crypto/x509v3/v3_cpols.c:131: error: NULL_DEREFERENCE
  pointer `pols` last assigned on line 100 could be null and is dereferenced by call to `sk_POLICYINFO_push()` at line 131, column 3.
Showing all 37 steps of the trace


crypto/x509v3/v3_cpols.c:90:1: start of procedure r2i_certpol()
88.   
89.   
90. > static STACK_OF(POLICYINFO) *r2i_certpol(X509V3_EXT_METHOD *method,
91.   		X509V3_CTX *ctx, char *value)
92.   {

crypto/x509v3/v3_cpols.c:93:2: 
91.   		X509V3_CTX *ctx, char *value)
92.   {
93. > 	STACK_OF(POLICYINFO) *pols = NULL;
94.   	char *pstr;
95.   	POLICYINFO *pol;

crypto/x509v3/v3_cpols.c:100:2: 
98.   	CONF_VALUE *cnf;
99.   	int i;
100. > 	pols = sk_POLICYINFO_new_null();
101.   	vals =  X509V3_parse_list(value);
102.   	for(i = 0; i < sk_num(vals); i++) {

crypto/x509v3/v3_cpols.c:344:1: start of procedure sk_POLICYINFO_new_null()
  342.   }
  343.   
  344. > IMPLEMENT_STACK_OF(POLICYINFO)
  345.   IMPLEMENT_ASN1_SET_OF(POLICYINFO)
  346.   

crypto/stack/stack.c:112:1: start of procedure sk_new()
    110.   	}
    111.   
    112. > STACK *sk_new(int (*c)())
    113.   	{
    114.   	STACK *ret;

crypto/stack/stack.c:117:6: Taking true branch
    115.   	int i;
    116.   
    117.   	if ((ret=(STACK *)Malloc(sizeof(STACK))) == NULL)
                ^
    118.   		goto err0;
    119.   	if ((ret->data=(char **)Malloc(sizeof(char *)*MIN_NODES)) == NULL)

crypto/stack/stack.c:130:1: 
    128.   err1:
    129.   	Free((char *)ret);
    130. > err0:
    131.   	return(NULL);
    132.   	}

crypto/stack/stack.c:131:2: 
    129.   	Free((char *)ret);
    130.   err0:
    131. > 	return(NULL);
    132.   	}
    133.   

crypto/stack/stack.c:132:2: return from a call to sk_new
    130.   err0:
    131.   	return(NULL);
    132.   	}
            ^
    133.   
    134.   int sk_insert(STACK *st, char *data, int loc)

crypto/x509v3/v3_cpols.c:344:1: return from a call to sk_POLICYINFO_new_null
  342.   }
  343.   
  344. > IMPLEMENT_STACK_OF(POLICYINFO)
  345.   IMPLEMENT_ASN1_SET_OF(POLICYINFO)
  346.   

crypto/x509v3/v3_cpols.c:101:2: Skipping X509V3_parse_list(): empty list of specs
99.   	int i;
100.   	pols = sk_POLICYINFO_new_null();
101.   	vals =  X509V3_parse_list(value);
        ^
102.   	for(i = 0; i < sk_num(vals); i++) {
103.   		cnf = (CONF_VALUE *)sk_value(vals, i);

crypto/x509v3/v3_cpols.c:102:6: 
100.   	pols = sk_POLICYINFO_new_null();
101.   	vals =  X509V3_parse_list(value);
102. > 	for(i = 0; i < sk_num(vals); i++) {
103.   		cnf = (CONF_VALUE *)sk_value(vals, i);
104.   		if(cnf->value || !cnf->name ) {

crypto/x509v3/v3_cpols.c:102:13: Loop condition is true. Entering loop body
100.   	pols = sk_POLICYINFO_new_null();
101.   	vals =  X509V3_parse_list(value);
102.   	for(i = 0; i < sk_num(vals); i++) {
                   ^
103.   		cnf = (CONF_VALUE *)sk_value(vals, i);
104.   		if(cnf->value || !cnf->name ) {

crypto/x509v3/v3_cpols.c:103:3: 
101.   	vals =  X509V3_parse_list(value);
102.   	for(i = 0; i < sk_num(vals); i++) {
103. > 		cnf = (CONF_VALUE *)sk_value(vals, i);
104.   		if(cnf->value || !cnf->name ) {
105.   			X509V3err(X509V3_F_R2I_CERTPOL,X509V3_R_INVALID_POLICY_IDENTIFIER);

