crypto/x509/x509_cmp.c:41: error: NULL_DEREFERENCE
  pointer `null` is dereferenced by call to `X509_NAME_oneline()` at line 41, column 9.
Showing all 22 steps of the trace


crypto/x509/x509_cmp.c:32:1: start of procedure X509_issuer_and_serial_hash()
30.   
31.   #ifndef OPENSSL_NO_MD5
32. > unsigned long X509_issuer_and_serial_hash(X509 *a)
33.   {
34.       unsigned long ret = 0;

crypto/x509/x509_cmp.c:34:5: 
32.   unsigned long X509_issuer_and_serial_hash(X509 *a)
33.   {
34. >     unsigned long ret = 0;
35.       EVP_MD_CTX *ctx = EVP_MD_CTX_new();
36.       unsigned char md[16];

crypto/x509/x509_cmp.c:35:5: 
33.   {
34.       unsigned long ret = 0;
35. >     EVP_MD_CTX *ctx = EVP_MD_CTX_new();
36.       unsigned char md[16];
37.       char *f;

crypto/evp/digest.c:74:1: start of procedure EVP_MD_CTX_new()
  72.   }
  73.   
  74. > EVP_MD_CTX *EVP_MD_CTX_new(void)
  75.   {
  76.       return OPENSSL_zalloc(sizeof(EVP_MD_CTX));

crypto/evp/digest.c:76:5: 
  74.   EVP_MD_CTX *EVP_MD_CTX_new(void)
  75.   {
  76. >     return OPENSSL_zalloc(sizeof(EVP_MD_CTX));
  77.   }
  78.   

providers/fips/fipsprov.c:476:1: start of procedure CRYPTO_zalloc()
    474.   }
    475.   
    476. > void *CRYPTO_zalloc(size_t num, const char *file, int line)
    477.   {
    478.       return c_CRYPTO_zalloc(num, file, line);

providers/fips/fipsprov.c:478:5: Skipping __function_pointer__(): unresolved function pointer
    476.   void *CRYPTO_zalloc(size_t num, const char *file, int line)
    477.   {
    478.       return c_CRYPTO_zalloc(num, file, line);
               ^
    479.   }
    480.   

providers/fips/fipsprov.c:479:1: return from a call to CRYPTO_zalloc
    477.   {
    478.       return c_CRYPTO_zalloc(num, file, line);
    479. > }
    480.   
    481.   void *CRYPTO_memdup(const void *str, size_t siz, const char *file, int line)

crypto/evp/digest.c:77:1: return from a call to EVP_MD_CTX_new
  75.   {
  76.       return OPENSSL_zalloc(sizeof(EVP_MD_CTX));
  77. > }
  78.   
  79.   void EVP_MD_CTX_free(EVP_MD_CTX *ctx)

crypto/x509/x509_cmp.c:39:9: Taking false branch
37.       char *f;
38.   
39.       if (ctx == NULL)
              ^
40.           goto err;
41.       f = X509_NAME_oneline(a->cert_info.issuer, NULL, 0);

crypto/x509/x509_cmp.c:41:5: 
39.       if (ctx == NULL)
40.           goto err;
41. >     f = X509_NAME_oneline(a->cert_info.issuer, NULL, 0);
42.       if (!EVP_DigestInit_ex(ctx, EVP_md5(), NULL))
43.           goto err;

crypto/x509/x509_obj.c:24:1: start of procedure X509_NAME_oneline()
  22.   #define NAME_ONELINE_MAX    (1024 * 1024)
  23.   
  24. > char *X509_NAME_oneline(const X509_NAME *a, char *buf, int len)
  25.   {
  26.       const X509_NAME_ENTRY *ne;

crypto/x509/x509_obj.c:32:5: 
  30.       char *p;
  31.       unsigned char *q;
  32. >     BUF_MEM *b = NULL;
  33.       static const char hex[17] = "0123456789ABCDEF";
  34.       int gs_doit[4];

crypto/x509/x509_obj.c:33:5: 
  31.       unsigned char *q;
  32.       BUF_MEM *b = NULL;
  33. >     static const char hex[17] = "0123456789ABCDEF";
  34.       int gs_doit[4];
  35.       char tmp_buf[80];

crypto/x509/x509_obj.c:40:9: Taking false branch
  38.   #endif
  39.   
  40.       if (buf == NULL) {
                ^
  41.           if ((b = BUF_MEM_new()) == NULL)
  42.               goto err;

crypto/x509/x509_obj.c:47:16: Taking false branch
  45.           b->data[0] = '\0';
  46.           len = 200;
  47.       } else if (len == 0) {
                       ^
  48.           return NULL;
  49.       }

crypto/x509/x509_obj.c:50:9: Taking true branch
  48.           return NULL;
  49.       }
  50.       if (a == NULL) {
                ^
  51.           if (b) {
  52.               buf = b->data;

