crypto/ts/ts_rsp_verify.c:416: error: NULL_DEREFERENCE
  pointer `signer` last assigned on line 385 could be null and is dereferenced by call to `ts_check_signer_name()` at line 416, column 25.
Showing all 38 steps of the trace


crypto/ts/ts_rsp_verify.c:382:1: start of procedure int_ts_RESP_verify_token()
380.    *      - Check if the TSA name is the expected TSA.
381.    */
382. > static int int_ts_RESP_verify_token(TS_VERIFY_CTX *ctx,
383.                                       PKCS7 *token, TS_TST_INFO *tst_info)
384.   {

crypto/ts/ts_rsp_verify.c:385:5: 
383.                                       PKCS7 *token, TS_TST_INFO *tst_info)
384.   {
385. >     X509 *signer = NULL;
386.       GENERAL_NAME *tsa_name = tst_info->tsa;
387.       X509_ALGOR *md_alg = NULL;

crypto/ts/ts_rsp_verify.c:386:5: 
384.   {
385.       X509 *signer = NULL;
386. >     GENERAL_NAME *tsa_name = tst_info->tsa;
387.       X509_ALGOR *md_alg = NULL;
388.       unsigned char *imprint = NULL;

crypto/ts/ts_rsp_verify.c:387:5: 
385.       X509 *signer = NULL;
386.       GENERAL_NAME *tsa_name = tst_info->tsa;
387. >     X509_ALGOR *md_alg = NULL;
388.       unsigned char *imprint = NULL;
389.       unsigned imprint_len = 0;

crypto/ts/ts_rsp_verify.c:388:5: 
386.       GENERAL_NAME *tsa_name = tst_info->tsa;
387.       X509_ALGOR *md_alg = NULL;
388. >     unsigned char *imprint = NULL;
389.       unsigned imprint_len = 0;
390.       int ret = 0;

crypto/ts/ts_rsp_verify.c:389:5: 
387.       X509_ALGOR *md_alg = NULL;
388.       unsigned char *imprint = NULL;
389. >     unsigned imprint_len = 0;
390.       int ret = 0;
391.   

crypto/ts/ts_rsp_verify.c:390:5: 
388.       unsigned char *imprint = NULL;
389.       unsigned imprint_len = 0;
390. >     int ret = 0;
391.   
392.       if ((ctx->flags & TS_VFY_SIGNATURE)

crypto/ts/ts_rsp_verify.c:392:10: Taking false branch
390.       int ret = 0;
391.   
392.       if ((ctx->flags & TS_VFY_SIGNATURE)
                ^
393.           && !TS_RESP_verify_signature(token, ctx->certs, ctx->store, &signer))
394.           goto err;

crypto/ts/ts_rsp_verify.c:395:10: Taking false branch
393.           && !TS_RESP_verify_signature(token, ctx->certs, ctx->store, &signer))
394.           goto err;
395.       if ((ctx->flags & TS_VFY_VERSION)
                ^
396.           && TS_TST_INFO_get_version(tst_info) != 1) {
397.           TSerr(TS_F_INT_TS_RESP_VERIFY_TOKEN, TS_R_UNSUPPORTED_VERSION);

crypto/ts/ts_rsp_verify.c:400:10: Taking true branch
398.           goto err;
399.       }
400.       if ((ctx->flags & TS_VFY_POLICY)
                ^
401.           && !ts_check_policy(ctx->policy, tst_info))
402.           goto err;

crypto/ts/ts_rsp_verify.c:401:13: 
399.       }
400.       if ((ctx->flags & TS_VFY_POLICY)
401. >         && !ts_check_policy(ctx->policy, tst_info))
402.           goto err;
403.       if ((ctx->flags & TS_VFY_IMPRINT)

crypto/ts/ts_rsp_verify.c:514:1: start of procedure ts_check_policy()
  512.   }
  513.   
  514. > static int ts_check_policy(ASN1_OBJECT *req_oid, TS_TST_INFO *tst_info)
  515.   {
  516.       ASN1_OBJECT *resp_oid = tst_info->policy_id;

crypto/ts/ts_rsp_verify.c:516:5: 
  514.   static int ts_check_policy(ASN1_OBJECT *req_oid, TS_TST_INFO *tst_info)
  515.   {
  516. >     ASN1_OBJECT *resp_oid = tst_info->policy_id;
  517.   
  518.       if (OBJ_cmp(req_oid, resp_oid) != 0) {

crypto/ts/ts_rsp_verify.c:518:9: 
  516.       ASN1_OBJECT *resp_oid = tst_info->policy_id;
  517.   
  518. >     if (OBJ_cmp(req_oid, resp_oid) != 0) {
  519.           TSerr(TS_F_TS_CHECK_POLICY, TS_R_POLICY_MISMATCH);
  520.           return 0;

