crypto/ts/ts_rsp_verify.c:382: error: NULL_DEREFERENCE
  pointer `signer` last assigned on line 344 could be null and is dereferenced by call to `ts_check_signer_name()` at line 382, column 25.
Showing all 34 steps of the trace


crypto/ts/ts_rsp_verify.c:341:1: start of procedure int_ts_RESP_verify_token()
339.    *      - Check if the TSA name is the expected TSA.
340.    */
341. > static int int_ts_RESP_verify_token(TS_VERIFY_CTX *ctx,
342.                                       PKCS7 *token, TS_TST_INFO *tst_info)
343.   {

crypto/ts/ts_rsp_verify.c:344:5: 
342.                                       PKCS7 *token, TS_TST_INFO *tst_info)
343.   {
344. >     X509 *signer = NULL;
345.       GENERAL_NAME *tsa_name = tst_info->tsa;
346.       X509_ALGOR *md_alg = NULL;

crypto/ts/ts_rsp_verify.c:345:5: 
343.   {
344.       X509 *signer = NULL;
345. >     GENERAL_NAME *tsa_name = tst_info->tsa;
346.       X509_ALGOR *md_alg = NULL;
347.       unsigned char *imprint = NULL;

crypto/ts/ts_rsp_verify.c:346:5: 
344.       X509 *signer = NULL;
345.       GENERAL_NAME *tsa_name = tst_info->tsa;
346. >     X509_ALGOR *md_alg = NULL;
347.       unsigned char *imprint = NULL;
348.       unsigned imprint_len = 0;

crypto/ts/ts_rsp_verify.c:347:5: 
345.       GENERAL_NAME *tsa_name = tst_info->tsa;
346.       X509_ALGOR *md_alg = NULL;
347. >     unsigned char *imprint = NULL;
348.       unsigned imprint_len = 0;
349.       int ret = 0;

crypto/ts/ts_rsp_verify.c:348:5: 
346.       X509_ALGOR *md_alg = NULL;
347.       unsigned char *imprint = NULL;
348. >     unsigned imprint_len = 0;
349.       int ret = 0;
350.       int flags = ctx->flags;

crypto/ts/ts_rsp_verify.c:349:5: 
347.       unsigned char *imprint = NULL;
348.       unsigned imprint_len = 0;
349. >     int ret = 0;
350.       int flags = ctx->flags;
351.   

crypto/ts/ts_rsp_verify.c:350:5: 
348.       unsigned imprint_len = 0;
349.       int ret = 0;
350. >     int flags = ctx->flags;
351.   
352.       /* Some options require us to also check the signature */

crypto/ts/ts_rsp_verify.c:353:11: Taking true branch
351.   
352.       /* Some options require us to also check the signature */
353.       if (((flags & TS_VFY_SIGNER) && tsa_name != NULL)
                 ^
354.               || (flags & TS_VFY_TSA_NAME)) {
355.           flags |= TS_VFY_SIGNATURE;

crypto/ts/ts_rsp_verify.c:353:37: Taking true branch
351.   
352.       /* Some options require us to also check the signature */
353.       if (((flags & TS_VFY_SIGNER) && tsa_name != NULL)
                                           ^
354.               || (flags & TS_VFY_TSA_NAME)) {
355.           flags |= TS_VFY_SIGNATURE;

crypto/ts/ts_rsp_verify.c:355:9: 
353.       if (((flags & TS_VFY_SIGNER) && tsa_name != NULL)
354.               || (flags & TS_VFY_TSA_NAME)) {
355. >         flags |= TS_VFY_SIGNATURE;
356.       }
357.   

