crypto/store/str_lib.c:1302: error: NULL_DEREFERENCE
  pointer `null` is dereferenced by call to `STORE_ATTR_INFO_modify_sha1str()` at line 1302, column 4.
Showing all 82 steps of the trace


crypto/store/str_lib.c:1285:1: start of procedure STORE_ATTR_INFO_attr_free()
1283.   	return (STORE_ATTR_INFO *)OPENSSL_malloc(sizeof(STORE_ATTR_INFO));
1284.   	}
1285. > static void STORE_ATTR_INFO_attr_free(STORE_ATTR_INFO *attrs,
1286.   	STORE_ATTR_TYPES code)
1287.   	{

crypto/store/str_lib.c:1288:6: Taking true branch
1286.   	STORE_ATTR_TYPES code)
1287.   	{
1288.   	if (ATTR_IS_SET(attrs,code))
             ^
1289.   		{
1290.   		switch(code)

crypto/store/str_lib.c:1288:6: Taking true branch
1286.   	STORE_ATTR_TYPES code)
1287.   	{
1288.   	if (ATTR_IS_SET(attrs,code))
             ^
1289.   		{
1290.   		switch(code)

crypto/store/str_lib.c:1288:6: Taking true branch
1286.   	STORE_ATTR_TYPES code)
1287.   	{
1288.   	if (ATTR_IS_SET(attrs,code))
             ^
1289.   		{
1290.   		switch(code)

crypto/store/str_lib.c:1290:3: 
1288.   	if (ATTR_IS_SET(attrs,code))
1289.   		{
1290. > 		switch(code)
1291.   			{
1292.   		case STORE_ATTR_FRIENDLYNAME:

crypto/store/str_lib.c:1292:3: Switch condition is false. Skipping switch case
1290.   		switch(code)
1291.   			{
1292.   		case STORE_ATTR_FRIENDLYNAME:
          ^
1293.   		case STORE_ATTR_EMAIL:
1294.   		case STORE_ATTR_FILENAME:

crypto/store/str_lib.c:1293:3: Switch condition is false. Skipping switch case
1291.   			{
1292.   		case STORE_ATTR_FRIENDLYNAME:
1293.   		case STORE_ATTR_EMAIL:
          ^
1294.   		case STORE_ATTR_FILENAME:
1295.   			STORE_ATTR_INFO_modify_cstr(attrs, code, NULL, 0);

crypto/store/str_lib.c:1294:3: Switch condition is false. Skipping switch case
1292.   		case STORE_ATTR_FRIENDLYNAME:
1293.   		case STORE_ATTR_EMAIL:
1294.   		case STORE_ATTR_FILENAME:
          ^
1295.   			STORE_ATTR_INFO_modify_cstr(attrs, code, NULL, 0);
1296.   			break;

crypto/store/str_lib.c:1297:3: Switch condition is true. Entering switch case
1295.   			STORE_ATTR_INFO_modify_cstr(attrs, code, NULL, 0);
1296.   			break;
1297.   		case STORE_ATTR_KEYID:
          ^
1298.   		case STORE_ATTR_ISSUERKEYID:
1299.   		case STORE_ATTR_SUBJECTKEYID:

crypto/store/str_lib.c:1302:4: 
1300.   		case STORE_ATTR_ISSUERSERIALHASH:
1301.   		case STORE_ATTR_CERTHASH:
1302. > 			STORE_ATTR_INFO_modify_sha1str(attrs, code, NULL, 0);
1303.   			break;
1304.   		case STORE_ATTR_ISSUER:

crypto/store/str_lib.c:1483:1: start of procedure STORE_ATTR_INFO_modify_sha1str()
  1481.   	return STORE_ATTR_INFO_set_cstr(attrs, code, cstr, cstr_size);
  1482.   	}
  1483. > int STORE_ATTR_INFO_modify_sha1str(STORE_ATTR_INFO *attrs, STORE_ATTR_TYPES code,
  1484.   	unsigned char *sha1str, size_t sha1str_size)
  1485.   	{

