crypto/x509/x509_lu.c:567: error: NULL_DEREFERENCE
  pointer `obj` last assigned on line 566 could be null and is dereferenced at line 567, column 13.
Showing all 48 steps of the trace


crypto/x509/x509_lu.c:537:1: start of procedure X509_STORE_get1_crls()
535.   }
536.   
537. > STACK_OF(X509_CRL) *X509_STORE_get1_crls(X509_STORE_CTX *ctx, X509_NAME *nm)
538.   {
539.       int i, idx, cnt;

crypto/x509/x509_lu.c:543:5: 
541.       X509_CRL *x;
542.       X509_OBJECT *obj, xobj;
543. >     sk = sk_X509_CRL_new_null();
544.       CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);
545.       /* Check cache first */

crypto/stack/stack.c:145:1: start of procedure sk_new_null()
  143.   }
  144.   
  145. > _STACK *sk_new_null(void)
  146.   {
  147.       return sk_new((int (*)(const void *, const void *))0);

crypto/stack/stack.c:147:5: Skipping sk_new(): empty list of specs
  145.   _STACK *sk_new_null(void)
  146.   {
  147.       return sk_new((int (*)(const void *, const void *))0);
             ^
  148.   }
  149.   

crypto/stack/stack.c:148:1: return from a call to sk_new_null
  146.   {
  147.       return sk_new((int (*)(const void *, const void *))0);
  148. > }
  149.   
  150.   _STACK *sk_new(int (*c) (const void *, const void *))

crypto/x509/x509_lu.c:544:5: 
542.       X509_OBJECT *obj, xobj;
543.       sk = sk_X509_CRL_new_null();
544. >     CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);
545.       /* Check cache first */
546.       idx = x509_object_idx_cnt(ctx->ctx->objs, X509_LU_CRL, nm, &cnt);

crypto/lock.c:417:1: start of procedure CRYPTO_lock()
  415.   }
  416.   
  417. > void CRYPTO_lock(int mode, int type, const char *file, int line)
  418.   {
  419.   #ifdef LOCK_DEBUG

crypto/lock.c:444:9: Taking false branch
  442.       }
  443.   #endif
  444.       if (type < 0) {
                 ^
  445.           if (dynlock_lock_callback != NULL) {
  446.               struct CRYPTO_dynlock_value *pointer

crypto/lock.c:455:16: Taking true branch
  453.               CRYPTO_destroy_dynlockid(type);
  454.           }
  455.       } else if (locking_callback != NULL)
                        ^
  456.           locking_callback(mode, type, file, line);
  457.   }

crypto/lock.c:456:9: Skipping __function_pointer__(): unresolved function pointer
  454.           }
  455.       } else if (locking_callback != NULL)
  456.           locking_callback(mode, type, file, line);
                 ^
  457.   }
  458.   

crypto/lock.c:444:5: 
  442.       }
  443.   #endif
  444. >     if (type < 0) {
  445.           if (dynlock_lock_callback != NULL) {
  446.               struct CRYPTO_dynlock_value *pointer

crypto/lock.c:457:1: return from a call to CRYPTO_lock
  455.       } else if (locking_callback != NULL)
  456.           locking_callback(mode, type, file, line);
  457. > }
  458.   
  459.   int CRYPTO_add_lock(int *pointer, int amount, int type, const char *file,

crypto/x509/x509_lu.c:546:5: Skipping x509_object_idx_cnt(): empty list of specs
544.       CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);
545.       /* Check cache first */
546.       idx = x509_object_idx_cnt(ctx->ctx->objs, X509_LU_CRL, nm, &cnt);
           ^
547.   
548.       /*

crypto/x509/x509_lu.c:551:5: 
549.        * Always do lookup to possibly add new CRLs to cache
550.        */
551. >     CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
552.       if (!X509_STORE_get_by_subject(ctx, X509_LU_CRL, nm, &xobj)) {
553.           sk_X509_CRL_free(sk);

crypto/lock.c:417:1: start of procedure CRYPTO_lock()
  415.   }
  416.   
  417. > void CRYPTO_lock(int mode, int type, const char *file, int line)
  418.   {
  419.   #ifdef LOCK_DEBUG

crypto/lock.c:444:9: Taking false branch
  442.       }
  443.   #endif
  444.       if (type < 0) {
                 ^
  445.           if (dynlock_lock_callback != NULL) {
  446.               struct CRYPTO_dynlock_value *pointer

crypto/lock.c:455:16: Taking true branch
  453.               CRYPTO_destroy_dynlockid(type);
  454.           }
  455.       } else if (locking_callback != NULL)
                        ^
  456.           locking_callback(mode, type, file, line);
  457.   }

crypto/lock.c:456:9: Skipping __function_pointer__(): unresolved function pointer
  454.           }
  455.       } else if (locking_callback != NULL)
  456.           locking_callback(mode, type, file, line);
                 ^
  457.   }
  458.   

