crypto/x509/x509_req.c:201: error: NULL_DEREFERENCE
  pointer `attr` last assigned on line 200 could be null and is dereferenced at line 201, column 6.
Showing all 47 steps of the trace


crypto/x509/x509_req.c:186:1: start of procedure X509_REQ_get_extensions()
184.   }
185.   
186. > STACK_OF(X509_EXTENSION) *X509_REQ_get_extensions(X509_REQ *req)
187.   	{
188.   	X509_ATTRIBUTE *attr;

crypto/x509/x509_req.c:189:2: 
187.   	{
188.   	X509_ATTRIBUTE *attr;
189. > 	ASN1_TYPE *ext = NULL;
190.   	int idx, *pnid;
191.   	const unsigned char *p;

crypto/x509/x509_req.c:193:7: Taking false branch
191.   	const unsigned char *p;
192.   
193.   	if ((req == NULL) || (req->req_info == NULL) || !ext_nids)
             ^
194.   		return(NULL);
195.   	for (pnid = ext_nids; *pnid != NID_undef; pnid++)

crypto/x509/x509_req.c:193:24: Taking false branch
191.   	const unsigned char *p;
192.   
193.   	if ((req == NULL) || (req->req_info == NULL) || !ext_nids)
                              ^
194.   		return(NULL);
195.   	for (pnid = ext_nids; *pnid != NID_undef; pnid++)

crypto/x509/x509_req.c:193:51: Taking false branch
191.   	const unsigned char *p;
192.   
193.   	if ((req == NULL) || (req->req_info == NULL) || !ext_nids)
                                                         ^
194.   		return(NULL);
195.   	for (pnid = ext_nids; *pnid != NID_undef; pnid++)

crypto/x509/x509_req.c:195:7: 
193.   	if ((req == NULL) || (req->req_info == NULL) || !ext_nids)
194.   		return(NULL);
195. > 	for (pnid = ext_nids; *pnid != NID_undef; pnid++)
196.   		{
197.   		idx = X509_REQ_get_attr_by_NID(req, *pnid, -1);

crypto/x509/x509_req.c:195:24: Loop condition is true. Entering loop body
193.   	if ((req == NULL) || (req->req_info == NULL) || !ext_nids)
194.   		return(NULL);
195.   	for (pnid = ext_nids; *pnid != NID_undef; pnid++)
                              ^
196.   		{
197.   		idx = X509_REQ_get_attr_by_NID(req, *pnid, -1);

crypto/x509/x509_req.c:197:3: 
195.   	for (pnid = ext_nids; *pnid != NID_undef; pnid++)
196.   		{
197. > 		idx = X509_REQ_get_attr_by_NID(req, *pnid, -1);
198.   		if (idx == -1)
199.   			continue;

crypto/x509/x509_req.c:263:1: start of procedure X509_REQ_get_attr_by_NID()
  261.   }
  262.   
  263. > int X509_REQ_get_attr_by_NID(const X509_REQ *req, int nid,
  264.   			  int lastpos)
  265.   {

crypto/x509/x509_req.c:266:2: 
  264.   			  int lastpos)
  265.   {
  266. > 	return X509at_get_attr_by_NID(req->req_info->attributes, nid, lastpos);
  267.   }
  268.   

crypto/x509/x509_att.c:73:1: start of procedure X509at_get_attr_by_NID()
    71.   }
    72.   
    73. > int X509at_get_attr_by_NID(const STACK_OF(X509_ATTRIBUTE) *x, int nid,
    74.   			  int lastpos)
    75.   {

crypto/x509/x509_att.c:78:2: 
    76.   	ASN1_OBJECT *obj;
    77.   
    78. > 	obj=OBJ_nid2obj(nid);
    79.   	if (obj == NULL) return(-2);
    80.   	return(X509at_get_attr_by_OBJ(x,obj,lastpos));

