apps/s_cb.c:1291: error: NULL_DEREFERENCE
  pointer `vfy` last assigned on line 1268 could be null and is dereferenced by call to `X509_STORE_free()` at line 1291, column 5.
Showing all 53 steps of the trace


apps/s_cb.c:1263:1: start of procedure ssl_load_stores()
1261.   }
1262.   
1263. > int ssl_load_stores(SSL_CTX *ctx,
1264.                       const char *vfyCApath, const char *vfyCAfile,
1265.                       const char *chCApath, const char *chCAfile,

apps/s_cb.c:1268:5: 
1266.                       STACK_OF(X509_CRL) *crls, int crl_download)
1267.   {
1268. >     X509_STORE *vfy = NULL, *ch = NULL;
1269.       int rv = 0;
1270.       if (vfyCApath != NULL || vfyCAfile != NULL) {

apps/s_cb.c:1269:5: 
1267.   {
1268.       X509_STORE *vfy = NULL, *ch = NULL;
1269. >     int rv = 0;
1270.       if (vfyCApath != NULL || vfyCAfile != NULL) {
1271.           vfy = X509_STORE_new();

apps/s_cb.c:1270:9: Taking false branch
1268.       X509_STORE *vfy = NULL, *ch = NULL;
1269.       int rv = 0;
1270.       if (vfyCApath != NULL || vfyCAfile != NULL) {
                ^
1271.           vfy = X509_STORE_new();
1272.           if (vfy == NULL)

apps/s_cb.c:1270:30: Taking false branch
1268.       X509_STORE *vfy = NULL, *ch = NULL;
1269.       int rv = 0;
1270.       if (vfyCApath != NULL || vfyCAfile != NULL) {
                                     ^
1271.           vfy = X509_STORE_new();
1272.           if (vfy == NULL)

apps/s_cb.c:1281:9: Taking true branch
1279.               store_setup_crl_download(vfy);
1280.       }
1281.       if (chCApath != NULL || chCAfile != NULL) {
                ^
1282.           ch = X509_STORE_new();
1283.           if (ch == NULL)

apps/s_cb.c:1282:9: Skipping X509_STORE_new(): empty list of specs
1280.       }
1281.       if (chCApath != NULL || chCAfile != NULL) {
1282.           ch = X509_STORE_new();
                ^
1283.           if (ch == NULL)
1284.               goto err;

apps/s_cb.c:1283:13: Taking false branch
1281.       if (chCApath != NULL || chCAfile != NULL) {
1282.           ch = X509_STORE_new();
1283.           if (ch == NULL)
                    ^
1284.               goto err;
1285.           if (!X509_STORE_load_locations(ch, chCAfile, chCApath))

apps/s_cb.c:1285:14: 
1283.           if (ch == NULL)
1284.               goto err;
1285. >         if (!X509_STORE_load_locations(ch, chCAfile, chCApath))
1286.               goto err;
1287.           SSL_CTX_set1_chain_cert_store(ctx, ch);

crypto/x509/x509_d2.c:35:1: start of procedure X509_STORE_load_locations()
  33.   }
  34.   
  35. > int X509_STORE_load_locations(X509_STORE *ctx, const char *file,
  36.                                 const char *path)
  37.   {

crypto/x509/x509_d2.c:40:9: Taking true branch
  38.       X509_LOOKUP *lookup;
  39.   
  40.       if (file != NULL) {
                ^
  41.           lookup = X509_STORE_add_lookup(ctx, X509_LOOKUP_file());
  42.           if (lookup == NULL)

crypto/x509/x509_d2.c:41:9: 
  39.   
  40.       if (file != NULL) {
  41. >         lookup = X509_STORE_add_lookup(ctx, X509_LOOKUP_file());
  42.           if (lookup == NULL)
  43.               return 0;

crypto/x509/by_file.c:35:1: start of procedure X509_LOOKUP_file()
    33.   };
    34.   
    35. > X509_LOOKUP_METHOD *X509_LOOKUP_file(void)
    36.   {
    37.       return &x509_file_lookup;

crypto/x509/by_file.c:37:5: 
    35.   X509_LOOKUP_METHOD *X509_LOOKUP_file(void)
    36.   {
    37. >     return &x509_file_lookup;
    38.   }
    39.   