crypto/lock.c:444:5: 
  442.       }
  443.   #endif
  444. >     if (type < 0) {
  445.           if (dynlock_lock_callback != NULL) {
  446.               struct CRYPTO_dynlock_value *pointer

crypto/lock.c:457:1: return from a call to CRYPTO_lock
  455.       } else if (locking_callback != NULL)
  456.           locking_callback(mode, type, file, line);
  457. > }
  458.   
  459.   int CRYPTO_add_lock(int *pointer, int amount, int type, const char *file,

crypto/x509/x509_lu.c:552:10: Taking false branch
550.        */
551.       CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
552.       if (!X509_STORE_get_by_subject(ctx, X509_LU_CRL, nm, &xobj)) {
                ^
553.           sk_X509_CRL_free(sk);
554.           return NULL;

crypto/x509/x509_lu.c:556:5: 
554.           return NULL;
555.       }
556. >     X509_OBJECT_free_contents(&xobj);
557.       CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);
558.       idx = x509_object_idx_cnt(ctx->ctx->objs, X509_LU_CRL, nm, &cnt);

crypto/x509/x509_lu.c:417:1: start of procedure X509_OBJECT_free_contents()
  415.   }
  416.   
  417. > void X509_OBJECT_free_contents(X509_OBJECT *a)
  418.   {
  419.       if (!a)

crypto/x509/x509_lu.c:419:10: Taking false branch
  417.   void X509_OBJECT_free_contents(X509_OBJECT *a)
  418.   {
  419.       if (!a)
                  ^
  420.           return;
  421.       switch (a->type) {

crypto/x509/x509_lu.c:421:5: 
  419.       if (!a)
  420.           return;
  421. >     switch (a->type) {
  422.       default:
  423.           break;

crypto/x509/x509_lu.c:424:5: Switch condition is false. Skipping switch case
  422.       default:
  423.           break;
  424.       case X509_LU_X509:
             ^
  425.           X509_free(a->data.x509);
  426.           break;

crypto/x509/x509_lu.c:427:5: Switch condition is false. Skipping switch case
  425.           X509_free(a->data.x509);
  426.           break;
  427.       case X509_LU_CRL:
             ^
  428.           X509_CRL_free(a->data.crl);
  429.           break;

crypto/x509/x509_lu.c:431:1: return from a call to X509_OBJECT_free_contents
  429.           break;
  430.       }
  431. > }
  432.   
  433.   static int x509_object_idx_cnt(STACK_OF(X509_OBJECT) *h, int type,

crypto/x509/x509_lu.c:557:5: 
555.       }
556.       X509_OBJECT_free_contents(&xobj);
557. >     CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);
558.       idx = x509_object_idx_cnt(ctx->ctx->objs, X509_LU_CRL, nm, &cnt);
559.       if (idx < 0) {

crypto/lock.c:417:1: start of procedure CRYPTO_lock()
  415.   }
  416.   
  417. > void CRYPTO_lock(int mode, int type, const char *file, int line)
  418.   {
  419.   #ifdef LOCK_DEBUG

crypto/lock.c:444:9: Taking false branch
  442.       }
  443.   #endif
  444.       if (type < 0) {
                 ^
  445.           if (dynlock_lock_callback != NULL) {
  446.               struct CRYPTO_dynlock_value *pointer

crypto/lock.c:455:16: Taking true branch
  453.               CRYPTO_destroy_dynlockid(type);
  454.           }
  455.       } else if (locking_callback != NULL)
                        ^
  456.           locking_callback(mode, type, file, line);
  457.   }

crypto/lock.c:456:9: Skipping __function_pointer__(): unresolved function pointer
  454.           }
  455.       } else if (locking_callback != NULL)
  456.           locking_callback(mode, type, file, line);
                 ^
  457.   }
  458.   

