crypto/x509/x509_lu.c:651: error: NULL_DEREFERENCE
  pointer `pobj` last assigned on line 649 could be null and is dereferenced at line 651, column 17.
Showing all 44 steps of the trace


crypto/x509/x509_lu.c:612:1: start of procedure X509_STORE_CTX_get1_issuer()
610.    * -1 some other error.
611.    */
612. > int X509_STORE_CTX_get1_issuer(X509 **issuer, X509_STORE_CTX *ctx, X509 *x)
613.   {
614.       X509_NAME *xn;

crypto/x509/x509_lu.c:617:5: 
615.       X509_OBJECT obj, *pobj;
616.       int i, ok, idx, ret;
617. >     *issuer = NULL;
618.       xn = X509_get_issuer_name(x);
619.       ok = X509_STORE_get_by_subject(ctx, X509_LU_X509, xn, &obj);

crypto/x509/x509_lu.c:618:5: 
616.       int i, ok, idx, ret;
617.       *issuer = NULL;
618. >     xn = X509_get_issuer_name(x);
619.       ok = X509_STORE_get_by_subject(ctx, X509_LU_X509, xn, &obj);
620.       if (ok != X509_LU_X509) {

crypto/x509/x509_cmp.c:130:1: start of procedure X509_get_issuer_name()
  128.   }
  129.   
  130. > X509_NAME *X509_get_issuer_name(X509 *a)
  131.   {
  132.       return (a->cert_info->issuer);

crypto/x509/x509_cmp.c:132:5: 
  130.   X509_NAME *X509_get_issuer_name(X509 *a)
  131.   {
  132. >     return (a->cert_info->issuer);
  133.   }
  134.   

crypto/x509/x509_cmp.c:133:1: return from a call to X509_get_issuer_name
  131.   {
  132.       return (a->cert_info->issuer);
  133. > }
  134.   
  135.   unsigned long X509_issuer_name_hash(X509 *x)

crypto/x509/x509_lu.c:619:5: Skipping X509_STORE_get_by_subject(): empty list of specs
617.       *issuer = NULL;
618.       xn = X509_get_issuer_name(x);
619.       ok = X509_STORE_get_by_subject(ctx, X509_LU_X509, xn, &obj);
           ^
620.       if (ok != X509_LU_X509) {
621.           if (ok == X509_LU_RETRY) {

crypto/x509/x509_lu.c:620:9: Taking false branch
618.       xn = X509_get_issuer_name(x);
619.       ok = X509_STORE_get_by_subject(ctx, X509_LU_X509, xn, &obj);
620.       if (ok != X509_LU_X509) {
               ^
621.           if (ok == X509_LU_RETRY) {
622.               X509_OBJECT_free_contents(&obj);

crypto/x509/x509_lu.c:633:9: Taking false branch
631.       }
632.       /* If certificate matches all OK */
633.       if (ctx->check_issued(ctx, x, obj.data.x509)) {
               ^
634.           if (x509_check_cert_time(ctx, obj.data.x509, 1)) {
635.               *issuer = obj.data.x509;

crypto/x509/x509_lu.c:639:5: 
637.           }
638.       }
639. >     X509_OBJECT_free_contents(&obj);
640.   
641.       /* Else find index of first cert accepted by 'check_issued' */

crypto/x509/x509_lu.c:414:1: start of procedure X509_OBJECT_free_contents()
  412.   }
  413.   
  414. > void X509_OBJECT_free_contents(X509_OBJECT *a)
  415.   {
  416.       switch (a->type) {

crypto/x509/x509_lu.c:416:5: 
  414.   void X509_OBJECT_free_contents(X509_OBJECT *a)
  415.   {
  416. >     switch (a->type) {
  417.       case X509_LU_X509:
  418.           X509_free(a->data.x509);

