crypto/x509v3/pcy_tree.c:235: error: MEMORY_LEAK
  memory dynamically allocated by call to `CRYPTO_zalloc()` at line 166, column 17 is not reachable after line 235, column 5.
Showing all 72 steps of the trace


crypto/x509v3/pcy_tree.c:89:1: start of procedure tree_init()
87.    * X509_PCY_TREE_EXPLICIT: explicit policy required
88.    */
89. > static int tree_init(X509_POLICY_TREE **ptree, STACK_OF(X509) *certs,
90.                        unsigned int flags)
91.   {

crypto/x509v3/pcy_tree.c:95:5: 
93.       X509_POLICY_LEVEL *level;
94.       const X509_POLICY_CACHE *cache;
95. >     X509_POLICY_DATA *data = NULL;
96.       int ret = X509_PCY_TREE_VALID;
97.       int n = sk_X509_num(certs) - 1; /* RFC5280 paths omit the TA */

crypto/x509v3/pcy_tree.c:96:5: 
94.       const X509_POLICY_CACHE *cache;
95.       X509_POLICY_DATA *data = NULL;
96. >     int ret = X509_PCY_TREE_VALID;
97.       int n = sk_X509_num(certs) - 1; /* RFC5280 paths omit the TA */
98.       int explicit_policy = (flags & X509_V_FLAG_EXPLICIT_POLICY) ? 0 : n+1;

crypto/x509v3/pcy_tree.c:97:5: 
95.       X509_POLICY_DATA *data = NULL;
96.       int ret = X509_PCY_TREE_VALID;
97. >     int n = sk_X509_num(certs) - 1; /* RFC5280 paths omit the TA */
98.       int explicit_policy = (flags & X509_V_FLAG_EXPLICIT_POLICY) ? 0 : n+1;
99.       int any_skip = (flags & X509_V_FLAG_INHIBIT_ANY) ? 0 : n+1;

include/openssl/x509.h:104:1: start of procedure sk_X509_num()
  102.   typedef struct x509_cinf_st X509_CINF;
  103.   
  104. > DEFINE_STACK_OF(X509)
  105.   
  106.   /* This is used for a table of trust checking functions */

crypto/stack/stack.c:270:1: start of procedure OPENSSL_sk_num()
    268.   }
    269.   
    270. > int OPENSSL_sk_num(const OPENSSL_STACK *st)
    271.   {
    272.       if (st == NULL)

crypto/stack/stack.c:272:9: Taking true branch
    270.   int OPENSSL_sk_num(const OPENSSL_STACK *st)
    271.   {
    272.       if (st == NULL)
                   ^
    273.           return -1;
    274.       return st->num;

crypto/stack/stack.c:273:9: 
    271.   {
    272.       if (st == NULL)
    273. >         return -1;
    274.       return st->num;
    275.   }

crypto/stack/stack.c:275:1: return from a call to OPENSSL_sk_num
    273.           return -1;
    274.       return st->num;
    275. > }
    276.   
    277.   void *OPENSSL_sk_value(const OPENSSL_STACK *st, int i)

include/openssl/x509.h:104:1: return from a call to sk_X509_num
  102.   typedef struct x509_cinf_st X509_CINF;
  103.   
  104. > DEFINE_STACK_OF(X509)
  105.   
  106.   /* This is used for a table of trust checking functions */

crypto/x509v3/pcy_tree.c:98:28: Condition is true
96.       int ret = X509_PCY_TREE_VALID;
97.       int n = sk_X509_num(certs) - 1; /* RFC5280 paths omit the TA */
98.       int explicit_policy = (flags & X509_V_FLAG_EXPLICIT_POLICY) ? 0 : n+1;
                                  ^
99.       int any_skip = (flags & X509_V_FLAG_INHIBIT_ANY) ? 0 : n+1;
100.       int map_skip = (flags & X509_V_FLAG_INHIBIT_MAP) ? 0 : n+1;

