crypto/store/str_lib.c:1302: error: NULL_DEREFERENCE
  pointer `null` is dereferenced by call to `STORE_ATTR_INFO_modify_sha1str()` at line 1302, column 4.
Showing all 82 steps of the trace


crypto/store/str_lib.c:1285:1: start of procedure STORE_ATTR_INFO_attr_free()
1283.   	return (STORE_ATTR_INFO *)OPENSSL_malloc(sizeof(STORE_ATTR_INFO));
1284.   	}
1285. > static void STORE_ATTR_INFO_attr_free(STORE_ATTR_INFO *attrs,
1286.   	STORE_ATTR_TYPES code)
1287.   	{

crypto/store/str_lib.c:1288:6: Taking true branch
1286.   	STORE_ATTR_TYPES code)
1287.   	{
1288.   	if (ATTR_IS_SET(attrs,code))
             ^
1289.   		{
1290.   		switch(code)

crypto/store/str_lib.c:1288:6: Taking true branch
1286.   	STORE_ATTR_TYPES code)
1287.   	{
1288.   	if (ATTR_IS_SET(attrs,code))
             ^
1289.   		{
1290.   		switch(code)

crypto/store/str_lib.c:1288:6: Taking true branch
1286.   	STORE_ATTR_TYPES code)
1287.   	{
1288.   	if (ATTR_IS_SET(attrs,code))
             ^
1289.   		{
1290.   		switch(code)

crypto/store/str_lib.c:1290:3: 
1288.   	if (ATTR_IS_SET(attrs,code))
1289.   		{
1290. > 		switch(code)
1291.   			{
1292.   		case STORE_ATTR_FRIENDLYNAME:

crypto/store/str_lib.c:1292:3: Switch condition is false. Skipping switch case
1290.   		switch(code)
1291.   			{
1292.   		case STORE_ATTR_FRIENDLYNAME:
          ^
1293.   		case STORE_ATTR_EMAIL:
1294.   		case STORE_ATTR_FILENAME:

crypto/store/str_lib.c:1293:3: Switch condition is false. Skipping switch case
1291.   			{
1292.   		case STORE_ATTR_FRIENDLYNAME:
1293.   		case STORE_ATTR_EMAIL:
          ^
1294.   		case STORE_ATTR_FILENAME:
1295.   			STORE_ATTR_INFO_modify_cstr(attrs, code, NULL, 0);

crypto/store/str_lib.c:1294:3: Switch condition is false. Skipping switch case
1292.   		case STORE_ATTR_FRIENDLYNAME:
1293.   		case STORE_ATTR_EMAIL:
1294.   		case STORE_ATTR_FILENAME:
          ^
1295.   			STORE_ATTR_INFO_modify_cstr(attrs, code, NULL, 0);
1296.   			break;

crypto/store/str_lib.c:1297:3: Switch condition is true. Entering switch case
1295.   			STORE_ATTR_INFO_modify_cstr(attrs, code, NULL, 0);
1296.   			break;
1297.   		case STORE_ATTR_KEYID:
          ^
1298.   		case STORE_ATTR_ISSUERKEYID:
1299.   		case STORE_ATTR_SUBJECTKEYID:

crypto/store/str_lib.c:1302:4: 
1300.   		case STORE_ATTR_ISSUERSERIALHASH:
1301.   		case STORE_ATTR_CERTHASH:
1302. > 			STORE_ATTR_INFO_modify_sha1str(attrs, code, NULL, 0);
1303.   			break;
1304.   		case STORE_ATTR_ISSUER:

crypto/store/str_lib.c:1483:1: start of procedure STORE_ATTR_INFO_modify_sha1str()
  1481.   	return STORE_ATTR_INFO_set_cstr(attrs, code, cstr, cstr_size);
  1482.   	}
  1483. > int STORE_ATTR_INFO_modify_sha1str(STORE_ATTR_INFO *attrs, STORE_ATTR_TYPES code,
  1484.   	unsigned char *sha1str, size_t sha1str_size)
  1485.   	{

crypto/store/str_lib.c:1486:7: Taking false branch
  1484.   	unsigned char *sha1str, size_t sha1str_size)
  1485.   	{
  1486.   	if (!attrs)
                ^
  1487.   		{
  1488.   		STOREerr(STORE_F_STORE_ATTR_INFO_MODIFY_SHA1STR,

crypto/store/str_lib.c:1492:6: Taking true branch
  1490.   		return 0;
  1491.   		}
  1492.   	if (ATTR_IS_SET(attrs,code))
               ^
  1493.   		{
  1494.   		OPENSSL_free(attrs->values[code].sha1string);

