: AIA URL: %s\\n",\n                       sk_OPENSSL_STRING_value(aia, 0));\n    } else {\n        if (!srctx->host) {\n            BIO_puts(bio_err,\n                     "cert_status: no AIA and no default responder URL\\n");\n            goto done;\n        }\n        host = srctx->host;\n        path = srctx->path;\n        port = srctx->port;\n        use_ssl = srctx->use_ssl;\n    }\n    inctx = X509_STORE_CTX_new();\n    if (inctx == NULL)\n        goto err;\n    if (!X509_STORE_CTX_init(inctx,\n                             SSL_CTX_get_cert_store(SSL_get_SSL_CTX(s)),\n                             NULL, NULL))\n        goto err;\n    obj = X509_STORE_CTX_get_obj_by_subject(inctx, X509_LU_X509,\n                                            X509_get_issuer_name(x));\n    if (obj == NULL) {\n        BIO_puts(bio_err, "cert_status: Can\'t retrieve issuer certificate.\\n");\n        goto done;\n    }\n    id = OCSP_cert_to_id(NULL, x, X509_OBJECT_get0_X509(obj));\n    X509_OBJECT_free(obj);\n    if (!id)\n        goto err;\n    req = OCSP_REQUEST_new();\n    if (req == NULL)\n        goto err;\n    if (!OCSP_request_add0_id(req, id))\n        goto err;\n    id = NULL;\n    SSL_get_tlsext_status_exts(s, &exts);\n    for (i = 0; i < sk_X509_EXTENSION_num(exts); i++) {\n        X509_EXTENSION *ext = sk_X509_EXTENSION_value(exts, i);\n        if (!OCSP_REQUEST_add_ext(req, ext, -1))\n            goto err;\n    }\n    *resp = process_responder(req, host, path, port, use_ssl, NULL,\n                             srctx->timeout);\n    if (*resp == NULL) {\n        BIO_puts(bio_err, "cert_status: error querying responder\\n");\n        goto done;\n    }\n    ret = SSL_TLSEXT_ERR_OK;\n    goto done;\n err:\n    ret = SSL_TLSEXT_ERR_ALERT_FATAL;\n done:\n    if (aia != NULL) {\n        OPENSSL_free(host);\n        OPENSSL_free(path);\n        OPENSSL_free(port);\n        X509_email_free(aia);\n    }\n    OCSP_CERTID_free(id);\n    OCSP_REQUEST_free(req);\n    X509_STORE_CTX_free(inctx);\n    return ret;\n}', 'X509 *SSL_get_certificate(const SSL *s)\n{\n    if (s->cert != NULL)\n        return (s->cert->key->x509);\n    else\n        return (NULL);\n}']