crypto/x509v3/pcy_tree.c:98:27: 
96.       int ret = X509_PCY_TREE_VALID;
97.       int n = sk_X509_num(certs) - 1; /* RFC5280 paths omit the TA */
98. >     int explicit_policy = (flags & X509_V_FLAG_EXPLICIT_POLICY) ? 0 : n+1;
99.       int any_skip = (flags & X509_V_FLAG_INHIBIT_ANY) ? 0 : n+1;
100.       int map_skip = (flags & X509_V_FLAG_INHIBIT_MAP) ? 0 : n+1;

crypto/x509v3/pcy_tree.c:98:5: 
96.       int ret = X509_PCY_TREE_VALID;
97.       int n = sk_X509_num(certs) - 1; /* RFC5280 paths omit the TA */
98. >     int explicit_policy = (flags & X509_V_FLAG_EXPLICIT_POLICY) ? 0 : n+1;
99.       int any_skip = (flags & X509_V_FLAG_INHIBIT_ANY) ? 0 : n+1;
100.       int map_skip = (flags & X509_V_FLAG_INHIBIT_MAP) ? 0 : n+1;

crypto/x509v3/pcy_tree.c:99:21: Condition is true
97.       int n = sk_X509_num(certs) - 1; /* RFC5280 paths omit the TA */
98.       int explicit_policy = (flags & X509_V_FLAG_EXPLICIT_POLICY) ? 0 : n+1;
99.       int any_skip = (flags & X509_V_FLAG_INHIBIT_ANY) ? 0 : n+1;
                           ^
100.       int map_skip = (flags & X509_V_FLAG_INHIBIT_MAP) ? 0 : n+1;
101.       int i;

crypto/x509v3/pcy_tree.c:99:20: 
97.       int n = sk_X509_num(certs) - 1; /* RFC5280 paths omit the TA */
98.       int explicit_policy = (flags & X509_V_FLAG_EXPLICIT_POLICY) ? 0 : n+1;
99. >     int any_skip = (flags & X509_V_FLAG_INHIBIT_ANY) ? 0 : n+1;
100.       int map_skip = (flags & X509_V_FLAG_INHIBIT_MAP) ? 0 : n+1;
101.       int i;

crypto/x509v3/pcy_tree.c:99:5: 
97.       int n = sk_X509_num(certs) - 1; /* RFC5280 paths omit the TA */
98.       int explicit_policy = (flags & X509_V_FLAG_EXPLICIT_POLICY) ? 0 : n+1;
99. >     int any_skip = (flags & X509_V_FLAG_INHIBIT_ANY) ? 0 : n+1;
100.       int map_skip = (flags & X509_V_FLAG_INHIBIT_MAP) ? 0 : n+1;
101.       int i;

crypto/x509v3/pcy_tree.c:100:21: Condition is true
98.       int explicit_policy = (flags & X509_V_FLAG_EXPLICIT_POLICY) ? 0 : n+1;
99.       int any_skip = (flags & X509_V_FLAG_INHIBIT_ANY) ? 0 : n+1;
100.       int map_skip = (flags & X509_V_FLAG_INHIBIT_MAP) ? 0 : n+1;
                           ^
101.       int i;
102.   

crypto/x509v3/pcy_tree.c:100:20: 
98.       int explicit_policy = (flags & X509_V_FLAG_EXPLICIT_POLICY) ? 0 : n+1;
99.       int any_skip = (flags & X509_V_FLAG_INHIBIT_ANY) ? 0 : n+1;
100. >     int map_skip = (flags & X509_V_FLAG_INHIBIT_MAP) ? 0 : n+1;
101.       int i;
102.   

crypto/x509v3/pcy_tree.c:100:5: 
98.       int explicit_policy = (flags & X509_V_FLAG_EXPLICIT_POLICY) ? 0 : n+1;
99.       int any_skip = (flags & X509_V_FLAG_INHIBIT_ANY) ? 0 : n+1;
100. >     int map_skip = (flags & X509_V_FLAG_INHIBIT_MAP) ? 0 : n+1;
101.       int i;
102.   

