crypto/x509/x509_lu.c:666: error: NULL_DEREFERENCE
  pointer `pobj` last assigned on line 664 could be null and is dereferenced at line 666, column 8.
Showing all 43 steps of the trace


crypto/x509/x509_lu.c:624:1: start of procedure X509_STORE_CTX_get1_issuer()
622.    * -1 some other error.
623.    */
624. > int X509_STORE_CTX_get1_issuer(X509 **issuer, X509_STORE_CTX *ctx, X509 *x)
625.   	{
626.   	X509_NAME *xn;

crypto/x509/x509_lu.c:629:2: 
627.   	X509_OBJECT obj, *pobj;
628.   	int i, ok, idx, ret;
629. > 	xn=X509_get_issuer_name(x);
630.   	ok=X509_STORE_get_by_subject(ctx,X509_LU_X509,xn,&obj);
631.   	if (ok != X509_LU_X509)

crypto/x509/x509_cmp.c:130:1: start of procedure X509_get_issuer_name()
  128.   #endif
  129.   
  130. > X509_NAME *X509_get_issuer_name(X509 *a)
  131.   	{
  132.   	return(a->cert_info->issuer);

crypto/x509/x509_cmp.c:132:2: 
  130.   X509_NAME *X509_get_issuer_name(X509 *a)
  131.   	{
  132. > 	return(a->cert_info->issuer);
  133.   	}
  134.   

crypto/x509/x509_cmp.c:133:2: return from a call to X509_get_issuer_name
  131.   	{
  132.   	return(a->cert_info->issuer);
  133.   	}
          ^
  134.   
  135.   unsigned long X509_issuer_name_hash(X509 *x)

crypto/x509/x509_lu.c:630:2: Skipping X509_STORE_get_by_subject(): empty list of specs
628.   	int i, ok, idx, ret;
629.   	xn=X509_get_issuer_name(x);
630.   	ok=X509_STORE_get_by_subject(ctx,X509_LU_X509,xn,&obj);
        ^
631.   	if (ok != X509_LU_X509)
632.   		{

crypto/x509/x509_lu.c:631:6: Taking false branch
629.   	xn=X509_get_issuer_name(x);
630.   	ok=X509_STORE_get_by_subject(ctx,X509_LU_X509,xn,&obj);
631.   	if (ok != X509_LU_X509)
            ^
632.   		{
633.   		if (ok == X509_LU_RETRY)

crypto/x509/x509_lu.c:648:6: Taking false branch
646.   		}
647.   	/* If certificate matches all OK */
648.   	if (ctx->check_issued(ctx, x, obj.data.x509))
            ^
649.   		{
650.   		*issuer = obj.data.x509;

crypto/x509/x509_lu.c:653:2: 
651.   		return 1;
652.   		}
653. > 	X509_OBJECT_free_contents(&obj);
654.   
655.   	/* Else find index of first cert accepted by 'check_issued' */

crypto/x509/x509_lu.c:413:1: start of procedure X509_OBJECT_free_contents()
  411.   	}
  412.   
  413. > void X509_OBJECT_free_contents(X509_OBJECT *a)
  414.   	{
  415.   	switch (a->type)

crypto/x509/x509_lu.c:415:2: 
  413.   void X509_OBJECT_free_contents(X509_OBJECT *a)
  414.   	{
  415. > 	switch (a->type)
  416.   		{
  417.   	case X509_LU_X509:

crypto/x509/x509_lu.c:417:2: Switch condition is false. Skipping switch case
  415.   	switch (a->type)
  416.   		{
  417.   	case X509_LU_X509:
          ^
  418.   		X509_free(a->data.x509);
  419.   		break;

crypto/x509/x509_lu.c:420:2: Switch condition is false. Skipping switch case
  418.   		X509_free(a->data.x509);
  419.   		break;
  420.   	case X509_LU_CRL:
          ^
  421.   		X509_CRL_free(a->data.crl);
  422.   		break;

crypto/x509/x509_lu.c:424:2: return from a call to X509_OBJECT_free_contents
  422.   		break;
  423.   		}
  424.   	}
          ^
  425.   
  426.   static int x509_object_idx_cnt(STACK_OF(X509_OBJECT) *h, int type,

