crypto/x509v3/pcy_tree.c:612: error: NULL_DEREFERENCE
  pointer `cache` last assigned on line 611 could be null and is dereferenced by call to `tree_link_nodes()` at line 612, column 14.
Showing all 46 steps of the trace


crypto/x509v3/pcy_tree.c:604:1: start of procedure tree_evaluate()
602.   }
603.   
604. > static int tree_evaluate(X509_POLICY_TREE *tree)
605.   {
606.       int ret, i;

crypto/x509v3/pcy_tree.c:607:5: 
605.   {
606.       int ret, i;
607. >     X509_POLICY_LEVEL *curr = tree->levels + 1;
608.       const X509_POLICY_CACHE *cache;
609.   

crypto/x509v3/pcy_tree.c:610:10: 
608.       const X509_POLICY_CACHE *cache;
609.   
610. >     for (i = 1; i < tree->nlevel; i++, curr++) {
611.           cache = policy_cache_set(curr->cert);
612.           if (!tree_link_nodes(curr, cache))

crypto/x509v3/pcy_tree.c:610:17: Loop condition is true. Entering loop body
608.       const X509_POLICY_CACHE *cache;
609.   
610.       for (i = 1; i < tree->nlevel; i++, curr++) {
                       ^
611.           cache = policy_cache_set(curr->cert);
612.           if (!tree_link_nodes(curr, cache))

crypto/x509v3/pcy_tree.c:611:9: 
609.   
610.       for (i = 1; i < tree->nlevel; i++, curr++) {
611. >         cache = policy_cache_set(curr->cert);
612.           if (!tree_link_nodes(curr, cache))
613.               return 0;

crypto/x509v3/pcy_cache.c:223:1: start of procedure policy_cache_set()
  221.   }
  222.   
  223. > const X509_POLICY_CACHE *policy_cache_set(X509 *x)
  224.   {
  225.   

crypto/x509v3/pcy_cache.c:226:9: Taking true branch
  224.   {
  225.   
  226.       if (x->policy_cache == NULL) {
                 ^
  227.           CRYPTO_w_lock(CRYPTO_LOCK_X509);
  228.           policy_cache_new(x);

crypto/x509v3/pcy_cache.c:227:9: 
  225.   
  226.       if (x->policy_cache == NULL) {
  227. >         CRYPTO_w_lock(CRYPTO_LOCK_X509);
  228.           policy_cache_new(x);
  229.           CRYPTO_w_unlock(CRYPTO_LOCK_X509);

crypto/lock.c:413:1: start of procedure CRYPTO_lock()
    411.   }
    412.   
    413. > void CRYPTO_lock(int mode, int type, const char *file, int line)
    414.   {
    415.   #ifdef LOCK_DEBUG

crypto/lock.c:440:9: Taking false branch
    438.       }
    439.   #endif
    440.       if (type < 0) {
                   ^
    441.           if (dynlock_lock_callback != NULL) {
    442.               struct CRYPTO_dynlock_value *pointer

crypto/lock.c:451:16: Taking true branch
    449.               CRYPTO_destroy_dynlockid(type);
    450.           }
    451.       } else if (locking_callback != NULL)
                          ^
    452.           locking_callback(mode, type, file, line);
    453.   }

crypto/lock.c:452:9: Skipping __function_pointer__(): unresolved function pointer
    450.           }
    451.       } else if (locking_callback != NULL)
    452.           locking_callback(mode, type, file, line);
                   ^
    453.   }
    454.   

