crypto/ts/ts_rsp_verify.c:415: error: NULL_DEREFERENCE
  pointer `signer` last assigned on line 384 could be null and is dereferenced by call to `ts_check_signer_name()` at line 415, column 25.
Showing all 38 steps of the trace


crypto/ts/ts_rsp_verify.c:381:1: start of procedure int_ts_RESP_verify_token()
379.    *      - Check if the TSA name is the expected TSA.
380.    */
381. > static int int_ts_RESP_verify_token(TS_VERIFY_CTX *ctx,
382.                                       PKCS7 *token, TS_TST_INFO *tst_info)
383.   {

crypto/ts/ts_rsp_verify.c:384:5: 
382.                                       PKCS7 *token, TS_TST_INFO *tst_info)
383.   {
384. >     X509 *signer = NULL;
385.       GENERAL_NAME *tsa_name = tst_info->tsa;
386.       X509_ALGOR *md_alg = NULL;

crypto/ts/ts_rsp_verify.c:385:5: 
383.   {
384.       X509 *signer = NULL;
385. >     GENERAL_NAME *tsa_name = tst_info->tsa;
386.       X509_ALGOR *md_alg = NULL;
387.       unsigned char *imprint = NULL;

crypto/ts/ts_rsp_verify.c:386:5: 
384.       X509 *signer = NULL;
385.       GENERAL_NAME *tsa_name = tst_info->tsa;
386. >     X509_ALGOR *md_alg = NULL;
387.       unsigned char *imprint = NULL;
388.       unsigned imprint_len = 0;

crypto/ts/ts_rsp_verify.c:387:5: 
385.       GENERAL_NAME *tsa_name = tst_info->tsa;
386.       X509_ALGOR *md_alg = NULL;
387. >     unsigned char *imprint = NULL;
388.       unsigned imprint_len = 0;
389.       int ret = 0;

crypto/ts/ts_rsp_verify.c:388:5: 
386.       X509_ALGOR *md_alg = NULL;
387.       unsigned char *imprint = NULL;
388. >     unsigned imprint_len = 0;
389.       int ret = 0;
390.   

crypto/ts/ts_rsp_verify.c:389:5: 
387.       unsigned char *imprint = NULL;
388.       unsigned imprint_len = 0;
389. >     int ret = 0;
390.   
391.       if ((ctx->flags & TS_VFY_SIGNATURE)

crypto/ts/ts_rsp_verify.c:391:10: Taking false branch
389.       int ret = 0;
390.   
391.       if ((ctx->flags & TS_VFY_SIGNATURE)
                ^
392.           && !TS_RESP_verify_signature(token, ctx->certs, ctx->store, &signer))
393.           goto err;

crypto/ts/ts_rsp_verify.c:394:10: Taking false branch
392.           && !TS_RESP_verify_signature(token, ctx->certs, ctx->store, &signer))
393.           goto err;
394.       if ((ctx->flags & TS_VFY_VERSION)
                ^
395.           && TS_TST_INFO_get_version(tst_info) != 1) {
396.           TSerr(TS_F_INT_TS_RESP_VERIFY_TOKEN, TS_R_UNSUPPORTED_VERSION);

crypto/ts/ts_rsp_verify.c:399:10: Taking true branch
397.           goto err;
398.       }
399.       if ((ctx->flags & TS_VFY_POLICY)
                ^
400.           && !ts_check_policy(ctx->policy, tst_info))
401.           goto err;

crypto/ts/ts_rsp_verify.c:400:13: 
398.       }
399.       if ((ctx->flags & TS_VFY_POLICY)
400. >         && !ts_check_policy(ctx->policy, tst_info))
401.           goto err;
402.       if ((ctx->flags & TS_VFY_IMPRINT)

crypto/ts/ts_rsp_verify.c:513:1: start of procedure ts_check_policy()
  511.   }
  512.   
  513. > static int ts_check_policy(ASN1_OBJECT *req_oid, TS_TST_INFO *tst_info)
  514.   {
  515.       ASN1_OBJECT *resp_oid = tst_info->policy_id;

crypto/ts/ts_rsp_verify.c:515:5: 
  513.   static int ts_check_policy(ASN1_OBJECT *req_oid, TS_TST_INFO *tst_info)
  514.   {
  515. >     ASN1_OBJECT *resp_oid = tst_info->policy_id;
  516.   
  517.       if (OBJ_cmp(req_oid, resp_oid) != 0) {

crypto/ts/ts_rsp_verify.c:517:9: 
  515.       ASN1_OBJECT *resp_oid = tst_info->policy_id;
  516.   
  517. >     if (OBJ_cmp(req_oid, resp_oid) != 0) {
  518.           TSerr(TS_F_TS_CHECK_POLICY, TS_R_POLICY_MISMATCH);
  519.           return 0;

