test/ct_test.c:317: error: NULL_DEREFERENCE
  pointer `&scts` last assigned on line 242 could be null and is dereferenced by call to `o2i_SCT_LIST()` at line 317, column 14.
Showing all 39 steps of the trace


test/ct_test.c:238:1: start of procedure execute_cert_test()
236.   }
237.   
238. > static int execute_cert_test(CT_TEST_FIXTURE *fixture)
239.   {
240.       int success = 0;

test/ct_test.c:240:5: 
238.   static int execute_cert_test(CT_TEST_FIXTURE *fixture)
239.   {
240. >     int success = 0;
241.       X509 *cert = NULL, *issuer = NULL;
242.       STACK_OF(SCT) *scts = NULL;

test/ct_test.c:241:5: 
239.   {
240.       int success = 0;
241. >     X509 *cert = NULL, *issuer = NULL;
242.       STACK_OF(SCT) *scts = NULL;
243.       SCT *sct = NULL;

test/ct_test.c:242:5: 
240.       int success = 0;
241.       X509 *cert = NULL, *issuer = NULL;
242. >     STACK_OF(SCT) *scts = NULL;
243.       SCT *sct = NULL;
244.       char expected_sct_text[CT_TEST_MAX_FILE_SIZE];

test/ct_test.c:243:5: 
241.       X509 *cert = NULL, *issuer = NULL;
242.       STACK_OF(SCT) *scts = NULL;
243. >     SCT *sct = NULL;
244.       char expected_sct_text[CT_TEST_MAX_FILE_SIZE];
245.       int sct_text_len = 0;

test/ct_test.c:245:5: 
243.       SCT *sct = NULL;
244.       char expected_sct_text[CT_TEST_MAX_FILE_SIZE];
245. >     int sct_text_len = 0;
246.       unsigned char *tls_sct_list = NULL;
247.       size_t tls_sct_list_len = 0;

test/ct_test.c:246:5: 
244.       char expected_sct_text[CT_TEST_MAX_FILE_SIZE];
245.       int sct_text_len = 0;
246. >     unsigned char *tls_sct_list = NULL;
247.       size_t tls_sct_list_len = 0;
248.       CT_POLICY_EVAL_CTX *ct_policy_ctx = CT_POLICY_EVAL_CTX_new();

test/ct_test.c:247:5: 
245.       int sct_text_len = 0;
246.       unsigned char *tls_sct_list = NULL;
247. >     size_t tls_sct_list_len = 0;
248.       CT_POLICY_EVAL_CTX *ct_policy_ctx = CT_POLICY_EVAL_CTX_new();
249.   

test/ct_test.c:248:5: Skipping CT_POLICY_EVAL_CTX_new(): empty list of specs
246.       unsigned char *tls_sct_list = NULL;
247.       size_t tls_sct_list_len = 0;
248.       CT_POLICY_EVAL_CTX *ct_policy_ctx = CT_POLICY_EVAL_CTX_new();
           ^
249.   
250.       if (fixture->sct_text_file != NULL) {

test/ct_test.c:250:9: Taking false branch
248.       CT_POLICY_EVAL_CTX *ct_policy_ctx = CT_POLICY_EVAL_CTX_new();
249.   
250.       if (fixture->sct_text_file != NULL) {
               ^
251.           sct_text_len = read_text_file(fixture->sct_dir, fixture->sct_text_file,
252.                                         expected_sct_text,

test/ct_test.c:260:5: 
258.       }
259.   
260. >     CT_POLICY_EVAL_CTX_set_shared_CTLOG_STORE(
261.               ct_policy_ctx, fixture->ctlog_store);
262.   

