crypto/x509/x509_vfy.c:247: error: NULL_DEREFERENCE
  pointer `sktmp` last assigned on line 171 could be null and is dereferenced by call to `sk_delete_ptr()` at line 247, column 11.
Showing all 75 steps of the trace


crypto/x509/x509_vfy.c:163:1: start of procedure X509_verify_cert()
161.   	}
162.   
163. > int X509_verify_cert(X509_STORE_CTX *ctx)
164.   	{
165.   	X509 *x,*xtmp,*chain_ss=NULL;

crypto/x509/x509_vfy.c:165:2: 
163.   int X509_verify_cert(X509_STORE_CTX *ctx)
164.   	{
165. > 	X509 *x,*xtmp,*chain_ss=NULL;
166.   	int bad_chain = 0;
167.   	X509_VERIFY_PARAM *param = ctx->param;

crypto/x509/x509_vfy.c:166:2: 
164.   	{
165.   	X509 *x,*xtmp,*chain_ss=NULL;
166. > 	int bad_chain = 0;
167.   	X509_VERIFY_PARAM *param = ctx->param;
168.   	int depth,i,ok=0;

crypto/x509/x509_vfy.c:167:2: 
165.   	X509 *x,*xtmp,*chain_ss=NULL;
166.   	int bad_chain = 0;
167. > 	X509_VERIFY_PARAM *param = ctx->param;
168.   	int depth,i,ok=0;
169.   	int num;

crypto/x509/x509_vfy.c:168:2: 
166.   	int bad_chain = 0;
167.   	X509_VERIFY_PARAM *param = ctx->param;
168. > 	int depth,i,ok=0;
169.   	int num;
170.   	int (*cb)(int xok,X509_STORE_CTX *xctx);

crypto/x509/x509_vfy.c:171:2: 
169.   	int num;
170.   	int (*cb)(int xok,X509_STORE_CTX *xctx);
171. > 	STACK_OF(X509) *sktmp=NULL;
172.   	if (ctx->cert == NULL)
173.   		{

crypto/x509/x509_vfy.c:172:6: Taking false branch
170.   	int (*cb)(int xok,X509_STORE_CTX *xctx);
171.   	STACK_OF(X509) *sktmp=NULL;
172.   	if (ctx->cert == NULL)
            ^
173.   		{
174.   		X509err(X509_F_X509_VERIFY_CERT,X509_R_NO_CERT_SET_FOR_US_TO_VERIFY);

crypto/x509/x509_vfy.c:178:2: 
176.   		}
177.   
178. > 	cb=ctx->verify_cb;
179.   
180.   	/* first we make sure the chain we are going to build is

crypto/x509/x509_vfy.c:182:6: Taking false branch
180.   	/* first we make sure the chain we are going to build is
181.   	 * present and that the first entry is in place */
182.   	if (ctx->chain == NULL)
            ^
183.   		{
184.   		if (	((ctx->chain=sk_X509_new_null()) == NULL) ||

crypto/x509/x509_vfy.c:195:6: Taking false branch
193.   
194.   	/* We use a temporary STACK so we can chop and hack at it */
195.   	if (ctx->untrusted != NULL
            ^
196.   	    && (sktmp=sk_X509_dup(ctx->untrusted)) == NULL)
197.   		{

crypto/x509/x509_vfy.c:202:6: Condition is true
200.   		}
201.   
202.   	num=sk_X509_num(ctx->chain);
            ^
203.   	x=sk_X509_value(ctx->chain,num-1);
204.   	depth=param->depth;

crypto/x509/x509_vfy.c:202:2: 
200.   		}
201.   
202. > 	num=sk_X509_num(ctx->chain);
203.   	x=sk_X509_value(ctx->chain,num-1);
204.   	depth=param->depth;

crypto/stack/stack.c:294:1: start of procedure sk_num()
  292.   	}
  293.   
  294. > int sk_num(const _STACK *st)
  295.   {
  296.   	if(st == NULL) return -1;

crypto/stack/stack.c:296:5: Taking false branch
  294.   int sk_num(const _STACK *st)
  295.   {
  296.   	if(st == NULL) return -1;
             ^
  297.   	return st->num;
  298.   }

crypto/stack/stack.c:297:2: 
  295.   {
  296.   	if(st == NULL) return -1;
  297. > 	return st->num;
  298.   }
  299.   

