crypto/x509/x509_lu.c:658: error: NULL_DEREFERENCE
  pointer `pobj` last assigned on line 656 could be null and is dereferenced at line 658, column 17.
Showing all 45 steps of the trace


crypto/x509/x509_lu.c:619:1: start of procedure X509_STORE_CTX_get1_issuer()
617.    * -1 some other error.
618.    */
619. > int X509_STORE_CTX_get1_issuer(X509 **issuer, X509_STORE_CTX *ctx, X509 *x)
620.   {
621.       X509_NAME *xn;

crypto/x509/x509_lu.c:624:5: 
622.       X509_OBJECT obj, *pobj;
623.       int i, ok, idx, ret;
624. >     *issuer = NULL;
625.       xn = X509_get_issuer_name(x);
626.       ok = X509_STORE_get_by_subject(ctx, X509_LU_X509, xn, &obj);

crypto/x509/x509_lu.c:625:5: 
623.       int i, ok, idx, ret;
624.       *issuer = NULL;
625. >     xn = X509_get_issuer_name(x);
626.       ok = X509_STORE_get_by_subject(ctx, X509_LU_X509, xn, &obj);
627.       if (ok != X509_LU_X509) {

crypto/x509/x509_cmp.c:131:1: start of procedure X509_get_issuer_name()
  129.   }
  130.   
  131. > X509_NAME *X509_get_issuer_name(X509 *a)
  132.   {
  133.       return (a->cert_info->issuer);

crypto/x509/x509_cmp.c:133:5: 
  131.   X509_NAME *X509_get_issuer_name(X509 *a)
  132.   {
  133. >     return (a->cert_info->issuer);
  134.   }
  135.   

crypto/x509/x509_cmp.c:134:1: return from a call to X509_get_issuer_name
  132.   {
  133.       return (a->cert_info->issuer);
  134. > }
  135.   
  136.   unsigned long X509_issuer_name_hash(X509 *x)

crypto/x509/x509_lu.c:626:5: Skipping X509_STORE_get_by_subject(): empty list of specs
624.       *issuer = NULL;
625.       xn = X509_get_issuer_name(x);
626.       ok = X509_STORE_get_by_subject(ctx, X509_LU_X509, xn, &obj);
           ^
627.       if (ok != X509_LU_X509) {
628.           if (ok == X509_LU_RETRY) {

crypto/x509/x509_lu.c:627:9: Taking false branch
625.       xn = X509_get_issuer_name(x);
626.       ok = X509_STORE_get_by_subject(ctx, X509_LU_X509, xn, &obj);
627.       if (ok != X509_LU_X509) {
               ^
628.           if (ok == X509_LU_RETRY) {
629.               X509_OBJECT_free_contents(&obj);

crypto/x509/x509_lu.c:640:9: Taking false branch
638.       }
639.       /* If certificate matches all OK */
640.       if (ctx->check_issued(ctx, x, obj.data.x509)) {
               ^
641.           if (x509_check_cert_time(ctx, obj.data.x509, 1)) {
642.               *issuer = obj.data.x509;

crypto/x509/x509_lu.c:646:5: 
644.           }
645.       }
646. >     X509_OBJECT_free_contents(&obj);
647.   
648.       /* Else find index of first cert accepted by 'check_issued' */

crypto/x509/x509_lu.c:417:1: start of procedure X509_OBJECT_free_contents()
  415.   }
  416.   
  417. > void X509_OBJECT_free_contents(X509_OBJECT *a)
  418.   {
  419.       if (!a)

crypto/x509/x509_lu.c:419:10: Taking false branch
  417.   void X509_OBJECT_free_contents(X509_OBJECT *a)
  418.   {
  419.       if (!a)
                  ^
  420.           return;
  421.       switch (a->type) {

crypto/x509/x509_lu.c:421:5: 
  419.       if (!a)
  420.           return;
  421. >     switch (a->type) {
  422.       default:
  423.           break;

