crypto/x509/x509_vfy.c:682: error: NULL_DEREFERENCE
  pointer `x` last assigned on line 671 could be null and is dereferenced by call to `get_crl_delta()` at line 682, column 18.
Showing all 29 steps of the trace


crypto/x509/x509_vfy.c:664:1: start of procedure check_cert()
662.   }
663.   
664. > static int check_cert(X509_STORE_CTX *ctx)
665.   {
666.       X509_CRL *crl = NULL, *dcrl = NULL;

crypto/x509/x509_vfy.c:666:5: 
664.   static int check_cert(X509_STORE_CTX *ctx)
665.   {
666. >     X509_CRL *crl = NULL, *dcrl = NULL;
667.       X509 *x = NULL;
668.       int ok = 0, cnum = 0;

crypto/x509/x509_vfy.c:667:5: 
665.   {
666.       X509_CRL *crl = NULL, *dcrl = NULL;
667. >     X509 *x = NULL;
668.       int ok = 0, cnum = 0;
669.       unsigned int last_reasons = 0;

crypto/x509/x509_vfy.c:668:5: 
666.       X509_CRL *crl = NULL, *dcrl = NULL;
667.       X509 *x = NULL;
668. >     int ok = 0, cnum = 0;
669.       unsigned int last_reasons = 0;
670.       cnum = ctx->error_depth;

crypto/x509/x509_vfy.c:669:5: 
667.       X509 *x = NULL;
668.       int ok = 0, cnum = 0;
669. >     unsigned int last_reasons = 0;
670.       cnum = ctx->error_depth;
671.       x = sk_X509_value(ctx->chain, cnum);

crypto/x509/x509_vfy.c:670:5: 
668.       int ok = 0, cnum = 0;
669.       unsigned int last_reasons = 0;
670. >     cnum = ctx->error_depth;
671.       x = sk_X509_value(ctx->chain, cnum);
672.       ctx->current_cert = x;

crypto/x509/x509_vfy.c:671:9: Condition is true
669.       unsigned int last_reasons = 0;
670.       cnum = ctx->error_depth;
671.       x = sk_X509_value(ctx->chain, cnum);
               ^
672.       ctx->current_cert = x;
673.       ctx->current_issuer = NULL;

crypto/x509/x509_vfy.c:671:5: 
669.       unsigned int last_reasons = 0;
670.       cnum = ctx->error_depth;
671. >     x = sk_X509_value(ctx->chain, cnum);
672.       ctx->current_cert = x;
673.       ctx->current_issuer = NULL;

crypto/stack/stack.c:324:1: start of procedure sk_value()
  322.   }
  323.   
  324. > void *sk_value(const _STACK *st, int i)
  325.   {
  326.       if (!st || (i < 0) || (i >= st->num))

crypto/stack/stack.c:326:10: Taking false branch
  324.   void *sk_value(const _STACK *st, int i)
  325.   {
  326.       if (!st || (i < 0) || (i >= st->num))
                  ^
  327.           return NULL;
  328.       return st->data[i];

crypto/stack/stack.c:326:17: Taking false branch
  324.   void *sk_value(const _STACK *st, int i)
  325.   {
  326.       if (!st || (i < 0) || (i >= st->num))
                         ^
  327.           return NULL;
  328.       return st->data[i];

crypto/stack/stack.c:326:28: Taking true branch
  324.   void *sk_value(const _STACK *st, int i)
  325.   {
  326.       if (!st || (i < 0) || (i >= st->num))
                                    ^
  327.           return NULL;
  328.       return st->data[i];

crypto/stack/stack.c:327:9: 
  325.   {
  326.       if (!st || (i < 0) || (i >= st->num))
  327. >         return NULL;
  328.       return st->data[i];
  329.   }

crypto/stack/stack.c:329:1: return from a call to sk_value
  327.           return NULL;
  328.       return st->data[i];
  329. > }
  330.   
  331.   void *sk_set(_STACK *st, int i, void *value)

crypto/x509/x509_vfy.c:672:5: 
670.       cnum = ctx->error_depth;
671.       x = sk_X509_value(ctx->chain, cnum);
672. >     ctx->current_cert = x;
673.       ctx->current_issuer = NULL;
674.       ctx->current_crl_score = 0;

