crypto/x509v3/v3_asid.c:335: error: NULL_DEREFERENCE
  pointer `b_min` last assigned on line 326 could be null and is dereferenced by call to `ASN1_INTEGER_cmp()` at line 335, column 13.
Showing all 63 steps of the trace


crypto/x509v3/v3_asid.c:301:1: start of procedure ASIdentifierChoice_is_canonical()
299.    * Check whether an ASIdentifierChoice is in canonical form.
300.    */
301. > static int ASIdentifierChoice_is_canonical(ASIdentifierChoice *choice)
302.   {
303.       ASN1_INTEGER *a_max_plus_one = NULL;

crypto/x509v3/v3_asid.c:303:5: 
301.   static int ASIdentifierChoice_is_canonical(ASIdentifierChoice *choice)
302.   {
303. >     ASN1_INTEGER *a_max_plus_one = NULL;
304.       BIGNUM *bn = NULL;
305.       int i, ret = 0;

crypto/x509v3/v3_asid.c:304:5: 
302.   {
303.       ASN1_INTEGER *a_max_plus_one = NULL;
304. >     BIGNUM *bn = NULL;
305.       int i, ret = 0;
306.   

crypto/x509v3/v3_asid.c:305:5: 
303.       ASN1_INTEGER *a_max_plus_one = NULL;
304.       BIGNUM *bn = NULL;
305. >     int i, ret = 0;
306.   
307.       /*

crypto/x509v3/v3_asid.c:310:9: Taking false branch
308.        * Empty element or inheritance is canonical.
309.        */
310.       if (choice == NULL || choice->type == ASIdentifierChoice_inherit)
               ^
311.           return 1;
312.   

crypto/x509v3/v3_asid.c:310:27: Taking false branch
308.        * Empty element or inheritance is canonical.
309.        */
310.       if (choice == NULL || choice->type == ASIdentifierChoice_inherit)
                                 ^
311.           return 1;
312.   

crypto/x509v3/v3_asid.c:316:9: Taking false branch
314.        * If not a list, or if empty list, it's broken.
315.        */
316.       if (choice->type != ASIdentifierChoice_asIdsOrRanges ||
               ^
317.           sk_ASIdOrRange_num(choice->u.asIdsOrRanges) == 0)
318.           return 0;

crypto/x509v3/v3_asid.c:317:9: Condition is true
315.        */
316.       if (choice->type != ASIdentifierChoice_asIdsOrRanges ||
317.           sk_ASIdOrRange_num(choice->u.asIdsOrRanges) == 0)
               ^
318.           return 0;
319.   

crypto/stack/stack.c:317:1: start of procedure sk_num()
  315.   }
  316.   
  317. > int sk_num(const _STACK *st)
  318.   {
  319.       if (st == NULL)

crypto/stack/stack.c:319:9: Taking false branch
  317.   int sk_num(const _STACK *st)
  318.   {
  319.       if (st == NULL)
                 ^
  320.           return -1;
  321.       return st->num;

crypto/stack/stack.c:321:5: 
  319.       if (st == NULL)
  320.           return -1;
  321. >     return st->num;
  322.   }
  323.   

crypto/stack/stack.c:322:1: return from a call to sk_num
  320.           return -1;
  321.       return st->num;
  322. > }
  323.   
  324.   void *sk_value(const _STACK *st, int i)

crypto/x509v3/v3_asid.c:317:9: Taking false branch
315.        */
316.       if (choice->type != ASIdentifierChoice_asIdsOrRanges ||
317.           sk_ASIdOrRange_num(choice->u.asIdsOrRanges) == 0)
               ^
318.           return 0;
319.   

crypto/x509v3/v3_asid.c:323:10: 
321.        * It's a list, check it.
322.        */
323. >     for (i = 0; i < sk_ASIdOrRange_num(choice->u.asIdsOrRanges) - 1; i++) {
324.           ASIdOrRange *a = sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i);
325.           ASIdOrRange *b = sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i + 1);

crypto/x509v3/v3_asid.c:323:21: Condition is true
321.        * It's a list, check it.
322.        */
323.       for (i = 0; i < sk_ASIdOrRange_num(choice->u.asIdsOrRanges) - 1; i++) {
                           ^
324.           ASIdOrRange *a = sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i);
325.           ASIdOrRange *b = sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i + 1);

