crypto/x509/x509_vpm.c:550: error: NULL_DEREFERENCE
  pointer `ptmp` last assigned on line 549 could be null and is dereferenced by call to `X509_VERIFY_PARAM_free()` at line 550, column 4.
Showing all 28 steps of the trace


crypto/x509/x509_vpm.c:534:1: start of procedure X509_VERIFY_PARAM_add0_table()
532.   	}
533.   
534. > int X509_VERIFY_PARAM_add0_table(X509_VERIFY_PARAM *param)
535.   	{
536.   	int idx;

crypto/x509/x509_vpm.c:538:7: Taking false branch
536.   	int idx;
537.   	X509_VERIFY_PARAM *ptmp;
538.   	if (!param_table)
             ^
539.   		{
540.   		param_table = sk_X509_VERIFY_PARAM_new(param_cmp);

crypto/x509/x509_vpm.c:546:9: Condition is true
544.   	else
545.   		{
546.   		idx = sk_X509_VERIFY_PARAM_find(param_table, param);
               ^
547.   		if (idx != -1)
548.   			{

crypto/x509/x509_vpm.c:546:9: Condition is true
544.   	else
545.   		{
546.   		idx = sk_X509_VERIFY_PARAM_find(param_table, param);
               ^
547.   		if (idx != -1)
548.   			{

crypto/x509/x509_vpm.c:546:3: 
544.   	else
545.   		{
546. > 		idx = sk_X509_VERIFY_PARAM_find(param_table, param);
547.   		if (idx != -1)
548.   			{

crypto/stack/stack.c:235:1: start of procedure sk_find()
  233.   	}
  234.   
  235. > int sk_find(_STACK *st, void *data)
  236.   	{
  237.   	return internal_find(st, data, OBJ_BSEARCH_FIRST_VALUE_ON_MATCH);

crypto/stack/stack.c:237:2: 
  235.   int sk_find(_STACK *st, void *data)
  236.   	{
  237. > 	return internal_find(st, data, OBJ_BSEARCH_FIRST_VALUE_ON_MATCH);
  238.   	}
  239.   int sk_find_ex(_STACK *st, void *data)

crypto/stack/stack.c:213:1: start of procedure internal_find()
    211.   	}
    212.   
    213. > static int internal_find(_STACK *st, void *data, int ret_val_options)
    214.   	{
    215.   	const void * const *r;

crypto/stack/stack.c:218:5: Taking false branch
    216.   	int i;
    217.   
    218.   	if(st == NULL) return -1;
               ^
    219.   
    220.   	if (st->comp == NULL)

crypto/stack/stack.c:220:6: Taking true branch
    218.   	if(st == NULL) return -1;
    219.   
    220.   	if (st->comp == NULL)
                ^
    221.   		{
    222.   		for (i=0; i<st->num; i++)

crypto/stack/stack.c:222:8: 
    220.   	if (st->comp == NULL)
    221.   		{
    222. > 		for (i=0; i<st->num; i++)
    223.   			if (st->data[i] == data)
    224.   				return(i);

crypto/stack/stack.c:222:13: Loop condition is true. Entering loop body
    220.   	if (st->comp == NULL)
    221.   		{
    222.   		for (i=0; i<st->num; i++)
                       ^
    223.   			if (st->data[i] == data)
    224.   				return(i);

crypto/stack/stack.c:223:8: Taking false branch
    221.   		{
    222.   		for (i=0; i<st->num; i++)
    223.   			if (st->data[i] == data)
                  ^
    224.   				return(i);
    225.   		return(-1);

crypto/stack/stack.c:222:24: 
    220.   	if (st->comp == NULL)
    221.   		{
    222. > 		for (i=0; i<st->num; i++)
    223.   			if (st->data[i] == data)
    224.   				return(i);

crypto/stack/stack.c:222:13: Loop condition is true. Entering loop body
    220.   	if (st->comp == NULL)
    221.   		{
    222.   		for (i=0; i<st->num; i++)
                       ^
    223.   			if (st->data[i] == data)
    224.   				return(i);

crypto/stack/stack.c:223:8: Taking true branch
    221.   		{
    222.   		for (i=0; i<st->num; i++)
    223.   			if (st->data[i] == data)
                  ^
    224.   				return(i);
    225.   		return(-1);

crypto/stack/stack.c:224:5: 
    222.   		for (i=0; i<st->num; i++)
    223.   			if (st->data[i] == data)
    224. > 				return(i);
    225.   		return(-1);
    226.   		}

crypto/stack/stack.c:233:2: return from a call to internal_find
    231.   	if (r == NULL) return(-1);
    232.   	return (int)((char **)r-st->data);
    233.   	}
            ^
    234.   
    235.   int sk_find(_STACK *st, void *data)

crypto/stack/stack.c:238:2: return from a call to sk_find
  236.   	{
  237.   	return internal_find(st, data, OBJ_BSEARCH_FIRST_VALUE_ON_MATCH);
  238.   	}
          ^
  239.   int sk_find_ex(_STACK *st, void *data)
  240.   	{

crypto/x509/x509_vpm.c:547:7: Taking true branch
545.   		{
546.   		idx = sk_X509_VERIFY_PARAM_find(param_table, param);
547.   		if (idx != -1)
             ^
548.   			{
549.   			ptmp = sk_X509_VERIFY_PARAM_value(param_table, idx);

