crypto/x509/x509_trs.c:147: error: NULL_DEREFERENCE
  pointer `trtmp` last assigned on line 144 could be null and is dereferenced at line 147, column 9.
Showing all 11 steps of the trace


crypto/x509/x509_trs.c:123:1: start of procedure X509_TRUST_add()
121.   }
122.   
123. > int X509_TRUST_add(int id, int flags, int (*ck) (X509_TRUST *, X509 *, int),
124.                      const char *name, int arg1, void *arg2)
125.   {

crypto/x509/x509_trs.c:131:5: 
129.        * This is set according to what we change: application can't set it
130.        */
131. >     flags &= ~X509_TRUST_DYNAMIC;
132.       /* This will always be set for application modified trust entries */
133.       flags |= X509_TRUST_DYNAMIC_NAME;

crypto/x509/x509_trs.c:133:5: 
131.       flags &= ~X509_TRUST_DYNAMIC;
132.       /* This will always be set for application modified trust entries */
133. >     flags |= X509_TRUST_DYNAMIC_NAME;
134.       /* Get existing entry if any */
135.       idx = X509_TRUST_get_by_id(id);

crypto/x509/x509_trs.c:135:5: Skipping X509_TRUST_get_by_id(): empty list of specs
133.       flags |= X509_TRUST_DYNAMIC_NAME;
134.       /* Get existing entry if any */
135.       idx = X509_TRUST_get_by_id(id);
           ^
136.       /* Need a new entry */
137.       if (idx == -1) {

crypto/x509/x509_trs.c:137:9: Taking false branch
135.       idx = X509_TRUST_get_by_id(id);
136.       /* Need a new entry */
137.       if (idx == -1) {
               ^
138.           if ((trtmp = OPENSSL_malloc(sizeof(*trtmp))) == NULL) {
139.               X509err(X509_F_X509_TRUST_ADD, ERR_R_MALLOC_FAILURE);

crypto/x509/x509_trs.c:144:9: 
142.           trtmp->flags = X509_TRUST_DYNAMIC;
143.       } else
144. >         trtmp = X509_TRUST_get0(idx);
145.   
146.       /* OPENSSL_free existing name if dynamic */

crypto/x509/x509_trs.c:88:1: start of procedure X509_TRUST_get0()
  86.   }
  87.   
  88. > X509_TRUST *X509_TRUST_get0(int idx)
  89.   {
  90.       if (idx < 0)

crypto/x509/x509_trs.c:90:9: Taking true branch
  88.   X509_TRUST *X509_TRUST_get0(int idx)
  89.   {
  90.       if (idx < 0)
                ^
  91.           return NULL;
  92.       if (idx < (int)X509_TRUST_COUNT)

crypto/x509/x509_trs.c:91:9: 
  89.   {
  90.       if (idx < 0)
  91. >         return NULL;
  92.       if (idx < (int)X509_TRUST_COUNT)
  93.           return trstandard + idx;

crypto/x509/x509_trs.c:95:1: return from a call to X509_TRUST_get0
  93.           return trstandard + idx;
  94.       return sk_X509_TRUST_value(trtable, idx - X509_TRUST_COUNT);
  95. > }
  96.   
  97.   int X509_TRUST_get_by_id(int id)

crypto/x509/x509_trs.c:147:9: 
145.   
146.       /* OPENSSL_free existing name if dynamic */
147. >     if (trtmp->flags & X509_TRUST_DYNAMIC_NAME)
148.           OPENSSL_free(trtmp->name);
149.       /* dup supplied name */