crypto/objects/obj_lib.c:123:1: start of procedure OBJ_cmp()
    121.   }
    122.   
    123. > int OBJ_cmp(const ASN1_OBJECT *a, const ASN1_OBJECT *b)
    124.   {
    125.       int ret;

crypto/objects/obj_lib.c:127:5: 
    125.       int ret;
    126.   
    127. >     ret = (a->length - b->length);
    128.       if (ret)
    129.           return (ret);

crypto/objects/obj_lib.c:128:9: Taking true branch
    126.   
    127.       ret = (a->length - b->length);
    128.       if (ret)
                   ^
    129.           return (ret);
    130.       return (memcmp(a->data, b->data, a->length));

crypto/objects/obj_lib.c:129:9: 
    127.       ret = (a->length - b->length);
    128.       if (ret)
    129. >         return (ret);
    130.       return (memcmp(a->data, b->data, a->length));
    131.   }

crypto/objects/obj_lib.c:131:1: return from a call to OBJ_cmp
    129.           return (ret);
    130.       return (memcmp(a->data, b->data, a->length));
    131. > }

crypto/ts/ts_rsp_verify.c:517:9: Taking false branch
  515.       ASN1_OBJECT *resp_oid = tst_info->policy_id;
  516.   
  517.       if (OBJ_cmp(req_oid, resp_oid) != 0) {
                 ^
  518.           TSerr(TS_F_TS_CHECK_POLICY, TS_R_POLICY_MISMATCH);
  519.           return 0;

crypto/ts/ts_rsp_verify.c:522:5: 
  520.       }
  521.   
  522. >     return 1;
  523.   }
  524.   

crypto/ts/ts_rsp_verify.c:523:1: return from a call to ts_check_policy
  521.   
  522.       return 1;
  523. > }
  524.   
  525.   static int ts_compute_imprint(BIO *data, TS_TST_INFO *tst_info,

crypto/ts/ts_rsp_verify.c:400:13: Taking false branch
398.       }
399.       if ((ctx->flags & TS_VFY_POLICY)
400.           && !ts_check_policy(ctx->policy, tst_info))
                   ^
401.           goto err;
402.       if ((ctx->flags & TS_VFY_IMPRINT)

crypto/ts/ts_rsp_verify.c:402:10: Taking true branch
400.           && !ts_check_policy(ctx->policy, tst_info))
401.           goto err;
402.       if ((ctx->flags & TS_VFY_IMPRINT)
                ^
403.           && !ts_check_imprints(ctx->md_alg, ctx->imprint, ctx->imprint_len,
404.                                 tst_info))

crypto/ts/ts_rsp_verify.c:403:13: Taking false branch
401.           goto err;
402.       if ((ctx->flags & TS_VFY_IMPRINT)
403.           && !ts_check_imprints(ctx->md_alg, ctx->imprint, ctx->imprint_len,
                   ^
404.                                 tst_info))
405.           goto err;

crypto/ts/ts_rsp_verify.c:406:10: Taking false branch
404.                                 tst_info))
405.           goto err;
406.       if ((ctx->flags & TS_VFY_DATA)
                ^
407.           && (!ts_compute_imprint(ctx->data, tst_info,
408.                                   &md_alg, &imprint, &imprint_len)

crypto/ts/ts_rsp_verify.c:411:10: Taking false branch
409.               || !ts_check_imprints(md_alg, imprint, imprint_len, tst_info)))
410.           goto err;
411.       if ((ctx->flags & TS_VFY_NONCE)
                ^
412.           && !ts_check_nonces(ctx->nonce, tst_info))
413.           goto err;

crypto/ts/ts_rsp_verify.c:414:10: Taking true branch
412.           && !ts_check_nonces(ctx->nonce, tst_info))
413.           goto err;
414.       if ((ctx->flags & TS_VFY_SIGNER)
                ^
415.           && tsa_name && !ts_check_signer_name(tsa_name, signer)) {
416.           TSerr(TS_F_INT_TS_RESP_VERIFY_TOKEN, TS_R_TSA_NAME_MISMATCH);

crypto/ts/ts_rsp_verify.c:415:12: Taking true branch
413.           goto err;
414.       if ((ctx->flags & TS_VFY_SIGNER)
415.           && tsa_name && !ts_check_signer_name(tsa_name, signer)) {
                  ^
416.           TSerr(TS_F_INT_TS_RESP_VERIFY_TOKEN, TS_R_TSA_NAME_MISMATCH);
417.           goto err;

