crypto/x509/x509_req.c:202: error: NULL_DEREFERENCE
  pointer `attr` last assigned on line 201 could be null and is dereferenced at line 202, column 13.
Showing all 47 steps of the trace


crypto/x509/x509_req.c:188:1: start of procedure X509_REQ_get_extensions()
186.   }
187.   
188. > STACK_OF(X509_EXTENSION) *X509_REQ_get_extensions(X509_REQ *req)
189.   {
190.       X509_ATTRIBUTE *attr;

crypto/x509/x509_req.c:191:5: 
189.   {
190.       X509_ATTRIBUTE *attr;
191. >     ASN1_TYPE *ext = NULL;
192.       int idx, *pnid;
193.       const unsigned char *p;

crypto/x509/x509_req.c:195:10: Taking false branch
193.       const unsigned char *p;
194.   
195.       if ((req == NULL) || (req->req_info == NULL) || !ext_nids)
                ^
196.           return (NULL);
197.       for (pnid = ext_nids; *pnid != NID_undef; pnid++) {

crypto/x509/x509_req.c:195:27: Taking false branch
193.       const unsigned char *p;
194.   
195.       if ((req == NULL) || (req->req_info == NULL) || !ext_nids)
                                 ^
196.           return (NULL);
197.       for (pnid = ext_nids; *pnid != NID_undef; pnid++) {

crypto/x509/x509_req.c:195:54: Taking false branch
193.       const unsigned char *p;
194.   
195.       if ((req == NULL) || (req->req_info == NULL) || !ext_nids)
                                                            ^
196.           return (NULL);
197.       for (pnid = ext_nids; *pnid != NID_undef; pnid++) {

crypto/x509/x509_req.c:197:10: 
195.       if ((req == NULL) || (req->req_info == NULL) || !ext_nids)
196.           return (NULL);
197. >     for (pnid = ext_nids; *pnid != NID_undef; pnid++) {
198.           idx = X509_REQ_get_attr_by_NID(req, *pnid, -1);
199.           if (idx == -1)

crypto/x509/x509_req.c:197:27: Loop condition is true. Entering loop body
195.       if ((req == NULL) || (req->req_info == NULL) || !ext_nids)
196.           return (NULL);
197.       for (pnid = ext_nids; *pnid != NID_undef; pnid++) {
                                 ^
198.           idx = X509_REQ_get_attr_by_NID(req, *pnid, -1);
199.           if (idx == -1)

crypto/x509/x509_req.c:198:9: 
196.           return (NULL);
197.       for (pnid = ext_nids; *pnid != NID_undef; pnid++) {
198. >         idx = X509_REQ_get_attr_by_NID(req, *pnid, -1);
199.           if (idx == -1)
200.               continue;

crypto/x509/x509_req.c:270:1: start of procedure X509_REQ_get_attr_by_NID()
  268.   }
  269.   
  270. > int X509_REQ_get_attr_by_NID(const X509_REQ *req, int nid, int lastpos)
  271.   {
  272.       return X509at_get_attr_by_NID(req->req_info->attributes, nid, lastpos);

crypto/x509/x509_req.c:272:5: 
  270.   int X509_REQ_get_attr_by_NID(const X509_REQ *req, int nid, int lastpos)
  271.   {
  272. >     return X509at_get_attr_by_NID(req->req_info->attributes, nid, lastpos);
  273.   }
  274.   

crypto/x509/x509_att.c:73:1: start of procedure X509at_get_attr_by_NID()
    71.   }
    72.   
    73. > int X509at_get_attr_by_NID(const STACK_OF(X509_ATTRIBUTE) *x, int nid,
    74.                              int lastpos)
    75.   {

crypto/x509/x509_att.c:78:5: 
    76.       ASN1_OBJECT *obj;
    77.   
    78. >     obj = OBJ_nid2obj(nid);
    79.       if (obj == NULL)
    80.           return (-2);

crypto/objects/obj_dat.c:313:1: start of procedure OBJ_nid2obj()
      311.   }
      312.   
      313. > ASN1_OBJECT *OBJ_nid2obj(int n)
      314.   {
      315.       ADDED_OBJ ad, *adp;

crypto/objects/obj_dat.c:318:10: Taking true branch
      316.       ASN1_OBJECT ob;
      317.   
      318.       if ((n >= 0) && (n < NUM_NID)) {
                      ^
      319.           if ((n != NID_undef) && (nid_objs[n].nid == NID_undef)) {
      320.               OBJerr(OBJ_F_OBJ_NID2OBJ, OBJ_R_UNKNOWN_NID);