crypto/x509v3/pcy_tree.c:103:5: 
101.       int i;
102.   
103. >     *ptree = NULL;
104.   
105.       /* Can't do anything with just a trust anchor */

crypto/x509v3/pcy_tree.c:106:9: Taking false branch
104.   
105.       /* Can't do anything with just a trust anchor */
106.       if (n == 0)
               ^
107.           return X509_PCY_TREE_EMPTY;
108.   

crypto/x509v3/pcy_tree.c:114:10: 
112.        * certificates with invalid policy extensions.
113.        */
114. >     for (i = n - 1; i >= 0; i--) {
115.           X509 *x = sk_X509_value(certs, i);
116.   

crypto/x509v3/pcy_tree.c:114:21: Loop condition is false. Leaving loop
112.        * certificates with invalid policy extensions.
113.        */
114.       for (i = n - 1; i >= 0; i--) {
                           ^
115.           X509 *x = sk_X509_value(certs, i);
116.   

crypto/x509v3/pcy_tree.c:136:10: 
134.        * policy is required we're done.
135.        */
136. >     for (i = n - 1;
137.            i >= 0 && (explicit_policy > 0 || (ret & X509_PCY_TREE_EMPTY) == 0);
138.            i--) {

crypto/x509v3/pcy_tree.c:137:10: Loop condition is false. Leaving loop
135.        */
136.       for (i = n - 1;
137.            i >= 0 && (explicit_policy > 0 || (ret & X509_PCY_TREE_EMPTY) == 0);
                ^
138.            i--) {
139.           X509 *x = sk_X509_value(certs, i);

crypto/x509v3/pcy_tree.c:160:9: Taking false branch
158.       }
159.   
160.       if (explicit_policy == 0)
               ^
161.           ret |= X509_PCY_TREE_EXPLICIT;
162.       if ((ret & X509_PCY_TREE_VALID) == 0)

crypto/x509v3/pcy_tree.c:162:9: Taking false branch
160.       if (explicit_policy == 0)
161.           ret |= X509_PCY_TREE_EXPLICIT;
162.       if ((ret & X509_PCY_TREE_VALID) == 0)
               ^
163.           return ret;
164.   

crypto/x509v3/pcy_tree.c:166:9: 
164.   
165.       /* If we get this far initialize the tree */
166. >     if ((tree = OPENSSL_zalloc(sizeof(*tree))) == NULL)
167.           return X509_PCY_TREE_INTERNAL;
168.   

crypto/mem.c:98:1: start of procedure CRYPTO_zalloc()
  96.   }
  97.   
  98. > void *CRYPTO_zalloc(size_t num, const char *file, int line)
  99.   {
  100.       void *ret = CRYPTO_malloc(num, file, line);

crypto/mem.c:100:5: 
  98.   void *CRYPTO_zalloc(size_t num, const char *file, int line)
  99.   {
  100. >     void *ret = CRYPTO_malloc(num, file, line);
  101.   
  102.       if (ret != NULL)

crypto/mem.c:71:1: start of procedure CRYPTO_malloc()
    69.   }
    70.   
    71. > void *CRYPTO_malloc(size_t num, const char *file, int line)
    72.   {
    73.       void *ret = NULL;

crypto/mem.c:73:5: 
    71.   void *CRYPTO_malloc(size_t num, const char *file, int line)
    72.   {
    73. >     void *ret = NULL;
    74.   
    75.       if (malloc_impl != NULL && malloc_impl != CRYPTO_malloc)

crypto/mem.c:75:9: Taking false branch
    73.       void *ret = NULL;
    74.   
    75.       if (malloc_impl != NULL && malloc_impl != CRYPTO_malloc)
                  ^
    76.           return malloc_impl(num, file, line);
    77.   

crypto/mem.c:78:9: Taking false branch
    76.           return malloc_impl(num, file, line);
    77.   
    78.       if (num <= 0)
                  ^
    79.           return NULL;
    80.   

