crypto/x509v3/pcy_tree.c:531: error: NULL_DEREFERENCE
  pointer `cache` last assigned on line 530 could be null and is dereferenced by call to `tree_link_nodes()` at line 531, column 8.
Showing all 48 steps of the trace


crypto/x509v3/pcy_tree.c:522:1: start of procedure tree_evaluate()
520.   	}
521.   
522. > static int tree_evaluate(X509_POLICY_TREE *tree)
523.   	{
524.   	int ret, i;

crypto/x509v3/pcy_tree.c:525:2: 
523.   	{
524.   	int ret, i;
525. > 	X509_POLICY_LEVEL *curr = tree->levels + 1;
526.   	const X509_POLICY_CACHE *cache;
527.   

crypto/x509v3/pcy_tree.c:528:6: 
526.   	const X509_POLICY_CACHE *cache;
527.   
528. > 	for(i = 1; i < tree->nlevel; i++, curr++)
529.   		{
530.   		cache = policy_cache_set(curr->cert);

crypto/x509v3/pcy_tree.c:528:13: Loop condition is true. Entering loop body
526.   	const X509_POLICY_CACHE *cache;
527.   
528.   	for(i = 1; i < tree->nlevel; i++, curr++)
                   ^
529.   		{
530.   		cache = policy_cache_set(curr->cert);

crypto/x509v3/pcy_tree.c:530:3: 
528.   	for(i = 1; i < tree->nlevel; i++, curr++)
529.   		{
530. > 		cache = policy_cache_set(curr->cert);
531.   		if (!tree_link_nodes(curr, cache))
532.   			return 0;

crypto/x509v3/pcy_cache.c:247:1: start of procedure policy_cache_set()
  245.   	}
  246.   
  247. > const X509_POLICY_CACHE *policy_cache_set(X509 *x)
  248.   	{
  249.   

crypto/x509v3/pcy_cache.c:250:6: Taking true branch
  248.   	{
  249.   
  250.   	if (x->policy_cache == NULL)
              ^
  251.   		{
  252.   		CRYPTO_w_lock(CRYPTO_LOCK_X509);

crypto/x509v3/pcy_cache.c:252:3: 
  250.   	if (x->policy_cache == NULL)
  251.   		{
  252. > 		CRYPTO_w_lock(CRYPTO_LOCK_X509);
  253.   			policy_cache_new(x);
  254.   		CRYPTO_w_unlock(CRYPTO_LOCK_X509);

crypto/cryptlib.c:473:1: start of procedure CRYPTO_lock()
    471.   	}
    472.   
    473. > void CRYPTO_lock(int mode, int type, const char *file, int line)
    474.   	{
    475.   #ifdef LOCK_DEBUG

crypto/cryptlib.c:498:6: Taking false branch
    496.   		}
    497.   #endif
    498.   	if (type < 0)
                ^
    499.   		{
    500.   		if (dynlock_lock_callback != NULL)

crypto/cryptlib.c:513:7: Taking true branch
    511.   		}
    512.   	else
    513.   		if (locking_callback != NULL)
                 ^
    514.   			locking_callback(mode,type,file,line);
    515.   	}

crypto/cryptlib.c:514:4: Skipping __function_pointer__(): unresolved function pointer
    512.   	else
    513.   		if (locking_callback != NULL)
    514.   			locking_callback(mode,type,file,line);
              ^
    515.   	}
    516.   

crypto/cryptlib.c:498:2: 
    496.   		}
    497.   #endif
    498. > 	if (type < 0)
    499.   		{
    500.   		if (dynlock_lock_callback != NULL)

crypto/cryptlib.c:515:2: return from a call to CRYPTO_lock
    513.   		if (locking_callback != NULL)
    514.   			locking_callback(mode,type,file,line);
    515.   	}
            ^
    516.   
    517.   int CRYPTO_add_lock(int *pointer, int amount, int type, const char *file,

crypto/x509v3/pcy_cache.c:253:4: 
  251.   		{
  252.   		CRYPTO_w_lock(CRYPTO_LOCK_X509);
  253. > 			policy_cache_new(x);
  254.   		CRYPTO_w_unlock(CRYPTO_LOCK_X509);
  255.   		}

crypto/x509v3/pcy_cache.c:129:1: start of procedure policy_cache_new()
    127.   
    128.   	
    129. > static int policy_cache_new(X509 *x)
    130.   	{
    131.   	X509_POLICY_CACHE *cache;