crypto/x509/x509_vfy.c:673:5: 
671.       x = sk_X509_value(ctx->chain, cnum);
672.       ctx->current_cert = x;
673. >     ctx->current_issuer = NULL;
674.       ctx->current_crl_score = 0;
675.       ctx->current_reasons = 0;

crypto/x509/x509_vfy.c:674:5: 
672.       ctx->current_cert = x;
673.       ctx->current_issuer = NULL;
674. >     ctx->current_crl_score = 0;
675.       ctx->current_reasons = 0;
676.       while (ctx->current_reasons != CRLDP_ALL_REASONS) {

crypto/x509/x509_vfy.c:675:5: 
673.       ctx->current_issuer = NULL;
674.       ctx->current_crl_score = 0;
675. >     ctx->current_reasons = 0;
676.       while (ctx->current_reasons != CRLDP_ALL_REASONS) {
677.           last_reasons = ctx->current_reasons;

crypto/x509/x509_vfy.c:676:12: Loop condition is true. Entering loop body
674.       ctx->current_crl_score = 0;
675.       ctx->current_reasons = 0;
676.       while (ctx->current_reasons != CRLDP_ALL_REASONS) {
                  ^
677.           last_reasons = ctx->current_reasons;
678.           /* Try to retrieve relevant CRL */

crypto/x509/x509_vfy.c:677:9: 
675.       ctx->current_reasons = 0;
676.       while (ctx->current_reasons != CRLDP_ALL_REASONS) {
677. >         last_reasons = ctx->current_reasons;
678.           /* Try to retrieve relevant CRL */
679.           if (ctx->get_crl)

crypto/x509/x509_vfy.c:679:13: Taking false branch
677.           last_reasons = ctx->current_reasons;
678.           /* Try to retrieve relevant CRL */
679.           if (ctx->get_crl)
                   ^
680.               ok = ctx->get_crl(ctx, &crl, x);
681.           else

crypto/x509/x509_vfy.c:682:13: 
680.               ok = ctx->get_crl(ctx, &crl, x);
681.           else
682. >             ok = get_crl_delta(ctx, &crl, &dcrl, x);
683.           /*
684.            * If error looking up CRL, nothing we can do except notify callback

crypto/x509/x509_vfy.c:1230:1: start of procedure get_crl_delta()
  1228.    */
  1229.   
  1230. > static int get_crl_delta(X509_STORE_CTX *ctx,
  1231.                            X509_CRL **pcrl, X509_CRL **pdcrl, X509 *x)
  1232.   {

crypto/x509/x509_vfy.c:1234:5: 
  1232.   {
  1233.       int ok;
  1234. >     X509 *issuer = NULL;
  1235.       int crl_score = 0;
  1236.       unsigned int reasons;

crypto/x509/x509_vfy.c:1235:5: 
  1233.       int ok;
  1234.       X509 *issuer = NULL;
  1235. >     int crl_score = 0;
  1236.       unsigned int reasons;
  1237.       X509_CRL *crl = NULL, *dcrl = NULL;

crypto/x509/x509_vfy.c:1237:5: 
  1235.       int crl_score = 0;
  1236.       unsigned int reasons;
  1237. >     X509_CRL *crl = NULL, *dcrl = NULL;
  1238.       STACK_OF(X509_CRL) *skcrl;
  1239.       X509_NAME *nm = X509_get_issuer_name(x);

crypto/x509/x509_vfy.c:1239:5: 
  1237.       X509_CRL *crl = NULL, *dcrl = NULL;
  1238.       STACK_OF(X509_CRL) *skcrl;
  1239. >     X509_NAME *nm = X509_get_issuer_name(x);
  1240.       reasons = ctx->current_reasons;
  1241.       ok = get_crl_sk(ctx, &crl, &dcrl,

crypto/x509/x509_cmp.c:132:1: start of procedure X509_get_issuer_name()
    130.   }
    131.   
    132. > X509_NAME *X509_get_issuer_name(X509 *a)
    133.   {
    134.       return (a->cert_info.issuer);

crypto/x509/x509_cmp.c:134:5: 
    132.   X509_NAME *X509_get_issuer_name(X509 *a)
    133.   {
    134. >     return (a->cert_info.issuer);
    135.   }
    136.   
