crypto/x509/x509_vpm.c:633: error: NULL_DEREFERENCE
  pointer `ptmp` last assigned on line 632 could be null and is dereferenced by call to `X509_VERIFY_PARAM_free()` at line 633, column 4.
Showing all 26 steps of the trace


crypto/x509/x509_vpm.c:617:1: start of procedure X509_VERIFY_PARAM_add0_table()
615.   	}
616.   
617. > int X509_VERIFY_PARAM_add0_table(X509_VERIFY_PARAM *param)
618.   	{
619.   	int idx;

crypto/x509/x509_vpm.c:621:7: Taking false branch
619.   	int idx;
620.   	X509_VERIFY_PARAM *ptmp;
621.   	if (!param_table)
             ^
622.   		{
623.   		param_table = sk_X509_VERIFY_PARAM_new(param_cmp);

crypto/x509/x509_vpm.c:629:9: Condition is true
627.   	else
628.   		{
629.   		idx = sk_X509_VERIFY_PARAM_find(param_table, param);
               ^
630.   		if (idx != -1)
631.   			{

crypto/x509/x509_vpm.c:629:9: Condition is true
627.   	else
628.   		{
629.   		idx = sk_X509_VERIFY_PARAM_find(param_table, param);
               ^
630.   		if (idx != -1)
631.   			{

crypto/x509/x509_vpm.c:629:3: 
627.   	else
628.   		{
629. > 		idx = sk_X509_VERIFY_PARAM_find(param_table, param);
630.   		if (idx != -1)
631.   			{

crypto/stack/stack.c:272:1: start of procedure sk_find()
  270.   	}
  271.   
  272. > int sk_find(_STACK *st, void *data)
  273.   	{
  274.   	return internal_find(st, data, OBJ_BSEARCH_FIRST_VALUE_ON_MATCH);

crypto/stack/stack.c:274:2: 
  272.   int sk_find(_STACK *st, void *data)
  273.   	{
  274. > 	return internal_find(st, data, OBJ_BSEARCH_FIRST_VALUE_ON_MATCH);
  275.   	}
  276.   int sk_find_ex(_STACK *st, void *data)

crypto/stack/stack.c:250:1: start of procedure internal_find()
    248.   	}
    249.   
    250. > static int internal_find(_STACK *st, void *data, int ret_val_options)
    251.   	{
    252.   	const void * const *r;

crypto/stack/stack.c:255:5: Taking false branch
    253.   	int i;
    254.   
    255.   	if(st == NULL) return -1;
               ^
    256.   
    257.   	if (st->comp == NULL)

crypto/stack/stack.c:257:6: Taking true branch
    255.   	if(st == NULL) return -1;
    256.   
    257.   	if (st->comp == NULL)
                ^
    258.   		{
    259.   		for (i=0; i<st->num; i++)

crypto/stack/stack.c:259:8: 
    257.   	if (st->comp == NULL)
    258.   		{
    259. > 		for (i=0; i<st->num; i++)
    260.   			if (st->data[i] == data)
    261.   				return(i);

crypto/stack/stack.c:259:13: Loop condition is true. Entering loop body
    257.   	if (st->comp == NULL)
    258.   		{
    259.   		for (i=0; i<st->num; i++)
                       ^
    260.   			if (st->data[i] == data)
    261.   				return(i);

crypto/stack/stack.c:260:8: Taking true branch
    258.   		{
    259.   		for (i=0; i<st->num; i++)
    260.   			if (st->data[i] == data)
                  ^
    261.   				return(i);
    262.   		return(-1);

crypto/stack/stack.c:261:5: 
    259.   		for (i=0; i<st->num; i++)
    260.   			if (st->data[i] == data)
    261. > 				return(i);
    262.   		return(-1);
    263.   		}

crypto/stack/stack.c:270:2: return from a call to internal_find
    268.   	if (r == NULL) return(-1);
    269.   	return (int)((char **)r-st->data);
    270.   	}
            ^
    271.   
    272.   int sk_find(_STACK *st, void *data)

crypto/stack/stack.c:275:2: return from a call to sk_find
  273.   	{
  274.   	return internal_find(st, data, OBJ_BSEARCH_FIRST_VALUE_ON_MATCH);
  275.   	}
          ^
  276.   int sk_find_ex(_STACK *st, void *data)
  277.   	{

crypto/x509/x509_vpm.c:630:7: Taking true branch
628.   		{
629.   		idx = sk_X509_VERIFY_PARAM_find(param_table, param);
630.   		if (idx != -1)
             ^
631.   			{
632.   			ptmp = sk_X509_VERIFY_PARAM_value(param_table, idx);

crypto/x509/x509_vpm.c:632:11: Condition is true
630.   		if (idx != -1)
631.   			{
632.   			ptmp = sk_X509_VERIFY_PARAM_value(param_table, idx);
                 ^
633.   			X509_VERIFY_PARAM_free(ptmp);
634.   			(void)sk_X509_VERIFY_PARAM_delete(param_table, idx);

crypto/x509/x509_vpm.c:632:4: 
630.   		if (idx != -1)
631.   			{
632. > 			ptmp = sk_X509_VERIFY_PARAM_value(param_table, idx);
633.   			X509_VERIFY_PARAM_free(ptmp);
634.   			(void)sk_X509_VERIFY_PARAM_delete(param_table, idx);

crypto/stack/stack.c:337:1: start of procedure sk_value()
  335.   }
  336.   
  337. > void *sk_value(const _STACK *st, int i)
  338.   {
  339.   	if(!st || (i < 0) || (i >= st->num)) return NULL;

crypto/stack/stack.c:339:6: Taking false branch
  337.   void *sk_value(const _STACK *st, int i)
  338.   {
  339.   	if(!st || (i < 0) || (i >= st->num)) return NULL;
              ^
  340.   	return st->data[i];
  341.   }

crypto/stack/stack.c:339:13: Taking false branch
  337.   void *sk_value(const _STACK *st, int i)
  338.   {
  339.   	if(!st || (i < 0) || (i >= st->num)) return NULL;
                     ^
  340.   	return st->data[i];
  341.   }

crypto/stack/stack.c:339:24: Taking true branch
  337.   void *sk_value(const _STACK *st, int i)
  338.   {
  339.   	if(!st || (i < 0) || (i >= st->num)) return NULL;
                                ^
  340.   	return st->data[i];
  341.   }

crypto/stack/stack.c:339:39: 
  337.   void *sk_value(const _STACK *st, int i)
  338.   {
  339. > 	if(!st || (i < 0) || (i >= st->num)) return NULL;
  340.   	return st->data[i];
  341.   }

crypto/stack/stack.c:341:1: return from a call to sk_value
  339.   	if(!st || (i < 0) || (i >= st->num)) return NULL;
  340.   	return st->data[i];
  341. > }
  342.   
  343.   void *sk_set(_STACK *st, int i, void *value)

crypto/x509/x509_vpm.c:633:4: 
631.   			{
632.   			ptmp = sk_X509_VERIFY_PARAM_value(param_table, idx);
633. > 			X509_VERIFY_PARAM_free(ptmp);
634.   			(void)sk_X509_VERIFY_PARAM_delete(param_table, idx);
635.   			}
