crypto/x509v3/v3_asid.c:334: error: NULL_DEREFERENCE
  pointer `a_min` last assigned on line 325 could be null and is dereferenced by call to `ASN1_INTEGER_cmp()` at line 334, column 13.
Showing all 62 steps of the trace


crypto/x509v3/v3_asid.c:300:1: start of procedure ASIdentifierChoice_is_canonical()
298.    * Check whether an ASIdentifierChoice is in canonical form.
299.    */
300. > static int ASIdentifierChoice_is_canonical(ASIdentifierChoice *choice)
301.   {
302.       ASN1_INTEGER *a_max_plus_one = NULL;

crypto/x509v3/v3_asid.c:302:5: 
300.   static int ASIdentifierChoice_is_canonical(ASIdentifierChoice *choice)
301.   {
302. >     ASN1_INTEGER *a_max_plus_one = NULL;
303.       BIGNUM *bn = NULL;
304.       int i, ret = 0;

crypto/x509v3/v3_asid.c:303:5: 
301.   {
302.       ASN1_INTEGER *a_max_plus_one = NULL;
303. >     BIGNUM *bn = NULL;
304.       int i, ret = 0;
305.   

crypto/x509v3/v3_asid.c:304:5: 
302.       ASN1_INTEGER *a_max_plus_one = NULL;
303.       BIGNUM *bn = NULL;
304. >     int i, ret = 0;
305.   
306.       /*

crypto/x509v3/v3_asid.c:309:9: Taking false branch
307.        * Empty element or inheritance is canonical.
308.        */
309.       if (choice == NULL || choice->type == ASIdentifierChoice_inherit)
               ^
310.           return 1;
311.   

crypto/x509v3/v3_asid.c:309:27: Taking false branch
307.        * Empty element or inheritance is canonical.
308.        */
309.       if (choice == NULL || choice->type == ASIdentifierChoice_inherit)
                                 ^
310.           return 1;
311.   

crypto/x509v3/v3_asid.c:315:9: Taking false branch
313.        * If not a list, or if empty list, it's broken.
314.        */
315.       if (choice->type != ASIdentifierChoice_asIdsOrRanges ||
               ^
316.           sk_ASIdOrRange_num(choice->u.asIdsOrRanges) == 0)
317.           return 0;

crypto/x509v3/v3_asid.c:316:9: Condition is true
314.        */
315.       if (choice->type != ASIdentifierChoice_asIdsOrRanges ||
316.           sk_ASIdOrRange_num(choice->u.asIdsOrRanges) == 0)
               ^
317.           return 0;
318.   

crypto/stack/stack.c:317:1: start of procedure sk_num()
  315.   }
  316.   
  317. > int sk_num(const _STACK *st)
  318.   {
  319.       if (st == NULL)

crypto/stack/stack.c:319:9: Taking false branch
  317.   int sk_num(const _STACK *st)
  318.   {
  319.       if (st == NULL)
                 ^
  320.           return -1;
  321.       return st->num;

crypto/stack/stack.c:321:5: 
  319.       if (st == NULL)
  320.           return -1;
  321. >     return st->num;
  322.   }
  323.   

crypto/stack/stack.c:322:1: return from a call to sk_num
  320.           return -1;
  321.       return st->num;
  322. > }
  323.   
  324.   void *sk_value(const _STACK *st, int i)

crypto/x509v3/v3_asid.c:316:9: Taking false branch
314.        */
315.       if (choice->type != ASIdentifierChoice_asIdsOrRanges ||
316.           sk_ASIdOrRange_num(choice->u.asIdsOrRanges) == 0)
               ^
317.           return 0;
318.   

