crypto/ts/ts_rsp_verify.c:429: error: NULL_DEREFERENCE
  pointer `signer` last assigned on line 393 could be null and is dereferenced by call to `ts_check_signer_name()` at line 429, column 13.
Showing all 38 steps of the trace


crypto/ts/ts_rsp_verify.c:390:1: start of procedure int_ts_RESP_verify_token()
388.    *      - Check if the TSA name is the expected TSA.
389.    */
390. > static int int_ts_RESP_verify_token(TS_VERIFY_CTX *ctx,
391.                                       PKCS7 *token, TS_TST_INFO *tst_info)
392.   {

crypto/ts/ts_rsp_verify.c:393:5: 
391.                                       PKCS7 *token, TS_TST_INFO *tst_info)
392.   {
393. >     X509 *signer = NULL;
394.       GENERAL_NAME *tsa_name = tst_info->tsa;
395.       X509_ALGOR *md_alg = NULL;

crypto/ts/ts_rsp_verify.c:394:5: 
392.   {
393.       X509 *signer = NULL;
394. >     GENERAL_NAME *tsa_name = tst_info->tsa;
395.       X509_ALGOR *md_alg = NULL;
396.       unsigned char *imprint = NULL;

crypto/ts/ts_rsp_verify.c:395:5: 
393.       X509 *signer = NULL;
394.       GENERAL_NAME *tsa_name = tst_info->tsa;
395. >     X509_ALGOR *md_alg = NULL;
396.       unsigned char *imprint = NULL;
397.       unsigned imprint_len = 0;

crypto/ts/ts_rsp_verify.c:396:5: 
394.       GENERAL_NAME *tsa_name = tst_info->tsa;
395.       X509_ALGOR *md_alg = NULL;
396. >     unsigned char *imprint = NULL;
397.       unsigned imprint_len = 0;
398.       int ret = 0;

crypto/ts/ts_rsp_verify.c:397:5: 
395.       X509_ALGOR *md_alg = NULL;
396.       unsigned char *imprint = NULL;
397. >     unsigned imprint_len = 0;
398.       int ret = 0;
399.   

crypto/ts/ts_rsp_verify.c:398:5: 
396.       unsigned char *imprint = NULL;
397.       unsigned imprint_len = 0;
398. >     int ret = 0;
399.   
400.       if ((ctx->flags & TS_VFY_SIGNATURE)

crypto/ts/ts_rsp_verify.c:400:10: Taking false branch
398.       int ret = 0;
399.   
400.       if ((ctx->flags & TS_VFY_SIGNATURE)
                ^
401.           && !TS_RESP_verify_signature(token, ctx->certs, ctx->store, &signer))
402.           goto err;

crypto/ts/ts_rsp_verify.c:403:10: Taking false branch
401.           && !TS_RESP_verify_signature(token, ctx->certs, ctx->store, &signer))
402.           goto err;
403.       if ((ctx->flags & TS_VFY_VERSION)
                ^
404.           && TS_TST_INFO_get_version(tst_info) != 1) {
405.           TSerr(TS_F_INT_TS_RESP_VERIFY_TOKEN, TS_R_UNSUPPORTED_VERSION);

crypto/ts/ts_rsp_verify.c:408:10: Taking true branch
406.           goto err;
407.       }
408.       if ((ctx->flags & TS_VFY_POLICY)
                ^
409.           && !ts_check_policy(ctx->policy, tst_info))
410.           goto err;

crypto/ts/ts_rsp_verify.c:409:13: 
407.       }
408.       if ((ctx->flags & TS_VFY_POLICY)
409. >         && !ts_check_policy(ctx->policy, tst_info))
410.           goto err;
411.       if ((ctx->flags & TS_VFY_IMPRINT)

crypto/ts/ts_rsp_verify.c:522:1: start of procedure ts_check_policy()
  520.   }
  521.   
  522. > static int ts_check_policy(ASN1_OBJECT *req_oid, TS_TST_INFO *tst_info)
  523.   {
  524.       ASN1_OBJECT *resp_oid = tst_info->policy_id;

