apps/apps.c:1103: error: NULL_DEREFERENCE
  pointer `store` last assigned on line 1066 could be null and is dereferenced by call to `X509_STORE_free()` at line 1103, column 5.
Showing all 17 steps of the trace


apps/apps.c:1064:1: start of procedure setup_verify()
1062.   }
1063.   
1064. > X509_STORE *setup_verify(const char *CAfile, const char *CApath, int noCAfile, int noCApath)
1065.   {
1066.       X509_STORE *store = X509_STORE_new();

apps/apps.c:1066:5: Skipping X509_STORE_new(): empty list of specs
1064.   X509_STORE *setup_verify(const char *CAfile, const char *CApath, int noCAfile, int noCApath)
1065.   {
1066.       X509_STORE *store = X509_STORE_new();
            ^
1067.       X509_LOOKUP *lookup;
1068.   

apps/apps.c:1069:9: Taking true branch
1067.       X509_LOOKUP *lookup;
1068.   
1069.       if (store == NULL)
                ^
1070.           goto end;
1071.   

apps/apps.c:1102:2: 
1100.       ERR_clear_error();
1101.       return store;
1102. >  end:
1103.       X509_STORE_free(store);
1104.       return NULL;

apps/apps.c:1103:5: 
1101.       return store;
1102.    end:
1103. >     X509_STORE_free(store);
1104.       return NULL;
1105.   }

crypto/x509/x509_lu.c:204:1: start of procedure X509_STORE_free()
  202.   }
  203.   
  204. > void X509_STORE_free(X509_STORE *vfy)
  205.   {
  206.       int i;

crypto/x509/x509_lu.c:210:9: Taking false branch
  208.       X509_LOOKUP *lu;
  209.   
  210.       if (vfy == NULL)
                 ^
  211.           return;
  212.       CRYPTO_DOWN_REF(&vfy->references, &i, vfy->lock);

crypto/x509/x509_lu.c:212:5: 
  210.       if (vfy == NULL)
  211.           return;
  212. >     CRYPTO_DOWN_REF(&vfy->references, &i, vfy->lock);
  213.       REF_PRINT_COUNT("X509_STORE", vfy);
  214.       if (i > 0)

include/internal/refcount.h:49:1: start of procedure CRYPTO_DOWN_REF()
    47.    * otherwise imply an acquire fence. Hence conditional acquire fence...
    48.    */
    49. > static inline int CRYPTO_DOWN_REF(_Atomic int *val, int *ret, void *lock)
    50.   {
    51.       *ret = atomic_fetch_sub_explicit(val, 1, memory_order_relaxed) - 1;

include/internal/refcount.h:51:5: 
    49.   static inline int CRYPTO_DOWN_REF(_Atomic int *val, int *ret, void *lock)
    50.   {
    51. >     *ret = atomic_fetch_sub_explicit(val, 1, memory_order_relaxed) - 1;
    52.       if (*ret == 0)
    53.           atomic_thread_fence(memory_order_acquire);

include/internal/refcount.h:52:9: Taking true branch
    50.   {
    51.       *ret = atomic_fetch_sub_explicit(val, 1, memory_order_relaxed) - 1;
    52.       if (*ret == 0)
                  ^
    53.           atomic_thread_fence(memory_order_acquire);
    54.       return 1;

include/internal/refcount.h:53:9: Skipping __c11_atomic_thread_fence(): method has no implementation
    51.       *ret = atomic_fetch_sub_explicit(val, 1, memory_order_relaxed) - 1;
    52.       if (*ret == 0)
    53.           atomic_thread_fence(memory_order_acquire);
                  ^
    54.       return 1;
    55.   }

include/internal/refcount.h:54:5: 
    52.       if (*ret == 0)
    53.           atomic_thread_fence(memory_order_acquire);
    54. >     return 1;
    55.   }
    56.   

include/internal/refcount.h:55:1: return from a call to CRYPTO_DOWN_REF
    53.           atomic_thread_fence(memory_order_acquire);
    54.       return 1;
    55. > }
    56.   
    57.   #  elif defined(__GNUC__) && defined(__ATOMIC_RELAXED) && __GCC_ATOMIC_INT_LOCK_FREE > 0

crypto/x509/x509_lu.c:214:9: Taking true branch
  212.       CRYPTO_DOWN_REF(&vfy->references, &i, vfy->lock);
  213.       REF_PRINT_COUNT("X509_STORE", vfy);
  214.       if (i > 0)
                 ^
  215.           return;
  216.       REF_ASSERT_ISNT(i < 0);

crypto/x509/x509_lu.c:215:9: 
  213.       REF_PRINT_COUNT("X509_STORE", vfy);
  214.       if (i > 0)
  215. >         return;
  216.       REF_ASSERT_ISNT(i < 0);
  217.   