crypto/x509v3/v3_asid.c:322:10: 
320.        * It's a list, check it.
321.        */
322. >     for (i = 0; i < sk_ASIdOrRange_num(choice->u.asIdsOrRanges) - 1; i++) {
323.           ASIdOrRange *a = sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i);
324.           ASIdOrRange *b = sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i + 1);

crypto/x509v3/v3_asid.c:322:21: Condition is true
320.        * It's a list, check it.
321.        */
322.       for (i = 0; i < sk_ASIdOrRange_num(choice->u.asIdsOrRanges) - 1; i++) {
                           ^
323.           ASIdOrRange *a = sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i);
324.           ASIdOrRange *b = sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i + 1);

crypto/x509v3/v3_asid.c:322:17: 
320.        * It's a list, check it.
321.        */
322. >     for (i = 0; i < sk_ASIdOrRange_num(choice->u.asIdsOrRanges) - 1; i++) {
323.           ASIdOrRange *a = sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i);
324.           ASIdOrRange *b = sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i + 1);

crypto/stack/stack.c:317:1: start of procedure sk_num()
  315.   }
  316.   
  317. > int sk_num(const _STACK *st)
  318.   {
  319.       if (st == NULL)

crypto/stack/stack.c:319:9: Taking false branch
  317.   int sk_num(const _STACK *st)
  318.   {
  319.       if (st == NULL)
                 ^
  320.           return -1;
  321.       return st->num;

crypto/stack/stack.c:321:5: 
  319.       if (st == NULL)
  320.           return -1;
  321. >     return st->num;
  322.   }
  323.   

crypto/stack/stack.c:322:1: return from a call to sk_num
  320.           return -1;
  321.       return st->num;
  322. > }
  323.   
  324.   void *sk_value(const _STACK *st, int i)

crypto/x509v3/v3_asid.c:322:17: Loop condition is true. Entering loop body
320.        * It's a list, check it.
321.        */
322.       for (i = 0; i < sk_ASIdOrRange_num(choice->u.asIdsOrRanges) - 1; i++) {
                       ^
323.           ASIdOrRange *a = sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i);
324.           ASIdOrRange *b = sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i + 1);

crypto/x509v3/v3_asid.c:323:26: Condition is true
321.        */
322.       for (i = 0; i < sk_ASIdOrRange_num(choice->u.asIdsOrRanges) - 1; i++) {
323.           ASIdOrRange *a = sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i);
                                ^
324.           ASIdOrRange *b = sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i + 1);
325.           ASN1_INTEGER *a_min = NULL, *a_max = NULL, *b_min = NULL, *b_max =

crypto/x509v3/v3_asid.c:323:9: 
321.        */
322.       for (i = 0; i < sk_ASIdOrRange_num(choice->u.asIdsOrRanges) - 1; i++) {
323. >         ASIdOrRange *a = sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i);
324.           ASIdOrRange *b = sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i + 1);
325.           ASN1_INTEGER *a_min = NULL, *a_max = NULL, *b_min = NULL, *b_max =

crypto/stack/stack.c:324:1: start of procedure sk_value()
  322.   }
  323.   
  324. > void *sk_value(const _STACK *st, int i)
  325.   {
  326.       if (!st || (i < 0) || (i >= st->num))

crypto/stack/stack.c:326:10: Taking false branch
  324.   void *sk_value(const _STACK *st, int i)
  325.   {
  326.       if (!st || (i < 0) || (i >= st->num))
                  ^
  327.           return NULL;
  328.       return st->data[i];

crypto/stack/stack.c:326:17: Taking false branch
  324.   void *sk_value(const _STACK *st, int i)
  325.   {
  326.       if (!st || (i < 0) || (i >= st->num))
                         ^
  327.           return NULL;
  328.       return st->data[i];

crypto/stack/stack.c:326:28: Taking false branch
  324.   void *sk_value(const _STACK *st, int i)
  325.   {
  326.       if (!st || (i < 0) || (i >= st->num))
                                    ^
  327.           return NULL;
  328.       return st->data[i];

crypto/stack/stack.c:328:5: 
  326.       if (!st || (i < 0) || (i >= st->num))
  327.           return NULL;
  328. >     return st->data[i];
  329.   }
  330.   