crypto/x509/x509_lu.c:417:5: Switch condition is false. Skipping switch case
  415.   {
  416.       switch (a->type) {
  417.       case X509_LU_X509:
             ^
  418.           X509_free(a->data.x509);
  419.           break;

crypto/x509/x509_lu.c:420:5: Switch condition is false. Skipping switch case
  418.           X509_free(a->data.x509);
  419.           break;
  420.       case X509_LU_CRL:
             ^
  421.           X509_CRL_free(a->data.crl);
  422.           break;

crypto/x509/x509_lu.c:424:1: return from a call to X509_OBJECT_free_contents
  422.           break;
  423.       }
  424. > }
  425.   
  426.   static int x509_object_idx_cnt(STACK_OF(X509_OBJECT) *h, int type,

crypto/x509/x509_lu.c:642:5: 
640.   
641.       /* Else find index of first cert accepted by 'check_issued' */
642. >     ret = 0;
643.       CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);
644.       idx = X509_OBJECT_idx_by_subject(ctx->ctx->objs, X509_LU_X509, xn);

crypto/x509/x509_lu.c:643:5: 
641.       /* Else find index of first cert accepted by 'check_issued' */
642.       ret = 0;
643. >     CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);
644.       idx = X509_OBJECT_idx_by_subject(ctx->ctx->objs, X509_LU_X509, xn);
645.       if (idx != -1) {            /* should be true as we've had at least one

crypto/lock.c:417:1: start of procedure CRYPTO_lock()
  415.   }
  416.   
  417. > void CRYPTO_lock(int mode, int type, const char *file, int line)
  418.   {
  419.   #ifdef LOCK_DEBUG

crypto/lock.c:444:9: Taking false branch
  442.       }
  443.   #endif
  444.       if (type < 0) {
                 ^
  445.           if (dynlock_lock_callback != NULL) {
  446.               struct CRYPTO_dynlock_value *pointer

crypto/lock.c:455:16: Taking true branch
  453.               CRYPTO_destroy_dynlockid(type);
  454.           }
  455.       } else if (locking_callback != NULL)
                        ^
  456.           locking_callback(mode, type, file, line);
  457.   }

crypto/lock.c:456:9: Skipping __function_pointer__(): unresolved function pointer
  454.           }
  455.       } else if (locking_callback != NULL)
  456.           locking_callback(mode, type, file, line);
                 ^
  457.   }
  458.   

crypto/lock.c:444:5: 
  442.       }
  443.   #endif
  444. >     if (type < 0) {
  445.           if (dynlock_lock_callback != NULL) {
  446.               struct CRYPTO_dynlock_value *pointer

crypto/lock.c:457:1: return from a call to CRYPTO_lock
  455.       } else if (locking_callback != NULL)
  456.           locking_callback(mode, type, file, line);
  457. > }
  458.   
  459.   int CRYPTO_add_lock(int *pointer, int amount, int type, const char *file,

crypto/x509/x509_lu.c:644:5: 
642.       ret = 0;
643.       CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);
644. >     idx = X509_OBJECT_idx_by_subject(ctx->ctx->objs, X509_LU_X509, xn);
645.       if (idx != -1) {            /* should be true as we've had at least one
646.                                    * match */

crypto/x509/x509_lu.c:469:1: start of procedure X509_OBJECT_idx_by_subject()
  467.   }
  468.   
  469. > int X509_OBJECT_idx_by_subject(STACK_OF(X509_OBJECT) *h, int type,
  470.                                  X509_NAME *name)
  471.   {

crypto/x509/x509_lu.c:472:5: Skipping x509_object_idx_cnt(): empty list of specs
  470.                                  X509_NAME *name)
  471.   {
  472.       return x509_object_idx_cnt(h, type, name, NULL);
             ^
  473.   }
  474.   

