crypto/ts/ts_rsp_verify.c:423: error: NULL_DEREFERENCE
  pointer `signer` last assigned on line 387 could be null and is dereferenced by call to `ts_check_signer_name()` at line 423, column 13.
Showing all 30 steps of the trace


crypto/ts/ts_rsp_verify.c:384:1: start of procedure int_ts_RESP_verify_token()
382.    *      - Check if the TSA name is the expected TSA.
383.    */
384. > static int int_ts_RESP_verify_token(TS_VERIFY_CTX *ctx,
385.                                       PKCS7 *token, TS_TST_INFO *tst_info)
386.   {

crypto/ts/ts_rsp_verify.c:387:5: 
385.                                       PKCS7 *token, TS_TST_INFO *tst_info)
386.   {
387. >     X509 *signer = NULL;
388.       GENERAL_NAME *tsa_name = tst_info->tsa;
389.       X509_ALGOR *md_alg = NULL;

crypto/ts/ts_rsp_verify.c:388:5: 
386.   {
387.       X509 *signer = NULL;
388. >     GENERAL_NAME *tsa_name = tst_info->tsa;
389.       X509_ALGOR *md_alg = NULL;
390.       unsigned char *imprint = NULL;

crypto/ts/ts_rsp_verify.c:389:5: 
387.       X509 *signer = NULL;
388.       GENERAL_NAME *tsa_name = tst_info->tsa;
389. >     X509_ALGOR *md_alg = NULL;
390.       unsigned char *imprint = NULL;
391.       unsigned imprint_len = 0;

crypto/ts/ts_rsp_verify.c:390:5: 
388.       GENERAL_NAME *tsa_name = tst_info->tsa;
389.       X509_ALGOR *md_alg = NULL;
390. >     unsigned char *imprint = NULL;
391.       unsigned imprint_len = 0;
392.       int ret = 0;

crypto/ts/ts_rsp_verify.c:391:5: 
389.       X509_ALGOR *md_alg = NULL;
390.       unsigned char *imprint = NULL;
391. >     unsigned imprint_len = 0;
392.       int ret = 0;
393.   

crypto/ts/ts_rsp_verify.c:392:5: 
390.       unsigned char *imprint = NULL;
391.       unsigned imprint_len = 0;
392. >     int ret = 0;
393.   
394.       if ((ctx->flags & TS_VFY_SIGNATURE)

crypto/ts/ts_rsp_verify.c:394:10: Taking false branch
392.       int ret = 0;
393.   
394.       if ((ctx->flags & TS_VFY_SIGNATURE)
                ^
395.           && !TS_RESP_verify_signature(token, ctx->certs, ctx->store, &signer))
396.           goto err;

crypto/ts/ts_rsp_verify.c:397:10: Taking false branch
395.           && !TS_RESP_verify_signature(token, ctx->certs, ctx->store, &signer))
396.           goto err;
397.       if ((ctx->flags & TS_VFY_VERSION)
                ^
398.           && TS_TST_INFO_get_version(tst_info) != 1) {
399.           TSerr(TS_F_INT_TS_RESP_VERIFY_TOKEN, TS_R_UNSUPPORTED_VERSION);

crypto/ts/ts_rsp_verify.c:402:10: Taking true branch
400.           goto err;
401.       }
402.       if ((ctx->flags & TS_VFY_POLICY)
                ^
403.           && !ts_check_policy(ctx->policy, tst_info))
404.           goto err;

crypto/ts/ts_rsp_verify.c:403:13: 
401.       }
402.       if ((ctx->flags & TS_VFY_POLICY)
403. >         && !ts_check_policy(ctx->policy, tst_info))
404.           goto err;
405.       if ((ctx->flags & TS_VFY_IMPRINT)

crypto/ts/ts_rsp_verify.c:516:1: start of procedure ts_check_policy()
  514.   }
  515.   
  516. > static int ts_check_policy(ASN1_OBJECT *req_oid, TS_TST_INFO *tst_info)
  517.   {
  518.       ASN1_OBJECT *resp_oid = tst_info->policy_id;

crypto/ts/ts_rsp_verify.c:518:5: 
  516.   static int ts_check_policy(ASN1_OBJECT *req_oid, TS_TST_INFO *tst_info)
  517.   {
  518. >     ASN1_OBJECT *resp_oid = tst_info->policy_id;
  519.   
  520.       if (OBJ_cmp(req_oid, resp_oid) != 0) {

crypto/ts/ts_rsp_verify.c:520:9: 
  518.       ASN1_OBJECT *resp_oid = tst_info->policy_id;
  519.   
  520. >     if (OBJ_cmp(req_oid, resp_oid) != 0) {
  521.           TSerr(TS_F_TS_CHECK_POLICY, TS_R_POLICY_MISMATCH);
  522.           return 0;

crypto/objects/obj_lib.c:124:1: start of procedure OBJ_cmp()
    122.   }
    123.   
    124. > int OBJ_cmp(const ASN1_OBJECT *a, const ASN1_OBJECT *b)
    125.   {
    126.       int ret;