crypto/lock.c:440:5: 
    438.       }
    439.   #endif
    440. >     if (type < 0) {
    441.           if (dynlock_lock_callback != NULL) {
    442.               struct CRYPTO_dynlock_value *pointer

crypto/lock.c:453:1: return from a call to CRYPTO_lock
    451.       } else if (locking_callback != NULL)
    452.           locking_callback(mode, type, file, line);
    453. > }
    454.   
    455.   int CRYPTO_add_lock(int *pointer, int amount, int type, const char *file,

crypto/x509v3/pcy_cache.c:228:9: 
  226.       if (x->policy_cache == NULL) {
  227.           CRYPTO_w_lock(CRYPTO_LOCK_X509);
  228. >         policy_cache_new(x);
  229.           CRYPTO_w_unlock(CRYPTO_LOCK_X509);
  230.       }

crypto/x509v3/pcy_cache.c:122:1: start of procedure policy_cache_new()
    120.   }
    121.   
    122. > static int policy_cache_new(X509 *x)
    123.   {
    124.       X509_POLICY_CACHE *cache;

crypto/x509v3/pcy_cache.c:125:5: 
    123.   {
    124.       X509_POLICY_CACHE *cache;
    125. >     ASN1_INTEGER *ext_any = NULL;
    126.       POLICY_CONSTRAINTS *ext_pcons = NULL;
    127.       CERTIFICATEPOLICIES *ext_cpols = NULL;

crypto/x509v3/pcy_cache.c:126:5: 
    124.       X509_POLICY_CACHE *cache;
    125.       ASN1_INTEGER *ext_any = NULL;
    126. >     POLICY_CONSTRAINTS *ext_pcons = NULL;
    127.       CERTIFICATEPOLICIES *ext_cpols = NULL;
    128.       POLICY_MAPPINGS *ext_pmaps = NULL;

crypto/x509v3/pcy_cache.c:127:5: 
    125.       ASN1_INTEGER *ext_any = NULL;
    126.       POLICY_CONSTRAINTS *ext_pcons = NULL;
    127. >     CERTIFICATEPOLICIES *ext_cpols = NULL;
    128.       POLICY_MAPPINGS *ext_pmaps = NULL;
    129.       int i;

crypto/x509v3/pcy_cache.c:128:5: 
    126.       POLICY_CONSTRAINTS *ext_pcons = NULL;
    127.       CERTIFICATEPOLICIES *ext_cpols = NULL;
    128. >     POLICY_MAPPINGS *ext_pmaps = NULL;
    129.       int i;
    130.       cache = OPENSSL_malloc(sizeof(*cache));

crypto/x509v3/pcy_cache.c:130:5: 
    128.       POLICY_MAPPINGS *ext_pmaps = NULL;
    129.       int i;
    130. >     cache = OPENSSL_malloc(sizeof(*cache));
    131.       if (cache == NULL)
    132.           return 0;

crypto/mem.c:119:1: start of procedure CRYPTO_malloc()
      117.   }
      118.   
      119. > void *CRYPTO_malloc(size_t num, const char *file, int line)
      120.   {
      121.       void *ret = NULL;

crypto/mem.c:121:5: 
      119.   void *CRYPTO_malloc(size_t num, const char *file, int line)
      120.   {
      121. >     void *ret = NULL;
      122.   
      123.       if (num <= 0)

crypto/mem.c:123:9: Taking false branch
      121.       void *ret = NULL;
      122.   
      123.       if (num <= 0)
                     ^
      124.           return NULL;
      125.   

crypto/mem.c:126:5: 
      124.           return NULL;
      125.   
      126. >     allow_customize = 0;
      127.   #ifndef OPENSSL_NO_CRYPTO_MDEBUG
      128.       if (call_malloc_debug) {

crypto/mem.c:136:5: 
      134.       }
      135.   #else
      136. >     (void)file;
      137.       (void)line;
      138.       ret = malloc(num);

crypto/mem.c:137:5: 
      135.   #else
      136.       (void)file;
      137. >     (void)line;
      138.       ret = malloc(num);
      139.   #endif

crypto/mem.c:138:5: 
      136.       (void)file;
      137.       (void)line;
      138. >     ret = malloc(num);
      139.   #endif
      140.   

crypto/mem.c:153:5: 
      151.   #endif
      152.   
      153. >     return ret;
      154.   }
      155.   