crypto/x509v3/v3_asid.c:323:17: 
321.        * It's a list, check it.
322.        */
323. >     for (i = 0; i < sk_ASIdOrRange_num(choice->u.asIdsOrRanges) - 1; i++) {
324.           ASIdOrRange *a = sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i);
325.           ASIdOrRange *b = sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i + 1);

crypto/stack/stack.c:317:1: start of procedure sk_num()
  315.   }
  316.   
  317. > int sk_num(const _STACK *st)
  318.   {
  319.       if (st == NULL)

crypto/stack/stack.c:319:9: Taking false branch
  317.   int sk_num(const _STACK *st)
  318.   {
  319.       if (st == NULL)
                 ^
  320.           return -1;
  321.       return st->num;

crypto/stack/stack.c:321:5: 
  319.       if (st == NULL)
  320.           return -1;
  321. >     return st->num;
  322.   }
  323.   

crypto/stack/stack.c:322:1: return from a call to sk_num
  320.           return -1;
  321.       return st->num;
  322. > }
  323.   
  324.   void *sk_value(const _STACK *st, int i)

crypto/x509v3/v3_asid.c:323:17: Loop condition is true. Entering loop body
321.        * It's a list, check it.
322.        */
323.       for (i = 0; i < sk_ASIdOrRange_num(choice->u.asIdsOrRanges) - 1; i++) {
                       ^
324.           ASIdOrRange *a = sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i);
325.           ASIdOrRange *b = sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i + 1);

crypto/x509v3/v3_asid.c:324:26: Condition is true
322.        */
323.       for (i = 0; i < sk_ASIdOrRange_num(choice->u.asIdsOrRanges) - 1; i++) {
324.           ASIdOrRange *a = sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i);
                                ^
325.           ASIdOrRange *b = sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i + 1);
326.           ASN1_INTEGER *a_min = NULL, *a_max = NULL, *b_min = NULL, *b_max =

crypto/x509v3/v3_asid.c:324:9: 
322.        */
323.       for (i = 0; i < sk_ASIdOrRange_num(choice->u.asIdsOrRanges) - 1; i++) {
324. >         ASIdOrRange *a = sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i);
325.           ASIdOrRange *b = sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i + 1);
326.           ASN1_INTEGER *a_min = NULL, *a_max = NULL, *b_min = NULL, *b_max =

crypto/stack/stack.c:324:1: start of procedure sk_value()
  322.   }
  323.   
  324. > void *sk_value(const _STACK *st, int i)
  325.   {
  326.       if (!st || (i < 0) || (i >= st->num))

crypto/stack/stack.c:326:10: Taking false branch
  324.   void *sk_value(const _STACK *st, int i)
  325.   {
  326.       if (!st || (i < 0) || (i >= st->num))
                  ^
  327.           return NULL;
  328.       return st->data[i];

crypto/stack/stack.c:326:17: Taking false branch
  324.   void *sk_value(const _STACK *st, int i)
  325.   {
  326.       if (!st || (i < 0) || (i >= st->num))
                         ^
  327.           return NULL;
  328.       return st->data[i];

crypto/stack/stack.c:326:28: Taking false branch
  324.   void *sk_value(const _STACK *st, int i)
  325.   {
  326.       if (!st || (i < 0) || (i >= st->num))
                                    ^
  327.           return NULL;
  328.       return st->data[i];

crypto/stack/stack.c:328:5: 
  326.       if (!st || (i < 0) || (i >= st->num))
  327.           return NULL;
  328. >     return st->data[i];
  329.   }
  330.   

crypto/stack/stack.c:329:1: return from a call to sk_value
  327.           return NULL;
  328.       return st->data[i];
  329. > }
  330.   
  331.   void *sk_set(_STACK *st, int i, void *value)

crypto/x509v3/v3_asid.c:325:26: Condition is true
323.       for (i = 0; i < sk_ASIdOrRange_num(choice->u.asIdsOrRanges) - 1; i++) {
324.           ASIdOrRange *a = sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i);
325.           ASIdOrRange *b = sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i + 1);
                                ^
326.           ASN1_INTEGER *a_min = NULL, *a_max = NULL, *b_min = NULL, *b_max =
327.               NULL;

crypto/x509v3/v3_asid.c:325:9: 
323.       for (i = 0; i < sk_ASIdOrRange_num(choice->u.asIdsOrRanges) - 1; i++) {
324.           ASIdOrRange *a = sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i);
325. >         ASIdOrRange *b = sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i + 1);
326.           ASN1_INTEGER *a_min = NULL, *a_max = NULL, *b_min = NULL, *b_max =
327.               NULL;