crypto/store/str_lib.c:1486:7: Taking false branch
  1484.   	unsigned char *sha1str, size_t sha1str_size)
  1485.   	{
  1486.   	if (!attrs)
                ^
  1487.   		{
  1488.   		STOREerr(STORE_F_STORE_ATTR_INFO_MODIFY_SHA1STR,

crypto/store/str_lib.c:1492:6: Taking true branch
  1490.   		return 0;
  1491.   		}
  1492.   	if (ATTR_IS_SET(attrs,code))
               ^
  1493.   		{
  1494.   		OPENSSL_free(attrs->values[code].sha1string);

crypto/store/str_lib.c:1492:6: Taking false branch
  1490.   		return 0;
  1491.   		}
  1492.   	if (ATTR_IS_SET(attrs,code))
               ^
  1493.   		{
  1494.   		OPENSSL_free(attrs->values[code].sha1string);

crypto/store/str_lib.c:1498:2: 
  1496.   		CLEAR_ATTRBIT(attrs, code);
  1497.   		}
  1498. > 	return STORE_ATTR_INFO_set_sha1str(attrs, code, sha1str, sha1str_size);
  1499.   	}
  1500.   int STORE_ATTR_INFO_modify_dn(STORE_ATTR_INFO *attrs, STORE_ATTR_TYPES code,

crypto/store/str_lib.c:1404:1: start of procedure STORE_ATTR_INFO_set_sha1str()
    1402.   	return 0;
    1403.   	}
    1404. > int STORE_ATTR_INFO_set_sha1str(STORE_ATTR_INFO *attrs, STORE_ATTR_TYPES code,
    1405.   	unsigned char *sha1str, size_t sha1str_size)
    1406.   	{

crypto/store/str_lib.c:1407:7: Taking false branch
    1405.   	unsigned char *sha1str, size_t sha1str_size)
    1406.   	{
    1407.   	if (!attrs)
                  ^
    1408.   		{
    1409.   		STOREerr(STORE_F_STORE_ATTR_INFO_SET_SHA1STR,

crypto/store/str_lib.c:1413:7: Taking false branch
    1411.   		return 0;
    1412.   		}
    1413.   	if (!ATTR_IS_SET(attrs,code))
                  ^
    1414.   		{
    1415.   		if ((attrs->values[code].sha1string =

crypto/store/str_lib.c:1413:7: Taking true branch
    1411.   		return 0;
    1412.   		}
    1413.   	if (!ATTR_IS_SET(attrs,code))
                  ^
    1414.   		{
    1415.   		if ((attrs->values[code].sha1string =

crypto/store/str_lib.c:1415:8: 
    1413.   	if (!ATTR_IS_SET(attrs,code))
    1414.   		{
    1415. > 		if ((attrs->values[code].sha1string =
    1416.   			    (unsigned char *)BUF_memdup(sha1str,
    1417.   				    sha1str_size)))

crypto/buffer/buffer.c:187:1: start of procedure BUF_memdup()
      185.   	}
      186.   
      187. > void *BUF_memdup(const void *data, size_t siz)
      188.   	{
      189.   	void *ret;

crypto/buffer/buffer.c:191:6: Taking false branch
      189.   	void *ret;
      190.   
      191.   	if (data == NULL) return(NULL);
                  ^
      192.   
      193.   	ret=OPENSSL_malloc(siz);

crypto/buffer/buffer.c:193:2: 
      191.   	if (data == NULL) return(NULL);
      192.   
      193. > 	ret=OPENSSL_malloc(siz);
      194.   	if (ret == NULL) 
      195.   		{

crypto/mem.c:291:1: start of procedure CRYPTO_malloc()
        289.   	}
        290.   
        291. > void *CRYPTO_malloc(int num, const char *file, int line)
        292.   	{
        293.   	void *ret = NULL;

crypto/mem.c:293:2: 
        291.   void *CRYPTO_malloc(int num, const char *file, int line)
        292.   	{
        293. > 	void *ret = NULL;
        294.   	extern unsigned char cleanse_ctr;
        295.   