crypto/objects/obj_lib.c:124:1: start of procedure OBJ_cmp()
    122.   }
    123.   
    124. > int OBJ_cmp(const ASN1_OBJECT *a, const ASN1_OBJECT *b)
    125.   {
    126.       int ret;

crypto/objects/obj_lib.c:128:5: 
    126.       int ret;
    127.   
    128. >     ret = (a->length - b->length);
    129.       if (ret)
    130.           return (ret);

crypto/objects/obj_lib.c:129:9: Taking true branch
    127.   
    128.       ret = (a->length - b->length);
    129.       if (ret)
                   ^
    130.           return (ret);
    131.       return (memcmp(a->data, b->data, a->length));

crypto/objects/obj_lib.c:130:9: 
    128.       ret = (a->length - b->length);
    129.       if (ret)
    130. >         return (ret);
    131.       return (memcmp(a->data, b->data, a->length));
    132.   }

crypto/objects/obj_lib.c:132:1: return from a call to OBJ_cmp
    130.           return (ret);
    131.       return (memcmp(a->data, b->data, a->length));
    132. > }

crypto/ts/ts_rsp_verify.c:518:9: Taking false branch
  516.       ASN1_OBJECT *resp_oid = tst_info->policy_id;
  517.   
  518.       if (OBJ_cmp(req_oid, resp_oid) != 0) {
                 ^
  519.           TSerr(TS_F_TS_CHECK_POLICY, TS_R_POLICY_MISMATCH);
  520.           return 0;

crypto/ts/ts_rsp_verify.c:523:5: 
  521.       }
  522.   
  523. >     return 1;
  524.   }
  525.   

crypto/ts/ts_rsp_verify.c:524:1: return from a call to ts_check_policy
  522.   
  523.       return 1;
  524. > }
  525.   
  526.   static int ts_compute_imprint(BIO *data, TS_TST_INFO *tst_info,

crypto/ts/ts_rsp_verify.c:401:13: Taking false branch
399.       }
400.       if ((ctx->flags & TS_VFY_POLICY)
401.           && !ts_check_policy(ctx->policy, tst_info))
                   ^
402.           goto err;
403.       if ((ctx->flags & TS_VFY_IMPRINT)

crypto/ts/ts_rsp_verify.c:403:10: Taking true branch
401.           && !ts_check_policy(ctx->policy, tst_info))
402.           goto err;
403.       if ((ctx->flags & TS_VFY_IMPRINT)
                ^
404.           && !ts_check_imprints(ctx->md_alg, ctx->imprint, ctx->imprint_len,
405.                                 tst_info))

crypto/ts/ts_rsp_verify.c:404:13: Taking false branch
402.           goto err;
403.       if ((ctx->flags & TS_VFY_IMPRINT)
404.           && !ts_check_imprints(ctx->md_alg, ctx->imprint, ctx->imprint_len,
                   ^
405.                                 tst_info))
406.           goto err;

crypto/ts/ts_rsp_verify.c:407:10: Taking false branch
405.                                 tst_info))
406.           goto err;
407.       if ((ctx->flags & TS_VFY_DATA)
                ^
408.           && (!ts_compute_imprint(ctx->data, tst_info,
409.                                   &md_alg, &imprint, &imprint_len)

crypto/ts/ts_rsp_verify.c:412:10: Taking false branch
410.               || !ts_check_imprints(md_alg, imprint, imprint_len, tst_info)))
411.           goto err;
412.       if ((ctx->flags & TS_VFY_NONCE)
                ^
413.           && !ts_check_nonces(ctx->nonce, tst_info))
414.           goto err;

crypto/ts/ts_rsp_verify.c:415:10: Taking true branch
413.           && !ts_check_nonces(ctx->nonce, tst_info))
414.           goto err;
415.       if ((ctx->flags & TS_VFY_SIGNER)
                ^
416.           && tsa_name && !ts_check_signer_name(tsa_name, signer)) {
417.           TSerr(TS_F_INT_TS_RESP_VERIFY_TOKEN, TS_R_TSA_NAME_MISMATCH);

crypto/ts/ts_rsp_verify.c:416:12: Taking true branch
414.           goto err;
415.       if ((ctx->flags & TS_VFY_SIGNER)
416.           && tsa_name && !ts_check_signer_name(tsa_name, signer)) {
                  ^
417.           TSerr(TS_F_INT_TS_RESP_VERIFY_TOKEN, TS_R_TSA_NAME_MISMATCH);
418.           goto err;