crypto/store/str_lib.c:1492:6: Taking false branch
  1490.   		return 0;
  1491.   		}
  1492.   	if (ATTR_IS_SET(attrs,code))
               ^
  1493.   		{
  1494.   		OPENSSL_free(attrs->values[code].sha1string);

crypto/store/str_lib.c:1498:2: 
  1496.   		CLEAR_ATTRBIT(attrs, code);
  1497.   		}
  1498. > 	return STORE_ATTR_INFO_set_sha1str(attrs, code, sha1str, sha1str_size);
  1499.   	}
  1500.   int STORE_ATTR_INFO_modify_dn(STORE_ATTR_INFO *attrs, STORE_ATTR_TYPES code,

crypto/store/str_lib.c:1404:1: start of procedure STORE_ATTR_INFO_set_sha1str()
    1402.   	return 0;
    1403.   	}
    1404. > int STORE_ATTR_INFO_set_sha1str(STORE_ATTR_INFO *attrs, STORE_ATTR_TYPES code,
    1405.   	unsigned char *sha1str, size_t sha1str_size)
    1406.   	{

crypto/store/str_lib.c:1407:7: Taking false branch
    1405.   	unsigned char *sha1str, size_t sha1str_size)
    1406.   	{
    1407.   	if (!attrs)
                  ^
    1408.   		{
    1409.   		STOREerr(STORE_F_STORE_ATTR_INFO_SET_SHA1STR,

crypto/store/str_lib.c:1413:7: Taking false branch
    1411.   		return 0;
    1412.   		}
    1413.   	if (!ATTR_IS_SET(attrs,code))
                  ^
    1414.   		{
    1415.   		if ((attrs->values[code].sha1string =

crypto/store/str_lib.c:1413:7: Taking true branch
    1411.   		return 0;
    1412.   		}
    1413.   	if (!ATTR_IS_SET(attrs,code))
                  ^
    1414.   		{
    1415.   		if ((attrs->values[code].sha1string =

crypto/store/str_lib.c:1415:8: 
    1413.   	if (!ATTR_IS_SET(attrs,code))
    1414.   		{
    1415. > 		if ((attrs->values[code].sha1string =
    1416.   			    (unsigned char *)BUF_memdup(sha1str,
    1417.   				    sha1str_size)))

crypto/buffer/buffer.c:187:1: start of procedure BUF_memdup()
      185.   	}
      186.   
      187. > void *BUF_memdup(const void *data, size_t siz)
      188.   	{
      189.   	void *ret;

crypto/buffer/buffer.c:191:6: Taking false branch
      189.   	void *ret;
      190.   
      191.   	if (data == NULL) return(NULL);
                  ^
      192.   
      193.   	ret=OPENSSL_malloc(siz);

crypto/buffer/buffer.c:193:2: 
      191.   	if (data == NULL) return(NULL);
      192.   
      193. > 	ret=OPENSSL_malloc(siz);
      194.   	if (ret == NULL) 
      195.   		{

crypto/mem.c:294:1: start of procedure CRYPTO_malloc()
        292.   	}
        293.   
        294. > void *CRYPTO_malloc(int num, const char *file, int line)
        295.   	{
        296.   	void *ret = NULL;

crypto/mem.c:296:2: 
        294.   void *CRYPTO_malloc(int num, const char *file, int line)
        295.   	{
        296. > 	void *ret = NULL;
        297.   
        298.   	if (num <= 0) return NULL;

crypto/mem.c:298:6: Taking false branch
        296.   	void *ret = NULL;
        297.   
        298.   	if (num <= 0) return NULL;
                    ^
        299.   
        300.   	allow_customize = 0;

crypto/mem.c:300:2: 
        298.   	if (num <= 0) return NULL;
        299.   
        300. > 	allow_customize = 0;
        301.   	if (malloc_debug_func != NULL)
        302.   		{

crypto/mem.c:301:6: Taking false branch
        299.   
        300.   	allow_customize = 0;
        301.   	if (malloc_debug_func != NULL)
                    ^
        302.   		{
        303.   		allow_customize_debug = 0;

crypto/mem.c:306:2: Skipping __function_pointer__(): unresolved function pointer
        304.   		malloc_debug_func(NULL, num, file, line, 0);
        305.   		}
        306.   	ret = malloc_ex_func(num,file,line);
                ^
        307.   #ifdef LEVITTE_DEBUG_MEM
        308.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);

crypto/mem.c:310:6: Taking false branch
        308.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);
        309.   #endif
        310.   	if (malloc_debug_func != NULL)
                    ^
        311.   		malloc_debug_func(ret, num, file, line, 1);
        312.   

