crypto/x509v3/pcy_tree.c:614: error: NULL_DEREFERENCE
  pointer `cache` last assigned on line 613 could be null and is dereferenced by call to `tree_link_nodes()` at line 614, column 14.
Showing all 46 steps of the trace


crypto/x509v3/pcy_tree.c:606:1: start of procedure tree_evaluate()
604.   }
605.   
606. > static int tree_evaluate(X509_POLICY_TREE *tree)
607.   {
608.       int ret, i;

crypto/x509v3/pcy_tree.c:609:5: 
607.   {
608.       int ret, i;
609. >     X509_POLICY_LEVEL *curr = tree->levels + 1;
610.       const X509_POLICY_CACHE *cache;
611.   

crypto/x509v3/pcy_tree.c:612:10: 
610.       const X509_POLICY_CACHE *cache;
611.   
612. >     for (i = 1; i < tree->nlevel; i++, curr++) {
613.           cache = policy_cache_set(curr->cert);
614.           if (!tree_link_nodes(curr, cache))

crypto/x509v3/pcy_tree.c:612:17: Loop condition is true. Entering loop body
610.       const X509_POLICY_CACHE *cache;
611.   
612.       for (i = 1; i < tree->nlevel; i++, curr++) {
                       ^
613.           cache = policy_cache_set(curr->cert);
614.           if (!tree_link_nodes(curr, cache))

crypto/x509v3/pcy_tree.c:613:9: 
611.   
612.       for (i = 1; i < tree->nlevel; i++, curr++) {
613. >         cache = policy_cache_set(curr->cert);
614.           if (!tree_link_nodes(curr, cache))
615.               return 0;

crypto/x509v3/pcy_cache.c:224:1: start of procedure policy_cache_set()
  222.   }
  223.   
  224. > const X509_POLICY_CACHE *policy_cache_set(X509 *x)
  225.   {
  226.   

crypto/x509v3/pcy_cache.c:227:9: Taking true branch
  225.   {
  226.   
  227.       if (x->policy_cache == NULL) {
                 ^
  228.           CRYPTO_w_lock(CRYPTO_LOCK_X509);
  229.           policy_cache_new(x);

crypto/x509v3/pcy_cache.c:228:9: 
  226.   
  227.       if (x->policy_cache == NULL) {
  228. >         CRYPTO_w_lock(CRYPTO_LOCK_X509);
  229.           policy_cache_new(x);
  230.           CRYPTO_w_unlock(CRYPTO_LOCK_X509);

crypto/lock.c:414:1: start of procedure CRYPTO_lock()
    412.   }
    413.   
    414. > void CRYPTO_lock(int mode, int type, const char *file, int line)
    415.   {
    416.   #ifdef LOCK_DEBUG

crypto/lock.c:441:9: Taking false branch
    439.       }
    440.   #endif
    441.       if (type < 0) {
                   ^
    442.           if (dynlock_lock_callback != NULL) {
    443.               struct CRYPTO_dynlock_value *pointer

crypto/lock.c:452:16: Taking true branch
    450.               CRYPTO_destroy_dynlockid(type);
    451.           }
    452.       } else if (locking_callback != NULL)
                          ^
    453.           locking_callback(mode, type, file, line);
    454.   }

crypto/lock.c:453:9: Skipping __function_pointer__(): unresolved function pointer
    451.           }
    452.       } else if (locking_callback != NULL)
    453.           locking_callback(mode, type, file, line);
                   ^
    454.   }
    455.   

crypto/lock.c:441:5: 
    439.       }
    440.   #endif
    441. >     if (type < 0) {
    442.           if (dynlock_lock_callback != NULL) {
    443.               struct CRYPTO_dynlock_value *pointer

crypto/lock.c:454:1: return from a call to CRYPTO_lock
    452.       } else if (locking_callback != NULL)
    453.           locking_callback(mode, type, file, line);
    454. > }
    455.   
    456.   int CRYPTO_add_lock(int *pointer, int amount, int type, const char *file,