crypto/x509/x509_lu.c:473:1: return from a call to X509_OBJECT_idx_by_subject
  471.   {
  472.       return x509_object_idx_cnt(h, type, name, NULL);
  473. > }
  474.   
  475.   X509_OBJECT *X509_OBJECT_retrieve_by_subject(STACK_OF(X509_OBJECT) *h,

crypto/x509/x509_lu.c:645:9: Taking true branch
643.       CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);
644.       idx = X509_OBJECT_idx_by_subject(ctx->ctx->objs, X509_LU_X509, xn);
645.       if (idx != -1) {            /* should be true as we've had at least one
               ^
646.                                    * match */
647.           /* Look through all matching certs for suitable issuer */

crypto/x509/x509_lu.c:648:14: 
646.                                    * match */
647.           /* Look through all matching certs for suitable issuer */
648. >         for (i = idx; i < sk_X509_OBJECT_num(ctx->ctx->objs); i++) {
649.               pobj = sk_X509_OBJECT_value(ctx->ctx->objs, i);
650.               /* See if we've run past the matches */

crypto/x509/x509_lu.c:648:27: Condition is true
646.                                    * match */
647.           /* Look through all matching certs for suitable issuer */
648.           for (i = idx; i < sk_X509_OBJECT_num(ctx->ctx->objs); i++) {
                                 ^
649.               pobj = sk_X509_OBJECT_value(ctx->ctx->objs, i);
650.               /* See if we've run past the matches */

crypto/x509/x509_lu.c:648:23: 
646.                                    * match */
647.           /* Look through all matching certs for suitable issuer */
648. >         for (i = idx; i < sk_X509_OBJECT_num(ctx->ctx->objs); i++) {
649.               pobj = sk_X509_OBJECT_value(ctx->ctx->objs, i);
650.               /* See if we've run past the matches */

crypto/stack/stack.c:319:1: start of procedure sk_num()
  317.   }
  318.   
  319. > int sk_num(const _STACK *st)
  320.   {
  321.       if (st == NULL)

crypto/stack/stack.c:321:9: Taking false branch
  319.   int sk_num(const _STACK *st)
  320.   {
  321.       if (st == NULL)
                 ^
  322.           return -1;
  323.       return st->num;

crypto/stack/stack.c:323:5: 
  321.       if (st == NULL)
  322.           return -1;
  323. >     return st->num;
  324.   }
  325.   

crypto/stack/stack.c:324:1: return from a call to sk_num
  322.           return -1;
  323.       return st->num;
  324. > }
  325.   
  326.   void *sk_value(const _STACK *st, int i)

crypto/x509/x509_lu.c:648:23: Loop condition is true. Entering loop body
646.                                    * match */
647.           /* Look through all matching certs for suitable issuer */
648.           for (i = idx; i < sk_X509_OBJECT_num(ctx->ctx->objs); i++) {
                             ^
649.               pobj = sk_X509_OBJECT_value(ctx->ctx->objs, i);
650.               /* See if we've run past the matches */

crypto/x509/x509_lu.c:649:20: Condition is true
647.           /* Look through all matching certs for suitable issuer */
648.           for (i = idx; i < sk_X509_OBJECT_num(ctx->ctx->objs); i++) {
649.               pobj = sk_X509_OBJECT_value(ctx->ctx->objs, i);
                          ^
650.               /* See if we've run past the matches */
651.               if (pobj->type != X509_LU_X509)

crypto/x509/x509_lu.c:649:13: 
647.           /* Look through all matching certs for suitable issuer */
648.           for (i = idx; i < sk_X509_OBJECT_num(ctx->ctx->objs); i++) {
649. >             pobj = sk_X509_OBJECT_value(ctx->ctx->objs, i);
650.               /* See if we've run past the matches */
651.               if (pobj->type != X509_LU_X509)

crypto/stack/stack.c:326:1: start of procedure sk_value()
  324.   }
  325.   
  326. > void *sk_value(const _STACK *st, int i)
  327.   {
  328.       if (!st || (i < 0) || (i >= st->num))