crypto/mem.c:296:6: Taking false branch
        294.   	extern unsigned char cleanse_ctr;
        295.   
        296.   	if (num <= 0) return NULL;
                    ^
        297.   
        298.   	allow_customize = 0;

crypto/mem.c:298:2: 
        296.   	if (num <= 0) return NULL;
        297.   
        298. > 	allow_customize = 0;
        299.   	if (malloc_debug_func != NULL)
        300.   		{

crypto/mem.c:299:6: Taking false branch
        297.   
        298.   	allow_customize = 0;
        299.   	if (malloc_debug_func != NULL)
                    ^
        300.   		{
        301.   		allow_customize_debug = 0;

crypto/mem.c:304:2: Skipping __function_pointer__(): unresolved function pointer
        302.   		malloc_debug_func(NULL, num, file, line, 0);
        303.   		}
        304.   	ret = malloc_ex_func(num,file,line);
                ^
        305.   #ifdef LEVITTE_DEBUG_MEM
        306.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);

crypto/mem.c:308:6: Taking false branch
        306.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);
        307.   #endif
        308.   	if (malloc_debug_func != NULL)
                    ^
        309.   		malloc_debug_func(ret, num, file, line, 1);
        310.   

crypto/mem.c:314:12: Taking false branch
        312.            * sanitisation function can't be optimised out. NB: We only do
        313.            * this for >2Kb so the overhead doesn't bother us. */
        314.           if(ret && (num > 2048))
                          ^
        315.                   ((unsigned char *)ret)[0] = cleanse_ctr;
        316.   

crypto/mem.c:317:2: 
        315.                   ((unsigned char *)ret)[0] = cleanse_ctr;
        316.   
        317. > 	return ret;
        318.   	}
        319.   

crypto/mem.c:318:2: return from a call to CRYPTO_malloc
        316.   
        317.   	return ret;
        318.   	}
                ^
        319.   
        320.   void *CRYPTO_realloc(void *str, int num, const char *file, int line)

crypto/buffer/buffer.c:194:6: Taking true branch
      192.   
      193.   	ret=OPENSSL_malloc(siz);
      194.   	if (ret == NULL) 
                  ^
      195.   		{
      196.   		BUFerr(BUF_F_BUF_MEMDUP,ERR_R_MALLOC_FAILURE);

crypto/buffer/buffer.c:196:3: 
      194.   	if (ret == NULL) 
      195.   		{
      196. > 		BUFerr(BUF_F_BUF_MEMDUP,ERR_R_MALLOC_FAILURE);
      197.   		return(NULL);
      198.   		}

crypto/err/err.c:666:1: start of procedure ERR_put_error()
        664.   /********************************************************/
        665.   
        666. > void ERR_put_error(int lib, int func, int reason, const char *file,
        667.   	     int line)
        668.   	{

crypto/err/err.c:690:2: Skipping ERR_get_state(): empty list of specs
        688.   	}
        689.   #endif
        690.   	es=ERR_get_state();
                ^
        691.   
        692.   	es->top=(es->top+1)%ERR_NUM_ERRORS;

crypto/err/err.c:692:2: 
        690.   	es=ERR_get_state();
        691.   
        692. > 	es->top=(es->top+1)%ERR_NUM_ERRORS;
        693.   	if (es->top == es->bottom)
        694.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;

crypto/err/err.c:693:6: Taking false branch
        691.   
        692.   	es->top=(es->top+1)%ERR_NUM_ERRORS;
        693.   	if (es->top == es->bottom)
                    ^
        694.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
        695.   	es->err_flags[es->top]=0;

