crypto/x509v3/v3_utl.c:366: error: NULL_DEREFERENCE
  pointer `&values` last assigned on line 294 could be null and is dereferenced by call to `X509V3_add_value()` at line 366, column 9.
Showing all 54 steps of the trace


crypto/x509v3/v3_utl.c:290:1: start of procedure X509V3_parse_list()
288.    */
289.   
290. > STACK_OF(CONF_VALUE) *X509V3_parse_list(const char *line)
291.   {
292.       char *p, *q, c;

crypto/x509v3/v3_utl.c:294:5: 
292.       char *p, *q, c;
293.       char *ntmp, *vtmp;
294. >     STACK_OF(CONF_VALUE) *values = NULL;
295.       char *linebuf;
296.       int state;

crypto/x509v3/v3_utl.c:298:5: 
296.       int state;
297.       /* We are going to modify the line so copy it first */
298. >     linebuf = OPENSSL_strdup(line);
299.       if (linebuf == NULL) {
300.           X509V3err(X509V3_F_X509V3_PARSE_LIST, ERR_R_MALLOC_FAILURE);

crypto/o_str.c:120:1: start of procedure CRYPTO_strdup()
  118.   }
  119.   
  120. > char *CRYPTO_strdup(const char *str, const char* file, int line)
  121.   {
  122.       char *ret;

crypto/o_str.c:124:9: Taking false branch
  122.       char *ret;
  123.   
  124.       if (str == NULL)
                 ^
  125.           return NULL;
  126.       ret = CRYPTO_malloc(strlen(str) + 1, file, line);

crypto/o_str.c:126:5: 
  124.       if (str == NULL)
  125.           return NULL;
  126. >     ret = CRYPTO_malloc(strlen(str) + 1, file, line);
  127.       if (ret != NULL)
  128.           strcpy(ret, str);

crypto/mem.c:119:1: start of procedure CRYPTO_malloc()
    117.   }
    118.   
    119. > void *CRYPTO_malloc(size_t num, const char *file, int line)
    120.   {
    121.       void *ret = NULL;

crypto/mem.c:121:5: 
    119.   void *CRYPTO_malloc(size_t num, const char *file, int line)
    120.   {
    121. >     void *ret = NULL;
    122.   
    123.       if (num <= 0)

crypto/mem.c:123:9: Taking false branch
    121.       void *ret = NULL;
    122.   
    123.       if (num <= 0)
                   ^
    124.           return NULL;
    125.   

crypto/mem.c:126:5: 
    124.           return NULL;
    125.   
    126. >     allow_customize = 0;
    127.   #ifndef OPENSSL_NO_CRYPTO_MDEBUG
    128.       if (call_malloc_debug) {

crypto/mem.c:136:5: 
    134.       }
    135.   #else
    136. >     (void)file;
    137.       (void)line;
    138.       ret = malloc(num);

crypto/mem.c:137:5: 
    135.   #else
    136.       (void)file;
    137. >     (void)line;
    138.       ret = malloc(num);
    139.   #endif

crypto/mem.c:138:5: 
    136.       (void)file;
    137.       (void)line;
    138. >     ret = malloc(num);
    139.   #endif
    140.   

crypto/mem.c:153:5: 
    151.   #endif
    152.   
    153. >     return ret;
    154.   }
    155.   

crypto/mem.c:154:1: return from a call to CRYPTO_malloc
    152.   
    153.       return ret;
    154. > }
    155.   
    156.   void *CRYPTO_zalloc(size_t num, const char *file, int line)

crypto/o_str.c:127:9: Taking true branch
  125.           return NULL;
  126.       ret = CRYPTO_malloc(strlen(str) + 1, file, line);
  127.       if (ret != NULL)
                 ^
  128.           strcpy(ret, str);
  129.       return ret;

crypto/o_str.c:128:9: 
  126.       ret = CRYPTO_malloc(strlen(str) + 1, file, line);
  127.       if (ret != NULL)
  128. >         strcpy(ret, str);
  129.       return ret;
  130.   }

crypto/o_str.c:129:5: 
  127.       if (ret != NULL)
  128.           strcpy(ret, str);
  129. >     return ret;
  130.   }
  131.   