crypto/objects/obj_dat.c:318:22: Taking false branch
      316.       ASN1_OBJECT ob;
      317.   
      318.       if ((n >= 0) && (n < NUM_NID)) {
                                  ^
      319.           if ((n != NID_undef) && (nid_objs[n].nid == NID_undef)) {
      320.               OBJerr(OBJ_F_OBJ_NID2OBJ, OBJ_R_UNKNOWN_NID);

crypto/objects/obj_dat.c:324:16: Taking false branch
      322.           }
      323.           return ((ASN1_OBJECT *)&(nid_objs[n]));
      324.       } else if (added == NULL)
                            ^
      325.           return (NULL);
      326.       else {

crypto/objects/obj_dat.c:327:9: 
      325.           return (NULL);
      326.       else {
      327. >         ad.type = ADDED_NID;
      328.           ad.obj = &ob;
      329.           ob.nid = n;

crypto/objects/obj_dat.c:328:9: 
      326.       else {
      327.           ad.type = ADDED_NID;
      328. >         ad.obj = &ob;
      329.           ob.nid = n;
      330.           adp = lh_ADDED_OBJ_retrieve(added, &ad);

crypto/objects/obj_dat.c:329:9: 
      327.           ad.type = ADDED_NID;
      328.           ad.obj = &ob;
      329. >         ob.nid = n;
      330.           adp = lh_ADDED_OBJ_retrieve(added, &ad);
      331.           if (adp != NULL)

crypto/objects/obj_dat.c:330:15: Condition is true
      328.           ad.obj = &ob;
      329.           ob.nid = n;
      330.           adp = lh_ADDED_OBJ_retrieve(added, &ad);
                           ^
      331.           if (adp != NULL)
      332.               return (adp->obj);

crypto/objects/obj_dat.c:330:15: Condition is true
      328.           ad.obj = &ob;
      329.           ob.nid = n;
      330.           adp = lh_ADDED_OBJ_retrieve(added, &ad);
                           ^
      331.           if (adp != NULL)
      332.               return (adp->obj);

crypto/objects/obj_dat.c:330:9: 
      328.           ad.obj = &ob;
      329.           ob.nid = n;
      330. >         adp = lh_ADDED_OBJ_retrieve(added, &ad);
      331.           if (adp != NULL)
      332.               return (adp->obj);

crypto/lhash/lhash.c:241:1: start of procedure lh_retrieve()
        239.   }
        240.   
        241. > void *lh_retrieve(_LHASH *lh, const void *data)
        242.   {
        243.       unsigned long hash;

crypto/lhash/lhash.c:247:5: 
        245.       void *ret;
        246.   
        247. >     lh->error = 0;
        248.       rn = getrn(lh, data, &hash);
        249.   

crypto/lhash/lhash.c:248:5: Skipping getrn(): empty list of specs
        246.   
        247.       lh->error = 0;
        248.       rn = getrn(lh, data, &hash);
                   ^
        249.   
        250.       if (*rn == NULL) {

crypto/lhash/lhash.c:250:9: Taking false branch
        248.       rn = getrn(lh, data, &hash);
        249.   
        250.       if (*rn == NULL) {
                       ^
        251.           lh->num_retrieve_miss++;
        252.           return (NULL);

crypto/lhash/lhash.c:254:9: 
        252.           return (NULL);
        253.       } else {
        254. >         ret = (*rn)->data;
        255.           lh->num_retrieve++;
        256.       }

crypto/lhash/lhash.c:255:9: 
        253.       } else {
        254.           ret = (*rn)->data;
        255. >         lh->num_retrieve++;
        256.       }
        257.       return (ret);

crypto/lhash/lhash.c:257:5: 
        255.           lh->num_retrieve++;
        256.       }
        257. >     return (ret);
        258.   }
        259.   

crypto/lhash/lhash.c:258:1: return from a call to lh_retrieve
        256.       }
        257.       return (ret);
        258. > }
        259.   
        260.   static void doall_util_fn(_LHASH *lh, int use_arg, LHASH_DOALL_FN_TYPE func,

crypto/objects/obj_dat.c:331:13: Taking true branch
      329.           ob.nid = n;
      330.           adp = lh_ADDED_OBJ_retrieve(added, &ad);
      331.           if (adp != NULL)
                         ^
      332.               return (adp->obj);
      333.           else {

crypto/objects/obj_dat.c:332:13: 
      330.           adp = lh_ADDED_OBJ_retrieve(added, &ad);
      331.           if (adp != NULL)
      332. >             return (adp->obj);
      333.           else {
      334.               OBJerr(OBJ_F_OBJ_NID2OBJ, OBJ_R_UNKNOWN_NID);

crypto/objects/obj_dat.c:338:1: return from a call to OBJ_nid2obj
      336.           }
      337.       }
      338. > }
      339.   
      340.   const char *OBJ_nid2sn(int n)

crypto/x509/x509_att.c:79:9: Taking false branch
    77.   
    78.       obj = OBJ_nid2obj(nid);
    79.       if (obj == NULL)
                  ^
    80.           return (-2);
    81.       return (X509at_get_attr_by_OBJ(x, obj, lastpos));

crypto/x509/x509_att.c:81:5: Skipping X509at_get_attr_by_OBJ(): empty list of specs
    79.       if (obj == NULL)
    80.           return (-2);
    81.       return (X509at_get_attr_by_OBJ(x, obj, lastpos));
              ^
    82.   }
    83.   

