crypto/x509/x509_lu.c:684: error: NULL_DEREFERENCE
  pointer `pobj` last assigned on line 682 could be null and is dereferenced at line 684, column 8.
Showing all 44 steps of the trace


crypto/x509/x509_lu.c:638:1: start of procedure X509_STORE_CTX_get1_issuer()
636.    * -1 some other error.
637.    */
638. > int X509_STORE_CTX_get1_issuer(X509 **issuer, X509_STORE_CTX *ctx, X509 *x)
639.   	{
640.   	X509_NAME *xn;

crypto/x509/x509_lu.c:643:2: 
641.   	X509_OBJECT obj, *pobj;
642.   	int i, ok, idx, ret;
643. > 	*issuer = NULL;
644.   	xn=X509_get_issuer_name(x);
645.   	ok=X509_STORE_get_by_subject(ctx,X509_LU_X509,xn,&obj);

crypto/x509/x509_lu.c:644:2: 
642.   	int i, ok, idx, ret;
643.   	*issuer = NULL;
644. > 	xn=X509_get_issuer_name(x);
645.   	ok=X509_STORE_get_by_subject(ctx,X509_LU_X509,xn,&obj);
646.   	if (ok != X509_LU_X509)

crypto/x509/x509_cmp.c:130:1: start of procedure X509_get_issuer_name()
  128.   #endif
  129.   
  130. > X509_NAME *X509_get_issuer_name(X509 *a)
  131.   	{
  132.   	return(a->cert_info->issuer);

crypto/x509/x509_cmp.c:132:2: 
  130.   X509_NAME *X509_get_issuer_name(X509 *a)
  131.   	{
  132. > 	return(a->cert_info->issuer);
  133.   	}
  134.   

crypto/x509/x509_cmp.c:133:2: return from a call to X509_get_issuer_name
  131.   	{
  132.   	return(a->cert_info->issuer);
  133.   	}
          ^
  134.   
  135.   unsigned long X509_issuer_name_hash(X509 *x)

crypto/x509/x509_lu.c:645:2: Skipping X509_STORE_get_by_subject(): empty list of specs
643.   	*issuer = NULL;
644.   	xn=X509_get_issuer_name(x);
645.   	ok=X509_STORE_get_by_subject(ctx,X509_LU_X509,xn,&obj);
        ^
646.   	if (ok != X509_LU_X509)
647.   		{

crypto/x509/x509_lu.c:646:6: Taking false branch
644.   	xn=X509_get_issuer_name(x);
645.   	ok=X509_STORE_get_by_subject(ctx,X509_LU_X509,xn,&obj);
646.   	if (ok != X509_LU_X509)
            ^
647.   		{
648.   		if (ok == X509_LU_RETRY)

crypto/x509/x509_lu.c:663:6: Taking false branch
661.   		}
662.   	/* If certificate matches all OK */
663.   	if (ctx->check_issued(ctx, x, obj.data.x509))
            ^
664.   		{
665.   		if (x509_check_cert_time(ctx, obj.data.x509, 1))

crypto/x509/x509_lu.c:671:2: 
669.   			}
670.   		}
671. > 	X509_OBJECT_free_contents(&obj);
672.   
673.   	/* Else find index of first cert accepted by 'check_issued' */

crypto/x509/x509_lu.c:427:1: start of procedure X509_OBJECT_free_contents()
  425.   	}
  426.   
  427. > void X509_OBJECT_free_contents(X509_OBJECT *a)
  428.   	{
  429.   	switch (a->type)

crypto/x509/x509_lu.c:429:2: 
  427.   void X509_OBJECT_free_contents(X509_OBJECT *a)
  428.   	{
  429. > 	switch (a->type)
  430.   		{
  431.   	case X509_LU_X509:

crypto/x509/x509_lu.c:431:2: Switch condition is false. Skipping switch case
  429.   	switch (a->type)
  430.   		{
  431.   	case X509_LU_X509:
          ^
  432.   		X509_free(a->data.x509);
  433.   		break;