crypto/o_str.c:130:1: return from a call to CRYPTO_strdup
  128.           strcpy(ret, str);
  129.       return ret;
  130. > }
  131.   
  132.   char *CRYPTO_strndup(const char *str, size_t s, const char* file, int line)

crypto/x509v3/v3_utl.c:299:9: Taking false branch
297.       /* We are going to modify the line so copy it first */
298.       linebuf = OPENSSL_strdup(line);
299.       if (linebuf == NULL) {
               ^
300.           X509V3err(X509V3_F_X509V3_PARSE_LIST, ERR_R_MALLOC_FAILURE);
301.           goto err;

crypto/x509v3/v3_utl.c:303:5: 
301.           goto err;
302.       }
303. >     state = HDR_NAME;
304.       ntmp = NULL;
305.       /* Go through all characters */

crypto/x509v3/v3_utl.c:304:5: 
302.       }
303.       state = HDR_NAME;
304. >     ntmp = NULL;
305.       /* Go through all characters */
306.       for (p = linebuf, q = linebuf; (c = *p) && (c != '\r') && (c != '\n');

crypto/x509v3/v3_utl.c:306:10: 
304.       ntmp = NULL;
305.       /* Go through all characters */
306. >     for (p = linebuf, q = linebuf; (c = *p) && (c != '\r') && (c != '\n');
307.            p++) {
308.   

crypto/x509v3/v3_utl.c:306:37: 
304.       ntmp = NULL;
305.       /* Go through all characters */
306. >     for (p = linebuf, q = linebuf; (c = *p) && (c != '\r') && (c != '\n');
307.            p++) {
308.   

crypto/x509v3/v3_utl.c:306:36: Loop condition is true. Entering loop body
304.       ntmp = NULL;
305.       /* Go through all characters */
306.       for (p = linebuf, q = linebuf; (c = *p) && (c != '\r') && (c != '\n');
                                          ^
307.            p++) {
308.   

crypto/x509v3/v3_utl.c:306:49: Loop condition is false. Leaving loop
304.       ntmp = NULL;
305.       /* Go through all characters */
306.       for (p = linebuf, q = linebuf; (c = *p) && (c != '\r') && (c != '\n');
                                                       ^
307.            p++) {
308.   

crypto/x509v3/v3_utl.c:352:9: Taking false branch
350.       }
351.   
352.       if (state == HDR_VALUE) {
               ^
353.           vtmp = strip_spaces(q);
354.           if (!vtmp) {

crypto/x509v3/v3_utl.c:361:9: Skipping strip_spaces(): empty list of specs
359.           X509V3_add_value(ntmp, vtmp, &values);
360.       } else {
361.           ntmp = strip_spaces(q);
               ^
362.           if (!ntmp) {
363.               X509V3err(X509V3_F_X509V3_PARSE_LIST, X509V3_R_INVALID_NULL_NAME);

crypto/x509v3/v3_utl.c:362:14: Taking false branch
360.       } else {
361.           ntmp = strip_spaces(q);
362.           if (!ntmp) {
                    ^
363.               X509V3err(X509V3_F_X509V3_PARSE_LIST, X509V3_R_INVALID_NULL_NAME);
364.               goto err;

crypto/x509v3/v3_utl.c:366:9: 
364.               goto err;
365.           }
366. >         X509V3_add_value(ntmp, NULL, &values);
367.       }
368.       OPENSSL_free(linebuf);

crypto/x509v3/v3_utl.c:82:1: start of procedure X509V3_add_value()
  80.   /* Add a CONF_VALUE name value pair to stack */
  81.   
  82. > int X509V3_add_value(const char *name, const char *value,
  83.                        STACK_OF(CONF_VALUE) **extlist)
  84.   {

crypto/x509v3/v3_utl.c:85:5: 
  83.                        STACK_OF(CONF_VALUE) **extlist)
  84.   {
  85. >     CONF_VALUE *vtmp = NULL;
  86.       char *tname = NULL, *tvalue = NULL;
  87.   