crypto/ct/ct_policy.c:69:1: start of procedure CT_POLICY_EVAL_CTX_set_shared_CTLOG_STORE()
  67.   }
  68.   
  69. > void CT_POLICY_EVAL_CTX_set_shared_CTLOG_STORE(CT_POLICY_EVAL_CTX *ctx,
  70.                                                  CTLOG_STORE *log_store)
  71.   {

crypto/ct/ct_policy.c:72:5: 
  70.                                                  CTLOG_STORE *log_store)
  71.   {
  72. >     ctx->log_store = log_store;
  73.   }
  74.   

crypto/ct/ct_policy.c:73:1: return from a call to CT_POLICY_EVAL_CTX_set_shared_CTLOG_STORE
  71.   {
  72.       ctx->log_store = log_store;
  73. > }
  74.   
  75.   void CT_POLICY_EVAL_CTX_set_time(CT_POLICY_EVAL_CTX *ctx, uint64_t time_in_ms)

test/ct_test.c:263:5: 
261.               ct_policy_ctx, fixture->ctlog_store);
262.   
263. >     CT_POLICY_EVAL_CTX_set_time(ct_policy_ctx, fixture->epoch_time_in_ms);
264.   
265.       if (fixture->certificate_file != NULL) {

crypto/ct/ct_policy.c:75:1: start of procedure CT_POLICY_EVAL_CTX_set_time()
  73.   }
  74.   
  75. > void CT_POLICY_EVAL_CTX_set_time(CT_POLICY_EVAL_CTX *ctx, uint64_t time_in_ms)
  76.   {
  77.       ctx->epoch_time_in_ms = time_in_ms;

crypto/ct/ct_policy.c:77:5: 
  75.   void CT_POLICY_EVAL_CTX_set_time(CT_POLICY_EVAL_CTX *ctx, uint64_t time_in_ms)
  76.   {
  77. >     ctx->epoch_time_in_ms = time_in_ms;
  78.   }
  79.   

crypto/ct/ct_policy.c:78:1: return from a call to CT_POLICY_EVAL_CTX_set_time
  76.   {
  77.       ctx->epoch_time_in_ms = time_in_ms;
  78. > }
  79.   
  80.   X509* CT_POLICY_EVAL_CTX_get0_cert(const CT_POLICY_EVAL_CTX *ctx)

test/ct_test.c:265:9: Taking false branch
263.       CT_POLICY_EVAL_CTX_set_time(ct_policy_ctx, fixture->epoch_time_in_ms);
264.   
265.       if (fixture->certificate_file != NULL) {
               ^
266.           int sct_extension_index;
267.           int i;

test/ct_test.c:314:9: Taking true branch
312.       }
313.   
314.       if (fixture->tls_sct_list != NULL) {
               ^
315.           const unsigned char *p = fixture->tls_sct_list;
316.   

test/ct_test.c:315:9: 
313.   
314.       if (fixture->tls_sct_list != NULL) {
315. >         const unsigned char *p = fixture->tls_sct_list;
316.   
317.           if (!TEST_ptr(o2i_SCT_LIST(&scts, &p, fixture->tls_sct_list_len)))

test/ct_test.c:317:14: 
315.           const unsigned char *p = fixture->tls_sct_list;
316.   
317. >         if (!TEST_ptr(o2i_SCT_LIST(&scts, &p, fixture->tls_sct_list_len)))
318.               goto end;
319.   

crypto/ct/ct_oct.c:257:1: start of procedure o2i_SCT_LIST()
  255.   }
  256.   
  257. > STACK_OF(SCT) *o2i_SCT_LIST(STACK_OF(SCT) **a, const unsigned char **pp,
  258.                               size_t len)
  259.   {

crypto/ct/ct_oct.c:260:5: 
  258.                               size_t len)
  259.   {
  260. >     STACK_OF(SCT) *sk = NULL;
  261.       size_t list_len, sct_len;
  262.   

