crypto/x509/x509_lu.c:298: error: NULL_DEREFERENCE
  pointer `lu` last assigned on line 297 could be null and is dereferenced by call to `X509_LOOKUP_by_subject()` at line 298, column 17.
Showing all 52 steps of the trace


crypto/x509/x509_lu.c:282:1: start of procedure X509_STORE_get_by_subject()
280.   }
281.   
282. > int X509_STORE_get_by_subject(X509_STORE_CTX *vs, X509_LOOKUP_TYPE type,
283.                                 X509_NAME *name, X509_OBJECT *ret)
284.   {

crypto/x509/x509_lu.c:285:5: 
283.                                 X509_NAME *name, X509_OBJECT *ret)
284.   {
285. >     X509_STORE *ctx = vs->ctx;
286.       X509_LOOKUP *lu;
287.       X509_OBJECT stmp, *tmp;

crypto/x509/x509_lu.c:290:5: 
288.       int i, j;
289.   
290. >     CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);
291.       tmp = X509_OBJECT_retrieve_by_subject(ctx->objs, type, name);
292.       CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);

crypto/lock.c:417:1: start of procedure CRYPTO_lock()
  415.   }
  416.   
  417. > void CRYPTO_lock(int mode, int type, const char *file, int line)
  418.   {
  419.   #ifdef LOCK_DEBUG

crypto/lock.c:444:9: Taking false branch
  442.       }
  443.   #endif
  444.       if (type < 0) {
                 ^
  445.           if (dynlock_lock_callback != NULL) {
  446.               struct CRYPTO_dynlock_value *pointer

crypto/lock.c:455:16: Taking true branch
  453.               CRYPTO_destroy_dynlockid(type);
  454.           }
  455.       } else if (locking_callback != NULL)
                        ^
  456.           locking_callback(mode, type, file, line);
  457.   }

crypto/lock.c:456:9: Skipping __function_pointer__(): unresolved function pointer
  454.           }
  455.       } else if (locking_callback != NULL)
  456.           locking_callback(mode, type, file, line);
                 ^
  457.   }
  458.   

crypto/lock.c:444:5: 
  442.       }
  443.   #endif
  444. >     if (type < 0) {
  445.           if (dynlock_lock_callback != NULL) {
  446.               struct CRYPTO_dynlock_value *pointer

crypto/lock.c:457:1: return from a call to CRYPTO_lock
  455.       } else if (locking_callback != NULL)
  456.           locking_callback(mode, type, file, line);
  457. > }
  458.   
  459.   int CRYPTO_add_lock(int *pointer, int amount, int type, const char *file,

crypto/x509/x509_lu.c:291:5: 
289.   
290.       CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);
291. >     tmp = X509_OBJECT_retrieve_by_subject(ctx->objs, type, name);
292.       CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
293.   

crypto/x509/x509_lu.c:467:1: start of procedure X509_OBJECT_retrieve_by_subject()
  465.   }
  466.   
  467. > X509_OBJECT *X509_OBJECT_retrieve_by_subject(STACK_OF(X509_OBJECT) *h,
  468.                                                int type, X509_NAME *name)
  469.   {

crypto/x509/x509_lu.c:471:5: 
  469.   {
  470.       int idx;
  471. >     idx = X509_OBJECT_idx_by_subject(h, type, name);
  472.       if (idx == -1)
  473.           return NULL;

crypto/x509/x509_lu.c:461:1: start of procedure X509_OBJECT_idx_by_subject()
    459.   }
    460.   
    461. > int X509_OBJECT_idx_by_subject(STACK_OF(X509_OBJECT) *h, int type,
    462.                                  X509_NAME *name)
    463.   {

crypto/x509/x509_lu.c:464:5: Skipping x509_object_idx_cnt(): empty list of specs
    462.                                  X509_NAME *name)
    463.   {
    464.       return x509_object_idx_cnt(h, type, name, NULL);
               ^
    465.   }
    466.   