crypto/stack/stack.c:329:1: return from a call to sk_value
  327.           return NULL;
  328.       return st->data[i];
  329. > }
  330.   
  331.   void *sk_set(_STACK *st, int i, void *value)

crypto/x509v3/v3_asid.c:324:26: Condition is true
322.       for (i = 0; i < sk_ASIdOrRange_num(choice->u.asIdsOrRanges) - 1; i++) {
323.           ASIdOrRange *a = sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i);
324.           ASIdOrRange *b = sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i + 1);
                                ^
325.           ASN1_INTEGER *a_min = NULL, *a_max = NULL, *b_min = NULL, *b_max =
326.               NULL;

crypto/x509v3/v3_asid.c:324:9: 
322.       for (i = 0; i < sk_ASIdOrRange_num(choice->u.asIdsOrRanges) - 1; i++) {
323.           ASIdOrRange *a = sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i);
324. >         ASIdOrRange *b = sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i + 1);
325.           ASN1_INTEGER *a_min = NULL, *a_max = NULL, *b_min = NULL, *b_max =
326.               NULL;

crypto/stack/stack.c:324:1: start of procedure sk_value()
  322.   }
  323.   
  324. > void *sk_value(const _STACK *st, int i)
  325.   {
  326.       if (!st || (i < 0) || (i >= st->num))

crypto/stack/stack.c:326:10: Taking false branch
  324.   void *sk_value(const _STACK *st, int i)
  325.   {
  326.       if (!st || (i < 0) || (i >= st->num))
                  ^
  327.           return NULL;
  328.       return st->data[i];

crypto/stack/stack.c:326:17: Taking false branch
  324.   void *sk_value(const _STACK *st, int i)
  325.   {
  326.       if (!st || (i < 0) || (i >= st->num))
                         ^
  327.           return NULL;
  328.       return st->data[i];

crypto/stack/stack.c:326:28: Taking false branch
  324.   void *sk_value(const _STACK *st, int i)
  325.   {
  326.       if (!st || (i < 0) || (i >= st->num))
                                    ^
  327.           return NULL;
  328.       return st->data[i];

crypto/stack/stack.c:328:5: 
  326.       if (!st || (i < 0) || (i >= st->num))
  327.           return NULL;
  328. >     return st->data[i];
  329.   }
  330.   

crypto/stack/stack.c:329:1: return from a call to sk_value
  327.           return NULL;
  328.       return st->data[i];
  329. > }
  330.   
  331.   void *sk_set(_STACK *st, int i, void *value)

crypto/x509v3/v3_asid.c:325:9: 
323.           ASIdOrRange *a = sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i);
324.           ASIdOrRange *b = sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i + 1);
325. >         ASN1_INTEGER *a_min = NULL, *a_max = NULL, *b_min = NULL, *b_max =
326.               NULL;
327.   

crypto/x509v3/v3_asid.c:328:9: 
326.               NULL;
327.   
328. >         extract_min_max(a, &a_min, &a_max);
329.           extract_min_max(b, &b_min, &b_max);
330.   

crypto/x509v3/v3_asid.c:281:1: start of procedure extract_min_max()
  279.    * Extract min and max values from an ASIdOrRange.
  280.    */
  281. > static void extract_min_max(ASIdOrRange *aor,
  282.                               ASN1_INTEGER **min, ASN1_INTEGER **max)
  283.   {

crypto/x509v3/v3_asid.c:284:5: Condition is true
  282.                               ASN1_INTEGER **min, ASN1_INTEGER **max)
  283.   {
  284.       OPENSSL_assert(aor != NULL && min != NULL && max != NULL);
             ^
  285.       switch (aor->type) {
  286.       case ASIdOrRange_id:

crypto/x509v3/v3_asid.c:284:5: Condition is true
  282.                               ASN1_INTEGER **min, ASN1_INTEGER **max)
  283.   {
  284.       OPENSSL_assert(aor != NULL && min != NULL && max != NULL);
             ^
  285.       switch (aor->type) {
  286.       case ASIdOrRange_id:

crypto/x509v3/v3_asid.c:284:5: Condition is true
  282.                               ASN1_INTEGER **min, ASN1_INTEGER **max)
  283.   {
  284.       OPENSSL_assert(aor != NULL && min != NULL && max != NULL);
             ^
  285.       switch (aor->type) {
  286.       case ASIdOrRange_id:

crypto/x509v3/v3_asid.c:285:5: 
  283.   {
  284.       OPENSSL_assert(aor != NULL && min != NULL && max != NULL);
  285. >     switch (aor->type) {
  286.       case ASIdOrRange_id:
  287.           *min = aor->u.id;

crypto/x509v3/v3_asid.c:286:5: Switch condition is false. Skipping switch case
  284.       OPENSSL_assert(aor != NULL && min != NULL && max != NULL);
  285.       switch (aor->type) {
  286.       case ASIdOrRange_id:
             ^
  287.           *min = aor->u.id;
  288.           *max = aor->u.id;

crypto/x509v3/v3_asid.c:290:5: Switch condition is false. Skipping switch case
  288.           *max = aor->u.id;
  289.           return;
  290.       case ASIdOrRange_range:
             ^
  291.           *min = aor->u.range->min;
  292.           *max = aor->u.range->max;

crypto/x509v3/v3_asid.c:295:1: return from a call to extract_min_max
  293.           return;
  294.       }
  295. > }
  296.   
  297.   /*

crypto/x509v3/v3_asid.c:329:9: 
327.   
328.           extract_min_max(a, &a_min, &a_max);
329. >         extract_min_max(b, &b_min, &b_max);
330.   
331.           /*

crypto/x509v3/v3_asid.c:281:1: start of procedure extract_min_max()
  279.    * Extract min and max values from an ASIdOrRange.
  280.    */
  281. > static void extract_min_max(ASIdOrRange *aor,
  282.                               ASN1_INTEGER **min, ASN1_INTEGER **max)
  283.   {

crypto/x509v3/v3_asid.c:284:5: Condition is true
  282.                               ASN1_INTEGER **min, ASN1_INTEGER **max)
  283.   {
  284.       OPENSSL_assert(aor != NULL && min != NULL && max != NULL);
             ^
  285.       switch (aor->type) {
  286.       case ASIdOrRange_id:

crypto/x509v3/v3_asid.c:284:5: Condition is true
  282.                               ASN1_INTEGER **min, ASN1_INTEGER **max)
  283.   {
  284.       OPENSSL_assert(aor != NULL && min != NULL && max != NULL);
             ^
  285.       switch (aor->type) {
  286.       case ASIdOrRange_id:

crypto/x509v3/v3_asid.c:284:5: Condition is true
  282.                               ASN1_INTEGER **min, ASN1_INTEGER **max)
  283.   {
  284.       OPENSSL_assert(aor != NULL && min != NULL && max != NULL);
             ^
  285.       switch (aor->type) {
  286.       case ASIdOrRange_id:

crypto/x509v3/v3_asid.c:285:5: 
  283.   {
  284.       OPENSSL_assert(aor != NULL && min != NULL && max != NULL);
  285. >     switch (aor->type) {
  286.       case ASIdOrRange_id:
  287.           *min = aor->u.id;

crypto/x509v3/v3_asid.c:286:5: Switch condition is false. Skipping switch case
  284.       OPENSSL_assert(aor != NULL && min != NULL && max != NULL);
  285.       switch (aor->type) {
  286.       case ASIdOrRange_id:
             ^
  287.           *min = aor->u.id;
  288.           *max = aor->u.id;

crypto/x509v3/v3_asid.c:290:5: Switch condition is true. Entering switch case
  288.           *max = aor->u.id;
  289.           return;
  290.       case ASIdOrRange_range:
             ^
  291.           *min = aor->u.range->min;
  292.           *max = aor->u.range->max;

