crypto/x509v3/v3_cpols.c:142: error: NULL_DEREFERENCE
  pointer `pols` last assigned on line 111 could be null and is dereferenced by call to `sk_POLICYINFO_push()` at line 142, column 3.
Showing all 37 steps of the trace


crypto/x509v3/v3_cpols.c:101:1: start of procedure r2i_certpol()
99.    */
100.   
101. > static STACK_OF(POLICYINFO) *r2i_certpol(X509V3_EXT_METHOD *method,
102.   		X509V3_CTX *ctx, char *value)
103.   {

crypto/x509v3/v3_cpols.c:104:2: 
102.   		X509V3_CTX *ctx, char *value)
103.   {
104. > 	STACK_OF(POLICYINFO) *pols = NULL;
105.   	char *pstr;
106.   	POLICYINFO *pol;

crypto/x509v3/v3_cpols.c:111:2: 
109.   	CONF_VALUE *cnf;
110.   	int i;
111. > 	pols = sk_POLICYINFO_new_null();
112.   	vals =  X509V3_parse_list(value);
113.   	for(i = 0; i < sk_num(vals); i++) {

crypto/x509v3/v3_cpols.c:360:1: start of procedure sk_POLICYINFO_new_null()
  358.   }
  359.   
  360. > IMPLEMENT_STACK_OF(POLICYINFO)
  361.   IMPLEMENT_ASN1_SET_OF(POLICYINFO)
  362.   

crypto/stack/stack.c:117:1: start of procedure sk_new()
    115.   	}
    116.   
    117. > STACK *sk_new(int (*c)())
    118.   	{
    119.   	STACK *ret;

crypto/stack/stack.c:122:6: Taking true branch
    120.   	int i;
    121.   
    122.   	if ((ret=(STACK *)Malloc(sizeof(STACK))) == NULL)
                ^
    123.   		goto err0;
    124.   	if ((ret->data=(char **)Malloc(sizeof(char *)*MIN_NODES)) == NULL)

crypto/stack/stack.c:135:1: 
    133.   err1:
    134.   	Free((char *)ret);
    135. > err0:
    136.   	return(NULL);
    137.   	}

crypto/stack/stack.c:136:2: 
    134.   	Free((char *)ret);
    135.   err0:
    136. > 	return(NULL);
    137.   	}
    138.   

crypto/stack/stack.c:137:2: return from a call to sk_new
    135.   err0:
    136.   	return(NULL);
    137.   	}
            ^
    138.   
    139.   int sk_insert(STACK *st, char *data, int loc)

crypto/x509v3/v3_cpols.c:360:1: return from a call to sk_POLICYINFO_new_null
  358.   }
  359.   
  360. > IMPLEMENT_STACK_OF(POLICYINFO)
  361.   IMPLEMENT_ASN1_SET_OF(POLICYINFO)
  362.   

crypto/x509v3/v3_cpols.c:112:2: Skipping X509V3_parse_list(): empty list of specs
110.   	int i;
111.   	pols = sk_POLICYINFO_new_null();
112.   	vals =  X509V3_parse_list(value);
        ^
113.   	for(i = 0; i < sk_num(vals); i++) {
114.   		cnf = (CONF_VALUE *)sk_value(vals, i);

crypto/x509v3/v3_cpols.c:113:6: 
111.   	pols = sk_POLICYINFO_new_null();
112.   	vals =  X509V3_parse_list(value);
113. > 	for(i = 0; i < sk_num(vals); i++) {
114.   		cnf = (CONF_VALUE *)sk_value(vals, i);
115.   		if(cnf->value || !cnf->name ) {

crypto/x509v3/v3_cpols.c:113:13: Loop condition is true. Entering loop body
111.   	pols = sk_POLICYINFO_new_null();
112.   	vals =  X509V3_parse_list(value);
113.   	for(i = 0; i < sk_num(vals); i++) {
                   ^
114.   		cnf = (CONF_VALUE *)sk_value(vals, i);
115.   		if(cnf->value || !cnf->name ) {

crypto/x509v3/v3_cpols.c:114:3: 
112.   	vals =  X509V3_parse_list(value);
113.   	for(i = 0; i < sk_num(vals); i++) {
114. > 		cnf = (CONF_VALUE *)sk_value(vals, i);
115.   		if(cnf->value || !cnf->name ) {
116.   			X509V3err(X509V3_F_R2I_CERTPOL,X509V3_R_INVALID_POLICY_IDENTIFIER);