crypto/x509/x509_lu.c:434:2: Switch condition is false. Skipping switch case
  432.   		X509_free(a->data.x509);
  433.   		break;
  434.   	case X509_LU_CRL:
          ^
  435.   		X509_CRL_free(a->data.crl);
  436.   		break;

crypto/x509/x509_lu.c:438:2: return from a call to X509_OBJECT_free_contents
  436.   		break;
  437.   		}
  438.   	}
          ^
  439.   
  440.   static int x509_object_idx_cnt(STACK_OF(X509_OBJECT) *h, int type,

crypto/x509/x509_lu.c:674:2: 
672.   
673.   	/* Else find index of first cert accepted by 'check_issued' */
674. > 	ret = 0;
675.   	CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);
676.   	idx = X509_OBJECT_idx_by_subject(ctx->ctx->objs, X509_LU_X509, xn);

crypto/x509/x509_lu.c:675:2: 
673.   	/* Else find index of first cert accepted by 'check_issued' */
674.   	ret = 0;
675. > 	CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);
676.   	idx = X509_OBJECT_idx_by_subject(ctx->ctx->objs, X509_LU_X509, xn);
677.   	if (idx != -1) /* should be true as we've had at least one match */

crypto/lock.c:426:1: start of procedure CRYPTO_lock()
  424.   	}
  425.   
  426. > void CRYPTO_lock(int mode, int type, const char *file, int line)
  427.   	{
  428.   #ifdef LOCK_DEBUG

crypto/lock.c:453:6: Taking false branch
  451.   		}
  452.   #endif
  453.   	if (type < 0)
              ^
  454.   		{
  455.   		if (dynlock_lock_callback != NULL)

crypto/lock.c:468:7: Taking true branch
  466.   		}
  467.   	else
  468.   		if (locking_callback != NULL)
               ^
  469.   			locking_callback(mode,type,file,line);
  470.   	}

crypto/lock.c:469:4: Skipping __function_pointer__(): unresolved function pointer
  467.   	else
  468.   		if (locking_callback != NULL)
  469.   			locking_callback(mode,type,file,line);
            ^
  470.   	}
  471.   

crypto/lock.c:453:2: 
  451.   		}
  452.   #endif
  453. > 	if (type < 0)
  454.   		{
  455.   		if (dynlock_lock_callback != NULL)

crypto/lock.c:470:2: return from a call to CRYPTO_lock
  468.   		if (locking_callback != NULL)
  469.   			locking_callback(mode,type,file,line);
  470.   	}
          ^
  471.   
  472.   int CRYPTO_add_lock(int *pointer, int amount, int type, const char *file,

crypto/x509/x509_lu.c:676:2: 
674.   	ret = 0;
675.   	CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);
676. > 	idx = X509_OBJECT_idx_by_subject(ctx->ctx->objs, X509_LU_X509, xn);
677.   	if (idx != -1) /* should be true as we've had at least one match */
678.   		{

crypto/x509/x509_lu.c:487:1: start of procedure X509_OBJECT_idx_by_subject()
  485.   
  486.   
  487. > int X509_OBJECT_idx_by_subject(STACK_OF(X509_OBJECT) *h, int type,
  488.   	     X509_NAME *name)
  489.   	{

crypto/x509/x509_lu.c:490:2: Skipping x509_object_idx_cnt(): empty list of specs
  488.   	     X509_NAME *name)
  489.   	{
  490.   	return x509_object_idx_cnt(h, type, name, NULL);
          ^
  491.   	}
  492.   

crypto/x509/x509_lu.c:491:2: return from a call to X509_OBJECT_idx_by_subject
  489.   	{
  490.   	return x509_object_idx_cnt(h, type, name, NULL);
  491.   	}
          ^
  492.   
  493.   X509_OBJECT *X509_OBJECT_retrieve_by_subject(STACK_OF(X509_OBJECT) *h, int type,

crypto/x509/x509_lu.c:677:6: Taking true branch
675.   	CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);
676.   	idx = X509_OBJECT_idx_by_subject(ctx->ctx->objs, X509_LU_X509, xn);
677.   	if (idx != -1) /* should be true as we've had at least one match */
            ^
678.   		{
679.   		/* Look through all matching certs for suitable issuer */