crypto/mem.c:317:12: Taking false branch
        315.            * sanitisation function can't be optimised out. NB: We only do
        316.            * this for >2Kb so the overhead doesn't bother us. */
        317.           if(ret && (num > 2048))
                          ^
        318.   	{	extern unsigned char cleanse_ctr;
        319.                   ((unsigned char *)ret)[0] = cleanse_ctr;

crypto/mem.c:323:2: 
        321.   #endif
        322.   
        323. > 	return ret;
        324.   	}
        325.   

crypto/mem.c:324:2: return from a call to CRYPTO_malloc
        322.   
        323.   	return ret;
        324.   	}
                ^
        325.   
        326.   void *CRYPTO_realloc(void *str, int num, const char *file, int line)

crypto/buffer/buffer.c:194:6: Taking true branch
      192.   
      193.   	ret=OPENSSL_malloc(siz);
      194.   	if (ret == NULL) 
                  ^
      195.   		{
      196.   		BUFerr(BUF_F_BUF_MEMDUP,ERR_R_MALLOC_FAILURE);

crypto/buffer/buffer.c:196:3: 
      194.   	if (ret == NULL) 
      195.   		{
      196. > 		BUFerr(BUF_F_BUF_MEMDUP,ERR_R_MALLOC_FAILURE);
      197.   		return(NULL);
      198.   		}

crypto/err/err.c:680:1: start of procedure ERR_put_error()
        678.   /********************************************************/
        679.   
        680. > void ERR_put_error(int lib, int func, int reason, const char *file,
        681.   	     int line)
        682.   	{

crypto/err/err.c:704:2: Skipping ERR_get_state(): empty list of specs
        702.   	}
        703.   #endif
        704.   	es=ERR_get_state();
                ^
        705.   
        706.   	es->top=(es->top+1)%ERR_NUM_ERRORS;

crypto/err/err.c:706:2: 
        704.   	es=ERR_get_state();
        705.   
        706. > 	es->top=(es->top+1)%ERR_NUM_ERRORS;
        707.   	if (es->top == es->bottom)
        708.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;

crypto/err/err.c:707:6: Taking false branch
        705.   
        706.   	es->top=(es->top+1)%ERR_NUM_ERRORS;
        707.   	if (es->top == es->bottom)
                    ^
        708.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
        709.   	es->err_flags[es->top]=0;

crypto/err/err.c:709:2: 
        707.   	if (es->top == es->bottom)
        708.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
        709. > 	es->err_flags[es->top]=0;
        710.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
        711.   	es->err_file[es->top]=file;

crypto/err/err.c:710:2: 
        708.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
        709.   	es->err_flags[es->top]=0;
        710. > 	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
        711.   	es->err_file[es->top]=file;
        712.   	es->err_line[es->top]=line;

crypto/err/err.c:711:2: 
        709.   	es->err_flags[es->top]=0;
        710.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
        711. > 	es->err_file[es->top]=file;
        712.   	es->err_line[es->top]=line;
        713.   	err_clear_data(es,es->top);

crypto/err/err.c:712:2: 
        710.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
        711.   	es->err_file[es->top]=file;
        712. > 	es->err_line[es->top]=line;
        713.   	err_clear_data(es,es->top);
        714.   	}

crypto/err/err.c:713:2: Taking true branch
        711.   	es->err_file[es->top]=file;
        712.   	es->err_line[es->top]=line;
        713.   	err_clear_data(es,es->top);
                ^
        714.   	}
        715.   

crypto/err/err.c:713:2: Taking true branch
        711.   	es->err_file[es->top]=file;
        712.   	es->err_line[es->top]=line;
        713.   	err_clear_data(es,es->top);
                ^
        714.   	}
        715.   

crypto/mem.c:377:1: start of procedure CRYPTO_free()
          375.   	}
          376.   
          377. > void CRYPTO_free(void *str)
          378.   	{
          379.   	if (free_debug_func != NULL)

crypto/mem.c:379:6: Taking true branch
          377.   void CRYPTO_free(void *str)
          378.   	{
          379.   	if (free_debug_func != NULL)
                      ^
          380.   		free_debug_func(str, 0);
          381.   #ifdef LEVITTE_DEBUG_MEM

crypto/mem.c:380:3: Skipping __function_pointer__(): unresolved function pointer
          378.   	{
          379.   	if (free_debug_func != NULL)
          380.   		free_debug_func(str, 0);
                   ^
          381.   #ifdef LEVITTE_DEBUG_MEM
          382.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         < 0x%p\n", str);

crypto/mem.c:384:2: Skipping __function_pointer__(): unresolved function pointer
          382.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         < 0x%p\n", str);
          383.   #endif
          384.   	free_func(str);
                  ^
          385.   	if (free_debug_func != NULL)
          386.   		free_debug_func(NULL, 1);

crypto/mem.c:385:6: Taking true branch
          383.   #endif
          384.   	free_func(str);
          385.   	if (free_debug_func != NULL)
                      ^
          386.   		free_debug_func(NULL, 1);
          387.   	}

crypto/mem.c:386:3: Skipping __function_pointer__(): unresolved function pointer
          384.   	free_func(str);
          385.   	if (free_debug_func != NULL)
          386.   		free_debug_func(NULL, 1);
                   ^
          387.   	}
          388.   