crypto/ts/ts_rsp_verify.c:416:25: 
414.           goto err;
415.       if ((ctx->flags & TS_VFY_SIGNER)
416. >         && tsa_name && !ts_check_signer_name(tsa_name, signer)) {
417.           TSerr(TS_F_INT_TS_RESP_VERIFY_TOKEN, TS_R_TSA_NAME_MISMATCH);
418.           goto err;

crypto/ts/ts_rsp_verify.c:630:1: start of procedure ts_check_signer_name()
  628.    * subject alternative names of the TSA certificate.
  629.    */
  630. > static int ts_check_signer_name(GENERAL_NAME *tsa_name, X509 *signer)
  631.   {
  632.       STACK_OF(GENERAL_NAME) *gen_names = NULL;

crypto/ts/ts_rsp_verify.c:632:5: 
  630.   static int ts_check_signer_name(GENERAL_NAME *tsa_name, X509 *signer)
  631.   {
  632. >     STACK_OF(GENERAL_NAME) *gen_names = NULL;
  633.       int idx = -1;
  634.       int found = 0;

crypto/ts/ts_rsp_verify.c:633:5: 
  631.   {
  632.       STACK_OF(GENERAL_NAME) *gen_names = NULL;
  633. >     int idx = -1;
  634.       int found = 0;
  635.   

crypto/ts/ts_rsp_verify.c:634:5: 
  632.       STACK_OF(GENERAL_NAME) *gen_names = NULL;
  633.       int idx = -1;
  634. >     int found = 0;
  635.   
  636.       if (tsa_name->type == GEN_DIRNAME

crypto/ts/ts_rsp_verify.c:636:9: Taking false branch
  634.       int found = 0;
  635.   
  636.       if (tsa_name->type == GEN_DIRNAME
                 ^
  637.           && X509_name_cmp(tsa_name->d.dirn, X509_get_subject_name(signer)) == 0)
  638.           return 1;

crypto/ts/ts_rsp_verify.c:639:5: 
  637.           && X509_name_cmp(tsa_name->d.dirn, X509_get_subject_name(signer)) == 0)
  638.           return 1;
  639. >     gen_names = X509_get_ext_d2i(signer, NID_subject_alt_name, NULL, &idx);
  640.       while (gen_names != NULL) {
  641.           found = ts_find_name(gen_names, tsa_name) >= 0;

crypto/x509/x509_ext.c:151:1: start of procedure X509_get_ext_d2i()
    149.   }
    150.   
    151. > void *X509_get_ext_d2i(X509 *x, int nid, int *crit, int *idx)
    152.   {
    153.       return X509V3_get_d2i(x->cert_info.extensions, nid, crit, idx);

crypto/x509/x509_ext.c:153:5: 
    151.   void *X509_get_ext_d2i(X509 *x, int nid, int *crit, int *idx)
    152.   {
    153. >     return X509V3_get_d2i(x->cert_info.extensions, nid, crit, idx);
    154.   }
    155.   