crypto/err/err.c:695:2: 
        693.   	if (es->top == es->bottom)
        694.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
        695. > 	es->err_flags[es->top]=0;
        696.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
        697.   	es->err_file[es->top]=file;

crypto/err/err.c:696:2: 
        694.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
        695.   	es->err_flags[es->top]=0;
        696. > 	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
        697.   	es->err_file[es->top]=file;
        698.   	es->err_line[es->top]=line;

crypto/err/err.c:697:2: 
        695.   	es->err_flags[es->top]=0;
        696.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
        697. > 	es->err_file[es->top]=file;
        698.   	es->err_line[es->top]=line;
        699.   	err_clear_data(es,es->top);

crypto/err/err.c:698:2: 
        696.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
        697.   	es->err_file[es->top]=file;
        698. > 	es->err_line[es->top]=line;
        699.   	err_clear_data(es,es->top);
        700.   	}

crypto/err/err.c:699:2: Taking true branch
        697.   	es->err_file[es->top]=file;
        698.   	es->err_line[es->top]=line;
        699.   	err_clear_data(es,es->top);
                ^
        700.   	}
        701.   

crypto/err/err.c:699:2: Taking true branch
        697.   	es->err_file[es->top]=file;
        698.   	es->err_line[es->top]=line;
        699.   	err_clear_data(es,es->top);
                ^
        700.   	}
        701.   

crypto/mem.c:371:1: start of procedure CRYPTO_free()
          369.   	}
          370.   
          371. > void CRYPTO_free(void *str)
          372.   	{
          373.   	if (free_debug_func != NULL)

crypto/mem.c:373:6: Taking true branch
          371.   void CRYPTO_free(void *str)
          372.   	{
          373.   	if (free_debug_func != NULL)
                      ^
          374.   		free_debug_func(str, 0);
          375.   #ifdef LEVITTE_DEBUG_MEM

crypto/mem.c:374:3: Skipping __function_pointer__(): unresolved function pointer
          372.   	{
          373.   	if (free_debug_func != NULL)
          374.   		free_debug_func(str, 0);
                   ^
          375.   #ifdef LEVITTE_DEBUG_MEM
          376.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         < 0x%p\n", str);

crypto/mem.c:378:2: Skipping __function_pointer__(): unresolved function pointer
          376.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         < 0x%p\n", str);
          377.   #endif
          378.   	free_func(str);
                  ^
          379.   	if (free_debug_func != NULL)
          380.   		free_debug_func(NULL, 1);

crypto/mem.c:379:6: Taking true branch
          377.   #endif
          378.   	free_func(str);
          379.   	if (free_debug_func != NULL)
                      ^
          380.   		free_debug_func(NULL, 1);
          381.   	}

crypto/mem.c:380:3: Skipping __function_pointer__(): unresolved function pointer
          378.   	free_func(str);
          379.   	if (free_debug_func != NULL)
          380.   		free_debug_func(NULL, 1);
                   ^
          381.   	}
          382.   

crypto/mem.c:379:2: 
          377.   #endif
          378.   	free_func(str);
          379. > 	if (free_debug_func != NULL)
          380.   		free_debug_func(NULL, 1);
          381.   	}

crypto/mem.c:381:2: return from a call to CRYPTO_free
          379.   	if (free_debug_func != NULL)
          380.   		free_debug_func(NULL, 1);
          381.   	}
                  ^
          382.   
          383.   void *CRYPTO_remalloc(void *a, int num, const char *file, int line)

crypto/err/err.c:699:2: Loop condition is false. Leaving loop
        697.   	es->err_file[es->top]=file;
        698.   	es->err_line[es->top]=line;
        699.   	err_clear_data(es,es->top);
                ^
        700.   	}
        701.   

