apps/ocsp.c:226: error: MEMORY_LEAK
  memory dynamically allocated to `return` by call to `sk_OCSP_CERTID_new_null()` at line 222, column 11 is not reachable after line 226, column 9.
Showing all 82 steps of the trace


apps/ocsp.c:178:1: start of procedure ocsp_main()
176.   };
177.   
178. > int ocsp_main(int argc, char **argv)
179.   {
180.       BIO *acbio = NULL, *cbio = NULL, *derbio = NULL, *out = NULL;

apps/ocsp.c:180:5: 
178.   int ocsp_main(int argc, char **argv)
179.   {
180. >     BIO *acbio = NULL, *cbio = NULL, *derbio = NULL, *out = NULL;
181.       const EVP_MD *cert_id_md = NULL, *rsign_md = NULL;
182.       int trailing_md = 0;

apps/ocsp.c:181:5: 
179.   {
180.       BIO *acbio = NULL, *cbio = NULL, *derbio = NULL, *out = NULL;
181. >     const EVP_MD *cert_id_md = NULL, *rsign_md = NULL;
182.       int trailing_md = 0;
183.       CA_DB *rdb = NULL;

apps/ocsp.c:182:5: 
180.       BIO *acbio = NULL, *cbio = NULL, *derbio = NULL, *out = NULL;
181.       const EVP_MD *cert_id_md = NULL, *rsign_md = NULL;
182. >     int trailing_md = 0;
183.       CA_DB *rdb = NULL;
184.       EVP_PKEY *key = NULL, *rkey = NULL;

apps/ocsp.c:183:5: 
181.       const EVP_MD *cert_id_md = NULL, *rsign_md = NULL;
182.       int trailing_md = 0;
183. >     CA_DB *rdb = NULL;
184.       EVP_PKEY *key = NULL, *rkey = NULL;
185.       OCSP_BASICRESP *bs = NULL;

apps/ocsp.c:184:5: 
182.       int trailing_md = 0;
183.       CA_DB *rdb = NULL;
184. >     EVP_PKEY *key = NULL, *rkey = NULL;
185.       OCSP_BASICRESP *bs = NULL;
186.       OCSP_REQUEST *req = NULL;

apps/ocsp.c:185:5: 
183.       CA_DB *rdb = NULL;
184.       EVP_PKEY *key = NULL, *rkey = NULL;
185. >     OCSP_BASICRESP *bs = NULL;
186.       OCSP_REQUEST *req = NULL;
187.       OCSP_RESPONSE *resp = NULL;

apps/ocsp.c:186:5: 
184.       EVP_PKEY *key = NULL, *rkey = NULL;
185.       OCSP_BASICRESP *bs = NULL;
186. >     OCSP_REQUEST *req = NULL;
187.       OCSP_RESPONSE *resp = NULL;
188.       STACK_OF(CONF_VALUE) *headers = NULL;

apps/ocsp.c:187:5: 
185.       OCSP_BASICRESP *bs = NULL;
186.       OCSP_REQUEST *req = NULL;
187. >     OCSP_RESPONSE *resp = NULL;
188.       STACK_OF(CONF_VALUE) *headers = NULL;
189.       STACK_OF(OCSP_CERTID) *ids = NULL;

apps/ocsp.c:188:5: 
186.       OCSP_REQUEST *req = NULL;
187.       OCSP_RESPONSE *resp = NULL;
188. >     STACK_OF(CONF_VALUE) *headers = NULL;
189.       STACK_OF(OCSP_CERTID) *ids = NULL;
190.       STACK_OF(OPENSSL_STRING) *reqnames = NULL;

apps/ocsp.c:189:5: 
187.       OCSP_RESPONSE *resp = NULL;
188.       STACK_OF(CONF_VALUE) *headers = NULL;
189. >     STACK_OF(OCSP_CERTID) *ids = NULL;
190.       STACK_OF(OPENSSL_STRING) *reqnames = NULL;
191.       STACK_OF(X509) *sign_other = NULL, *verify_other = NULL, *rother = NULL;

apps/ocsp.c:190:5: 
188.       STACK_OF(CONF_VALUE) *headers = NULL;
189.       STACK_OF(OCSP_CERTID) *ids = NULL;
190. >     STACK_OF(OPENSSL_STRING) *reqnames = NULL;
191.       STACK_OF(X509) *sign_other = NULL, *verify_other = NULL, *rother = NULL;
192.       STACK_OF(X509) *issuers = NULL;

apps/ocsp.c:191:5: 
189.       STACK_OF(OCSP_CERTID) *ids = NULL;
190.       STACK_OF(OPENSSL_STRING) *reqnames = NULL;
191. >     STACK_OF(X509) *sign_other = NULL, *verify_other = NULL, *rother = NULL;
192.       STACK_OF(X509) *issuers = NULL;
193.       X509 *issuer = NULL, *cert = NULL;

apps/ocsp.c:192:5: 
190.       STACK_OF(OPENSSL_STRING) *reqnames = NULL;
191.       STACK_OF(X509) *sign_other = NULL, *verify_other = NULL, *rother = NULL;
192. >     STACK_OF(X509) *issuers = NULL;
193.       X509 *issuer = NULL, *cert = NULL;
194.       STACK_OF(X509) *rca_cert = NULL;

apps/ocsp.c:193:5: 
191.       STACK_OF(X509) *sign_other = NULL, *verify_other = NULL, *rother = NULL;
192.       STACK_OF(X509) *issuers = NULL;
193. >     X509 *issuer = NULL, *cert = NULL;
194.       STACK_OF(X509) *rca_cert = NULL;
195.       X509 *signer = NULL, *rsigner = NULL;

apps/ocsp.c:194:5: 
192.       STACK_OF(X509) *issuers = NULL;
193.       X509 *issuer = NULL, *cert = NULL;
194. >     STACK_OF(X509) *rca_cert = NULL;
195.       X509 *signer = NULL, *rsigner = NULL;
196.       X509_STORE *store = NULL;

apps/ocsp.c:195:5: 
193.       X509 *issuer = NULL, *cert = NULL;
194.       STACK_OF(X509) *rca_cert = NULL;
195. >     X509 *signer = NULL, *rsigner = NULL;
196.       X509_STORE *store = NULL;
197.       X509_VERIFY_PARAM *vpm = NULL;

apps/ocsp.c:196:5: 
194.       STACK_OF(X509) *rca_cert = NULL;
195.       X509 *signer = NULL, *rsigner = NULL;
196. >     X509_STORE *store = NULL;
197.       X509_VERIFY_PARAM *vpm = NULL;
198.       const char *CAfile = NULL, *CApath = NULL;

apps/ocsp.c:197:5: 
195.       X509 *signer = NULL, *rsigner = NULL;
196.       X509_STORE *store = NULL;
197. >     X509_VERIFY_PARAM *vpm = NULL;
198.       const char *CAfile = NULL, *CApath = NULL;
199.       char *header, *value;

apps/ocsp.c:198:5: 
196.       X509_STORE *store = NULL;
197.       X509_VERIFY_PARAM *vpm = NULL;
198. >     const char *CAfile = NULL, *CApath = NULL;
199.       char *header, *value;
200.       char *host = NULL, *port = NULL, *path = "/", *outfile = NULL;

apps/ocsp.c:200:5: 
198.       const char *CAfile = NULL, *CApath = NULL;
199.       char *header, *value;
200. >     char *host = NULL, *port = NULL, *path = "/", *outfile = NULL;
201.       char *rca_filename = NULL, *reqin = NULL, *respin = NULL;
202.       char *reqout = NULL, *respout = NULL, *ridx_filename = NULL;

apps/ocsp.c:201:5: 
199.       char *header, *value;
200.       char *host = NULL, *port = NULL, *path = "/", *outfile = NULL;
201. >     char *rca_filename = NULL, *reqin = NULL, *respin = NULL;
202.       char *reqout = NULL, *respout = NULL, *ridx_filename = NULL;
203.       char *rsignfile = NULL, *rkeyfile = NULL;