crypto/objects/obj_dat.c:292:1: start of procedure OBJ_nid2obj()
      290.   	}
      291.   
      292. > ASN1_OBJECT *OBJ_nid2obj(int n)
      293.   	{
      294.   	ADDED_OBJ ad,*adp;

crypto/objects/obj_dat.c:297:7: Taking true branch
      295.   	ASN1_OBJECT ob;
      296.   
      297.   	if ((n >= 0) && (n < NUM_NID))
                   ^
      298.   		{
      299.   		if ((n != NID_undef) && (nid_objs[n].nid == NID_undef))

crypto/objects/obj_dat.c:297:19: Taking false branch
      295.   	ASN1_OBJECT ob;
      296.   
      297.   	if ((n >= 0) && (n < NUM_NID))
                               ^
      298.   		{
      299.   		if ((n != NID_undef) && (nid_objs[n].nid == NID_undef))

crypto/objects/obj_dat.c:306:11: Taking false branch
      304.   		return((ASN1_OBJECT *)&(nid_objs[n]));
      305.   		}
      306.   	else if (added == NULL)
                       ^
      307.   		return(NULL);
      308.   	else

crypto/objects/obj_dat.c:310:3: 
      308.   	else
      309.   		{
      310. > 		ad.type=ADDED_NID;
      311.   		ad.obj= &ob;
      312.   		ob.nid=n;

crypto/objects/obj_dat.c:311:3: 
      309.   		{
      310.   		ad.type=ADDED_NID;
      311. > 		ad.obj= &ob;
      312.   		ob.nid=n;
      313.   		adp=lh_ADDED_OBJ_retrieve(added,&ad);

crypto/objects/obj_dat.c:312:3: 
      310.   		ad.type=ADDED_NID;
      311.   		ad.obj= &ob;
      312. > 		ob.nid=n;
      313.   		adp=lh_ADDED_OBJ_retrieve(added,&ad);
      314.   		if (adp != NULL)

crypto/objects/obj_dat.c:313:7: Condition is true
      311.   		ad.obj= &ob;
      312.   		ob.nid=n;
      313.   		adp=lh_ADDED_OBJ_retrieve(added,&ad);
                   ^
      314.   		if (adp != NULL)
      315.   			return(adp->obj);

crypto/objects/obj_dat.c:313:7: Condition is true
      311.   		ad.obj= &ob;
      312.   		ob.nid=n;
      313.   		adp=lh_ADDED_OBJ_retrieve(added,&ad);
                   ^
      314.   		if (adp != NULL)
      315.   			return(adp->obj);

crypto/objects/obj_dat.c:313:3: 
      311.   		ad.obj= &ob;
      312.   		ob.nid=n;
      313. > 		adp=lh_ADDED_OBJ_retrieve(added,&ad);
      314.   		if (adp != NULL)
      315.   			return(adp->obj);

crypto/lhash/lhash.c:248:1: start of procedure lh_retrieve()
        246.   	}
        247.   
        248. > void *lh_retrieve(_LHASH *lh, const void *data)
        249.   	{
        250.   	unsigned long hash;

crypto/lhash/lhash.c:254:2: 
        252.   	void *ret;
        253.   
        254. > 	lh->error=0;
        255.   	rn=getrn(lh,data,&hash);
        256.   

crypto/lhash/lhash.c:255:2: Skipping getrn(): empty list of specs
        253.   
        254.   	lh->error=0;
        255.   	rn=getrn(lh,data,&hash);
                ^
        256.   
        257.   	if (*rn == NULL)

crypto/lhash/lhash.c:257:6: Taking false branch
        255.   	rn=getrn(lh,data,&hash);
        256.   
        257.   	if (*rn == NULL)
                    ^
        258.   		{
        259.   		lh->num_retrieve_miss++;

crypto/lhash/lhash.c:264:3: 
        262.   	else
        263.   		{
        264. > 		ret= (*rn)->data;
        265.   		lh->num_retrieve++;
        266.   		}

crypto/lhash/lhash.c:265:3: 
        263.   		{
        264.   		ret= (*rn)->data;
        265. > 		lh->num_retrieve++;
        266.   		}
        267.   	return(ret);

crypto/lhash/lhash.c:267:2: 
        265.   		lh->num_retrieve++;
        266.   		}
        267. > 	return(ret);
        268.   	}
        269.   