crypto/x509v3/v3_cpols.c:104:6: Taking false branch
102.   	for(i = 0; i < sk_num(vals); i++) {
103.   		cnf = (CONF_VALUE *)sk_value(vals, i);
104.   		if(cnf->value || !cnf->name ) {
            ^
105.   			X509V3err(X509V3_F_R2I_CERTPOL,X509V3_R_INVALID_POLICY_IDENTIFIER);
106.   			X509V3_conf_err(cnf);

crypto/x509v3/v3_cpols.c:104:21: Taking false branch
102.   	for(i = 0; i < sk_num(vals); i++) {
103.   		cnf = (CONF_VALUE *)sk_value(vals, i);
104.   		if(cnf->value || !cnf->name ) {
                           ^
105.   			X509V3err(X509V3_F_R2I_CERTPOL,X509V3_R_INVALID_POLICY_IDENTIFIER);
106.   			X509V3_conf_err(cnf);

crypto/x509v3/v3_cpols.c:109:3: 
107.   			goto err;
108.   		}
109. > 		pstr = cnf->name;
110.   		if(*pstr == '@') {
111.   			STACK *polsect;

crypto/x509v3/v3_cpols.c:110:6: Taking true branch
108.   		}
109.   		pstr = cnf->name;
110.   		if(*pstr == '@') {
            ^
111.   			STACK *polsect;
112.   			polsect = X509V3_get_section(ctx, pstr + 1);

crypto/x509v3/v3_cpols.c:112:4: 
110.   		if(*pstr == '@') {
111.   			STACK *polsect;
112. > 			polsect = X509V3_get_section(ctx, pstr + 1);
113.   			if(!polsect) {
114.   				X509V3err(X509V3_F_R2I_CERTPOL,X509V3_R_INVALID_SECTION);

crypto/x509v3/v3_conf.c:285:1: start of procedure X509V3_get_section()
  283.   }
  284.   
  285. > STACK * X509V3_get_section(X509V3_CTX *ctx, char *section)
  286.   {
  287.   	if(ctx->db_meth->get_section)

crypto/x509v3/v3_conf.c:287:5: Taking true branch
  285.   STACK * X509V3_get_section(X509V3_CTX *ctx, char *section)
  286.   {
  287.   	if(ctx->db_meth->get_section)
             ^
  288.   			return ctx->db_meth->get_section(ctx->db, section);
  289.   	return NULL;

crypto/x509v3/v3_conf.c:288:4: Skipping __function_pointer__(): unresolved function pointer
  286.   {
  287.   	if(ctx->db_meth->get_section)
  288.   			return ctx->db_meth->get_section(ctx->db, section);
            ^
  289.   	return NULL;
  290.   }

crypto/x509v3/v3_conf.c:290:1: return from a call to X509V3_get_section
  288.   			return ctx->db_meth->get_section(ctx->db, section);
  289.   	return NULL;
  290. > }
  291.   
  292.   void X509V3_string_free(X509V3_CTX *ctx, char *str)

crypto/x509v3/v3_cpols.c:113:8: Taking false branch
111.   			STACK *polsect;
112.   			polsect = X509V3_get_section(ctx, pstr + 1);
113.   			if(!polsect) {
              ^
114.   				X509V3err(X509V3_F_R2I_CERTPOL,X509V3_R_INVALID_SECTION);
115.   

crypto/x509v3/v3_cpols.c:119:4: Skipping policy_section(): empty list of specs
117.   				goto err;
118.   			}
119.   			pol = policy_section(ctx, polsect);
          ^
120.   			X509V3_section_free(ctx, polsect);
121.   			if(!pol) goto err;

crypto/x509v3/v3_cpols.c:120:4: 
118.   			}
119.   			pol = policy_section(ctx, polsect);
120. > 			X509V3_section_free(ctx, polsect);
121.   			if(!pol) goto err;
122.   		} else {

crypto/x509v3/v3_conf.c:299:1: start of procedure X509V3_section_free()
  297.   }
  298.   
  299. > void X509V3_section_free(X509V3_CTX *ctx, STACK *section)
  300.   {
  301.   	if(!section) return;

