crypto/x509/x509_vfy.c:427: error: NULL_DEREFERENCE
  pointer `x` last assigned on line 409 could be null and is dereferenced by call to `X509_check_ca()` at line 427, column 15.
Showing all 24 steps of the trace


crypto/x509/x509_vfy.c:371:1: start of procedure check_chain_extensions()
369.    */
370.   
371. > static int check_chain_extensions(X509_STORE_CTX *ctx)
372.   {
373.       int i, ok = 0, must_be_ca, plen = 0;

crypto/x509/x509_vfy.c:373:5: 
371.   static int check_chain_extensions(X509_STORE_CTX *ctx)
372.   {
373. >     int i, ok = 0, must_be_ca, plen = 0;
374.       X509 *x;
375.       int proxy_path_length = 0;

crypto/x509/x509_vfy.c:375:5: 
373.       int i, ok = 0, must_be_ca, plen = 0;
374.       X509 *x;
375. >     int proxy_path_length = 0;
376.       int purpose;
377.       int allow_proxy_certs;

crypto/x509/x509_vfy.c:388:5: 
386.        *     all certificates in the chain except the leaf certificate.
387.        */
388. >     must_be_ca = -1;
389.   
390.       /* CRL path validation */

crypto/x509/x509_vfy.c:391:9: Taking false branch
389.   
390.       /* CRL path validation */
391.       if (ctx->parent) {
               ^
392.           allow_proxy_certs = 0;
393.           purpose = X509_PURPOSE_CRL_SIGN;

crypto/x509/x509_vfy.c:396:17: Condition is true
394.       } else {
395.           allow_proxy_certs =
396.               ! !(ctx->param->flags & X509_V_FLAG_ALLOW_PROXY_CERTS);
                       ^
397.           /*
398.            * A hack to keep people who don't want to modify their software

crypto/x509/x509_vfy.c:396:13: 
394.       } else {
395.           allow_proxy_certs =
396. >             ! !(ctx->param->flags & X509_V_FLAG_ALLOW_PROXY_CERTS);
397.           /*
398.            * A hack to keep people who don't want to modify their software

crypto/x509/x509_vfy.c:395:9: 
393.           purpose = X509_PURPOSE_CRL_SIGN;
394.       } else {
395. >         allow_proxy_certs =
396.               ! !(ctx->param->flags & X509_V_FLAG_ALLOW_PROXY_CERTS);
397.           /*

crypto/x509/x509_vfy.c:401:13: Taking false branch
399.            * happy
400.            */
401.           if (getenv("OPENSSL_ALLOW_PROXY_CERTS"))
                   ^
402.               allow_proxy_certs = 1;
403.           purpose = ctx->param->purpose;

crypto/x509/x509_vfy.c:403:9: 
401.           if (getenv("OPENSSL_ALLOW_PROXY_CERTS"))
402.               allow_proxy_certs = 1;
403. >         purpose = ctx->param->purpose;
404.       }
405.   

crypto/x509/x509_vfy.c:407:10: 
405.   
406.       /* Check all untrusted certificates */
407. >     for (i = 0; i == 0 || i < ctx->num_untrusted; i++) {
408.           int ret;
409.           x = sk_X509_value(ctx->chain, i);

crypto/x509/x509_vfy.c:407:17: Loop condition is true. Entering loop body
405.   
406.       /* Check all untrusted certificates */
407.       for (i = 0; i == 0 || i < ctx->num_untrusted; i++) {
                       ^
408.           int ret;
409.           x = sk_X509_value(ctx->chain, i);

crypto/x509/x509_vfy.c:409:9: 
407.       for (i = 0; i == 0 || i < ctx->num_untrusted; i++) {
408.           int ret;
409. >         x = sk_X509_value(ctx->chain, i);
410.           if (!(ctx->param->flags & X509_V_FLAG_IGNORE_CRITICAL)
411.               && (x->ex_flags & EXFLAG_CRITICAL)) {

include/openssl/x509.h:170:1: start of procedure sk_X509_value()
  168.   typedef struct x509_cinf_st X509_CINF;
  169.   
  170. > DEFINE_STACK_OF(X509)
  171.   
  172.   /* This is used for a table of trust checking functions */

crypto/stack/stack.c:324:1: start of procedure sk_value()
    322.   }
    323.   
    324. > void *sk_value(const _STACK *st, int i)
    325.   {
    326.       if (!st || (i < 0) || (i >= st->num))

crypto/stack/stack.c:326:10: Taking true branch
    324.   void *sk_value(const _STACK *st, int i)
    325.   {
    326.       if (!st || (i < 0) || (i >= st->num))
                    ^
    327.           return NULL;
    328.       return st->data[i];

crypto/stack/stack.c:327:9: 
    325.   {
    326.       if (!st || (i < 0) || (i >= st->num))
    327. >         return NULL;
    328.       return st->data[i];
    329.   }

crypto/stack/stack.c:329:1: return from a call to sk_value
    327.           return NULL;
    328.       return st->data[i];
    329. > }
    330.   
    331.   void *sk_set(_STACK *st, int i, void *value)

include/openssl/x509.h:170:1: return from a call to sk_X509_value
  168.   typedef struct x509_cinf_st X509_CINF;
  169.   
  170. > DEFINE_STACK_OF(X509)
  171.   
  172.   /* This is used for a table of trust checking functions */

crypto/x509/x509_vfy.c:410:15: Taking false branch
408.           int ret;
409.           x = sk_X509_value(ctx->chain, i);
410.           if (!(ctx->param->flags & X509_V_FLAG_IGNORE_CRITICAL)
                     ^
411.               && (x->ex_flags & EXFLAG_CRITICAL)) {
412.               ctx->error = X509_V_ERR_UNHANDLED_CRITICAL_EXTENSION;

crypto/x509/x509_vfy.c:419:14: Taking false branch
417.                   goto end;
418.           }
419.           if (!allow_proxy_certs && (x->ex_flags & EXFLAG_PROXY)) {
                    ^
420.               ctx->error = X509_V_ERR_PROXY_CERTIFICATES_NOT_ALLOWED;
421.               ctx->error_depth = i;

crypto/x509/x509_vfy.c:427:9: 
425.                   goto end;
426.           }
427. >         ret = X509_check_ca(x);
428.           switch (must_be_ca) {
429.           case -1:

crypto/x509v3/v3_purp.c:576:1: start of procedure X509_check_ca()
  574.   }
  575.   
  576. > int X509_check_ca(X509 *x)
  577.   {
  578.       if (!(x->ex_flags & EXFLAG_SET)) {

crypto/x509v3/v3_purp.c:578:11: 
  576.   int X509_check_ca(X509 *x)
  577.   {
  578. >     if (!(x->ex_flags & EXFLAG_SET)) {
  579.           CRYPTO_w_lock(CRYPTO_LOCK_X509);
  580.           x509v3_cache_extensions(x);