crypto/stack/stack.c:298:1: return from a call to sk_num
  296.   	if(st == NULL) return -1;
  297.   	return st->num;
  298. > }
  299.   
  300.   void *sk_value(const _STACK *st, int i)

crypto/x509/x509_vfy.c:203:4: Condition is true
201.   
202.   	num=sk_X509_num(ctx->chain);
203.   	x=sk_X509_value(ctx->chain,num-1);
          ^
204.   	depth=param->depth;
205.   

crypto/x509/x509_vfy.c:203:2: 
201.   
202.   	num=sk_X509_num(ctx->chain);
203. > 	x=sk_X509_value(ctx->chain,num-1);
204.   	depth=param->depth;
205.   

crypto/stack/stack.c:300:1: start of procedure sk_value()
  298.   }
  299.   
  300. > void *sk_value(const _STACK *st, int i)
  301.   {
  302.   	if(!st || (i < 0) || (i >= st->num)) return NULL;

crypto/stack/stack.c:302:6: Taking false branch
  300.   void *sk_value(const _STACK *st, int i)
  301.   {
  302.   	if(!st || (i < 0) || (i >= st->num)) return NULL;
              ^
  303.   	return st->data[i];
  304.   }

crypto/stack/stack.c:302:13: Taking false branch
  300.   void *sk_value(const _STACK *st, int i)
  301.   {
  302.   	if(!st || (i < 0) || (i >= st->num)) return NULL;
                     ^
  303.   	return st->data[i];
  304.   }

crypto/stack/stack.c:302:24: Taking false branch
  300.   void *sk_value(const _STACK *st, int i)
  301.   {
  302.   	if(!st || (i < 0) || (i >= st->num)) return NULL;
                                ^
  303.   	return st->data[i];
  304.   }

crypto/stack/stack.c:303:2: 
  301.   {
  302.   	if(!st || (i < 0) || (i >= st->num)) return NULL;
  303. > 	return st->data[i];
  304.   }
  305.   

crypto/stack/stack.c:304:1: return from a call to sk_value
  302.   	if(!st || (i < 0) || (i >= st->num)) return NULL;
  303.   	return st->data[i];
  304. > }
  305.   
  306.   void *sk_set(_STACK *st, int i, void *value)

crypto/x509/x509_vfy.c:204:2: 
202.   	num=sk_X509_num(ctx->chain);
203.   	x=sk_X509_value(ctx->chain,num-1);
204. > 	depth=param->depth;
205.   
206.   

crypto/x509/x509_vfy.c:257:3: Loop condition is true. Entering loop body
255.   			}
256.   		break;
257.   		}
         ^
258.   
259.   	/* at this point, chain should contain a list of untrusted

crypto/x509/x509_vfy.c:210:7: Taking false branch
208.   		{
209.   		/* If we have enough, we break */
210.   		if (depth < num) break; /* FIXME: If this happens, we should take
             ^
211.   		                         * note of it and, if appropriate, use the
212.   		                         * X509_V_ERR_CERT_CHAIN_TOO_LONG error

crypto/x509/x509_vfy.c:217:7: 
215.   
216.   		/* If we are self signed, we break */
217. > 		if (cert_self_signed(x))
218.   			break;
219.   		/* If asked see if we can find issuer in trusted store first */

crypto/x509/x509_vfy.c:154:1: start of procedure cert_self_signed()
  152.   #endif
  153.   /* Return 1 is a certificate is self signed */
  154. > static int cert_self_signed(X509 *x)
  155.   	{
  156.   	X509_check_purpose(x, -1, 0);