crypto/x509/by_file.c:38:1: return from a call to X509_LOOKUP_file
    36.   {
    37.       return &x509_file_lookup;
    38. > }
    39.   
    40.   static int by_file_ctrl(X509_LOOKUP *ctx, int cmd, const char *argp,

crypto/x509/x509_lu.c:245:1: start of procedure X509_STORE_add_lookup()
    243.   }
    244.   
    245. > X509_LOOKUP *X509_STORE_add_lookup(X509_STORE *v, X509_LOOKUP_METHOD *m)
    246.   {
    247.       int i;

crypto/x509/x509_lu.c:251:5: 
    249.       X509_LOOKUP *lu;
    250.   
    251. >     sk = v->get_cert_methods;
    252.       for (i = 0; i < sk_X509_LOOKUP_num(sk); i++) {
    253.           lu = sk_X509_LOOKUP_value(sk, i);

crypto/x509/x509_lu.c:252:10: 
    250.   
    251.       sk = v->get_cert_methods;
    252. >     for (i = 0; i < sk_X509_LOOKUP_num(sk); i++) {
    253.           lu = sk_X509_LOOKUP_value(sk, i);
    254.           if (m == lu->method) {

crypto/x509/x509_lu.c:252:17: 
    250.   
    251.       sk = v->get_cert_methods;
    252. >     for (i = 0; i < sk_X509_LOOKUP_num(sk); i++) {
    253.           lu = sk_X509_LOOKUP_value(sk, i);
    254.           if (m == lu->method) {

include/openssl/x509_vfy.h:57:1: start of procedure sk_X509_LOOKUP_num()
      55.   #endif
      56.   
      57. > DEFINE_STACK_OF(X509_LOOKUP)
      58.   DEFINE_STACK_OF(X509_OBJECT)
      59.   DEFINE_STACK_OF(X509_VERIFY_PARAM)

crypto/stack/stack.c:379:1: start of procedure OPENSSL_sk_num()
        377.   }
        378.   
        379. > int OPENSSL_sk_num(const OPENSSL_STACK *st)
        380.   {
        381.       return st == NULL ? -1 : st->num;

crypto/stack/stack.c:381:12: Condition is true
        379.   int OPENSSL_sk_num(const OPENSSL_STACK *st)
        380.   {
        381.       return st == NULL ? -1 : st->num;
                          ^
        382.   }
        383.   

crypto/stack/stack.c:381:5: 
        379.   int OPENSSL_sk_num(const OPENSSL_STACK *st)
        380.   {
        381. >     return st == NULL ? -1 : st->num;
        382.   }
        383.   

crypto/stack/stack.c:382:1: return from a call to OPENSSL_sk_num
        380.   {
        381.       return st == NULL ? -1 : st->num;
        382. > }
        383.   
        384.   void *OPENSSL_sk_value(const OPENSSL_STACK *st, int i)

include/openssl/x509_vfy.h:57:1: return from a call to sk_X509_LOOKUP_num
      55.   #endif
      56.   
      57. > DEFINE_STACK_OF(X509_LOOKUP)
      58.   DEFINE_STACK_OF(X509_OBJECT)
      59.   DEFINE_STACK_OF(X509_VERIFY_PARAM)

crypto/x509/x509_lu.c:252:17: Loop condition is false. Leaving loop
    250.   
    251.       sk = v->get_cert_methods;
    252.       for (i = 0; i < sk_X509_LOOKUP_num(sk); i++) {
                           ^
    253.           lu = sk_X509_LOOKUP_value(sk, i);
    254.           if (m == lu->method) {

crypto/x509/x509_lu.c:259:5: Skipping X509_LOOKUP_new(): empty list of specs
    257.       }
    258.       /* a new one */
    259.       lu = X509_LOOKUP_new(m);
               ^
    260.       if (lu == NULL) {
    261.           X509err(X509_F_X509_STORE_ADD_LOOKUP, ERR_R_MALLOC_FAILURE);

crypto/x509/x509_lu.c:260:9: Taking true branch
    258.       /* a new one */
    259.       lu = X509_LOOKUP_new(m);
    260.       if (lu == NULL) {
                   ^
    261.           X509err(X509_F_X509_STORE_ADD_LOOKUP, ERR_R_MALLOC_FAILURE);
    262.           return NULL;

crypto/x509/x509_lu.c:261:9: 
    259.       lu = X509_LOOKUP_new(m);
    260.       if (lu == NULL) {
    261. >         X509err(X509_F_X509_STORE_ADD_LOOKUP, ERR_R_MALLOC_FAILURE);
    262.           return NULL;
    263.       }

providers/fips/fipsprov.c:381:1: start of procedure ERR_put_error()
      379.   }
      380.   
      381. > void ERR_put_error(int lib, int func, int reason, const char *file, int line)
      382.   {
      383.       /*