crypto/err/err.c:700:2: return from a call to ERR_put_error
        698.   	es->err_line[es->top]=line;
        699.   	err_clear_data(es,es->top);
        700.   	}
                ^
        701.   
        702.   void ERR_clear_error(void)

crypto/buffer/buffer.c:197:3: 
      195.   		{
      196.   		BUFerr(BUF_F_BUF_MEMDUP,ERR_R_MALLOC_FAILURE);
      197. > 		return(NULL);
      198.   		}
      199.   	return memcpy(ret, data, siz);

crypto/buffer/buffer.c:200:2: return from a call to BUF_memdup
      198.   		}
      199.   	return memcpy(ret, data, siz);
      200.   	}	
              ^
      201.   
      202.   size_t BUF_strlcpy(char *dst, const char *src, size_t size)

crypto/store/str_lib.c:1415:8: Taking false branch
    1413.   	if (!ATTR_IS_SET(attrs,code))
    1414.   		{
    1415.   		if ((attrs->values[code].sha1string =
                   ^
    1416.   			    (unsigned char *)BUF_memdup(sha1str,
    1417.   				    sha1str_size)))

crypto/store/str_lib.c:1419:3: 
    1417.   				    sha1str_size)))
    1418.   			return 1;
    1419. > 		STOREerr(STORE_F_STORE_ATTR_INFO_SET_SHA1STR,
    1420.   			ERR_R_MALLOC_FAILURE);
    1421.   		return 0;

crypto/err/err.c:666:1: start of procedure ERR_put_error()
      664.   /********************************************************/
      665.   
      666. > void ERR_put_error(int lib, int func, int reason, const char *file,
      667.   	     int line)
      668.   	{

crypto/err/err.c:690:2: Skipping ERR_get_state(): empty list of specs
      688.   	}
      689.   #endif
      690.   	es=ERR_get_state();
              ^
      691.   
      692.   	es->top=(es->top+1)%ERR_NUM_ERRORS;

crypto/err/err.c:692:2: 
      690.   	es=ERR_get_state();
      691.   
      692. > 	es->top=(es->top+1)%ERR_NUM_ERRORS;
      693.   	if (es->top == es->bottom)
      694.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;

crypto/err/err.c:693:6: Taking false branch
      691.   
      692.   	es->top=(es->top+1)%ERR_NUM_ERRORS;
      693.   	if (es->top == es->bottom)
                  ^
      694.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
      695.   	es->err_flags[es->top]=0;

crypto/err/err.c:695:2: 
      693.   	if (es->top == es->bottom)
      694.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
      695. > 	es->err_flags[es->top]=0;
      696.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
      697.   	es->err_file[es->top]=file;

crypto/err/err.c:696:2: 
      694.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
      695.   	es->err_flags[es->top]=0;
      696. > 	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
      697.   	es->err_file[es->top]=file;
      698.   	es->err_line[es->top]=line;

crypto/err/err.c:697:2: 
      695.   	es->err_flags[es->top]=0;
      696.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
      697. > 	es->err_file[es->top]=file;
      698.   	es->err_line[es->top]=line;
      699.   	err_clear_data(es,es->top);

crypto/err/err.c:698:2: 
      696.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
      697.   	es->err_file[es->top]=file;
      698. > 	es->err_line[es->top]=line;
      699.   	err_clear_data(es,es->top);
      700.   	}

crypto/err/err.c:699:2: Taking true branch
      697.   	es->err_file[es->top]=file;
      698.   	es->err_line[es->top]=line;
      699.   	err_clear_data(es,es->top);
              ^
      700.   	}
      701.   

crypto/err/err.c:699:2: Taking true branch
      697.   	es->err_file[es->top]=file;
      698.   	es->err_line[es->top]=line;
      699.   	err_clear_data(es,es->top);
              ^
      700.   	}
      701.   