apps/ocsp.c:202:5: 
200.       char *host = NULL, *port = NULL, *path = "/", *outfile = NULL;
201.       char *rca_filename = NULL, *reqin = NULL, *respin = NULL;
202. >     char *reqout = NULL, *respout = NULL, *ridx_filename = NULL;
203.       char *rsignfile = NULL, *rkeyfile = NULL;
204.       char *sign_certfile = NULL, *verify_certfile = NULL, *rcertfile = NULL;

apps/ocsp.c:203:5: 
201.       char *rca_filename = NULL, *reqin = NULL, *respin = NULL;
202.       char *reqout = NULL, *respout = NULL, *ridx_filename = NULL;
203. >     char *rsignfile = NULL, *rkeyfile = NULL;
204.       char *sign_certfile = NULL, *verify_certfile = NULL, *rcertfile = NULL;
205.       char *signfile = NULL, *keyfile = NULL;

apps/ocsp.c:204:5: 
202.       char *reqout = NULL, *respout = NULL, *ridx_filename = NULL;
203.       char *rsignfile = NULL, *rkeyfile = NULL;
204. >     char *sign_certfile = NULL, *verify_certfile = NULL, *rcertfile = NULL;
205.       char *signfile = NULL, *keyfile = NULL;
206.       char *thost = NULL, *tport = NULL, *tpath = NULL;

apps/ocsp.c:205:5: 
203.       char *rsignfile = NULL, *rkeyfile = NULL;
204.       char *sign_certfile = NULL, *verify_certfile = NULL, *rcertfile = NULL;
205. >     char *signfile = NULL, *keyfile = NULL;
206.       char *thost = NULL, *tport = NULL, *tpath = NULL;
207.       int noCAfile = 0, noCApath = 0;

apps/ocsp.c:206:5: 
204.       char *sign_certfile = NULL, *verify_certfile = NULL, *rcertfile = NULL;
205.       char *signfile = NULL, *keyfile = NULL;
206. >     char *thost = NULL, *tport = NULL, *tpath = NULL;
207.       int noCAfile = 0, noCApath = 0;
208.       int accept_count = -1, add_nonce = 1, noverify = 0, use_ssl = -1;

apps/ocsp.c:207:5: 
205.       char *signfile = NULL, *keyfile = NULL;
206.       char *thost = NULL, *tport = NULL, *tpath = NULL;
207. >     int noCAfile = 0, noCApath = 0;
208.       int accept_count = -1, add_nonce = 1, noverify = 0, use_ssl = -1;
209.       int vpmtouched = 0, badsig = 0, i, ignore_err = 0, nmin = 0, ndays = -1;

apps/ocsp.c:208:5: 
206.       char *thost = NULL, *tport = NULL, *tpath = NULL;
207.       int noCAfile = 0, noCApath = 0;
208. >     int accept_count = -1, add_nonce = 1, noverify = 0, use_ssl = -1;
209.       int vpmtouched = 0, badsig = 0, i, ignore_err = 0, nmin = 0, ndays = -1;
210.       int req_text = 0, resp_text = 0, ret = 1;

apps/ocsp.c:209:5: 
207.       int noCAfile = 0, noCApath = 0;
208.       int accept_count = -1, add_nonce = 1, noverify = 0, use_ssl = -1;
209. >     int vpmtouched = 0, badsig = 0, i, ignore_err = 0, nmin = 0, ndays = -1;
210.       int req_text = 0, resp_text = 0, ret = 1;
211.   #ifndef OPENSSL_NO_SOCK

apps/ocsp.c:210:5: 
208.       int accept_count = -1, add_nonce = 1, noverify = 0, use_ssl = -1;
209.       int vpmtouched = 0, badsig = 0, i, ignore_err = 0, nmin = 0, ndays = -1;
210. >     int req_text = 0, resp_text = 0, ret = 1;
211.   #ifndef OPENSSL_NO_SOCK
212.       int req_timeout = -1;

apps/ocsp.c:212:5: 
210.       int req_text = 0, resp_text = 0, ret = 1;
211.   #ifndef OPENSSL_NO_SOCK
212. >     int req_timeout = -1;
213.   #endif
214.       long nsec = MAX_VALIDITY_PERIOD, maxage = -1;

apps/ocsp.c:214:5: 
212.       int req_timeout = -1;
213.   #endif
214. >     long nsec = MAX_VALIDITY_PERIOD, maxage = -1;
215.       unsigned long sign_flags = 0, verify_flags = 0, rflags = 0;
216.       OPTION_CHOICE o;

apps/ocsp.c:215:5: 
213.   #endif
214.       long nsec = MAX_VALIDITY_PERIOD, maxage = -1;
215. >     unsigned long sign_flags = 0, verify_flags = 0, rflags = 0;
216.       OPTION_CHOICE o;
217.       char *prog;

apps/ocsp.c:219:5: 
217.       char *prog;
218.   
219. >     reqnames = sk_OPENSSL_STRING_new_null();
220.       if (reqnames == NULL)
221.           goto end;

include/openssl/safestack.h:155:1: start of procedure sk_OPENSSL_STRING_new_null()
  153.    * dealt with in the autogenerated macros below.
  154.    */
  155. > DEFINE_SPECIAL_STACK_OF(OPENSSL_STRING, char)
  156.   DEFINE_SPECIAL_STACK_OF_CONST(OPENSSL_CSTRING, char)
  157.   

crypto/stack/stack.c:118:1: start of procedure OPENSSL_sk_new_null()
    116.   }
    117.   
    118. > OPENSSL_STACK *OPENSSL_sk_new_null(void)
    119.   {
    120.       return OPENSSL_zalloc(sizeof(OPENSSL_STACK));

crypto/stack/stack.c:120:5: 
    118.   OPENSSL_STACK *OPENSSL_sk_new_null(void)
    119.   {
    120. >     return OPENSSL_zalloc(sizeof(OPENSSL_STACK));
    121.   }
    122.   

crypto/mem.c:198:1: start of procedure CRYPTO_zalloc()
      196.   }
      197.   
      198. > void *CRYPTO_zalloc(size_t num, const char *file, int line)
      199.   {
      200.       void *ret = CRYPTO_malloc(num, file, line);

crypto/mem.c:200:5: 
      198.   void *CRYPTO_zalloc(size_t num, const char *file, int line)
      199.   {
      200. >     void *ret = CRYPTO_malloc(num, file, line);
      201.   
      202.       FAILTEST();

crypto/mem.c:170:1: start of procedure CRYPTO_malloc()
        168.   #endif
        169.   
        170. > void *CRYPTO_malloc(size_t num, const char *file, int line)
        171.   {
        172.       void *ret = NULL;

crypto/mem.c:172:5: 
        170.   void *CRYPTO_malloc(size_t num, const char *file, int line)
        171.   {
        172. >     void *ret = NULL;
        173.   
        174.       if (malloc_impl != NULL && malloc_impl != CRYPTO_malloc)

crypto/mem.c:174:9: Taking false branch
        172.       void *ret = NULL;
        173.   
        174.       if (malloc_impl != NULL && malloc_impl != CRYPTO_malloc)
                       ^
        175.           return malloc_impl(num, file, line);
        176.   

crypto/mem.c:177:9: Taking false branch
        175.           return malloc_impl(num, file, line);
        176.   
        177.       if (num == 0)
                       ^
        178.           return NULL;
        179.   

crypto/mem.c:181:5: 
        179.   
        180.       FAILTEST();
        181. >     allow_customize = 0;
        182.   #ifndef OPENSSL_NO_CRYPTO_MDEBUG
        183.       if (call_malloc_debug) {

crypto/mem.c:191:5: 
        189.       }
        190.   #else
        191. >     (void)(file); (void)(line);
        192.       ret = malloc(num);
        193.   #endif

crypto/mem.c:191:19: 
        189.       }
        190.   #else
        191. >     (void)(file); (void)(line);
        192.       ret = malloc(num);
        193.   #endif

crypto/mem.c:192:5: 
        190.   #else
        191.       (void)(file); (void)(line);
        192. >     ret = malloc(num);
        193.   #endif
        194.   

