crypto/x509/x509_lu.c:660: error: NULL_DEREFERENCE
  pointer `pobj` last assigned on line 658 could be null and is dereferenced at line 660, column 7.
Showing all 33 steps of the trace


crypto/x509/x509_lu.c:620:1: start of procedure X509_STORE_CTX_get1_issuer()
618.   
619.   
620. > int X509_STORE_CTX_get1_issuer(X509 **issuer, X509_STORE_CTX *ctx, X509 *x)
621.   {
622.   	X509_NAME *xn;

crypto/x509/x509_lu.c:625:2: 
623.   	X509_OBJECT obj, *pobj;
624.   	int i, ok, idx;
625. > 	xn=X509_get_issuer_name(x);
626.   	ok=X509_STORE_get_by_subject(ctx,X509_LU_X509,xn,&obj);
627.   	if (ok != X509_LU_X509)

crypto/x509/x509_cmp.c:126:1: start of procedure X509_get_issuer_name()
  124.   #endif
  125.   
  126. > X509_NAME *X509_get_issuer_name(X509 *a)
  127.   	{
  128.   	return(a->cert_info->issuer);

crypto/x509/x509_cmp.c:128:2: 
  126.   X509_NAME *X509_get_issuer_name(X509 *a)
  127.   	{
  128. > 	return(a->cert_info->issuer);
  129.   	}
  130.   

crypto/x509/x509_cmp.c:129:2: return from a call to X509_get_issuer_name
  127.   	{
  128.   	return(a->cert_info->issuer);
  129.   	}
          ^
  130.   
  131.   unsigned long X509_issuer_name_hash(X509 *x)

crypto/x509/x509_lu.c:626:2: Skipping X509_STORE_get_by_subject(): empty list of specs
624.   	int i, ok, idx;
625.   	xn=X509_get_issuer_name(x);
626.   	ok=X509_STORE_get_by_subject(ctx,X509_LU_X509,xn,&obj);
        ^
627.   	if (ok != X509_LU_X509)
628.   		{

crypto/x509/x509_lu.c:627:6: Taking false branch
625.   	xn=X509_get_issuer_name(x);
626.   	ok=X509_STORE_get_by_subject(ctx,X509_LU_X509,xn,&obj);
627.   	if (ok != X509_LU_X509)
            ^
628.   		{
629.   		if (ok == X509_LU_RETRY)

crypto/x509/x509_lu.c:644:6: Taking false branch
642.   		}
643.   	/* If certificate matches all OK */
644.   	if (ctx->check_issued(ctx, x, obj.data.x509))
            ^
645.   		{
646.   		*issuer = obj.data.x509;

crypto/x509/x509_lu.c:649:2: 
647.   		return 1;
648.   		}
649. > 	X509_OBJECT_free_contents(&obj);
650.   	/* Else find index of first matching cert */
651.   	idx = X509_OBJECT_idx_by_subject(ctx->ctx->objs, X509_LU_X509, xn);

crypto/x509/x509_lu.c:406:1: start of procedure X509_OBJECT_free_contents()
  404.   	}
  405.   
  406. > void X509_OBJECT_free_contents(X509_OBJECT *a)
  407.   	{
  408.   	switch (a->type)

crypto/x509/x509_lu.c:408:2: 
  406.   void X509_OBJECT_free_contents(X509_OBJECT *a)
  407.   	{
  408. > 	switch (a->type)
  409.   		{
  410.   	case X509_LU_X509:

crypto/x509/x509_lu.c:410:2: Switch condition is false. Skipping switch case
  408.   	switch (a->type)
  409.   		{
  410.   	case X509_LU_X509:
          ^
  411.   		X509_free(a->data.x509);
  412.   		break;

crypto/x509/x509_lu.c:413:2: Switch condition is false. Skipping switch case
  411.   		X509_free(a->data.x509);
  412.   		break;
  413.   	case X509_LU_CRL:
          ^
  414.   		X509_CRL_free(a->data.crl);
  415.   		break;

crypto/x509/x509_lu.c:417:2: return from a call to X509_OBJECT_free_contents
  415.   		break;
  416.   		}
  417.   	}
          ^
  418.   
  419.   static int x509_object_idx_cnt(STACK_OF(X509_OBJECT) *h, int type,

crypto/x509/x509_lu.c:651:2: 
649.   	X509_OBJECT_free_contents(&obj);
650.   	/* Else find index of first matching cert */
651. > 	idx = X509_OBJECT_idx_by_subject(ctx->ctx->objs, X509_LU_X509, xn);
652.   	/* This shouldn't normally happen since we already have one match */
653.   	if (idx == -1) return 0;

crypto/x509/x509_lu.c:466:1: start of procedure X509_OBJECT_idx_by_subject()
  464.   
  465.   
  466. > int X509_OBJECT_idx_by_subject(STACK_OF(X509_OBJECT) *h, int type,
  467.   	     X509_NAME *name)
  468.   	{

crypto/x509/x509_lu.c:469:2: Skipping x509_object_idx_cnt(): empty list of specs
  467.   	     X509_NAME *name)
  468.   	{
  469.   	return x509_object_idx_cnt(h, type, name, NULL);
          ^
  470.   	}
  471.   