crypto/lhash/lhash.c:268:2: return from a call to lh_retrieve
        266.   		}
        267.   	return(ret);
        268.   	}
                ^
        269.   
        270.   static void doall_util_fn(_LHASH *lh, int use_arg, LHASH_DOALL_FN_TYPE func,

crypto/objects/obj_dat.c:314:7: Taking true branch
      312.   		ob.nid=n;
      313.   		adp=lh_ADDED_OBJ_retrieve(added,&ad);
      314.   		if (adp != NULL)
                   ^
      315.   			return(adp->obj);
      316.   		else

crypto/objects/obj_dat.c:315:4: 
      313.   		adp=lh_ADDED_OBJ_retrieve(added,&ad);
      314.   		if (adp != NULL)
      315. > 			return(adp->obj);
      316.   		else
      317.   			{

crypto/objects/obj_dat.c:322:2: return from a call to OBJ_nid2obj
      320.   			}
      321.   		}
      322.   	}
              ^
      323.   
      324.   const char *OBJ_nid2sn(int n)

crypto/x509/x509_att.c:79:6: Taking false branch
    77.   
    78.   	obj=OBJ_nid2obj(nid);
    79.   	if (obj == NULL) return(-2);
               ^
    80.   	return(X509at_get_attr_by_OBJ(x,obj,lastpos));
    81.   }

crypto/x509/x509_att.c:80:2: Skipping X509at_get_attr_by_OBJ(): empty list of specs
    78.   	obj=OBJ_nid2obj(nid);
    79.   	if (obj == NULL) return(-2);
    80.   	return(X509at_get_attr_by_OBJ(x,obj,lastpos));
           ^
    81.   }
    82.   

crypto/x509/x509_att.c:81:1: return from a call to X509at_get_attr_by_NID
    79.   	if (obj == NULL) return(-2);
    80.   	return(X509at_get_attr_by_OBJ(x,obj,lastpos));
    81. > }
    82.   
    83.   int X509at_get_attr_by_OBJ(const STACK_OF(X509_ATTRIBUTE) *sk, ASN1_OBJECT *obj,

crypto/x509/x509_req.c:267:1: return from a call to X509_REQ_get_attr_by_NID
  265.   {
  266.   	return X509at_get_attr_by_NID(req->req_info->attributes, nid, lastpos);
  267. > }
  268.   
  269.   int X509_REQ_get_attr_by_OBJ(const X509_REQ *req, ASN1_OBJECT *obj,

crypto/x509/x509_req.c:198:7: Taking false branch
196.   		{
197.   		idx = X509_REQ_get_attr_by_NID(req, *pnid, -1);
198.   		if (idx == -1)
             ^
199.   			continue;
200.   		attr = X509_REQ_get_attr(req, idx);

crypto/x509/x509_req.c:200:3: 
198.   		if (idx == -1)
199.   			continue;
200. > 		attr = X509_REQ_get_attr(req, idx);
201.   		if(attr->single) ext = attr->value.single;
202.   		else if(sk_ASN1_TYPE_num(attr->value.set))

crypto/x509/x509_req.c:275:1: start of procedure X509_REQ_get_attr()
  273.   }
  274.   
  275. > X509_ATTRIBUTE *X509_REQ_get_attr(const X509_REQ *req, int loc)
  276.   {
  277.   	return X509at_get_attr(req->req_info->attributes, loc);

crypto/x509/x509_req.c:277:2: 
  275.   X509_ATTRIBUTE *X509_REQ_get_attr(const X509_REQ *req, int loc)
  276.   {
  277. > 	return X509at_get_attr(req->req_info->attributes, loc);
  278.   }
  279.   