crypto/mem.c:154:1: return from a call to CRYPTO_malloc
      152.   
      153.       return ret;
      154. > }
      155.   
      156.   void *CRYPTO_zalloc(size_t num, const char *file, int line)

crypto/x509v3/pcy_cache.c:131:9: Taking true branch
    129.       int i;
    130.       cache = OPENSSL_malloc(sizeof(*cache));
    131.       if (cache == NULL)
                   ^
    132.           return 0;
    133.       cache->anyPolicy = NULL;

crypto/x509v3/pcy_cache.c:132:9: 
    130.       cache = OPENSSL_malloc(sizeof(*cache));
    131.       if (cache == NULL)
    132. >         return 0;
    133.       cache->anyPolicy = NULL;
    134.       cache->data = NULL;

crypto/x509v3/pcy_cache.c:212:1: return from a call to policy_cache_new
    210.       return 1;
    211.   
    212. > }
    213.   
    214.   void policy_cache_free(X509_POLICY_CACHE *cache)

crypto/x509v3/pcy_cache.c:229:9: 
  227.           CRYPTO_w_lock(CRYPTO_LOCK_X509);
  228.           policy_cache_new(x);
  229. >         CRYPTO_w_unlock(CRYPTO_LOCK_X509);
  230.       }
  231.   

crypto/lock.c:413:1: start of procedure CRYPTO_lock()
    411.   }
    412.   
    413. > void CRYPTO_lock(int mode, int type, const char *file, int line)
    414.   {
    415.   #ifdef LOCK_DEBUG

crypto/lock.c:440:9: Taking false branch
    438.       }
    439.   #endif
    440.       if (type < 0) {
                   ^
    441.           if (dynlock_lock_callback != NULL) {
    442.               struct CRYPTO_dynlock_value *pointer

crypto/lock.c:451:16: Taking true branch
    449.               CRYPTO_destroy_dynlockid(type);
    450.           }
    451.       } else if (locking_callback != NULL)
                          ^
    452.           locking_callback(mode, type, file, line);
    453.   }

crypto/lock.c:452:9: Skipping __function_pointer__(): unresolved function pointer
    450.           }
    451.       } else if (locking_callback != NULL)
    452.           locking_callback(mode, type, file, line);
                   ^
    453.   }
    454.   

crypto/lock.c:440:5: 
    438.       }
    439.   #endif
    440. >     if (type < 0) {
    441.           if (dynlock_lock_callback != NULL) {
    442.               struct CRYPTO_dynlock_value *pointer

crypto/lock.c:453:1: return from a call to CRYPTO_lock
    451.       } else if (locking_callback != NULL)
    452.           locking_callback(mode, type, file, line);
    453. > }
    454.   
    455.   int CRYPTO_add_lock(int *pointer, int amount, int type, const char *file,

crypto/x509v3/pcy_cache.c:232:5: 
  230.       }
  231.   
  232. >     return x->policy_cache;
  233.   
  234.   }

crypto/x509v3/pcy_cache.c:234:1: return from a call to policy_cache_set
  232.       return x->policy_cache;
  233.   
  234. > }
  235.   
  236.   X509_POLICY_DATA *policy_cache_find_data(const X509_POLICY_CACHE *cache,

crypto/x509v3/pcy_tree.c:612:14: 
610.       for (i = 1; i < tree->nlevel; i++, curr++) {
611.           cache = policy_cache_set(curr->cert);
612. >         if (!tree_link_nodes(curr, cache))
613.               return 0;
614.   