crypto/mem.c:195:5: 
        193.   #endif
        194.   
        195. >     return ret;
        196.   }
        197.   

crypto/mem.c:196:1: return from a call to CRYPTO_malloc
        194.   
        195.       return ret;
        196. > }
        197.   
        198.   void *CRYPTO_zalloc(size_t num, const char *file, int line)

crypto/mem.c:203:9: Taking true branch
      201.   
      202.       FAILTEST();
      203.       if (ret != NULL)
                     ^
      204.           memset(ret, 0, num);
      205.       return ret;

crypto/mem.c:204:9: 
      202.       FAILTEST();
      203.       if (ret != NULL)
      204. >         memset(ret, 0, num);
      205.       return ret;
      206.   }

crypto/mem.c:205:5: 
      203.       if (ret != NULL)
      204.           memset(ret, 0, num);
      205. >     return ret;
      206.   }
      207.   

crypto/mem.c:206:1: return from a call to CRYPTO_zalloc
      204.           memset(ret, 0, num);
      205.       return ret;
      206. > }
      207.   
      208.   void *CRYPTO_realloc(void *str, size_t num, const char *file, int line)

crypto/stack/stack.c:121:1: return from a call to OPENSSL_sk_new_null
    119.   {
    120.       return OPENSSL_zalloc(sizeof(OPENSSL_STACK));
    121. > }
    122.   
    123.   OPENSSL_STACK *OPENSSL_sk_new(OPENSSL_sk_compfunc c)

include/openssl/safestack.h:155:1: return from a call to sk_OPENSSL_STRING_new_null
  153.    * dealt with in the autogenerated macros below.
  154.    */
  155. > DEFINE_SPECIAL_STACK_OF(OPENSSL_STRING, char)
  156.   DEFINE_SPECIAL_STACK_OF_CONST(OPENSSL_CSTRING, char)
  157.   

apps/ocsp.c:220:9: Taking false branch
218.   
219.       reqnames = sk_OPENSSL_STRING_new_null();
220.       if (reqnames == NULL)
               ^
221.           goto end;
222.       ids = sk_OCSP_CERTID_new_null();

apps/ocsp.c:222:5: 
220.       if (reqnames == NULL)
221.           goto end;
222. >     ids = sk_OCSP_CERTID_new_null();
223.       if (ids == NULL)
224.           goto end;

include/openssl/ocsp.h:73:1: start of procedure sk_OCSP_CERTID_new_null()
  71.   typedef struct ocsp_cert_id_st OCSP_CERTID;
  72.   
  73. > DEFINE_STACK_OF(OCSP_CERTID)
  74.   
  75.   typedef struct ocsp_one_request_st OCSP_ONEREQ;

crypto/stack/stack.c:118:1: start of procedure OPENSSL_sk_new_null()
    116.   }
    117.   
    118. > OPENSSL_STACK *OPENSSL_sk_new_null(void)
    119.   {
    120.       return OPENSSL_zalloc(sizeof(OPENSSL_STACK));

crypto/stack/stack.c:120:5: 
    118.   OPENSSL_STACK *OPENSSL_sk_new_null(void)
    119.   {
    120. >     return OPENSSL_zalloc(sizeof(OPENSSL_STACK));
    121.   }
    122.   

crypto/mem.c:198:1: start of procedure CRYPTO_zalloc()
      196.   }
      197.   
      198. > void *CRYPTO_zalloc(size_t num, const char *file, int line)
      199.   {
      200.       void *ret = CRYPTO_malloc(num, file, line);

crypto/mem.c:200:5: 
      198.   void *CRYPTO_zalloc(size_t num, const char *file, int line)
      199.   {
      200. >     void *ret = CRYPTO_malloc(num, file, line);
      201.   
      202.       FAILTEST();

crypto/mem.c:170:1: start of procedure CRYPTO_malloc()
        168.   #endif
        169.   
        170. > void *CRYPTO_malloc(size_t num, const char *file, int line)
        171.   {
        172.       void *ret = NULL;

crypto/mem.c:172:5: 
        170.   void *CRYPTO_malloc(size_t num, const char *file, int line)
        171.   {
        172. >     void *ret = NULL;
        173.   
        174.       if (malloc_impl != NULL && malloc_impl != CRYPTO_malloc)

crypto/mem.c:174:9: Taking false branch
        172.       void *ret = NULL;
        173.   
        174.       if (malloc_impl != NULL && malloc_impl != CRYPTO_malloc)
                       ^
        175.           return malloc_impl(num, file, line);
        176.   

crypto/mem.c:177:9: Taking false branch
        175.           return malloc_impl(num, file, line);
        176.   
        177.       if (num == 0)
                       ^
        178.           return NULL;
        179.   

crypto/mem.c:181:5: 
        179.   
        180.       FAILTEST();
        181. >     allow_customize = 0;
        182.   #ifndef OPENSSL_NO_CRYPTO_MDEBUG
        183.       if (call_malloc_debug) {

crypto/mem.c:191:5: 
        189.       }
        190.   #else
        191. >     (void)(file); (void)(line);
        192.       ret = malloc(num);
        193.   #endif

crypto/mem.c:191:19: 
        189.       }
        190.   #else
        191. >     (void)(file); (void)(line);
        192.       ret = malloc(num);
        193.   #endif

crypto/mem.c:192:5: 
        190.   #else
        191.       (void)(file); (void)(line);
        192. >     ret = malloc(num);
        193.   #endif
        194.   

crypto/mem.c:195:5: 
        193.   #endif
        194.   
        195. >     return ret;
        196.   }
        197.   

crypto/mem.c:196:1: return from a call to CRYPTO_malloc
        194.   
        195.       return ret;
        196. > }
        197.   
        198.   void *CRYPTO_zalloc(size_t num, const char *file, int line)

crypto/mem.c:203:9: Taking true branch
      201.   
      202.       FAILTEST();
      203.       if (ret != NULL)
                     ^
      204.           memset(ret, 0, num);
      205.       return ret;

crypto/mem.c:204:9: 
      202.       FAILTEST();
      203.       if (ret != NULL)
      204. >         memset(ret, 0, num);
      205.       return ret;
      206.   }

crypto/mem.c:205:5: 
      203.       if (ret != NULL)
      204.           memset(ret, 0, num);
      205. >     return ret;
      206.   }
      207.   

crypto/mem.c:206:1: return from a call to CRYPTO_zalloc
      204.           memset(ret, 0, num);
      205.       return ret;
      206. > }
      207.   
      208.   void *CRYPTO_realloc(void *str, size_t num, const char *file, int line)

crypto/stack/stack.c:121:1: return from a call to OPENSSL_sk_new_null
    119.   {
    120.       return OPENSSL_zalloc(sizeof(OPENSSL_STACK));
    121. > }
    122.   
    123.   OPENSSL_STACK *OPENSSL_sk_new(OPENSSL_sk_compfunc c)

include/openssl/ocsp.h:73:1: return from a call to sk_OCSP_CERTID_new_null
  71.   typedef struct ocsp_cert_id_st OCSP_CERTID;
  72.   
  73. > DEFINE_STACK_OF(OCSP_CERTID)
  74.   
  75.   typedef struct ocsp_one_request_st OCSP_ONEREQ;

apps/ocsp.c:223:9: Taking false branch
221.           goto end;
222.       ids = sk_OCSP_CERTID_new_null();
223.       if (ids == NULL)
               ^
224.           goto end;
225.       if ((vpm = X509_VERIFY_PARAM_new()) == NULL)

apps/ocsp.c:225:9: Taking true branch
223.       if (ids == NULL)
224.           goto end;
225.       if ((vpm = X509_VERIFY_PARAM_new()) == NULL)
               ^
226.           return 1;
227.   