crypto/mem.c:385:2: 
          383.   #endif
          384.   	free_func(str);
          385. > 	if (free_debug_func != NULL)
          386.   		free_debug_func(NULL, 1);
          387.   	}

crypto/mem.c:387:2: return from a call to CRYPTO_free
          385.   	if (free_debug_func != NULL)
          386.   		free_debug_func(NULL, 1);
          387.   	}
                  ^
          388.   
          389.   void *CRYPTO_remalloc(void *a, int num, const char *file, int line)

crypto/err/err.c:713:2: Loop condition is false. Leaving loop
        711.   	es->err_file[es->top]=file;
        712.   	es->err_line[es->top]=line;
        713.   	err_clear_data(es,es->top);
                ^
        714.   	}
        715.   

crypto/err/err.c:714:2: return from a call to ERR_put_error
        712.   	es->err_line[es->top]=line;
        713.   	err_clear_data(es,es->top);
        714.   	}
                ^
        715.   
        716.   void ERR_clear_error(void)

crypto/buffer/buffer.c:197:3: 
      195.   		{
      196.   		BUFerr(BUF_F_BUF_MEMDUP,ERR_R_MALLOC_FAILURE);
      197. > 		return(NULL);
      198.   		}
      199.   	return memcpy(ret, data, siz);

crypto/buffer/buffer.c:200:2: return from a call to BUF_memdup
      198.   		}
      199.   	return memcpy(ret, data, siz);
      200.   	}	
              ^
      201.   
      202.   size_t BUF_strlcpy(char *dst, const char *src, size_t size)

crypto/store/str_lib.c:1415:8: Taking false branch
    1413.   	if (!ATTR_IS_SET(attrs,code))
    1414.   		{
    1415.   		if ((attrs->values[code].sha1string =
                   ^
    1416.   			    (unsigned char *)BUF_memdup(sha1str,
    1417.   				    sha1str_size)))

crypto/store/str_lib.c:1419:3: 
    1417.   				    sha1str_size)))
    1418.   			return 1;
    1419. > 		STOREerr(STORE_F_STORE_ATTR_INFO_SET_SHA1STR,
    1420.   			ERR_R_MALLOC_FAILURE);
    1421.   		return 0;

crypto/err/err.c:680:1: start of procedure ERR_put_error()
      678.   /********************************************************/
      679.   
      680. > void ERR_put_error(int lib, int func, int reason, const char *file,
      681.   	     int line)
      682.   	{

crypto/err/err.c:704:2: Skipping ERR_get_state(): empty list of specs
      702.   	}
      703.   #endif
      704.   	es=ERR_get_state();
              ^
      705.   
      706.   	es->top=(es->top+1)%ERR_NUM_ERRORS;

crypto/err/err.c:706:2: 
      704.   	es=ERR_get_state();
      705.   
      706. > 	es->top=(es->top+1)%ERR_NUM_ERRORS;
      707.   	if (es->top == es->bottom)
      708.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;

crypto/err/err.c:707:6: Taking false branch
      705.   
      706.   	es->top=(es->top+1)%ERR_NUM_ERRORS;
      707.   	if (es->top == es->bottom)
                  ^
      708.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
      709.   	es->err_flags[es->top]=0;

crypto/err/err.c:709:2: 
      707.   	if (es->top == es->bottom)
      708.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
      709. > 	es->err_flags[es->top]=0;
      710.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
      711.   	es->err_file[es->top]=file;

crypto/err/err.c:710:2: 
      708.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
      709.   	es->err_flags[es->top]=0;
      710. > 	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
      711.   	es->err_file[es->top]=file;
      712.   	es->err_line[es->top]=line;

crypto/err/err.c:711:2: 
      709.   	es->err_flags[es->top]=0;
      710.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
      711. > 	es->err_file[es->top]=file;
      712.   	es->err_line[es->top]=line;
      713.   	err_clear_data(es,es->top);

crypto/err/err.c:712:2: 
      710.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
      711.   	es->err_file[es->top]=file;
      712. > 	es->err_line[es->top]=line;
      713.   	err_clear_data(es,es->top);
      714.   	}

crypto/err/err.c:713:2: Taking true branch
      711.   	es->err_file[es->top]=file;
      712.   	es->err_line[es->top]=line;
      713.   	err_clear_data(es,es->top);
              ^
      714.   	}
      715.   