crypto/stack/stack.c:324:1: start of procedure sk_value()
  322.   }
  323.   
  324. > void *sk_value(const _STACK *st, int i)
  325.   {
  326.       if (!st || (i < 0) || (i >= st->num))

crypto/stack/stack.c:326:10: Taking false branch
  324.   void *sk_value(const _STACK *st, int i)
  325.   {
  326.       if (!st || (i < 0) || (i >= st->num))
                  ^
  327.           return NULL;
  328.       return st->data[i];

crypto/stack/stack.c:326:17: Taking false branch
  324.   void *sk_value(const _STACK *st, int i)
  325.   {
  326.       if (!st || (i < 0) || (i >= st->num))
                         ^
  327.           return NULL;
  328.       return st->data[i];

crypto/stack/stack.c:326:28: Taking false branch
  324.   void *sk_value(const _STACK *st, int i)
  325.   {
  326.       if (!st || (i < 0) || (i >= st->num))
                                    ^
  327.           return NULL;
  328.       return st->data[i];

crypto/stack/stack.c:328:5: 
  326.       if (!st || (i < 0) || (i >= st->num))
  327.           return NULL;
  328. >     return st->data[i];
  329.   }
  330.   

crypto/stack/stack.c:329:1: return from a call to sk_value
  327.           return NULL;
  328.       return st->data[i];
  329. > }
  330.   
  331.   void *sk_set(_STACK *st, int i, void *value)

crypto/x509v3/v3_asid.c:326:9: 
324.           ASIdOrRange *a = sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i);
325.           ASIdOrRange *b = sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i + 1);
326. >         ASN1_INTEGER *a_min = NULL, *a_max = NULL, *b_min = NULL, *b_max =
327.               NULL;
328.   

crypto/x509v3/v3_asid.c:329:9: 
327.               NULL;
328.   
329. >         extract_min_max(a, &a_min, &a_max);
330.           extract_min_max(b, &b_min, &b_max);
331.   

crypto/x509v3/v3_asid.c:282:1: start of procedure extract_min_max()
  280.    * Extract min and max values from an ASIdOrRange.
  281.    */
  282. > static void extract_min_max(ASIdOrRange *aor,
  283.                               ASN1_INTEGER **min, ASN1_INTEGER **max)
  284.   {

crypto/x509v3/v3_asid.c:285:5: Condition is true
  283.                               ASN1_INTEGER **min, ASN1_INTEGER **max)
  284.   {
  285.       OPENSSL_assert(aor != NULL && min != NULL && max != NULL);
             ^
  286.       switch (aor->type) {
  287.       case ASIdOrRange_id:

crypto/x509v3/v3_asid.c:285:5: Condition is true
  283.                               ASN1_INTEGER **min, ASN1_INTEGER **max)
  284.   {
  285.       OPENSSL_assert(aor != NULL && min != NULL && max != NULL);
             ^
  286.       switch (aor->type) {
  287.       case ASIdOrRange_id:

crypto/x509v3/v3_asid.c:285:5: Condition is true
  283.                               ASN1_INTEGER **min, ASN1_INTEGER **max)
  284.   {
  285.       OPENSSL_assert(aor != NULL && min != NULL && max != NULL);
             ^
  286.       switch (aor->type) {
  287.       case ASIdOrRange_id:

crypto/x509v3/v3_asid.c:286:5: 
  284.   {
  285.       OPENSSL_assert(aor != NULL && min != NULL && max != NULL);
  286. >     switch (aor->type) {
  287.       case ASIdOrRange_id:
  288.           *min = aor->u.id;

crypto/x509v3/v3_asid.c:287:5: Switch condition is false. Skipping switch case
  285.       OPENSSL_assert(aor != NULL && min != NULL && max != NULL);
  286.       switch (aor->type) {
  287.       case ASIdOrRange_id:
             ^
  288.           *min = aor->u.id;
  289.           *max = aor->u.id;

crypto/x509v3/v3_asid.c:291:5: Switch condition is true. Entering switch case
  289.           *max = aor->u.id;
  290.           return;
  291.       case ASIdOrRange_range:
             ^
  292.           *min = aor->u.range->min;
  293.           *max = aor->u.range->max;

crypto/x509v3/v3_asid.c:292:9: 
  290.           return;
  291.       case ASIdOrRange_range:
  292. >         *min = aor->u.range->min;
  293.           *max = aor->u.range->max;
  294.           return;