crypto/x509v3/pcy_tree.c:319:1: start of procedure tree_link_nodes()
  317.    */
  318.   
  319. > static int tree_link_nodes(X509_POLICY_LEVEL *curr,
  320.                              const X509_POLICY_CACHE *cache)
  321.   {

crypto/x509v3/pcy_tree.c:325:10: 
  323.       X509_POLICY_DATA *data;
  324.   
  325. >     for (i = 0; i < sk_X509_POLICY_DATA_num(cache->data); i++) {
  326.           data = sk_X509_POLICY_DATA_value(cache->data, i);
  327.           /* Look for matching nodes in previous level */

crypto/x509v3/pcy_tree.c:325:17: 
  323.       X509_POLICY_DATA *data;
  324.   
  325. >     for (i = 0; i < sk_X509_POLICY_DATA_num(cache->data); i++) {
  326.           data = sk_X509_POLICY_DATA_value(cache->data, i);
  327.           /* Look for matching nodes in previous level */

static int tree_evaluate(X509_POLICY_TREE *tree)
{
    int ret, i;
    X509_POLICY_LEVEL *curr = tree->levels + 1;
    const X509_POLICY_CACHE *cache;
    for (i = 1; i < tree->nlevel; i++, curr++) {
        cache = policy_cache_set(curr->cert);
        if (!tree_link_nodes(curr, cache))
            return 0;
        if (!(curr->flags & X509_V_FLAG_INHIBIT_ANY)
            && !tree_link_any(curr, cache, tree))
            return 0;
        tree_print("before tree_prune()", tree, curr);
        ret = tree_prune(tree, curr);
        if (ret != 1)
            return ret;
    }
    return 1;
}
['static int tree_evaluate(X509_POLICY_TREE *tree)\n{\n    int ret, i;\n    X509_POLICY_LEVEL *curr = tree->levels + 1;\n    const X509_POLICY_CACHE *cache;\n    for (i = 1; i < tree->nlevel; i++, curr++) {\n        cache = policy_cache_set(curr->cert);\n        if (!tree_link_nodes(curr, cache))\n            return 0;\n        if (!(curr->flags & X509_V_FLAG_INHIBIT_ANY)\n            && !tree_link_any(curr, cache, tree))\n            return 0;\n        tree_print("before tree_prune()", tree, curr);\n        ret = tree_prune(tree, curr);\n        if (ret != 1)\n            return ret;\n    }\n    return 1;\n}', 'const X509_POLICY_CACHE *policy_cache_set(X509 *x)\n{\n    if (x->policy_cache == NULL) {\n        CRYPTO_w_lock(CRYPTO_LOCK_X509);\n        policy_cache_new(x);\n        CRYPTO_w_unlock(CRYPTO_LOCK_X509);\n    }\n    return x->policy_cache;\n}', 'void CRYPTO_lock(int mode, int type, const char *file, int line)\n{\n#ifdef LOCK_DEBUG\n    {\n        CRYPTO_THREADID id;\n        char *rw_text, *operation_text;\n        if (mode & CRYPTO_LOCK)\n            operation_text = "lock  ";\n        else if (mode & CRYPTO_UNLOCK)\n            operation_text = "unlock";\n        else\n            operation_text = "ERROR ";\n        if (mode & CRYPTO_READ)\n            rw_text = "r";\n        else if (mode & CRYPTO_WRITE)\n            rw_text = "w";\n        else\n            rw_text = "ERROR";\n        CRYPTO_THREADID_current(&id);\n        fprintf(stderr, "lock:%08lx:(%s)%s %-18s %s:%d\\n",\n                CRYPTO_THREADID_hash(&id), rw_text, operation_text,\n                CRYPTO_get_lock_name(type), file, line);\n    }\n#endif\n    if (type < 0) {\n        if (dynlock_lock_callback != NULL) {\n            struct CRYPTO_dynlock_value *pointer\n                = CRYPTO_get_dynlock_value(type);\n            OPENSSL_assert(pointer != NULL);\n            