crypto/x509/x509_req.c:200: error: NULL_DEREFERENCE
  pointer `attr` last assigned on line 199 could be null and is dereferenced at line 200, column 6.
Showing all 53 steps of the trace


crypto/x509/x509_req.c:185:1: start of procedure X509_REQ_get_extensions()
183.   }
184.   
185. > STACK_OF(X509_EXTENSION) *X509_REQ_get_extensions(X509_REQ *req)
186.   	{
187.   	X509_ATTRIBUTE *attr;

crypto/x509/x509_req.c:188:2: 
186.   	{
187.   	X509_ATTRIBUTE *attr;
188. > 	ASN1_TYPE *ext = NULL;
189.   	int idx, *pnid;
190.   	const unsigned char *p;

crypto/x509/x509_req.c:192:7: Taking false branch
190.   	const unsigned char *p;
191.   
192.   	if ((req == NULL) || (req->req_info == NULL) || !ext_nids)
             ^
193.   		return(NULL);
194.   	for (pnid = ext_nids; *pnid != NID_undef; pnid++)

crypto/x509/x509_req.c:192:24: Taking false branch
190.   	const unsigned char *p;
191.   
192.   	if ((req == NULL) || (req->req_info == NULL) || !ext_nids)
                              ^
193.   		return(NULL);
194.   	for (pnid = ext_nids; *pnid != NID_undef; pnid++)

crypto/x509/x509_req.c:192:51: Taking false branch
190.   	const unsigned char *p;
191.   
192.   	if ((req == NULL) || (req->req_info == NULL) || !ext_nids)
                                                         ^
193.   		return(NULL);
194.   	for (pnid = ext_nids; *pnid != NID_undef; pnid++)

crypto/x509/x509_req.c:194:7: 
192.   	if ((req == NULL) || (req->req_info == NULL) || !ext_nids)
193.   		return(NULL);
194. > 	for (pnid = ext_nids; *pnid != NID_undef; pnid++)
195.   		{
196.   		idx = X509_REQ_get_attr_by_NID(req, *pnid, -1);

crypto/x509/x509_req.c:194:24: Loop condition is true. Entering loop body
192.   	if ((req == NULL) || (req->req_info == NULL) || !ext_nids)
193.   		return(NULL);
194.   	for (pnid = ext_nids; *pnid != NID_undef; pnid++)
                              ^
195.   		{
196.   		idx = X509_REQ_get_attr_by_NID(req, *pnid, -1);

crypto/x509/x509_req.c:196:3: 
194.   	for (pnid = ext_nids; *pnid != NID_undef; pnid++)
195.   		{
196. > 		idx = X509_REQ_get_attr_by_NID(req, *pnid, -1);
197.   		if (idx == -1)
198.   			continue;

crypto/x509/x509_req.c:266:1: start of procedure X509_REQ_get_attr_by_NID()
  264.   }
  265.   
  266. > int X509_REQ_get_attr_by_NID(const X509_REQ *req, int nid,
  267.   			  int lastpos)
  268.   {

crypto/x509/x509_req.c:269:2: 
  267.   			  int lastpos)
  268.   {
  269. > 	return X509at_get_attr_by_NID(req->req_info->attributes, nid, lastpos);
  270.   }
  271.   

crypto/x509/x509_att.c:74:1: start of procedure X509at_get_attr_by_NID()
    72.   }
    73.   
    74. > int X509at_get_attr_by_NID(const STACK_OF(X509_ATTRIBUTE) *x, int nid,
    75.   			  int lastpos)
    76.   {

crypto/x509/x509_att.c:79:2: 
    77.   	ASN1_OBJECT *obj;
    78.   
    79. > 	obj=OBJ_nid2obj(nid);
    80.   	if (obj == NULL) return(-2);
    81.   	return(X509at_get_attr_by_OBJ(x,obj,lastpos));

crypto/objects/obj_dat.c:270:1: start of procedure OBJ_nid2obj()
      268.   	}
      269.   
      270. > ASN1_OBJECT *OBJ_nid2obj(int n)
      271.   	{
      272.   	ADDED_OBJ ad,*adp;

crypto/objects/obj_dat.c:275:7: Taking true branch
      273.   	ASN1_OBJECT ob;
      274.   
      275.   	if ((n >= 0) && (n < NUM_NID))
                   ^
      276.   		{
      277.   		if ((n != NID_undef) && (nid_objs[n].nid == NID_undef))