crypto/x509/x509_lu.c:424:5: Switch condition is false. Skipping switch case
  422.       default:
  423.           break;
  424.       case X509_LU_X509:
             ^
  425.           X509_free(a->data.x509);
  426.           break;

crypto/x509/x509_lu.c:427:5: Switch condition is false. Skipping switch case
  425.           X509_free(a->data.x509);
  426.           break;
  427.       case X509_LU_CRL:
             ^
  428.           X509_CRL_free(a->data.crl);
  429.           break;

crypto/x509/x509_lu.c:431:1: return from a call to X509_OBJECT_free_contents
  429.           break;
  430.       }
  431. > }
  432.   
  433.   static int x509_object_idx_cnt(STACK_OF(X509_OBJECT) *h, int type,

crypto/x509/x509_lu.c:649:5: 
647.   
648.       /* Else find index of first cert accepted by 'check_issued' */
649. >     ret = 0;
650.       CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);
651.       idx = X509_OBJECT_idx_by_subject(ctx->ctx->objs, X509_LU_X509, xn);

crypto/x509/x509_lu.c:650:5: 
648.       /* Else find index of first cert accepted by 'check_issued' */
649.       ret = 0;
650. >     CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);
651.       idx = X509_OBJECT_idx_by_subject(ctx->ctx->objs, X509_LU_X509, xn);
652.       if (idx != -1) {            /* should be true as we've had at least one

crypto/lock.c:417:1: start of procedure CRYPTO_lock()
  415.   }
  416.   
  417. > void CRYPTO_lock(int mode, int type, const char *file, int line)
  418.   {
  419.   #ifdef LOCK_DEBUG

crypto/lock.c:444:9: Taking false branch
  442.       }
  443.   #endif
  444.       if (type < 0) {
                 ^
  445.           if (dynlock_lock_callback != NULL) {
  446.               struct CRYPTO_dynlock_value *pointer

crypto/lock.c:455:16: Taking true branch
  453.               CRYPTO_destroy_dynlockid(type);
  454.           }
  455.       } else if (locking_callback != NULL)
                        ^
  456.           locking_callback(mode, type, file, line);
  457.   }

crypto/lock.c:456:9: Skipping __function_pointer__(): unresolved function pointer
  454.           }
  455.       } else if (locking_callback != NULL)
  456.           locking_callback(mode, type, file, line);
                 ^
  457.   }
  458.   

crypto/lock.c:444:5: 
  442.       }
  443.   #endif
  444. >     if (type < 0) {
  445.           if (dynlock_lock_callback != NULL) {
  446.               struct CRYPTO_dynlock_value *pointer

crypto/lock.c:457:1: return from a call to CRYPTO_lock
  455.       } else if (locking_callback != NULL)
  456.           locking_callback(mode, type, file, line);
  457. > }
  458.   
  459.   int CRYPTO_add_lock(int *pointer, int amount, int type, const char *file,

crypto/x509/x509_lu.c:651:5: 
649.       ret = 0;
650.       CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);
651. >     idx = X509_OBJECT_idx_by_subject(ctx->ctx->objs, X509_LU_X509, xn);
652.       if (idx != -1) {            /* should be true as we've had at least one
653.                                    * match */

crypto/x509/x509_lu.c:476:1: start of procedure X509_OBJECT_idx_by_subject()
  474.   }
  475.   
  476. > int X509_OBJECT_idx_by_subject(STACK_OF(X509_OBJECT) *h, int type,
  477.                                  X509_NAME *name)
  478.   {

crypto/x509/x509_lu.c:479:5: Skipping x509_object_idx_cnt(): empty list of specs
  477.                                  X509_NAME *name)
  478.   {
  479.       return x509_object_idx_cnt(h, type, name, NULL);
             ^
  480.   }
  481.   