providers/fips/fipsprov.c:388:5: Skipping __function_pointer__(): unresolved function pointer
      386.        * a OPENSSL_CTX pointer.
      387.        */
      388.       c_put_error(NULL, ERR_PACK(lib, func, reason), file, line);
                 ^
      389.       ERR_add_error_data(1, "(in the FIPS module)");
      390.   }

providers/fips/fipsprov.c:389:5: Skipping ERR_add_error_data(): empty list of specs
      387.        */
      388.       c_put_error(NULL, ERR_PACK(lib, func, reason), file, line);
      389.       ERR_add_error_data(1, "(in the FIPS module)");
                 ^
      390.   }
      391.   

providers/fips/fipsprov.c:390:1: return from a call to ERR_put_error
      388.       c_put_error(NULL, ERR_PACK(lib, func, reason), file, line);
      389.       ERR_add_error_data(1, "(in the FIPS module)");
      390. > }
      391.   
      392.   void ERR_add_error_data(int num, ...)

crypto/x509/x509_lu.c:262:9: 
    260.       if (lu == NULL) {
    261.           X509err(X509_F_X509_STORE_ADD_LOOKUP, ERR_R_MALLOC_FAILURE);
    262. >         return NULL;
    263.       }
    264.   

crypto/x509/x509_lu.c:272:1: return from a call to X509_STORE_add_lookup
    270.       X509_LOOKUP_free(lu);
    271.       return NULL;
    272. > }
    273.   
    274.   X509_OBJECT *X509_STORE_CTX_get_obj_by_subject(X509_STORE_CTX *vs,

crypto/x509/x509_d2.c:42:13: Taking true branch
  40.       if (file != NULL) {
  41.           lookup = X509_STORE_add_lookup(ctx, X509_LOOKUP_file());
  42.           if (lookup == NULL)
                    ^
  43.               return 0;
  44.           if (X509_LOOKUP_load_file(lookup, file, X509_FILETYPE_PEM) != 1)

crypto/x509/x509_d2.c:43:13: 
  41.           lookup = X509_STORE_add_lookup(ctx, X509_LOOKUP_file());
  42.           if (lookup == NULL)
  43. >             return 0;
  44.           if (X509_LOOKUP_load_file(lookup, file, X509_FILETYPE_PEM) != 1)
  45.               return 0;

crypto/x509/x509_d2.c:57:1: return from a call to X509_STORE_load_locations
  55.           return 0;
  56.       return 1;
  57. > }

apps/s_cb.c:1285:14: Taking true branch
1283.           if (ch == NULL)
1284.               goto err;
1285.           if (!X509_STORE_load_locations(ch, chCAfile, chCApath))
                     ^
1286.               goto err;
1287.           SSL_CTX_set1_chain_cert_store(ctx, ch);

apps/s_cb.c:1290:2: 
1288.       }
1289.       rv = 1;
1290. >  err:
1291.       X509_STORE_free(vfy);
1292.       X509_STORE_free(ch);

apps/s_cb.c:1291:5: 
1289.       rv = 1;
1290.    err:
1291. >     X509_STORE_free(vfy);
1292.       X509_STORE_free(ch);
1293.       return rv;

crypto/x509/x509_lu.c:204:1: start of procedure X509_STORE_free()
  202.   }
  203.   
  204. > void X509_STORE_free(X509_STORE *vfy)
  205.   {
  206.       int i;

crypto/x509/x509_lu.c:210:9: Taking false branch
  208.       X509_LOOKUP *lu;
  209.   
  210.       if (vfy == NULL)
                 ^
  211.           return;
  212.       CRYPTO_DOWN_REF(&vfy->references, &i, vfy->lock);

crypto/x509/x509_lu.c:212:5: 
  210.       if (vfy == NULL)
  211.           return;
  212. >     CRYPTO_DOWN_REF(&vfy->references, &i, vfy->lock);
  213.       REF_PRINT_COUNT("X509_STORE", vfy);
  214.       if (i > 0)

include/internal/refcount.h:49:1: start of procedure CRYPTO_DOWN_REF()
    47.    * otherwise imply an acquire fence. Hence conditional acquire fence...
    48.    */
    49. > static inline int CRYPTO_DOWN_REF(_Atomic int *val, int *ret, void *lock)
    50.   {
    51.       *ret = atomic_fetch_sub_explicit(val, 1, memory_order_relaxed) - 1;

