crypto/asn1/asn1_gen.c:461: error: NULL_DEREFERENCE
  pointer `sk` last assigned on line 448 could be null and is dereferenced by call to `sk_push()` at line 461, column 4.
Showing all 59 steps of the trace


crypto/asn1/asn1_gen.c:440:1: start of procedure asn1_multi()
438.   /* Handle multiple types: SET and SEQUENCE */
439.   
440. > static ASN1_TYPE *asn1_multi(int utype, const char *section, X509V3_CTX *cnf)
441.   	{
442.   	ASN1_TYPE *ret = NULL;

crypto/asn1/asn1_gen.c:442:2: 
440.   static ASN1_TYPE *asn1_multi(int utype, const char *section, X509V3_CTX *cnf)
441.   	{
442. > 	ASN1_TYPE *ret = NULL;
443.   	STACK_OF(ASN1_TYPE) *sk = NULL;
444.   	STACK_OF(CONF_VALUE) *sect = NULL;

crypto/asn1/asn1_gen.c:443:2: 
441.   	{
442.   	ASN1_TYPE *ret = NULL;
443. > 	STACK_OF(ASN1_TYPE) *sk = NULL;
444.   	STACK_OF(CONF_VALUE) *sect = NULL;
445.   	unsigned char *der = NULL;

crypto/asn1/asn1_gen.c:444:2: 
442.   	ASN1_TYPE *ret = NULL;
443.   	STACK_OF(ASN1_TYPE) *sk = NULL;
444. > 	STACK_OF(CONF_VALUE) *sect = NULL;
445.   	unsigned char *der = NULL;
446.   	int derlen;

crypto/asn1/asn1_gen.c:445:2: 
443.   	STACK_OF(ASN1_TYPE) *sk = NULL;
444.   	STACK_OF(CONF_VALUE) *sect = NULL;
445. > 	unsigned char *der = NULL;
446.   	int derlen;
447.   	int i;

crypto/asn1/asn1_gen.c:448:2: 
446.   	int derlen;
447.   	int i;
448. > 	sk = sk_ASN1_TYPE_new_null();
449.   	if (section)
450.   		{

crypto/stack/stack.c:115:1: start of procedure sk_new_null()
  113.   	}
  114.   
  115. > _STACK *sk_new_null(void)
  116.   	{
  117.   	return sk_new((int (*)(const void *, const void *))0);

crypto/stack/stack.c:117:2: 
  115.   _STACK *sk_new_null(void)
  116.   	{
  117. > 	return sk_new((int (*)(const void *, const void *))0);
  118.   	}
  119.   

crypto/stack/stack.c:120:1: start of procedure sk_new()
    118.   	}
    119.   
    120. > _STACK *sk_new(int (*c)(const void *, const void *))
    121.   	{
    122.   	_STACK *ret;

crypto/stack/stack.c:125:6: 
    123.   	int i;
    124.   
    125. > 	if ((ret=OPENSSL_malloc(sizeof(_STACK))) == NULL)
    126.   		goto err;
    127.   	if ((ret->data=OPENSSL_malloc(sizeof(char *)*MIN_NODES)) == NULL)

crypto/mem.c:294:1: start of procedure CRYPTO_malloc()
      292.   	}
      293.   
      294. > void *CRYPTO_malloc(int num, const char *file, int line)
      295.   	{
      296.   	void *ret = NULL;

crypto/mem.c:296:2: 
      294.   void *CRYPTO_malloc(int num, const char *file, int line)
      295.   	{
      296. > 	void *ret = NULL;
      297.   
      298.   	if (num <= 0) return NULL;

crypto/mem.c:298:6: Taking false branch
      296.   	void *ret = NULL;
      297.   
      298.   	if (num <= 0) return NULL;
                  ^
      299.   
      300.   	allow_customize = 0;

crypto/mem.c:300:2: 
      298.   	if (num <= 0) return NULL;
      299.   
      300. > 	allow_customize = 0;
      301.   	if (malloc_debug_func != NULL)
      302.   		{