crypto/x509v3/pcy_cache.c:132:2: 
    130.   	{
    131.   	X509_POLICY_CACHE *cache;
    132. > 	ASN1_INTEGER *ext_any = NULL;
    133.   	POLICY_CONSTRAINTS *ext_pcons = NULL;
    134.   	CERTIFICATEPOLICIES *ext_cpols = NULL;

crypto/x509v3/pcy_cache.c:133:2: 
    131.   	X509_POLICY_CACHE *cache;
    132.   	ASN1_INTEGER *ext_any = NULL;
    133. > 	POLICY_CONSTRAINTS *ext_pcons = NULL;
    134.   	CERTIFICATEPOLICIES *ext_cpols = NULL;
    135.   	POLICY_MAPPINGS *ext_pmaps = NULL;

crypto/x509v3/pcy_cache.c:134:2: 
    132.   	ASN1_INTEGER *ext_any = NULL;
    133.   	POLICY_CONSTRAINTS *ext_pcons = NULL;
    134. > 	CERTIFICATEPOLICIES *ext_cpols = NULL;
    135.   	POLICY_MAPPINGS *ext_pmaps = NULL;
    136.   	int i;

crypto/x509v3/pcy_cache.c:135:2: 
    133.   	POLICY_CONSTRAINTS *ext_pcons = NULL;
    134.   	CERTIFICATEPOLICIES *ext_cpols = NULL;
    135. > 	POLICY_MAPPINGS *ext_pmaps = NULL;
    136.   	int i;
    137.   	cache = OPENSSL_malloc(sizeof(X509_POLICY_CACHE));

crypto/x509v3/pcy_cache.c:137:2: 
    135.   	POLICY_MAPPINGS *ext_pmaps = NULL;
    136.   	int i;
    137. > 	cache = OPENSSL_malloc(sizeof(X509_POLICY_CACHE));
    138.   	if (!cache)
    139.   		return 0;

crypto/mem.c:294:1: start of procedure CRYPTO_malloc()
      292.   	}
      293.   
      294. > void *CRYPTO_malloc(int num, const char *file, int line)
      295.   	{
      296.   	void *ret = NULL;

crypto/mem.c:296:2: 
      294.   void *CRYPTO_malloc(int num, const char *file, int line)
      295.   	{
      296. > 	void *ret = NULL;
      297.   
      298.   	if (num <= 0) return NULL;

crypto/mem.c:298:6: Taking false branch
      296.   	void *ret = NULL;
      297.   
      298.   	if (num <= 0) return NULL;
                  ^
      299.   
      300.   	allow_customize = 0;

crypto/mem.c:300:2: 
      298.   	if (num <= 0) return NULL;
      299.   
      300. > 	allow_customize = 0;
      301.   	if (malloc_debug_func != NULL)
      302.   		{

crypto/mem.c:301:6: Taking false branch
      299.   
      300.   	allow_customize = 0;
      301.   	if (malloc_debug_func != NULL)
                  ^
      302.   		{
      303.   		allow_customize_debug = 0;

crypto/mem.c:306:2: Skipping __function_pointer__(): unresolved function pointer
      304.   		malloc_debug_func(NULL, num, file, line, 0);
      305.   		}
      306.   	ret = malloc_ex_func(num,file,line);
              ^
      307.   #ifdef LEVITTE_DEBUG_MEM
      308.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);

crypto/mem.c:310:6: Taking false branch
      308.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);
      309.   #endif
      310.   	if (malloc_debug_func != NULL)
                  ^
      311.   		malloc_debug_func(ret, num, file, line, 1);
      312.   

crypto/mem.c:317:12: Taking false branch
      315.            * sanitisation function can't be optimised out. NB: We only do
      316.            * this for >2Kb so the overhead doesn't bother us. */
      317.           if(ret && (num > 2048))
                        ^
      318.   	{	extern unsigned char cleanse_ctr;
      319.                   ((unsigned char *)ret)[0] = cleanse_ctr;

crypto/mem.c:323:2: 
      321.   #endif
      322.   
      323. > 	return ret;
      324.   	}
      325.   