crypto/objects/obj_dat.c:275:19: Taking true branch
      273.   	ASN1_OBJECT ob;
      274.   
      275.   	if ((n >= 0) && (n < NUM_NID))
                               ^
      276.   		{
      277.   		if ((n != NID_undef) && (nid_objs[n].nid == NID_undef))

crypto/objects/obj_dat.c:277:8: Taking true branch
      275.   	if ((n >= 0) && (n < NUM_NID))
      276.   		{
      277.   		if ((n != NID_undef) && (nid_objs[n].nid == NID_undef))
                    ^
      278.   			{
      279.   			OBJerr(OBJ_F_OBJ_NID2OBJ,OBJ_R_UNKNOWN_NID);

crypto/objects/obj_dat.c:277:28: Taking true branch
      275.   	if ((n >= 0) && (n < NUM_NID))
      276.   		{
      277.   		if ((n != NID_undef) && (nid_objs[n].nid == NID_undef))
                                        ^
      278.   			{
      279.   			OBJerr(OBJ_F_OBJ_NID2OBJ,OBJ_R_UNKNOWN_NID);

crypto/objects/obj_dat.c:279:4: 
      277.   		if ((n != NID_undef) && (nid_objs[n].nid == NID_undef))
      278.   			{
      279. > 			OBJerr(OBJ_F_OBJ_NID2OBJ,OBJ_R_UNKNOWN_NID);
      280.   			return(NULL);
      281.   			}

crypto/err/err.c:664:1: start of procedure ERR_put_error()
        662.   /********************************************************/
        663.   
        664. > void ERR_put_error(int lib, int func, int reason, const char *file,
        665.   	     int line)
        666.   	{

crypto/err/err.c:688:2: Skipping ERR_get_state(): empty list of specs
        686.   	}
        687.   #endif
        688.   	es=ERR_get_state();
                ^
        689.   
        690.   	es->top=(es->top+1)%ERR_NUM_ERRORS;

crypto/err/err.c:690:2: 
        688.   	es=ERR_get_state();
        689.   
        690. > 	es->top=(es->top+1)%ERR_NUM_ERRORS;
        691.   	if (es->top == es->bottom)
        692.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;

crypto/err/err.c:691:6: Taking false branch
        689.   
        690.   	es->top=(es->top+1)%ERR_NUM_ERRORS;
        691.   	if (es->top == es->bottom)
                    ^
        692.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
        693.   	es->err_flags[es->top]=0;

crypto/err/err.c:693:2: 
        691.   	if (es->top == es->bottom)
        692.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
        693. > 	es->err_flags[es->top]=0;
        694.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
        695.   	es->err_file[es->top]=file;

crypto/err/err.c:694:2: 
        692.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
        693.   	es->err_flags[es->top]=0;
        694. > 	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
        695.   	es->err_file[es->top]=file;
        696.   	es->err_line[es->top]=line;

crypto/err/err.c:695:2: 
        693.   	es->err_flags[es->top]=0;
        694.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
        695. > 	es->err_file[es->top]=file;
        696.   	es->err_line[es->top]=line;
        697.   	err_clear_data(es,es->top);

crypto/err/err.c:696:2: 
        694.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
        695.   	es->err_file[es->top]=file;
        696. > 	es->err_line[es->top]=line;
        697.   	err_clear_data(es,es->top);
        698.   	}

crypto/err/err.c:697:2: Taking true branch
        695.   	es->err_file[es->top]=file;
        696.   	es->err_line[es->top]=line;
        697.   	err_clear_data(es,es->top);
                ^
        698.   	}
        699.   

crypto/err/err.c:697:2: Taking false branch
        695.   	es->err_file[es->top]=file;
        696.   	es->err_line[es->top]=line;
        697.   	err_clear_data(es,es->top);
                ^
        698.   	}
        699.   

crypto/err/err.c:697:2: Loop condition is false. Leaving loop
        695.   	es->err_file[es->top]=file;
        696.   	es->err_line[es->top]=line;
        697.   	err_clear_data(es,es->top);
                ^
        698.   	}
        699.   