apps/ocsp.c:226:9: 
224.           goto end;
225.       if ((vpm = X509_VERIFY_PARAM_new()) == NULL)
226. >         return 1;
227.   
228.       prog = opt_init(argc, argv, ocsp_options);

int ocsp_main(int argc, char **argv)
{
    BIO *acbio = NULL, *cbio = NULL, *derbio = NULL, *out = NULL;
    const EVP_MD *cert_id_md = NULL, *rsign_md = NULL;
    int trailing_md = 0;
    CA_DB *rdb = NULL;
    EVP_PKEY *key = NULL, *rkey = NULL;
    OCSP_BASICRESP *bs = NULL;
    OCSP_REQUEST *req = NULL;
    OCSP_RESPONSE *resp = NULL;
    STACK_OF(CONF_VALUE) *headers = NULL;
    STACK_OF(OCSP_CERTID) *ids = NULL;
    STACK_OF(OPENSSL_STRING) *reqnames = NULL;
    STACK_OF(X509) *sign_other = NULL, *verify_other = NULL, *rother = NULL;
    STACK_OF(X509) *issuers = NULL;
    X509 *issuer = NULL, *cert = NULL;
    STACK_OF(X509) *rca_cert = NULL;
    X509 *signer = NULL, *rsigner = NULL;
    X509_STORE *store = NULL;
    X509_VERIFY_PARAM *vpm = NULL;
    const char *CAfile = NULL, *CApath = NULL;
    char *header, *value;
    char *host = NULL, *port = NULL, *path = "/", *outfile = NULL;
    char *rca_filename = NULL, *reqin = NULL, *respin = NULL;
    char *reqout = NULL, *respout = NULL, *ridx_filename = NULL;
    char *rsignfile = NULL, *rkeyfile = NULL;
    char *sign_certfile = NULL, *verify_certfile = NULL, *rcertfile = NULL;
    char *signfile = NULL, *keyfile = NULL;
    char *thost = NULL, *tport = NULL, *tpath = NULL;
    int noCAfile = 0, noCApath = 0;
    int accept_count = -1, add_nonce = 1, noverify = 0, use_ssl = -1;
    int vpmtouched = 0, badsig = 0, i, ignore_err = 0, nmin = 0, ndays = -1;
    int req_text = 0, resp_text = 0, ret = 1;
#ifndef OPENSSL_NO_SOCK
    int req_timeout = -1;
#endif
    long nsec = MAX_VALIDITY_PERIOD, maxage = -1;
    unsigned long sign_flags = 0, verify_flags = 0, rflags = 0;
    OPTION_CHOICE o;
    char *prog;
    reqnames = sk_OPENSSL_STRING_new_null();
    if (reqnames == NULL)
        goto end;
    ids = sk_OCSP_CERTID_new_null();
    if (ids == NULL)
        goto end;
    if ((vpm = X509_VERIFY_PARAM_new()) == NULL)
        return 1;
    prog = opt_init(argc, argv, ocsp_options);
    while ((o = opt_next()) != OPT_EOF) {
        switch (o) {
        case OPT_EOF:
        case OPT_ERR:
 opthelp:
            BIO_printf(bio_err, "%s: Use -help for summary.\n", prog);
            goto end;
        case OPT_HELP:
            ret = 0;
            opt_help(ocsp_options);
            goto end;
        case OPT_OUTFILE:
            outfile = opt_arg();
            break;
        case OPT_TIMEOUT:
#ifndef OPENSSL_NO_SOCK
            req_timeout = atoi(opt_arg());
#endif
            break;
        case OPT_URL:
            OPENSSL_free(thost);
            OPENSSL_free(tport);
            OPENSSL_free(tpath);
            thost = tport = tpath = NULL;
            if (!OCSP_parse_url(opt_arg(), &host, &port, &path, &use_ssl)) {
                BIO_printf(bio_err, "%s Error parsing URL\n", prog);
                goto end;
            }
            thost = host;
            tport = port;
            tpath = path;
            break;
        case OPT_HOST:
            host = opt_arg();
            break;
        case OPT_PORT:
            port = opt_arg();
            break;
        case OPT_IGNORE_ERR:
            ignore_err = 1;
            break;
        case OPT_NOVERIFY:
            noverify = 1;
            break;
        case OPT_NONCE:
            add_nonce = 2;
            break;
        case OPT_NO_NONCE:
            add_nonce = 0;
            break;
        case OPT_RESP_NO_CERTS:
            rflags |= OCSP_NOCERTS;
            break;
        case OPT_RESP_KEY_ID:
            rflags |= OCSP_RESPID_KEY;
            break;
        case OPT_NO_CERTS:
            sign_flags |= OCSP_NOCERTS;
            break;
        case OPT_NO_SIGNATURE_VERIFY:
            verify_flags |= OCSP_NOSIGS;
            break;
        case OPT_NO_CERT_VERIFY:
            verify_flags |= OCSP_NOVERIFY;
            break;
        case OPT_NO_CHAIN:
            verify_flags |= OCSP_NOCHAIN;
            break;
        case OPT_NO_CERT_CHECKS:
            verify_flags |= OCSP_NOCHECKS;
            break;
        case OPT_NO_EXPLICIT:
            verify_flags |= OCSP_NOEXPLICIT;
            break;
        case OPT_TRUST_OTHER:
            verify_flags |= OCSP_TRUSTOTHER;
            break;
        case OPT_NO_INTERN:
            verify_flags |= OCSP_NOINTERN;
            break;
        case OPT_BADSIG:
            badsig = 1;
            break;
        case OPT_TEXT:
            req_text = resp_text = 1;
            break;
        case OPT_REQ_TEXT:
            req_text = 1;
            break;
        case OPT_RESP_TEXT:
            resp_text = 1;
            break;
        case OPT_REQIN:
            reqin = opt_arg();
            break;
        case OPT_RESPIN:
            respin = opt_arg();
            break;
        case OPT_SIGNER:
            signfile = opt_arg();
            break;
        case OPT_VAFILE:
            verify_certfile = opt_arg();
            verify_flags |= OCSP_TRUSTOTHER;
            break;
        case OPT_SIGN_OTHER:
            sign_certfile = opt_arg();
            break;
        case OPT_VERIFY_OTHER:
            verify_certfile = opt_arg();
            break;
        case OPT_CAFILE:
            CAfile = opt_arg();
            break;
        case OPT_CAPATH:
            CApath = opt_arg();
            break;
        case OPT_NOCAFILE:
            noCAfile = 1;
            break;
        case OPT_NOCAPATH:
            noCApath = 1;
            break;
        case OPT_V_CASES:
            if (!opt_verify(o, vpm))
                goto end;
            vpmtouched++;
            break;
        case OPT_VALIDITY_PERIOD:
            opt_long(opt_arg(), &nsec);
            break;
        case OPT_STATUS_AGE:
            opt_long(opt_arg(), &maxage);
            break;
        case OPT_SIGNKEY:
            keyfile = opt_arg();
            break;
        case OPT_REQOUT:
            reqout = opt_arg();
            break;
        case OPT_RESPOUT:
            respout = opt_arg();
            break;
        case OPT_PATH:
            path = opt_arg();
            break;
        case OPT_ISSUER:
            issuer = load_cert(opt_arg(), FORMAT_PEM, "issuer certificate");
            if (issuer == NULL)
                goto end;
            if (issuers == NULL) {
                if ((issuers = sk_X509_new_null()) == NULL)
                    goto end;
            }
            sk_X509_push(issuers, issuer);
            break;
        case OPT_CERT:
            X509_free(cert);
            cert = load_cert(opt_arg(), FORMAT_PEM, "certificate");
            if (cert == NULL)
                goto end;
            if (cert_id_md == NULL)
                cert_id_md = EVP_sha1();
            if (!add_ocsp_cert(&req, cert, cert_id_md, issuer, ids))
                goto end;
            if (!sk_OPENSSL_STRING_push(reqnames, opt_arg()))
                goto end;
            trailing_md = 0;
            break;
        case OPT_SERIAL:
            if (cert_id_md == NULL)
                cert_id_md = EVP_sha1();
            if (!add_ocsp_serial(&req, opt_arg(), cert_id_md, issuer, ids))