crypto/ts/ts_rsp_verify.c:358:10: Taking false branch
356.       }
357.   
358.       if ((flags & TS_VFY_SIGNATURE)
                ^
359.           && !TS_RESP_verify_signature(token, ctx->certs, ctx->store, &signer))
360.           goto err;

crypto/ts/ts_rsp_verify.c:361:10: Taking false branch
359.           && !TS_RESP_verify_signature(token, ctx->certs, ctx->store, &signer))
360.           goto err;
361.       if ((flags & TS_VFY_VERSION)
                ^
362.           && TS_TST_INFO_get_version(tst_info) != 1) {
363.           TSerr(TS_F_INT_TS_RESP_VERIFY_TOKEN, TS_R_UNSUPPORTED_VERSION);

crypto/ts/ts_rsp_verify.c:366:10: Taking true branch
364.           goto err;
365.       }
366.       if ((flags & TS_VFY_POLICY)
                ^
367.           && !ts_check_policy(ctx->policy, tst_info))
368.           goto err;

crypto/ts/ts_rsp_verify.c:367:13: 
365.       }
366.       if ((flags & TS_VFY_POLICY)
367. >         && !ts_check_policy(ctx->policy, tst_info))
368.           goto err;
369.       if ((flags & TS_VFY_IMPRINT)

crypto/ts/ts_rsp_verify.c:480:1: start of procedure ts_check_policy()
  478.   }
  479.   
  480. > static int ts_check_policy(ASN1_OBJECT *req_oid, TS_TST_INFO *tst_info)
  481.   {
  482.       ASN1_OBJECT *resp_oid = tst_info->policy_id;

crypto/ts/ts_rsp_verify.c:482:5: 
  480.   static int ts_check_policy(ASN1_OBJECT *req_oid, TS_TST_INFO *tst_info)
  481.   {
  482. >     ASN1_OBJECT *resp_oid = tst_info->policy_id;
  483.   
  484.       if (OBJ_cmp(req_oid, resp_oid) != 0) {

crypto/ts/ts_rsp_verify.c:484:9: 
  482.       ASN1_OBJECT *resp_oid = tst_info->policy_id;
  483.   
  484. >     if (OBJ_cmp(req_oid, resp_oid) != 0) {
  485.           TSerr(TS_F_TS_CHECK_POLICY, TS_R_POLICY_MISMATCH);
  486.           return 0;

crypto/objects/obj_lib.c:58:1: start of procedure OBJ_cmp()
    56.   }
    57.   
    58. > int OBJ_cmp(const ASN1_OBJECT *a, const ASN1_OBJECT *b)
    59.   {
    60.       int ret;

crypto/objects/obj_lib.c:62:5: 
    60.       int ret;
    61.   
    62. >     ret = (a->length - b->length);
    63.       if (ret)
    64.           return (ret);

crypto/objects/obj_lib.c:63:9: Taking true branch
    61.   
    62.       ret = (a->length - b->length);
    63.       if (ret)
                  ^
    64.           return (ret);
    65.       return (memcmp(a->data, b->data, a->length));

crypto/objects/obj_lib.c:64:9: 
    62.       ret = (a->length - b->length);
    63.       if (ret)
    64. >         return (ret);
    65.       return (memcmp(a->data, b->data, a->length));
    66.   }

crypto/objects/obj_lib.c:66:1: return from a call to OBJ_cmp
    64.           return (ret);
    65.       return (memcmp(a->data, b->data, a->length));
    66. > }

crypto/ts/ts_rsp_verify.c:484:9: Taking false branch
  482.       ASN1_OBJECT *resp_oid = tst_info->policy_id;
  483.   
  484.       if (OBJ_cmp(req_oid, resp_oid) != 0) {
                 ^
  485.           TSerr(TS_F_TS_CHECK_POLICY, TS_R_POLICY_MISMATCH);
  486.           return 0;

crypto/ts/ts_rsp_verify.c:489:5: 
  487.       }
  488.   
  489. >     return 1;
  490.   }
  491.   

crypto/ts/ts_rsp_verify.c:490:1: return from a call to ts_check_policy
  488.   
  489.       return 1;
  490. > }
  491.   
  492.   static int ts_compute_imprint(BIO *data, TS_TST_INFO *tst_info,

crypto/ts/ts_rsp_verify.c:367:13: Taking false branch
365.       }
366.       if ((flags & TS_VFY_POLICY)
367.           && !ts_check_policy(ctx->policy, tst_info))
                   ^
368.           goto err;
369.       if ((flags & TS_VFY_IMPRINT)