crypto/err/err.c:698:2: return from a call to ERR_put_error
        696.   	es->err_line[es->top]=line;
        697.   	err_clear_data(es,es->top);
        698.   	}
                ^
        699.   
        700.   void ERR_clear_error(void)

crypto/objects/obj_dat.c:280:4: 
      278.   			{
      279.   			OBJerr(OBJ_F_OBJ_NID2OBJ,OBJ_R_UNKNOWN_NID);
      280. > 			return(NULL);
      281.   			}
      282.   		return((ASN1_OBJECT *)&(nid_objs[n]));

crypto/objects/obj_dat.c:300:2: return from a call to OBJ_nid2obj
      298.   			}
      299.   		}
      300.   	}
              ^
      301.   
      302.   const char *OBJ_nid2sn(int n)

crypto/x509/x509_att.c:80:6: Taking true branch
    78.   
    79.   	obj=OBJ_nid2obj(nid);
    80.   	if (obj == NULL) return(-2);
               ^
    81.   	return(X509at_get_attr_by_OBJ(x,obj,lastpos));
    82.   }

crypto/x509/x509_att.c:80:19: 
    78.   
    79.   	obj=OBJ_nid2obj(nid);
    80. > 	if (obj == NULL) return(-2);
    81.   	return(X509at_get_attr_by_OBJ(x,obj,lastpos));
    82.   }

crypto/x509/x509_att.c:82:1: return from a call to X509at_get_attr_by_NID
    80.   	if (obj == NULL) return(-2);
    81.   	return(X509at_get_attr_by_OBJ(x,obj,lastpos));
    82. > }
    83.   
    84.   int X509at_get_attr_by_OBJ(const STACK_OF(X509_ATTRIBUTE) *sk, ASN1_OBJECT *obj,

crypto/x509/x509_req.c:270:1: return from a call to X509_REQ_get_attr_by_NID
  268.   {
  269.   	return X509at_get_attr_by_NID(req->req_info->attributes, nid, lastpos);
  270. > }
  271.   
  272.   int X509_REQ_get_attr_by_OBJ(const X509_REQ *req, ASN1_OBJECT *obj,

crypto/x509/x509_req.c:197:7: Taking false branch
195.   		{
196.   		idx = X509_REQ_get_attr_by_NID(req, *pnid, -1);
197.   		if (idx == -1)
             ^
198.   			continue;
199.   		attr = X509_REQ_get_attr(req, idx);

crypto/x509/x509_req.c:199:3: 
197.   		if (idx == -1)
198.   			continue;
199. > 		attr = X509_REQ_get_attr(req, idx);
200.   		if(attr->single) ext = attr->value.single;
201.   		else if(sk_ASN1_TYPE_num(attr->value.set))

crypto/x509/x509_req.c:278:1: start of procedure X509_REQ_get_attr()
  276.   }
  277.   
  278. > X509_ATTRIBUTE *X509_REQ_get_attr(const X509_REQ *req, int loc)
  279.   {
  280.   	return X509at_get_attr(req->req_info->attributes, loc);

crypto/x509/x509_req.c:280:2: 
  278.   X509_ATTRIBUTE *X509_REQ_get_attr(const X509_REQ *req, int loc)
  279.   {
  280. > 	return X509at_get_attr(req->req_info->attributes, loc);
  281.   }
  282.   

crypto/x509/x509_att.c:104:1: start of procedure X509at_get_attr()
    102.   }
    103.   
    104. > X509_ATTRIBUTE *X509at_get_attr(const STACK_OF(X509_ATTRIBUTE) *x, int loc)
    105.   {
    106.   	if (x == NULL || sk_X509_ATTRIBUTE_num(x) <= loc || loc < 0)

crypto/x509/x509_att.c:106:6: Taking false branch
    104.   X509_ATTRIBUTE *X509at_get_attr(const STACK_OF(X509_ATTRIBUTE) *x, int loc)
    105.   {
    106.   	if (x == NULL || sk_X509_ATTRIBUTE_num(x) <= loc || loc < 0)
                ^
    107.   		return NULL;
    108.   	else

crypto/x509/x509_att.c:106:19: 
    104.   X509_ATTRIBUTE *X509at_get_attr(const STACK_OF(X509_ATTRIBUTE) *x, int loc)
    105.   {
    106. > 	if (x == NULL || sk_X509_ATTRIBUTE_num(x) <= loc || loc < 0)
    107.   		return NULL;
    108.   	else

crypto/stack/stack.c:301:1: start of procedure sk_num()
      299.   	}
      300.   
      301. > int sk_num(const STACK *st)
      302.   {
      303.   	if(st == NULL) return -1;

crypto/stack/stack.c:303:5: Taking false branch
      301.   int sk_num(const STACK *st)
      302.   {
      303.   	if(st == NULL) return -1;
                 ^
      304.   	return st->num;
      305.   }

crypto/stack/stack.c:304:2: 
      302.   {
      303.   	if(st == NULL) return -1;
      304. > 	return st->num;
      305.   }
      306.   