                goto end;
            if (!sk_OPENSSL_STRING_push(reqnames, opt_arg()))
                goto end;
            trailing_md = 0;
            break;
        case OPT_INDEX:
            ridx_filename = opt_arg();
            break;
        case OPT_CA:
            rca_filename = opt_arg();
            break;
        case OPT_NMIN:
            opt_int(opt_arg(), &nmin);
            if (ndays == -1)
                ndays = 0;
            break;
        case OPT_REQUEST:
            opt_int(opt_arg(), &accept_count);
            break;
        case OPT_NDAYS:
            ndays = atoi(opt_arg());
            break;
        case OPT_RSIGNER:
            rsignfile = opt_arg();
            break;
        case OPT_RKEY:
            rkeyfile = opt_arg();
            break;
        case OPT_ROTHER:
            rcertfile = opt_arg();
            break;
        case OPT_RMD:
            if (!opt_md(opt_arg(), &rsign_md))
                goto end;
            break;
        case OPT_HEADER:
            header = opt_arg();
            value = strchr(header, '=');
            if (value == NULL) {
                BIO_printf(bio_err, "Missing = in header key=value\n");
                goto opthelp;
            }
            *value++ = '\0';
            if (!X509V3_add_value(header, value, &headers))
                goto end;
            break;
        case OPT_MD:
            if (trailing_md) {
                BIO_printf(bio_err,
                           "%s: Digest must be before -cert or -serial\n",
                           prog);
                goto opthelp;
            }
            if (!opt_md(opt_unknown(), &cert_id_md))
                goto opthelp;
            trailing_md = 1;
            break;
        }
    }
    if (trailing_md) {
        BIO_printf(bio_err, "%s: Digest must be before -cert or -serial\n",
                   prog);
        goto opthelp;
    }
    argc = opt_num_rest();
    if (argc != 0)
        goto opthelp;
    if (req == NULL&& reqin == NULL
        && respin == NULL && !(port != NULL && ridx_filename != NULL))
        goto opthelp;
    out = bio_open_default(outfile, 'w', FORMAT_TEXT);
    if (out == NULL)
        goto end;
    if (req == NULL && (add_nonce != 2))
        add_nonce = 0;
    if (req == NULL && reqin != NULL) {
        derbio = bio_open_default(reqin, 'r', FORMAT_ASN1);
        if (derbio == NULL)
            goto end;
        req = d2i_OCSP_REQUEST_bio(derbio, NULL);
        BIO_free(derbio);
        if (req == NULL) {
            BIO_printf(bio_err, "Error reading OCSP request\n");
            goto end;
        }
    }
    if (req == NULL && port != NULL) {
        acbio = init_responder(port);
        if (acbio == NULL)
            goto end;
    }
    if (rsignfile != NULL) {
        if (rkeyfile == NULL)
            rkeyfile = rsignfile;
        rsigner = load_cert(rsignfile, FORMAT_PEM, "responder certificate");
        if (rsigner == NULL) {
            BIO_printf(bio_err, "Error loading responder certificate\n");
            goto end;
        }
        if (!load_certs(rca_filename, &rca_cert, FORMAT_PEM,
                        NULL, "CA certificate"))
            goto end;
        if (rcertfile != NULL) {
            if (!load_certs(rcertfile, &rother, FORMAT_PEM, NULL,
                            "responder other certificates"))
                goto end;
        }
        rkey = load_key(rkeyfile, FORMAT_PEM, 0, NULL, NULL,
                        "responder private key");
        if (rkey == NULL)
            goto end;
    }
    if (acbio != NULL)
        BIO_printf(bio_err, "Waiting for OCSP client connections...\n");
redo_accept:
    if (acbio != NULL) {
        if (!do_responder(&req, &cbio, acbio))
            goto end;
        if (req == NULL) {
            resp =
                OCSP_response_create(OCSP_RESPONSE_STATUS_MALFORMEDREQUEST,
                                     NULL);
            send_ocsp_response(cbio, resp);
            goto done_resp;
        }
    }
    if (req == NULL
        && (signfile != NULL || reqout != NULL
            || host != NULL || add_nonce || ridx_filename != NULL)) {
        BIO_printf(bio_err, "Need an OCSP request for this operation!\n");
        goto end;
    }
    if (req != NULL && add_nonce)
        OCSP_request_add1_nonce(req, NULL, -1);
    if (signfile != NULL) {
        if (keyfile == NULL)
            keyfile = signfile;
        signer = load_cert(signfile, FORMAT_PEM, "signer certificate");
        if (signer == NULL) {
            BIO_printf(bio_err, "Error loading signer certificate\n");
            goto end;
        }
        if (sign_certfile != NULL) {
            if (!load_certs(sign_certfile, &sign_other, FORMAT_PEM, NULL,
                            "signer certificates"))
                goto end;
        }
        key = load_key(keyfile, FORMAT_PEM, 0, NULL, NULL,
                       "signer private key");
        if (key == NULL)
            goto end;
        if (!OCSP_request_sign
            (req, signer, key, NULL, sign_other, sign_flags)) {
            BIO_printf(bio_err, "Error signing OCSP request\n");
            goto end;
        }
    }
    if (req_text && req != NULL)
        OCSP_REQUEST_print(out, req, 0);
    if (reqout != NULL) {
        derbio = bio_open_default(reqout, 'w', FORMAT_ASN1);
        if (derbio == NULL)
            goto end;
        i2d_OCSP_REQUEST_bio(derbio, req);
        BIO_free(derbio);
    }
    if (ridx_filename != NULL
        && (rkey == NULL || rsigner == NULL || rca_cert == NULL)) {
        BIO_printf(bio_err,
                   "Need a responder certificate, key and CA for this operation!\n");
        goto end;
    }
    if (ridx_filename != NULL && rdb == NULL) {
        rdb = load_index(ridx_filename, NULL);
        if (rdb == NULL)
            goto end;
        if (!index_index(rdb))
            goto end;
    }
    if (rdb != NULL) {
        make_ocsp_response(&resp, req, rdb, rca_cert, rsigner, rkey,
                               rsign_md, rother, rflags, nmin, ndays, badsig);
        if (cbio != NULL)
            send_ocsp_response(cbio, resp);
    } else if (host != NULL) {
# ifndef OPENSSL_NO_SOCK
        resp = process_responder(req, host, path,
                                 port, use_ssl, headers, req_timeout);
        if (resp == NULL)
            goto end;
# else
        BIO_printf(bio_err,
                   "Error creating connect BIO - sockets not supported.\n");
        goto end;
# endif
    } else if (respin != NULL) {
        derbio = bio_open_default(respin, 'r', FORMAT_ASN1);
        if (derbio == NULL)
            goto end;
        resp = d2i_OCSP_RESPONSE_bio(derbio, NULL);
        BIO_free(derbio);
        if (resp == NULL) {
            BIO_printf(bio_err, "Error reading OCSP response\n");
            goto end;
        }
    } else {
        ret = 0;
        goto end;
    }
 done_resp:
    if (respout != NULL) {
        derbio = bio_open_default(respout, 'w', FORMAT_ASN1);
        if (derbio == NULL)
            goto end;
        i2d_OCSP_RESPONSE_bio(derbio, resp);
        BIO_free(derbio);
    }
    i = OCSP_response_status(resp);
    if (i != OCSP_RESPONSE_STATUS_SUCCESSFUL) {