crypto/x509/x509_att.c:103:1: start of procedure X509at_get_attr()
    101.   }
    102.   
    103. > X509_ATTRIBUTE *X509at_get_attr(const STACK_OF(X509_ATTRIBUTE) *x, int loc)
    104.   {
    105.   	if (x == NULL || sk_X509_ATTRIBUTE_num(x) <= loc || loc < 0)

crypto/x509/x509_att.c:105:6: Taking true branch
    103.   X509_ATTRIBUTE *X509at_get_attr(const STACK_OF(X509_ATTRIBUTE) *x, int loc)
    104.   {
    105.   	if (x == NULL || sk_X509_ATTRIBUTE_num(x) <= loc || loc < 0)
                ^
    106.   		return NULL;
    107.   	else

crypto/x509/x509_att.c:106:3: 
    104.   {
    105.   	if (x == NULL || sk_X509_ATTRIBUTE_num(x) <= loc || loc < 0)
    106. > 		return NULL;
    107.   	else
    108.   		return sk_X509_ATTRIBUTE_value(x,loc);

crypto/x509/x509_att.c:109:1: return from a call to X509at_get_attr
    107.   	else
    108.   		return sk_X509_ATTRIBUTE_value(x,loc);
    109. > }
    110.   
    111.   X509_ATTRIBUTE *X509at_delete_attr(STACK_OF(X509_ATTRIBUTE) *x, int loc)

crypto/x509/x509_req.c:278:1: return from a call to X509_REQ_get_attr
  276.   {
  277.   	return X509at_get_attr(req->req_info->attributes, loc);
  278. > }
  279.   
  280.   X509_ATTRIBUTE *X509_REQ_delete_attr(X509_REQ *req, int loc)

crypto/x509/x509_req.c:201:6: Taking false branch
199.   			continue;
200.   		attr = X509_REQ_get_attr(req, idx);
201.   		if(attr->single) ext = attr->value.single;
            ^
202.   		else if(sk_ASN1_TYPE_num(attr->value.set))
203.   			ext = sk_ASN1_TYPE_value(attr->value.set, 0);