crypto/x509/x509_lu.c:480:1: return from a call to X509_OBJECT_idx_by_subject
  478.   {
  479.       return x509_object_idx_cnt(h, type, name, NULL);
  480. > }
  481.   
  482.   X509_OBJECT *X509_OBJECT_retrieve_by_subject(STACK_OF(X509_OBJECT) *h,

crypto/x509/x509_lu.c:652:9: Taking true branch
650.       CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);
651.       idx = X509_OBJECT_idx_by_subject(ctx->ctx->objs, X509_LU_X509, xn);
652.       if (idx != -1) {            /* should be true as we've had at least one
               ^
653.                                    * match */
654.           /* Look through all matching certs for suitable issuer */

crypto/x509/x509_lu.c:655:14: 
653.                                    * match */
654.           /* Look through all matching certs for suitable issuer */
655. >         for (i = idx; i < sk_X509_OBJECT_num(ctx->ctx->objs); i++) {
656.               pobj = sk_X509_OBJECT_value(ctx->ctx->objs, i);
657.               /* See if we've run past the matches */

crypto/x509/x509_lu.c:655:27: Condition is true
653.                                    * match */
654.           /* Look through all matching certs for suitable issuer */
655.           for (i = idx; i < sk_X509_OBJECT_num(ctx->ctx->objs); i++) {
                                 ^
656.               pobj = sk_X509_OBJECT_value(ctx->ctx->objs, i);
657.               /* See if we've run past the matches */

crypto/x509/x509_lu.c:655:23: 
653.                                    * match */
654.           /* Look through all matching certs for suitable issuer */
655. >         for (i = idx; i < sk_X509_OBJECT_num(ctx->ctx->objs); i++) {
656.               pobj = sk_X509_OBJECT_value(ctx->ctx->objs, i);
657.               /* See if we've run past the matches */

crypto/stack/stack.c:321:1: start of procedure sk_num()
  319.   }
  320.   
  321. > int sk_num(const _STACK *st)
  322.   {
  323.       if (st == NULL)

crypto/stack/stack.c:323:9: Taking false branch
  321.   int sk_num(const _STACK *st)
  322.   {
  323.       if (st == NULL)
                 ^
  324.           return -1;
  325.       return st->num;

crypto/stack/stack.c:325:5: 
  323.       if (st == NULL)
  324.           return -1;
  325. >     return st->num;
  326.   }
  327.   

crypto/stack/stack.c:326:1: return from a call to sk_num
  324.           return -1;
  325.       return st->num;
  326. > }
  327.   
  328.   void *sk_value(const _STACK *st, int i)

crypto/x509/x509_lu.c:655:23: Loop condition is true. Entering loop body
653.                                    * match */
654.           /* Look through all matching certs for suitable issuer */
655.           for (i = idx; i < sk_X509_OBJECT_num(ctx->ctx->objs); i++) {
                             ^
656.               pobj = sk_X509_OBJECT_value(ctx->ctx->objs, i);
657.               /* See if we've run past the matches */

crypto/x509/x509_lu.c:656:20: Condition is true
654.           /* Look through all matching certs for suitable issuer */
655.           for (i = idx; i < sk_X509_OBJECT_num(ctx->ctx->objs); i++) {
656.               pobj = sk_X509_OBJECT_value(ctx->ctx->objs, i);
                          ^
657.               /* See if we've run past the matches */
658.               if (pobj->type != X509_LU_X509)

crypto/x509/x509_lu.c:656:13: 
654.           /* Look through all matching certs for suitable issuer */
655.           for (i = idx; i < sk_X509_OBJECT_num(ctx->ctx->objs); i++) {
656. >             pobj = sk_X509_OBJECT_value(ctx->ctx->objs, i);
657.               /* See if we've run past the matches */
658.               if (pobj->type != X509_LU_X509)

crypto/stack/stack.c:328:1: start of procedure sk_value()
  326.   }
  327.   
  328. > void *sk_value(const _STACK *st, int i)
  329.   {
  330.       if (!st || (i < 0) || (i >= st->num))