crypto/mem.c:301:6: Taking false branch
      299.   
      300.   	allow_customize = 0;
      301.   	if (malloc_debug_func != NULL)
                  ^
      302.   		{
      303.   		allow_customize_debug = 0;

crypto/mem.c:306:2: Skipping __function_pointer__(): unresolved function pointer
      304.   		malloc_debug_func(NULL, num, file, line, 0);
      305.   		}
      306.   	ret = malloc_ex_func(num,file,line);
              ^
      307.   #ifdef LEVITTE_DEBUG_MEM
      308.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);

crypto/mem.c:310:6: Taking false branch
      308.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);
      309.   #endif
      310.   	if (malloc_debug_func != NULL)
                  ^
      311.   		malloc_debug_func(ret, num, file, line, 1);
      312.   

crypto/mem.c:317:12: Taking false branch
      315.            * sanitisation function can't be optimised out. NB: We only do
      316.            * this for >2Kb so the overhead doesn't bother us. */
      317.           if(ret && (num > 2048))
                        ^
      318.   	{	extern unsigned char cleanse_ctr;
      319.                   ((unsigned char *)ret)[0] = cleanse_ctr;

crypto/mem.c:323:2: 
      321.   #endif
      322.   
      323. > 	return ret;
      324.   	}
      325.   

crypto/mem.c:324:2: return from a call to CRYPTO_malloc
      322.   
      323.   	return ret;
      324.   	}
              ^
      325.   
      326.   void *CRYPTO_realloc(void *str, int num, const char *file, int line)

crypto/stack/stack.c:125:6: Taking true branch
    123.   	int i;
    124.   
    125.   	if ((ret=OPENSSL_malloc(sizeof(_STACK))) == NULL)
                ^
    126.   		goto err;
    127.   	if ((ret->data=OPENSSL_malloc(sizeof(char *)*MIN_NODES)) == NULL)

crypto/stack/stack.c:136:1: 
    134.   	ret->sorted=0;
    135.   	return(ret);
    136. > err:
    137.   	if(ret)
    138.   		OPENSSL_free(ret);

crypto/stack/stack.c:137:5: Taking false branch
    135.   	return(ret);
    136.   err:
    137.   	if(ret)
               ^
    138.   		OPENSSL_free(ret);
    139.   	return(NULL);

crypto/stack/stack.c:139:2: 
    137.   	if(ret)
    138.   		OPENSSL_free(ret);
    139. > 	return(NULL);
    140.   	}
    141.   

crypto/stack/stack.c:140:2: return from a call to sk_new
    138.   		OPENSSL_free(ret);
    139.   	return(NULL);
    140.   	}
            ^
    141.   
    142.   int sk_insert(_STACK *st, void *data, int loc)

crypto/stack/stack.c:118:2: return from a call to sk_new_null
  116.   	{
  117.   	return sk_new((int (*)(const void *, const void *))0);
  118.   	}
          ^
  119.   
  120.   _STACK *sk_new(int (*c)(const void *, const void *))

crypto/asn1/asn1_gen.c:449:6: Taking true branch
447.   	int i;
448.   	sk = sk_ASN1_TYPE_new_null();
449.   	if (section)
            ^
450.   		{
451.   		if (!cnf)

crypto/asn1/asn1_gen.c:451:8: Taking false branch
449.   	if (section)
450.   		{
451.   		if (!cnf)
              ^
452.   			goto bad;
453.   		sect = X509V3_get_section(cnf, (char *)section);

crypto/asn1/asn1_gen.c:453:3: 
451.   		if (!cnf)
452.   			goto bad;
453. > 		sect = X509V3_get_section(cnf, (char *)section);
454.   		if (!sect)
455.   			goto bad;