int X509_TRUST_add(int id, int flags, int (*ck) (X509_TRUST *, X509 *, int),
                   const char *name, int arg1, void *arg2)
{
    int idx;
    X509_TRUST *trtmp;
    flags &= ~X509_TRUST_DYNAMIC;
    flags |= X509_TRUST_DYNAMIC_NAME;
    idx = X509_TRUST_get_by_id(id);
    if (idx == -1) {
        if ((trtmp = OPENSSL_malloc(sizeof(*trtmp))) == NULL) {
            X509err(X509_F_X509_TRUST_ADD, ERR_R_MALLOC_FAILURE);
            return 0;
        }
        trtmp->flags = X509_TRUST_DYNAMIC;
    } else
        trtmp = X509_TRUST_get0(idx);
    if (trtmp->flags & X509_TRUST_DYNAMIC_NAME)
        OPENSSL_free(trtmp->name);
    if ((trtmp->name = OPENSSL_strdup(name)) == NULL) {
        X509err(X509_F_X509_TRUST_ADD, ERR_R_MALLOC_FAILURE);
        goto err;
    }
    trtmp->flags &= X509_TRUST_DYNAMIC;
    trtmp->flags |= flags;
    trtmp->trust = id;
    trtmp->check_trust = ck;
    trtmp->arg1 = arg1;
    trtmp->arg2 = arg2;
    if (idx == -1) {
        if (trtable == NULL
            && (trtable = sk_X509_TRUST_new(tr_cmp)) == NULL) {
            X509err(X509_F_X509_TRUST_ADD, ERR_R_MALLOC_FAILURE);
            goto err;;
        }
        if (!sk_X509_TRUST_push(trtable, trtmp)) {
            X509err(X509_F_X509_TRUST_ADD, ERR_R_MALLOC_FAILURE);
            goto err;
        }
    }
    return 1;
 err:
    if (idx == -1) {
        OPENSSL_free(trtmp->name);
        OPENSSL_free(trtmp);
    }
    return 0;
}
['int X509_TRUST_add(int id, int flags, int (*ck) (X509_TRUST *, X509 *, int),\n                   const char *name, int arg1, void *arg2)\n{\n    int idx;\n    X509_TRUST *trtmp;\n    flags &= ~X509_TRUST_DYNAMIC;\n    flags |= X509_TRUST_DYNAMIC_NAME;\n    idx = X509_TRUST_get_by_id(id);\n    if (idx == -1) {\n        if ((trtmp = OPENSSL_malloc(sizeof(*trtmp))) == NULL) {\n            X509err(X509_F_X509_TRUST_ADD, ERR_R_MALLOC_FAILURE);\n            return 0;\n        }\n        trtmp->flags = X509_TRUST_DYNAMIC;\n    } else\n        trtmp = X509_TRUST_get0(idx);\n    if (trtmp->flags & X509_TRUST_DYNAMIC_NAME)\n        OPENSSL_free(trtmp->name);\n    if ((trtmp->name = OPENSSL_strdup(name)) == NULL) {\n        X509err(X509_F_X509_TRUST_ADD, ERR_R_MALLOC_FAILURE);\n        goto err;\n    }\n    trtmp->flags &= X509_TRUST_DYNAMIC;\n    trtmp->flags |= flags;\n    trtmp->trust = id;\n    trtmp->check_trust = ck;\n    trtmp->arg1 = arg1;\n    trtmp->arg2 = arg2;\n    if (idx == -1) {\n        if (trtable == NULL\n            && (trtable = sk_X509_TRUST_new(tr_cmp)) == NULL) {\n            X509err(X509_F_X509_TRUST_ADD, ERR_R_MALLOC_FAILURE);\n            goto err;;\n        }\n        if (!sk_X509_TRUST_push(trtable, trtmp)) {\n            X509err(X509_F_X509_TRUST_ADD, ERR_R_MALLOC_FAILURE);\n            goto err;\n        }\n    }\n    return 1;\n err:\n    if (idx == -1) {\n        OPENSSL_free(trtmp->name);\n        OPENSSL_free(trtmp);\n    }\n    return 0;\n}', 'X509_TRUST *X509_TRUST_get0(int idx)\n{\n    if (idx < 0)\n        return NULL;\n    if (idx < (int)X509_TRUST_COUNT)\n        return trstandard + idx;\n    return sk_X509_TRUST_value(trtable, idx - X509_TRUST_COUNT);\n}']