crypto/x509/x509_lu.c:465:1: return from a call to X509_OBJECT_idx_by_subject
    463.   {
    464.       return x509_object_idx_cnt(h, type, name, NULL);
    465. > }
    466.   
    467.   X509_OBJECT *X509_OBJECT_retrieve_by_subject(STACK_OF(X509_OBJECT) *h,

crypto/x509/x509_lu.c:472:9: Taking false branch
  470.       int idx;
  471.       idx = X509_OBJECT_idx_by_subject(h, type, name);
  472.       if (idx == -1)
                 ^
  473.           return NULL;
  474.       return sk_X509_OBJECT_value(h, idx);

crypto/x509/x509_lu.c:474:12: Condition is true
  472.       if (idx == -1)
  473.           return NULL;
  474.       return sk_X509_OBJECT_value(h, idx);
                    ^
  475.   }
  476.   

crypto/x509/x509_lu.c:474:5: 
  472.       if (idx == -1)
  473.           return NULL;
  474. >     return sk_X509_OBJECT_value(h, idx);
  475.   }
  476.   

crypto/stack/stack.c:324:1: start of procedure sk_value()
    322.   }
    323.   
    324. > void *sk_value(const _STACK *st, int i)
    325.   {
    326.       if (!st || (i < 0) || (i >= st->num))

crypto/stack/stack.c:326:10: Taking false branch
    324.   void *sk_value(const _STACK *st, int i)
    325.   {
    326.       if (!st || (i < 0) || (i >= st->num))
                    ^
    327.           return NULL;
    328.       return st->data[i];

crypto/stack/stack.c:326:17: Taking false branch
    324.   void *sk_value(const _STACK *st, int i)
    325.   {
    326.       if (!st || (i < 0) || (i >= st->num))
                           ^
    327.           return NULL;
    328.       return st->data[i];

crypto/stack/stack.c:326:28: Taking false branch
    324.   void *sk_value(const _STACK *st, int i)
    325.   {
    326.       if (!st || (i < 0) || (i >= st->num))
                                      ^
    327.           return NULL;
    328.       return st->data[i];

crypto/stack/stack.c:328:5: 
    326.       if (!st || (i < 0) || (i >= st->num))
    327.           return NULL;
    328. >     return st->data[i];
    329.   }
    330.   

crypto/stack/stack.c:329:1: return from a call to sk_value
    327.           return NULL;
    328.       return st->data[i];
    329. > }
    330.   
    331.   void *sk_set(_STACK *st, int i, void *value)

crypto/x509/x509_lu.c:475:1: return from a call to X509_OBJECT_retrieve_by_subject
  473.           return NULL;
  474.       return sk_X509_OBJECT_value(h, idx);
  475. > }
  476.   
  477.   STACK_OF(X509) *X509_STORE_get1_certs(X509_STORE_CTX *ctx, X509_NAME *nm)

crypto/x509/x509_lu.c:292:5: 
290.       CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);
291.       tmp = X509_OBJECT_retrieve_by_subject(ctx->objs, type, name);
292. >     CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
293.   
294.       if (tmp == NULL || type == X509_LU_CRL) {

crypto/lock.c:417:1: start of procedure CRYPTO_lock()
  415.   }
  416.   
  417. > void CRYPTO_lock(int mode, int type, const char *file, int line)
  418.   {
  419.   #ifdef LOCK_DEBUG

crypto/lock.c:444:9: Taking false branch
  442.       }
  443.   #endif
  444.       if (type < 0) {
                 ^
  445.           if (dynlock_lock_callback != NULL) {
  446.               struct CRYPTO_dynlock_value *pointer

crypto/lock.c:455:16: Taking true branch
  453.               CRYPTO_destroy_dynlockid(type);
  454.           }
  455.       } else if (locking_callback != NULL)
                        ^
  456.           locking_callback(mode, type, file, line);
  457.   }

crypto/lock.c:456:9: Skipping __function_pointer__(): unresolved function pointer
  454.           }
  455.       } else if (locking_callback != NULL)
  456.           locking_callback(mode, type, file, line);
                 ^
  457.   }
  458.   