crypto/ct/ct_oct.c:263:9: Taking false branch
  261.       size_t list_len, sct_len;
  262.   
  263.       if (len < 2 || len > MAX_SCT_LIST_SIZE) {
                 ^
  264.           CTerr(CT_F_O2I_SCT_LIST, CT_R_SCT_LIST_INVALID);
  265.           return NULL;

crypto/ct/ct_oct.c:263:20: Taking false branch
  261.       size_t list_len, sct_len;
  262.   
  263.       if (len < 2 || len > MAX_SCT_LIST_SIZE) {
                            ^
  264.           CTerr(CT_F_O2I_SCT_LIST, CT_R_SCT_LIST_INVALID);
  265.           return NULL;

crypto/ct/ct_oct.c:268:5: 
  266.       }
  267.   
  268. >     n2s(*pp, list_len);
  269.       if (list_len != len - 2) {
  270.           CTerr(CT_F_O2I_SCT_LIST, CT_R_SCT_LIST_INVALID);

crypto/ct/ct_oct.c:269:9: Taking false branch
  267.   
  268.       n2s(*pp, list_len);
  269.       if (list_len != len - 2) {
                 ^
  270.           CTerr(CT_F_O2I_SCT_LIST, CT_R_SCT_LIST_INVALID);
  271.           return NULL;

crypto/ct/ct_oct.c:274:9: Taking false branch
  272.       }
  273.   
  274.       if (a == NULL || *a == NULL) {
                 ^
  275.           sk = sk_SCT_new_null();
  276.           if (sk == NULL)

crypto/ct/ct_oct.c:274:22: Taking false branch
  272.       }
  273.   
  274.       if (a == NULL || *a == NULL) {
                              ^
  275.           sk = sk_SCT_new_null();
  276.           if (sk == NULL)

crypto/ct/ct_oct.c:282:9: 
  280.   
  281.           /* Use the given stack, but empty it first. */
  282. >         sk = *a;
  283.           while ((sct = sk_SCT_pop(sk)) != NULL)
  284.               SCT_free(sct);

crypto/ct/ct_oct.c:283:16: 
  281.           /* Use the given stack, but empty it first. */
  282.           sk = *a;
  283. >         while ((sct = sk_SCT_pop(sk)) != NULL)
  284.               SCT_free(sct);
  285.       }

include/openssl/ct.h:58:1: start of procedure sk_SCT_pop()
    56.   } sct_validation_status_t;
    57.   
    58. > DEFINE_STACK_OF(SCT)
    59.   DEFINE_STACK_OF(CTLOG)
    60.   

crypto/stack/stack.c:344:1: start of procedure OPENSSL_sk_pop()
      342.   }
      343.   
      344. > void *OPENSSL_sk_pop(OPENSSL_STACK *st)
      345.   {
      346.       if (st == NULL || st->num == 0)

crypto/stack/stack.c:346:9: Taking false branch
      344.   void *OPENSSL_sk_pop(OPENSSL_STACK *st)
      345.   {
      346.       if (st == NULL || st->num == 0)
                     ^
      347.           return NULL;
      348.       return internal_delete(st, st->num - 1);

crypto/stack/stack.c:346:23: Taking false branch
      344.   void *OPENSSL_sk_pop(OPENSSL_STACK *st)
      345.   {
      346.       if (st == NULL || st->num == 0)
                                   ^
      347.           return NULL;
      348.       return internal_delete(st, st->num - 1);

crypto/stack/stack.c:348:5: 
      346.       if (st == NULL || st->num == 0)
      347.           return NULL;
      348. >     return internal_delete(st, st->num - 1);
      349.   }
      350.   

crypto/stack/stack.c:256:1: start of procedure internal_delete()
        254.   }
        255.   
        256. > static ossl_inline void *internal_delete(OPENSSL_STACK *st, int loc)
        257.   {
        258.       const void *ret = st->data[loc];

crypto/stack/stack.c:258:5: 
        256.   static ossl_inline void *internal_delete(OPENSSL_STACK *st, int loc)
        257.   {
        258. >     const void *ret = st->data[loc];
        259.   
        260.       if (loc != st->num - 1)