crypto/lock.c:444:5: 
  442.       }
  443.   #endif
  444. >     if (type < 0) {
  445.           if (dynlock_lock_callback != NULL) {
  446.               struct CRYPTO_dynlock_value *pointer

crypto/lock.c:457:1: return from a call to CRYPTO_lock
  455.       } else if (locking_callback != NULL)
  456.           locking_callback(mode, type, file, line);
  457. > }
  458.   
  459.   int CRYPTO_add_lock(int *pointer, int amount, int type, const char *file,

crypto/x509/x509_lu.c:558:5: Skipping x509_object_idx_cnt(): empty list of specs
556.       X509_OBJECT_free_contents(&xobj);
557.       CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);
558.       idx = x509_object_idx_cnt(ctx->ctx->objs, X509_LU_CRL, nm, &cnt);
           ^
559.       if (idx < 0) {
560.           CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);

crypto/x509/x509_lu.c:559:9: Taking false branch
557.       CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);
558.       idx = x509_object_idx_cnt(ctx->ctx->objs, X509_LU_CRL, nm, &cnt);
559.       if (idx < 0) {
               ^
560.           CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
561.           sk_X509_CRL_free(sk);

crypto/x509/x509_lu.c:565:10: 
563.       }
564.   
565. >     for (i = 0; i < cnt; i++, idx++) {
566.           obj = sk_X509_OBJECT_value(ctx->ctx->objs, idx);
567.           x = obj->data.crl;

crypto/x509/x509_lu.c:565:17: Loop condition is true. Entering loop body
563.       }
564.   
565.       for (i = 0; i < cnt; i++, idx++) {
                       ^
566.           obj = sk_X509_OBJECT_value(ctx->ctx->objs, idx);
567.           x = obj->data.crl;

crypto/x509/x509_lu.c:566:15: Condition is true
564.   
565.       for (i = 0; i < cnt; i++, idx++) {
566.           obj = sk_X509_OBJECT_value(ctx->ctx->objs, idx);
                     ^
567.           x = obj->data.crl;
568.           X509_CRL_up_ref(x);

crypto/x509/x509_lu.c:566:9: 
564.   
565.       for (i = 0; i < cnt; i++, idx++) {
566. >         obj = sk_X509_OBJECT_value(ctx->ctx->objs, idx);
567.           x = obj->data.crl;
568.           X509_CRL_up_ref(x);

crypto/stack/stack.c:328:1: start of procedure sk_value()
  326.   }
  327.   
  328. > void *sk_value(const _STACK *st, int i)
  329.   {
  330.       if (!st || (i < 0) || (i >= st->num))

crypto/stack/stack.c:330:10: Taking false branch
  328.   void *sk_value(const _STACK *st, int i)
  329.   {
  330.       if (!st || (i < 0) || (i >= st->num))
                  ^
  331.           return NULL;
  332.       return st->data[i];

crypto/stack/stack.c:330:17: Taking false branch
  328.   void *sk_value(const _STACK *st, int i)
  329.   {
  330.       if (!st || (i < 0) || (i >= st->num))
                         ^
  331.           return NULL;
  332.       return st->data[i];

crypto/stack/stack.c:330:28: Taking true branch
  328.   void *sk_value(const _STACK *st, int i)
  329.   {
  330.       if (!st || (i < 0) || (i >= st->num))
                                    ^
  331.           return NULL;
  332.       return st->data[i];

crypto/stack/stack.c:331:9: 
  329.   {
  330.       if (!st || (i < 0) || (i >= st->num))
  331. >         return NULL;
  332.       return st->data[i];
  333.   }

crypto/stack/stack.c:333:1: return from a call to sk_value
  331.           return NULL;
  332.       return st->data[i];
  333. > }
  334.   
  335.   void *sk_set(_STACK *st, int i, void *value)

crypto/x509/x509_lu.c:567:9: 
565.       for (i = 0; i < cnt; i++, idx++) {
566.           obj = sk_X509_OBJECT_value(ctx->ctx->objs, idx);
567. >         x = obj->data.crl;
568.           X509_CRL_up_ref(x);
569.           if (!sk_X509_CRL_push(sk, x)) {