crypto/x509v3/v3_utl.c:86:5: 
  84.   {
  85.       CONF_VALUE *vtmp = NULL;
  86. >     char *tname = NULL, *tvalue = NULL;
  87.   
  88.       if (name && (tname = OPENSSL_strdup(name)) == NULL)

crypto/x509v3/v3_utl.c:88:9: Taking false branch
  86.       char *tname = NULL, *tvalue = NULL;
  87.   
  88.       if (name && (tname = OPENSSL_strdup(name)) == NULL)
                ^
  89.           goto err;
  90.       if (value && (tvalue = OPENSSL_strdup(value)) == NULL)

crypto/x509v3/v3_utl.c:90:9: Taking false branch
  88.       if (name && (tname = OPENSSL_strdup(name)) == NULL)
  89.           goto err;
  90.       if (value && (tvalue = OPENSSL_strdup(value)) == NULL)
                ^
  91.           goto err;
  92.       if ((vtmp = OPENSSL_malloc(sizeof(*vtmp))) == NULL)

crypto/x509v3/v3_utl.c:92:9: 
  90.       if (value && (tvalue = OPENSSL_strdup(value)) == NULL)
  91.           goto err;
  92. >     if ((vtmp = OPENSSL_malloc(sizeof(*vtmp))) == NULL)
  93.           goto err;
  94.       if (*extlist == NULL && (*extlist = sk_CONF_VALUE_new_null()) == NULL)

crypto/mem.c:119:1: start of procedure CRYPTO_malloc()
    117.   }
    118.   
    119. > void *CRYPTO_malloc(size_t num, const char *file, int line)
    120.   {
    121.       void *ret = NULL;

crypto/mem.c:121:5: 
    119.   void *CRYPTO_malloc(size_t num, const char *file, int line)
    120.   {
    121. >     void *ret = NULL;
    122.   
    123.       if (num <= 0)

crypto/mem.c:123:9: Taking false branch
    121.       void *ret = NULL;
    122.   
    123.       if (num <= 0)
                   ^
    124.           return NULL;
    125.   

crypto/mem.c:126:5: 
    124.           return NULL;
    125.   
    126. >     allow_customize = 0;
    127.   #ifndef OPENSSL_NO_CRYPTO_MDEBUG
    128.       if (call_malloc_debug) {

crypto/mem.c:136:5: 
    134.       }
    135.   #else
    136. >     (void)file;
    137.       (void)line;
    138.       ret = malloc(num);

crypto/mem.c:137:5: 
    135.   #else
    136.       (void)file;
    137. >     (void)line;
    138.       ret = malloc(num);
    139.   #endif

crypto/mem.c:138:5: 
    136.       (void)file;
    137.       (void)line;
    138. >     ret = malloc(num);
    139.   #endif
    140.   

crypto/mem.c:153:5: 
    151.   #endif
    152.   
    153. >     return ret;
    154.   }
    155.   

crypto/mem.c:154:1: return from a call to CRYPTO_malloc
    152.   
    153.       return ret;
    154. > }
    155.   
    156.   void *CRYPTO_zalloc(size_t num, const char *file, int line)

crypto/x509v3/v3_utl.c:92:9: Taking false branch
  90.       if (value && (tvalue = OPENSSL_strdup(value)) == NULL)
  91.           goto err;
  92.       if ((vtmp = OPENSSL_malloc(sizeof(*vtmp))) == NULL)
                ^
  93.           goto err;
  94.       if (*extlist == NULL && (*extlist = sk_CONF_VALUE_new_null()) == NULL)

crypto/x509v3/v3_utl.c:94:9: Taking false branch
  92.       if ((vtmp = OPENSSL_malloc(sizeof(*vtmp))) == NULL)
  93.           goto err;
  94.       if (*extlist == NULL && (*extlist = sk_CONF_VALUE_new_null()) == NULL)
                ^
  95.           goto err;
  96.       vtmp->section = NULL;

crypto/x509v3/v3_utl.c:96:5: 
  94.       if (*extlist == NULL && (*extlist = sk_CONF_VALUE_new_null()) == NULL)
  95.           goto err;
  96. >     vtmp->section = NULL;
  97.       vtmp->name = tname;
  98.       vtmp->value = tvalue;

crypto/x509v3/v3_utl.c:97:5: 
  95.           goto err;
  96.       vtmp->section = NULL;
  97. >     vtmp->name = tname;
  98.       vtmp->value = tvalue;
  99.       if (!sk_CONF_VALUE_push(*extlist, vtmp))

crypto/x509v3/v3_utl.c:98:5: 
  96.       vtmp->section = NULL;
  97.       vtmp->name = tname;
  98. >     vtmp->value = tvalue;
  99.       if (!sk_CONF_VALUE_push(*extlist, vtmp))
  100.           goto err;

crypto/x509v3/v3_utl.c:99:10: 
  97.       vtmp->name = tname;
  98.       vtmp->value = tvalue;
  99. >     if (!sk_CONF_VALUE_push(*extlist, vtmp))
  100.           goto err;
  101.       return 1;

include/openssl/conf.h:79:1: start of procedure sk_CONF_VALUE_push()
    77.   } CONF_VALUE;
    78.   
    79. > DEFINE_STACK_OF(CONF_VALUE)
    80.   DEFINE_LHASH_OF(CONF_VALUE);
    81.   