crypto/x509/x509_att.c:82:1: return from a call to X509at_get_attr_by_NID
    80.           return (-2);
    81.       return (X509at_get_attr_by_OBJ(x, obj, lastpos));
    82. > }
    83.   
    84.   int X509at_get_attr_by_OBJ(const STACK_OF(X509_ATTRIBUTE) *sk,

crypto/x509/x509_req.c:273:1: return from a call to X509_REQ_get_attr_by_NID
  271.   {
  272.       return X509at_get_attr_by_NID(req->req_info->attributes, nid, lastpos);
  273. > }
  274.   
  275.   int X509_REQ_get_attr_by_OBJ(const X509_REQ *req, ASN1_OBJECT *obj,

crypto/x509/x509_req.c:199:13: Taking false branch
197.       for (pnid = ext_nids; *pnid != NID_undef; pnid++) {
198.           idx = X509_REQ_get_attr_by_NID(req, *pnid, -1);
199.           if (idx == -1)
                   ^
200.               continue;
201.           attr = X509_REQ_get_attr(req, idx);

crypto/x509/x509_req.c:201:9: 
199.           if (idx == -1)
200.               continue;
201. >         attr = X509_REQ_get_attr(req, idx);
202.           if (attr->single)
203.               ext = attr->value.single;

crypto/x509/x509_req.c:281:1: start of procedure X509_REQ_get_attr()
  279.   }
  280.   
  281. > X509_ATTRIBUTE *X509_REQ_get_attr(const X509_REQ *req, int loc)
  282.   {
  283.       return X509at_get_attr(req->req_info->attributes, loc);

crypto/x509/x509_req.c:283:5: 
  281.   X509_ATTRIBUTE *X509_REQ_get_attr(const X509_REQ *req, int loc)
  282.   {
  283. >     return X509at_get_attr(req->req_info->attributes, loc);
  284.   }
  285.   

crypto/x509/x509_att.c:104:1: start of procedure X509at_get_attr()
    102.   }
    103.   
    104. > X509_ATTRIBUTE *X509at_get_attr(const STACK_OF(X509_ATTRIBUTE) *x, int loc)
    105.   {
    106.       if (x == NULL || sk_X509_ATTRIBUTE_num(x) <= loc || loc < 0)

crypto/x509/x509_att.c:106:9: Taking true branch
    104.   X509_ATTRIBUTE *X509at_get_attr(const STACK_OF(X509_ATTRIBUTE) *x, int loc)
    105.   {
    106.       if (x == NULL || sk_X509_ATTRIBUTE_num(x) <= loc || loc < 0)
                   ^
    107.           return NULL;
    108.       else

crypto/x509/x509_att.c:107:9: 
    105.   {
    106.       if (x == NULL || sk_X509_ATTRIBUTE_num(x) <= loc || loc < 0)
    107. >         return NULL;
    108.       else
    109.           return sk_X509_ATTRIBUTE_value(x, loc);

crypto/x509/x509_att.c:110:1: return from a call to X509at_get_attr
    108.       else
    109.           return sk_X509_ATTRIBUTE_value(x, loc);
    110. > }
    111.   
    112.   X509_ATTRIBUTE *X509at_delete_attr(STACK_OF(X509_ATTRIBUTE) *x, int loc)

crypto/x509/x509_req.c:284:1: return from a call to X509_REQ_get_attr
  282.   {
  283.       return X509at_get_attr(req->req_info->attributes, loc);
  284. > }
  285.   
  286.   X509_ATTRIBUTE *X509_REQ_delete_attr(X509_REQ *req, int loc)

crypto/x509/x509_req.c:202:13: Taking false branch
200.               continue;
201.           attr = X509_REQ_get_attr(req, idx);
202.           if (attr->single)
                   ^
203.               ext = attr->value.single;
204.           else if (sk_ASN1_TYPE_num(attr->value.set))

