crypto/ts/ts_rsp_verify.c:383: error: NULL_DEREFERENCE
  pointer `signer` last assigned on line 345 could be null and is dereferenced by call to `ts_check_signer_name()` at line 383, column 25.
Showing all 33 steps of the trace


crypto/ts/ts_rsp_verify.c:342:1: start of procedure int_ts_RESP_verify_token()
340.    *      - Check if the TSA name is the expected TSA.
341.    */
342. > static int int_ts_RESP_verify_token(TS_VERIFY_CTX *ctx,
343.                                       PKCS7 *token, TS_TST_INFO *tst_info)
344.   {

crypto/ts/ts_rsp_verify.c:345:5: 
343.                                       PKCS7 *token, TS_TST_INFO *tst_info)
344.   {
345. >     X509 *signer = NULL;
346.       GENERAL_NAME *tsa_name = tst_info->tsa;
347.       X509_ALGOR *md_alg = NULL;

crypto/ts/ts_rsp_verify.c:346:5: 
344.   {
345.       X509 *signer = NULL;
346. >     GENERAL_NAME *tsa_name = tst_info->tsa;
347.       X509_ALGOR *md_alg = NULL;
348.       unsigned char *imprint = NULL;

crypto/ts/ts_rsp_verify.c:347:5: 
345.       X509 *signer = NULL;
346.       GENERAL_NAME *tsa_name = tst_info->tsa;
347. >     X509_ALGOR *md_alg = NULL;
348.       unsigned char *imprint = NULL;
349.       unsigned imprint_len = 0;

crypto/ts/ts_rsp_verify.c:348:5: 
346.       GENERAL_NAME *tsa_name = tst_info->tsa;
347.       X509_ALGOR *md_alg = NULL;
348. >     unsigned char *imprint = NULL;
349.       unsigned imprint_len = 0;
350.       int ret = 0;

crypto/ts/ts_rsp_verify.c:349:5: 
347.       X509_ALGOR *md_alg = NULL;
348.       unsigned char *imprint = NULL;
349. >     unsigned imprint_len = 0;
350.       int ret = 0;
351.       int flags = ctx->flags;

crypto/ts/ts_rsp_verify.c:350:5: 
348.       unsigned char *imprint = NULL;
349.       unsigned imprint_len = 0;
350. >     int ret = 0;
351.       int flags = ctx->flags;
352.   

crypto/ts/ts_rsp_verify.c:351:5: 
349.       unsigned imprint_len = 0;
350.       int ret = 0;
351. >     int flags = ctx->flags;
352.   
353.       /* Some options require us to also check the signature */

crypto/ts/ts_rsp_verify.c:354:11: Taking false branch
352.   
353.       /* Some options require us to also check the signature */
354.       if (((flags & TS_VFY_SIGNER) && tsa_name != NULL)
                 ^
355.               || (flags & TS_VFY_TSA_NAME)) {
356.           flags |= TS_VFY_SIGNATURE;

crypto/ts/ts_rsp_verify.c:355:17: Taking false branch
353.       /* Some options require us to also check the signature */
354.       if (((flags & TS_VFY_SIGNER) && tsa_name != NULL)
355.               || (flags & TS_VFY_TSA_NAME)) {
                       ^
356.           flags |= TS_VFY_SIGNATURE;
357.       }

crypto/ts/ts_rsp_verify.c:359:10: Taking false branch
357.       }
358.   
359.       if ((flags & TS_VFY_SIGNATURE)
                ^
360.           && !TS_RESP_verify_signature(token, ctx->certs, ctx->store, &signer))
361.           goto err;

crypto/ts/ts_rsp_verify.c:362:10: Taking false branch
360.           && !TS_RESP_verify_signature(token, ctx->certs, ctx->store, &signer))
361.           goto err;
362.       if ((flags & TS_VFY_VERSION)
                ^
363.           && TS_TST_INFO_get_version(tst_info) != 1) {
364.           TSerr(TS_F_INT_TS_RESP_VERIFY_TOKEN, TS_R_UNSUPPORTED_VERSION);