crypto/x509/x509_lu.c:680:8: 
678.   		{
679.   		/* Look through all matching certs for suitable issuer */
680. > 		for (i = idx; i < sk_X509_OBJECT_num(ctx->ctx->objs); i++)
681.   			{
682.   			pobj = sk_X509_OBJECT_value(ctx->ctx->objs, i);

crypto/x509/x509_lu.c:680:21: Condition is true
678.   		{
679.   		/* Look through all matching certs for suitable issuer */
680.   		for (i = idx; i < sk_X509_OBJECT_num(ctx->ctx->objs); i++)
                           ^
681.   			{
682.   			pobj = sk_X509_OBJECT_value(ctx->ctx->objs, i);

crypto/x509/x509_lu.c:680:17: 
678.   		{
679.   		/* Look through all matching certs for suitable issuer */
680. > 		for (i = idx; i < sk_X509_OBJECT_num(ctx->ctx->objs); i++)
681.   			{
682.   			pobj = sk_X509_OBJECT_value(ctx->ctx->objs, i);

crypto/stack/stack.c:294:1: start of procedure sk_num()
  292.   	}
  293.   
  294. > int sk_num(const _STACK *st)
  295.   {
  296.   	if(st == NULL) return -1;

crypto/stack/stack.c:296:5: Taking false branch
  294.   int sk_num(const _STACK *st)
  295.   {
  296.   	if(st == NULL) return -1;
             ^
  297.   	return st->num;
  298.   }

crypto/stack/stack.c:297:2: 
  295.   {
  296.   	if(st == NULL) return -1;
  297. > 	return st->num;
  298.   }
  299.   

crypto/stack/stack.c:298:1: return from a call to sk_num
  296.   	if(st == NULL) return -1;
  297.   	return st->num;
  298. > }
  299.   
  300.   void *sk_value(const _STACK *st, int i)

crypto/x509/x509_lu.c:680:17: Loop condition is true. Entering loop body
678.   		{
679.   		/* Look through all matching certs for suitable issuer */
680.   		for (i = idx; i < sk_X509_OBJECT_num(ctx->ctx->objs); i++)
                       ^
681.   			{
682.   			pobj = sk_X509_OBJECT_value(ctx->ctx->objs, i);

crypto/x509/x509_lu.c:682:11: Condition is true
680.   		for (i = idx; i < sk_X509_OBJECT_num(ctx->ctx->objs); i++)
681.   			{
682.   			pobj = sk_X509_OBJECT_value(ctx->ctx->objs, i);
                 ^
683.   			/* See if we've run past the matches */
684.   			if (pobj->type != X509_LU_X509)

crypto/x509/x509_lu.c:682:4: 
680.   		for (i = idx; i < sk_X509_OBJECT_num(ctx->ctx->objs); i++)
681.   			{
682. > 			pobj = sk_X509_OBJECT_value(ctx->ctx->objs, i);
683.   			/* See if we've run past the matches */
684.   			if (pobj->type != X509_LU_X509)

crypto/stack/stack.c:300:1: start of procedure sk_value()
  298.   }
  299.   
  300. > void *sk_value(const _STACK *st, int i)
  301.   {
  302.   	if(!st || (i < 0) || (i >= st->num)) return NULL;

crypto/stack/stack.c:302:6: Taking false branch
  300.   void *sk_value(const _STACK *st, int i)
  301.   {
  302.   	if(!st || (i < 0) || (i >= st->num)) return NULL;
              ^
  303.   	return st->data[i];
  304.   }

crypto/stack/stack.c:302:13: Taking true branch
  300.   void *sk_value(const _STACK *st, int i)
  301.   {
  302.   	if(!st || (i < 0) || (i >= st->num)) return NULL;
                     ^
  303.   	return st->data[i];
  304.   }

crypto/stack/stack.c:302:39: 
  300.   void *sk_value(const _STACK *st, int i)
  301.   {
  302. > 	if(!st || (i < 0) || (i >= st->num)) return NULL;
  303.   	return st->data[i];
  304.   }