crypto/x509v3/v3_conf.c:301:6: Taking false branch
  299.   void X509V3_section_free(X509V3_CTX *ctx, STACK *section)
  300.   {
  301.   	if(!section) return;
              ^
  302.   	if(ctx->db_meth->free_section)
  303.   			ctx->db_meth->free_section(ctx->db, section);

crypto/x509v3/v3_conf.c:302:5: Taking true branch
  300.   {
  301.   	if(!section) return;
  302.   	if(ctx->db_meth->free_section)
             ^
  303.   			ctx->db_meth->free_section(ctx->db, section);
  304.   }

crypto/x509v3/v3_conf.c:303:4: Skipping __function_pointer__(): unresolved function pointer
  301.   	if(!section) return;
  302.   	if(ctx->db_meth->free_section)
  303.   			ctx->db_meth->free_section(ctx->db, section);
            ^
  304.   }
  305.   

crypto/x509v3/v3_conf.c:302:2: 
  300.   {
  301.   	if(!section) return;
  302. > 	if(ctx->db_meth->free_section)
  303.   			ctx->db_meth->free_section(ctx->db, section);
  304.   }

crypto/x509v3/v3_conf.c:304:1: return from a call to X509V3_section_free
  302.   	if(ctx->db_meth->free_section)
  303.   			ctx->db_meth->free_section(ctx->db, section);
  304. > }
  305.   
  306.   static char *conf_lhash_get_string(void *db, char *section, char *value)

crypto/x509v3/v3_cpols.c:121:8: Taking false branch
119.   			pol = policy_section(ctx, polsect);
120.   			X509V3_section_free(ctx, polsect);
121.   			if(!pol) goto err;
              ^
122.   		} else {
123.   			if(!(pobj = OBJ_txt2obj(cnf->name, 0))) {

crypto/x509v3/v3_cpols.c:131:3: 
129.   			pol->policyid = pobj;
130.   		}
131. > 		sk_POLICYINFO_push(pols, pol);
132.   	}
133.   	sk_pop_free(vals, X509V3_conf_free);

crypto/x509v3/v3_cpols.c:344:1: start of procedure sk_POLICYINFO_push()
  342.   }
  343.   
  344. > IMPLEMENT_STACK_OF(POLICYINFO)
  345.   IMPLEMENT_ASN1_SET_OF(POLICYINFO)
  346.   

crypto/stack/stack.c:237:1: start of procedure sk_push()
    235.   	}
    236.   
    237. > int sk_push(STACK *st, char *data)
    238.   	{
    239.   	return(sk_insert(st,data,st->num));

crypto/stack/stack.c:239:2: Skipping sk_insert(): empty list of specs
    237.   int sk_push(STACK *st, char *data)
    238.   	{
    239.   	return(sk_insert(st,data,st->num));
            ^
    240.   	}
    241.   