crypto/x509v3/v3_conf.c:397:1: start of procedure X509V3_get_section()
  395.   	}
  396.   
  397. > STACK_OF(CONF_VALUE) * X509V3_get_section(X509V3_CTX *ctx, char *section)
  398.   	{
  399.   	if(!ctx->db || !ctx->db_meth || !ctx->db_meth->get_section)

crypto/x509v3/v3_conf.c:399:6: Taking false branch
  397.   STACK_OF(CONF_VALUE) * X509V3_get_section(X509V3_CTX *ctx, char *section)
  398.   	{
  399.   	if(!ctx->db || !ctx->db_meth || !ctx->db_meth->get_section)
              ^
  400.   		{
  401.   		X509V3err(X509V3_F_X509V3_GET_SECTION,X509V3_R_OPERATION_NOT_DEFINED);

crypto/x509v3/v3_conf.c:399:18: Taking false branch
  397.   STACK_OF(CONF_VALUE) * X509V3_get_section(X509V3_CTX *ctx, char *section)
  398.   	{
  399.   	if(!ctx->db || !ctx->db_meth || !ctx->db_meth->get_section)
                          ^
  400.   		{
  401.   		X509V3err(X509V3_F_X509V3_GET_SECTION,X509V3_R_OPERATION_NOT_DEFINED);

crypto/x509v3/v3_conf.c:399:35: Taking false branch
  397.   STACK_OF(CONF_VALUE) * X509V3_get_section(X509V3_CTX *ctx, char *section)
  398.   	{
  399.   	if(!ctx->db || !ctx->db_meth || !ctx->db_meth->get_section)
                                           ^
  400.   		{
  401.   		X509V3err(X509V3_F_X509V3_GET_SECTION,X509V3_R_OPERATION_NOT_DEFINED);

crypto/x509v3/v3_conf.c:404:6: Taking true branch
  402.   		return NULL;
  403.   		}
  404.   	if (ctx->db_meth->get_section)
              ^
  405.   			return ctx->db_meth->get_section(ctx->db, section);
  406.   	return NULL;

crypto/x509v3/v3_conf.c:405:4: Skipping __function_pointer__(): unresolved function pointer
  403.   		}
  404.   	if (ctx->db_meth->get_section)
  405.   			return ctx->db_meth->get_section(ctx->db, section);
            ^
  406.   	return NULL;
  407.   	}

crypto/x509v3/v3_conf.c:407:2: return from a call to X509V3_get_section
  405.   			return ctx->db_meth->get_section(ctx->db, section);
  406.   	return NULL;
  407.   	}
          ^
  408.   
  409.   void X509V3_string_free(X509V3_CTX *ctx, char *str)

crypto/asn1/asn1_gen.c:454:8: Taking false branch
452.   			goto bad;
453.   		sect = X509V3_get_section(cnf, (char *)section);
454.   		if (!sect)
              ^
455.   			goto bad;
456.   		for (i = 0; i < sk_CONF_VALUE_num(sect); i++)

crypto/asn1/asn1_gen.c:456:8: 
454.   		if (!sect)
455.   			goto bad;
456. > 		for (i = 0; i < sk_CONF_VALUE_num(sect); i++)
457.   			{
458.   			ASN1_TYPE *typ = ASN1_generate_v3(sk_CONF_VALUE_value(sect, i)->value, cnf);

crypto/asn1/asn1_gen.c:456:19: Condition is true
454.   		if (!sect)
455.   			goto bad;
456.   		for (i = 0; i < sk_CONF_VALUE_num(sect); i++)
                         ^
457.   			{
458.   			ASN1_TYPE *typ = ASN1_generate_v3(sk_CONF_VALUE_value(sect, i)->value, cnf);

crypto/asn1/asn1_gen.c:456:15: 
454.   		if (!sect)
455.   			goto bad;
456. > 		for (i = 0; i < sk_CONF_VALUE_num(sect); i++)
457.   			{
458.   			ASN1_TYPE *typ = ASN1_generate_v3(sk_CONF_VALUE_value(sect, i)->value, cnf);