crypto/x509/x509_lu.c:656:2: 
654.   
655.   	/* Else find index of first cert accepted by 'check_issued' */
656. > 	ret = 0;
657.   	CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);
658.   	idx = X509_OBJECT_idx_by_subject(ctx->ctx->objs, X509_LU_X509, xn);

crypto/x509/x509_lu.c:657:2: 
655.   	/* Else find index of first cert accepted by 'check_issued' */
656.   	ret = 0;
657. > 	CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);
658.   	idx = X509_OBJECT_idx_by_subject(ctx->ctx->objs, X509_LU_X509, xn);
659.   	if (idx != -1) /* should be true as we've had at least one match */

crypto/lock.c:426:1: start of procedure CRYPTO_lock()
  424.   	}
  425.   
  426. > void CRYPTO_lock(int mode, int type, const char *file, int line)
  427.   	{
  428.   #ifdef LOCK_DEBUG

crypto/lock.c:453:6: Taking false branch
  451.   		}
  452.   #endif
  453.   	if (type < 0)
              ^
  454.   		{
  455.   		if (dynlock_lock_callback != NULL)

crypto/lock.c:468:7: Taking true branch
  466.   		}
  467.   	else
  468.   		if (locking_callback != NULL)
               ^
  469.   			locking_callback(mode,type,file,line);
  470.   	}

crypto/lock.c:469:4: Skipping __function_pointer__(): unresolved function pointer
  467.   	else
  468.   		if (locking_callback != NULL)
  469.   			locking_callback(mode,type,file,line);
            ^
  470.   	}
  471.   

crypto/lock.c:453:2: 
  451.   		}
  452.   #endif
  453. > 	if (type < 0)
  454.   		{
  455.   		if (dynlock_lock_callback != NULL)

crypto/lock.c:470:2: return from a call to CRYPTO_lock
  468.   		if (locking_callback != NULL)
  469.   			locking_callback(mode,type,file,line);
  470.   	}
          ^
  471.   
  472.   int CRYPTO_add_lock(int *pointer, int amount, int type, const char *file,

crypto/x509/x509_lu.c:658:2: 
656.   	ret = 0;
657.   	CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);
658. > 	idx = X509_OBJECT_idx_by_subject(ctx->ctx->objs, X509_LU_X509, xn);
659.   	if (idx != -1) /* should be true as we've had at least one match */
660.   		{

crypto/x509/x509_lu.c:473:1: start of procedure X509_OBJECT_idx_by_subject()
  471.   
  472.   
  473. > int X509_OBJECT_idx_by_subject(STACK_OF(X509_OBJECT) *h, int type,
  474.   	     X509_NAME *name)
  475.   	{

crypto/x509/x509_lu.c:476:2: Skipping x509_object_idx_cnt(): empty list of specs
  474.   	     X509_NAME *name)
  475.   	{
  476.   	return x509_object_idx_cnt(h, type, name, NULL);
          ^
  477.   	}
  478.   

crypto/x509/x509_lu.c:477:2: return from a call to X509_OBJECT_idx_by_subject
  475.   	{
  476.   	return x509_object_idx_cnt(h, type, name, NULL);
  477.   	}
          ^
  478.   
  479.   X509_OBJECT *X509_OBJECT_retrieve_by_subject(STACK_OF(X509_OBJECT) *h, int type,

crypto/x509/x509_lu.c:659:6: Taking true branch
657.   	CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);
658.   	idx = X509_OBJECT_idx_by_subject(ctx->ctx->objs, X509_LU_X509, xn);
659.   	if (idx != -1) /* should be true as we've had at least one match */
            ^
660.   		{
661.   		/* Look through all matching certs for suitable issuer */

crypto/x509/x509_lu.c:662:8: 
660.   		{
661.   		/* Look through all matching certs for suitable issuer */
662. > 		for (i = idx; i < sk_X509_OBJECT_num(ctx->ctx->objs); i++)
663.   			{
664.   			pobj = sk_X509_OBJECT_value(ctx->ctx->objs, i);