crypto/stack/stack.c:305:1: return from a call to sk_num
      303.   	if(st == NULL) return -1;
      304.   	return st->num;
      305. > }
      306.   
      307.   char *sk_value(const STACK *st, int i)

crypto/x509/x509_att.c:106:19: Taking false branch
    104.   X509_ATTRIBUTE *X509at_get_attr(const STACK_OF(X509_ATTRIBUTE) *x, int loc)
    105.   {
    106.   	if (x == NULL || sk_X509_ATTRIBUTE_num(x) <= loc || loc < 0)
                             ^
    107.   		return NULL;
    108.   	else

crypto/x509/x509_att.c:106:54: Taking true branch
    104.   X509_ATTRIBUTE *X509at_get_attr(const STACK_OF(X509_ATTRIBUTE) *x, int loc)
    105.   {
    106.   	if (x == NULL || sk_X509_ATTRIBUTE_num(x) <= loc || loc < 0)
                                                                ^
    107.   		return NULL;
    108.   	else

crypto/x509/x509_att.c:107:3: 
    105.   {
    106.   	if (x == NULL || sk_X509_ATTRIBUTE_num(x) <= loc || loc < 0)
    107. > 		return NULL;
    108.   	else
    109.   		return sk_X509_ATTRIBUTE_value(x,loc);

crypto/x509/x509_att.c:110:1: return from a call to X509at_get_attr
    108.   	else
    109.   		return sk_X509_ATTRIBUTE_value(x,loc);
    110. > }
    111.   
    112.   X509_ATTRIBUTE *X509at_delete_attr(STACK_OF(X509_ATTRIBUTE) *x, int loc)

crypto/x509/x509_req.c:281:1: return from a call to X509_REQ_get_attr
  279.   {
  280.   	return X509at_get_attr(req->req_info->attributes, loc);
  281. > }
  282.   
  283.   X509_ATTRIBUTE *X509_REQ_delete_attr(X509_REQ *req, int loc)

crypto/x509/x509_req.c:200:6: Taking false branch
198.   			continue;
199.   		attr = X509_REQ_get_attr(req, idx);
200.   		if(attr->single) ext = attr->value.single;
            ^
201.   		else if(sk_ASN1_TYPE_num(attr->value.set))
202.   			ext = sk_ASN1_TYPE_value(attr->value.set, 0);