crypto/stack/stack.c:258:1: start of procedure sk_push()
      256.   }
      257.   
      258. > int sk_push(_STACK *st, void *data)
      259.   {
      260.       return (sk_insert(st, data, st->num));

crypto/stack/stack.c:260:5: 
      258.   int sk_push(_STACK *st, void *data)
      259.   {
      260. >     return (sk_insert(st, data, st->num));
      261.   }
      262.   

STACK_OF(CONF_VALUE) *X509V3_parse_list(const char *line)
{
    char *p, *q, c;
    char *ntmp, *vtmp;
    STACK_OF(CONF_VALUE) *values = NULL;
    char *linebuf;
    int state;
    linebuf = OPENSSL_strdup(line);
    if (linebuf == NULL) {
        X509V3err(X509V3_F_X509V3_PARSE_LIST, ERR_R_MALLOC_FAILURE);
        goto err;
    }
    state = HDR_NAME;
    ntmp = NULL;
    for (p = linebuf, q = linebuf; (c = *p) && (c != '\r') && (c != '\n');
         p++) {
        switch (state) {
        case HDR_NAME:
            if (c == ':') {
                state = HDR_VALUE;
                *p = 0;
                ntmp = strip_spaces(q);
                if (!ntmp) {
                    X509V3err(X509V3_F_X509V3_PARSE_LIST,
                              X509V3_R_INVALID_NULL_NAME);
                    goto err;
                }
                q = p + 1;
            } else if (c == ',') {
                *p = 0;
                ntmp = strip_spaces(q);
                q = p + 1;
                if (!ntmp) {
                    X509V3err(X509V3_F_X509V3_PARSE_LIST,
                              X509V3_R_INVALID_NULL_NAME);
                    goto err;
                }
                X509V3_add_value(ntmp, NULL, &values);
            }
            break;
        case HDR_VALUE:
            if (c == ',') {
                state = HDR_NAME;
                *p = 0;
                vtmp = strip_spaces(q);
                if (!vtmp) {
                    X509V3err(X509V3_F_X509V3_PARSE_LIST,
                              X509V3_R_INVALID_NULL_VALUE);
                    goto err;
                }
                X509V3_add_value(ntmp, vtmp, &values);
                ntmp = NULL;
                q = p + 1;
            }
        }
    }
    if (state == HDR_VALUE) {
        vtmp = strip_spaces(q);
        if (!vtmp) {
            X509V3err(X509V3_F_X509V3_PARSE_LIST,
                      X509V3_R_INVALID_NULL_VALUE);
            goto err;
        }
        X509V3_add_value(ntmp, vtmp, &values);
    } else {
        ntmp = strip_spaces(q);
        if (!ntmp) {
            X509V3err(X509V3_F_X509V3_PARSE_LIST, X509V3_R_INVALID_NULL_NAME);
            goto err;
        }
        X509V3_add_value(ntmp, NULL, &values);
    }
    OPENSSL_free(linebuf);
    return values;
 err:
    OPENSSL_free(linebuf);
    sk_CONF_VALUE_pop_free(values, X509V3_conf_free);
    return NULL;
}
["STACK_OF(CONF_VALUE) *X509V3_parse_list(const char *line)\n{\n    char *p, *q, c;\n    char *ntmp, *vtmp;\n    STACK_OF(CONF_VALUE) *values = NULL;\n    char *linebuf;\n    int state;\n    linebuf = OPENSSL_strdup(line);\n    if (linebuf == NULL) {\n        X509V3err(X509V3_F_X509V3_PARSE_LIST, ERR_R_MALLOC_FAILURE);\n        goto err;\n    }\n    state = HDR_NAME;\n    ntmp = NULL;\n    for (p = linebuf, q = linebuf; (c = *p) && (c != '\\r') && (c != '\\n');\n         p++) {\n        switch (state) {\n        case HDR_NAME:\n            if (c == ':') {\n                state = HDR_VALUE;\n                *p = 0;\n                ntmp = strip_spaces(q);\n                if (!ntmp) {\n                    X509V3err(X509V3_F_X509V3_PARSE_LIST,\n                              