crypto/mem.c:324:2: return from a call to CRYPTO_malloc
      322.   
      323.   	return ret;
      324.   	}
              ^
      325.   
      326.   void *CRYPTO_realloc(void *str, int num, const char *file, int line)

crypto/x509v3/pcy_cache.c:138:7: Taking true branch
    136.   	int i;
    137.   	cache = OPENSSL_malloc(sizeof(X509_POLICY_CACHE));
    138.   	if (!cache)
                 ^
    139.   		return 0;
    140.   	cache->anyPolicy = NULL;

crypto/x509v3/pcy_cache.c:139:3: 
    137.   	cache = OPENSSL_malloc(sizeof(X509_POLICY_CACHE));
    138.   	if (!cache)
    139. > 		return 0;
    140.   	cache->anyPolicy = NULL;
    141.   	cache->data = NULL;

crypto/x509v3/pcy_cache.c:234:1: return from a call to policy_cache_new
    232.   
    233.   	
    234. > }
    235.   
    236.   void policy_cache_free(X509_POLICY_CACHE *cache)

crypto/x509v3/pcy_cache.c:254:3: 
  252.   		CRYPTO_w_lock(CRYPTO_LOCK_X509);
  253.   			policy_cache_new(x);
  254. > 		CRYPTO_w_unlock(CRYPTO_LOCK_X509);
  255.   		}
  256.   

crypto/cryptlib.c:473:1: start of procedure CRYPTO_lock()
    471.   	}
    472.   
    473. > void CRYPTO_lock(int mode, int type, const char *file, int line)
    474.   	{
    475.   #ifdef LOCK_DEBUG

crypto/cryptlib.c:498:6: Taking false branch
    496.   		}
    497.   #endif
    498.   	if (type < 0)
                ^
    499.   		{
    500.   		if (dynlock_lock_callback != NULL)

crypto/cryptlib.c:513:7: Taking true branch
    511.   		}
    512.   	else
    513.   		if (locking_callback != NULL)
                 ^
    514.   			locking_callback(mode,type,file,line);
    515.   	}

crypto/cryptlib.c:514:4: Skipping __function_pointer__(): unresolved function pointer
    512.   	else
    513.   		if (locking_callback != NULL)
    514.   			locking_callback(mode,type,file,line);
              ^
    515.   	}
    516.   

crypto/cryptlib.c:498:2: 
    496.   		}
    497.   #endif
    498. > 	if (type < 0)
    499.   		{
    500.   		if (dynlock_lock_callback != NULL)

crypto/cryptlib.c:515:2: return from a call to CRYPTO_lock
    513.   		if (locking_callback != NULL)
    514.   			locking_callback(mode,type,file,line);
    515.   	}
            ^
    516.   
    517.   int CRYPTO_add_lock(int *pointer, int amount, int type, const char *file,

crypto/x509v3/pcy_cache.c:257:2: 
  255.   		}
  256.   
  257. > 	return x->policy_cache;
  258.   
  259.   	}

crypto/x509v3/pcy_cache.c:259:2: return from a call to policy_cache_set
  257.   	return x->policy_cache;
  258.   
  259.   	}
          ^
  260.   
  261.   X509_POLICY_DATA *policy_cache_find_data(const X509_POLICY_CACHE *cache,

crypto/x509v3/pcy_tree.c:531:8: 
529.   		{
530.   		cache = policy_cache_set(curr->cert);
531. > 		if (!tree_link_nodes(curr, cache))
532.   			return 0;
533.   

crypto/x509v3/pcy_tree.c:244:1: start of procedure tree_link_nodes()
  242.    */
  243.   
  244. > static int tree_link_nodes(X509_POLICY_LEVEL *curr,
  245.   				const X509_POLICY_CACHE *cache)
  246.   	{

crypto/x509v3/pcy_tree.c:251:2: 
  249.   	X509_POLICY_DATA *data;
  250.   	X509_POLICY_NODE *parent;
  251. > 	last = curr - 1;
  252.   	for (i = 0; i < sk_X509_POLICY_DATA_num(cache->data); i++)
  253.   		{

crypto/x509v3/pcy_tree.c:252:7: 
  250.   	X509_POLICY_NODE *parent;
  251.   	last = curr - 1;
  252. > 	for (i = 0; i < sk_X509_POLICY_DATA_num(cache->data); i++)
  253.   		{
  254.   		data = sk_X509_POLICY_DATA_value(cache->data, i);

crypto/x509v3/pcy_tree.c:252:14: 
  250.   	X509_POLICY_NODE *parent;
  251.   	last = curr - 1;
  252. > 	for (i = 0; i < sk_X509_POLICY_DATA_num(cache->data); i++)
  253.   		{
  254.   		data = sk_X509_POLICY_DATA_value(cache->data, i);