        BIO_printf(out, "Responder Error: %s (%d)\n",
                   OCSP_response_status_str(i), i);
        if (ignore_err)
            goto redo_accept;
        ret = 0;
        goto end;
    }
    if (resp_text)
        OCSP_RESPONSE_print(out, resp, 0);
    if (cbio != NULL) {
        if (accept_count != -1 && --accept_count <= 0) {
            ret = 0;
            goto end;
        }
        BIO_free_all(cbio);
        cbio = NULL;
        OCSP_REQUEST_free(req);
        req = NULL;
        OCSP_RESPONSE_free(resp);
        resp = NULL;
        goto redo_accept;
    }
    if (ridx_filename != NULL) {
        ret = 0;
        goto end;
    }
    if (store == NULL) {
        store = setup_verify(CAfile, CApath, noCAfile, noCApath);
        if (!store)
            goto end;
    }
    if (vpmtouched)
        X509_STORE_set1_param(store, vpm);
    if (verify_certfile != NULL) {
        if (!load_certs(verify_certfile, &verify_other, FORMAT_PEM, NULL,
                        "validator certificate"))
            goto end;
    }
    bs = OCSP_response_get1_basic(resp);
    if (bs == NULL) {
        BIO_printf(bio_err, "Error parsing response\n");
        goto end;
    }
    ret = 0;
    if (!noverify) {
        if (req != NULL && ((i = OCSP_check_nonce(req, bs)) <= 0)) {
            if (i == -1)
                BIO_printf(bio_err, "WARNING: no nonce in response\n");
            else {
                BIO_printf(bio_err, "Nonce Verify error\n");
                ret = 1;
                goto end;
            }
        }
        i = OCSP_basic_verify(bs, verify_other, store, verify_flags);
        if (i <= 0 && issuers) {
            i = OCSP_basic_verify(bs, issuers, store, OCSP_TRUSTOTHER);
            if (i > 0)
                ERR_clear_error();
        }
        if (i <= 0) {
            BIO_printf(bio_err, "Response Verify Failure\n");
            ERR_print_errors(bio_err);
            ret = 1;
        } else {
            BIO_printf(bio_err, "Response verify OK\n");
        }
    }
    print_ocsp_summary(out, bs, req, reqnames, ids, nsec, maxage);
 end:
    ERR_print_errors(bio_err);
    X509_free(signer);
    X509_STORE_free(store);
    X509_VERIFY_PARAM_free(vpm);
    EVP_PKEY_free(key);
    EVP_PKEY_free(rkey);
    X509_free(cert);
    sk_X509_pop_free(issuers, X509_free);
    X509_free(rsigner);
    sk_X509_pop_free(rca_cert, X509_free);
    free_index(rdb);
    BIO_free_all(cbio);
    BIO_free_all(acbio);
    BIO_free(out);
    OCSP_REQUEST_free(req);
    OCSP_RESPONSE_free(resp);
    OCSP_BASICRESP_free(bs);
    sk_OPENSSL_STRING_free(reqnames);
    sk_OCSP_CERTID_free(ids);
    sk_X509_pop_free(sign_other, X509_free);
    sk_X509_pop_free(verify_other, X509_free);
    sk_CONF_VALUE_pop_free(headers, X509V3_conf_free);
    OPENSSL_free(thost);
    OPENSSL_free(tport);
    OPENSSL_free(tpath);
    return (ret);
}
['int ocsp_main(int argc, char **argv)\n{\n    BIO *acbio = NULL, *cbio = NULL, *derbio = NULL, *out = NULL;\n    const EVP_MD *cert_id_md = NULL, *rsign_md = NULL;\n    int trailing_md = 0;\n    CA_DB *rdb = NULL;\n    EVP_PKEY *key = NULL, *rkey = NULL;\n    OCSP_BASICRESP *bs = NULL;\n    OCSP_REQUEST *req = NULL;\n    OCSP_RESPONSE *resp = NULL;\n    STACK_OF(CONF_VALUE) *headers = NULL;\n    STACK_OF(OCSP_CERTID) *ids = NULL;\n    STACK_OF(OPENSSL_STRING) *reqnames = NULL;\n    STACK_OF(X509) *sign_other = NULL, *verify_other = NULL, *rother = NULL;\n    STACK_OF(X509) *issuers = NULL;\n    X509 *issuer = NULL, *cert = NULL;\n    STACK_OF(X509) *rca_cert = NULL;\n    X509 *signer = NULL, *rsigner = NULL;\n    X509_STORE *store = NULL;\n    X509_VERIFY_PARAM *vpm = NULL;\n    const char *CAfile = NULL, *CApath = NULL;\n    char *header, *value;\n    char *host = NULL, *port = NULL, *path = "/", *outfile = NULL;\n    char *rca_filename = NULL, *reqin = NULL, *respin = NULL;\n    char *reqout = NULL, *respout = NULL, *ridx_filename = NULL;\n    char *rsignfile = NULL, *rkeyfile = NULL;\n    char *sign_certfile = NULL, *verify_certfile = NULL, *rcertfile = NULL;\n    char *signfile = NULL, *keyfile = NULL;\n    char *thost = NULL, *tport = NULL, *tpath = NULL;\n    int noCAfile = 0, noCApath = 0;\n    int accept_count = -1, add_nonce = 1, noverify = 0, use_ssl = -1;\n    int vpmtouched = 0, badsig = 0, i, ignore_err = 0, nmin = 0, ndays = -1;\n    int req_text = 0, resp_text = 0, ret = 1;\n#ifndef OPENSSL_NO_SOCK\n    int req_timeout = -1;\n#endif\n    long nsec = MAX_VALIDITY_PERIOD, maxage = -1;\n    unsigned long sign_flags = 0, verify_flags = 0, rflags = 0;\n    OPTION_CHOICE o;\n    char *prog;\n    reqnames = sk_OPENSSL_STRING_new_null();\n    if (reqnames == NULL)\n        goto end;\n    ids = sk_OCSP_CERTID_new_null();\n    if (ids == NULL)\n        goto end;\n    if ((vpm = X509_VERIFY_PARAM_new()) == NULL)\n        return 1;\n    prog = opt_init(argc, argv, ocsp_options);\n    while ((o = opt_next()) != OPT_EOF) {\n        switch (o) {\n        case OPT_EOF:\n        case OPT_ERR:\n opthelp:\n            BIO_printf(bio_err, "%s: Use -help for summary.\\n", prog);\n            goto end;\n        case OPT_HELP:\n            ret = 0;\n            opt_help(ocsp_options);\n            goto end;\n        case OPT_OUTFILE:\n            outfile = opt_arg();\n            break;\n        case OPT_TIMEOUT:\n#ifndef OPENSSL_NO_SOCK\n            req_timeout = atoi(opt_arg());\n#endif\n            break;\n        case OPT_URL:\n            OPENSSL_free(thost);\n            OPENSSL_free(tport);\n            OPENSSL_free(tpath);\n            thost = tport = tpath = NULL;\n            if (!OCSP_parse_url(opt_arg(), &host, &port, &path, &use_ssl)) {\n                BIO_printf(bio_err, "%s Error parsing URL\\n", prog);\n                goto end;\n            }\n            thost = host;\n            tport = port;\n            tpath = path;\n            break;\n        case OPT_HOST:\n            host = opt_arg();\n            break;\n        case OPT_PORT:\n            port = opt_arg();\n            break;\n        case OPT_IGNORE_ERR:\n            ignore_err = 1;\n            break;\n        case OPT_NOVERIFY:\n            noverify = 1;\n            break;\n        case OPT_NONCE:\n            add_nonce = 2;\n            break;\n        case OPT_NO_NONCE:\n            add_nonce = 0;\n            break;\n        case OPT_RESP_NO_CERTS:\n            rflags |= OCSP_NOCERTS;\n            break;\n        case OPT_RESP_KEY_ID:\n            rflags |= OCSP_RESPID_KEY;\n            break;\n        case OPT_NO_CERTS:\n            sign_flags |= OCSP_NOCERTS;\n            break;\n        case OPT_NO_SIGNATURE_VERIFY:\n            verify_flags |= OCSP_NOSIGS;\n            break;\n        case OPT_NO_CERT_VERIFY:\n            verify_flags |= OCSP_NOVERIFY;\n            break;\n        case OPT_NO_CHAIN:\n            verify_flags |= OCSP_NOCHAIN;\n            break;\n        case OPT_NO_CERT_CHECKS:\n            verify_flags |= OCSP_NOCHECKS;\n            break;\n        case OPT_NO_EXPLICIT:\n            verify_flags |= OCSP_NOEXPLICIT;\n            break;\n        case OPT_TRUST_OTHER:\n            verify_flags |= OCSP_TRUSTOTHER;\n            