crypto/objects/obj_lib.c:128:5: 
    126.       int ret;
    127.   
    128. >     ret = (a->length - b->length);
    129.       if (ret)
    130.           return (ret);

crypto/objects/obj_lib.c:129:9: Taking true branch
    127.   
    128.       ret = (a->length - b->length);
    129.       if (ret)
                   ^
    130.           return (ret);
    131.       return (memcmp(a->data, b->data, a->length));

crypto/objects/obj_lib.c:130:9: 
    128.       ret = (a->length - b->length);
    129.       if (ret)
    130. >         return (ret);
    131.       return (memcmp(a->data, b->data, a->length));
    132.   }

crypto/objects/obj_lib.c:132:1: return from a call to OBJ_cmp
    130.           return (ret);
    131.       return (memcmp(a->data, b->data, a->length));
    132. > }

crypto/ts/ts_rsp_verify.c:520:9: Taking false branch
  518.       ASN1_OBJECT *resp_oid = tst_info->policy_id;
  519.   
  520.       if (OBJ_cmp(req_oid, resp_oid) != 0) {
                 ^
  521.           TSerr(TS_F_TS_CHECK_POLICY, TS_R_POLICY_MISMATCH);
  522.           return 0;

crypto/ts/ts_rsp_verify.c:525:5: 
  523.       }
  524.   
  525. >     return 1;
  526.   }
  527.   

crypto/ts/ts_rsp_verify.c:526:1: return from a call to ts_check_policy
  524.   
  525.       return 1;
  526. > }
  527.   
  528.   static int ts_compute_imprint(BIO *data, TS_TST_INFO *tst_info,

crypto/ts/ts_rsp_verify.c:403:13: Taking false branch
401.       }
402.       if ((ctx->flags & TS_VFY_POLICY)
403.           && !ts_check_policy(ctx->policy, tst_info))
                   ^
404.           goto err;
405.       if ((ctx->flags & TS_VFY_IMPRINT)

crypto/ts/ts_rsp_verify.c:405:10: Taking true branch
403.           && !ts_check_policy(ctx->policy, tst_info))
404.           goto err;
405.       if ((ctx->flags & TS_VFY_IMPRINT)
                ^
406.           && !ts_check_imprints(ctx->md_alg, ctx->imprint, ctx->imprint_len,
407.                                 tst_info))

crypto/ts/ts_rsp_verify.c:406:13: Taking false branch
404.           goto err;
405.       if ((ctx->flags & TS_VFY_IMPRINT)
406.           && !ts_check_imprints(ctx->md_alg, ctx->imprint, ctx->imprint_len,
                   ^
407.                                 tst_info))
408.           goto err;

crypto/ts/ts_rsp_verify.c:409:10: Taking false branch
407.                                 tst_info))
408.           goto err;
409.       if ((ctx->flags & TS_VFY_DATA)
                ^
410.           && (!ts_compute_imprint(ctx->data, tst_info,
411.                                   &md_alg, &imprint, &imprint_len)

crypto/ts/ts_rsp_verify.c:414:10: Taking false branch
412.               || !ts_check_imprints(md_alg, imprint, imprint_len, tst_info)))
413.           goto err;
414.       if ((ctx->flags & TS_VFY_NONCE)
                ^
415.           && !ts_check_nonces(ctx->nonce, tst_info))
416.           goto err;

crypto/ts/ts_rsp_verify.c:417:10: Taking false branch
415.           && !ts_check_nonces(ctx->nonce, tst_info))
416.           goto err;
417.       if ((ctx->flags & TS_VFY_SIGNER)
                ^
418.           && tsa_name && !ts_check_signer_name(tsa_name, signer)) {
419.           TSerr(TS_F_INT_TS_RESP_VERIFY_TOKEN, TS_R_TSA_NAME_MISMATCH);

crypto/ts/ts_rsp_verify.c:422:10: Taking true branch
420.           goto err;
421.       }
422.       if ((ctx->flags & TS_VFY_TSA_NAME)
                ^
423.           && !ts_check_signer_name(ctx->tsa_name, signer)) {
424.           TSerr(TS_F_INT_TS_RESP_VERIFY_TOKEN, TS_R_TSA_UNTRUSTED);

crypto/ts/ts_rsp_verify.c:423:13: 
421.       }
422.       if ((ctx->flags & TS_VFY_TSA_NAME)
423. >         && !ts_check_signer_name(ctx->tsa_name, signer)) {
424.           TSerr(TS_F_INT_TS_RESP_VERIFY_TOKEN, TS_R_TSA_UNTRUSTED);
425.           goto err;