include/internal/refcount.h:51:5: 
    49.   static inline int CRYPTO_DOWN_REF(_Atomic int *val, int *ret, void *lock)
    50.   {
    51. >     *ret = atomic_fetch_sub_explicit(val, 1, memory_order_relaxed) - 1;
    52.       if (*ret == 0)
    53.           atomic_thread_fence(memory_order_acquire);

include/internal/refcount.h:52:9: Taking true branch
    50.   {
    51.       *ret = atomic_fetch_sub_explicit(val, 1, memory_order_relaxed) - 1;
    52.       if (*ret == 0)
                  ^
    53.           atomic_thread_fence(memory_order_acquire);
    54.       return 1;

include/internal/refcount.h:53:9: Skipping __c11_atomic_thread_fence(): method has no implementation
    51.       *ret = atomic_fetch_sub_explicit(val, 1, memory_order_relaxed) - 1;
    52.       if (*ret == 0)
    53.           atomic_thread_fence(memory_order_acquire);
                  ^
    54.       return 1;
    55.   }

include/internal/refcount.h:54:5: 
    52.       if (*ret == 0)
    53.           atomic_thread_fence(memory_order_acquire);
    54. >     return 1;
    55.   }
    56.   

include/internal/refcount.h:55:1: return from a call to CRYPTO_DOWN_REF
    53.           atomic_thread_fence(memory_order_acquire);
    54.       return 1;
    55. > }
    56.   
    57.   #  elif defined(__GNUC__) && defined(__ATOMIC_RELAXED) && __GCC_ATOMIC_INT_LOCK_FREE > 0

crypto/x509/x509_lu.c:214:9: Taking true branch
  212.       CRYPTO_DOWN_REF(&vfy->references, &i, vfy->lock);
  213.       REF_PRINT_COUNT("X509_STORE", vfy);
  214.       if (i > 0)
                 ^
  215.           return;
  216.       REF_ASSERT_ISNT(i < 0);

crypto/x509/x509_lu.c:215:9: 
  213.       REF_PRINT_COUNT("X509_STORE", vfy);
  214.       if (i > 0)
  215. >         return;
  216.       REF_ASSERT_ISNT(i < 0);
  217.   

crypto/x509/x509_lu.c:231:1: return from a call to X509_STORE_free
  229.       CRYPTO_THREAD_lock_free(vfy->lock);
  230.       OPENSSL_free(vfy);
  231. > }
  232.   
  233.   int X509_STORE_up_ref(X509_STORE *vfy)