crypto/x509v3/v3_cpols.c:115:6: Taking false branch
113.   	for(i = 0; i < sk_num(vals); i++) {
114.   		cnf = (CONF_VALUE *)sk_value(vals, i);
115.   		if(cnf->value || !cnf->name ) {
            ^
116.   			X509V3err(X509V3_F_R2I_CERTPOL,X509V3_R_INVALID_POLICY_IDENTIFIER);
117.   			X509V3_conf_err(cnf);

crypto/x509v3/v3_cpols.c:115:21: Taking false branch
113.   	for(i = 0; i < sk_num(vals); i++) {
114.   		cnf = (CONF_VALUE *)sk_value(vals, i);
115.   		if(cnf->value || !cnf->name ) {
                           ^
116.   			X509V3err(X509V3_F_R2I_CERTPOL,X509V3_R_INVALID_POLICY_IDENTIFIER);
117.   			X509V3_conf_err(cnf);

crypto/x509v3/v3_cpols.c:120:3: 
118.   			goto err;
119.   		}
120. > 		pstr = cnf->name;
121.   		if(*pstr == '@') {
122.   			STACK *polsect;

crypto/x509v3/v3_cpols.c:121:6: Taking true branch
119.   		}
120.   		pstr = cnf->name;
121.   		if(*pstr == '@') {
            ^
122.   			STACK *polsect;
123.   			polsect = X509V3_get_section(ctx, pstr + 1);

crypto/x509v3/v3_cpols.c:123:4: 
121.   		if(*pstr == '@') {
122.   			STACK *polsect;
123. > 			polsect = X509V3_get_section(ctx, pstr + 1);
124.   			if(!polsect) {
125.   				X509V3err(X509V3_F_R2I_CERTPOL,X509V3_R_INVALID_SECTION);

crypto/x509v3/v3_conf.c:295:1: start of procedure X509V3_get_section()
  293.   }
  294.   
  295. > STACK * X509V3_get_section(X509V3_CTX *ctx, char *section)
  296.   {
  297.   	if(ctx->db_meth->get_section)

crypto/x509v3/v3_conf.c:297:5: Taking true branch
  295.   STACK * X509V3_get_section(X509V3_CTX *ctx, char *section)
  296.   {
  297.   	if(ctx->db_meth->get_section)
             ^
  298.   			return ctx->db_meth->get_section(ctx->db, section);
  299.   	return NULL;

crypto/x509v3/v3_conf.c:298:4: Skipping __function_pointer__(): unresolved function pointer
  296.   {
  297.   	if(ctx->db_meth->get_section)
  298.   			return ctx->db_meth->get_section(ctx->db, section);
            ^
  299.   	return NULL;
  300.   }

crypto/x509v3/v3_conf.c:300:1: return from a call to X509V3_get_section
  298.   			return ctx->db_meth->get_section(ctx->db, section);
  299.   	return NULL;
  300. > }
  301.   
  302.   void X509V3_string_free(X509V3_CTX *ctx, char *str)

crypto/x509v3/v3_cpols.c:124:8: Taking false branch
122.   			STACK *polsect;
123.   			polsect = X509V3_get_section(ctx, pstr + 1);
124.   			if(!polsect) {
              ^
125.   				X509V3err(X509V3_F_R2I_CERTPOL,X509V3_R_INVALID_SECTION);
126.   

crypto/x509v3/v3_cpols.c:130:4: Skipping policy_section(): empty list of specs
128.   				goto err;
129.   			}
130.   			pol = policy_section(ctx, polsect);
          ^
131.   			X509V3_section_free(ctx, polsect);
132.   			if(!pol) goto err;

crypto/x509v3/v3_cpols.c:131:4: 
129.   			}
130.   			pol = policy_section(ctx, polsect);
131. > 			X509V3_section_free(ctx, polsect);
132.   			if(!pol) goto err;
133.   		} else {

crypto/x509v3/v3_conf.c:309:1: start of procedure X509V3_section_free()
  307.   }
  308.   
  309. > void X509V3_section_free(X509V3_CTX *ctx, STACK *section)
  310.   {
  311.   	if(!section) return;