static STACK_OF(POLICYINFO) *r2i_certpol(X509V3_EXT_METHOD *method,
		X509V3_CTX *ctx, char *value)
{
	STACK_OF(POLICYINFO) *pols = NULL;
	char *pstr;
	POLICYINFO *pol;
	ASN1_OBJECT *pobj;
	STACK *vals;
	CONF_VALUE *cnf;
	int i;
	pols = sk_POLICYINFO_new_null();
	vals =  X509V3_parse_list(value);
	for(i = 0; i < sk_num(vals); i++) {
		cnf = (CONF_VALUE *)sk_value(vals, i);
		if(cnf->value || !cnf->name ) {
			X509V3err(X509V3_F_R2I_CERTPOL,X509V3_R_INVALID_POLICY_IDENTIFIER);
			X509V3_conf_err(cnf);
			goto err;
		}
		pstr = cnf->name;
		if(*pstr == '@') {
			STACK *polsect;
			polsect = X509V3_get_section(ctx, pstr + 1);
			if(!polsect) {
				X509V3err(X509V3_F_R2I_CERTPOL,X509V3_R_INVALID_SECTION);
				X509V3_conf_err(cnf);
				goto err;
			}
			pol = policy_section(ctx, polsect);
			X509V3_section_free(ctx, polsect);
			if(!pol) goto err;
		} else {
			if(!(pobj = OBJ_txt2obj(cnf->name, 0))) {
				X509V3err(X509V3_F_R2I_CERTPOL,X509V3_R_INVALID_OBJECT_IDENTIFIER);
				X509V3_conf_err(cnf);
				goto err;
			}
			pol = POLICYINFO_new();
			pol->policyid = pobj;
		}
		sk_POLICYINFO_push(pols, pol);
	}
	sk_pop_free(vals, X509V3_conf_free);
	return pols;
	err:
	sk_POLICYINFO_pop_free(pols, POLICYINFO_free);
	return NULL;
}
["static STACK_OF(POLICYINFO) *r2i_certpol(X509V3_EXT_METHOD *method,\n\t\tX509V3_CTX *ctx, char *value)\n{\n\tSTACK_OF(POLICYINFO) *pols = NULL;\n\tchar *pstr;\n\tPOLICYINFO *pol;\n\tASN1_OBJECT *pobj;\n\tSTACK *vals;\n\tCONF_VALUE *cnf;\n\tint i;\n\tpols = sk_POLICYINFO_new_null();\n\tvals =  X509V3_parse_list(value);\n\tfor(i = 0; i < sk_num(vals); i++) {\n\t\tcnf = (CONF_VALUE *)sk_value(vals, i);\n\t\tif(cnf->value || !cnf->name ) {\n\t\t\tX509V3err(X509V3_F_R2I_CERTPOL,X509V3_R_INVALID_POLICY_IDENTIFIER);\n\t\t\tX509V3_conf_err(cnf);\n\t\t\tgoto err;\n\t\t}\n\t\tpstr = cnf->name;\n\t\tif(*pstr == '@') {\n\t\t\tSTACK *polsect;\n\t\t\tpolsect = X509V3_get_section(ctx, pstr + 1);\n\t\t\tif(!polsect) {\n\t\t\t\tX509V3err(X509V3_F_R2I_CERTPOL,X509V3_R_INVALID_SECTION);\n\t\t\t\tX509V3_conf_err(cnf);\n\t\t\t\tgoto err;\n\t\t\t}\n\t\t\tpol = policy_section(ctx, polsect);\n\t\t\tX509V3_section_free(ctx, polsect);\n\t\t\tif(!pol) goto err;\n\t\t} else {\n\t\t\tif(!(pobj = OBJ_txt2obj(cnf->name, 0))) {\n\t\t\t\tX509V3err(X509V3_F_R2I_CERTPOL,X509V3_R_INVALID_OBJECT_IDENTIFIER);\n\t\t\t\tX509V3_conf_err(cnf);\n\t\t\t\tgoto err;\n\t\t\t}\n\t\t\tpol = POLICYINFO_new();\n\t\t\tpol->policyid = pobj;\n\t\t}\n\t\tsk_POLICYINFO_push(pols, pol);\n\t}\n\tsk_pop_free(vals, X509V3_conf_free);\n\treturn pols;\n\terr:\n\tsk_POLICYINFO_pop_free(pols, POLICYINFO_free);\n\treturn NULL;\n}", 'IMPLEMENT_STACK_OF(POLICYINFO)', 'STACK *sk_new(int (*c)())\n\t{\n\tSTACK *ret;\n\tint i;\n\tif ((ret=(STACK *)Malloc(sizeof(STACK))) == NULL)\n\t\tgoto err0;\n\tif ((ret->data=(char **)Malloc(sizeof(char *)*MIN_NODES)) == NULL)\n\t\tgoto err1;\n\tfor (i=0; i<MIN_NODES; i++)\n\t\tret->data[i]=NULL;\n\tret->comp=c;\n\tret->num_alloc=MIN_NODES;\n\tret->num=0;\n\tret->sorted=0;\n\treturn(ret);\nerr1:\n\tFree((char *)ret);\nerr0:\n\treturn(NULL);\n\t}', 'STACK * X509V3_get_section(X509V3_CTX *ctx, char *section)\n{\n\tif(ctx->db_meth->get_section)\n\t\t\treturn ctx->db_meth->get_section(ctx->db, section);\n\treturn NULL;\n}', 'void X509V3_section_free(X509V3_CTX *ctx, STACK *section)\n{\n\tif(!section) return;\n\tif(ctx->db_meth->free_section)\n\t\t\tctx->db_meth->free_section(ctx->db, section);\n}', 'int sk_push(STACK *st, char *data)\n\t{\n\treturn(sk_insert(st,data,st->num));\n\t}']