crypto/ts/ts_rsp_verify.c:367:10: Taking true branch
365.           goto err;
366.       }
367.       if ((flags & TS_VFY_POLICY)
                ^
368.           && !ts_check_policy(ctx->policy, tst_info))
369.           goto err;

crypto/ts/ts_rsp_verify.c:368:13: 
366.       }
367.       if ((flags & TS_VFY_POLICY)
368. >         && !ts_check_policy(ctx->policy, tst_info))
369.           goto err;
370.       if ((flags & TS_VFY_IMPRINT)

crypto/ts/ts_rsp_verify.c:481:1: start of procedure ts_check_policy()
  479.   }
  480.   
  481. > static int ts_check_policy(const ASN1_OBJECT *req_oid, 
  482.                              const TS_TST_INFO *tst_info)
  483.   {

crypto/ts/ts_rsp_verify.c:484:5: 
  482.                              const TS_TST_INFO *tst_info)
  483.   {
  484. >     const ASN1_OBJECT *resp_oid = tst_info->policy_id;
  485.   
  486.       if (OBJ_cmp(req_oid, resp_oid) != 0) {

crypto/ts/ts_rsp_verify.c:486:9: 
  484.       const ASN1_OBJECT *resp_oid = tst_info->policy_id;
  485.   
  486. >     if (OBJ_cmp(req_oid, resp_oid) != 0) {
  487.           TSerr(TS_F_TS_CHECK_POLICY, TS_R_POLICY_MISMATCH);
  488.           return 0;

crypto/objects/obj_lib.c:58:1: start of procedure OBJ_cmp()
    56.   }
    57.   
    58. > int OBJ_cmp(const ASN1_OBJECT *a, const ASN1_OBJECT *b)
    59.   {
    60.       int ret;

crypto/objects/obj_lib.c:62:5: 
    60.       int ret;
    61.   
    62. >     ret = (a->length - b->length);
    63.       if (ret)
    64.           return (ret);

crypto/objects/obj_lib.c:63:9: Taking true branch
    61.   
    62.       ret = (a->length - b->length);
    63.       if (ret)
                  ^
    64.           return (ret);
    65.       return (memcmp(a->data, b->data, a->length));

crypto/objects/obj_lib.c:64:9: 
    62.       ret = (a->length - b->length);
    63.       if (ret)
    64. >         return (ret);
    65.       return (memcmp(a->data, b->data, a->length));
    66.   }

crypto/objects/obj_lib.c:66:1: return from a call to OBJ_cmp
    64.           return (ret);
    65.       return (memcmp(a->data, b->data, a->length));
    66. > }

crypto/ts/ts_rsp_verify.c:486:9: Taking false branch
  484.       const ASN1_OBJECT *resp_oid = tst_info->policy_id;
  485.   
  486.       if (OBJ_cmp(req_oid, resp_oid) != 0) {
                 ^
  487.           TSerr(TS_F_TS_CHECK_POLICY, TS_R_POLICY_MISMATCH);
  488.           return 0;

crypto/ts/ts_rsp_verify.c:491:5: 
  489.       }
  490.   
  491. >     return 1;
  492.   }
  493.   

crypto/ts/ts_rsp_verify.c:492:1: return from a call to ts_check_policy
  490.   
  491.       return 1;
  492. > }
  493.   
  494.   static int ts_compute_imprint(BIO *data, TS_TST_INFO *tst_info,

crypto/ts/ts_rsp_verify.c:368:13: Taking false branch
366.       }
367.       if ((flags & TS_VFY_POLICY)
368.           && !ts_check_policy(ctx->policy, tst_info))
                   ^
369.           goto err;
370.       if ((flags & TS_VFY_IMPRINT)

crypto/ts/ts_rsp_verify.c:370:10: Taking true branch
368.           && !ts_check_policy(ctx->policy, tst_info))
369.           goto err;
370.       if ((flags & TS_VFY_IMPRINT)
                ^
371.           && !ts_check_imprints(ctx->md_alg, ctx->imprint, ctx->imprint_len,
372.                                 tst_info))