crypto/mem.c:81:5: 
    79.           return NULL;
    80.   
    81. >     allow_customize = 0;
    82.   #ifndef OPENSSL_NO_CRYPTO_MDEBUG
    83.       if (call_malloc_debug) {

crypto/mem.c:91:5: 
    89.       }
    90.   #else
    91. >     osslargused(file); osslargused(line);
    92.       ret = malloc(num);
    93.   #endif

crypto/mem.c:91:24: 
    89.       }
    90.   #else
    91. >     osslargused(file); osslargused(line);
    92.       ret = malloc(num);
    93.   #endif

crypto/mem.c:92:5: 
    90.   #else
    91.       osslargused(file); osslargused(line);
    92. >     ret = malloc(num);
    93.   #endif
    94.   

crypto/mem.c:95:5: 
    93.   #endif
    94.   
    95. >     return ret;
    96.   }
    97.   

crypto/mem.c:96:1: return from a call to CRYPTO_malloc
    94.   
    95.       return ret;
    96. > }
    97.   
    98.   void *CRYPTO_zalloc(size_t num, const char *file, int line)

crypto/mem.c:102:9: Taking true branch
  100.       void *ret = CRYPTO_malloc(num, file, line);
  101.   
  102.       if (ret != NULL)
                 ^
  103.           memset(ret, 0, num);
  104.       return ret;

crypto/mem.c:103:9: 
  101.   
  102.       if (ret != NULL)
  103. >         memset(ret, 0, num);
  104.       return ret;
  105.   }

crypto/mem.c:104:5: 
  102.       if (ret != NULL)
  103.           memset(ret, 0, num);
  104. >     return ret;
  105.   }
  106.   

crypto/mem.c:105:1: return from a call to CRYPTO_zalloc
  103.           memset(ret, 0, num);
  104.       return ret;
  105. > }
  106.   
  107.   void *CRYPTO_realloc(void *str, size_t num, const char *file, int line)

crypto/x509v3/pcy_tree.c:166:9: Taking false branch
164.   
165.       /* If we get this far initialize the tree */
166.       if ((tree = OPENSSL_zalloc(sizeof(*tree))) == NULL)
               ^
167.           return X509_PCY_TREE_INTERNAL;
168.   

crypto/x509v3/pcy_tree.c:176:9: 
174.        * depth n, we have the leaf at depth 0 and the TA at depth n).
175.        */
176. >     if ((tree->levels = OPENSSL_zalloc(sizeof(*tree->levels)*(n+1))) == NULL) {
177.           OPENSSL_free(tree);
178.           return X509_PCY_TREE_INTERNAL;

crypto/mem.c:98:1: start of procedure CRYPTO_zalloc()
  96.   }
  97.   
  98. > void *CRYPTO_zalloc(size_t num, const char *file, int line)
  99.   {
  100.       void *ret = CRYPTO_malloc(num, file, line);

crypto/mem.c:100:5: 
  98.   void *CRYPTO_zalloc(size_t num, const char *file, int line)
  99.   {
  100. >     void *ret = CRYPTO_malloc(num, file, line);
  101.   
  102.       if (ret != NULL)

crypto/mem.c:71:1: start of procedure CRYPTO_malloc()
    69.   }
    70.   
    71. > void *CRYPTO_malloc(size_t num, const char *file, int line)
    72.   {
    73.       void *ret = NULL;

crypto/mem.c:73:5: 
    71.   void *CRYPTO_malloc(size_t num, const char *file, int line)
    72.   {
    73. >     void *ret = NULL;
    74.   
    75.       if (malloc_impl != NULL && malloc_impl != CRYPTO_malloc)

crypto/mem.c:75:9: Taking true branch
    73.       void *ret = NULL;
    74.   
    75.       if (malloc_impl != NULL && malloc_impl != CRYPTO_malloc)
                  ^
    76.           return malloc_impl(num, file, line);
    77.   

crypto/mem.c:75:32: Taking true branch
    73.       void *ret = NULL;
    74.   
    75.       if (malloc_impl != NULL && malloc_impl != CRYPTO_malloc)
                                         ^
    76.           return malloc_impl(num, file, line);
    77.   