crypto/stack/stack.c:304:1: return from a call to sk_value
  302.   	if(!st || (i < 0) || (i >= st->num)) return NULL;
  303.   	return st->data[i];
  304. > }
  305.   
  306.   void *sk_set(_STACK *st, int i, void *value)

crypto/x509/x509_lu.c:684:8: 
682.   			pobj = sk_X509_OBJECT_value(ctx->ctx->objs, i);
683.   			/* See if we've run past the matches */
684. > 			if (pobj->type != X509_LU_X509)
685.   				break;
686.   			if (X509_NAME_cmp(xn, X509_get_subject_name(pobj->data.x509)))

int X509_STORE_CTX_get1_issuer(X509 **issuer, X509_STORE_CTX *ctx, X509 *x)
	{
	X509_NAME *xn;
	X509_OBJECT obj, *pobj;
	int i, ok, idx, ret;
	*issuer = NULL;
	xn=X509_get_issuer_name(x);
	ok=X509_STORE_get_by_subject(ctx,X509_LU_X509,xn,&obj);
	if (ok != X509_LU_X509)
		{
		if (ok == X509_LU_RETRY)
			{
			X509_OBJECT_free_contents(&obj);
			X509err(X509_F_X509_STORE_CTX_GET1_ISSUER,X509_R_SHOULD_RETRY);
			return -1;
			}
		else if (ok != X509_LU_FAIL)
			{
			X509_OBJECT_free_contents(&obj);
			return -1;
			}
		return 0;
		}
	if (ctx->check_issued(ctx, x, obj.data.x509))
		{
		if (x509_check_cert_time(ctx, obj.data.x509, 1))
			{
			*issuer = obj.data.x509;
			return 1;
			}
		}
	X509_OBJECT_free_contents(&obj);
	ret = 0;
	CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);
	idx = X509_OBJECT_idx_by_subject(ctx->ctx->objs, X509_LU_X509, xn);
	if (idx != -1)
		{
		for (i = idx; i < sk_X509_OBJECT_num(ctx->ctx->objs); i++)
			{
			pobj = sk_X509_OBJECT_value(ctx->ctx->objs, i);
			if (pobj->type != X509_LU_X509)
				break;
			if (X509_NAME_cmp(xn, X509_get_subject_name(pobj->data.x509)))
				break;
			if (ctx->check_issued(ctx, x, pobj->data.x509))
				{
				*issuer = pobj->data.x509;
				ret = 1;
				if (x509_check_cert_time(ctx, *issuer, 1))
					break;
				}
			}
		}
	CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
	if (*issuer)
		CRYPTO_add(&(*issuer)->references,1,CRYPTO_LOCK_X509);
	return ret;
	}
['int X509_STORE_CTX_get1_issuer(X509 **issuer, X509_STORE_CTX *ctx, X509 *x)\n\t{\n\tX509_NAME *xn;\n\tX509_OBJECT obj, *pobj;\n\tint i, ok, idx, ret;\n\t*issuer = NULL;\n\txn=X509_get_issuer_name(x);\n\tok=X509_STORE_get_by_subject(ctx,X509_LU_X509,xn,&obj);\n\tif (ok != X509_LU_X509)\n\t\t{\n\t\tif (ok == X509_LU_RETRY)\n\t\t\t{\n\t\t\tX509_OBJECT_free_contents(&obj);\n\t\t\tX509err(X509_F_X509_STORE_CTX_GET1_ISSUER,X509_R_SHOULD_RETRY);\n\t\t\treturn -1;\n\t\t\t}\n\t\telse if (ok != X509_LU_FAIL)\n\t\t\t{\n\t\t\tX509_OBJECT_free_contents(&obj);\n\t\t\treturn -1;\n\t\t\t}\n\t\treturn 0;\n\t\t}\n\tif (ctx->check_issued(ctx, x, obj.data.x509))\n\t\t{\n\t\tif (x509_check_cert_time(ctx, obj.data.x509, 1))\n\t\t\t{\n\t\t\t*issuer = obj.data.x509;\n\t\t\treturn 1;\n\t\t\t}\n\t\t}\n\tX509_OBJECT_free_contents(&obj);\n\tret = 0;\n\tCRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);\n\tidx = X509_OBJECT_idx_by_subject(ctx->ctx->objs, X509_LU_X509, xn);\n\tif (idx != -1)\n\t\t{\n\t\tfor (i = idx; i < sk_X509_OBJECT_num(ctx->ctx->objs); i++)\n\t\t\t{\n\t\t\tpobj = sk_X509_OBJECT_value(ctx->ctx->objs, i);\n\t\t\tif (pobj->type != X509_LU_X509)\n\t\t\t\tbreak;\n\t\t\tif (X509_NAME_cmp(xn, X509_get_subject_name(pobj->data.x509)))\n\t\t\t\tbreak;\n\t\t\tif (ctx->check_issued(ctx, x, pobj->data.x509))\n\t\t\t\t{\n\t\t\t\t*issuer = pobj->data.x509;\n\t\t\t\tret = 1;\n\t\t\t\tif (x509_check_cert_time(ctx, *issuer, 1))\n\t\t\t\t\tbreak;\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\tCRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);\n\tif (*issuer)\n\t\tCRYPTO_add(&(*issuer)->references,1,CRYPTO_LOCK_X509);\n\treturn ret;\n\t}', 'X509_NAME *X509_get_issuer_name(X509 *a)\n\t{\n\treturn(a->cert_info->issuer);\n\t}', 'void X509_OBJECT_free_contents(X509_OBJECT *a)\n\t{\n\tswitch (a->type)\n\t\t{\n\tcase X509_LU_X509:\n\t\tX509_free(a->data.x509);\n\t\tbreak;\n\tcase X509_LU_CRL:\n\t\tX509_CRL_free(a->data.crl);\n\t\tbreak;\n\t\t}\n\t}', 'void CRYPTO_lock(int mode, int type, const char *file, int line)\n\t{\n#ifdef LOCK_DEBUG\n\t\t{\n\t\tCRYPTO_THREADID id;\n\t\tchar *rw_text,*operation_text;\n\t\tif (mode & CRYPTO_LOCK)\n\t\t\toperation_text="lock  ";\n\t\telse if (mode & CRYPTO_UNLOCK)\n\t\t\toperation_text="unlock";\n\t\telse\n\t\t\toperation_text="ERROR ";\n\t\tif (mode & CRYPTO_READ)\n\t\t\trw_text="r";\n\t\telse if (mode & CRYPTO_WRITE)\n\t\t\trw_text="w";\n\t\telse\n\t\t\trw_text="ERROR";\n\t\tCRYPTO_THREADID_current(&id);\n\t\tfprintf(stderr,"lock:%08lx:(%s)%s %-18s %s:%d\\n",\n\t\t\tCRYPTO_THREADID_hash(&id), rw_text, operation_text,\n\t\t\tCRYPTO_get_lock_name(type), file, line);\n\t\t}\n#endif\n\tif (type < 0)\n\t\t{\n\t\tif (dynlock_lock_callback != NULL)\n\t\t\t{\n\t\t\tstruct CRYPTO_dynlock_value *pointer\n\t\t\t\t= CRYPTO_get_dynlock_value(type);\n\t\t\tOPENSSL_assert(pointer != NULL);\n\t\t\tdynlock_lock_callback(mode, pointer, file, line);\n\t\t\tCRYPTO_destroy_dynlockid(type);\n\t\t\t}\n\t\t}\n\telse\n\t\tif (locking_callback != NULL)\n\t\t\tlocking_callback(mode,type,file,line);\n\t}', 'int X509_OBJECT_idx_by_subject(STACK_OF(X509_OBJECT) *h, int type,\n\t     X509_NAME *name)\n\t{\n\treturn x509_object_idx_cnt(h, type, name, NULL);\n\t}', 'int sk_num(const _STACK *st)\n{\n\tif(st == NULL) return -1;\n\treturn st->num;\n}', 'void *sk_value(const _STACK *st, int i)\n{\n\tif(!st || (i < 0) || (i >= st->num)) return NULL;\n\treturn st->data[i];\n}']