crypto/ts/ts_rsp_verify.c:369:10: Taking true branch
367.           && !ts_check_policy(ctx->policy, tst_info))
368.           goto err;
369.       if ((flags & TS_VFY_IMPRINT)
                ^
370.           && !ts_check_imprints(ctx->md_alg, ctx->imprint, ctx->imprint_len,
371.                                 tst_info))

crypto/ts/ts_rsp_verify.c:370:13: Taking false branch
368.           goto err;
369.       if ((flags & TS_VFY_IMPRINT)
370.           && !ts_check_imprints(ctx->md_alg, ctx->imprint, ctx->imprint_len,
                   ^
371.                                 tst_info))
372.           goto err;

crypto/ts/ts_rsp_verify.c:373:10: Taking false branch
371.                                 tst_info))
372.           goto err;
373.       if ((flags & TS_VFY_DATA)
                ^
374.           && (!ts_compute_imprint(ctx->data, tst_info,
375.                                   &md_alg, &imprint, &imprint_len)

crypto/ts/ts_rsp_verify.c:378:10: Taking false branch
376.               || !ts_check_imprints(md_alg, imprint, imprint_len, tst_info)))
377.           goto err;
378.       if ((flags & TS_VFY_NONCE)
                ^
379.           && !ts_check_nonces(ctx->nonce, tst_info))
380.           goto err;

crypto/ts/ts_rsp_verify.c:381:10: Taking true branch
379.           && !ts_check_nonces(ctx->nonce, tst_info))
380.           goto err;
381.       if ((flags & TS_VFY_SIGNER)
                ^
382.           && tsa_name && !ts_check_signer_name(tsa_name, signer)) {
383.           TSerr(TS_F_INT_TS_RESP_VERIFY_TOKEN, TS_R_TSA_NAME_MISMATCH);

crypto/ts/ts_rsp_verify.c:382:12: Taking true branch
380.           goto err;
381.       if ((flags & TS_VFY_SIGNER)
382.           && tsa_name && !ts_check_signer_name(tsa_name, signer)) {
                  ^
383.           TSerr(TS_F_INT_TS_RESP_VERIFY_TOKEN, TS_R_TSA_NAME_MISMATCH);
384.           goto err;

crypto/ts/ts_rsp_verify.c:382:25: 
380.           goto err;
381.       if ((flags & TS_VFY_SIGNER)
382. >         && tsa_name && !ts_check_signer_name(tsa_name, signer)) {
383.           TSerr(TS_F_INT_TS_RESP_VERIFY_TOKEN, TS_R_TSA_NAME_MISMATCH);
384.           goto err;