crypto/x509v3/v3_asid.c:293:9: 
  291.       case ASIdOrRange_range:
  292.           *min = aor->u.range->min;
  293. >         *max = aor->u.range->max;
  294.           return;
  295.       }

crypto/x509v3/v3_asid.c:294:9: 
  292.           *min = aor->u.range->min;
  293.           *max = aor->u.range->max;
  294. >         return;
  295.       }
  296.   }

crypto/x509v3/v3_asid.c:296:1: return from a call to extract_min_max
  294.           return;
  295.       }
  296. > }
  297.   
  298.   /*

crypto/x509v3/v3_asid.c:330:9: 
328.   
329.           extract_min_max(a, &a_min, &a_max);
330. >         extract_min_max(b, &b_min, &b_max);
331.   
332.           /*

crypto/x509v3/v3_asid.c:282:1: start of procedure extract_min_max()
  280.    * Extract min and max values from an ASIdOrRange.
  281.    */
  282. > static void extract_min_max(ASIdOrRange *aor,
  283.                               ASN1_INTEGER **min, ASN1_INTEGER **max)
  284.   {

crypto/x509v3/v3_asid.c:285:5: Condition is true
  283.                               ASN1_INTEGER **min, ASN1_INTEGER **max)
  284.   {
  285.       OPENSSL_assert(aor != NULL && min != NULL && max != NULL);
             ^
  286.       switch (aor->type) {
  287.       case ASIdOrRange_id:

crypto/x509v3/v3_asid.c:285:5: Condition is true
  283.                               ASN1_INTEGER **min, ASN1_INTEGER **max)
  284.   {
  285.       OPENSSL_assert(aor != NULL && min != NULL && max != NULL);
             ^
  286.       switch (aor->type) {
  287.       case ASIdOrRange_id:

crypto/x509v3/v3_asid.c:285:5: Condition is true
  283.                               ASN1_INTEGER **min, ASN1_INTEGER **max)
  284.   {
  285.       OPENSSL_assert(aor != NULL && min != NULL && max != NULL);
             ^
  286.       switch (aor->type) {
  287.       case ASIdOrRange_id:

crypto/x509v3/v3_asid.c:286:5: 
  284.   {
  285.       OPENSSL_assert(aor != NULL && min != NULL && max != NULL);
  286. >     switch (aor->type) {
  287.       case ASIdOrRange_id:
  288.           *min = aor->u.id;

crypto/x509v3/v3_asid.c:287:5: Switch condition is false. Skipping switch case
  285.       OPENSSL_assert(aor != NULL && min != NULL && max != NULL);
  286.       switch (aor->type) {
  287.       case ASIdOrRange_id:
             ^
  288.           *min = aor->u.id;
  289.           *max = aor->u.id;

crypto/x509v3/v3_asid.c:291:5: Switch condition is false. Skipping switch case
  289.           *max = aor->u.id;
  290.           return;
  291.       case ASIdOrRange_range:
             ^
  292.           *min = aor->u.range->min;
  293.           *max = aor->u.range->max;

crypto/x509v3/v3_asid.c:296:1: return from a call to extract_min_max
  294.           return;
  295.       }
  296. > }
  297.   
  298.   /*

crypto/x509v3/v3_asid.c:335:13: 
333.            * Punt misordered list, overlapping start, or inverted range.
334.            */
335. >         if (ASN1_INTEGER_cmp(a_min, b_min) >= 0 ||
336.               ASN1_INTEGER_cmp(a_min, a_max) > 0 ||
337.               ASN1_INTEGER_cmp(b_min, b_max) > 0)

crypto/asn1/a_int.c:72:1: start of procedure ASN1_INTEGER_cmp()
  70.   }
  71.   
  72. > int ASN1_INTEGER_cmp(const ASN1_INTEGER *x, const ASN1_INTEGER *y)
  73.   {
  74.       int neg, ret;

crypto/asn1/a_int.c:76:5: 
  74.       int neg, ret;
  75.       /* Compare signs */
  76. >     neg = x->type & V_ASN1_NEG;
  77.       if (neg != (y->type & V_ASN1_NEG)) {
  78.           if (neg)

crypto/asn1/a_int.c:77:9: 
  75.       /* Compare signs */
  76.       neg = x->type & V_ASN1_NEG;
  77. >     if (neg != (y->type & V_ASN1_NEG)) {
  78.           if (neg)
  79.               return -1;