crypto/ts/ts_rsp_verify.c:371:13: Taking false branch
369.           goto err;
370.       if ((flags & TS_VFY_IMPRINT)
371.           && !ts_check_imprints(ctx->md_alg, ctx->imprint, ctx->imprint_len,
                   ^
372.                                 tst_info))
373.           goto err;

crypto/ts/ts_rsp_verify.c:374:10: Taking false branch
372.                                 tst_info))
373.           goto err;
374.       if ((flags & TS_VFY_DATA)
                ^
375.           && (!ts_compute_imprint(ctx->data, tst_info,
376.                                   &md_alg, &imprint, &imprint_len)

crypto/ts/ts_rsp_verify.c:379:10: Taking false branch
377.               || !ts_check_imprints(md_alg, imprint, imprint_len, tst_info)))
378.           goto err;
379.       if ((flags & TS_VFY_NONCE)
                ^
380.           && !ts_check_nonces(ctx->nonce, tst_info))
381.           goto err;

crypto/ts/ts_rsp_verify.c:382:10: Taking true branch
380.           && !ts_check_nonces(ctx->nonce, tst_info))
381.           goto err;
382.       if ((flags & TS_VFY_SIGNER)
                ^
383.           && tsa_name && !ts_check_signer_name(tsa_name, signer)) {
384.           TSerr(TS_F_INT_TS_RESP_VERIFY_TOKEN, TS_R_TSA_NAME_MISMATCH);

crypto/ts/ts_rsp_verify.c:383:12: Taking true branch
381.           goto err;
382.       if ((flags & TS_VFY_SIGNER)
383.           && tsa_name && !ts_check_signer_name(tsa_name, signer)) {
                  ^
384.           TSerr(TS_F_INT_TS_RESP_VERIFY_TOKEN, TS_R_TSA_NAME_MISMATCH);
385.           goto err;

crypto/ts/ts_rsp_verify.c:383:25: 
381.           goto err;
382.       if ((flags & TS_VFY_SIGNER)
383. >         && tsa_name && !ts_check_signer_name(tsa_name, signer)) {
384.           TSerr(TS_F_INT_TS_RESP_VERIFY_TOKEN, TS_R_TSA_NAME_MISMATCH);
385.           goto err;