crypto/x509v3/v3_conf.c:311:6: Taking false branch
  309.   void X509V3_section_free(X509V3_CTX *ctx, STACK *section)
  310.   {
  311.   	if(!section) return;
              ^
  312.   	if(ctx->db_meth->free_section)
  313.   			ctx->db_meth->free_section(ctx->db, section);

crypto/x509v3/v3_conf.c:312:5: Taking true branch
  310.   {
  311.   	if(!section) return;
  312.   	if(ctx->db_meth->free_section)
             ^
  313.   			ctx->db_meth->free_section(ctx->db, section);
  314.   }

crypto/x509v3/v3_conf.c:313:4: Skipping __function_pointer__(): unresolved function pointer
  311.   	if(!section) return;
  312.   	if(ctx->db_meth->free_section)
  313.   			ctx->db_meth->free_section(ctx->db, section);
            ^
  314.   }
  315.   

crypto/x509v3/v3_conf.c:312:2: 
  310.   {
  311.   	if(!section) return;
  312. > 	if(ctx->db_meth->free_section)
  313.   			ctx->db_meth->free_section(ctx->db, section);
  314.   }

crypto/x509v3/v3_conf.c:314:1: return from a call to X509V3_section_free
  312.   	if(ctx->db_meth->free_section)
  313.   			ctx->db_meth->free_section(ctx->db, section);
  314. > }
  315.   
  316.   static char *conf_lhash_get_string(void *db, char *section, char *value)

crypto/x509v3/v3_cpols.c:132:8: Taking false branch
130.   			pol = policy_section(ctx, polsect);
131.   			X509V3_section_free(ctx, polsect);
132.   			if(!pol) goto err;
              ^
133.   		} else {
134.   			if(!(pobj = OBJ_txt2obj(cnf->name, 0))) {

crypto/x509v3/v3_cpols.c:142:3: 
140.   			pol->policyid = pobj;
141.   		}
142. > 		sk_POLICYINFO_push(pols, pol);
143.   	}
144.   	sk_pop_free(vals, X509V3_conf_free);

crypto/x509v3/v3_cpols.c:360:1: start of procedure sk_POLICYINFO_push()
  358.   }
  359.   
  360. > IMPLEMENT_STACK_OF(POLICYINFO)
  361.   IMPLEMENT_ASN1_SET_OF(POLICYINFO)
  362.   

crypto/stack/stack.c:239:1: start of procedure sk_push()
    237.   	}
    238.   
    239. > int sk_push(STACK *st, char *data)
    240.   	{
    241.   	return(sk_insert(st,data,st->num));

crypto/stack/stack.c:241:2: Skipping sk_insert(): empty list of specs
    239.   int sk_push(STACK *st, char *data)
    240.   	{
    241.   	return(sk_insert(st,data,st->num));
            ^
    242.   	}
    243.   