int ssl_load_stores(SSL_CTX *ctx,
                    const char *vfyCApath, const char *vfyCAfile,
                    const char *chCApath, const char *chCAfile,
                    STACK_OF(X509_CRL) *crls, int crl_download)
{
    X509_STORE *vfy = NULL, *ch = NULL;
    int rv = 0;
    if (vfyCApath != NULL || vfyCAfile != NULL) {
        vfy = X509_STORE_new();
        if (vfy == NULL)
            goto err;
        if (!X509_STORE_load_locations(vfy, vfyCAfile, vfyCApath))
            goto err;
        add_crls_store(vfy, crls);
        SSL_CTX_set1_verify_cert_store(ctx, vfy);
        if (crl_download)
            store_setup_crl_download(vfy);
    }
    if (chCApath != NULL || chCAfile != NULL) {
        ch = X509_STORE_new();
        if (ch == NULL)
            goto err;
        if (!X509_STORE_load_locations(ch, chCAfile, chCApath))
            goto err;
        SSL_CTX_set1_chain_cert_store(ctx, ch);
    }
    rv = 1;
 err:
    X509_STORE_free(vfy);
    X509_STORE_free(ch);
    return rv;
}
['int ssl_load_stores(SSL_CTX *ctx,\n                    const char *vfyCApath, const char *vfyCAfile,\n                    const char *chCApath, const char *chCAfile,\n                    STACK_OF(X509_CRL) *crls, int crl_download)\n{\n    X509_STORE *vfy = NULL, *ch = NULL;\n    int rv = 0;\n    if (vfyCApath != NULL || vfyCAfile != NULL) {\n        vfy = X509_STORE_new();\n        if (vfy == NULL)\n            goto err;\n        if (!X509_STORE_load_locations(vfy, vfyCAfile, vfyCApath))\n            goto err;\n        add_crls_store(vfy, crls);\n        SSL_CTX_set1_verify_cert_store(ctx, vfy);\n        if (crl_download)\n            store_setup_crl_download(vfy);\n    }\n    if (chCApath != NULL || chCAfile != NULL) {\n        ch = X509_STORE_new();\n        if (ch == NULL)\n            goto err;\n        if (!X509_STORE_load_locations(ch, chCAfile, chCApath))\n            goto err;\n        SSL_CTX_set1_chain_cert_store(ctx, ch);\n    }\n    rv = 1;\n err:\n    X509_STORE_free(vfy);\n    X509_STORE_free(ch);\n    return rv;\n}', 'int X509_STORE_load_locations(X509_STORE *ctx, const char *file,\n                              const char *path)\n{\n    X509_LOOKUP *lookup;\n    if (file != NULL) {\n        lookup = X509_STORE_add_lookup(ctx, X509_LOOKUP_file());\n        if (lookup == NULL)\n            return 0;\n        if (X509_LOOKUP_load_file(lookup, file, X509_FILETYPE_PEM) != 1)\n            return 0;\n    }\n    if (path != NULL) {\n        lookup = X509_STORE_add_lookup(ctx, X509_LOOKUP_hash_dir());\n        if (lookup == NULL)\n            return 0;\n        if (X509_LOOKUP_add_dir(lookup, path, X509_FILETYPE_PEM) != 1)\n            return 0;\n    }\n    if ((path == NULL) && (file == NULL))\n        return 0;\n    return 1;\n}', 'X509_LOOKUP_METHOD *X509_LOOKUP_file(void)\n{\n    return &x509_file_lookup;\n}', 'X509_LOOKUP *X509_STORE_add_lookup(X509_STORE *v, X509_LOOKUP_METHOD *m)\n{\n    int i;\n    STACK_OF(X509_LOOKUP) *sk;\n    X509_LOOKUP *lu;\n    sk = v->get_cert_methods;\n    for (i = 0; i < sk_X509_LOOKUP_num(sk); i++) {\n        lu = sk_X509_LOOKUP_value(sk, i);\n        if (m == lu->method) {\n            return lu;\n        }\n    }\n    lu = X509_LOOKUP_new(m);\n    if (lu == NULL) {\n        X509err(X509_F_X509_STORE_ADD_LOOKUP, ERR_R_MALLOC_FAILURE);\n        return NULL;\n    }\n    lu->store_ctx = v;\n    if (sk_X509_LOOKUP_push(v->get_cert_methods, lu))\n        return lu;\n    X509err(X509_F_X509_STORE_ADD_LOOKUP, ERR_R_MALLOC_FAILURE);\n    X509_LOOKUP_free(lu);\n    return NULL;\n}', 'int OPENSSL_sk_num(const OPENSSL_STACK *st)\n{\n    return st == NULL ? -1 : st->num;\n}', 'void ERR_put_error(int lib, int func, int reason, const char *file, int line)\n{\n    c_put_error(NULL, ERR_PACK(lib, func, reason), file, line);\n    ERR_add_error_data(1, "(in the FIPS module)");\n}', 'void X509_STORE_free(X509_STORE *vfy)\n{\n    int i;\n    STACK_OF(X509_LOOKUP) *sk;\n    X509_LOOKUP *lu;\n    if (vfy == NULL)\n        return;\n    CRYPTO_DOWN_REF(&vfy->references, &i, vfy->lock);\n    REF_PRINT_COUNT("X509_STORE", vfy);\n    if (i > 0)\n        return;\n    REF_ASSERT_ISNT(i < 0);\n    sk = vfy->get_cert_methods;\n    for (i = 0; i < sk_X509_LOOKUP_num(sk); i++) {\n        lu = sk_X509_LOOKUP_value(sk, i);\n        X509_LOOKUP_shutdown(lu);\n        X509_LOOKUP_free(lu);\n    }\n    sk_X509_LOOKUP_free(sk);\n    sk_X509_OBJECT_pop_free(vfy->objs, X509_OBJECT_free);\n    CRYPTO_free_ex_data(CRYPTO_EX_INDEX_X509_STORE, vfy, &vfy->ex_data);\n    X509_VERIFY_PARAM_free(vfy->param);\n    CRYPTO_THREAD_lock_free(vfy->lock);\n    OPENSSL_free(vfy);\n}', 'static inline int CRYPTO_DOWN_REF(_Atomic int *val, int *ret, void *lock)\n{\n    *ret = atomic_fetch_sub_explicit(val, 1, memory_order_relaxed) - 1;\n    if (*ret == 0)\n        atomic_thread_fence(memory_order_acquire);\n    return 1;\n}']