crypto/mem.c:76:9: Skipping __function_pointer__(): unresolved function pointer
    74.   
    75.       if (malloc_impl != NULL && malloc_impl != CRYPTO_malloc)
    76.           return malloc_impl(num, file, line);
                  ^
    77.   
    78.       if (num <= 0)

crypto/mem.c:96:1: return from a call to CRYPTO_malloc
    94.   
    95.       return ret;
    96. > }
    97.   
    98.   void *CRYPTO_zalloc(size_t num, const char *file, int line)

crypto/mem.c:102:9: Taking true branch
  100.       void *ret = CRYPTO_malloc(num, file, line);
  101.   
  102.       if (ret != NULL)
                 ^
  103.           memset(ret, 0, num);
  104.       return ret;

crypto/mem.c:103:9: 
  101.   
  102.       if (ret != NULL)
  103. >         memset(ret, 0, num);
  104.       return ret;
  105.   }

crypto/mem.c:104:5: 
  102.       if (ret != NULL)
  103.           memset(ret, 0, num);
  104. >     return ret;
  105.   }
  106.   

crypto/mem.c:105:1: return from a call to CRYPTO_zalloc
  103.           memset(ret, 0, num);
  104.       return ret;
  105. > }
  106.   
  107.   void *CRYPTO_realloc(void *str, size_t num, const char *file, int line)

crypto/x509v3/pcy_tree.c:176:9: Taking false branch
174.        * depth n, we have the leaf at depth 0 and the TA at depth n).
175.        */
176.       if ((tree->levels = OPENSSL_zalloc(sizeof(*tree->levels)*(n+1))) == NULL) {
               ^
177.           OPENSSL_free(tree);
178.           return X509_PCY_TREE_INTERNAL;

crypto/x509v3/pcy_tree.c:180:5: 
178.           return X509_PCY_TREE_INTERNAL;
179.       }
180. >     tree->nlevel = n+1;
181.       level = tree->levels;
182.       if ((data = policy_data_new(NULL, OBJ_nid2obj(NID_any_policy), 0)) == NULL)

crypto/x509v3/pcy_tree.c:181:5: 
179.       }
180.       tree->nlevel = n+1;
181. >     level = tree->levels;
182.       if ((data = policy_data_new(NULL, OBJ_nid2obj(NID_any_policy), 0)) == NULL)
183.           goto bad_tree;

crypto/x509v3/pcy_tree.c:182:9: 
180.       tree->nlevel = n+1;
181.       level = tree->levels;
182. >     if ((data = policy_data_new(NULL, OBJ_nid2obj(NID_any_policy), 0)) == NULL)
183.           goto bad_tree;
184.       if (level_add_node(level, data, NULL, tree) == NULL) {

crypto/objects/obj_dat.c:220:1: start of procedure OBJ_nid2obj()
  218.   }
  219.   
  220. > ASN1_OBJECT *OBJ_nid2obj(int n)
  221.   {
  222.       ADDED_OBJ ad, *adp;

crypto/objects/obj_dat.c:225:10: Taking true branch
  223.       ASN1_OBJECT ob;
  224.   
  225.       if ((n >= 0) && (n < NUM_NID)) {
                  ^
  226.           if ((n != NID_undef) && (nid_objs[n].nid == NID_undef)) {
  227.               OBJerr(OBJ_F_OBJ_NID2OBJ, OBJ_R_UNKNOWN_NID);

crypto/objects/obj_dat.c:225:22: Taking true branch
  223.       ASN1_OBJECT ob;
  224.   
  225.       if ((n >= 0) && (n < NUM_NID)) {
                              ^
  226.           if ((n != NID_undef) && (nid_objs[n].nid == NID_undef)) {
  227.               OBJerr(OBJ_F_OBJ_NID2OBJ, OBJ_R_UNKNOWN_NID);

crypto/objects/obj_dat.c:226:14: Taking true branch
  224.   
  225.       if ((n >= 0) && (n < NUM_NID)) {
  226.           if ((n != NID_undef) && (nid_objs[n].nid == NID_undef)) {
                      ^
  227.               OBJerr(OBJ_F_OBJ_NID2OBJ, OBJ_R_UNKNOWN_NID);
  228.               return (NULL);