dynlock_lock_callback(mode, pointer, file, line);\n            CRYPTO_destroy_dynlockid(type);\n        }\n    } else if (locking_callback != NULL)\n        locking_callback(mode, type, file, line);\n}', 'static int policy_cache_new(X509 *x)\n{\n    X509_POLICY_CACHE *cache;\n    ASN1_INTEGER *ext_any = NULL;\n    POLICY_CONSTRAINTS *ext_pcons = NULL;\n    CERTIFICATEPOLICIES *ext_cpols = NULL;\n    POLICY_MAPPINGS *ext_pmaps = NULL;\n    int i;\n    cache = OPENSSL_malloc(sizeof(*cache));\n    if (cache == NULL)\n        return 0;\n    cache->anyPolicy = NULL;\n    cache->data = NULL;\n    cache->any_skip = -1;\n    cache->explicit_skip = -1;\n    cache->map_skip = -1;\n    x->policy_cache = cache;\n    ext_pcons = X509_get_ext_d2i(x, NID_policy_constraints, &i, NULL);\n    if (!ext_pcons) {\n        if (i != -1)\n            goto bad_cache;\n    } else {\n        if (!ext_pcons->requireExplicitPolicy\n            && !ext_pcons->inhibitPolicyMapping)\n            goto bad_cache;\n        if (!policy_cache_set_int(&cache->explicit_skip,\n                                  ext_pcons->requireExplicitPolicy))\n            goto bad_cache;\n        if (!policy_cache_set_int(&cache->map_skip,\n                                  ext_pcons->inhibitPolicyMapping))\n            goto bad_cache;\n    }\n    ext_cpols = X509_get_ext_d2i(x, NID_certificate_policies, &i, NULL);\n    if (!ext_cpols) {\n        if (i != -1)\n            goto bad_cache;\n        return 1;\n    }\n    i = policy_cache_create(x, ext_cpols, i);\n    if (i <= 0)\n        return i;\n    ext_pmaps = X509_get_ext_d2i(x, NID_policy_mappings, &i, NULL);\n    if (!ext_pmaps) {\n        if (i != -1)\n            goto bad_cache;\n    } else {\n        i = policy_cache_set_mapping(x, ext_pmaps);\n        if (i <= 0)\n            goto bad_cache;\n    }\n    ext_any = X509_get_ext_d2i(x, NID_inhibit_any_policy, &i, NULL);\n    if (!ext_any) {\n        if (i != -1)\n            goto bad_cache;\n    } else if (!policy_cache_set_int(&cache->any_skip, ext_any))\n        goto bad_cache;\n    goto just_cleanup;\n bad_cache:\n    x->ex_flags |= EXFLAG_INVALID_POLICY;\n just_cleanup:\n    POLICY_CONSTRAINTS_free(ext_pcons);\n    ASN1_INTEGER_free(ext_any);\n    return 1;\n}', 'void *CRYPTO_malloc(size_t num, const char *file, int line)\n{\n    void *ret = NULL;\n    if (num <= 0)\n        return NULL;\n    allow_customize = 0;\n#ifndef OPENSSL_NO_CRYPTO_MDEBUG\n    if (call_malloc_debug) {\n        CRYPTO_mem_debug_malloc(NULL, num, 0, file, line);\n        ret = malloc(num);\n        CRYPTO_mem_debug_malloc(ret, num, 1, file, line);\n    } else {\n        ret = malloc(num);\n    }\n#else\n    (void)file;\n    (void)line;\n    ret = malloc(num);\n#endif\n#ifndef OPENSSL_CPUID_OBJ\n    if (ret && (num > 2048)) {\n        extern unsigned char cleanse_ctr;\n        ((unsigned char *)ret)[0] = cleanse_ctr;\n    }\n#endif\n    return ret;\n}', 'static int tree_link_nodes(X509_POLICY_LEVEL *curr,\n                           const X509_POLICY_CACHE *cache)\n{\n    int i;\n    X509_POLICY_DATA *data;\n    for (i = 0; i < sk_X509_POLICY_DATA_num(cache->data); i++) {\n        data = sk_X509_POLICY_DATA_value(cache->data, i);\n        if (!tree_link_matching_nodes(curr, data))\n            return 0;\n    }\n    return 1;\n}']