crypto/x509/x509_lu.c:470:2: return from a call to X509_OBJECT_idx_by_subject
  468.   	{
  469.   	return x509_object_idx_cnt(h, type, name, NULL);
  470.   	}
          ^
  471.   
  472.   X509_OBJECT *X509_OBJECT_retrieve_by_subject(STACK_OF(X509_OBJECT) *h, int type,

crypto/x509/x509_lu.c:653:6: Taking false branch
651.   	idx = X509_OBJECT_idx_by_subject(ctx->ctx->objs, X509_LU_X509, xn);
652.   	/* This shouldn't normally happen since we already have one match */
653.   	if (idx == -1) return 0;
            ^
654.   
655.   	/* Look through all matching certificates for a suitable issuer */

crypto/x509/x509_lu.c:656:7: 
654.   
655.   	/* Look through all matching certificates for a suitable issuer */
656. > 	for (i = idx; i < sk_X509_OBJECT_num(ctx->ctx->objs); i++)
657.   		{
658.   		pobj = sk_X509_OBJECT_value(ctx->ctx->objs, i);

crypto/x509/x509_lu.c:656:16: 
654.   
655.   	/* Look through all matching certificates for a suitable issuer */
656. > 	for (i = idx; i < sk_X509_OBJECT_num(ctx->ctx->objs); i++)
657.   		{
658.   		pobj = sk_X509_OBJECT_value(ctx->ctx->objs, i);

crypto/stack/stack.c:301:1: start of procedure sk_num()
  299.   	}
  300.   
  301. > int sk_num(const STACK *st)
  302.   {
  303.   	if(st == NULL) return -1;

crypto/stack/stack.c:303:5: Taking false branch
  301.   int sk_num(const STACK *st)
  302.   {
  303.   	if(st == NULL) return -1;
             ^
  304.   	return st->num;
  305.   }

crypto/stack/stack.c:304:2: 
  302.   {
  303.   	if(st == NULL) return -1;
  304. > 	return st->num;
  305.   }
  306.   

crypto/stack/stack.c:305:1: return from a call to sk_num
  303.   	if(st == NULL) return -1;
  304.   	return st->num;
  305. > }
  306.   
  307.   char *sk_value(const STACK *st, int i)

crypto/x509/x509_lu.c:656:16: Loop condition is true. Entering loop body
654.   
655.   	/* Look through all matching certificates for a suitable issuer */
656.   	for (i = idx; i < sk_X509_OBJECT_num(ctx->ctx->objs); i++)
                      ^
657.   		{
658.   		pobj = sk_X509_OBJECT_value(ctx->ctx->objs, i);

crypto/x509/x509_lu.c:658:3: 
656.   	for (i = idx; i < sk_X509_OBJECT_num(ctx->ctx->objs); i++)
657.   		{
658. > 		pobj = sk_X509_OBJECT_value(ctx->ctx->objs, i);
659.   		/* See if we've ran out of matches */
660.   		if (pobj->type != X509_LU_X509) return 0;

crypto/stack/stack.c:307:1: start of procedure sk_value()
  305.   }
  306.   
  307. > char *sk_value(const STACK *st, int i)
  308.   {
  309.   	if(!st || (i < 0) || (i >= st->num)) return NULL;

crypto/stack/stack.c:309:6: Taking false branch
  307.   char *sk_value(const STACK *st, int i)
  308.   {
  309.   	if(!st || (i < 0) || (i >= st->num)) return NULL;
              ^
  310.   	return st->data[i];
  311.   }

crypto/stack/stack.c:309:13: Taking true branch
  307.   char *sk_value(const STACK *st, int i)
  308.   {
  309.   	if(!st || (i < 0) || (i >= st->num)) return NULL;
                     ^
  310.   	return st->data[i];
  311.   }

crypto/stack/stack.c:309:39: 
  307.   char *sk_value(const STACK *st, int i)
  308.   {
  309. > 	if(!st || (i < 0) || (i >= st->num)) return NULL;
  310.   	return st->data[i];
  311.   }

crypto/stack/stack.c:311:1: return from a call to sk_value
  309.   	if(!st || (i < 0) || (i >= st->num)) return NULL;
  310.   	return st->data[i];
  311. > }
  312.   
  313.   char *sk_set(STACK *st, int i, char *value)

crypto/x509/x509_lu.c:660:7: 
658.   		pobj = sk_X509_OBJECT_value(ctx->ctx->objs, i);
659.   		/* See if we've ran out of matches */
660. > 		if (pobj->type != X509_LU_X509) return 0;
661.   		if (X509_NAME_cmp(xn, X509_get_subject_name(pobj->data.x509))) return 0;
662.   		if (ctx->check_issued(ctx, x, pobj->data.x509))