crypto/ts/ts_rsp_verify.c:415:25: 
413.           goto err;
414.       if ((ctx->flags & TS_VFY_SIGNER)
415. >         && tsa_name && !ts_check_signer_name(tsa_name, signer)) {
416.           TSerr(TS_F_INT_TS_RESP_VERIFY_TOKEN, TS_R_TSA_NAME_MISMATCH);
417.           goto err;

crypto/ts/ts_rsp_verify.c:629:1: start of procedure ts_check_signer_name()
  627.    * subject alternative names of the TSA certificate.
  628.    */
  629. > static int ts_check_signer_name(GENERAL_NAME *tsa_name, X509 *signer)
  630.   {
  631.       STACK_OF(GENERAL_NAME) *gen_names = NULL;

crypto/ts/ts_rsp_verify.c:631:5: 
  629.   static int ts_check_signer_name(GENERAL_NAME *tsa_name, X509 *signer)
  630.   {
  631. >     STACK_OF(GENERAL_NAME) *gen_names = NULL;
  632.       int idx = -1;
  633.       int found = 0;

crypto/ts/ts_rsp_verify.c:632:5: 
  630.   {
  631.       STACK_OF(GENERAL_NAME) *gen_names = NULL;
  632. >     int idx = -1;
  633.       int found = 0;
  634.   

crypto/ts/ts_rsp_verify.c:633:5: 
  631.       STACK_OF(GENERAL_NAME) *gen_names = NULL;
  632.       int idx = -1;
  633. >     int found = 0;
  634.   
  635.       if (tsa_name->type == GEN_DIRNAME

crypto/ts/ts_rsp_verify.c:635:9: Taking false branch
  633.       int found = 0;
  634.   
  635.       if (tsa_name->type == GEN_DIRNAME
                 ^
  636.           && X509_name_cmp(tsa_name->d.dirn, X509_get_subject_name(signer)) == 0)
  637.           return 1;

crypto/ts/ts_rsp_verify.c:638:5: 
  636.           && X509_name_cmp(tsa_name->d.dirn, X509_get_subject_name(signer)) == 0)
  637.           return 1;
  638. >     gen_names = X509_get_ext_d2i(signer, NID_subject_alt_name, NULL, &idx);
  639.       while (gen_names != NULL) {
  640.           found = ts_find_name(gen_names, tsa_name) >= 0;

crypto/x509/x509_ext.c:150:1: start of procedure X509_get_ext_d2i()
    148.   }
    149.   
    150. > void *X509_get_ext_d2i(X509 *x, int nid, int *crit, int *idx)
    151.   {
    152.       return X509V3_get_d2i(x->cert_info.extensions, nid, crit, idx);

crypto/x509/x509_ext.c:152:5: 
    150.   void *X509_get_ext_d2i(X509 *x, int nid, int *crit, int *idx)
    151.   {
    152. >     return X509V3_get_d2i(x->cert_info.extensions, nid, crit, idx);
    153.   }
    154.   