crypto/stack/stack.c:328:10: Taking false branch
  326.   void *sk_value(const _STACK *st, int i)
  327.   {
  328.       if (!st || (i < 0) || (i >= st->num))
                  ^
  329.           return NULL;
  330.       return st->data[i];

crypto/stack/stack.c:328:17: Taking true branch
  326.   void *sk_value(const _STACK *st, int i)
  327.   {
  328.       if (!st || (i < 0) || (i >= st->num))
                         ^
  329.           return NULL;
  330.       return st->data[i];

crypto/stack/stack.c:329:9: 
  327.   {
  328.       if (!st || (i < 0) || (i >= st->num))
  329. >         return NULL;
  330.       return st->data[i];
  331.   }

crypto/stack/stack.c:331:1: return from a call to sk_value
  329.           return NULL;
  330.       return st->data[i];
  331. > }
  332.   
  333.   void *sk_set(_STACK *st, int i, void *value)

crypto/x509/x509_lu.c:651:17: 
649.               pobj = sk_X509_OBJECT_value(ctx->ctx->objs, i);
650.               /* See if we've run past the matches */
651. >             if (pobj->type != X509_LU_X509)
652.                   break;
653.               if (X509_NAME_cmp(xn, X509_get_subject_name(pobj->data.x509)))

int X509_STORE_CTX_get1_issuer(X509 **issuer, X509_STORE_CTX *ctx, X509 *x)
{
    X509_NAME *xn;
    X509_OBJECT obj, *pobj;
    int i, ok, idx, ret;
    *issuer = NULL;
    xn = X509_get_issuer_name(x);
    ok = X509_STORE_get_by_subject(ctx, X509_LU_X509, xn, &obj);
    if (ok != X509_LU_X509) {
        if (ok == X509_LU_RETRY) {
            X509_OBJECT_free_contents(&obj);
            X509err(X509_F_X509_STORE_CTX_GET1_ISSUER, X509_R_SHOULD_RETRY);
            return -1;
        } else if (ok != X509_LU_FAIL) {
            X509_OBJECT_free_contents(&obj);
            return -1;
        }
        return 0;
    }
    if (ctx->check_issued(ctx, x, obj.data.x509)) {
        if (x509_check_cert_time(ctx, obj.data.x509, 1)) {
            *issuer = obj.data.x509;
            return 1;
        }
    }
    X509_OBJECT_free_contents(&obj);
    ret = 0;
    CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);
    idx = X509_OBJECT_idx_by_subject(ctx->ctx->objs, X509_LU_X509, xn);
    if (idx != -1) {
        for (i = idx; i < sk_X509_OBJECT_num(ctx->ctx->objs); i++) {
            pobj = sk_X509_OBJECT_value(ctx->ctx->objs, i);
            if (pobj->type != X509_LU_X509)
                break;
            if (X509_NAME_cmp(xn, X509_get_subject_name(pobj->data.x509)))
                break;
            if (ctx->check_issued(ctx, x, pobj->data.x509)) {
                *issuer = pobj->data.x509;
                ret = 1;
                if (x509_check_cert_time(ctx, *issuer, 1))
                    break;
            }
        }
    }
    CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
    if (*issuer)
        CRYPTO_add(&(*issuer)->references, 1, CRYPTO_LOCK_X509);
    return ret;
}
['int X509_STORE_CTX_get1_issuer(X509 **issuer, X509_STORE_CTX *ctx, X509 *x)\n{\n    X509_NAME *xn;\n    X509_OBJECT obj, *pobj;\n    int i, ok, idx, ret;\n    *issuer = NULL;\n    xn = X509_get_issuer_name(x);\n    ok = X509_STORE_get_by_subject(ctx, X509_LU_X509, xn, &obj);\n    if (ok != X509_LU_X509) {\n        if (ok == X509_LU_RETRY) {\n            X509_OBJECT_free_contents(&obj);\n            X509err(X509_F_X509_STORE_CTX_GET1_ISSUER, X509_R_SHOULD_RETRY);\n            return -1;\n        } else if (ok != X509_LU_FAIL) {\n            X509_OBJECT_free_contents(&obj);\n            return -1;\n        }\n        return 0;\n    }\n    if (ctx->check_issued(ctx, x, obj.data.x509)) {\n        if (x509_check_cert_time(ctx, obj.data.x509, 1)) {\n            *issuer = obj.data.x509;\n            return 1;\n        }\n    }\n    X509_OBJECT_free_contents(&obj);\n    ret = 0;\n    CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);\n    idx = X509_OBJECT_idx_by_subject(ctx->ctx->objs, X509_LU_X509, xn);\n    if (idx != -1) {\n        for (i = idx; i < sk_X509_OBJECT_num(ctx->ctx->objs); i++) {\n            pobj = sk_X509_OBJECT_value(ctx->ctx->objs, i);\n            if (pobj->type != X509_LU_X509)\n                break;\n            if (X509_NAME_cmp(xn, X509_get_subject_name(pobj->data.x509)))\n                break;\n            if (ctx->check_issued(ctx, x, pobj->data.x509)) {\n                *issuer = pobj->data.x509;\n                ret = 1;\n                if (x509_check_cert_time(ctx, *issuer, 1))\n                    break;\n            }\n        }\n    }\n    CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);\n    if (*issuer)\n        CRYPTO_add(&(*issuer)->references, 1, CRYPTO_LOCK_X509);\n    return ret;\n}', 'X509_NAME *X509_get_issuer_name(X509 *a)\n{\n    return (a->cert_info->issuer);\n}', 'void X509_OBJECT_free_contents(X509_OBJECT *a)\n{\n    switch (a->type) {\n    case X509_LU_X509:\n        X509_free(a->data.x509);\n        break;\n    case X509_LU_CRL:\n        X509_CRL_free(a->data.crl);\n        break;\n    }\n}', 'void CRYPTO_lock(int mode, int type, const char *file, int line)\n{\n#ifdef LOCK_DEBUG\n    {\n        CRYPTO_THREADID id;\n        char *rw_text, *operation_text;\n        if (mode & CRYPTO_LOCK)\n            operation_text = "lock  ";\n        else if (mode & CRYPTO_UNLOCK)\n            operation_text = "unlock";\n        else\n            operation_text = "ERROR ";\n        if (mode & CRYPTO_READ)\n            rw_text = "r";\n        else if (mode & CRYPTO_WRITE)\n            rw_text = "w";\n        else\n            rw_text = "ERROR";\n        CRYPTO_THREADID_current(&id);\n        fprintf(stderr, "lock:%08lx:(%s)%s %-18s %s:%d\\n",\n                CRYPTO_THREADID_hash(&id), rw_text, operation_text,\n                CRYPTO_get_lock_name(type), file, line);\n    }\n#endif\n    if (type < 0) {\n        if (dynlock_lock_callback != NULL) {\n            struct CRYPTO_dynlock_value *pointer\n                = CRYPTO_get_dynlock_value(type);\n            OPENSSL_assert(pointer != NULL);\n            dynlock_lock_callback(mode, pointer, file, line);\n            CRYPTO_destroy_dynlockid(type);\n        }\n    } else if (locking_callback != NULL)\n        locking_callback(mode, type, file, line);\n}', 'int X509_OBJECT_idx_by_subject(STACK_OF(X509_OBJECT) *h, int type,\n                               X509_NAME *name)\n{\n    return x509_object_idx_cnt(h, type, name, NULL);\n}', 'int sk_num(const _STACK *st)\n{\n    if (st == NULL)\n        return -1;\n    return st->num;\n}', 'void *sk_value(const _STACK *st, int i)\n{\n    if (!st || (i < 0) || (i >= st->num))\n        return NULL;\n    return st->data[i];\n}']