static int int_ts_RESP_verify_token(TS_VERIFY_CTX *ctx,
                                    PKCS7 *token, TS_TST_INFO *tst_info)
{
    X509 *signer = NULL;
    GENERAL_NAME *tsa_name = tst_info->tsa;
    X509_ALGOR *md_alg = NULL;
    unsigned char *imprint = NULL;
    unsigned imprint_len = 0;
    int ret = 0;
    if ((ctx->flags & TS_VFY_SIGNATURE)
        && !TS_RESP_verify_signature(token, ctx->certs, ctx->store, &signer))
        goto err;
    if ((ctx->flags & TS_VFY_VERSION)
        && TS_TST_INFO_get_version(tst_info) != 1) {
        TSerr(TS_F_INT_TS_RESP_VERIFY_TOKEN, TS_R_UNSUPPORTED_VERSION);
        goto err;
    }
    if ((ctx->flags & TS_VFY_POLICY)
        && !ts_check_policy(ctx->policy, tst_info))
        goto err;
    if ((ctx->flags & TS_VFY_IMPRINT)
        && !ts_check_imprints(ctx->md_alg, ctx->imprint, ctx->imprint_len,
                              tst_info))
        goto err;
    if ((ctx->flags & TS_VFY_DATA)
        && (!ts_compute_imprint(ctx->data, tst_info,
                                &md_alg, &imprint, &imprint_len)
            || !ts_check_imprints(md_alg, imprint, imprint_len, tst_info)))
        goto err;
    if ((ctx->flags & TS_VFY_NONCE)
        && !ts_check_nonces(ctx->nonce, tst_info))
        goto err;
    if ((ctx->flags & TS_VFY_SIGNER)
        && tsa_name && !ts_check_signer_name(tsa_name, signer)) {
        TSerr(TS_F_INT_TS_RESP_VERIFY_TOKEN, TS_R_TSA_NAME_MISMATCH);
        goto err;
    }
    if ((ctx->flags & TS_VFY_TSA_NAME)
        && !ts_check_signer_name(ctx->tsa_name, signer)) {
        TSerr(TS_F_INT_TS_RESP_VERIFY_TOKEN, TS_R_TSA_UNTRUSTED);
        goto err;
    }
    ret = 1;
 err:
    X509_free(signer);
    X509_ALGOR_free(md_alg);
    OPENSSL_free(imprint);
    return ret;
}
['static int int_ts_RESP_verify_token(TS_VERIFY_CTX *ctx,\n                                    PKCS7 *token, TS_TST_INFO *tst_info)\n{\n    X509 *signer = NULL;\n    GENERAL_NAME *tsa_name = tst_info->tsa;\n    X509_ALGOR *md_alg = NULL;\n    unsigned char *imprint = NULL;\n    unsigned imprint_len = 0;\n    int ret = 0;\n    if ((ctx->flags & TS_VFY_SIGNATURE)\n        && !TS_RESP_verify_signature(token, ctx->certs, ctx->store, &signer))\n        goto err;\n    if ((ctx->flags & TS_VFY_VERSION)\n        && TS_TST_INFO_get_version(tst_info) != 1) {\n        TSerr(TS_F_INT_TS_RESP_VERIFY_TOKEN, TS_R_UNSUPPORTED_VERSION);\n        goto err;\n    }\n    if ((ctx->flags & TS_VFY_POLICY)\n        && !ts_check_policy(ctx->policy, tst_info))\n        goto err;\n    if ((ctx->flags & TS_VFY_IMPRINT)\n        && !ts_check_imprints(ctx->md_alg, ctx->imprint, ctx->imprint_len,\n                              tst_info))\n        goto err;\n    if ((ctx->flags & TS_VFY_DATA)\n        && (!ts_compute_imprint(ctx->data, tst_info,\n                                &md_alg, &imprint, &imprint_len)\n            || !ts_check_imprints(md_alg, imprint, imprint_len, tst_info)))\n        goto err;\n    if ((ctx->flags & TS_VFY_NONCE)\n        && !ts_check_nonces(ctx->nonce, tst_info))\n        goto err;\n    if ((ctx->flags & TS_VFY_SIGNER)\n        && tsa_name && !ts_check_signer_name(tsa_name, signer)) {\n        TSerr(TS_F_INT_TS_RESP_VERIFY_TOKEN, TS_R_TSA_NAME_MISMATCH);\n        goto err;\n    }\n    if ((ctx->flags & TS_VFY_TSA_NAME)\n        && !ts_check_signer_name(ctx->tsa_name, signer)) {\n        TSerr(TS_F_INT_TS_RESP_VERIFY_TOKEN, TS_R_TSA_UNTRUSTED);\n        goto err;\n    }\n    ret = 1;\n err:\n    X509_free(signer);\n    X509_ALGOR_free(md_alg);\n    OPENSSL_free(imprint);\n    return ret;\n}', 'static int ts_check_policy(ASN1_OBJECT *req_oid, TS_TST_INFO *tst_info)\n{\n    ASN1_OBJECT *resp_oid = tst_info->policy_id;\n    if (OBJ_cmp(req_oid, resp_oid) != 0) {\n        TSerr(TS_F_TS_CHECK_POLICY, TS_R_POLICY_MISMATCH);\n        return 0;\n    }\n    return 1;\n}', 'int OBJ_cmp(const ASN1_OBJECT *a, const ASN1_OBJECT *b)\n{\n    int ret;\n    ret = (a->length - b->length);\n    if (ret)\n        return (ret);\n    return (memcmp(a->data, b->data, a->length));\n}']