static int int_ts_RESP_verify_token(TS_VERIFY_CTX *ctx,
                                    PKCS7 *token, TS_TST_INFO *tst_info)
{
    X509 *signer = NULL;
    GENERAL_NAME *tsa_name = tst_info->tsa;
    X509_ALGOR *md_alg = NULL;
    unsigned char *imprint = NULL;
    unsigned imprint_len = 0;
    int ret = 0;
    if ((ctx->flags & TS_VFY_SIGNATURE)
        && !TS_RESP_verify_signature(token, ctx->certs, ctx->store, &signer))
        goto err;
    if ((ctx->flags & TS_VFY_VERSION)
        && TS_TST_INFO_get_version(tst_info) != 1) {
        TSerr(TS_F_INT_TS_RESP_VERIFY_TOKEN, TS_R_UNSUPPORTED_VERSION);
        goto err;
    }
    if ((ctx->flags & TS_VFY_POLICY)
        && !ts_check_policy(ctx->policy, tst_info))
        goto err;
    if ((ctx->flags & TS_VFY_IMPRINT)
        && !ts_check_imprints(ctx->md_alg, ctx->imprint, ctx->imprint_len,
                              tst_info))
        goto err;
    if ((ctx->flags & TS_VFY_DATA)
        && (!ts_compute_imprint(ctx->data, tst_info,
                                &md_alg, &imprint, &imprint_len)
            || !ts_check_imprints(md_alg, imprint, imprint_len, tst_info)))
        goto err;
    if ((ctx->flags & TS_VFY_NONCE)
        && !ts_check_nonces(ctx->nonce, tst_info))
        goto err;
    if ((ctx->flags & TS_VFY_SIGNER)
        && tsa_name && !ts_check_signer_name(tsa_name, signer)) {
        TSerr(TS_F_INT_TS_RESP_VERIFY_TOKEN, TS_R_TSA_NAME_MISMATCH);
        goto err;
    }
    if ((ctx->flags & TS_VFY_TSA_NAME)
        && !ts_check_signer_name(ctx->tsa_name, signer)) {
        TSerr(TS_F_INT_TS_RESP_VERIFY_TOKEN, TS_R_TSA_UNTRUSTED);
        goto err;
    }
    ret = 1;
 err:
    X509_free(signer);
    X509_ALGOR_free(md_alg);
    OPENSSL_free(imprint);
    return ret;
}
['static int int_ts_RESP_verify_token(TS_VERIFY_CTX *ctx,\n                                    PKCS7 *token, TS_TST_INFO *tst_info)\n{\n    X509 *signer = NULL;\n    GENERAL_NAME *tsa_name = tst_info->tsa;\n    X509_ALGOR *md_alg = NULL;\n    unsigned char *imprint = NULL;\n    unsigned imprint_len = 0;\n    int ret = 0;\n    if ((ctx->flags & TS_VFY_SIGNATURE)\n        && !TS_RESP_verify_signature(token, ctx->certs, ctx->store, &signer))\n        goto err;\n    if ((ctx->flags & TS_VFY_VERSION)\n        && TS_TST_INFO_get_version(tst_info) != 1) {\n        TSerr(TS_F_INT_TS_RESP_VERIFY_TOKEN, TS_R_UNSUPPORTED_VERSION);\n        goto err;\n    }\n    if ((ctx->flags & TS_VFY_POLICY)\n        && !ts_check_policy(ctx->policy, tst_info))\n        goto err;\n    if ((ctx->flags & TS_VFY_IMPRINT)\n        && !ts_check_imprints(ctx->md_alg, ctx->imprint, ctx->imprint_len,\n                              tst_info))\n        goto err;\n    if ((ctx->flags & TS_VFY_DATA)\n        && (!ts_compute_imprint(ctx->data, tst_info,\n                                &md_alg, &imprint, &imprint_len)\n            || !ts_check_imprints(md_alg, imprint, imprint_len, tst_info)))\n        goto err;\n    if ((ctx->flags & TS_VFY_NONCE)\n        && !ts_check_nonces(ctx->nonce, tst_info))\n        goto err;\n    if ((ctx->flags & TS_VFY_SIGNER)\n        && tsa_name && !ts_check_signer_name(tsa_name, signer)) {\n        TSerr(TS_F_INT_TS_RESP_VERIFY_TOKEN, TS_R_TSA_NAME_MISMATCH);\n        goto err;\n    }\n    if ((ctx->flags & TS_VFY_TSA_NAME)\n        && !ts_check_signer_name(ctx->tsa_name, signer)) {\n        TSerr(TS_F_INT_TS_RESP_VERIFY_TOKEN, TS_R_TSA_UNTRUSTED);\n        goto err;\n    }\n    ret = 1;\n err:\n    X509_free(signer);\n    X509_ALGOR_free(md_alg);\n    OPENSSL_free(imprint);\n    return ret;\n}', 'static int ts_check_policy(ASN1_OBJECT *req_oid, TS_TST_INFO *tst_info)\n{\n    ASN1_OBJECT *resp_oid = tst_info->policy_id;\n    if (OBJ_cmp(req_oid, resp_oid) != 0) {\n        TSerr(TS_F_TS_CHECK_POLICY, TS_R_POLICY_MISMATCH);\n        return 0;\n    }\n    return 1;\n}', 'int OBJ_cmp(const ASN1_OBJECT *a, const ASN1_OBJECT *b)\n{\n    int ret;\n    ret = (a->length - b->length);\n    if (ret)\n        return (ret);\n    return (memcmp(a->data, b->data, a->length));\n}', 'static int ts_check_signer_name(GENERAL_NAME *tsa_name, X509 *signer)\n{\n    STACK_OF(GENERAL_NAME) *gen_names = NULL;\n    int idx = -1;\n    int found = 0;\n    if (tsa_name->type == GEN_DIRNAME\n        && X509_name_cmp(tsa_name->d.dirn, X509_get_subject_name(signer)) == 0)\n        return 1;\n    gen_names = X509_get_ext_d2i(signer, NID_subject_alt_name, NULL, &idx);\n    while (gen_names != NULL) {\n        found = ts_find_name(gen_names, tsa_name) >= 0;\n        if (found)\n            break;\n        GENERAL_NAMES_free(gen_names);\n        gen_names = X509_get_ext_d2i(signer, NID_subject_alt_name, NULL, &idx);\n    }\n    GENERAL_NAMES_free(gen_names);\n    return found;\n}', 'void *X509_get_ext_d2i(X509 *x, int nid, int *crit, int *idx)\n{\n    return X509V3_get_d2i(x->cert_info.extensions, nid, crit, idx);\n}']