crypto/lock.c:444:5: 
  442.       }
  443.   #endif
  444. >     if (type < 0) {
  445.           if (dynlock_lock_callback != NULL) {
  446.               struct CRYPTO_dynlock_value *pointer

crypto/lock.c:457:1: return from a call to CRYPTO_lock
  455.       } else if (locking_callback != NULL)
  456.           locking_callback(mode, type, file, line);
  457. > }
  458.   
  459.   int CRYPTO_add_lock(int *pointer, int amount, int type, const char *file,

crypto/x509/x509_lu.c:294:9: Taking false branch
292.       CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
293.   
294.       if (tmp == NULL || type == X509_LU_CRL) {
               ^
295.           for (i = vs->current_method;
296.                i < sk_X509_LOOKUP_num(ctx->get_cert_methods); i++) {

crypto/x509/x509_lu.c:294:24: Taking true branch
292.       CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
293.   
294.       if (tmp == NULL || type == X509_LU_CRL) {
                              ^
295.           for (i = vs->current_method;
296.                i < sk_X509_LOOKUP_num(ctx->get_cert_methods); i++) {

crypto/x509/x509_lu.c:295:14: 
293.   
294.       if (tmp == NULL || type == X509_LU_CRL) {
295. >         for (i = vs->current_method;
296.                i < sk_X509_LOOKUP_num(ctx->get_cert_methods); i++) {
297.               lu = sk_X509_LOOKUP_value(ctx->get_cert_methods, i);

crypto/x509/x509_lu.c:296:18: Condition is true
294.       if (tmp == NULL || type == X509_LU_CRL) {
295.           for (i = vs->current_method;
296.                i < sk_X509_LOOKUP_num(ctx->get_cert_methods); i++) {
                        ^
297.               lu = sk_X509_LOOKUP_value(ctx->get_cert_methods, i);
298.               j = X509_LOOKUP_by_subject(lu, type, name, &stmp);

crypto/x509/x509_lu.c:296:14: 
294.       if (tmp == NULL || type == X509_LU_CRL) {
295.           for (i = vs->current_method;
296. >              i < sk_X509_LOOKUP_num(ctx->get_cert_methods); i++) {
297.               lu = sk_X509_LOOKUP_value(ctx->get_cert_methods, i);
298.               j = X509_LOOKUP_by_subject(lu, type, name, &stmp);

crypto/stack/stack.c:317:1: start of procedure sk_num()
  315.   }
  316.   
  317. > int sk_num(const _STACK *st)
  318.   {
  319.       if (st == NULL)

crypto/stack/stack.c:319:9: Taking false branch
  317.   int sk_num(const _STACK *st)
  318.   {
  319.       if (st == NULL)
                 ^
  320.           return -1;
  321.       return st->num;

crypto/stack/stack.c:321:5: 
  319.       if (st == NULL)
  320.           return -1;
  321. >     return st->num;
  322.   }
  323.   

crypto/stack/stack.c:322:1: return from a call to sk_num
  320.           return -1;
  321.       return st->num;
  322. > }
  323.   
  324.   void *sk_value(const _STACK *st, int i)

crypto/x509/x509_lu.c:296:14: Loop condition is true. Entering loop body
294.       if (tmp == NULL || type == X509_LU_CRL) {
295.           for (i = vs->current_method;
296.                i < sk_X509_LOOKUP_num(ctx->get_cert_methods); i++) {
                    ^
297.               lu = sk_X509_LOOKUP_value(ctx->get_cert_methods, i);
298.               j = X509_LOOKUP_by_subject(lu, type, name, &stmp);

crypto/x509/x509_lu.c:297:18: Condition is true
295.           for (i = vs->current_method;
296.                i < sk_X509_LOOKUP_num(ctx->get_cert_methods); i++) {
297.               lu = sk_X509_LOOKUP_value(ctx->get_cert_methods, i);
                        ^
298.               j = X509_LOOKUP_by_subject(lu, type, name, &stmp);
299.               if (j < 0) {