break;\n        case OPT_NO_INTERN:\n            verify_flags |= OCSP_NOINTERN;\n            break;\n        case OPT_BADSIG:\n            badsig = 1;\n            break;\n        case OPT_TEXT:\n            req_text = resp_text = 1;\n            break;\n        case OPT_REQ_TEXT:\n            req_text = 1;\n            break;\n        case OPT_RESP_TEXT:\n            resp_text = 1;\n            break;\n        case OPT_REQIN:\n            reqin = opt_arg();\n            break;\n        case OPT_RESPIN:\n            respin = opt_arg();\n            break;\n        case OPT_SIGNER:\n            signfile = opt_arg();\n            break;\n        case OPT_VAFILE:\n            verify_certfile = opt_arg();\n            verify_flags |= OCSP_TRUSTOTHER;\n            break;\n        case OPT_SIGN_OTHER:\n            sign_certfile = opt_arg();\n            break;\n        case OPT_VERIFY_OTHER:\n            verify_certfile = opt_arg();\n            break;\n        case OPT_CAFILE:\n            CAfile = opt_arg();\n            break;\n        case OPT_CAPATH:\n            CApath = opt_arg();\n            break;\n        case OPT_NOCAFILE:\n            noCAfile = 1;\n            break;\n        case OPT_NOCAPATH:\n            noCApath = 1;\n            break;\n        case OPT_V_CASES:\n            if (!opt_verify(o, vpm))\n                goto end;\n            vpmtouched++;\n            break;\n        case OPT_VALIDITY_PERIOD:\n            opt_long(opt_arg(), &nsec);\n            break;\n        case OPT_STATUS_AGE:\n            opt_long(opt_arg(), &maxage);\n            break;\n        case OPT_SIGNKEY:\n            keyfile = opt_arg();\n            break;\n        case OPT_REQOUT:\n            reqout = opt_arg();\n            break;\n        case OPT_RESPOUT:\n            respout = opt_arg();\n            break;\n        case OPT_PATH:\n            path = opt_arg();\n            break;\n        case OPT_ISSUER:\n            issuer = load_cert(opt_arg(), FORMAT_PEM, "issuer certificate");\n            if (issuer == NULL)\n                goto end;\n            if (issuers == NULL) {\n                if ((issuers = sk_X509_new_null()) == NULL)\n                    goto end;\n            }\n            sk_X509_push(issuers, issuer);\n            break;\n        case OPT_CERT:\n            X509_free(cert);\n            cert = load_cert(opt_arg(), FORMAT_PEM, "certificate");\n            if (cert == NULL)\n                goto end;\n            if (cert_id_md == NULL)\n                cert_id_md = EVP_sha1();\n            if (!add_ocsp_cert(&req, cert, cert_id_md, issuer, ids))\n                goto end;\n            if (!sk_OPENSSL_STRING_push(reqnames, opt_arg()))\n                goto end;\n            trailing_md = 0;\n            break;\n        case OPT_SERIAL:\n            if (cert_id_md == NULL)\n                cert_id_md = EVP_sha1();\n            if (!add_ocsp_serial(&req, opt_arg(), cert_id_md, issuer, ids))\n                goto end;\n            if (!sk_OPENSSL_STRING_push(reqnames, opt_arg()))\n                goto end;\n            trailing_md = 0;\n            break;\n        case OPT_INDEX:\n            ridx_filename = opt_arg();\n            break;\n        case OPT_CA:\n            rca_filename = opt_arg();\n            break;\n        case OPT_NMIN:\n            opt_int(opt_arg(), &nmin);\n            if (ndays == -1)\n                ndays = 0;\n            break;\n        case OPT_REQUEST:\n            opt_int(opt_arg(), &accept_count);\n            break;\n        case OPT_NDAYS:\n            ndays = atoi(opt_arg());\n            break;\n        case OPT_RSIGNER:\n            rsignfile = opt_arg();\n            break;\n        case OPT_RKEY:\n            rkeyfile = opt_arg();\n            break;\n        case OPT_ROTHER:\n            rcertfile = opt_arg();\n            break;\n        case OPT_RMD:\n            if (!opt_md(opt_arg(), &rsign_md))\n                goto end;\n            break;\n        case OPT_HEADER:\n            header = opt_arg();\n            value = strchr(header, \'=\');\n            if (value == NULL) {\n                BIO_printf(bio_err, "Missing = in header key=value\\n");\n                goto opthelp;\n            }\n            *value++ = \'\\0\';\n            if (!X509V3_add_value(header, value, &headers))\n                goto end;\n            break;\n        case OPT_MD:\n            if (trailing_md) {\n                BIO_printf(bio_err,\n                           "%s: Digest must be before -cert or -serial\\n",\n                           prog);\n                goto opthelp;\n            }\n            if (!opt_md(opt_unknown(), &cert_id_md))\n                goto opthelp;\n            trailing_md = 1;\n            break;\n        }\n    }\n    if (trailing_md) {\n        BIO_printf(bio_err, "%s: Digest must be before -cert or -serial\\n",\n                   prog);\n        goto opthelp;\n    }\n    argc = opt_num_rest();\n    if (argc != 0)\n        goto opthelp;\n    if (req == NULL&& reqin == NULL\n        && respin == NULL && !(port != NULL && ridx_filename != NULL))\n        goto opthelp;\n    out = bio_open_default(outfile, \'w\', FORMAT_TEXT);\n    if (out == NULL)\n        goto end;\n    if (req == NULL && (add_nonce != 2))\n        add_nonce = 0;\n    if (req == NULL && reqin != NULL) {\n        derbio = bio_open_default(reqin, \'r\', FORMAT_ASN1);\n        if (derbio == NULL)\n            goto end;\n        req = d2i_OCSP_REQUEST_bio(derbio, NULL);\n        BIO_free(derbio);\n        if (req == NULL) {\n            BIO_printf(bio_err, "Error reading OCSP request\\n");\n            goto end;\n        }\n    }\n    if (req == NULL && port != NULL) {\n        acbio = init_responder(port);\n        if (acbio == NULL)\n            goto end;\n    }\n    if (rsignfile != NULL) {\n        if (rkeyfile == NULL)\n            rkeyfile = rsignfile;\n        rsigner = load_cert(rsignfile, FORMAT_PEM, "responder certificate");\n        if (rsigner == NULL) {\n            BIO_printf(bio_err, "Error loading responder certificate\\n");\n            goto end;\n        }\n        if (!load_certs(rca_filename, &rca_cert, FORMAT_PEM,\n                        NULL, "CA certificate"))\n            goto end;\n        if (rcertfile != NULL) {\n            if (!load_certs(rcertfile, &rother, FORMAT_PEM, NULL,\n                            "responder other certificates"))\n                goto end;\n        }\n        rkey = load_key(rkeyfile, FORMAT_PEM, 0, NULL, NULL,\n                        "responder private key");\n        if (rkey == NULL)\n            goto end;\n    }\n    if (acbio != NULL)\n        BIO_printf(bio_err, "Waiting for OCSP client connections...\\n");\nredo_accept:\n    if (acbio != NULL) {\n        if (!do_responder(&req, &cbio, acbio))\n            goto end;\n        if (req == NULL) {\n            resp =\n                OCSP_response_create(OCSP_RESPONSE_STATUS_MALFORMEDREQUEST,\n                                     NULL);\n            send_ocsp_response(cbio, resp);\n            goto done_resp;\n        }\n    }\n    if (req == NULL\n        && (signfile != NULL || reqout != NULL\n            || host != NULL || add_nonce || ridx_filename != NULL)) {\n        BIO_printf(bio_err, "Need an OCSP request for this operation!