crypto/x509/x509_vfy.c:156:2: Skipping X509_check_purpose(): empty list of specs
  154.   static int cert_self_signed(X509 *x)
  155.   	{
  156.   	X509_check_purpose(x, -1, 0);
          ^
  157.   	if (x->ex_flags & EXFLAG_SS)
  158.   		return 1;

crypto/x509/x509_vfy.c:157:6: Taking false branch
  155.   	{
  156.   	X509_check_purpose(x, -1, 0);
  157.   	if (x->ex_flags & EXFLAG_SS)
              ^
  158.   		return 1;
  159.   	else

crypto/x509/x509_vfy.c:160:3: 
  158.   		return 1;
  159.   	else
  160. > 		return 0;
  161.   	}
  162.   

crypto/x509/x509_vfy.c:161:2: return from a call to cert_self_signed
  159.   	else
  160.   		return 0;
  161.   	}
          ^
  162.   
  163.   int X509_verify_cert(X509_STORE_CTX *ctx)

crypto/x509/x509_vfy.c:217:7: Taking false branch
215.   
216.   		/* If we are self signed, we break */
217.   		if (cert_self_signed(x))
             ^
218.   			break;
219.   		/* If asked see if we can find issuer in trusted store first */

crypto/x509/x509_vfy.c:220:7: Taking true branch
218.   			break;
219.   		/* If asked see if we can find issuer in trusted store first */
220.   		if (ctx->param->flags & X509_V_FLAG_TRUSTED_FIRST)
             ^
221.   			{
222.   			ok = ctx->get_issuer(&xtmp, ctx, x);

crypto/x509/x509_vfy.c:222:4: Skipping __function_pointer__(): unresolved function pointer
220.   		if (ctx->param->flags & X509_V_FLAG_TRUSTED_FIRST)
221.   			{
222.   			ok = ctx->get_issuer(&xtmp, ctx, x);
          ^
223.   			if (ok < 0)
224.   				return ok;

crypto/x509/x509_vfy.c:223:8: Taking false branch
221.   			{
222.   			ok = ctx->get_issuer(&xtmp, ctx, x);
223.   			if (ok < 0)
              ^
224.   				return ok;
225.   			/* If successful for now free up cert so it

crypto/x509/x509_vfy.c:228:8: Taking false branch
226.   			 * will be picked up again later.
227.   			 */
228.   			if (ok > 0)
              ^
229.   				{
230.   				X509_free(xtmp);

crypto/x509/x509_vfy.c:236:7: Taking true branch
234.   
235.   		/* If we were passed a cert chain, use it first */
236.   		if (ctx->untrusted != NULL)
             ^
237.   			{
238.   			xtmp=find_issuer(ctx, sktmp,x);

crypto/x509/x509_vfy.c:238:4: Skipping find_issuer(): empty list of specs
236.   		if (ctx->untrusted != NULL)
237.   			{
238.   			xtmp=find_issuer(ctx, sktmp,x);
          ^
239.   			if (xtmp != NULL)
240.   				{

crypto/x509/x509_vfy.c:239:8: Taking true branch
237.   			{
238.   			xtmp=find_issuer(ctx, sktmp,x);
239.   			if (xtmp != NULL)
              ^
240.   				{
241.   				if (!sk_X509_push(ctx->chain,xtmp))

crypto/x509/x509_vfy.c:241:10: Condition is true
239.   			if (xtmp != NULL)
240.   				{
241.   				if (!sk_X509_push(ctx->chain,xtmp))
                ^
242.   					{
243.   					X509err(X509_F_X509_VERIFY_CERT,ERR_R_MALLOC_FAILURE);

crypto/x509/x509_vfy.c:241:10: Condition is true
239.   			if (xtmp != NULL)
240.   				{
241.   				if (!sk_X509_push(ctx->chain,xtmp))
                ^
242.   					{
243.   					X509err(X509_F_X509_VERIFY_CERT,ERR_R_MALLOC_FAILURE);

crypto/stack/stack.c:244:1: start of procedure sk_push()
  242.   	}
  243.   
  244. > int sk_push(_STACK *st, void *data)
  245.   	{
  246.   	return(sk_insert(st,data,st->num));

crypto/stack/stack.c:246:2: Skipping sk_insert(): empty list of specs
  244.   int sk_push(_STACK *st, void *data)
  245.   	{
  246.   	return(sk_insert(st,data,st->num));
          ^
  247.   	}
  248.   