crypto/stack/stack.c:294:1: start of procedure sk_num()
  292.   	}
  293.   
  294. > int sk_num(const _STACK *st)
  295.   {
  296.   	if(st == NULL) return -1;

crypto/stack/stack.c:296:5: Taking false branch
  294.   int sk_num(const _STACK *st)
  295.   {
  296.   	if(st == NULL) return -1;
             ^
  297.   	return st->num;
  298.   }

crypto/stack/stack.c:297:2: 
  295.   {
  296.   	if(st == NULL) return -1;
  297. > 	return st->num;
  298.   }
  299.   

crypto/stack/stack.c:298:1: return from a call to sk_num
  296.   	if(st == NULL) return -1;
  297.   	return st->num;
  298. > }
  299.   
  300.   void *sk_value(const _STACK *st, int i)

crypto/asn1/asn1_gen.c:456:15: Loop condition is true. Entering loop body
454.   		if (!sect)
455.   			goto bad;
456.   		for (i = 0; i < sk_CONF_VALUE_num(sect); i++)
                     ^
457.   			{
458.   			ASN1_TYPE *typ = ASN1_generate_v3(sk_CONF_VALUE_value(sect, i)->value, cnf);

crypto/asn1/asn1_gen.c:458:38: Condition is true
456.   		for (i = 0; i < sk_CONF_VALUE_num(sect); i++)
457.   			{
458.   			ASN1_TYPE *typ = ASN1_generate_v3(sk_CONF_VALUE_value(sect, i)->value, cnf);
                                            ^
459.   			if (!typ)
460.   				goto bad;

crypto/asn1/asn1_gen.c:458:4: 
456.   		for (i = 0; i < sk_CONF_VALUE_num(sect); i++)
457.   			{
458. > 			ASN1_TYPE *typ = ASN1_generate_v3(sk_CONF_VALUE_value(sect, i)->value, cnf);
459.   			if (!typ)
460.   				goto bad;

crypto/stack/stack.c:300:1: start of procedure sk_value()
  298.   }
  299.   
  300. > void *sk_value(const _STACK *st, int i)
  301.   {
  302.   	if(!st || (i < 0) || (i >= st->num)) return NULL;

crypto/stack/stack.c:302:6: Taking false branch
  300.   void *sk_value(const _STACK *st, int i)
  301.   {
  302.   	if(!st || (i < 0) || (i >= st->num)) return NULL;
              ^
  303.   	return st->data[i];
  304.   }

crypto/stack/stack.c:302:13: Taking false branch
  300.   void *sk_value(const _STACK *st, int i)
  301.   {
  302.   	if(!st || (i < 0) || (i >= st->num)) return NULL;
                     ^
  303.   	return st->data[i];
  304.   }

crypto/stack/stack.c:302:24: Taking false branch
  300.   void *sk_value(const _STACK *st, int i)
  301.   {
  302.   	if(!st || (i < 0) || (i >= st->num)) return NULL;
                                ^
  303.   	return st->data[i];
  304.   }

crypto/stack/stack.c:303:2: 
  301.   {
  302.   	if(!st || (i < 0) || (i >= st->num)) return NULL;
  303. > 	return st->data[i];
  304.   }
  305.   

crypto/stack/stack.c:304:1: return from a call to sk_value
  302.   	if(!st || (i < 0) || (i >= st->num)) return NULL;
  303.   	return st->data[i];
  304. > }
  305.   
  306.   void *sk_set(_STACK *st, int i, void *value)

crypto/asn1/asn1_gen.c:458:4: Skipping ASN1_generate_v3(): function or method not found
456.   		for (i = 0; i < sk_CONF_VALUE_num(sect); i++)
457.   			{
458.   			ASN1_TYPE *typ = ASN1_generate_v3(sk_CONF_VALUE_value(sect, i)->value, cnf);
          ^
459.   			if (!typ)
460.   				goto bad;