STACK_OF(X509_EXTENSION) *X509_REQ_get_extensions(X509_REQ *req)
	{
	X509_ATTRIBUTE *attr;
	ASN1_TYPE *ext = NULL;
	int idx, *pnid;
	const unsigned char *p;
	if ((req == NULL) || (req->req_info == NULL) || !ext_nids)
		return(NULL);
	for (pnid = ext_nids; *pnid != NID_undef; pnid++)
		{
		idx = X509_REQ_get_attr_by_NID(req, *pnid, -1);
		if (idx == -1)
			continue;
		attr = X509_REQ_get_attr(req, idx);
		if(attr->single) ext = attr->value.single;
		else if(sk_ASN1_TYPE_num(attr->value.set))
			ext = sk_ASN1_TYPE_value(attr->value.set, 0);
		break;
		}
	if(!ext || (ext->type != V_ASN1_SEQUENCE))
		return NULL;
	p = ext->value.sequence->data;
	return d2i_ASN1_SET_OF_X509_EXTENSION(NULL, &p,
			ext->value.sequence->length,
			d2i_X509_EXTENSION, X509_EXTENSION_free,
			V_ASN1_SEQUENCE, V_ASN1_UNIVERSAL);
}
['STACK_OF(X509_EXTENSION) *X509_REQ_get_extensions(X509_REQ *req)\n\t{\n\tX509_ATTRIBUTE *attr;\n\tASN1_TYPE *ext = NULL;\n\tint idx, *pnid;\n\tconst unsigned char *p;\n\tif ((req == NULL) || (req->req_info == NULL) || !ext_nids)\n\t\treturn(NULL);\n\tfor (pnid = ext_nids; *pnid != NID_undef; pnid++)\n\t\t{\n\t\tidx = X509_REQ_get_attr_by_NID(req, *pnid, -1);\n\t\tif (idx == -1)\n\t\t\tcontinue;\n\t\tattr = X509_REQ_get_attr(req, idx);\n\t\tif(attr->single) ext = attr->value.single;\n\t\telse if(sk_ASN1_TYPE_num(attr->value.set))\n\t\t\text = sk_ASN1_TYPE_value(attr->value.set, 0);\n\t\tbreak;\n\t\t}\n\tif(!ext || (ext->type != V_ASN1_SEQUENCE))\n\t\treturn NULL;\n\tp = ext->value.sequence->data;\n\treturn d2i_ASN1_SET_OF_X509_EXTENSION(NULL, &p,\n\t\t\text->value.sequence->length,\n\t\t\td2i_X509_EXTENSION, X509_EXTENSION_free,\n\t\t\tV_ASN1_SEQUENCE, V_ASN1_UNIVERSAL);\n}', 'int X509_REQ_get_attr_by_NID(const X509_REQ *req, int nid,\n\t\t\t  int lastpos)\n{\n\treturn X509at_get_attr_by_NID(req->req_info->attributes, nid, lastpos);\n}', 'int X509at_get_attr_by_NID(const STACK_OF(X509_ATTRIBUTE) *x, int nid,\n\t\t\t  int lastpos)\n{\n\tASN1_OBJECT *obj;\n\tobj=OBJ_nid2obj(nid);\n\tif (obj == NULL) return(-2);\n\treturn(X509at_get_attr_by_OBJ(x,obj,lastpos));\n}', 'ASN1_OBJECT *OBJ_nid2obj(int n)\n\t{\n\tADDED_OBJ ad,*adp;\n\tASN1_OBJECT ob;\n\tif ((n >= 0) && (n < NUM_NID))\n\t\t{\n\t\tif ((n != NID_undef) && (nid_objs[n].nid == NID_undef))\n\t\t\t{\n\t\t\tOBJerr(OBJ_F_OBJ_NID2OBJ,OBJ_R_UNKNOWN_NID);\n\t\t\treturn(NULL);\n\t\t\t}\n\t\treturn((ASN1_OBJECT *)&(nid_objs[n]));\n\t\t}\n\telse if (added == NULL)\n\t\treturn(NULL);\n\telse\n\t\t{\n\t\tad.type=ADDED_NID;\n\t\tad.obj= &ob;\n\t\tob.nid=n;\n\t\tadp=(ADDED_OBJ *)lh_retrieve(added,&ad);\n\t\tif (adp != NULL)\n\t\t\treturn(adp->obj);\n\t\telse\n\t\t\t{\n\t\t\tOBJerr(OBJ_F_OBJ_NID2OBJ,OBJ_R_UNKNOWN_NID);\n\t\t\treturn(NULL);\n\t\t\t}\n\t\t}\n\t}', 'void ERR_put_error(int lib, int func, int reason, const char *file,\n\t     int line)\n\t{\n\tERR_STATE *es;\n#ifdef _OSD_POSIX\n\tif (strncmp(file,"*POSIX(", sizeof("*POSIX(")-1) == 0) {\n\t\tchar *end;\n\t\tfile += sizeof("*POSIX(")-1;\n\t\tend = &file[strlen(file)-1];\n\t\tif (*end == \')\')\n\t\t\t*end = \'\\0\';\n\t\tif ((end = strrchr(file, \'/\')) != NULL)\n\t\t\tfile = &end[1];\n\t}\n#endif\n\tes=ERR_get_state();\n\tes->top=(es->top+1)%ERR_NUM_ERRORS;\n\tif (es->top == es->bottom)\n\t\tes->bottom=(es->bottom+1)%ERR_NUM_ERRORS;\n\tes->err_flags[es->top]=0;\n\tes->err_buffer[es->top]=ERR_PACK(lib,func,reason);\n\tes->err_file[es->top]=file;\n\tes->err_line[es->top]=line;\n\terr_clear_data(es,es->top);\n\t}', 'X509_ATTRIBUTE *X509_REQ_get_attr(const X509_REQ *req, int loc)\n{\n\treturn X509at_get_attr(req->req_info->attributes, loc);\n}', 'X509_ATTRIBUTE *X509at_get_attr(const STACK_OF(X509_ATTRIBUTE) *x, int loc)\n{\n\tif (x == NULL || sk_X509_ATTRIBUTE_num(x) <= loc || loc < 0)\n\t\treturn NULL;\n\telse\n\t\treturn sk_X509_ATTRIBUTE_value(x,loc);\n}', 'int sk_num(const STACK *st)\n{\n\tif(st == NULL) return -1;\n\treturn st->num;\n}']