crypto/stack/stack.c:247:2: return from a call to sk_push
  245.   	{
  246.   	return(sk_insert(st,data,st->num));
  247.   	}
          ^
  248.   
  249.   int sk_unshift(_STACK *st, void *data)

crypto/x509/x509_vfy.c:241:10: Taking false branch
239.   			if (xtmp != NULL)
240.   				{
241.   				if (!sk_X509_push(ctx->chain,xtmp))
                ^
242.   					{
243.   					X509err(X509_F_X509_VERIFY_CERT,ERR_R_MALLOC_FAILURE);

crypto/x509/x509_vfy.c:246:5: 
244.   					goto end;
245.   					}
246. > 				CRYPTO_add(&xtmp->references,1,CRYPTO_LOCK_X509);
247.   				(void)sk_X509_delete_ptr(sktmp,xtmp);
248.   				ctx->last_untrusted++;

crypto/lock.c:472:1: start of procedure CRYPTO_add_lock()
  470.   	}
  471.   
  472. > int CRYPTO_add_lock(int *pointer, int amount, int type, const char *file,
  473.   	     int line)
  474.   	{

crypto/lock.c:475:2: 
  473.   	     int line)
  474.   	{
  475. > 	int ret = 0;
  476.   
  477.   	if (add_lock_callback != NULL)

crypto/lock.c:477:6: Taking false branch
  475.   	int ret = 0;
  476.   
  477.   	if (add_lock_callback != NULL)
              ^
  478.   		{
  479.   #ifdef LOCK_DEBUG

crypto/lock.c:497:3: 
  495.   	else
  496.   		{
  497. > 		CRYPTO_lock(CRYPTO_LOCK|CRYPTO_WRITE,type,file,line);
  498.   
  499.   		ret= *pointer+amount;

crypto/lock.c:426:1: start of procedure CRYPTO_lock()
    424.   	}
    425.   
    426. > void CRYPTO_lock(int mode, int type, const char *file, int line)
    427.   	{
    428.   #ifdef LOCK_DEBUG

crypto/lock.c:453:6: Taking false branch
    451.   		}
    452.   #endif
    453.   	if (type < 0)
                ^
    454.   		{
    455.   		if (dynlock_lock_callback != NULL)

crypto/lock.c:468:7: Taking false branch
    466.   		}
    467.   	else
    468.   		if (locking_callback != NULL)
                 ^
    469.   			locking_callback(mode,type,file,line);
    470.   	}

crypto/lock.c:453:2: 
    451.   		}
    452.   #endif
    453. > 	if (type < 0)
    454.   		{
    455.   		if (dynlock_lock_callback != NULL)

crypto/lock.c:470:2: return from a call to CRYPTO_lock
    468.   		if (locking_callback != NULL)
    469.   			locking_callback(mode,type,file,line);
    470.   	}
            ^
    471.   
    472.   int CRYPTO_add_lock(int *pointer, int amount, int type, const char *file,

crypto/lock.c:499:3: 
  497.   		CRYPTO_lock(CRYPTO_LOCK|CRYPTO_WRITE,type,file,line);
  498.   
  499. > 		ret= *pointer+amount;
  500.   #ifdef LOCK_DEBUG
  501.   		{

crypto/lock.c:511:3: 
  509.   		}
  510.   #endif
  511. > 		*pointer=ret;
  512.   		CRYPTO_lock(CRYPTO_UNLOCK|CRYPTO_WRITE,type,file,line);
  513.   		}