crypto/err/err.c:713:2: Taking true branch
      711.   	es->err_file[es->top]=file;
      712.   	es->err_line[es->top]=line;
      713.   	err_clear_data(es,es->top);
              ^
      714.   	}
      715.   

crypto/mem.c:377:1: start of procedure CRYPTO_free()
        375.   	}
        376.   
        377. > void CRYPTO_free(void *str)
        378.   	{
        379.   	if (free_debug_func != NULL)

crypto/mem.c:379:6: Taking true branch
        377.   void CRYPTO_free(void *str)
        378.   	{
        379.   	if (free_debug_func != NULL)
                    ^
        380.   		free_debug_func(str, 0);
        381.   #ifdef LEVITTE_DEBUG_MEM

crypto/mem.c:380:3: Skipping __function_pointer__(): unresolved function pointer
        378.   	{
        379.   	if (free_debug_func != NULL)
        380.   		free_debug_func(str, 0);
                 ^
        381.   #ifdef LEVITTE_DEBUG_MEM
        382.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         < 0x%p\n", str);

crypto/mem.c:384:2: Skipping __function_pointer__(): unresolved function pointer
        382.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         < 0x%p\n", str);
        383.   #endif
        384.   	free_func(str);
                ^
        385.   	if (free_debug_func != NULL)
        386.   		free_debug_func(NULL, 1);

crypto/mem.c:385:6: Taking true branch
        383.   #endif
        384.   	free_func(str);
        385.   	if (free_debug_func != NULL)
                    ^
        386.   		free_debug_func(NULL, 1);
        387.   	}

crypto/mem.c:386:3: Skipping __function_pointer__(): unresolved function pointer
        384.   	free_func(str);
        385.   	if (free_debug_func != NULL)
        386.   		free_debug_func(NULL, 1);
                 ^
        387.   	}
        388.   

crypto/mem.c:385:2: 
        383.   #endif
        384.   	free_func(str);
        385. > 	if (free_debug_func != NULL)
        386.   		free_debug_func(NULL, 1);
        387.   	}

crypto/mem.c:387:2: return from a call to CRYPTO_free
        385.   	if (free_debug_func != NULL)
        386.   		free_debug_func(NULL, 1);
        387.   	}
                ^
        388.   
        389.   void *CRYPTO_remalloc(void *a, int num, const char *file, int line)

crypto/err/err.c:713:2: Loop condition is false. Leaving loop
      711.   	es->err_file[es->top]=file;
      712.   	es->err_line[es->top]=line;
      713.   	err_clear_data(es,es->top);
              ^
      714.   	}
      715.   

crypto/err/err.c:714:2: return from a call to ERR_put_error
      712.   	es->err_line[es->top]=line;
      713.   	err_clear_data(es,es->top);
      714.   	}
              ^
      715.   
      716.   void ERR_clear_error(void)

crypto/store/str_lib.c:1421:3: 
    1419.   		STOREerr(STORE_F_STORE_ATTR_INFO_SET_SHA1STR,
    1420.   			ERR_R_MALLOC_FAILURE);
    1421. > 		return 0;
    1422.   		}
    1423.   	STOREerr(STORE_F_STORE_ATTR_INFO_SET_SHA1STR, STORE_R_ALREADY_HAS_A_VALUE);

crypto/store/str_lib.c:1425:2: return from a call to STORE_ATTR_INFO_set_sha1str
    1423.   	STOREerr(STORE_F_STORE_ATTR_INFO_SET_SHA1STR, STORE_R_ALREADY_HAS_A_VALUE);
    1424.   	return 0;
    1425.   	}
             ^
    1426.   int STORE_ATTR_INFO_set_dn(STORE_ATTR_INFO *attrs, STORE_ATTR_TYPES code,
    1427.   	X509_NAME *dn)

crypto/store/str_lib.c:1499:2: return from a call to STORE_ATTR_INFO_modify_sha1str
  1497.   		}
  1498.   	return STORE_ATTR_INFO_set_sha1str(attrs, code, sha1str, sha1str_size);
  1499.   	}
           ^
  1500.   int STORE_ATTR_INFO_modify_dn(STORE_ATTR_INFO *attrs, STORE_ATTR_TYPES code,
  1501.   	X509_NAME *dn)