crypto/x509v3/pcy_cache.c:229:9: 
  227.       if (x->policy_cache == NULL) {
  228.           CRYPTO_w_lock(CRYPTO_LOCK_X509);
  229. >         policy_cache_new(x);
  230.           CRYPTO_w_unlock(CRYPTO_LOCK_X509);
  231.       }

crypto/x509v3/pcy_cache.c:123:1: start of procedure policy_cache_new()
    121.   }
    122.   
    123. > static int policy_cache_new(X509 *x)
    124.   {
    125.       X509_POLICY_CACHE *cache;

crypto/x509v3/pcy_cache.c:126:5: 
    124.   {
    125.       X509_POLICY_CACHE *cache;
    126. >     ASN1_INTEGER *ext_any = NULL;
    127.       POLICY_CONSTRAINTS *ext_pcons = NULL;
    128.       CERTIFICATEPOLICIES *ext_cpols = NULL;

crypto/x509v3/pcy_cache.c:127:5: 
    125.       X509_POLICY_CACHE *cache;
    126.       ASN1_INTEGER *ext_any = NULL;
    127. >     POLICY_CONSTRAINTS *ext_pcons = NULL;
    128.       CERTIFICATEPOLICIES *ext_cpols = NULL;
    129.       POLICY_MAPPINGS *ext_pmaps = NULL;

crypto/x509v3/pcy_cache.c:128:5: 
    126.       ASN1_INTEGER *ext_any = NULL;
    127.       POLICY_CONSTRAINTS *ext_pcons = NULL;
    128. >     CERTIFICATEPOLICIES *ext_cpols = NULL;
    129.       POLICY_MAPPINGS *ext_pmaps = NULL;
    130.       int i;

crypto/x509v3/pcy_cache.c:129:5: 
    127.       POLICY_CONSTRAINTS *ext_pcons = NULL;
    128.       CERTIFICATEPOLICIES *ext_cpols = NULL;
    129. >     POLICY_MAPPINGS *ext_pmaps = NULL;
    130.       int i;
    131.       cache = OPENSSL_malloc(sizeof(*cache));

crypto/x509v3/pcy_cache.c:131:5: 
    129.       POLICY_MAPPINGS *ext_pmaps = NULL;
    130.       int i;
    131. >     cache = OPENSSL_malloc(sizeof(*cache));
    132.       if (cache == NULL)
    133.           return 0;

crypto/mem.c:120:1: start of procedure CRYPTO_malloc()
      118.   }
      119.   
      120. > void *CRYPTO_malloc(size_t num, const char *file, int line)
      121.   {
      122.       void *ret = NULL;

crypto/mem.c:122:5: 
      120.   void *CRYPTO_malloc(size_t num, const char *file, int line)
      121.   {
      122. >     void *ret = NULL;
      123.   
      124.       if (num <= 0)

crypto/mem.c:124:9: Taking false branch
      122.       void *ret = NULL;
      123.   
      124.       if (num <= 0)
                     ^
      125.           return NULL;
      126.   

crypto/mem.c:127:5: 
      125.           return NULL;
      126.   
      127. >     allow_customize = 0;
      128.   #ifndef OPENSSL_NO_CRYPTO_MDEBUG
      129.       if (call_malloc_debug) {

crypto/mem.c:137:5: 
      135.       }
      136.   #else
      137. >     (void)file;
      138.       (void)line;
      139.       ret = malloc(num);

crypto/mem.c:138:5: 
      136.   #else
      137.       (void)file;
      138. >     (void)line;
      139.       ret = malloc(num);
      140.   #endif

crypto/mem.c:139:5: 
      137.       (void)file;
      138.       (void)line;
      139. >     ret = malloc(num);
      140.   #endif
      141.   

crypto/mem.c:154:5: 
      152.   #endif
      153.   
      154. >     return ret;
      155.   }
      156.   