STACK_OF(X509_EXTENSION) *X509_REQ_get_extensions(X509_REQ *req)
	{
	X509_ATTRIBUTE *attr;
	ASN1_TYPE *ext = NULL;
	int idx, *pnid;
	const unsigned char *p;
	if ((req == NULL) || (req->req_info == NULL) || !ext_nids)
		return(NULL);
	for (pnid = ext_nids; *pnid != NID_undef; pnid++)
		{
		idx = X509_REQ_get_attr_by_NID(req, *pnid, -1);
		if (idx == -1)
			continue;
		attr = X509_REQ_get_attr(req, idx);
		if(attr->single) ext = attr->value.single;
		else if(sk_ASN1_TYPE_num(attr->value.set))
			ext = sk_ASN1_TYPE_value(attr->value.set, 0);
		break;
		}
	if(!ext || (ext->type != V_ASN1_SEQUENCE))
		return NULL;
	p = ext->value.sequence->data;
	return (STACK_OF(X509_EXTENSION) *)
		ASN1_item_d2i(NULL, &p, ext->value.sequence->length,
				ASN1_ITEM_rptr(X509_EXTENSIONS));
}
['STACK_OF(X509_EXTENSION) *X509_REQ_get_extensions(X509_REQ *req)\n\t{\n\tX509_ATTRIBUTE *attr;\n\tASN1_TYPE *ext = NULL;\n\tint idx, *pnid;\n\tconst unsigned char *p;\n\tif ((req == NULL) || (req->req_info == NULL) || !ext_nids)\n\t\treturn(NULL);\n\tfor (pnid = ext_nids; *pnid != NID_undef; pnid++)\n\t\t{\n\t\tidx = X509_REQ_get_attr_by_NID(req, *pnid, -1);\n\t\tif (idx == -1)\n\t\t\tcontinue;\n\t\tattr = X509_REQ_get_attr(req, idx);\n\t\tif(attr->single) ext = attr->value.single;\n\t\telse if(sk_ASN1_TYPE_num(attr->value.set))\n\t\t\text = sk_ASN1_TYPE_value(attr->value.set, 0);\n\t\tbreak;\n\t\t}\n\tif(!ext || (ext->type != V_ASN1_SEQUENCE))\n\t\treturn NULL;\n\tp = ext->value.sequence->data;\n\treturn (STACK_OF(X509_EXTENSION) *)\n\t\tASN1_item_d2i(NULL, &p, ext->value.sequence->length,\n\t\t\t\tASN1_ITEM_rptr(X509_EXTENSIONS));\n}', 'int X509_REQ_get_attr_by_NID(const X509_REQ *req, int nid,\n\t\t\t  int lastpos)\n{\n\treturn X509at_get_attr_by_NID(req->req_info->attributes, nid, lastpos);\n}', 'int X509at_get_attr_by_NID(const STACK_OF(X509_ATTRIBUTE) *x, int nid,\n\t\t\t  int lastpos)\n{\n\tASN1_OBJECT *obj;\n\tobj=OBJ_nid2obj(nid);\n\tif (obj == NULL) return(-2);\n\treturn(X509at_get_attr_by_OBJ(x,obj,lastpos));\n}', 'ASN1_OBJECT *OBJ_nid2obj(int n)\n\t{\n\tADDED_OBJ ad,*adp;\n\tASN1_OBJECT ob;\n\tif ((n >= 0) && (n < NUM_NID))\n\t\t{\n\t\tif ((n != NID_undef) && (nid_objs[n].nid == NID_undef))\n\t\t\t{\n\t\t\tOBJerr(OBJ_F_OBJ_NID2OBJ,OBJ_R_UNKNOWN_NID);\n\t\t\treturn(NULL);\n\t\t\t}\n\t\treturn((ASN1_OBJECT *)&(nid_objs[n]));\n\t\t}\n\telse if (added == NULL)\n\t\treturn(NULL);\n\telse\n\t\t{\n\t\tad.type=ADDED_NID;\n\t\tad.obj= &ob;\n\t\tob.nid=n;\n\t\tadp=lh_ADDED_OBJ_retrieve(added,&ad);\n\t\tif (adp != NULL)\n\t\t\treturn(adp->obj);\n\t\telse\n\t\t\t{\n\t\t\tOBJerr(OBJ_F_OBJ_NID2OBJ,OBJ_R_UNKNOWN_NID);\n\t\t\treturn(NULL);\n\t\t\t}\n\t\t}\n\t}', 'void *lh_retrieve(_LHASH *lh, const void *data)\n\t{\n\tunsigned long hash;\n\tLHASH_NODE **rn;\n\tvoid *ret;\n\tlh->error=0;\n\trn=getrn(lh,data,&hash);\n\tif (*rn == NULL)\n\t\t{\n\t\tlh->num_retrieve_miss++;\n\t\treturn(NULL);\n\t\t}\n\telse\n\t\t{\n\t\tret= (*rn)->data;\n\t\tlh->num_retrieve++;\n\t\t}\n\treturn(ret);\n\t}', 'X509_ATTRIBUTE *X509_REQ_get_attr(const X509_REQ *req, int loc)\n{\n\treturn X509at_get_attr(req->req_info->attributes, loc);\n}', 'X509_ATTRIBUTE *X509at_get_attr(const STACK_OF(X509_ATTRIBUTE) *x, int loc)\n{\n\tif (x == NULL || sk_X509_ATTRIBUTE_num(x) <= loc || loc < 0)\n\t\treturn NULL;\n\telse\n\t\treturn sk_X509_ATTRIBUTE_value(x,loc);\n}']