apps/ca.c:2144: error: NULL_DEREFERENCE
  pointer `null` is dereferenced by call to `X509_NAME_oneline()` at line 2144, column 15.
Showing all 27 steps of the trace


apps/ca.c:2136:1: start of procedure do_revoke()
2134.   }
2135.   
2136. > static int do_revoke(X509 *x509, TXT_DB *db)
2137.   {
2138.   	ASN1_UTCTIME *tm=NULL;

apps/ca.c:2138:2: 
2136.   static int do_revoke(X509 *x509, TXT_DB *db)
2137.   {
2138. > 	ASN1_UTCTIME *tm=NULL;
2139.   	char *row[DB_NUMBER],**rrow,**irow;
2140.   	int ok=-1,i;

apps/ca.c:2140:2: 
2138.   	ASN1_UTCTIME *tm=NULL;
2139.   	char *row[DB_NUMBER],**rrow,**irow;
2140. > 	int ok=-1,i;
2141.   
2142.   	for (i=0; i<DB_NUMBER; i++)

apps/ca.c:2142:7: 
2140.   	int ok=-1,i;
2141.   
2142. > 	for (i=0; i<DB_NUMBER; i++)
2143.   		row[i]=NULL;
2144.   	row[DB_name]=X509_NAME_oneline(x509->cert_info->subject,NULL,0);

apps/ca.c:2142:12: Loop condition is true. Entering loop body
2140.   	int ok=-1,i;
2141.   
2142.   	for (i=0; i<DB_NUMBER; i++)
                   ^
2143.   		row[i]=NULL;
2144.   	row[DB_name]=X509_NAME_oneline(x509->cert_info->subject,NULL,0);

apps/ca.c:2143:3: 
2141.   
2142.   	for (i=0; i<DB_NUMBER; i++)
2143. > 		row[i]=NULL;
2144.   	row[DB_name]=X509_NAME_oneline(x509->cert_info->subject,NULL,0);
2145.   	row[DB_serial]=BN_bn2hex(ASN1_INTEGER_to_BN(x509->cert_info->serialNumber,NULL));

apps/ca.c:2142:25: 
2140.   	int ok=-1,i;
2141.   
2142. > 	for (i=0; i<DB_NUMBER; i++)
2143.   		row[i]=NULL;
2144.   	row[DB_name]=X509_NAME_oneline(x509->cert_info->subject,NULL,0);

apps/ca.c:2142:12: Loop condition is true. Entering loop body
2140.   	int ok=-1,i;
2141.   
2142.   	for (i=0; i<DB_NUMBER; i++)
                   ^
2143.   		row[i]=NULL;
2144.   	row[DB_name]=X509_NAME_oneline(x509->cert_info->subject,NULL,0);

apps/ca.c:2143:3: 
2141.   
2142.   	for (i=0; i<DB_NUMBER; i++)
2143. > 		row[i]=NULL;
2144.   	row[DB_name]=X509_NAME_oneline(x509->cert_info->subject,NULL,0);
2145.   	row[DB_serial]=BN_bn2hex(ASN1_INTEGER_to_BN(x509->cert_info->serialNumber,NULL));

apps/ca.c:2142:25: 
2140.   	int ok=-1,i;
2141.   
2142. > 	for (i=0; i<DB_NUMBER; i++)
2143.   		row[i]=NULL;
2144.   	row[DB_name]=X509_NAME_oneline(x509->cert_info->subject,NULL,0);

apps/ca.c:2142:12: Loop condition is true. Entering loop body
2140.   	int ok=-1,i;
2141.   
2142.   	for (i=0; i<DB_NUMBER; i++)
                   ^
2143.   		row[i]=NULL;
2144.   	row[DB_name]=X509_NAME_oneline(x509->cert_info->subject,NULL,0);

apps/ca.c:2143:3: 
2141.   
2142.   	for (i=0; i<DB_NUMBER; i++)
2143. > 		row[i]=NULL;
2144.   	row[DB_name]=X509_NAME_oneline(x509->cert_info->subject,NULL,0);
2145.   	row[DB_serial]=BN_bn2hex(ASN1_INTEGER_to_BN(x509->cert_info->serialNumber,NULL));

apps/ca.c:2142:25: 
2140.   	int ok=-1,i;
2141.   
2142. > 	for (i=0; i<DB_NUMBER; i++)
2143.   		row[i]=NULL;
2144.   	row[DB_name]=X509_NAME_oneline(x509->cert_info->subject,NULL,0);

apps/ca.c:2142:12: Loop condition is true. Entering loop body
2140.   	int ok=-1,i;
2141.   
2142.   	for (i=0; i<DB_NUMBER; i++)
                   ^
2143.   		row[i]=NULL;
2144.   	row[DB_name]=X509_NAME_oneline(x509->cert_info->subject,NULL,0);

apps/ca.c:2143:3: 
2141.   
2142.   	for (i=0; i<DB_NUMBER; i++)
2143. > 		row[i]=NULL;
2144.   	row[DB_name]=X509_NAME_oneline(x509->cert_info->subject,NULL,0);
2145.   	row[DB_serial]=BN_bn2hex(ASN1_INTEGER_to_BN(x509->cert_info->serialNumber,NULL));

apps/ca.c:2142:25: 
2140.   	int ok=-1,i;
2141.   
2142. > 	for (i=0; i<DB_NUMBER; i++)
2143.   		row[i]=NULL;
2144.   	row[DB_name]=X509_NAME_oneline(x509->cert_info->subject,NULL,0);

apps/ca.c:2142:12: Loop condition is false. Leaving loop
2140.   	int ok=-1,i;
2141.   
2142.   	for (i=0; i<DB_NUMBER; i++)
                   ^
2143.   		row[i]=NULL;
2144.   	row[DB_name]=X509_NAME_oneline(x509->cert_info->subject,NULL,0);

apps/ca.c:2144:2: 
2142.   	for (i=0; i<DB_NUMBER; i++)
2143.   		row[i]=NULL;
2144. > 	row[DB_name]=X509_NAME_oneline(x509->cert_info->subject,NULL,0);
2145.   	row[DB_serial]=BN_bn2hex(ASN1_INTEGER_to_BN(x509->cert_info->serialNumber,NULL));
2146.   	if ((row[DB_name] == NULL) || (row[DB_serial] == NULL))

crypto/x509/x509_obj.c:66:1: start of procedure X509_NAME_oneline()
  64.   #include <openssl/buffer.h>
  65.   
  66. > char *X509_NAME_oneline(X509_NAME *a, char *buf, int len)
  67.   	{
  68.   	X509_NAME_ENTRY *ne;

crypto/x509/x509_obj.c:74:2: 
  72.   	char *p;
  73.   	unsigned char *q;
  74. > 	BUF_MEM *b=NULL;
  75.   	static char hex[17]="0123456789ABCDEF";
  76.   	int gs_doit[4];

crypto/x509/x509_obj.c:75:2: 
  73.   	unsigned char *q;
  74.   	BUF_MEM *b=NULL;
  75. > 	static char hex[17]="0123456789ABCDEF";
  76.   	int gs_doit[4];
  77.   	char tmp_buf[80];

crypto/x509/x509_obj.c:82:6: Taking false branch
  80.   #endif
  81.   
  82.   	if (buf == NULL)
             ^
  83.   		{
  84.   		if ((b=BUF_MEM_new()) == NULL) goto err;

crypto/x509/x509_obj.c:89:6: Taking true branch
  87.   		len=200;
  88.   		}
  89.   	if (a == NULL)
             ^
  90.   	    {
  91.   	    if(b)

crypto/x509/x509_obj.c:91:9: Taking false branch
  89.   	if (a == NULL)
  90.   	    {
  91.   	    if(b)
                ^
  92.   		{
  93.   		buf=b->data;

crypto/x509/x509_obj.c:96:6: 
  94.   		Free(b);
  95.   		}
  96. > 	    strncpy(buf,"NO X509_NAME",len);
  97.   	    return buf;
  98.   	    }

crypto/x509/x509_obj.c:97:6: 
  95.   		}
  96.   	    strncpy(buf,"NO X509_NAME",len);
  97. > 	    return buf;
  98.   	    }
  99.   

crypto/x509/x509_obj.c:222:2: return from a call to X509_NAME_oneline
  220.   	if (b != NULL) BUF_MEM_free(b);
  221.   	return(NULL);
  222.   	}
          ^
  223.   

static int do_revoke(X509 *x509, TXT_DB *db)
{
	ASN1_UTCTIME *tm=NULL;
	char *row[DB_NUMBER],**rrow,**irow;
	int ok=-1,i;
	for (i=0; i<DB_NUMBER; i++)
		row[i]=NULL;
	row[DB_name]=X509_NAME_oneline(x509->cert_info->subject,NULL,0);
	row[DB_serial]=BN_bn2hex(ASN1_INTEGER_to_BN(x509->cert_info->serialNumber,NULL));
	if ((row[DB_name] == NULL) || (row[DB_serial] == NULL))
		{
		BIO_printf(bio_err,"Malloc failure\n");
		goto err;
		}
	rrow=TXT_DB_get_by_index(db,DB_name,row);
	if (rrow == NULL)
		{
		BIO_printf(bio_err,"Adding Entry to DB for %s\n", row[DB_name]);
		row[DB_type]=(char *)Malloc(2);
		tm=X509_get_notAfter(x509);
		row[DB_exp_date]=(char *)Malloc(tm->length+1);
		memcpy(row[DB_exp_date],tm->data,tm->length);
		row[DB_exp_date][tm->length]='\0';
		row[DB_rev_date]=NULL;
		row[DB_file]=(char *)Malloc(8);
		if ((row[DB_type] == NULL) || (row[DB_exp_date] == NULL) ||
			(row[DB_file] == NULL))
			{
			BIO_printf(bio_err,"Malloc failure\n");
			goto err;
			}
		strcpy(row[DB_file],"unknown");
		row[DB_type][0]='V';
		row[DB_type][1]='\0';
		if ((irow=(char **)Malloc(sizeof(char *)*(DB_NUMBER+1))) == NULL)
			{
			BIO_printf(bio_err,"Malloc failure\n");
			goto err;
			}
		for (i=0; i<DB_NUMBER; i++)
			{
			irow[i]=row[i];
			row[i]=NULL;
			}
		irow[DB_NUMBER]=NULL;
		if (!TXT_DB_insert(db,irow))
			{
			BIO_printf(bio_err,"failed to update database\n");
			BIO_printf(bio_err,"TXT_DB error number %ld\n",db->error);
			goto err;
			}
		do_revoke(x509,db);
		ok=1;
		goto err;
		}
	else if (index_serial_cmp(row,rrow))
		{
		BIO_printf(bio_err,"ERROR:no same serial number %s\n",
			   row[DB_serial]);
		goto err;
		}
	else if (rrow[DB_type][0]=='R')
		{
		BIO_printf(bio_err,"ERROR:Already revoked, serial number %s\n",
			   row[DB_serial]);
		goto err;
		}
	else
		{
		BIO_printf(bio_err,"Revoking Certificate %s.\n", rrow[DB_serial]);
		tm=X509_gmtime_adj(tm,0);
		rrow[DB_type][0]='R';
		rrow[DB_type][1]='\0';
		rrow[DB_rev_date]=(char *)Malloc(tm->length+1);
		memcpy(rrow[DB_rev_date],tm->data,tm->length);
		rrow[DB_rev_date][tm->length]='\0';
		}
	ok=1;
err:
	for (i=0; i<DB_NUMBER; i++)
		{
		if (row[i] != NULL)
			Free(row[i]);
		}
	ASN1_UTCTIME_free(tm);
	return(ok);
}
['static int do_revoke(X509 *x509, TXT_DB *db)\n{\n\tASN1_UTCTIME *tm=NULL;\n\tchar *row[DB_NUMBER],**rrow,**irow;\n\tint ok=-1,i;\n\tfor (i=0; i<DB_NUMBER; i++)\n\t\trow[i]=NULL;\n\trow[DB_name]=X509_NAME_oneline(x509->cert_info->subject,NULL,0);\n\trow[DB_serial]=BN_bn2hex(ASN1_INTEGER_to_BN(x509->cert_info->serialNumber,NULL));\n\tif ((row[DB_name] == NULL) || (row[DB_serial] == NULL))\n\t\t{\n\t\tBIO_printf(bio_err,"Malloc failure\\n");\n\t\tgoto err;\n\t\t}\n\trrow=TXT_DB_get_by_index(db,DB_name,row);\n\tif (rrow == NULL)\n\t\t{\n\t\tBIO_printf(bio_err,"Adding Entry to DB for %s\\n", row[DB_name]);\n\t\trow[DB_type]=(char *)Malloc(2);\n\t\ttm=X509_get_notAfter(x509);\n\t\trow[DB_exp_date]=(char *)Malloc(tm->length+1);\n\t\tmemcpy(row[DB_exp_date],tm->data,tm->length);\n\t\trow[DB_exp_date][tm->length]=\'\\0\';\n\t\trow[DB_rev_date]=NULL;\n\t\trow[DB_file]=(char *)Malloc(8);\n\t\tif ((row[DB_type] == NULL) || (row[DB_exp_date] == NULL) ||\n\t\t\t(row[DB_file] == NULL))\n\t\t\t{\n\t\t\tBIO_printf(bio_err,"Malloc failure\\n");\n\t\t\tgoto err;\n\t\t\t}\n\t\tstrcpy(row[DB_file],"unknown");\n\t\trow[DB_type][0]=\'V\';\n\t\trow[DB_type][1]=\'\\0\';\n\t\tif ((irow=(char **)Malloc(sizeof(char *)*(DB_NUMBER+1))) == NULL)\n\t\t\t{\n\t\t\tBIO_printf(bio_err,"Malloc failure\\n");\n\t\t\tgoto err;\n\t\t\t}\n\t\tfor (i=0; i<DB_NUMBER; i++)\n\t\t\t{\n\t\t\tirow[i]=row[i];\n\t\t\trow[i]=NULL;\n\t\t\t}\n\t\tirow[DB_NUMBER]=NULL;\n\t\tif (!TXT_DB_insert(db,irow))\n\t\t\t{\n\t\t\tBIO_printf(bio_err,"failed to update database\\n");\n\t\t\tBIO_printf(bio_err,"TXT_DB error number %ld\\n",db->error);\n\t\t\tgoto err;\n\t\t\t}\n\t\tdo_revoke(x509,db);\n\t\tok=1;\n\t\tgoto err;\n\t\t}\n\telse if (index_serial_cmp(row,rrow))\n\t\t{\n\t\tBIO_printf(bio_err,"ERROR:no same serial number %s\\n",\n\t\t\t   row[DB_serial]);\n\t\tgoto err;\n\t\t}\n\telse if (rrow[DB_type][0]==\'R\')\n\t\t{\n\t\tBIO_printf(bio_err,"ERROR:Already revoked, serial number %s\\n",\n\t\t\t   row[DB_serial]);\n\t\tgoto err;\n\t\t}\n\telse\n\t\t{\n\t\tBIO_printf(bio_err,"Revoking Certificate %s.\\n", rrow[DB_serial]);\n\t\ttm=X509_gmtime_adj(tm,0);\n\t\trrow[DB_type][0]=\'R\';\n\t\trrow[DB_type][1]=\'\\0\';\n\t\trrow[DB_rev_date]=(char *)Malloc(tm->length+1);\n\t\tmemcpy(rrow[DB_rev_date],tm->data,tm->length);\n\t\trrow[DB_rev_date][tm->length]=\'\\0\';\n\t\t}\n\tok=1;\nerr:\n\tfor (i=0; i<DB_NUMBER; i++)\n\t\t{\n\t\tif (row[i] != NULL)\n\t\t\tFree(row[i]);\n\t\t}\n\tASN1_UTCTIME_free(tm);\n\treturn(ok);\n}', 'char *X509_NAME_oneline(X509_NAME *a, char *buf, int len)\n\t{\n\tX509_NAME_ENTRY *ne;\nint i;\n\tint n,lold,l,l1,l2,num,j,type;\n\tconst char *s;\n\tchar *p;\n\tunsigned char *q;\n\tBUF_MEM *b=NULL;\n\tstatic char hex[17]="0123456789ABCDEF";\n\tint gs_doit[4];\n\tchar tmp_buf[80];\n#ifdef CHARSET_EBCDIC\n\tchar ebcdic_buf[1024];\n#endif\n\tif (buf == NULL)\n\t\t{\n\t\tif ((b=BUF_MEM_new()) == NULL) goto err;\n\t\tif (!BUF_MEM_grow(b,200)) goto err;\n\t\tb->data[0]=\'\\0\';\n\t\tlen=200;\n\t\t}\n\tif (a == NULL)\n\t    {\n\t    if(b)\n\t\t{\n\t\tbuf=b->data;\n\t\tFree(b);\n\t\t}\n\t    strncpy(buf,"NO X509_NAME",len);\n\t    return buf;\n\t    }\n\tlen--;\n\tl=0;\n\tfor (i=0; i<sk_X509_NAME_ENTRY_num(a->entries); i++)\n\t\t{\n\t\tne=sk_X509_NAME_ENTRY_value(a->entries,i);\n\t\tn=OBJ_obj2nid(ne->object);\n\t\tif ((n == NID_undef) || ((s=OBJ_nid2sn(n)) == NULL))\n\t\t\t{\n\t\t\ti2t_ASN1_OBJECT(tmp_buf,sizeof(tmp_buf),ne->object);\n\t\t\ts=tmp_buf;\n\t\t\t}\n\t\tl1=strlen(s);\n\t\ttype=ne->value->type;\n\t\tnum=ne->value->length;\n\t\tq=ne->value->data;\n#ifdef CHARSET_EBCDIC\n                if (type == V_ASN1_GENERALSTRING ||\n\t\t    type == V_ASN1_VISIBLESTRING ||\n\t\t    type == V_ASN1_PRINTABLESTRING ||\n\t\t    type == V_ASN1_TELETEXSTRING ||\n\t\t    type == V_ASN1_VISIBLESTRING ||\n\t\t    type == V_ASN1_IA5STRING) {\n                        ascii2ebcdic(ebcdic_buf, q,\n\t\t\t\t     (num > sizeof ebcdic_buf)\n\t\t\t\t     ? sizeof ebcdic_buf : num);\n                        q=ebcdic_buf;\n\t\t}\n#endif\n\t\tif ((type == V_ASN1_GENERALSTRING) && ((num%4) == 0))\n\t\t\t{\n\t\t\tgs_doit[0]=gs_doit[1]=gs_doit[2]=gs_doit[3]=0;\n\t\t\tfor (j=0; j<num; j++)\n\t\t\t\tif (q[j] != 0) gs_doit[j&3]=1;\n\t\t\tif (gs_doit[0]|gs_doit[1]|gs_doit[2])\n\t\t\t\tgs_doit[0]=gs_doit[1]=gs_doit[2]=gs_doit[3]=1;\n\t\t\telse\n\t\t\t\t{\n\t\t\t\tgs_doit[0]=gs_doit[1]=gs_doit[2]=0;\n\t\t\t\tgs_doit[3]=1;\n\t\t\t\t}\n\t\t\t}\n\t\telse\n\t\t\tgs_doit[0]=gs_doit[1]=gs_doit[2]=gs_doit[3]=1;\n\t\tfor (l2=j=0; j<num; j++)\n\t\t\t{\n\t\t\tif (!gs_doit[j&3]) continue;\n\t\t\tl2++;\n#ifndef CHARSET_EBCDIC\n\t\t\tif ((q[j] < \' \') || (q[j] > \'~\')) l2+=3;\n#else\n\t\t\tif ((os_toascii[q[j]] < os_toascii[\' \']) ||\n\t\t\t    (os_toascii[q[j]] > os_toascii[\'~\'])) l2+=3;\n#endif\n\t\t\t}\n\t\tlold=l;\n\t\tl+=1+l1+1+l2;\n\t\tif (b != NULL)\n\t\t\t{\n\t\t\tif (!BUF_MEM_grow(b,l+1)) goto err;\n\t\t\tp= &(b->data[lold]);\n\t\t\t}\n\t\telse if (l > len)\n\t\t\t{\n\t\t\tbreak;\n\t\t\t}\n\t\telse\n\t\t\tp= &(buf[lold]);\n\t\t*(p++)=\'/\';\n\t\tmemcpy(p,s,(unsigned int)l1); p+=l1;\n\t\t*(p++)=\'=\';\n#ifndef CHARSET_EBCDIC\n\t\tq=ne->value->data;\n#endif\n\t\tfor (j=0; j<num; j++)\n\t\t\t{\n\t\t\tif (!gs_doit[j&3]) continue;\n#ifndef CHARSET_EBCDIC\n\t\t\tn=q[j];\n\t\t\tif ((n < \' \') || (n > \'~\'))\n\t\t\t\t{\n\t\t\t\t*(p++)=\'\\\\\';\n\t\t\t\t*(p++)=\'x\';\n\t\t\t\t*(p++)=hex[(n>>4)&0x0f];\n\t\t\t\t*(p++)=hex[n&0x0f];\n\t\t\t\t}\n\t\t\telse\n\t\t\t\t*(p++)=n;\n#else\n\t\t\tn=os_toascii[q[j]];\n\t\t\tif ((n < os_toascii[\' \']) ||\n\t\t\t    (n > os_toascii[\'~\']))\n\t\t\t\t{\n\t\t\t\t*(p++)=\'\\\\\';\n\t\t\t\t*(p++)=\'x\';\n\t\t\t\t*(p++)=hex[(n>>4)&0x0f];\n\t\t\t\t*(p++)=hex[n&0x0f];\n\t\t\t\t}\n\t\t\telse\n\t\t\t\t*(p++)=q[j];\n#endif\n\t\t\t}\n\t\t*p=\'\\0\';\n\t\t}\n\tif (b != NULL)\n\t\t{\n\t\tp=b->data;\n\t\tFree(b);\n\t\t}\n\telse\n\t\tp=buf;\n\treturn(p);\nerr:\n\tX509err(X509_F_X509_NAME_ONELINE,ERR_R_MALLOC_FAILURE);\n\tif (b != NULL) BUF_MEM_free(b);\n\treturn(NULL);\n\t}']