crypto/pkcs7/pk7_smime.c:346: error: NULL_DEREFERENCE
  pointer `p7->d.enveloped` last assigned on line 345 could be null and is dereferenced by call to `PKCS7_set_cipher()` at line 346, column 6.
Showing all 47 steps of the trace


crypto/pkcs7/pk7_smime.c:333:1: start of procedure PKCS7_encrypt()
331.   /* Build a complete PKCS#7 enveloped data */
332.   
333. > PKCS7 *PKCS7_encrypt(STACK_OF(X509) *certs, BIO *in, EVP_CIPHER *cipher,
334.   								int flags)
335.   {

crypto/pkcs7/pk7_smime.c:337:2: 
335.   {
336.   	PKCS7 *p7;
337. > 	BIO *p7bio = NULL;
338.   	int i;
339.   	X509 *x509;

crypto/pkcs7/pk7_smime.c:340:7: Taking false branch
338.   	int i;
339.   	X509 *x509;
340.   	if(!(p7 = PKCS7_new())) {
             ^
341.   		PKCS7err(PKCS7_F_PKCS7_ENCRYPT,ERR_R_MALLOC_FAILURE);
342.   		return NULL;

crypto/pkcs7/pk7_smime.c:345:2: 
343.   	}
344.   
345. > 	PKCS7_set_type(p7, NID_pkcs7_enveloped);
346.   	if(!PKCS7_set_cipher(p7, cipher)) {
347.   		PKCS7err(PKCS7_F_PKCS7_ENCRYPT,PKCS7_R_ERROR_SETTING_CIPHER);

crypto/pkcs7/pk7_lib.c:143:1: start of procedure PKCS7_set_type()
  141.   	}
  142.   
  143. > int PKCS7_set_type(PKCS7 *p7, int type)
  144.   	{
  145.   	ASN1_OBJECT *obj;

crypto/pkcs7/pk7_lib.c:147:2: Skipping PKCS7_content_free(): empty list of specs
  145.   	ASN1_OBJECT *obj;
  146.   
  147.   	PKCS7_content_free(p7);
          ^
  148.   	obj=OBJ_nid2obj(type); /* will not fail */
  149.   

crypto/pkcs7/pk7_lib.c:148:2: 
  146.   
  147.   	PKCS7_content_free(p7);
  148. > 	obj=OBJ_nid2obj(type); /* will not fail */
  149.   
  150.   	switch (type)

crypto/objects/obj_dat.c:262:1: start of procedure OBJ_nid2obj()
    260.   	}
    261.   
    262. > ASN1_OBJECT *OBJ_nid2obj(int n)
    263.   	{
    264.   	ADDED_OBJ ad,*adp;

crypto/objects/obj_dat.c:267:7: Taking true branch
    265.   	ASN1_OBJECT ob;
    266.   
    267.   	if ((n >= 0) && (n < NUM_NID))
                 ^
    268.   		{
    269.   		if ((n != NID_undef) && (nid_objs[n].nid == NID_undef))

crypto/objects/obj_dat.c:267:19: Taking true branch
    265.   	ASN1_OBJECT ob;
    266.   
    267.   	if ((n >= 0) && (n < NUM_NID))
                             ^
    268.   		{
    269.   		if ((n != NID_undef) && (nid_objs[n].nid == NID_undef))

crypto/objects/obj_dat.c:269:8: Taking true branch
    267.   	if ((n >= 0) && (n < NUM_NID))
    268.   		{
    269.   		if ((n != NID_undef) && (nid_objs[n].nid == NID_undef))
                  ^
    270.   			{
    271.   			OBJerr(OBJ_F_OBJ_NID2OBJ,OBJ_R_UNKNOWN_NID);

crypto/objects/obj_dat.c:269:28: Taking true branch
    267.   	if ((n >= 0) && (n < NUM_NID))
    268.   		{
    269.   		if ((n != NID_undef) && (nid_objs[n].nid == NID_undef))
                                      ^
    270.   			{
    271.   			OBJerr(OBJ_F_OBJ_NID2OBJ,OBJ_R_UNKNOWN_NID);

crypto/objects/obj_dat.c:271:4: 
    269.   		if ((n != NID_undef) && (nid_objs[n].nid == NID_undef))
    270.   			{
    271. > 			OBJerr(OBJ_F_OBJ_NID2OBJ,OBJ_R_UNKNOWN_NID);
    272.   			return(NULL);
    273.   			}