crypto/x509v3/v3_asid.c:291:9: 
  289.           return;
  290.       case ASIdOrRange_range:
  291. >         *min = aor->u.range->min;
  292.           *max = aor->u.range->max;
  293.           return;

crypto/x509v3/v3_asid.c:292:9: 
  290.       case ASIdOrRange_range:
  291.           *min = aor->u.range->min;
  292. >         *max = aor->u.range->max;
  293.           return;
  294.       }

crypto/x509v3/v3_asid.c:293:9: 
  291.           *min = aor->u.range->min;
  292.           *max = aor->u.range->max;
  293. >         return;
  294.       }
  295.   }

crypto/x509v3/v3_asid.c:295:1: return from a call to extract_min_max
  293.           return;
  294.       }
  295. > }
  296.   
  297.   /*

crypto/x509v3/v3_asid.c:334:13: 
332.            * Punt misordered list, overlapping start, or inverted range.
333.            */
334. >         if (ASN1_INTEGER_cmp(a_min, b_min) >= 0 ||
335.               ASN1_INTEGER_cmp(a_min, a_max) > 0 ||
336.               ASN1_INTEGER_cmp(b_min, b_max) > 0)

crypto/asn1/a_int.c:72:1: start of procedure ASN1_INTEGER_cmp()
  70.   }
  71.   
  72. > int ASN1_INTEGER_cmp(const ASN1_INTEGER *x, const ASN1_INTEGER *y)
  73.   {
  74.       int neg, ret;

crypto/asn1/a_int.c:76:5: 
  74.       int neg, ret;
  75.       /* Compare signs */
  76. >     neg = x->type & V_ASN1_NEG;
  77.       if (neg != (y->type & V_ASN1_NEG)) {
  78.           if (neg)