crypto/x509/x509_lu.c:662:21: Condition is true
660.   		{
661.   		/* Look through all matching certs for suitable issuer */
662.   		for (i = idx; i < sk_X509_OBJECT_num(ctx->ctx->objs); i++)
                           ^
663.   			{
664.   			pobj = sk_X509_OBJECT_value(ctx->ctx->objs, i);

crypto/x509/x509_lu.c:662:17: 
660.   		{
661.   		/* Look through all matching certs for suitable issuer */
662. > 		for (i = idx; i < sk_X509_OBJECT_num(ctx->ctx->objs); i++)
663.   			{
664.   			pobj = sk_X509_OBJECT_value(ctx->ctx->objs, i);

crypto/stack/stack.c:294:1: start of procedure sk_num()
  292.   	}
  293.   
  294. > int sk_num(const _STACK *st)
  295.   {
  296.   	if(st == NULL) return -1;

crypto/stack/stack.c:296:5: Taking false branch
  294.   int sk_num(const _STACK *st)
  295.   {
  296.   	if(st == NULL) return -1;
             ^
  297.   	return st->num;
  298.   }

crypto/stack/stack.c:297:2: 
  295.   {
  296.   	if(st == NULL) return -1;
  297. > 	return st->num;
  298.   }
  299.   

crypto/stack/stack.c:298:1: return from a call to sk_num
  296.   	if(st == NULL) return -1;
  297.   	return st->num;
  298. > }
  299.   
  300.   void *sk_value(const _STACK *st, int i)

crypto/x509/x509_lu.c:662:17: Loop condition is true. Entering loop body
660.   		{
661.   		/* Look through all matching certs for suitable issuer */
662.   		for (i = idx; i < sk_X509_OBJECT_num(ctx->ctx->objs); i++)
                       ^
663.   			{
664.   			pobj = sk_X509_OBJECT_value(ctx->ctx->objs, i);

crypto/x509/x509_lu.c:664:11: Condition is true
662.   		for (i = idx; i < sk_X509_OBJECT_num(ctx->ctx->objs); i++)
663.   			{
664.   			pobj = sk_X509_OBJECT_value(ctx->ctx->objs, i);
                 ^
665.   			/* See if we've run past the matches */
666.   			if (pobj->type != X509_LU_X509)

crypto/x509/x509_lu.c:664:4: 
662.   		for (i = idx; i < sk_X509_OBJECT_num(ctx->ctx->objs); i++)
663.   			{
664. > 			pobj = sk_X509_OBJECT_value(ctx->ctx->objs, i);
665.   			/* See if we've run past the matches */
666.   			if (pobj->type != X509_LU_X509)

crypto/stack/stack.c:300:1: start of procedure sk_value()
  298.   }
  299.   
  300. > void *sk_value(const _STACK *st, int i)
  301.   {
  302.   	if(!st || (i < 0) || (i >= st->num)) return NULL;

crypto/stack/stack.c:302:6: Taking false branch
  300.   void *sk_value(const _STACK *st, int i)
  301.   {
  302.   	if(!st || (i < 0) || (i >= st->num)) return NULL;
              ^
  303.   	return st->data[i];
  304.   }

crypto/stack/stack.c:302:13: Taking true branch
  300.   void *sk_value(const _STACK *st, int i)
  301.   {
  302.   	if(!st || (i < 0) || (i >= st->num)) return NULL;
                     ^
  303.   	return st->data[i];
  304.   }

crypto/stack/stack.c:302:39: 
  300.   void *sk_value(const _STACK *st, int i)
  301.   {
  302. > 	if(!st || (i < 0) || (i >= st->num)) return NULL;
  303.   	return st->data[i];
  304.   }

crypto/stack/stack.c:304:1: return from a call to sk_value
  302.   	if(!st || (i < 0) || (i >= st->num)) return NULL;
  303.   	return st->data[i];
  304. > }
  305.   
  306.   void *sk_set(_STACK *st, int i, void *value)

crypto/x509/x509_lu.c:666:8: 
664.   			pobj = sk_X509_OBJECT_value(ctx->ctx->objs, i);
665.   			/* See if we've run past the matches */
666. > 			if (pobj->type != X509_LU_X509)
667.   				break;
668.   			if (X509_NAME_cmp(xn, X509_get_subject_name(pobj->data.x509)))