static int int_ts_RESP_verify_token(TS_VERIFY_CTX *ctx,
                                    PKCS7 *token, TS_TST_INFO *tst_info)
{
    X509 *signer = NULL;
    GENERAL_NAME *tsa_name = tst_info->tsa;
    X509_ALGOR *md_alg = NULL;
    unsigned char *imprint = NULL;
    unsigned imprint_len = 0;
    int ret = 0;
    int flags = ctx->flags;
    if (((flags & TS_VFY_SIGNER) && tsa_name != NULL)
            || (flags & TS_VFY_TSA_NAME)) {
        flags |= TS_VFY_SIGNATURE;
    }
    if ((flags & TS_VFY_SIGNATURE)
        && !TS_RESP_verify_signature(token, ctx->certs, ctx->store, &signer))
        goto err;
    if ((flags & TS_VFY_VERSION)
        && TS_TST_INFO_get_version(tst_info) != 1) {
        TSerr(TS_F_INT_TS_RESP_VERIFY_TOKEN, TS_R_UNSUPPORTED_VERSION);
        goto err;
    }
    if ((flags & TS_VFY_POLICY)
        && !ts_check_policy(ctx->policy, tst_info))
        goto err;
    if ((flags & TS_VFY_IMPRINT)
        && !ts_check_imprints(ctx->md_alg, ctx->imprint, ctx->imprint_len,
                              tst_info))
        goto err;
    if ((flags & TS_VFY_DATA)
        && (!ts_compute_imprint(ctx->data, tst_info,
                                &md_alg, &imprint, &imprint_len)
            || !ts_check_imprints(md_alg, imprint, imprint_len, tst_info)))
        goto err;
    if ((flags & TS_VFY_NONCE)
        && !ts_check_nonces(ctx->nonce, tst_info))
        goto err;
    if ((flags & TS_VFY_SIGNER)
        && tsa_name && !ts_check_signer_name(tsa_name, signer)) {
        TSerr(TS_F_INT_TS_RESP_VERIFY_TOKEN, TS_R_TSA_NAME_MISMATCH);
        goto err;
    }
    if ((flags & TS_VFY_TSA_NAME)
        && !ts_check_signer_name(ctx->tsa_name, signer)) {
        TSerr(TS_F_INT_TS_RESP_VERIFY_TOKEN, TS_R_TSA_UNTRUSTED);
        goto err;
    }
    ret = 1;
 err:
    X509_free(signer);
    X509_ALGOR_free(md_alg);
    OPENSSL_free(imprint);
    return ret;
}
['static int int_ts_RESP_verify_token(TS_VERIFY_CTX *ctx,\n                                    PKCS7 *token, TS_TST_INFO *tst_info)\n{\n    X509 *signer = NULL;\n    GENERAL_NAME *tsa_name = tst_info->tsa;\n    X509_ALGOR *md_alg = NULL;\n    unsigned char *imprint = NULL;\n    unsigned imprint_len = 0;\n    int ret = 0;\n    int flags = ctx->flags;\n    if (((flags & TS_VFY_SIGNER) && tsa_name != NULL)\n            || (flags & TS_VFY_TSA_NAME)) {\n        flags |= TS_VFY_SIGNATURE;\n    }\n    if ((flags & TS_VFY_SIGNATURE)\n        && !TS_RESP_verify_signature(token, ctx->certs, ctx->store, &signer))\n        goto err;\n    if ((flags & TS_VFY_VERSION)\n        && TS_TST_INFO_get_version(tst_info) != 1) {\n        TSerr(TS_F_INT_TS_RESP_VERIFY_TOKEN, TS_R_UNSUPPORTED_VERSION);\n        goto err;\n    }\n    if ((flags & TS_VFY_POLICY)\n        && !ts_check_policy(ctx->policy, tst_info))\n        goto err;\n    if ((flags & TS_VFY_IMPRINT)\n        && !ts_check_imprints(ctx->md_alg, ctx->imprint, ctx->imprint_len,\n                              tst_info))\n        goto err;\n    if ((flags & TS_VFY_DATA)\n        && (!ts_compute_imprint(ctx->data, tst_info,\n                                &md_alg, &imprint, &imprint_len)\n            || !ts_check_imprints(md_alg, imprint, imprint_len, tst_info)))\n        goto err;\n    if ((flags & TS_VFY_NONCE)\n        && !ts_check_nonces(ctx->nonce, tst_info))\n        goto err;\n    if ((flags & TS_VFY_SIGNER)\n        && tsa_name && !ts_check_signer_name(tsa_name, signer)) {\n        TSerr(TS_F_INT_TS_RESP_VERIFY_TOKEN, TS_R_TSA_NAME_MISMATCH);\n        goto err;\n    }\n    if ((flags & TS_VFY_TSA_NAME)\n        && !ts_check_signer_name(ctx->tsa_name, signer)) {\n        TSerr(TS_F_INT_TS_RESP_VERIFY_TOKEN, TS_R_TSA_UNTRUSTED);\n        goto err;\n    }\n    ret = 1;\n err:\n    X509_free(signer);\n    X509_ALGOR_free(md_alg);\n    OPENSSL_free(imprint);\n    return ret;\n}', 'static int ts_check_policy(ASN1_OBJECT *req_oid, TS_TST_INFO *tst_info)\n{\n    ASN1_OBJECT *resp_oid = tst_info->policy_id;\n    if (OBJ_cmp(req_oid, resp_oid) != 0) {\n        TSerr(TS_F_TS_CHECK_POLICY, TS_R_POLICY_MISMATCH);\n        return 0;\n    }\n    return 1;\n}', 'int OBJ_cmp(const ASN1_OBJECT *a, const ASN1_OBJECT *b)\n{\n    int ret;\n    ret = (a->length - b->length);\n    if (ret)\n        return (ret);\n    return (memcmp(a->data, b->data, a->length));\n}']