static int ASIdentifierChoice_is_canonical(ASIdentifierChoice *choice)
{
    ASN1_INTEGER *a_max_plus_one = NULL;
    BIGNUM *bn = NULL;
    int i, ret = 0;
    if (choice == NULL || choice->type == ASIdentifierChoice_inherit)
        return 1;
    if (choice->type != ASIdentifierChoice_asIdsOrRanges ||
        sk_ASIdOrRange_num(choice->u.asIdsOrRanges) == 0)
        return 0;
    for (i = 0; i < sk_ASIdOrRange_num(choice->u.asIdsOrRanges) - 1; i++) {
        ASIdOrRange *a = sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i);
        ASIdOrRange *b = sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i + 1);
        ASN1_INTEGER *a_min = NULL, *a_max = NULL, *b_min = NULL, *b_max =
            NULL;
        extract_min_max(a, &a_min, &a_max);
        extract_min_max(b, &b_min, &b_max);
        if (ASN1_INTEGER_cmp(a_min, b_min) >= 0 ||
            ASN1_INTEGER_cmp(a_min, a_max) > 0 ||
            ASN1_INTEGER_cmp(b_min, b_max) > 0)
            goto done;
        if ((bn == NULL && (bn = BN_new()) == NULL) ||
            ASN1_INTEGER_to_BN(a_max, bn) == NULL ||
            !BN_add_word(bn, 1) ||
            (a_max_plus_one =
             BN_to_ASN1_INTEGER(bn, a_max_plus_one)) == NULL) {
            X509V3err(X509V3_F_ASIDENTIFIERCHOICE_IS_CANONICAL,
                      ERR_R_MALLOC_FAILURE);
            goto done;
        }
        if (ASN1_INTEGER_cmp(a_max_plus_one, b_min) >= 0)
            goto done;
    }
    i = sk_ASIdOrRange_num(choice->u.asIdsOrRanges) - 1;
    {
        ASIdOrRange *a = sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i);
        ASN1_INTEGER *a_min, *a_max;
        if (a != NULL && a->type == ASIdOrRange_range) {
            extract_min_max(a, &a_min, &a_max);
            if (ASN1_INTEGER_cmp(a_min, a_max) > 0)
                goto done;
        }
    }
    ret = 1;
 done:
    ASN1_INTEGER_free(a_max_plus_one);
    BN_free(bn);
    return ret;
}
['static int ASIdentifierChoice_is_canonical(ASIdentifierChoice *choice)\n{\n    ASN1_INTEGER *a_max_plus_one = NULL;\n    BIGNUM *bn = NULL;\n    int i, ret = 0;\n    if (choice == NULL || choice->type == ASIdentifierChoice_inherit)\n        return 1;\n    if (choice->type != ASIdentifierChoice_asIdsOrRanges ||\n        sk_ASIdOrRange_num(choice->u.asIdsOrRanges) == 0)\n        return 0;\n    for (i = 0; i < sk_ASIdOrRange_num(choice->u.asIdsOrRanges) - 1; i++) {\n        ASIdOrRange *a = sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i);\n        ASIdOrRange *b = sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i + 1);\n        ASN1_INTEGER *a_min = NULL, *a_max = NULL, *b_min = NULL, *b_max =\n            NULL;\n        extract_min_max(a, &a_min, &a_max);\n        extract_min_max(b, &b_min, &b_max);\n        if (ASN1_INTEGER_cmp(a_min, b_min) >= 0 ||\n            ASN1_INTEGER_cmp(a_min, a_max) > 0 ||\n            ASN1_INTEGER_cmp(b_min, b_max) > 0)\n            goto done;\n        if ((bn == NULL && (bn = BN_new()) == NULL) ||\n            ASN1_INTEGER_to_BN(a_max, bn) == NULL ||\n            !BN_add_word(bn, 1) ||\n            (a_max_plus_one =\n             BN_to_ASN1_INTEGER(bn, a_max_plus_one)) == NULL) {\n            X509V3err(X509V3_F_ASIDENTIFIERCHOICE_IS_CANONICAL,\n                      ERR_R_MALLOC_FAILURE);\n            goto done;\n        }\n        if (ASN1_INTEGER_cmp(a_max_plus_one, b_min) >= 0)\n            goto done;\n    }\n    i = sk_ASIdOrRange_num(choice->u.asIdsOrRanges) - 1;\n    {\n        ASIdOrRange *a = sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i);\n        ASN1_INTEGER *a_min, *a_max;\n        if (a != NULL && a->type == ASIdOrRange_range) {\n            extract_min_max(a, &a_min, &a_max);\n            if (ASN1_INTEGER_cmp(a_min, a_max) > 0)\n                goto done;\n        }\n    }\n    ret = 1;\n done:\n    ASN1_INTEGER_free(a_max_plus_one);\n    BN_free(bn);\n    return ret;\n}', 'int sk_num(const _STACK *st)\n{\n    if (st == NULL)\n        return -1;\n    return st->num;\n}', 'void *sk_value(const _STACK *st, int i)\n{\n    if (!st || (i < 0) || (i >= st->num))\n        return NULL;\n    return st->data[i];\n}', 'static void extract_min_max(ASIdOrRange *aor,\n                            ASN1_INTEGER **min, ASN1_INTEGER **max)\n{\n    OPENSSL_assert(aor != NULL && min != NULL && max != NULL);\n    switch (aor->type) {\n    case ASIdOrRange_id:\n        *min = aor->u.id;\n        *max = aor->u.id;\n        return;\n    case ASIdOrRange_range:\n        *min = aor->u.range->min;\n        *max = aor->u.range->max;\n        return;\n    }\n}', 'int ASN1_INTEGER_cmp(const ASN1_INTEGER *x, const ASN1_INTEGER *y)\n{\n    int neg, ret;\n    neg = x->type & V_ASN1_NEG;\n    if (neg != (y->type & V_ASN1_NEG)) {\n        if (neg)\n            return -1;\n        else\n            return 1;\n    }\n    ret = ASN1_STRING_cmp(x, y);\n    if (neg)\n        return -ret;\n    else\n        return ret;\n}']