crypto/x509/x509_obj.c:51:13: Taking false branch
  49.       }
  50.       if (a == NULL) {
  51.           if (b) {
                    ^
  52.               buf = b->data;
  53.               OPENSSL_free(b);

crypto/x509/x509_obj.c:55:9: 
  53.               OPENSSL_free(b);
  54.           }
  55. >         strncpy(buf, "NO X509_NAME", len);
  56.           buf[len - 1] = '\0';
  57.           return buf;

crypto/x509/x509_obj.c:56:9: 
  54.           }
  55.           strncpy(buf, "NO X509_NAME", len);
  56. >         buf[len - 1] = '\0';
  57.           return buf;
  58.       }

crypto/x509/x509_obj.c:57:9: 
  55.           strncpy(buf, "NO X509_NAME", len);
  56.           buf[len - 1] = '\0';
  57. >         return buf;
  58.       }
  59.   

crypto/x509/x509_obj.c:181:1: return from a call to X509_NAME_oneline
  179.       BUF_MEM_free(b);
  180.       return NULL;
  181. > }

unsigned long X509_issuer_and_serial_hash(X509 *a)
{
    unsigned long ret = 0;
    EVP_MD_CTX *ctx = EVP_MD_CTX_new();
    unsigned char md[16];
    char *f;
    if (ctx == NULL)
        goto err;
    f = X509_NAME_oneline(a->cert_info.issuer, NULL, 0);
    if (!EVP_DigestInit_ex(ctx, EVP_md5(), NULL))
        goto err;
    if (!EVP_DigestUpdate(ctx, (unsigned char *)f, strlen(f)))
        goto err;
    OPENSSL_free(f);
    if (!EVP_DigestUpdate
        (ctx, (unsigned char *)a->cert_info.serialNumber.data,
         (unsigned long)a->cert_info.serialNumber.length))
        goto err;
    if (!EVP_DigestFinal_ex(ctx, &(md[0]), NULL))
        goto err;
    ret = (((unsigned long)md[0]) | ((unsigned long)md[1] << 8L) |
           ((unsigned long)md[2] << 16L) | ((unsigned long)md[3] << 24L)
        ) & 0xffffffffL;
 err:
    EVP_MD_CTX_free(ctx);
    return ret;
}
['unsigned long X509_issuer_and_serial_hash(X509 *a)\n{\n    unsigned long ret = 0;\n    EVP_MD_CTX *ctx = EVP_MD_CTX_new();\n    unsigned char md[16];\n    char *f;\n    if (ctx == NULL)\n        goto err;\n    f = X509_NAME_oneline(a->cert_info.issuer, NULL, 0);\n    if (!EVP_DigestInit_ex(ctx, EVP_md5(), NULL))\n        goto err;\n    if (!EVP_DigestUpdate(ctx, (unsigned char *)f, strlen(f)))\n        goto err;\n    OPENSSL_free(f);\n    if (!EVP_DigestUpdate\n        (ctx, (unsigned char *)a->cert_info.serialNumber.data,\n         (unsigned long)a->cert_info.serialNumber.length))\n        goto err;\n    if (!EVP_DigestFinal_ex(ctx, &(md[0]), NULL))\n        goto err;\n    ret = (((unsigned long)md[0]) | ((unsigned long)md[1] << 8L) |\n           ((unsigned long)md[2] << 16L) | ((unsigned long)md[3] << 24L)\n        ) & 0xffffffffL;\n err:\n    EVP_MD_CTX_free(ctx);\n    return ret;\n}', 'EVP_MD_CTX *EVP_MD_CTX_new(void)\n{\n    return OPENSSL_zalloc(sizeof(EVP_MD_CTX));\n}', 'void *CRYPTO_zalloc(size_t num, const char *file, int line)\n{\n    return c_CRYPTO_zalloc(num, file, line);\n}', 'char *X509_NAME_oneline(const X509_NAME *a, char *buf, int len)\n{\n    const X509_NAME_ENTRY *ne;\n    int i;\n    int n, lold, l, l1, l2, num, j, type;\n    const char *s;\n    char *p;\n    unsigned char *q;\n    BUF_MEM *b = NULL;\n    static const char hex[17] = "0123456789ABCDEF";\n    int gs_doit[4];\n    char tmp_buf[80];\n#ifdef CHARSET_EBCDIC\n    unsigned char ebcdic_buf[1024];\n#endif\n    if (buf == NULL) {\n        if ((b = BUF_MEM_new()) == NULL)\n            goto err;\n        if (!BUF_MEM_grow(b, 200))\n            goto err;\n        b->data[0] = \'\\0\';\n        len = 200;\n    } else if (len == 0) {\n        return NULL;\n    }\n    if (a == NULL) {\n        if (b) {\n            buf = b->data;\n            OPENSSL_free(b);\n        }\n        strncpy(buf, "NO X509_NAME", len);\n        buf[len - 1] = \'\\0\';\n        return buf;\n    }\n    len--;\n    l = 0;\n    for (i = 0; i < sk_X509_NAME_ENTRY_num(a->entries); i++) {\n        ne = sk_X509_NAME_ENTRY_value(a->entries, i);\n        n = OBJ_obj2nid(ne->object);\n        if ((n == NID_undef) || ((s = OBJ_nid2sn(n)) == NULL)) {\n            i2t_ASN1_OBJECT(tmp_buf, sizeof(tmp_buf), ne->object);\n            s = tmp_buf;\n        }\n        l1 = strlen(s);\n        type = ne->value->type;\n        num = ne->value->length;\n        if (num > NAME_ONELINE_MAX) {\n            X509err(X509_F_X509_NAME_ONELINE, X509_R_NAME_TOO_LONG);\n            goto end;\n        }\n        q = ne->value->data;\n#ifdef CHARSET_EBCDIC\n        if (type == V_ASN1_GENERALSTRING ||\n            type == V_ASN1_VISIBLESTRING ||\n            type == V_ASN1_PRINTABLESTRING ||\n            type == V_ASN1_TELETEXSTRING ||\n            type == V_ASN1_IA5STRING) {\n            if (num > (int)sizeof(ebcdic_buf))\n                num = sizeof(ebcdic_buf);\n            ascii2ebcdic(ebcdic_buf, q, num);\n            q = ebcdic_buf;\n        }\n#endif\n        if ((type == V_ASN1_GENERALSTRING) && ((num % 4) == 0)) {\n            gs_doit[0] = gs_doit[1] = gs_doit[2] = gs_doit[3] = 0;\n            for (j = 0; j < num; j++)\n                if (q[j] != 0)\n                    gs_doit[j & 3] = 1;\n            if (gs_doit[0] | gs_doit[1] | gs_doit[2])\n                gs_doit[0] = gs_doit[1] = gs_doit[2] = gs_doit[3] = 1;\n            else {\n                gs_doit[0] = gs_doit[1] = gs_doit[2] = 0;\n                gs_doit[3] = 1;\n            }\n        } else\n            gs_doit[0] = gs_doit[1] = gs_doit[2] = gs_doit[3] = 1;\n        for (l2 = j = 0; j < num; j++) {\n            if (!gs_doit[j & 3])\n                continue;\n            l2++;\n#ifndef CHARSET_EBCDIC\n            if ((q[j] < \' \') || (q[j] > \'~\'))\n                l2 += 3;\n#else\n            if ((os_toascii[q[j]] < os_toascii[\' \']) ||\n                (os_toascii[q[j]] > os_toascii[\'~\']))\n                l2 += 3;\n#endif\n        }\n        lold = l;\n        l += 1 + l1 + 1 + l2;\n        if (l > NAME_ONELINE_MAX) {\n            X509err(X509_F_X509_NAME_ONELINE, X509_R_NAME_TOO_LONG);\n            goto end;\n        }\n        if (b != NULL) {\n            if (!BUF_MEM_grow(b, l + 1))\n                goto err;\n            p = &(b->data[lold]);\n        } else if (l > len) {\n            break;\n        } else\n            p = &(buf[lold]);\n        *(p++) = \'/\';\n        memcpy(p, s, (unsigned int)l1);\n        p += l1;\n        *(p++) = \'=\';\n#ifndef CHARSET_EBCDIC\n        q = ne->value->data;\n#endif\n        for (j = 0; j < num; j++) {\n            if (!gs_doit[j & 3])\n                continue;\n#ifndef CHARSET_EBCDIC\n            n = q[j];\n            if ((n < \' \') || (n > \'~\')) {\n                *(p++) = \'\\\\\';\n                *(p++) = \'x\';\n                *(p++) = hex[(n >> 4) & 0x0f];\n                *(p++) = hex[n & 0x0f];\n            } else\n                *(p++) = n;\n#else\n            n = os_toascii[q[j]];\n            if ((n < os_toascii[\' \']) || (n > os_toascii[\'~\'])) {\n                *(p++) = \'\\\\\';\n                *(p++) = \'x\';\n                *(p++) = hex[(n >> 4) & 0x0f];\n                *(p++) = hex[n & 0x0f];\n            } else\n                *(p++) = q[j];\n#endif\n        }\n        *p = \'\\0\';\n    }\n    if (b != NULL) {\n        p = b->data;\n        OPENSSL_free(b);\n    } else\n        p = buf;\n    if (i == 0)\n        *p = \'\\0\';\n    return p;\n err:\n    X509err(X509_F_X509_NAME_ONELINE, ERR_R_MALLOC_FAILURE);\n end:\n    BUF_MEM_free(b);\n    return NULL;\n}']