crypto/x509/x509_lu.c:297:13: 
295.           for (i = vs->current_method;
296.                i < sk_X509_LOOKUP_num(ctx->get_cert_methods); i++) {
297. >             lu = sk_X509_LOOKUP_value(ctx->get_cert_methods, i);
298.               j = X509_LOOKUP_by_subject(lu, type, name, &stmp);
299.               if (j < 0) {

crypto/stack/stack.c:324:1: start of procedure sk_value()
  322.   }
  323.   
  324. > void *sk_value(const _STACK *st, int i)
  325.   {
  326.       if (!st || (i < 0) || (i >= st->num))

crypto/stack/stack.c:326:10: Taking false branch
  324.   void *sk_value(const _STACK *st, int i)
  325.   {
  326.       if (!st || (i < 0) || (i >= st->num))
                  ^
  327.           return NULL;
  328.       return st->data[i];

crypto/stack/stack.c:326:17: Taking true branch
  324.   void *sk_value(const _STACK *st, int i)
  325.   {
  326.       if (!st || (i < 0) || (i >= st->num))
                         ^
  327.           return NULL;
  328.       return st->data[i];

crypto/stack/stack.c:327:9: 
  325.   {
  326.       if (!st || (i < 0) || (i >= st->num))
  327. >         return NULL;
  328.       return st->data[i];
  329.   }

crypto/stack/stack.c:329:1: return from a call to sk_value
  327.           return NULL;
  328.       return st->data[i];
  329. > }
  330.   
  331.   void *sk_set(_STACK *st, int i, void *value)

crypto/x509/x509_lu.c:298:13: 
296.                i < sk_X509_LOOKUP_num(ctx->get_cert_methods); i++) {
297.               lu = sk_X509_LOOKUP_value(ctx->get_cert_methods, i);
298. >             j = X509_LOOKUP_by_subject(lu, type, name, &stmp);
299.               if (j < 0) {
300.                   vs->current_method = j;

crypto/x509/x509_lu.c:123:1: start of procedure X509_LOOKUP_by_subject()
  121.   }
  122.   
  123. > int X509_LOOKUP_by_subject(X509_LOOKUP *ctx, int type, X509_NAME *name,
  124.                              X509_OBJECT *ret)
  125.   {

crypto/x509/x509_lu.c:126:10: 
  124.                              X509_OBJECT *ret)
  125.   {
  126. >     if ((ctx->method == NULL) || (ctx->method->get_by_subject == NULL))
  127.           return X509_LU_FAIL;
  128.       if (ctx->skip)