crypto/err/err.c:353:1: start of procedure ERR_put_error()
      351.   /********************************************************/
      352.   
      353. > void ERR_put_error(int lib, int func, int reason, const char *file,
      354.   	     int line)
      355.   	{

crypto/err/err.c:377:2: Skipping ERR_get_state(): empty list of specs
      375.   	}
      376.   #endif
      377.   	es=ERR_get_state();
              ^
      378.   
      379.   	es->top=(es->top+1)%ERR_NUM_ERRORS;

crypto/err/err.c:379:2: 
      377.   	es=ERR_get_state();
      378.   
      379. > 	es->top=(es->top+1)%ERR_NUM_ERRORS;
      380.   	if (es->top == es->bottom)
      381.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;

crypto/err/err.c:380:6: Taking false branch
      378.   
      379.   	es->top=(es->top+1)%ERR_NUM_ERRORS;
      380.   	if (es->top == es->bottom)
                  ^
      381.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
      382.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);

crypto/err/err.c:382:2: 
      380.   	if (es->top == es->bottom)
      381.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
      382. > 	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
      383.   	es->err_file[es->top]=file;
      384.   	es->err_line[es->top]=line;

crypto/err/err.c:383:2: 
      381.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
      382.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
      383. > 	es->err_file[es->top]=file;
      384.   	es->err_line[es->top]=line;
      385.   	err_clear_data(es,es->top);

crypto/err/err.c:384:2: 
      382.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
      383.   	es->err_file[es->top]=file;
      384. > 	es->err_line[es->top]=line;
      385.   	err_clear_data(es,es->top);
      386.   	}

crypto/err/err.c:385:2: Taking true branch
      383.   	es->err_file[es->top]=file;
      384.   	es->err_line[es->top]=line;
      385.   	err_clear_data(es,es->top);
              ^
      386.   	}
      387.   

crypto/err/err.c:385:2: Taking false branch
      383.   	es->err_file[es->top]=file;
      384.   	es->err_line[es->top]=line;
      385.   	err_clear_data(es,es->top);
              ^
      386.   	}
      387.   

crypto/err/err.c:386:2: return from a call to ERR_put_error
      384.   	es->err_line[es->top]=line;
      385.   	err_clear_data(es,es->top);
      386.   	}
              ^
      387.   
      388.   void ERR_clear_error(void)

crypto/objects/obj_dat.c:272:4: 
    270.   			{
    271.   			OBJerr(OBJ_F_OBJ_NID2OBJ,OBJ_R_UNKNOWN_NID);
    272. > 			return(NULL);
    273.   			}
    274.   		return((ASN1_OBJECT *)&(nid_objs[n]));

crypto/objects/obj_dat.c:292:2: return from a call to OBJ_nid2obj
    290.   			}
    291.   		}
    292.   	}
            ^
    293.   
    294.   const char *OBJ_nid2sn(int n)

crypto/pkcs7/pk7_lib.c:150:2: 
  148.   	obj=OBJ_nid2obj(type); /* will not fail */
  149.   
  150. > 	switch (type)
  151.   		{
  152.   	case NID_pkcs7_signed:

crypto/pkcs7/pk7_lib.c:152:2: Switch condition is false. Skipping switch case
  150.   	switch (type)
  151.   		{
  152.   	case NID_pkcs7_signed:
          ^
  153.   		p7->type=obj;
  154.   		if ((p7->d.sign=PKCS7_SIGNED_new()) == NULL)

crypto/pkcs7/pk7_lib.c:158:2: Switch condition is false. Skipping switch case
  156.   		ASN1_INTEGER_set(p7->d.sign->version,1);
  157.   		break;
  158.   	case NID_pkcs7_data:
          ^
  159.   		p7->type=obj;
  160.   		if ((p7->d.data=M_ASN1_OCTET_STRING_new()) == NULL)

crypto/pkcs7/pk7_lib.c:163:2: Switch condition is false. Skipping switch case
  161.   			goto err;
  162.   		break;
  163.   	case NID_pkcs7_signedAndEnveloped:
          ^
  164.   		p7->type=obj;
  165.   		if ((p7->d.signed_and_enveloped=PKCS7_SIGN_ENVELOPE_new())

crypto/pkcs7/pk7_lib.c:169:2: Switch condition is true. Entering switch case
  167.   		ASN1_INTEGER_set(p7->d.signed_and_enveloped->version,1);
  168.   		break;
  169.   	case NID_pkcs7_enveloped:
          ^
  170.   		p7->type=obj;
  171.   		if ((p7->d.enveloped=PKCS7_ENVELOPE_new())