STACK_OF(X509_EXTENSION) *X509_REQ_get_extensions(X509_REQ *req)
{
    X509_ATTRIBUTE *attr;
    ASN1_TYPE *ext = NULL;
    int idx, *pnid;
    const unsigned char *p;
    if ((req == NULL) || (req->req_info == NULL) || !ext_nids)
        return (NULL);
    for (pnid = ext_nids; *pnid != NID_undef; pnid++) {
        idx = X509_REQ_get_attr_by_NID(req, *pnid, -1);
        if (idx == -1)
            continue;
        attr = X509_REQ_get_attr(req, idx);
        if (attr->single)
            ext = attr->value.single;
        else if (sk_ASN1_TYPE_num(attr->value.set))
            ext = sk_ASN1_TYPE_value(attr->value.set, 0);
        break;
    }
    if (!ext || (ext->type != V_ASN1_SEQUENCE))
        return NULL;
    p = ext->value.sequence->data;
    return (STACK_OF(X509_EXTENSION) *)
        ASN1_item_d2i(NULL, &p, ext->value.sequence->length,
                      ASN1_ITEM_rptr(X509_EXTENSIONS));
}
['STACK_OF(X509_EXTENSION) *X509_REQ_get_extensions(X509_REQ *req)\n{\n    X509_ATTRIBUTE *attr;\n    ASN1_TYPE *ext = NULL;\n    int idx, *pnid;\n    const unsigned char *p;\n    if ((req == NULL) || (req->req_info == NULL) || !ext_nids)\n        return (NULL);\n    for (pnid = ext_nids; *pnid != NID_undef; pnid++) {\n        idx = X509_REQ_get_attr_by_NID(req, *pnid, -1);\n        if (idx == -1)\n            continue;\n        attr = X509_REQ_get_attr(req, idx);\n        if (attr->single)\n            ext = attr->value.single;\n        else if (sk_ASN1_TYPE_num(attr->value.set))\n            ext = sk_ASN1_TYPE_value(attr->value.set, 0);\n        break;\n    }\n    if (!ext || (ext->type != V_ASN1_SEQUENCE))\n        return NULL;\n    p = ext->value.sequence->data;\n    return (STACK_OF(X509_EXTENSION) *)\n        ASN1_item_d2i(NULL, &p, ext->value.sequence->length,\n                      ASN1_ITEM_rptr(X509_EXTENSIONS));\n}', 'int X509_REQ_get_attr_by_NID(const X509_REQ *req, int nid, int lastpos)\n{\n    return X509at_get_attr_by_NID(req->req_info->attributes, nid, lastpos);\n}', 'int X509at_get_attr_by_NID(const STACK_OF(X509_ATTRIBUTE) *x, int nid,\n                           int lastpos)\n{\n    ASN1_OBJECT *obj;\n    obj = OBJ_nid2obj(nid);\n    if (obj == NULL)\n        return (-2);\n    return (X509at_get_attr_by_OBJ(x, obj, lastpos));\n}', 'ASN1_OBJECT *OBJ_nid2obj(int n)\n{\n    ADDED_OBJ ad, *adp;\n    ASN1_OBJECT ob;\n    if ((n >= 0) && (n < NUM_NID)) {\n        if ((n != NID_undef) && (nid_objs[n].nid == NID_undef)) {\n            OBJerr(OBJ_F_OBJ_NID2OBJ, OBJ_R_UNKNOWN_NID);\n            return (NULL);\n        }\n        return ((ASN1_OBJECT *)&(nid_objs[n]));\n    } else if (added == NULL)\n        return (NULL);\n    else {\n        ad.type = ADDED_NID;\n        ad.obj = &ob;\n        ob.nid = n;\n        adp = lh_ADDED_OBJ_retrieve(added, &ad);\n        if (adp != NULL)\n            return (adp->obj);\n        else {\n            OBJerr(OBJ_F_OBJ_NID2OBJ, OBJ_R_UNKNOWN_NID);\n            return (NULL);\n        }\n    }\n}', 'void *lh_retrieve(_LHASH *lh, const void *data)\n{\n    unsigned long hash;\n    LHASH_NODE **rn;\n    void *ret;\n    lh->error = 0;\n    rn = getrn(lh, data, &hash);\n    if (*rn == NULL) {\n        lh->num_retrieve_miss++;\n        return (NULL);\n    } else {\n        ret = (*rn)->data;\n        lh->num_retrieve++;\n    }\n    return (ret);\n}', 'X509_ATTRIBUTE *X509_REQ_get_attr(const X509_REQ *req, int loc)\n{\n    return X509at_get_attr(req->req_info->attributes, loc);\n}', 'X509_ATTRIBUTE *X509at_get_attr(const STACK_OF(X509_ATTRIBUTE) *x, int loc)\n{\n    if (x == NULL || sk_X509_ATTRIBUTE_num(x) <= loc || loc < 0)\n        return NULL;\n    else\n        return sk_X509_ATTRIBUTE_value(x, loc);\n}']