STACK_OF(X509_CRL) *X509_STORE_get1_crls(X509_STORE_CTX *ctx, X509_NAME *nm)
{
    int i, idx, cnt;
    STACK_OF(X509_CRL) *sk;
    X509_CRL *x;
    X509_OBJECT *obj, xobj;
    sk = sk_X509_CRL_new_null();
    CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);
    idx = x509_object_idx_cnt(ctx->ctx->objs, X509_LU_CRL, nm, &cnt);
    CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
    if (!X509_STORE_get_by_subject(ctx, X509_LU_CRL, nm, &xobj)) {
        sk_X509_CRL_free(sk);
        return NULL;
    }
    X509_OBJECT_free_contents(&xobj);
    CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);
    idx = x509_object_idx_cnt(ctx->ctx->objs, X509_LU_CRL, nm, &cnt);
    if (idx < 0) {
        CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
        sk_X509_CRL_free(sk);
        return NULL;
    }
    for (i = 0; i < cnt; i++, idx++) {
        obj = sk_X509_OBJECT_value(ctx->ctx->objs, idx);
        x = obj->data.crl;
        X509_CRL_up_ref(x);
        if (!sk_X509_CRL_push(sk, x)) {
            CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
            X509_CRL_free(x);
            sk_X509_CRL_pop_free(sk, X509_CRL_free);
            return NULL;
        }
    }
    CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
    return sk;
}
['STACK_OF(X509_CRL) *X509_STORE_get1_crls(X509_STORE_CTX *ctx, X509_NAME *nm)\n{\n    int i, idx, cnt;\n    STACK_OF(X509_CRL) *sk;\n    X509_CRL *x;\n    X509_OBJECT *obj, xobj;\n    sk = sk_X509_CRL_new_null();\n    CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);\n    idx = x509_object_idx_cnt(ctx->ctx->objs, X509_LU_CRL, nm, &cnt);\n    CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);\n    if (!X509_STORE_get_by_subject(ctx, X509_LU_CRL, nm, &xobj)) {\n        sk_X509_CRL_free(sk);\n        return NULL;\n    }\n    X509_OBJECT_free_contents(&xobj);\n    CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);\n    idx = x509_object_idx_cnt(ctx->ctx->objs, X509_LU_CRL, nm, &cnt);\n    if (idx < 0) {\n        CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);\n        sk_X509_CRL_free(sk);\n        return NULL;\n    }\n    for (i = 0; i < cnt; i++, idx++) {\n        obj = sk_X509_OBJECT_value(ctx->ctx->objs, idx);\n        x = obj->data.crl;\n        X509_CRL_up_ref(x);\n        if (!sk_X509_CRL_push(sk, x)) {\n            CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);\n            X509_CRL_free(x);\n            sk_X509_CRL_pop_free(sk, X509_CRL_free);\n            return NULL;\n        }\n    }\n    CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);\n    return sk;\n}', '_STACK *sk_new_null(void)\n{\n    return sk_new((int (*)(const void *, const void *))0);\n}', 'void CRYPTO_lock(int mode, int type, const char *file, int line)\n{\n#ifdef LOCK_DEBUG\n    {\n        CRYPTO_THREADID id;\n        char *rw_text, *operation_text;\n        if (mode & CRYPTO_LOCK)\n            operation_text = "lock  ";\n        else if (mode & CRYPTO_UNLOCK)\n            operation_text = "unlock";\n        else\n            operation_text = "ERROR ";\n        if (mode & CRYPTO_READ)\n            rw_text = "r";\n        else if (mode & CRYPTO_WRITE)\n            rw_text = "w";\n        else\n            rw_text = "ERROR";\n        CRYPTO_THREADID_current(&id);\n        fprintf(stderr, "lock:%08lx:(%s)%s %-18s %s:%d\\n",\n                CRYPTO_THREADID_hash(&id), rw_text, operation_text,\n                CRYPTO_get_lock_name(type), file, line);\n    }\n#endif\n    if (type < 0) {\n        if (dynlock_lock_callback != NULL) {\n            struct CRYPTO_dynlock_value *pointer\n                = CRYPTO_get_dynlock_value(type);\n            OPENSSL_assert(pointer != NULL);\n            dynlock_lock_callback(mode, pointer, file, line);\n            CRYPTO_destroy_dynlockid(type);\n        }\n    } else if (locking_callback != NULL)\n        locking_callback(mode, type, file, line);\n}', 'void X509_OBJECT_free_contents(X509_OBJECT *a)\n{\n    if (!a)\n        return;\n    switch (a->type) {\n    default:\n        break;\n    case X509_LU_X509:\n        X509_free(a->data.x509);\n        break;\n    case X509_LU_CRL:\n        X509_CRL_free(a->data.crl);\n        break;\n    }\n}', 'void *sk_value(const _STACK *st, int i)\n{\n    if (!st || (i < 0) || (i >= st->num))\n        return NULL;\n    return st->data[i];\n}']