crypto/x509/x509_vpm.c:606: error: NULL_DEREFERENCE
  pointer `ptmp` last assigned on line 605 could be null and is dereferenced by call to `X509_VERIFY_PARAM_free()` at line 606, column 13.
Showing all 28 steps of the trace


crypto/x509/x509_vpm.c:594:1: start of procedure X509_VERIFY_PARAM_add0_table()
592.   }
593.   
594. > int X509_VERIFY_PARAM_add0_table(X509_VERIFY_PARAM *param)
595.   {
596.       int idx;

crypto/x509/x509_vpm.c:598:10: Taking false branch
596.       int idx;
597.       X509_VERIFY_PARAM *ptmp;
598.       if (!param_table) {
                ^
599.           param_table = sk_X509_VERIFY_PARAM_new(param_cmp);
600.           if (!param_table)

crypto/x509/x509_vpm.c:603:15: Condition is true
601.               return 0;
602.       } else {
603.           idx = sk_X509_VERIFY_PARAM_find(param_table, param);
                     ^
604.           if (idx != -1) {
605.               ptmp = sk_X509_VERIFY_PARAM_value(param_table, idx);

crypto/x509/x509_vpm.c:603:15: Condition is true
601.               return 0;
602.       } else {
603.           idx = sk_X509_VERIFY_PARAM_find(param_table, param);
                     ^
604.           if (idx != -1) {
605.               ptmp = sk_X509_VERIFY_PARAM_value(param_table, idx);

crypto/x509/x509_vpm.c:603:9: 
601.               return 0;
602.       } else {
603. >         idx = sk_X509_VERIFY_PARAM_find(param_table, param);
604.           if (idx != -1) {
605.               ptmp = sk_X509_VERIFY_PARAM_value(param_table, idx);

crypto/stack/stack.c:271:1: start of procedure sk_find()
  269.   }
  270.   
  271. > int sk_find(_STACK *st, void *data)
  272.   {
  273.       return internal_find(st, data, OBJ_BSEARCH_FIRST_VALUE_ON_MATCH);

crypto/stack/stack.c:273:5: 
  271.   int sk_find(_STACK *st, void *data)
  272.   {
  273. >     return internal_find(st, data, OBJ_BSEARCH_FIRST_VALUE_ON_MATCH);
  274.   }
  275.   

crypto/stack/stack.c:247:1: start of procedure internal_find()
    245.   }
    246.   
    247. > static int internal_find(_STACK *st, void *data, int ret_val_options)
    248.   {
    249.       const void *const *r;

crypto/stack/stack.c:252:9: Taking false branch
    250.       int i;
    251.   
    252.       if (st == NULL)
                   ^
    253.           return -1;
    254.   

crypto/stack/stack.c:255:9: Taking true branch
    253.           return -1;
    254.   
    255.       if (st->comp == NULL) {
                   ^
    256.           for (i = 0; i < st->num; i++)
    257.               if (st->data[i] == data)

crypto/stack/stack.c:256:14: 
    254.   
    255.       if (st->comp == NULL) {
    256. >         for (i = 0; i < st->num; i++)
    257.               if (st->data[i] == data)
    258.                   return (i);

crypto/stack/stack.c:256:21: Loop condition is true. Entering loop body
    254.   
    255.       if (st->comp == NULL) {
    256.           for (i = 0; i < st->num; i++)
                               ^
    257.               if (st->data[i] == data)
    258.                   return (i);

crypto/stack/stack.c:257:17: Taking false branch
    255.       if (st->comp == NULL) {
    256.           for (i = 0; i < st->num; i++)
    257.               if (st->data[i] == data)
                           ^
    258.                   return (i);
    259.           return (-1);

crypto/stack/stack.c:256:34: 
    254.   
    255.       if (st->comp == NULL) {
    256. >         for (i = 0; i < st->num; i++)
    257.               if (st->data[i] == data)
    258.                   return (i);

crypto/stack/stack.c:256:21: Loop condition is true. Entering loop body
    254.   
    255.       if (st->comp == NULL) {
    256.           for (i = 0; i < st->num; i++)
                               ^
    257.               if (st->data[i] == data)
    258.                   return (i);

crypto/stack/stack.c:257:17: Taking true branch
    255.       if (st->comp == NULL) {
    256.           for (i = 0; i < st->num; i++)
    257.               if (st->data[i] == data)
                           ^
    258.                   return (i);
    259.           return (-1);

crypto/stack/stack.c:258:17: 
    256.           for (i = 0; i < st->num; i++)
    257.               if (st->data[i] == data)
    258. >                 return (i);
    259.           return (-1);
    260.       }

crypto/stack/stack.c:269:1: return from a call to internal_find
    267.           return (-1);
    268.       return (int)((char **)r - st->data);
    269. > }
    270.   
    271.   int sk_find(_STACK *st, void *data)

crypto/stack/stack.c:274:1: return from a call to sk_find
  272.   {
  273.       return internal_find(st, data, OBJ_BSEARCH_FIRST_VALUE_ON_MATCH);
  274. > }
  275.   
  276.   int sk_find_ex(_STACK *st, void *data)