static int int_ts_RESP_verify_token(TS_VERIFY_CTX *ctx,
                                    PKCS7 *token, TS_TST_INFO *tst_info)
{
    X509 *signer = NULL;
    GENERAL_NAME *tsa_name = tst_info->tsa;
    X509_ALGOR *md_alg = NULL;
    unsigned char *imprint = NULL;
    unsigned imprint_len = 0;
    int ret = 0;
    if ((ctx->flags & TS_VFY_SIGNATURE)
        && !TS_RESP_verify_signature(token, ctx->certs, ctx->store, &signer))
        goto err;
    if ((ctx->flags & TS_VFY_VERSION)
        && TS_TST_INFO_get_version(tst_info) != 1) {
        TSerr(TS_F_INT_TS_RESP_VERIFY_TOKEN, TS_R_UNSUPPORTED_VERSION);
        goto err;
    }
    if ((ctx->flags & TS_VFY_POLICY)
        && !ts_check_policy(ctx->policy, tst_info))
        goto err;
    if ((ctx->flags & TS_VFY_IMPRINT)
        && !ts_check_imprints(ctx->md_alg, ctx->imprint, ctx->imprint_len,
                              tst_info))
        goto err;
    if ((ctx->flags & TS_VFY_DATA)
        && (!ts_compute_imprint(ctx->data, tst_info,
                                &md_alg, &imprint, &imprint_len)
            || !ts_check_imprints(md_alg, imprint, imprint_len, tst_info)))
        goto err;
    if ((ctx->flags & TS_VFY_NONCE)
        && !ts_check_nonces(ctx->nonce, tst_info))
        goto err;
    if ((ctx->flags & TS_VFY_SIGNER)
        && tsa_name && !ts_check_signer_name(tsa_name, signer)) {
        TSerr(TS_F_INT_TS_RESP_VERIFY_TOKEN, TS_R_TSA_NAME_MISMATCH);
        goto err;
    }
    if ((ctx->flags & TS_VFY_TSA_NAME)
        && !ts_check_signer_name(ctx->tsa_name, signer)) {
        TSerr(TS_F_INT_TS_RESP_VERIFY_TOKEN, TS_R_TSA_UNTRUSTED);
        goto err;
    }
    ret = 1;
 err:
    X509_free(signer);
    X509_ALGOR_free(md_alg);
    OPENSSL_free(imprint);
    return ret;
}
['static int int_ts_RESP_verify_token(TS_VERIFY_CTX *ctx,\n                                    PKCS7 *token, TS_TST_INFO *tst_info)\n{\n    X509 *signer = NULL;\n    GENERAL_NAME *tsa_name = tst_info->tsa;\n    X509_ALGOR *md_alg = NULL;\n    unsigned char *imprint = NULL;\n    unsigned imprint_len = 0;\n    int ret = 0;\n    if ((ctx->flags & TS_VFY_SIGNATURE)\n        && !TS_RESP_verify_signature(token, ctx->certs, ctx->store, &signer))\n        goto err;\n    if ((ctx->flags & TS_VFY_VERSION)\n        && TS_TST_INFO_get_version(tst_info) != 1) {\n        TSerr(TS_F_INT_TS_RESP_VERIFY_TOKEN, TS_R_UNSUPPORTED_VERSION);\n        goto err;\n    }\n    if ((ctx->flags & TS_VFY_POLICY)\n        && !ts_check_policy(ctx->policy, tst_info))\n        goto err;\n    if ((ctx->flags & TS_VFY_IMPRINT)\n        && !ts_check_imprints(ctx->md_alg, ctx->imprint, ctx->imprint_len,\n                              tst_info))\n        goto err;\n    if ((ctx->flags & TS_VFY_DATA)\n        && (!ts_compute_imprint(ctx->data, tst_info,\n                                &md_alg, &imprint, &imprint_len)\n            || !ts_check_imprints(md_alg, imprint, imprint_len, tst_info)))\n        goto err;\n    if ((ctx->flags & TS_VFY_NONCE)\n        && !ts_check_nonces(ctx->nonce, tst_info))\n        goto err;\n    if ((ctx->flags & TS_VFY_SIGNER)\n        && tsa_name && !ts_check_signer_name(tsa_name, signer)) {\n        TSerr(TS_F_INT_TS_RESP_VERIFY_TOKEN, TS_R_TSA_NAME_MISMATCH);\n        goto err;\n    }\n    if ((ctx->flags & TS_VFY_TSA_NAME)\n        && !ts_check_signer_name(ctx->tsa_name, signer)) {\n        TSerr(TS_F_INT_TS_RESP_VERIFY_TOKEN, TS_R_TSA_UNTRUSTED);\n        goto err;\n    }\n    ret = 1;\n err:\n    X509_free(signer);\n    X509_ALGOR_free(md_alg);\n    OPENSSL_free(imprint);\n    return ret;\n}', 'static int ts_check_policy(ASN1_OBJECT *req_oid, TS_TST_INFO *tst_info)\n{\n    ASN1_OBJECT *resp_oid = tst_info->policy_id;\n    if (OBJ_cmp(req_oid, resp_oid) != 0) {\n        TSerr(TS_F_TS_CHECK_POLICY, TS_R_POLICY_MISMATCH);\n        return 0;\n    }\n    return 1;\n}', 'int OBJ_cmp(const ASN1_OBJECT *a, const ASN1_OBJECT *b)\n{\n    int ret;\n    ret = (a->length - b->length);\n    if (ret)\n        return (ret);\n    return (memcmp(a->data, b->data, a->length));\n}', 'static int ts_check_signer_name(GENERAL_NAME *tsa_name, X509 *signer)\n{\n    STACK_OF(GENERAL_NAME) *gen_names = NULL;\n    int idx = -1;\n    int found = 0;\n    if (tsa_name->type == GEN_DIRNAME\n        && X509_name_cmp(tsa_name->d.dirn, X509_get_subject_name(signer)) == 0)\n        return 1;\n    gen_names = X509_get_ext_d2i(signer, NID_subject_alt_name, NULL, &idx);\n    while (gen_names != NULL) {\n        found = ts_find_name(gen_names, tsa_name) >= 0;\n        if (found)\n            break;\n        GENERAL_NAMES_free(gen_names);\n        gen_names = X509_get_ext_d2i(signer, NID_subject_alt_name, NULL, &idx);\n    }\n    GENERAL_NAMES_free(gen_names);\n    return found;\n}', 'void *X509_get_ext_d2i(X509 *x, int nid, int *crit, int *idx)\n{\n    return X509V3_get_d2i(x->cert_info.extensions, nid, crit, idx);\n}']