crypto/x509/x509_vpm.c:549:11: Condition is true
547.   		if (idx != -1)
548.   			{
549.   			ptmp = sk_X509_VERIFY_PARAM_value(param_table, idx);
                 ^
550.   			X509_VERIFY_PARAM_free(ptmp);
551.   			(void)sk_X509_VERIFY_PARAM_delete(param_table, idx);

crypto/x509/x509_vpm.c:549:4: 
547.   		if (idx != -1)
548.   			{
549. > 			ptmp = sk_X509_VERIFY_PARAM_value(param_table, idx);
550.   			X509_VERIFY_PARAM_free(ptmp);
551.   			(void)sk_X509_VERIFY_PARAM_delete(param_table, idx);

crypto/stack/stack.c:300:1: start of procedure sk_value()
  298.   }
  299.   
  300. > void *sk_value(const _STACK *st, int i)
  301.   {
  302.   	if(!st || (i < 0) || (i >= st->num)) return NULL;

crypto/stack/stack.c:302:6: Taking false branch
  300.   void *sk_value(const _STACK *st, int i)
  301.   {
  302.   	if(!st || (i < 0) || (i >= st->num)) return NULL;
              ^
  303.   	return st->data[i];
  304.   }

crypto/stack/stack.c:302:13: Taking true branch
  300.   void *sk_value(const _STACK *st, int i)
  301.   {
  302.   	if(!st || (i < 0) || (i >= st->num)) return NULL;
                     ^
  303.   	return st->data[i];
  304.   }

crypto/stack/stack.c:302:39: 
  300.   void *sk_value(const _STACK *st, int i)
  301.   {
  302. > 	if(!st || (i < 0) || (i >= st->num)) return NULL;
  303.   	return st->data[i];
  304.   }

crypto/stack/stack.c:304:1: return from a call to sk_value
  302.   	if(!st || (i < 0) || (i >= st->num)) return NULL;
  303.   	return st->data[i];
  304. > }
  305.   
  306.   void *sk_set(_STACK *st, int i, void *value)

crypto/x509/x509_vpm.c:550:4: 
548.   			{
549.   			ptmp = sk_X509_VERIFY_PARAM_value(param_table, idx);
550. > 			X509_VERIFY_PARAM_free(ptmp);
551.   			(void)sk_X509_VERIFY_PARAM_delete(param_table, idx);
552.   			}

int X509_VERIFY_PARAM_add0_table(X509_VERIFY_PARAM *param)
	{
	int idx;
	X509_VERIFY_PARAM *ptmp;
	if (!param_table)
		{
		param_table = sk_X509_VERIFY_PARAM_new(param_cmp);
		if (!param_table)
			return 0;
		}
	else
		{
		idx = sk_X509_VERIFY_PARAM_find(param_table, param);
		if (idx != -1)
			{
			ptmp = sk_X509_VERIFY_PARAM_value(param_table, idx);
			X509_VERIFY_PARAM_free(ptmp);
			(void)sk_X509_VERIFY_PARAM_delete(param_table, idx);
			}
		}
	if (!sk_X509_VERIFY_PARAM_push(param_table, param))
		return 0;
	return 1;
	}
['int X509_VERIFY_PARAM_add0_table(X509_VERIFY_PARAM *param)\n\t{\n\tint idx;\n\tX509_VERIFY_PARAM *ptmp;\n\tif (!param_table)\n\t\t{\n\t\tparam_table = sk_X509_VERIFY_PARAM_new(param_cmp);\n\t\tif (!param_table)\n\t\t\treturn 0;\n\t\t}\n\telse\n\t\t{\n\t\tidx = sk_X509_VERIFY_PARAM_find(param_table, param);\n\t\tif (idx != -1)\n\t\t\t{\n\t\t\tptmp = sk_X509_VERIFY_PARAM_value(param_table, idx);\n\t\t\tX509_VERIFY_PARAM_free(ptmp);\n\t\t\t(void)sk_X509_VERIFY_PARAM_delete(param_table, idx);\n\t\t\t}\n\t\t}\n\tif (!sk_X509_VERIFY_PARAM_push(param_table, param))\n\t\treturn 0;\n\treturn 1;\n\t}', 'int sk_find(_STACK *st, void *data)\n\t{\n\treturn internal_find(st, data, OBJ_BSEARCH_FIRST_VALUE_ON_MATCH);\n\t}', 'static int internal_find(_STACK *st, void *data, int ret_val_options)\n\t{\n\tconst void * const *r;\n\tint i;\n\tif(st == NULL) return -1;\n\tif (st->comp == NULL)\n\t\t{\n\t\tfor (i=0; i<st->num; i++)\n\t\t\tif (st->data[i] == data)\n\t\t\t\treturn(i);\n\t\treturn(-1);\n\t\t}\n\tsk_sort(st);\n\tif (data == NULL) return(-1);\n\tr=OBJ_bsearch_ex_(&data,st->data,st->num,sizeof(void *),st->comp,\n\t\t\t  ret_val_options);\n\tif (r == NULL) return(-1);\n\treturn (int)((char **)r-st->data);\n\t}', 'void *sk_value(const _STACK *st, int i)\n{\n\tif(!st || (i < 0) || (i >= st->num)) return NULL;\n\treturn st->data[i];\n}']