crypto/pkcs7/pk7_lib.c:170:3: 
  168.   		break;
  169.   	case NID_pkcs7_enveloped:
  170. > 		p7->type=obj;
  171.   		if ((p7->d.enveloped=PKCS7_ENVELOPE_new())
  172.   			== NULL) goto err;

crypto/pkcs7/pk7_lib.c:171:7: Taking true branch
  169.   	case NID_pkcs7_enveloped:
  170.   		p7->type=obj;
  171.   		if ((p7->d.enveloped=PKCS7_ENVELOPE_new())
               ^
  172.   			== NULL) goto err;
  173.   		ASN1_INTEGER_set(p7->d.enveloped->version,0);

crypto/pkcs7/pk7_lib.c:188:1: 
  186.   		}
  187.   	return(1);
  188. > err:
  189.   	return(0);
  190.   	}

crypto/pkcs7/pk7_lib.c:189:2: 
  187.   	return(1);
  188.   err:
  189. > 	return(0);
  190.   	}
  191.   

crypto/pkcs7/pk7_lib.c:190:2: return from a call to PKCS7_set_type
  188.   err:
  189.   	return(0);
  190.   	}
          ^
  191.   
  192.   int PKCS7_add_signer(PKCS7 *p7, PKCS7_SIGNER_INFO *psi)

crypto/pkcs7/pk7_smime.c:346:6: 
344.   
345.   	PKCS7_set_type(p7, NID_pkcs7_enveloped);
346. > 	if(!PKCS7_set_cipher(p7, cipher)) {
347.   		PKCS7err(PKCS7_F_PKCS7_ENCRYPT,PKCS7_R_ERROR_SETTING_CIPHER);
348.   		goto err;

crypto/pkcs7/pk7_lib.c:438:1: start of procedure PKCS7_set_cipher()
  436.   	}
  437.   
  438. > int PKCS7_set_cipher(PKCS7 *p7, const EVP_CIPHER *cipher)
  439.   	{
  440.   	int i;

crypto/pkcs7/pk7_lib.c:444:2: 
  442.   	PKCS7_ENC_CONTENT *ec;
  443.   
  444. > 	i=OBJ_obj2nid(p7->type);
  445.   	switch (i)
  446.   		{

crypto/objects/obj_dat.c:358:1: start of procedure OBJ_obj2nid()
    356.   	}
    357.   
    358. > int OBJ_obj2nid(ASN1_OBJECT *a)
    359.   	{
    360.   	ASN1_OBJECT **op;

crypto/objects/obj_dat.c:363:6: Taking false branch
    361.   	ADDED_OBJ ad,*adp;
    362.   
    363.   	if (a == NULL)
                ^
    364.   		return(NID_undef);
    365.   	if (a->nid != 0)

crypto/objects/obj_dat.c:365:6: Taking true branch
    363.   	if (a == NULL)
    364.   		return(NID_undef);
    365.   	if (a->nid != 0)
                ^
    366.   		return(a->nid);
    367.   

crypto/objects/obj_dat.c:366:3: 
    364.   		return(NID_undef);
    365.   	if (a->nid != 0)
    366. > 		return(a->nid);
    367.   
    368.   	if (added != NULL)

crypto/objects/obj_dat.c:380:2: return from a call to OBJ_obj2nid
    378.   		return(NID_undef);
    379.   	return((*op)->nid);
    380.   	}
            ^
    381.   
    382.   /* Convert an object name into an ASN1_OBJECT

crypto/pkcs7/pk7_lib.c:445:2: 
  443.   
  444.   	i=OBJ_obj2nid(p7->type);
  445. > 	switch (i)
  446.   		{
  447.   	case NID_pkcs7_signedAndEnveloped:

crypto/pkcs7/pk7_lib.c:447:2: Switch condition is false. Skipping switch case
  445.   	switch (i)
  446.   		{
  447.   	case NID_pkcs7_signedAndEnveloped:
          ^
  448.   		ec=p7->d.signed_and_enveloped->enc_data;
  449.   		break;

crypto/pkcs7/pk7_lib.c:450:2: Switch condition is true. Entering switch case
  448.   		ec=p7->d.signed_and_enveloped->enc_data;
  449.   		break;
  450.   	case NID_pkcs7_enveloped:
          ^
  451.   		ec=p7->d.enveloped->enc_data;
  452.   		break;

crypto/pkcs7/pk7_lib.c:451:3: 
  449.   		break;
  450.   	case NID_pkcs7_enveloped:
  451. > 		ec=p7->d.enveloped->enc_data;
  452.   		break;
  453.   	default:
