crypto/x509v3/pcy_tree.c:631: error: NULL_DEREFERENCE
  pointer `cache` last assigned on line 630 could be null and is dereferenced by call to `tree_link_nodes()` at line 631, column 14.
Showing all 46 steps of the trace


crypto/x509v3/pcy_tree.c:623:1: start of procedure tree_evaluate()
621.    * (see tree_prune()).
622.    */
623. > static int tree_evaluate(X509_POLICY_TREE *tree)
624.   {
625.       int ret, i;

crypto/x509v3/pcy_tree.c:626:5: 
624.   {
625.       int ret, i;
626. >     X509_POLICY_LEVEL *curr = tree->levels + 1;
627.       const X509_POLICY_CACHE *cache;
628.   

crypto/x509v3/pcy_tree.c:629:10: 
627.       const X509_POLICY_CACHE *cache;
628.   
629. >     for (i = 1; i < tree->nlevel; i++, curr++) {
630.           cache = policy_cache_set(curr->cert);
631.           if (!tree_link_nodes(curr, cache))

crypto/x509v3/pcy_tree.c:629:17: Loop condition is true. Entering loop body
627.       const X509_POLICY_CACHE *cache;
628.   
629.       for (i = 1; i < tree->nlevel; i++, curr++) {
                       ^
630.           cache = policy_cache_set(curr->cert);
631.           if (!tree_link_nodes(curr, cache))

crypto/x509v3/pcy_tree.c:630:9: 
628.   
629.       for (i = 1; i < tree->nlevel; i++, curr++) {
630. >         cache = policy_cache_set(curr->cert);
631.           if (!tree_link_nodes(curr, cache))
632.               return X509_PCY_TREE_INTERNAL;

crypto/x509v3/pcy_cache.c:223:1: start of procedure policy_cache_set()
  221.   }
  222.   
  223. > const X509_POLICY_CACHE *policy_cache_set(X509 *x)
  224.   {
  225.   

crypto/x509v3/pcy_cache.c:226:9: Taking true branch
  224.   {
  225.   
  226.       if (x->policy_cache == NULL) {
                 ^
  227.           CRYPTO_w_lock(CRYPTO_LOCK_X509);
  228.           policy_cache_new(x);

crypto/x509v3/pcy_cache.c:227:9: 
  225.   
  226.       if (x->policy_cache == NULL) {
  227. >         CRYPTO_w_lock(CRYPTO_LOCK_X509);
  228.           policy_cache_new(x);
  229.           CRYPTO_w_unlock(CRYPTO_LOCK_X509);

crypto/lock.c:413:1: start of procedure CRYPTO_lock()
    411.   }
    412.   
    413. > void CRYPTO_lock(int mode, int type, const char *file, int line)
    414.   {
    415.   #ifdef LOCK_DEBUG

crypto/lock.c:440:9: Taking false branch
    438.       }
    439.   #endif
    440.       if (type < 0) {
                   ^
    441.           if (dynlock_lock_callback != NULL) {
    442.               struct CRYPTO_dynlock_value *pointer

crypto/lock.c:451:16: Taking true branch
    449.               CRYPTO_destroy_dynlockid(type);
    450.           }
    451.       } else if (locking_callback != NULL)
                          ^
    452.           locking_callback(mode, type, file, line);
    453.   }

crypto/lock.c:452:9: Skipping __function_pointer__(): unresolved function pointer
    450.           }
    451.       } else if (locking_callback != NULL)
    452.           locking_callback(mode, type, file, line);
                   ^
    453.   }
    454.   

crypto/lock.c:440:5: 
    438.       }
    439.   #endif
    440. >     if (type < 0) {
    441.           if (dynlock_lock_callback != NULL) {
    442.               struct CRYPTO_dynlock_value *pointer

crypto/lock.c:453:1: return from a call to CRYPTO_lock
    451.       } else if (locking_callback != NULL)
    452.           locking_callback(mode, type, file, line);
    453. > }
    454.   
    455.   int CRYPTO_add_lock(int *pointer, int amount, int type, const char *file,

crypto/x509v3/pcy_cache.c:228:9: 
  226.       if (x->policy_cache == NULL) {
  227.           CRYPTO_w_lock(CRYPTO_LOCK_X509);
  228. >         policy_cache_new(x);
  229.           CRYPTO_w_unlock(CRYPTO_LOCK_X509);
  230.       }

crypto/x509v3/pcy_cache.c:122:1: start of procedure policy_cache_new()
    120.   }
    121.   
    122. > static int policy_cache_new(X509 *x)
    123.   {
    124.       X509_POLICY_CACHE *cache;

crypto/x509v3/pcy_cache.c:125:5: 
    123.   {
    124.       X509_POLICY_CACHE *cache;
    125. >     ASN1_INTEGER *ext_any = NULL;
    126.       POLICY_CONSTRAINTS *ext_pcons = NULL;
    127.       CERTIFICATEPOLICIES *ext_cpols = NULL;

crypto/x509v3/pcy_cache.c:126:5: 
    124.       X509_POLICY_CACHE *cache;
    125.       ASN1_INTEGER *ext_any = NULL;
    126. >     POLICY_CONSTRAINTS *ext_pcons = NULL;
    127.       CERTIFICATEPOLICIES *ext_cpols = NULL;
    128.       POLICY_MAPPINGS *ext_pmaps = NULL;

crypto/x509v3/pcy_cache.c:127:5: 
    125.       ASN1_INTEGER *ext_any = NULL;
    126.       POLICY_CONSTRAINTS *ext_pcons = NULL;
    127. >     CERTIFICATEPOLICIES *ext_cpols = NULL;
    128.       POLICY_MAPPINGS *ext_pmaps = NULL;
    129.       int i;

crypto/x509v3/pcy_cache.c:128:5: 
    126.       POLICY_CONSTRAINTS *ext_pcons = NULL;
    127.       CERTIFICATEPOLICIES *ext_cpols = NULL;
    128. >     POLICY_MAPPINGS *ext_pmaps = NULL;
    129.       int i;
    130.       cache = OPENSSL_malloc(sizeof(*cache));

crypto/x509v3/pcy_cache.c:130:5: 
    128.       POLICY_MAPPINGS *ext_pmaps = NULL;
    129.       int i;
    130. >     cache = OPENSSL_malloc(sizeof(*cache));
    131.       if (cache == NULL)
    132.           return 0;

crypto/mem.c:119:1: start of procedure CRYPTO_malloc()
      117.   }
      118.   
      119. > void *CRYPTO_malloc(size_t num, const char *file, int line)
      120.   {
      121.       void *ret = NULL;

crypto/mem.c:121:5: 
      119.   void *CRYPTO_malloc(size_t num, const char *file, int line)
      120.   {
      121. >     void *ret = NULL;
      122.   
      123.       if (num <= 0)

crypto/mem.c:123:9: Taking false branch
      121.       void *ret = NULL;
      122.   
      123.       if (num <= 0)
                     ^
      124.           return NULL;
      125.   

crypto/mem.c:126:5: 
      124.           return NULL;
      125.   
      126. >     allow_customize = 0;
      127.   #ifndef OPENSSL_NO_CRYPTO_MDEBUG
      128.       if (call_malloc_debug) {

crypto/mem.c:136:5: 
      134.       }
      135.   #else
      136. >     (void)file;
      137.       (void)line;
      138.       ret = malloc(num);

crypto/mem.c:137:5: 
      135.   #else
      136.       (void)file;
      137. >     (void)line;
      138.       ret = malloc(num);
      139.   #endif

crypto/mem.c:138:5: 
      136.       (void)file;
      137.       (void)line;
      138. >     ret = malloc(num);
      139.   #endif
      140.   

crypto/mem.c:153:5: 
      151.   #endif
      152.   
      153. >     return ret;
      154.   }
      155.   