crypto/stack/stack.c:330:10: Taking false branch
  328.   void *sk_value(const _STACK *st, int i)
  329.   {
  330.       if (!st || (i < 0) || (i >= st->num))
                  ^
  331.           return NULL;
  332.       return st->data[i];

crypto/stack/stack.c:330:17: Taking true branch
  328.   void *sk_value(const _STACK *st, int i)
  329.   {
  330.       if (!st || (i < 0) || (i >= st->num))
                         ^
  331.           return NULL;
  332.       return st->data[i];

crypto/stack/stack.c:331:9: 
  329.   {
  330.       if (!st || (i < 0) || (i >= st->num))
  331. >         return NULL;
  332.       return st->data[i];
  333.   }

crypto/stack/stack.c:333:1: return from a call to sk_value
  331.           return NULL;
  332.       return st->data[i];
  333. > }
  334.   
  335.   void *sk_set(_STACK *st, int i, void *value)

crypto/x509/x509_lu.c:658:17: 
656.               pobj = sk_X509_OBJECT_value(ctx->ctx->objs, i);
657.               /* See if we've run past the matches */
658. >             if (pobj->type != X509_LU_X509)
659.                   break;
660.               if (X509_NAME_cmp(xn, X509_get_subject_name(pobj->data.x509)))