static STACK_OF(POLICYINFO) *r2i_certpol(X509V3_EXT_METHOD *method,
		X509V3_CTX *ctx, char *value)
{
	STACK_OF(POLICYINFO) *pols = NULL;
	char *pstr;
	POLICYINFO *pol;
	ASN1_OBJECT *pobj;
	STACK *vals;
	CONF_VALUE *cnf;
	int i;
	pols = sk_POLICYINFO_new_null();
	vals =  X509V3_parse_list(value);
	for(i = 0; i < sk_num(vals); i++) {
		cnf = (CONF_VALUE *)sk_value(vals, i);
		if(cnf->value || !cnf->name ) {
			X509V3err(X509V3_F_R2I_CERTPOL,X509V3_R_INVALID_POLICY_IDENTIFIER);
			X509V3_conf_err(cnf);
			goto err;
		}
		pstr = cnf->name;
		if(*pstr == '@') {
			STACK *polsect;
			polsect = X509V3_get_section(ctx, pstr + 1);
			if(!polsect) {
				X509V3err(X509V3_F_R2I_CERTPOL,X509V3_R_INVALID_SECTION);
				X509V3_conf_err(cnf);
				goto err;
			}
			pol = policy_section(ctx, polsect);
			X509V3_section_free(ctx, polsect);
			if(!pol) goto err;
		} else {
			if(!(pobj = OBJ_txt2obj(cnf->name, 0))) {
				X509V3err(X509V3_F_R2I_CERTPOL,X509V3_R_INVALID_OBJECT_IDENTIFIER);
				X509V3_conf_err(cnf);
				goto err;
			}
			pol = POLICYINFO_new();
			pol->policyid = pobj;
		}
		sk_POLICYINFO_push(pols, pol);
	}
	sk_pop_free(vals, X509V3_conf_free);
	return pols;
	err:
	sk_POLICYINFO_pop_free(pols, POLICYINFO_free);
	return NULL;
}
["static STACK_OF(POLICYINFO) *r2i_certpol(X509V3_EXT_METHOD *method,\n\t\tX509V3_CTX *ctx, char *value)\n{\n\tSTACK_OF(POLICYINFO) *pols = NULL;\n\tchar *pstr;\n\tPOLICYINFO *pol;\n\tASN1_OBJECT *pobj;\n\tSTACK *vals;\n\tCONF_VALUE *cnf;\n\tint i;\n\tpols = sk_POLICYINFO_new_null();\n\tvals =  X509V3_parse_list(value);\n\tfor(i = 0; i < sk_num(vals); i++) {\n\t\tcnf = (CONF_VALUE *)sk_value(vals, i);\n\t\tif(cnf->value || !cnf->name ) {\n\t\t\tX509V3err(X509V3_F_R2I_CERTPOL,X509V3_R_INVALID_POLICY_IDENTIFIER);\n\t\t\tX509V3_conf_err(cnf);\n\t\t\tgoto err;\n\t\t}\n\t\tpstr = cnf->name;\n\t\tif(*pstr == '@') {\n\t\t\tSTACK *polsect;\n\t\t\tpolsect = X509V3_get_section(ctx, pstr + 1);\n\t\t\tif(!polsect) {\n\t\t\t\tX509V3err(X509V3_F_R2I_CERTPOL,X509V3_R_INVALID_SECTION);\n\t\t\t\tX509V3_conf_err(cnf);\n\t\t\t\tgoto err;\n\t\t\t}\n\t\t\tpol = policy_section(ctx, polsect);\n\t\t\tX509V3_section_free(ctx, polsect);\n\t\t\tif(!pol) goto err;\n\t\t} else {\n\t\t\tif(!(pobj = OBJ_txt2obj(cnf->name, 0))) {\n\t\t\t\tX509V3err(X509V3_F_R2I_CERTPOL,X509V3_R_INVALID_OBJECT_IDENTIFIER);\n\t\t\t\tX509V3_conf_err(cnf);\n\t\t\t\tgoto err;\n\t\t\t}\n\t\t\tpol = POLICYINFO_new();\n\t\t\tpol->policyid = pobj;\n\t\t}\n\t\tsk_POLICYINFO_push(pols, pol);\n\t}\n\tsk_pop_free(vals, X509V3_conf_free);\n\treturn pols;\n\terr:\n\tsk_POLICYINFO_pop_free(pols, POLICYINFO_free);\n\treturn NULL;\n}", 'IMPLEMENT_STACK_OF(POLICYINFO)', 'STACK *sk_new(int (*c)())\n\t{\n\tSTACK *ret;\n\tint i;\n\tif ((ret=(STACK *)Malloc(sizeof(STACK))) == NULL)\n\t\tgoto err0;\n\tif ((ret->data=(char **)Malloc(sizeof(char *)*MIN_NODES)) == NULL)\n\t\tgoto err1;\n\tfor (i=0; i<MIN_NODES; i++)\n\t\tret->data[i]=NULL;\n\tret->comp=c;\n\tret->num_alloc=MIN_NODES;\n\tret->num=0;\n\tret->sorted=0;\n\treturn(ret);\nerr1:\n\tFree((char *)ret);\nerr0:\n\treturn(NULL);\n\t}', 'STACK * X509V3_get_section(X509V3_CTX *ctx, char *section)\n{\n\tif(ctx->db_meth->get_section)\n\t\t\treturn ctx->db_meth->get_section(ctx->db, section);\n\treturn NULL;\n}', 'void X509V3_section_free(X509V3_CTX *ctx, STACK *section)\n{\n\tif(!section) return;\n\tif(ctx->db_meth->free_section)\n\t\t\tctx->db_meth->free_section(ctx->db, section);\n}', 'int sk_push(STACK *st, char *data)\n\t{\n\treturn(sk_insert(st,data,st->num));\n\t}']