crypto/mem.c:155:1: return from a call to CRYPTO_malloc
      153.   
      154.       return ret;
      155. > }
      156.   
      157.   void *CRYPTO_zalloc(size_t num, const char *file, int line)

crypto/x509v3/pcy_cache.c:132:9: Taking true branch
    130.       int i;
    131.       cache = OPENSSL_malloc(sizeof(*cache));
    132.       if (cache == NULL)
                   ^
    133.           return 0;
    134.       cache->anyPolicy = NULL;

crypto/x509v3/pcy_cache.c:133:9: 
    131.       cache = OPENSSL_malloc(sizeof(*cache));
    132.       if (cache == NULL)
    133. >         return 0;
    134.       cache->anyPolicy = NULL;
    135.       cache->data = NULL;

crypto/x509v3/pcy_cache.c:213:1: return from a call to policy_cache_new
    211.       return 1;
    212.   
    213. > }
    214.   
    215.   void policy_cache_free(X509_POLICY_CACHE *cache)

crypto/x509v3/pcy_cache.c:230:9: 
  228.           CRYPTO_w_lock(CRYPTO_LOCK_X509);
  229.           policy_cache_new(x);
  230. >         CRYPTO_w_unlock(CRYPTO_LOCK_X509);
  231.       }
  232.   

crypto/lock.c:414:1: start of procedure CRYPTO_lock()
    412.   }
    413.   
    414. > void CRYPTO_lock(int mode, int type, const char *file, int line)
    415.   {
    416.   #ifdef LOCK_DEBUG

crypto/lock.c:441:9: Taking false branch
    439.       }
    440.   #endif
    441.       if (type < 0) {
                   ^
    442.           if (dynlock_lock_callback != NULL) {
    443.               struct CRYPTO_dynlock_value *pointer

crypto/lock.c:452:16: Taking true branch
    450.               CRYPTO_destroy_dynlockid(type);
    451.           }
    452.       } else if (locking_callback != NULL)
                          ^
    453.           locking_callback(mode, type, file, line);
    454.   }

crypto/lock.c:453:9: Skipping __function_pointer__(): unresolved function pointer
    451.           }
    452.       } else if (locking_callback != NULL)
    453.           locking_callback(mode, type, file, line);
                   ^
    454.   }
    455.   

crypto/lock.c:441:5: 
    439.       }
    440.   #endif
    441. >     if (type < 0) {
    442.           if (dynlock_lock_callback != NULL) {
    443.               struct CRYPTO_dynlock_value *pointer

crypto/lock.c:454:1: return from a call to CRYPTO_lock
    452.       } else if (locking_callback != NULL)
    453.           locking_callback(mode, type, file, line);
    454. > }
    455.   
    456.   int CRYPTO_add_lock(int *pointer, int amount, int type, const char *file,

crypto/x509v3/pcy_cache.c:233:5: 
  231.       }
  232.   
  233. >     return x->policy_cache;
  234.   
  235.   }

crypto/x509v3/pcy_cache.c:235:1: return from a call to policy_cache_set
  233.       return x->policy_cache;
  234.   
  235. > }
  236.   
  237.   X509_POLICY_DATA *policy_cache_find_data(const X509_POLICY_CACHE *cache,

crypto/x509v3/pcy_tree.c:614:14: 
612.       for (i = 1; i < tree->nlevel; i++, curr++) {
613.           cache = policy_cache_set(curr->cert);
614. >         if (!tree_link_nodes(curr, cache))
615.               return 0;
616.   

crypto/x509v3/pcy_tree.c:321:1: start of procedure tree_link_nodes()
  319.    */
  320.   
  321. > static int tree_link_nodes(X509_POLICY_LEVEL *curr,
  322.                              const X509_POLICY_CACHE *cache)
  323.   {

crypto/x509v3/pcy_tree.c:327:10: 
  325.       X509_POLICY_DATA *data;
  326.   
  327. >     for (i = 0; i < sk_X509_POLICY_DATA_num(cache->data); i++) {
  328.           data = sk_X509_POLICY_DATA_value(cache->data, i);
  329.           /* Look for matching nodes in previous level */

crypto/x509v3/pcy_tree.c:327:17: 
  325.       X509_POLICY_DATA *data;
  326.   
  327. >     for (i = 0; i < sk_X509_POLICY_DATA_num(cache->data); i++) {
  328.           data = sk_X509_POLICY_DATA_value(cache->data, i);
  329.           /* Look for matching nodes in previous level */