crypto/ts/ts_rsp_verify.c:524:5: 
  522.   static int ts_check_policy(ASN1_OBJECT *req_oid, TS_TST_INFO *tst_info)
  523.   {
  524. >     ASN1_OBJECT *resp_oid = tst_info->policy_id;
  525.   
  526.       if (OBJ_cmp(req_oid, resp_oid) != 0) {

crypto/ts/ts_rsp_verify.c:526:9: 
  524.       ASN1_OBJECT *resp_oid = tst_info->policy_id;
  525.   
  526. >     if (OBJ_cmp(req_oid, resp_oid) != 0) {
  527.           TSerr(TS_F_TS_CHECK_POLICY, TS_R_POLICY_MISMATCH);
  528.           return 0;

crypto/objects/obj_lib.c:123:1: start of procedure OBJ_cmp()
    121.   }
    122.   
    123. > int OBJ_cmp(const ASN1_OBJECT *a, const ASN1_OBJECT *b)
    124.   {
    125.       int ret;

crypto/objects/obj_lib.c:127:5: 
    125.       int ret;
    126.   
    127. >     ret = (a->length - b->length);
    128.       if (ret)
    129.           return (ret);

crypto/objects/obj_lib.c:128:9: Taking true branch
    126.   
    127.       ret = (a->length - b->length);
    128.       if (ret)
                   ^
    129.           return (ret);
    130.       return (memcmp(a->data, b->data, a->length));

crypto/objects/obj_lib.c:129:9: 
    127.       ret = (a->length - b->length);
    128.       if (ret)
    129. >         return (ret);
    130.       return (memcmp(a->data, b->data, a->length));
    131.   }

crypto/objects/obj_lib.c:131:1: return from a call to OBJ_cmp
    129.           return (ret);
    130.       return (memcmp(a->data, b->data, a->length));
    131. > }

crypto/ts/ts_rsp_verify.c:526:9: Taking false branch
  524.       ASN1_OBJECT *resp_oid = tst_info->policy_id;
  525.   
  526.       if (OBJ_cmp(req_oid, resp_oid) != 0) {
                 ^
  527.           TSerr(TS_F_TS_CHECK_POLICY, TS_R_POLICY_MISMATCH);
  528.           return 0;

crypto/ts/ts_rsp_verify.c:531:5: 
  529.       }
  530.   
  531. >     return 1;
  532.   }
  533.   

crypto/ts/ts_rsp_verify.c:532:1: return from a call to ts_check_policy
  530.   
  531.       return 1;
  532. > }
  533.   
  534.   static int ts_compute_imprint(BIO *data, TS_TST_INFO *tst_info,

crypto/ts/ts_rsp_verify.c:409:13: Taking false branch
407.       }
408.       if ((ctx->flags & TS_VFY_POLICY)
409.           && !ts_check_policy(ctx->policy, tst_info))
                   ^
410.           goto err;
411.       if ((ctx->flags & TS_VFY_IMPRINT)

crypto/ts/ts_rsp_verify.c:411:10: Taking true branch
409.           && !ts_check_policy(ctx->policy, tst_info))
410.           goto err;
411.       if ((ctx->flags & TS_VFY_IMPRINT)
                ^
412.           && !ts_check_imprints(ctx->md_alg, ctx->imprint, ctx->imprint_len,
413.                                 tst_info))

crypto/ts/ts_rsp_verify.c:412:13: Taking false branch
410.           goto err;
411.       if ((ctx->flags & TS_VFY_IMPRINT)
412.           && !ts_check_imprints(ctx->md_alg, ctx->imprint, ctx->imprint_len,
                   ^
413.                                 tst_info))
414.           goto err;

crypto/ts/ts_rsp_verify.c:415:10: Taking false branch
413.                                 tst_info))
414.           goto err;
415.       if ((ctx->flags & TS_VFY_DATA)
                ^
416.           && (!ts_compute_imprint(ctx->data, tst_info,
417.                                   &md_alg, &imprint, &imprint_len)