crypto/mem.c:371:1: start of procedure CRYPTO_free()
        369.   	}
        370.   
        371. > void CRYPTO_free(void *str)
        372.   	{
        373.   	if (free_debug_func != NULL)

crypto/mem.c:373:6: Taking true branch
        371.   void CRYPTO_free(void *str)
        372.   	{
        373.   	if (free_debug_func != NULL)
                    ^
        374.   		free_debug_func(str, 0);
        375.   #ifdef LEVITTE_DEBUG_MEM

crypto/mem.c:374:3: Skipping __function_pointer__(): unresolved function pointer
        372.   	{
        373.   	if (free_debug_func != NULL)
        374.   		free_debug_func(str, 0);
                 ^
        375.   #ifdef LEVITTE_DEBUG_MEM
        376.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         < 0x%p\n", str);

crypto/mem.c:378:2: Skipping __function_pointer__(): unresolved function pointer
        376.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         < 0x%p\n", str);
        377.   #endif
        378.   	free_func(str);
                ^
        379.   	if (free_debug_func != NULL)
        380.   		free_debug_func(NULL, 1);

crypto/mem.c:379:6: Taking true branch
        377.   #endif
        378.   	free_func(str);
        379.   	if (free_debug_func != NULL)
                    ^
        380.   		free_debug_func(NULL, 1);
        381.   	}

crypto/mem.c:380:3: Skipping __function_pointer__(): unresolved function pointer
        378.   	free_func(str);
        379.   	if (free_debug_func != NULL)
        380.   		free_debug_func(NULL, 1);
                 ^
        381.   	}
        382.   

crypto/mem.c:379:2: 
        377.   #endif
        378.   	free_func(str);
        379. > 	if (free_debug_func != NULL)
        380.   		free_debug_func(NULL, 1);
        381.   	}

crypto/mem.c:381:2: return from a call to CRYPTO_free
        379.   	if (free_debug_func != NULL)
        380.   		free_debug_func(NULL, 1);
        381.   	}
                ^
        382.   
        383.   void *CRYPTO_remalloc(void *a, int num, const char *file, int line)

crypto/err/err.c:699:2: Loop condition is false. Leaving loop
      697.   	es->err_file[es->top]=file;
      698.   	es->err_line[es->top]=line;
      699.   	err_clear_data(es,es->top);
              ^
      700.   	}
      701.   

crypto/err/err.c:700:2: return from a call to ERR_put_error
      698.   	es->err_line[es->top]=line;
      699.   	err_clear_data(es,es->top);
      700.   	}
              ^
      701.   
      702.   void ERR_clear_error(void)

crypto/store/str_lib.c:1421:3: 
    1419.   		STOREerr(STORE_F_STORE_ATTR_INFO_SET_SHA1STR,
    1420.   			ERR_R_MALLOC_FAILURE);
    1421. > 		return 0;
    1422.   		}
    1423.   	STOREerr(STORE_F_STORE_ATTR_INFO_SET_SHA1STR, STORE_R_ALREADY_HAS_A_VALUE);

crypto/store/str_lib.c:1425:2: return from a call to STORE_ATTR_INFO_set_sha1str
    1423.   	STOREerr(STORE_F_STORE_ATTR_INFO_SET_SHA1STR, STORE_R_ALREADY_HAS_A_VALUE);
    1424.   	return 0;
    1425.   	}
             ^
    1426.   int STORE_ATTR_INFO_set_dn(STORE_ATTR_INFO *attrs, STORE_ATTR_TYPES code,
    1427.   	X509_NAME *dn)

crypto/store/str_lib.c:1499:2: return from a call to STORE_ATTR_INFO_modify_sha1str
  1497.   		}
  1498.   	return STORE_ATTR_INFO_set_sha1str(attrs, code, sha1str, sha1str_size);
  1499.   	}
           ^
  1500.   int STORE_ATTR_INFO_modify_dn(STORE_ATTR_INFO *attrs, STORE_ATTR_TYPES code,
  1501.   	X509_NAME *dn)