crypto/objects/obj_dat.c:226:34: Taking false branch
  224.   
  225.       if ((n >= 0) && (n < NUM_NID)) {
  226.           if ((n != NID_undef) && (nid_objs[n].nid == NID_undef)) {
                                          ^
  227.               OBJerr(OBJ_F_OBJ_NID2OBJ, OBJ_R_UNKNOWN_NID);
  228.               return (NULL);

crypto/objects/obj_dat.c:230:9: 
  228.               return (NULL);
  229.           }
  230. >         return ((ASN1_OBJECT *)&(nid_objs[n]));
  231.       } else if (added == NULL)
  232.           return (NULL);

crypto/objects/obj_dat.c:245:1: return from a call to OBJ_nid2obj
  243.           }
  244.       }
  245. > }
  246.   
  247.   const char *OBJ_nid2sn(int n)

crypto/x509v3/pcy_tree.c:182:9: Taking true branch
180.       tree->nlevel = n+1;
181.       level = tree->levels;
182.       if ((data = policy_data_new(NULL, OBJ_nid2obj(NID_any_policy), 0)) == NULL)
               ^
183.           goto bad_tree;
184.       if (level_add_node(level, data, NULL, tree) == NULL) {

crypto/x509v3/pcy_tree.c:234:2: 
232.       return ret;
233.   
234. >  bad_tree:
235.       X509_policy_tree_free(tree);
236.       return X509_PCY_TREE_INTERNAL;

crypto/x509v3/pcy_tree.c:235:5: Skipping X509_policy_tree_free(): empty list of specs
233.   
234.    bad_tree:
235.       X509_policy_tree_free(tree);
           ^
236.       return X509_PCY_TREE_INTERNAL;
237.   }