\\n");\n        goto end;\n    }\n    if (req != NULL && add_nonce)\n        OCSP_request_add1_nonce(req, NULL, -1);\n    if (signfile != NULL) {\n        if (keyfile == NULL)\n            keyfile = signfile;\n        signer = load_cert(signfile, FORMAT_PEM, "signer certificate");\n        if (signer == NULL) {\n            BIO_printf(bio_err, "Error loading signer certificate\\n");\n            goto end;\n        }\n        if (sign_certfile != NULL) {\n            if (!load_certs(sign_certfile, &sign_other, FORMAT_PEM, NULL,\n                            "signer certificates"))\n                goto end;\n        }\n        key = load_key(keyfile, FORMAT_PEM, 0, NULL, NULL,\n                       "signer private key");\n        if (key == NULL)\n            goto end;\n        if (!OCSP_request_sign\n            (req, signer, key, NULL, sign_other, sign_flags)) {\n            BIO_printf(bio_err, "Error signing OCSP request\\n");\n            goto end;\n        }\n    }\n    if (req_text && req != NULL)\n        OCSP_REQUEST_print(out, req, 0);\n    if (reqout != NULL) {\n        derbio = bio_open_default(reqout, \'w\', FORMAT_ASN1);\n        if (derbio == NULL)\n            goto end;\n        i2d_OCSP_REQUEST_bio(derbio, req);\n        BIO_free(derbio);\n    }\n    if (ridx_filename != NULL\n        && (rkey == NULL || rsigner == NULL || rca_cert == NULL)) {\n        BIO_printf(bio_err,\n                   "Need a responder certificate, key and CA for this operation!\\n");\n        goto end;\n    }\n    if (ridx_filename != NULL && rdb == NULL) {\n        rdb = load_index(ridx_filename, NULL);\n        if (rdb == NULL)\n            goto end;\n        if (!index_index(rdb))\n            goto end;\n    }\n    if (rdb != NULL) {\n        make_ocsp_response(&resp, req, rdb, rca_cert, rsigner, rkey,\n                               rsign_md, rother, rflags, nmin, ndays, badsig);\n        if (cbio != NULL)\n            send_ocsp_response(cbio, resp);\n    } else if (host != NULL) {\n# ifndef OPENSSL_NO_SOCK\n        resp = process_responder(req, host, path,\n                                 port, use_ssl, headers, req_timeout);\n        if (resp == NULL)\n            goto end;\n# else\n        BIO_printf(bio_err,\n                   "Error creating connect BIO - sockets not supported.\\n");\n        goto end;\n# endif\n    } else if (respin != NULL) {\n        derbio = bio_open_default(respin, \'r\', FORMAT_ASN1);\n        if (derbio == NULL)\n            goto end;\n        resp = d2i_OCSP_RESPONSE_bio(derbio, NULL);\n        BIO_free(derbio);\n        if (resp == NULL) {\n            BIO_printf(bio_err, "Error reading OCSP response\\n");\n            goto end;\n        }\n    } else {\n        ret = 0;\n        goto end;\n    }\n done_resp:\n    if (respout != NULL) {\n        derbio = bio_open_default(respout, \'w\', FORMAT_ASN1);\n        if (derbio == NULL)\n            goto end;\n        i2d_OCSP_RESPONSE_bio(derbio, resp);\n        BIO_free(derbio);\n    }\n    i = OCSP_response_status(resp);\n    if (i != OCSP_RESPONSE_STATUS_SUCCESSFUL) {\n        BIO_printf(out, "Responder Error: %s (%d)\\n",\n                   OCSP_response_status_str(i), i);\n        if (ignore_err)\n            goto redo_accept;\n        ret = 0;\n        goto end;\n    }\n    if (resp_text)\n        OCSP_RESPONSE_print(out, resp, 0);\n    if (cbio != NULL) {\n        if (accept_count != -1 && --accept_count <= 0) {\n            ret = 0;\n            goto end;\n        }\n        BIO_free_all(cbio);\n        cbio = NULL;\n        OCSP_REQUEST_free(req);\n        req = NULL;\n        OCSP_RESPONSE_free(resp);\n        resp = NULL;\n        goto redo_accept;\n    }\n    if (ridx_filename != NULL) {\n        ret = 0;\n        goto end;\n    }\n    if (store == NULL) {\n        store = setup_verify(CAfile, CApath, noCAfile, noCApath);\n        if (!store)\n            goto end;\n    }\n    if (vpmtouched)\n        X509_STORE_set1_param(store, vpm);\n    if (verify_certfile != NULL) {\n        if (!load_certs(verify_certfile, &verify_other, FORMAT_PEM, NULL,\n                        "validator certificate"))\n            goto end;\n    }\n    bs = OCSP_response_get1_basic(resp);\n    if (bs == NULL) {\n        BIO_printf(bio_err, "Error parsing response\\n");\n        goto end;\n    }\n    ret = 0;\n    if (!noverify) {\n        if (req != NULL && ((i = OCSP_check_nonce(req, bs)) <= 0)) {\n            if (i == -1)\n                BIO_printf(bio_err, "WARNING: no nonce in response\\n");\n            else {\n                BIO_printf(bio_err, "Nonce Verify error\\n");\n                ret = 1;\n                goto end;\n            }\n        }\n        i = OCSP_basic_verify(bs, verify_other, store, verify_flags);\n        if (i <= 0 && issuers) {\n            i = OCSP_basic_verify(bs, issuers, store, OCSP_TRUSTOTHER);\n            if (i > 0)\n                ERR_clear_error();\n        }\n        if (i <= 0) {\n            BIO_printf(bio_err, "Response Verify Failure\\n");\n            ERR_print_errors(bio_err);\n            ret = 1;\n        } else {\n            BIO_printf(bio_err, "Response verify OK\\n");\n        }\n    }\n    print_ocsp_summary(out, bs, req, reqnames, ids, nsec, maxage);\n end:\n    ERR_print_errors(bio_err);\n    X509_free(signer);\n    X509_STORE_free(store);\n    X509_VERIFY_PARAM_free(vpm);\n    EVP_PKEY_free(key);\n    EVP_PKEY_free(rkey);\n    X509_free(cert);\n    sk_X509_pop_free(issuers, X509_free);\n    X509_free(rsigner);\n    sk_X509_pop_free(rca_cert, X509_free);\n    free_index(rdb);\n    BIO_free_all(cbio);\n    BIO_free_all(acbio);\n    BIO_free(out);\n    OCSP_REQUEST_free(req);\n    OCSP_RESPONSE_free(resp);\n    OCSP_BASICRESP_free(bs);\n    sk_OPENSSL_STRING_free(reqnames);\n    sk_OCSP_CERTID_free(ids);\n    sk_X509_pop_free(sign_other, X509_free);\n    sk_X509_pop_free(verify_other, X509_free);\n    sk_CONF_VALUE_pop_free(headers, X509V3_conf_free);\n    OPENSSL_free(thost);\n    OPENSSL_free(tport);\n    OPENSSL_free(tpath);\n    return (ret);\n}', 'DEFINE_SPECIAL_STACK_OF(OPENSSL_STRING, char)', 'OPENSSL_STACK *OPENSSL_sk_new_null(void)\n{\n    return OPENSSL_zalloc(sizeof(OPENSSL_STACK));\n}', 'void *CRYPTO_zalloc(size_t num, const char *file, int line)\n{\n    void *ret = CRYPTO_malloc(num, file, line);\n    FAILTEST();\n    if (ret != NULL)\n        memset(ret, 0, num);\n    return ret;\n}', 'void *CRYPTO_malloc(size_t num, const char *file, int line)\n{\n    void *ret = NULL;\n    if (malloc_impl != NULL && malloc_impl != CRYPTO_malloc)\n        return malloc_impl(num, file, line);\n    if (num == 0)\n        return NULL;\n    FAILTEST();\n    allow_customize = 0;\n#ifndef OPENSSL_NO_CRYPTO_MDEBUG\n    if (call_malloc_debug) {\n        CRYPTO_mem_debug_malloc(NULL, num, 0, file, line);\n        ret = malloc(num);\n        CRYPTO_mem_debug_malloc(ret, num, 1, file, line);\n    } else {\n        ret = malloc(num);\n    }\n#else\n    (void)(file); (void)(line);\n    ret = malloc(num);\n#endif\n    return ret;\n}', 'DEFINE_STACK_OF(OCSP_CERTID)']