crypto/x509/x509_lu.c:231:1: return from a call to X509_STORE_free
  229.       CRYPTO_THREAD_lock_free(vfy->lock);
  230.       OPENSSL_free(vfy);
  231. > }
  232.   
  233.   int X509_STORE_up_ref(X509_STORE *vfy)

X509_STORE *setup_verify(const char *CAfile, const char *CApath, int noCAfile, int noCApath)
{
    X509_STORE *store = X509_STORE_new();
    X509_LOOKUP *lookup;
    if (store == NULL)
        goto end;
    if (CAfile != NULL || !noCAfile) {
        lookup = X509_STORE_add_lookup(store, X509_LOOKUP_file());
        if (lookup == NULL)
            goto end;
        if (CAfile) {
            if (!X509_LOOKUP_load_file(lookup, CAfile, X509_FILETYPE_PEM)) {
                BIO_printf(bio_err, "Error loading file %s\n", CAfile);
                goto end;
            }
        } else {
            X509_LOOKUP_load_file(lookup, NULL, X509_FILETYPE_DEFAULT);
        }
    }
    if (CApath != NULL || !noCApath) {
        lookup = X509_STORE_add_lookup(store, X509_LOOKUP_hash_dir());
        if (lookup == NULL)
            goto end;
        if (CApath) {
            if (!X509_LOOKUP_add_dir(lookup, CApath, X509_FILETYPE_PEM)) {
                BIO_printf(bio_err, "Error loading directory %s\n", CApath);
                goto end;
            }
        } else {
            X509_LOOKUP_add_dir(lookup, NULL, X509_FILETYPE_DEFAULT);
        }
    }
    ERR_clear_error();
    return store;
 end:
    X509_STORE_free(store);
    return NULL;
}
['X509_STORE *setup_verify(const char *CAfile, const char *CApath, int noCAfile, int noCApath)\n{\n    X509_STORE *store = X509_STORE_new();\n    X509_LOOKUP *lookup;\n    if (store == NULL)\n        goto end;\n    if (CAfile != NULL || !noCAfile) {\n        lookup = X509_STORE_add_lookup(store, X509_LOOKUP_file());\n        if (lookup == NULL)\n            goto end;\n        if (CAfile) {\n            if (!X509_LOOKUP_load_file(lookup, CAfile, X509_FILETYPE_PEM)) {\n                BIO_printf(bio_err, "Error loading file %s\\n", CAfile);\n                goto end;\n            }\n        } else {\n            X509_LOOKUP_load_file(lookup, NULL, X509_FILETYPE_DEFAULT);\n        }\n    }\n    if (CApath != NULL || !noCApath) {\n        lookup = X509_STORE_add_lookup(store, X509_LOOKUP_hash_dir());\n        if (lookup == NULL)\n            goto end;\n        if (CApath) {\n            if (!X509_LOOKUP_add_dir(lookup, CApath, X509_FILETYPE_PEM)) {\n                BIO_printf(bio_err, "Error loading directory %s\\n", CApath);\n                goto end;\n            }\n        } else {\n            X509_LOOKUP_add_dir(lookup, NULL, X509_FILETYPE_DEFAULT);\n        }\n    }\n    ERR_clear_error();\n    return store;\n end:\n    X509_STORE_free(store);\n    return NULL;\n}', 'void X509_STORE_free(X509_STORE *vfy)\n{\n    int i;\n    STACK_OF(X509_LOOKUP) *sk;\n    X509_LOOKUP *lu;\n    if (vfy == NULL)\n        return;\n    CRYPTO_DOWN_REF(&vfy->references, &i, vfy->lock);\n    REF_PRINT_COUNT("X509_STORE", vfy);\n    if (i > 0)\n        return;\n    REF_ASSERT_ISNT(i < 0);\n    sk = vfy->get_cert_methods;\n    for (i = 0; i < sk_X509_LOOKUP_num(sk); i++) {\n        lu = sk_X509_LOOKUP_value(sk, i);\n        X509_LOOKUP_shutdown(lu);\n        X509_LOOKUP_free(lu);\n    }\n    sk_X509_LOOKUP_free(sk);\n    sk_X509_OBJECT_pop_free(vfy->objs, X509_OBJECT_free);\n    CRYPTO_free_ex_data(CRYPTO_EX_INDEX_X509_STORE, vfy, &vfy->ex_data);\n    X509_VERIFY_PARAM_free(vfy->param);\n    CRYPTO_THREAD_lock_free(vfy->lock);\n    OPENSSL_free(vfy);\n}', 'static inline int CRYPTO_DOWN_REF(_Atomic int *val, int *ret, void *lock)\n{\n    *ret = atomic_fetch_sub_explicit(val, 1, memory_order_relaxed) - 1;\n    if (*ret == 0)\n        atomic_thread_fence(memory_order_acquire);\n    return 1;\n}']