crypto/asn1/asn1_gen.c:459:9: Taking false branch
457.   			{
458.   			ASN1_TYPE *typ = ASN1_generate_v3(sk_CONF_VALUE_value(sect, i)->value, cnf);
459.   			if (!typ)
               ^
460.   				goto bad;
461.   			sk_ASN1_TYPE_push(sk, typ);

crypto/asn1/asn1_gen.c:461:4: Condition is true
459.   			if (!typ)
460.   				goto bad;
461.   			sk_ASN1_TYPE_push(sk, typ);
          ^
462.   			}
463.   		}

crypto/asn1/asn1_gen.c:461:4: Condition is true
459.   			if (!typ)
460.   				goto bad;
461.   			sk_ASN1_TYPE_push(sk, typ);
          ^
462.   			}
463.   		}

crypto/stack/stack.c:244:1: start of procedure sk_push()
  242.   	}
  243.   
  244. > int sk_push(_STACK *st, void *data)
  245.   	{
  246.   	return(sk_insert(st,data,st->num));

crypto/stack/stack.c:246:2: Skipping sk_insert(): empty list of specs
  244.   int sk_push(_STACK *st, void *data)
  245.   	{
  246.   	return(sk_insert(st,data,st->num));
          ^
  247.   	}
  248.   

static ASN1_TYPE *asn1_multi(int utype, const char *section, X509V3_CTX *cnf)
	{
	ASN1_TYPE *ret = NULL;
	STACK_OF(ASN1_TYPE) *sk = NULL;
	STACK_OF(CONF_VALUE) *sect = NULL;
	unsigned char *der = NULL;
	int derlen;
	int i;
	sk = sk_ASN1_TYPE_new_null();
	if (section)
		{
		if (!cnf)
			goto bad;
		sect = X509V3_get_section(cnf, (char *)section);
		if (!sect)
			goto bad;
		for (i = 0; i < sk_CONF_VALUE_num(sect); i++)
			{
			ASN1_TYPE *typ = ASN1_generate_v3(sk_CONF_VALUE_value(sect, i)->value, cnf);
			if (!typ)
				goto bad;
			sk_ASN1_TYPE_push(sk, typ);
			}
		}
	if (utype == V_ASN1_SET)
		derlen = i2d_ASN1_SET_ANY(sk, &der);
	else
		derlen = i2d_ASN1_SEQUENCE_ANY(sk, &der);
	if (!(ret = ASN1_TYPE_new()))
		goto bad;
	if (!(ret->value.asn1_string = ASN1_STRING_type_new(utype)))
		goto bad;
	ret->type = utype;
	ret->value.asn1_string->data = der;
	ret->value.asn1_string->length = derlen;
	der = NULL;
	bad:
	if (der)
		OPENSSL_free(der);
	if (sk)
		sk_ASN1_TYPE_pop_free(sk, ASN1_TYPE_free);
	if (sect)
		X509V3_section_free(cnf, sect);
	return ret;
	}
['static ASN1_TYPE *asn1_multi(int utype, const char *section, X509V3_CTX *cnf)\n\t{\n\tASN1_TYPE *ret = NULL;\n\tSTACK_OF(ASN1_TYPE) *sk = NULL;\n\tSTACK_OF(CONF_VALUE) *sect = NULL;\n\tunsigned char *der = NULL;\n\tint derlen;\n\tint i;\n\tsk = sk_ASN1_TYPE_new_null();\n\tif (section)\n\t\t{\n\t\tif (!cnf)\n\t\t\tgoto bad;\n\t\tsect = X509V3_get_section(cnf, (char *)section);\n\t\tif (!sect)\n\t\t\tgoto bad;\n\t\tfor (i = 0; i < sk_CONF_VALUE_num(sect); i++)\n\t\t\t{\n\t\t\tASN1_TYPE *typ = ASN1_generate_v3(sk_CONF_VALUE_value(sect, i)->value, cnf);\n\t\t\tif (!typ)\n\t\t\t\tgoto bad;\n\t\t\tsk_ASN1_TYPE_push(sk, typ);\n\t\t\t}\n\t\t}\n\tif (utype == V_ASN1_SET)\n\t\tderlen = i2d_ASN1_SET_ANY(sk, &der);\n\telse\n\t\tderlen = i2d_ASN1_SEQUENCE_ANY(sk, &der);\n\tif (!