crypto/x509/x509_vpm.c:604:13: Taking true branch
602.       } else {
603.           idx = sk_X509_VERIFY_PARAM_find(param_table, param);
604.           if (idx != -1) {
                   ^
605.               ptmp = sk_X509_VERIFY_PARAM_value(param_table, idx);
606.               X509_VERIFY_PARAM_free(ptmp);

crypto/x509/x509_vpm.c:605:20: Condition is true
603.           idx = sk_X509_VERIFY_PARAM_find(param_table, param);
604.           if (idx != -1) {
605.               ptmp = sk_X509_VERIFY_PARAM_value(param_table, idx);
                          ^
606.               X509_VERIFY_PARAM_free(ptmp);
607.               (void)sk_X509_VERIFY_PARAM_delete(param_table, idx);

crypto/x509/x509_vpm.c:605:13: 
603.           idx = sk_X509_VERIFY_PARAM_find(param_table, param);
604.           if (idx != -1) {
605. >             ptmp = sk_X509_VERIFY_PARAM_value(param_table, idx);
606.               X509_VERIFY_PARAM_free(ptmp);
607.               (void)sk_X509_VERIFY_PARAM_delete(param_table, idx);

crypto/stack/stack.c:347:1: start of procedure sk_value()
  345.   }
  346.   
  347. > void *sk_value(const _STACK *st, int i)
  348.   {
  349.       if (!st || (i < 0) || (i >= st->num))

crypto/stack/stack.c:349:10: Taking false branch
  347.   void *sk_value(const _STACK *st, int i)
  348.   {
  349.       if (!st || (i < 0) || (i >= st->num))
                  ^
  350.           return NULL;
  351.       return st->data[i];

crypto/stack/stack.c:349:17: Taking true branch
  347.   void *sk_value(const _STACK *st, int i)
  348.   {
  349.       if (!st || (i < 0) || (i >= st->num))
                         ^
  350.           return NULL;
  351.       return st->data[i];

crypto/stack/stack.c:350:9: 
  348.   {
  349.       if (!st || (i < 0) || (i >= st->num))
  350. >         return NULL;
  351.       return st->data[i];
  352.   }

crypto/stack/stack.c:352:1: return from a call to sk_value
  350.           return NULL;
  351.       return st->data[i];
  352. > }
  353.   
  354.   void *sk_set(_STACK *st, int i, void *value)

crypto/x509/x509_vpm.c:606:13: 
604.           if (idx != -1) {
605.               ptmp = sk_X509_VERIFY_PARAM_value(param_table, idx);
606. >             X509_VERIFY_PARAM_free(ptmp);
607.               (void)sk_X509_VERIFY_PARAM_delete(param_table, idx);
608.           }

int X509_VERIFY_PARAM_add0_table(X509_VERIFY_PARAM *param)
{
    int idx;
    X509_VERIFY_PARAM *ptmp;
    if (!param_table) {
        param_table = sk_X509_VERIFY_PARAM_new(param_cmp);
        if (!param_table)
            return 0;
    } else {
        idx = sk_X509_VERIFY_PARAM_find(param_table, param);
        if (idx != -1) {
            ptmp = sk_X509_VERIFY_PARAM_value(param_table, idx);
            X509_VERIFY_PARAM_free(ptmp);
            (void)sk_X509_VERIFY_PARAM_delete(param_table, idx);
        }
    }
    if (!sk_X509_VERIFY_PARAM_push(param_table, param))
        return 0;
    return 1;
}
['int X509_VERIFY_PARAM_add0_table(X509_VERIFY_PARAM *param)\n{\n    int idx;\n    X509_VERIFY_PARAM *ptmp;\n    if (!param_table) {\n        param_table = sk_X509_VERIFY_PARAM_new(param_cmp);\n        if (!param_table)\n            return 0;\n    } else {\n        idx = sk_X509_VERIFY_PARAM_find(param_table, param);\n        if (idx != -1) {\n            ptmp = sk_X509_VERIFY_PARAM_value(param_table, idx);\n            X509_VERIFY_PARAM_free(ptmp);\n            (void)sk_X509_VERIFY_PARAM_delete(param_table, idx);\n        }\n    }\n    if (!sk_X509_VERIFY_PARAM_push(param_table, param))\n        return 0;\n    return 1;\n}', 'int sk_find(_STACK *st, void *data)\n{\n    return internal_find(st, data, OBJ_BSEARCH_FIRST_VALUE_ON_MATCH);\n}', 'static int internal_find(_STACK *st, void *data, int ret_val_options)\n{\n    const void *const *r;\n    int i;\n    if (st == NULL)\n        return -1;\n    if (st->comp == NULL) {\n        for (i = 0; i < st->num; i++)\n            if (st->data[i] == data)\n                return (i);\n        return (-1);\n    }\n    sk_sort(st);\n    if (data == NULL)\n        return (-1);\n    r = OBJ_bsearch_ex_(&data, st->data, st->num, sizeof(void *), st->comp,\n                        ret_val_options);\n    if (r == NULL)\n        return (-1);\n    return (int)((char **)r - st->data);\n}', 'void *sk_value(const _STACK *st, int i)\n{\n    if (!st || (i < 0) || (i >= st->num))\n        return NULL;\n    return st->data[i];\n}']