int X509_STORE_CTX_get1_issuer(X509 **issuer, X509_STORE_CTX *ctx, X509 *x)
{
    X509_NAME *xn;
    X509_OBJECT obj, *pobj;
    int i, ok, idx, ret;
    *issuer = NULL;
    xn = X509_get_issuer_name(x);
    ok = X509_STORE_get_by_subject(ctx, X509_LU_X509, xn, &obj);
    if (ok != X509_LU_X509) {
        if (ok == X509_LU_RETRY) {
            X509_OBJECT_free_contents(&obj);
            X509err(X509_F_X509_STORE_CTX_GET1_ISSUER, X509_R_SHOULD_RETRY);
            return -1;
        } else if (ok != X509_LU_FAIL) {
            X509_OBJECT_free_contents(&obj);
            return -1;
        }
        return 0;
    }
    if (ctx->check_issued(ctx, x, obj.data.x509)) {
        if (x509_check_cert_time(ctx, obj.data.x509, 1)) {
            *issuer = obj.data.x509;
            return 1;
        }
    }
    X509_OBJECT_free_contents(&obj);
    ret = 0;
    CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);
    idx = X509_OBJECT_idx_by_subject(ctx->ctx->objs, X509_LU_X509, xn);
    if (idx != -1) {
        for (i = idx; i < sk_X509_OBJECT_num(ctx->ctx->objs); i++) {
            pobj = sk_X509_OBJECT_value(ctx->ctx->objs, i);
            if (pobj->type != X509_LU_X509)
                break;
            if (X509_NAME_cmp(xn, X509_get_subject_name(pobj->data.x509)))
                break;
            if (ctx->check_issued(ctx, x, pobj->data.x509)) {
                *issuer = pobj->data.x509;
                ret = 1;
                if (x509_check_cert_time(ctx, *issuer, 1))
                    break;
            }
        }
    }
    CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
    if (*issuer)
        CRYPTO_add(&(*issuer)->references, 1, CRYPTO_LOCK_X509);
    return ret;
}
['int X509_STORE_CTX_get1_issuer(X509 **issuer, X509_STORE_CTX *ctx, X509 *x)\n{\n    X509_NAME *xn;\n    X509_OBJECT obj, *pobj;\n    int i, ok, idx, ret;\n    *issuer = NULL;\n    xn = X509_get_issuer_name(x);\n    ok = X509_STORE_get_by_subject(ctx, X509_LU_X509, xn, &obj);\n    if (ok != X509_LU_X509) {\n        if (ok == X509_LU_RETRY) {\n            X509_OBJECT_free_contents(&obj);\n            X509err(X509_F_X509_STORE_CTX_GET1_ISSUER, X509_R_SHOULD_RETRY);\n            return -1;\n        } else if (ok != X509_LU_FAIL) {\n            X509_OBJECT_free_contents(&obj);\n            return -1;\n        }\n        return 0;\n    }\n    if (ctx->check_issued(ctx, x, obj.data.x509)) {\n        if (x509_check_cert_time(ctx, obj.data.x509, 1)) {\n            *issuer = obj.data.x509;\n            return 1;\n        }\n    }\n    X509_OBJECT_free_contents(&obj);\n    ret = 0;\n    CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);\n    idx = X509_OBJECT_idx_by_subject(ctx->ctx->objs, X509_LU_X509, xn);\n    if (idx != -1) {\n        for (i = idx; i < sk_X509_OBJECT_num(ctx->ctx->objs); i++) {\n            pobj = sk_X509_OBJECT_value(ctx->ctx->objs, i);\n            if (pobj->type != X509_LU_X509)\n                break;\n            if (X509_NAME_cmp(xn, X509_get_subject_name(pobj->data.x509)))\n                break;\n            if (ctx->check_issued(ctx, x, pobj->data.x509)) {\n                *issuer = pobj->data.x509;\n                ret = 1;\n                if (x509_check_cert_time(ctx, *issuer, 1))\n                    break;\n            }\n        }\n    }\n    CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);\n    if (*issuer)\n        CRYPTO_add(&(*issuer)->references, 1, CRYPTO_LOCK_X509);\n    return ret;\n}', 'X509_NAME *X509_get_issuer_name(X509 *a)\n{\n    return (a->cert_info->issuer);\n}', 'void X509_OBJECT_free_contents(X509_OBJECT *a)\n{\n    if (!a)\n        return;\n    switch (a->type) {\n    default:\n        break;\n    case X509_LU_X509:\n        X509_free(a->data.x509);\n        break;\n    case X509_LU_CRL:\n        X509_CRL_free(a->data.crl);\n        break;\n    }\n}', 'void CRYPTO_lock(int mode, int type, const char *file, int line)\n{\n#ifdef LOCK_DEBUG\n    {\n        CRYPTO_THREADID id;\n        char *rw_text, *operation_text;\n        if (mode & CRYPTO_LOCK)\n            operation_text = "lock  ";\n        else if (mode & CRYPTO_UNLOCK)\n            operation_text = "unlock";\n        else\n            operation_text = "ERROR ";\n        if (mode & CRYPTO_READ)\n            rw_text = "r";\n        else if (mode & CRYPTO_WRITE)\n            rw_text = "w";\n        else\n            rw_text = "ERROR";\n        CRYPTO_THREADID_current(&id);\n        fprintf(stderr, "lock:%08lx:(%s)%s %-18s %s:%d\\n",\n                CRYPTO_THREADID_hash(&id), rw_text, operation_text,\n                CRYPTO_get_lock_name(type), file, line);\n    }\n#endif\n    if (type < 0) {\n        if (dynlock_lock_callback != NULL) {\n            struct CRYPTO_dynlock_value *pointer\n                = CRYPTO_get_dynlock_value(type);\n            OPENSSL_assert(pointer != NULL);\n            dynlock_lock_callback(mode, pointer, file, line);\n            CRYPTO_destroy_dynlockid(type);\n        }\n    } else if (locking_callback != NULL)\n        locking_callback(mode, type, file, line);\n}', 'int X509_OBJECT_idx_by_subject(STACK_OF(X509_OBJECT) *h, int type,\n                               X509_NAME *name)\n{\n    return x509_object_idx_cnt(h, type, name, NULL);\n}', 'int sk_num(const _STACK *st)\n{\n    if (st == NULL)\n        return -1;\n    return st->num;\n}', 'void *sk_value(const _STACK *st, int i)\n{\n    if (!st || (i < 0) || (i >= st->num))\n        return NULL;\n    return st->data[i];\n}']