static int int_ts_RESP_verify_token(TS_VERIFY_CTX *ctx,
                                    PKCS7 *token, TS_TST_INFO *tst_info)
{
    X509 *signer = NULL;
    GENERAL_NAME *tsa_name = tst_info->tsa;
    X509_ALGOR *md_alg = NULL;
    unsigned char *imprint = NULL;
    unsigned imprint_len = 0;
    int ret = 0;
    int flags = ctx->flags;
    if (((flags & TS_VFY_SIGNER) && tsa_name != NULL)
            || (flags & TS_VFY_TSA_NAME)) {
        flags |= TS_VFY_SIGNATURE;
    }
    if ((flags & TS_VFY_SIGNATURE)
        && !TS_RESP_verify_signature(token, ctx->certs, ctx->store, &signer))
        goto err;
    if ((flags & TS_VFY_VERSION)
        && TS_TST_INFO_get_version(tst_info) != 1) {
        TSerr(TS_F_INT_TS_RESP_VERIFY_TOKEN, TS_R_UNSUPPORTED_VERSION);
        goto err;
    }
    if ((flags & TS_VFY_POLICY)
        && !ts_check_policy(ctx->policy, tst_info))
        goto err;
    if ((flags & TS_VFY_IMPRINT)
        && !ts_check_imprints(ctx->md_alg, ctx->imprint, ctx->imprint_len,
                              tst_info))
        goto err;
    if ((flags & TS_VFY_DATA)
        && (!ts_compute_imprint(ctx->data, tst_info,
                                &md_alg, &imprint, &imprint_len)
            || !ts_check_imprints(md_alg, imprint, imprint_len, tst_info)))
        goto err;
    if ((flags & TS_VFY_NONCE)
        && !ts_check_nonces(ctx->nonce, tst_info))
        goto err;
    if ((flags & TS_VFY_SIGNER)
        && tsa_name && !ts_check_signer_name(tsa_name, signer)) {
        TSerr(TS_F_INT_TS_RESP_VERIFY_TOKEN, TS_R_TSA_NAME_MISMATCH);
        goto err;
    }
    if ((flags & TS_VFY_TSA_NAME)
        && !ts_check_signer_name(ctx->tsa_name, signer)) {
        TSerr(TS_F_INT_TS_RESP_VERIFY_TOKEN, TS_R_TSA_UNTRUSTED);
        goto err;
    }
    ret = 1;
 err:
    X509_free(signer);
    X509_ALGOR_free(md_alg);
    OPENSSL_free(imprint);
    return ret;
}
['static int int_ts_RESP_verify_token(TS_VERIFY_CTX *ctx,\n                                    PKCS7 *token, TS_TST_INFO *tst_info)\n{\n    X509 *signer = NULL;\n    GENERAL_NAME *tsa_name = tst_info->tsa;\n    X509_ALGOR *md_alg = NULL;\n    unsigned char *imprint = NULL;\n    unsigned imprint_len = 0;\n    int ret = 0;\n    int flags = ctx->flags;\n    if (((flags & TS_VFY_SIGNER) && tsa_name != NULL)\n            || (flags & TS_VFY_TSA_NAME)) {\n        flags |= TS_VFY_SIGNATURE;\n    }\n    if ((flags & TS_VFY_SIGNATURE)\n        && !TS_RESP_verify_signature(token, ctx->certs, ctx->store, &signer))\n        goto err;\n    if ((flags & TS_VFY_VERSION)\n        && TS_TST_INFO_get_version(tst_info) != 1) {\n        TSerr(TS_F_INT_TS_RESP_VERIFY_TOKEN, TS_R_UNSUPPORTED_VERSION);\n        goto err;\n    }\n    if ((flags & TS_VFY_POLICY)\n        && !ts_check_policy(ctx->policy, tst_info))\n        goto err;\n    if ((flags & TS_VFY_IMPRINT)\n        && !ts_check_imprints(ctx->md_alg, ctx->imprint, ctx->imprint_len,\n                              tst_info))\n        goto err;\n    if ((flags & TS_VFY_DATA)\n        && (!ts_compute_imprint(ctx->data, tst_info,\n                                &md_alg, &imprint, &imprint_len)\n            || !ts_check_imprints(md_alg, imprint, imprint_len, tst_info)))\n        goto err;\n    if ((flags & TS_VFY_NONCE)\n        && !ts_check_nonces(ctx->nonce, tst_info))\n        goto err;\n    if ((flags & TS_VFY_SIGNER)\n        && tsa_name && !ts_check_signer_name(tsa_name, signer)) {\n        TSerr(TS_F_INT_TS_RESP_VERIFY_TOKEN, TS_R_TSA_NAME_MISMATCH);\n        goto err;\n    }\n    if ((flags & TS_VFY_TSA_NAME)\n        && !ts_check_signer_name(ctx->tsa_name, signer)) {\n        TSerr(TS_F_INT_TS_RESP_VERIFY_TOKEN, TS_R_TSA_UNTRUSTED);\n        goto err;\n    }\n    ret = 1;\n err:\n    X509_free(signer);\n    X509_ALGOR_free(md_alg);\n    OPENSSL_free(imprint);\n    return ret;\n}', 'static int ts_check_policy(const ASN1_OBJECT *req_oid,\n                           const TS_TST_INFO *tst_info)\n{\n    const ASN1_OBJECT *resp_oid = tst_info->policy_id;\n    if (OBJ_cmp(req_oid, resp_oid) != 0) {\n        TSerr(TS_F_TS_CHECK_POLICY, TS_R_POLICY_MISMATCH);\n        return 0;\n    }\n    return 1;\n}', 'int OBJ_cmp(const ASN1_OBJECT *a, const ASN1_OBJECT *b)\n{\n    int ret;\n    ret = (a->length - b->length);\n    if (ret)\n        return (ret);\n    return (memcmp(a->data, b->data, a->length));\n}']