crypto/ts/ts_rsp_verify.c:420:10: Taking false branch
418.               || !ts_check_imprints(md_alg, imprint, imprint_len, tst_info)))
419.           goto err;
420.       if ((ctx->flags & TS_VFY_NONCE)
                ^
421.           && !ts_check_nonces(ctx->nonce, tst_info))
422.           goto err;

crypto/ts/ts_rsp_verify.c:423:10: Taking false branch
421.           && !ts_check_nonces(ctx->nonce, tst_info))
422.           goto err;
423.       if ((ctx->flags & TS_VFY_SIGNER)
                ^
424.           && tsa_name && !ts_check_signer_name(tsa_name, signer)) {
425.           TSerr(TS_F_INT_TS_RESP_VERIFY_TOKEN, TS_R_TSA_NAME_MISMATCH);

crypto/ts/ts_rsp_verify.c:428:10: Taking true branch
426.           goto err;
427.       }
428.       if ((ctx->flags & TS_VFY_TSA_NAME)
                ^
429.           && !ts_check_signer_name(ctx->tsa_name, signer)) {
430.           TSerr(TS_F_INT_TS_RESP_VERIFY_TOKEN, TS_R_TSA_UNTRUSTED);

crypto/ts/ts_rsp_verify.c:429:13: 
427.       }
428.       if ((ctx->flags & TS_VFY_TSA_NAME)
429. >         && !ts_check_signer_name(ctx->tsa_name, signer)) {
430.           TSerr(TS_F_INT_TS_RESP_VERIFY_TOKEN, TS_R_TSA_UNTRUSTED);
431.           goto err;

crypto/ts/ts_rsp_verify.c:638:1: start of procedure ts_check_signer_name()
  636.    * subject alternative names of the TSA certificate.
  637.    */
  638. > static int ts_check_signer_name(GENERAL_NAME *tsa_name, X509 *signer)
  639.   {
  640.       STACK_OF(GENERAL_NAME) *gen_names = NULL;

crypto/ts/ts_rsp_verify.c:640:5: 
  638.   static int ts_check_signer_name(GENERAL_NAME *tsa_name, X509 *signer)
  639.   {
  640. >     STACK_OF(GENERAL_NAME) *gen_names = NULL;
  641.       int idx = -1;
  642.       int found = 0;

crypto/ts/ts_rsp_verify.c:641:5: 
  639.   {
  640.       STACK_OF(GENERAL_NAME) *gen_names = NULL;
  641. >     int idx = -1;
  642.       int found = 0;
  643.   

crypto/ts/ts_rsp_verify.c:642:5: 
  640.       STACK_OF(GENERAL_NAME) *gen_names = NULL;
  641.       int idx = -1;
  642. >     int found = 0;
  643.   
  644.       if (tsa_name->type == GEN_DIRNAME

crypto/ts/ts_rsp_verify.c:644:9: Taking false branch
  642.       int found = 0;
  643.   
  644.       if (tsa_name->type == GEN_DIRNAME
                 ^
  645.           && X509_name_cmp(tsa_name->d.dirn, X509_get_subject_name(signer)) == 0)
  646.           return 1;

crypto/ts/ts_rsp_verify.c:647:5: 
  645.           && X509_name_cmp(tsa_name->d.dirn, X509_get_subject_name(signer)) == 0)
  646.           return 1;
  647. >     gen_names = X509_get_ext_d2i(signer, NID_subject_alt_name, NULL, &idx);
  648.       while (gen_names != NULL) {
  649.           found = ts_find_name(gen_names, tsa_name) >= 0;

crypto/x509/x509_ext.c:150:1: start of procedure X509_get_ext_d2i()
    148.   }
    149.   
    150. > void *X509_get_ext_d2i(X509 *x, int nid, int *crit, int *idx)
    151.   {
    152.       return X509V3_get_d2i(x->cert_info.extensions, nid, crit, idx);

crypto/x509/x509_ext.c:152:5: 
    150.   void *X509_get_ext_d2i(X509 *x, int nid, int *crit, int *idx)
    151.   {
    152. >     return X509V3_get_d2i(x->cert_info.extensions, nid, crit, idx);
    153.   }
    154.   