int X509_STORE_CTX_get1_issuer(X509 **issuer, X509_STORE_CTX *ctx, X509 *x)
{
	X509_NAME *xn;
	X509_OBJECT obj, *pobj;
	int i, ok, idx;
	xn=X509_get_issuer_name(x);
	ok=X509_STORE_get_by_subject(ctx,X509_LU_X509,xn,&obj);
	if (ok != X509_LU_X509)
		{
		if (ok == X509_LU_RETRY)
			{
			X509_OBJECT_free_contents(&obj);
			X509err(X509_F_X509_STORE_CTX_GET1_ISSUER,X509_R_SHOULD_RETRY);
			return -1;
			}
		else if (ok != X509_LU_FAIL)
			{
			X509_OBJECT_free_contents(&obj);
			return -1;
			}
		return 0;
		}
	if (ctx->check_issued(ctx, x, obj.data.x509))
		{
		*issuer = obj.data.x509;
		return 1;
		}
	X509_OBJECT_free_contents(&obj);
	idx = X509_OBJECT_idx_by_subject(ctx->ctx->objs, X509_LU_X509, xn);
	if (idx == -1) return 0;
	for (i = idx; i < sk_X509_OBJECT_num(ctx->ctx->objs); i++)
		{
		pobj = sk_X509_OBJECT_value(ctx->ctx->objs, i);
		if (pobj->type != X509_LU_X509) return 0;
		if (X509_NAME_cmp(xn, X509_get_subject_name(pobj->data.x509))) return 0;
		if (ctx->check_issued(ctx, x, pobj->data.x509))
			{
			*issuer = pobj->data.x509;
			X509_OBJECT_up_ref_count(pobj);
			return 1;
			}
		}
	return 0;
}
['int X509_STORE_CTX_get1_issuer(X509 **issuer, X509_STORE_CTX *ctx, X509 *x)\n{\n\tX509_NAME *xn;\n\tX509_OBJECT obj, *pobj;\n\tint i, ok, idx;\n\txn=X509_get_issuer_name(x);\n\tok=X509_STORE_get_by_subject(ctx,X509_LU_X509,xn,&obj);\n\tif (ok != X509_LU_X509)\n\t\t{\n\t\tif (ok == X509_LU_RETRY)\n\t\t\t{\n\t\t\tX509_OBJECT_free_contents(&obj);\n\t\t\tX509err(X509_F_X509_STORE_CTX_GET1_ISSUER,X509_R_SHOULD_RETRY);\n\t\t\treturn -1;\n\t\t\t}\n\t\telse if (ok != X509_LU_FAIL)\n\t\t\t{\n\t\t\tX509_OBJECT_free_contents(&obj);\n\t\t\treturn -1;\n\t\t\t}\n\t\treturn 0;\n\t\t}\n\tif (ctx->check_issued(ctx, x, obj.data.x509))\n\t\t{\n\t\t*issuer = obj.data.x509;\n\t\treturn 1;\n\t\t}\n\tX509_OBJECT_free_contents(&obj);\n\tidx = X509_OBJECT_idx_by_subject(ctx->ctx->objs, X509_LU_X509, xn);\n\tif (idx == -1) return 0;\n\tfor (i = idx; i < sk_X509_OBJECT_num(ctx->ctx->objs); i++)\n\t\t{\n\t\tpobj = sk_X509_OBJECT_value(ctx->ctx->objs, i);\n\t\tif (pobj->type != X509_LU_X509) return 0;\n\t\tif (X509_NAME_cmp(xn, X509_get_subject_name(pobj->data.x509))) return 0;\n\t\tif (ctx->check_issued(ctx, x, pobj->data.x509))\n\t\t\t{\n\t\t\t*issuer = pobj->data.x509;\n\t\t\tX509_OBJECT_up_ref_count(pobj);\n\t\t\treturn 1;\n\t\t\t}\n\t\t}\n\treturn 0;\n}', 'X509_NAME *X509_get_issuer_name(X509 *a)\n\t{\n\treturn(a->cert_info->issuer);\n\t}', 'void X509_OBJECT_free_contents(X509_OBJECT *a)\n\t{\n\tswitch (a->type)\n\t\t{\n\tcase X509_LU_X509:\n\t\tX509_free(a->data.x509);\n\t\tbreak;\n\tcase X509_LU_CRL:\n\t\tX509_CRL_free(a->data.crl);\n\t\tbreak;\n\t\t}\n\t}', 'int X509_OBJECT_idx_by_subject(STACK_OF(X509_OBJECT) *h, int type,\n\t     X509_NAME *name)\n\t{\n\treturn x509_object_idx_cnt(h, type, name, NULL);\n\t}', 'int sk_num(const STACK *st)\n{\n\tif(st == NULL) return -1;\n\treturn st->num;\n}', 'char *sk_value(const STACK *st, int i)\n{\n\tif(!st || (i < 0) || (i >= st->num)) return NULL;\n\treturn st->data[i];\n}']