crypto/mem.c:154:1: return from a call to CRYPTO_malloc
      152.   
      153.       return ret;
      154. > }
      155.   
      156.   void *CRYPTO_zalloc(size_t num, const char *file, int line)

crypto/x509v3/pcy_cache.c:131:9: Taking true branch
    129.       int i;
    130.       cache = OPENSSL_malloc(sizeof(*cache));
    131.       if (cache == NULL)
                   ^
    132.           return 0;
    133.       cache->anyPolicy = NULL;

crypto/x509v3/pcy_cache.c:132:9: 
    130.       cache = OPENSSL_malloc(sizeof(*cache));
    131.       if (cache == NULL)
    132. >         return 0;
    133.       cache->anyPolicy = NULL;
    134.       cache->data = NULL;

crypto/x509v3/pcy_cache.c:212:1: return from a call to policy_cache_new
    210.       return 1;
    211.   
    212. > }
    213.   
    214.   void policy_cache_free(X509_POLICY_CACHE *cache)

crypto/x509v3/pcy_cache.c:229:9: 
  227.           CRYPTO_w_lock(CRYPTO_LOCK_X509);
  228.           policy_cache_new(x);
  229. >         CRYPTO_w_unlock(CRYPTO_LOCK_X509);
  230.       }
  231.   

crypto/lock.c:413:1: start of procedure CRYPTO_lock()
    411.   }
    412.   
    413. > void CRYPTO_lock(int mode, int type, const char *file, int line)
    414.   {
    415.   #ifdef LOCK_DEBUG

crypto/lock.c:440:9: Taking false branch
    438.       }
    439.   #endif
    440.       if (type < 0) {
                   ^
    441.           if (dynlock_lock_callback != NULL) {
    442.               struct CRYPTO_dynlock_value *pointer

crypto/lock.c:451:16: Taking true branch
    449.               CRYPTO_destroy_dynlockid(type);
    450.           }
    451.       } else if (locking_callback != NULL)
                          ^
    452.           locking_callback(mode, type, file, line);
    453.   }

crypto/lock.c:452:9: Skipping __function_pointer__(): unresolved function pointer
    450.           }
    451.       } else if (locking_callback != NULL)
    452.           locking_callback(mode, type, file, line);
                   ^
    453.   }
    454.   

crypto/lock.c:440:5: 
    438.       }
    439.   #endif
    440. >     if (type < 0) {
    441.           if (dynlock_lock_callback != NULL) {
    442.               struct CRYPTO_dynlock_value *pointer

crypto/lock.c:453:1: return from a call to CRYPTO_lock
    451.       } else if (locking_callback != NULL)
    452.           locking_callback(mode, type, file, line);
    453. > }
    454.   
    455.   int CRYPTO_add_lock(int *pointer, int amount, int type, const char *file,

crypto/x509v3/pcy_cache.c:232:5: 
  230.       }
  231.   
  232. >     return x->policy_cache;
  233.   
  234.   }

crypto/x509v3/pcy_cache.c:234:1: return from a call to policy_cache_set
  232.       return x->policy_cache;
  233.   
  234. > }
  235.   
  236.   X509_POLICY_DATA *policy_cache_find_data(const X509_POLICY_CACHE *cache,

crypto/x509v3/pcy_tree.c:631:14: 
629.       for (i = 1; i < tree->nlevel; i++, curr++) {
630.           cache = policy_cache_set(curr->cert);
631. >         if (!tree_link_nodes(curr, cache))
632.               return X509_PCY_TREE_INTERNAL;
633.   

crypto/x509v3/pcy_tree.c:320:1: start of procedure tree_link_nodes()
  318.    * Return value: 1 on success, 0 otherwise.
  319.    */
  320. > static int tree_link_nodes(X509_POLICY_LEVEL *curr,
  321.                              const X509_POLICY_CACHE *cache)
  322.   {

crypto/x509v3/pcy_tree.c:325:10: 
  323.       int i;
  324.   
  325. >     for (i = 0; i < sk_X509_POLICY_DATA_num(cache->data); i++) {
  326.           X509_POLICY_DATA *data = sk_X509_POLICY_DATA_value(cache->data, i);
  327.   

crypto/x509v3/pcy_tree.c:325:17: 
  323.       int i;
  324.   
  325. >     for (i = 0; i < sk_X509_POLICY_DATA_num(cache->data); i++) {
  326.           X509_POLICY_DATA *data = sk_X509_POLICY_DATA_value(cache->data, i);
  327.   