(ret = ASN1_TYPE_new()))\n\t\tgoto bad;\n\tif (!(ret->value.asn1_string = ASN1_STRING_type_new(utype)))\n\t\tgoto bad;\n\tret->type = utype;\n\tret->value.asn1_string->data = der;\n\tret->value.asn1_string->length = derlen;\n\tder = NULL;\n\tbad:\n\tif (der)\n\t\tOPENSSL_free(der);\n\tif (sk)\n\t\tsk_ASN1_TYPE_pop_free(sk, ASN1_TYPE_free);\n\tif (sect)\n\t\tX509V3_section_free(cnf, sect);\n\treturn ret;\n\t}', '_STACK *sk_new_null(void)\n\t{\n\treturn sk_new((int (*)(const void *, const void *))0);\n\t}', '_STACK *sk_new(int (*c)(const void *, const void *))\n\t{\n\t_STACK *ret;\n\tint i;\n\tif ((ret=OPENSSL_malloc(sizeof(_STACK))) == NULL)\n\t\tgoto err;\n\tif ((ret->data=OPENSSL_malloc(sizeof(char *)*MIN_NODES)) == NULL)\n\t\tgoto err;\n\tfor (i=0; i<MIN_NODES; i++)\n\t\tret->data[i]=NULL;\n\tret->comp=c;\n\tret->num_alloc=MIN_NODES;\n\tret->num=0;\n\tret->sorted=0;\n\treturn(ret);\nerr:\n\tif(ret)\n\t\tOPENSSL_free(ret);\n\treturn(NULL);\n\t}', 'void *CRYPTO_malloc(int num, const char *file, int line)\n\t{\n\tvoid *ret = NULL;\n\tif (num <= 0) return NULL;\n\tallow_customize = 0;\n\tif (malloc_debug_func != NULL)\n\t\t{\n\t\tallow_customize_debug = 0;\n\t\tmalloc_debug_func(NULL, num, file, line, 0);\n\t\t}\n\tret = malloc_ex_func(num,file,line);\n#ifdef LEVITTE_DEBUG_MEM\n\tfprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\\n", ret, num);\n#endif\n\tif (malloc_debug_func != NULL)\n\t\tmalloc_debug_func(ret, num, file, line, 1);\n#ifndef OPENSSL_CPUID_OBJ\n        if(ret && (num > 2048))\n\t{\textern unsigned char cleanse_ctr;\n                ((unsigned char *)ret)[0] = cleanse_ctr;\n\t}\n#endif\n\treturn ret;\n\t}', 'STACK_OF(CONF_VALUE) * X509V3_get_section(X509V3_CTX *ctx, char *section)\n\t{\n\tif(!ctx->db || !ctx->db_meth || !ctx->db_meth->get_section)\n\t\t{\n\t\tX509V3err(X509V3_F_X509V3_GET_SECTION,X509V3_R_OPERATION_NOT_DEFINED);\n\t\treturn NULL;\n\t\t}\n\tif (ctx->db_meth->get_section)\n\t\t\treturn ctx->db_meth->get_section(ctx->db, section);\n\treturn NULL;\n\t}', 'int sk_num(const _STACK *st)\n{\n\tif(st == NULL) return -1;\n\treturn st->num;\n}', 'void *sk_value(const _STACK *st, int i)\n{\n\tif(!st || (i < 0) || (i >= st->num)) return NULL;\n\treturn st->data[i];\n}', 'int sk_push(_STACK *st, void *data)\n\t{\n\treturn(sk_insert(st,data,st->num));\n\t}']