crypto/lock.c:512:3: 
  510.   #endif
  511.   		*pointer=ret;
  512. > 		CRYPTO_lock(CRYPTO_UNLOCK|CRYPTO_WRITE,type,file,line);
  513.   		}
  514.   	return(ret);

crypto/lock.c:426:1: start of procedure CRYPTO_lock()
    424.   	}
    425.   
    426. > void CRYPTO_lock(int mode, int type, const char *file, int line)
    427.   	{
    428.   #ifdef LOCK_DEBUG

crypto/lock.c:453:6: Taking false branch
    451.   		}
    452.   #endif
    453.   	if (type < 0)
                ^
    454.   		{
    455.   		if (dynlock_lock_callback != NULL)

crypto/lock.c:468:7: Taking false branch
    466.   		}
    467.   	else
    468.   		if (locking_callback != NULL)
                 ^
    469.   			locking_callback(mode,type,file,line);
    470.   	}

crypto/lock.c:453:2: 
    451.   		}
    452.   #endif
    453. > 	if (type < 0)
    454.   		{
    455.   		if (dynlock_lock_callback != NULL)

crypto/lock.c:470:2: return from a call to CRYPTO_lock
    468.   		if (locking_callback != NULL)
    469.   			locking_callback(mode,type,file,line);
    470.   	}
            ^
    471.   
    472.   int CRYPTO_add_lock(int *pointer, int amount, int type, const char *file,

crypto/lock.c:514:2: 
  512.   		CRYPTO_lock(CRYPTO_UNLOCK|CRYPTO_WRITE,type,file,line);
  513.   		}
  514. > 	return(ret);
  515.   	}
  516.   

crypto/lock.c:515:2: return from a call to CRYPTO_add_lock
  513.   		}
  514.   	return(ret);
  515.   	}
          ^
  516.   
  517.   const char *CRYPTO_get_lock_name(int type)

crypto/x509/x509_vfy.c:247:11: Condition is true
245.   					}
246.   				CRYPTO_add(&xtmp->references,1,CRYPTO_LOCK_X509);
247.   				(void)sk_X509_delete_ptr(sktmp,xtmp);
                 ^
248.   				ctx->last_untrusted++;
249.   				x=xtmp;

crypto/x509/x509_vfy.c:247:11: Condition is true
245.   					}
246.   				CRYPTO_add(&xtmp->references,1,CRYPTO_LOCK_X509);
247.   				(void)sk_X509_delete_ptr(sktmp,xtmp);
                 ^
248.   				ctx->last_untrusted++;
249.   				x=xtmp;

crypto/stack/stack.c:180:1: start of procedure sk_delete_ptr()
  178.   	}
  179.   
  180. > void *sk_delete_ptr(_STACK *st, void *p)
  181.   	{
  182.   	int i;

crypto/stack/stack.c:184:7: 
  182.   	int i;
  183.   
  184. > 	for (i=0; i<st->num; i++)
  185.   		if (st->data[i] == p)
  186.   			return(sk_delete(st,i));

crypto/stack/stack.c:184:12: Loop condition is true. Entering loop body
  182.   	int i;
  183.   
  184.   	for (i=0; i<st->num; i++)
                    ^
  185.   		if (st->data[i] == p)
  186.   			return(sk_delete(st,i));

crypto/stack/stack.c:185:7: Taking false branch
  183.   
  184.   	for (i=0; i<st->num; i++)
  185.   		if (st->data[i] == p)
               ^
  186.   			return(sk_delete(st,i));
  187.   	return(NULL);

crypto/stack/stack.c:184:23: 
  182.   	int i;
  183.   
  184. > 	for (i=0; i<st->num; i++)
  185.   		if (st->data[i] == p)
  186.   			return(sk_delete(st,i));

crypto/stack/stack.c:184:12: 
  182.   	int i;
  183.   
  184. > 	for (i=0; i<st->num; i++)
  185.   		if (st->data[i] == p)
  186.   			return(sk_delete(st,i));