X509V3_R_INVALID_NULL_NAME);\n                    goto err;\n                }\n                q = p + 1;\n            } else if (c == ',') {\n                *p = 0;\n                ntmp = strip_spaces(q);\n                q = p + 1;\n                if (!ntmp) {\n                    X509V3err(X509V3_F_X509V3_PARSE_LIST,\n                              X509V3_R_INVALID_NULL_NAME);\n                    goto err;\n                }\n                X509V3_add_value(ntmp, NULL, &values);\n            }\n            break;\n        case HDR_VALUE:\n            if (c == ',') {\n                state = HDR_NAME;\n                *p = 0;\n                vtmp = strip_spaces(q);\n                if (!vtmp) {\n                    X509V3err(X509V3_F_X509V3_PARSE_LIST,\n                              X509V3_R_INVALID_NULL_VALUE);\n                    goto err;\n                }\n                X509V3_add_value(ntmp, vtmp, &values);\n                ntmp = NULL;\n                q = p + 1;\n            }\n        }\n    }\n    if (state == HDR_VALUE) {\n        vtmp = strip_spaces(q);\n        if (!vtmp) {\n            X509V3err(X509V3_F_X509V3_PARSE_LIST,\n                      X509V3_R_INVALID_NULL_VALUE);\n            goto err;\n        }\n        X509V3_add_value(ntmp, vtmp, &values);\n    } else {\n        ntmp = strip_spaces(q);\n        if (!ntmp) {\n            X509V3err(X509V3_F_X509V3_PARSE_LIST, X509V3_R_INVALID_NULL_NAME);\n            goto err;\n        }\n        X509V3_add_value(ntmp, NULL, &values);\n    }\n    OPENSSL_free(linebuf);\n    return values;\n err:\n    OPENSSL_free(linebuf);\n    sk_CONF_VALUE_pop_free(values, X509V3_conf_free);\n    return NULL;\n}", 'char *CRYPTO_strdup(const char *str, const char* file, int line)\n{\n    char *ret;\n    if (str == NULL)\n        return NULL;\n    ret = CRYPTO_malloc(strlen(str) + 1, file, line);\n    if (ret != NULL)\n        strcpy(ret, str);\n    return ret;\n}', 'void *CRYPTO_malloc(size_t num, const char *file, int line)\n{\n    void *ret = NULL;\n    if (num <= 0)\n        return NULL;\n    allow_customize = 0;\n#ifndef OPENSSL_NO_CRYPTO_MDEBUG\n    if (call_malloc_debug) {\n        CRYPTO_mem_debug_malloc(NULL, num, 0, file, line);\n        ret = malloc(num);\n        CRYPTO_mem_debug_malloc(ret, num, 1, file, line);\n    } else {\n        ret = malloc(num);\n    }\n#else\n    (void)file;\n    (void)line;\n    ret = malloc(num);\n#endif\n#ifndef OPENSSL_CPUID_OBJ\n    if (ret && (num > 2048)) {\n        extern unsigned char cleanse_ctr;\n        ((unsigned char *)ret)[0] = cleanse_ctr;\n    }\n#endif\n    return ret;\n}', 'int X509V3_add_value(const char *name, const char *value,\n                     STACK_OF(CONF_VALUE) **extlist)\n{\n    CONF_VALUE *vtmp = NULL;\n    char *tname = NULL, *tvalue = NULL;\n    if (name && (tname = OPENSSL_strdup(name)) == NULL)\n        goto err;\n    if (value && (tvalue = OPENSSL_strdup(value)) == NULL)\n        goto err;\n    if ((vtmp = OPENSSL_malloc(sizeof(*vtmp))) == NULL)\n        goto err;\n    if (*extlist == NULL && (*extlist = sk_CONF_VALUE_new_null()) == NULL)\n        goto err;\n    vtmp->section = NULL;\n    vtmp->name = tname;\n    vtmp->value = tvalue;\n    if (!sk_CONF_VALUE_push(*extlist, vtmp))\n        goto err;\n    return 1;\n err:\n    X509V3err(X509V3_F_X509V3_ADD_VALUE, ERR_R_MALLOC_FAILURE);\n    OPENSSL_free(vtmp);\n    OPENSSL_free(tname);\n    OPENSSL_free(tvalue);\n    return 0;\n}', 'int sk_push(_STACK *st, void *data)\n{\n    return (sk_insert(st, data, st->num));\n}']