static int tree_init(X509_POLICY_TREE **ptree, STACK_OF(X509) *certs,
                     unsigned int flags)
{
    X509_POLICY_TREE *tree;
    X509_POLICY_LEVEL *level;
    const X509_POLICY_CACHE *cache;
    X509_POLICY_DATA *data = NULL;
    int ret = X509_PCY_TREE_VALID;
    int n = sk_X509_num(certs) - 1;
    int explicit_policy = (flags & X509_V_FLAG_EXPLICIT_POLICY) ? 0 : n+1;
    int any_skip = (flags & X509_V_FLAG_INHIBIT_ANY) ? 0 : n+1;
    int map_skip = (flags & X509_V_FLAG_INHIBIT_MAP) ? 0 : n+1;
    int i;
    *ptree = NULL;
    if (n == 0)
        return X509_PCY_TREE_EMPTY;
    for (i = n - 1; i >= 0; i--) {
        X509 *x = sk_X509_value(certs, i);
        X509_check_purpose(x, -1, 0);
        if ((cache = policy_cache_set(x)) == NULL)
            return X509_PCY_TREE_INTERNAL;
    }
    for (i = n - 1;
         i >= 0 && (explicit_policy > 0 || (ret & X509_PCY_TREE_EMPTY) == 0);
         i--) {
        X509 *x = sk_X509_value(certs, i);
        uint32_t ex_flags = X509_get_extension_flags(x);
        if (ex_flags & EXFLAG_INVALID_POLICY)
            return X509_PCY_TREE_INVALID;
        cache = policy_cache_set(x);
        if ((ret & X509_PCY_TREE_VALID) && cache->data == NULL)
            ret = X509_PCY_TREE_EMPTY;
        if (explicit_policy > 0) {
            if (!(ex_flags & EXFLAG_SI))
                explicit_policy--;
            if ((cache->explicit_skip >= 0)
                && (cache->explicit_skip < explicit_policy))
                explicit_policy = cache->explicit_skip;
        }
    }
    if (explicit_policy == 0)
        ret |= X509_PCY_TREE_EXPLICIT;
    if ((ret & X509_PCY_TREE_VALID) == 0)
        return ret;
    if ((tree = OPENSSL_zalloc(sizeof(*tree))) == NULL)
        return X509_PCY_TREE_INTERNAL;
    if ((tree->levels = OPENSSL_zalloc(sizeof(*tree->levels)*(n+1))) == NULL) {
        OPENSSL_free(tree);
        return X509_PCY_TREE_INTERNAL;
    }
    tree->nlevel = n+1;
    level = tree->levels;
    if ((data = policy_data_new(NULL, OBJ_nid2obj(NID_any_policy), 0)) == NULL)
        goto bad_tree;
    if (level_add_node(level, data, NULL, tree) == NULL) {
        policy_data_free(data);
        goto bad_tree;
    }
    for (i = n - 1; i >= 0; i--) {
        X509 *x = sk_X509_value(certs, i);
        uint32_t ex_flags = X509_get_extension_flags(x);
        cache = policy_cache_set(x);
        X509_up_ref(x);
        (++level)->cert = x;
        if (!cache->anyPolicy)
            level->flags |= X509_V_FLAG_INHIBIT_ANY;
        if (any_skip == 0) {
            if (!(ex_flags & EXFLAG_SI) || (i == 0))
                level->flags |= X509_V_FLAG_INHIBIT_ANY;
        } else {
            if (!(ex_flags & EXFLAG_SI))
                any_skip--;
            if ((cache->any_skip >= 0) && (cache->any_skip < any_skip))
                any_skip = cache->any_skip;
        }
        if (map_skip == 0)
            level->flags |= X509_V_FLAG_INHIBIT_MAP;
        else {
            if (!(ex_flags & EXFLAG_SI))
                map_skip--;
            if ((cache->map_skip >= 0) && (cache->map_skip < map_skip))
                map_skip = cache->map_skip;
        }
    }
    *ptree = tree;
    return ret;
 bad_tree:
    X509_policy_tree_free(tree);
    return X509_PCY_TREE_INTERNAL;
}
['static int tree_init(X509_POLICY_TREE **ptree, STACK_OF(X509) *certs,\n                     unsigned int flags)\n{\n    X509_POLICY_TREE *tree;\n    X509_POLICY_LEVEL *level;\n    const X509_POLICY_CACHE *cache;\n    X509_POLICY_DATA *data = NULL;\n    int ret = X509_PCY_TREE_VALID;\n    int n = sk_X509_num(certs) - 1;\n    int explicit_policy = (flags & X509_V_FLAG_EXPLICIT_POLICY) ? 0 : n+1;\n    int any_skip = (flags & X509_V_FLAG_INHIBIT_ANY) ? 0 : n+1;\n    int map_skip = (flags & X509_V_FLAG_INHIBIT_MAP) ? 