int X509_STORE_get_by_subject(X509_STORE_CTX *vs, X509_LOOKUP_TYPE type,
                              X509_NAME *name, X509_OBJECT *ret)
{
    X509_STORE *ctx = vs->ctx;
    X509_LOOKUP *lu;
    X509_OBJECT stmp, *tmp;
    int i, j;
    CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);
    tmp = X509_OBJECT_retrieve_by_subject(ctx->objs, type, name);
    CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
    if (tmp == NULL || type == X509_LU_CRL) {
        for (i = vs->current_method;
             i < sk_X509_LOOKUP_num(ctx->get_cert_methods); i++) {
            lu = sk_X509_LOOKUP_value(ctx->get_cert_methods, i);
            j = X509_LOOKUP_by_subject(lu, type, name, &stmp);
            if (j < 0) {
                vs->current_method = j;
                return j;
            } else if (j) {
                tmp = &stmp;
                break;
            }
        }
        vs->current_method = 0;
        if (tmp == NULL)
            return 0;
    }
    ret->type = tmp->type;
    ret->data.ptr = tmp->data.ptr;
    X509_OBJECT_up_ref_count(ret);
    return 1;
}
['int X509_STORE_get_by_subject(X509_STORE_CTX *vs, X509_LOOKUP_TYPE type,\n                              X509_NAME *name, X509_OBJECT *ret)\n{\n    X509_STORE *ctx = vs->ctx;\n    X509_LOOKUP *lu;\n    X509_OBJECT stmp, *tmp;\n    int i, j;\n    CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);\n    tmp = X509_OBJECT_retrieve_by_subject(ctx->objs, type, name);\n    CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);\n    if (tmp == NULL || type == X509_LU_CRL) {\n        for (i = vs->current_method;\n             i < sk_X509_LOOKUP_num(ctx->get_cert_methods); i++) {\n            lu = sk_X509_LOOKUP_value(ctx->get_cert_methods, i);\n            j = X509_LOOKUP_by_subject(lu, type, name, &stmp);\n            if (j < 0) {\n                vs->current_method = j;\n                return j;\n            } else if (j) {\n                tmp = &stmp;\n                break;\n            }\n        }\n        vs->current_method = 0;\n        if (tmp == NULL)\n            return 0;\n    }\n    ret->type = tmp->type;\n    ret->data.ptr = tmp->data.ptr;\n    X509_OBJECT_up_ref_count(ret);\n    return 1;\n}', 'void CRYPTO_lock(int mode, int type, const char *file, int line)\n{\n#ifdef LOCK_DEBUG\n    {\n        CRYPTO_THREADID id;\n        char *rw_text, *operation_text;\n        if (mode & CRYPTO_LOCK)\n            operation_text = "lock  ";\n        else if (mode & CRYPTO_UNLOCK)\n            operation_text = "unlock";\n        else\n            operation_text = "ERROR ";\n        if (mode & CRYPTO_READ)\n            rw_text = "r";\n        else if (mode & CRYPTO_WRITE)\n            rw_text = "w";\n        else\n            rw_text = "ERROR";\n        CRYPTO_THREADID_current(&id);\n        fprintf(stderr, "lock:%08lx:(%s)%s %-18s %s:%d\\n",\n                CRYPTO_THREADID_hash(&id), rw_text, operation_text,\n                CRYPTO_get_lock_name(type), file, line);\n    }\n#endif\n    if (type < 0) {\n        if (dynlock_lock_callback != NULL) {\n            struct CRYPTO_dynlock_value *pointer\n                = CRYPTO_get_dynlock_value(type);\n            OPENSSL_assert(pointer != NULL);\n            dynlock_lock_callback(mode, pointer, file, line);\n            CRYPTO_destroy_dynlockid(type);\n        }\n    } else if (locking_callback != NULL)\n        locking_callback(mode, type, file, line);\n}', 'X509_OBJECT *X509_OBJECT_retrieve_by_subject(STACK_OF(X509_OBJECT) *h,\n                                             int type, X509_NAME *name)\n{\n    int idx;\n    idx = X509_OBJECT_idx_by_subject(h, type, name);\n    if (idx == -1)\n        return NULL;\n    return sk_X509_OBJECT_value(h, idx);\n}', 'int X509_OBJECT_idx_by_subject(STACK_OF(X509_OBJECT) *h, int type,\n                               X509_NAME *name)\n{\n    return x509_object_idx_cnt(h, type, name, NULL);\n}', 'void *sk_value(const _STACK *st, int i)\n{\n    if (!st || (i < 0) || (i >= st->num))\n        return NULL;\n    return st->data[i];\n}', 'int sk_num(const _STACK *st)\n{\n    if (st == NULL)\n        return -1;\n    return st->num;\n}', 'int X509_LOOKUP_by_subject(X509_LOOKUP *ctx, int type, X509_NAME *name,\n                           X509_OBJECT *ret)\n{\n    if ((ctx->method == NULL) || (ctx->method->get_by_subject == NULL))\n        return X509_LU_FAIL;\n    if (ctx->skip)\n        return 0;\n    return ctx->method->get_by_subject(ctx, type, name, ret);\n}']