0 : n+1;\n    int i;\n    *ptree = NULL;\n    if (n == 0)\n        return X509_PCY_TREE_EMPTY;\n    for (i = n - 1; i >= 0; i--) {\n        X509 *x = sk_X509_value(certs, i);\n        X509_check_purpose(x, -1, 0);\n        if ((cache = policy_cache_set(x)) == NULL)\n            return X509_PCY_TREE_INTERNAL;\n    }\n    for (i = n - 1;\n         i >= 0 && (explicit_policy > 0 || (ret & X509_PCY_TREE_EMPTY) == 0);\n         i--) {\n        X509 *x = sk_X509_value(certs, i);\n        uint32_t ex_flags = X509_get_extension_flags(x);\n        if (ex_flags & EXFLAG_INVALID_POLICY)\n            return X509_PCY_TREE_INVALID;\n        cache = policy_cache_set(x);\n        if ((ret & X509_PCY_TREE_VALID) && cache->data == NULL)\n            ret = X509_PCY_TREE_EMPTY;\n        if (explicit_policy > 0) {\n            if (!(ex_flags & EXFLAG_SI))\n                explicit_policy--;\n            if ((cache->explicit_skip >= 0)\n                && (cache->explicit_skip < explicit_policy))\n                explicit_policy = cache->explicit_skip;\n        }\n    }\n    if (explicit_policy == 0)\n        ret |= X509_PCY_TREE_EXPLICIT;\n    if ((ret & X509_PCY_TREE_VALID) == 0)\n        return ret;\n    if ((tree = OPENSSL_zalloc(sizeof(*tree))) == NULL)\n        return X509_PCY_TREE_INTERNAL;\n    if ((tree->levels = OPENSSL_zalloc(sizeof(*tree->levels)*(n+1))) == NULL) {\n        OPENSSL_free(tree);\n        return X509_PCY_TREE_INTERNAL;\n    }\n    tree->nlevel = n+1;\n    level = tree->levels;\n    if ((data = policy_data_new(NULL, OBJ_nid2obj(NID_any_policy), 0)) == NULL)\n        goto bad_tree;\n    if (level_add_node(level, data, NULL, tree) == NULL) {\n        policy_data_free(data);\n        goto bad_tree;\n    }\n    for (i = n - 1; i >= 0; i--) {\n        X509 *x = sk_X509_value(certs, i);\n        uint32_t ex_flags = X509_get_extension_flags(x);\n        cache = policy_cache_set(x);\n        X509_up_ref(x);\n        (++level)->cert = x;\n        if (!cache->anyPolicy)\n            level->flags |= X509_V_FLAG_INHIBIT_ANY;\n        if (any_skip == 0) {\n            if (!(ex_flags & EXFLAG_SI) || (i == 0))\n                level->flags |= X509_V_FLAG_INHIBIT_ANY;\n        } else {\n            if (!(ex_flags & EXFLAG_SI))\n                any_skip--;\n            if ((cache->any_skip >= 0) && (cache->any_skip < any_skip))\n                any_skip = cache->any_skip;\n        }\n        if (map_skip == 0)\n            level->flags |= X509_V_FLAG_INHIBIT_MAP;\n        else {\n            if (!(ex_flags & EXFLAG_SI))\n                map_skip--;\n            if ((cache->map_skip >= 0) && (cache->map_skip < map_skip))\n                map_skip = cache->map_skip;\n        }\n    }\n    *ptree = tree;\n    return ret;\n bad_tree:\n    X509_policy_tree_free(tree);\n    return X509_PCY_TREE_INTERNAL;\n}', 'DEFINE_STACK_OF(X509)', 'int OPENSSL_sk_num(const OPENSSL_STACK *st)\n{\n    if (st == NULL)\n        return -1;\n    return st->num;\n}', 'void *CRYPTO_zalloc(size_t num, const char *file, int line)\n{\n    void *ret = CRYPTO_malloc(num, file, line);\n    if (ret != NULL)\n        memset(ret, 0, num);\n    return ret;\n}', 'void *CRYPTO_malloc(size_t num, const char *file, int line)\n{\n    void *ret = NULL;\n    if (malloc_impl != NULL && malloc_impl != CRYPTO_malloc)\n        return malloc_impl(num, file, line);\n    if (num <= 0)\n        return NULL;\n    allow_customize = 0;\n#ifndef OPENSSL_NO_CRYPTO_MDEBUG\n    if (call_malloc_debug) {\n        CRYPTO_mem_debug_malloc(NULL, num, 0, file, line);\n        ret = malloc(num);\n        CRYPTO_mem_debug_malloc(ret, num, 1, file, line);\n    } else {\n        ret = malloc(num);\n    }\n#else\n    osslargused(file); osslargused(line);\n    ret = malloc(num);\n#endif\n    return ret;\n}', 'ASN1_OBJECT *OBJ_nid2obj(int n)\n{\n    ADDED_OBJ ad, *adp;\n    ASN1_OBJECT ob;\n    if ((n >= 0) && (n < NUM_NID)) {\n        if ((n != NID_undef) && (nid_objs[n].nid == NID_undef)) {\n            OBJerr(OBJ_F_OBJ_NID2OBJ, OBJ_R_UNKNOWN_NID);\n            return (NULL);\n        }\n        return ((ASN1_OBJECT *)&(nid_objs[n]));\n    } else if (added == NULL)\n        return (NULL);\n    else {\n        ad.type = ADDED_NID;\n        ad.obj = &ob;\n        ob.nid = n;\n        adp = lh_ADDED_OBJ_retrieve(added, &ad);\n        if (adp != NULL)\n            return (adp->obj);\n        else {\n            OBJerr(OBJ_F_OBJ_NID2OBJ, OBJ_R_UNKNOWN_NID);\n            return (NULL);\n        }\n    }\n}']