crypto/store/str_lib.c:1298: error: NULL_DEREFERENCE
  pointer `null` is dereferenced by call to `STORE_ATTR_INFO_modify_sha1str()` at line 1298, column 4.
Showing all 82 steps of the trace


crypto/store/str_lib.c:1281:1: start of procedure STORE_ATTR_INFO_attr_free()
1279.   	return (STORE_ATTR_INFO *)OPENSSL_malloc(sizeof(STORE_ATTR_INFO));
1280.   	}
1281. > static void STORE_ATTR_INFO_attr_free(STORE_ATTR_INFO *attrs,
1282.   	STORE_ATTR_TYPES code)
1283.   	{

crypto/store/str_lib.c:1284:6: Taking true branch
1282.   	STORE_ATTR_TYPES code)
1283.   	{
1284.   	if (ATTR_IS_SET(attrs,code))
             ^
1285.   		{
1286.   		switch(code)

crypto/store/str_lib.c:1284:6: Taking true branch
1282.   	STORE_ATTR_TYPES code)
1283.   	{
1284.   	if (ATTR_IS_SET(attrs,code))
             ^
1285.   		{
1286.   		switch(code)

crypto/store/str_lib.c:1284:6: Taking true branch
1282.   	STORE_ATTR_TYPES code)
1283.   	{
1284.   	if (ATTR_IS_SET(attrs,code))
             ^
1285.   		{
1286.   		switch(code)

crypto/store/str_lib.c:1286:3: 
1284.   	if (ATTR_IS_SET(attrs,code))
1285.   		{
1286. > 		switch(code)
1287.   			{
1288.   		case STORE_ATTR_FRIENDLYNAME:

crypto/store/str_lib.c:1288:3: Switch condition is false. Skipping switch case
1286.   		switch(code)
1287.   			{
1288.   		case STORE_ATTR_FRIENDLYNAME:
          ^
1289.   		case STORE_ATTR_EMAIL:
1290.   		case STORE_ATTR_FILENAME:

crypto/store/str_lib.c:1289:3: Switch condition is false. Skipping switch case
1287.   			{
1288.   		case STORE_ATTR_FRIENDLYNAME:
1289.   		case STORE_ATTR_EMAIL:
          ^
1290.   		case STORE_ATTR_FILENAME:
1291.   			STORE_ATTR_INFO_modify_cstr(attrs, code, NULL, 0);

crypto/store/str_lib.c:1290:3: Switch condition is false. Skipping switch case
1288.   		case STORE_ATTR_FRIENDLYNAME:
1289.   		case STORE_ATTR_EMAIL:
1290.   		case STORE_ATTR_FILENAME:
          ^
1291.   			STORE_ATTR_INFO_modify_cstr(attrs, code, NULL, 0);
1292.   			break;

crypto/store/str_lib.c:1293:3: Switch condition is true. Entering switch case
1291.   			STORE_ATTR_INFO_modify_cstr(attrs, code, NULL, 0);
1292.   			break;
1293.   		case STORE_ATTR_KEYID:
          ^
1294.   		case STORE_ATTR_ISSUERKEYID:
1295.   		case STORE_ATTR_SUBJECTKEYID:

crypto/store/str_lib.c:1298:4: 
1296.   		case STORE_ATTR_ISSUERSERIALHASH:
1297.   		case STORE_ATTR_CERTHASH:
1298. > 			STORE_ATTR_INFO_modify_sha1str(attrs, code, NULL, 0);
1299.   			break;
1300.   		case STORE_ATTR_ISSUER:

crypto/store/str_lib.c:1479:1: start of procedure STORE_ATTR_INFO_modify_sha1str()
  1477.   	return STORE_ATTR_INFO_set_cstr(attrs, code, cstr, cstr_size);
  1478.   	}
  1479. > int STORE_ATTR_INFO_modify_sha1str(STORE_ATTR_INFO *attrs, STORE_ATTR_TYPES code,
  1480.   	unsigned char *sha1str, size_t sha1str_size)
  1481.   	{

crypto/store/str_lib.c:1482:7: Taking false branch
  1480.   	unsigned char *sha1str, size_t sha1str_size)
  1481.   	{
  1482.   	if (!attrs)
                ^
  1483.   		{
  1484.   		STOREerr(STORE_F_STORE_ATTR_INFO_MODIFY_SHA1STR,

crypto/store/str_lib.c:1488:6: Taking true branch
  1486.   		return 0;
  1487.   		}
  1488.   	if (ATTR_IS_SET(attrs,code))
               ^
  1489.   		{
  1490.   		OPENSSL_free(attrs->values[code].sha1string);

crypto/store/str_lib.c:1488:6: Taking false branch
  1486.   		return 0;
  1487.   		}
  1488.   	if (ATTR_IS_SET(attrs,code))
               ^
  1489.   		{
  1490.   		OPENSSL_free(attrs->values[code].sha1string);

crypto/store/str_lib.c:1494:2: 
  1492.   		CLEAR_ATTRBIT(attrs, code);
  1493.   		}
  1494. > 	return STORE_ATTR_INFO_set_sha1str(attrs, code, sha1str, sha1str_size);
  1495.   	}
  1496.   int STORE_ATTR_INFO_modify_dn(STORE_ATTR_INFO *attrs, STORE_ATTR_TYPES code,

crypto/store/str_lib.c:1400:1: start of procedure STORE_ATTR_INFO_set_sha1str()
    1398.   	return 0;
    1399.   	}
    1400. > int STORE_ATTR_INFO_set_sha1str(STORE_ATTR_INFO *attrs, STORE_ATTR_TYPES code,
    1401.   	unsigned char *sha1str, size_t sha1str_size)
    1402.   	{

crypto/store/str_lib.c:1403:7: Taking false branch
    1401.   	unsigned char *sha1str, size_t sha1str_size)
    1402.   	{
    1403.   	if (!attrs)
                  ^
    1404.   		{
    1405.   		STOREerr(STORE_F_STORE_ATTR_INFO_SET_SHA1STR,

crypto/store/str_lib.c:1409:7: Taking false branch
    1407.   		return 0;
    1408.   		}
    1409.   	if (!ATTR_IS_SET(attrs,code))
                  ^
    1410.   		{
    1411.   		if ((attrs->values[code].sha1string =

crypto/store/str_lib.c:1409:7: Taking true branch
    1407.   		return 0;
    1408.   		}
    1409.   	if (!ATTR_IS_SET(attrs,code))
                  ^
    1410.   		{
    1411.   		if ((attrs->values[code].sha1string =

crypto/store/str_lib.c:1411:8: 
    1409.   	if (!ATTR_IS_SET(attrs,code))
    1410.   		{
    1411. > 		if ((attrs->values[code].sha1string =
    1412.   			    (unsigned char *)BUF_memdup(sha1str,
    1413.   				    sha1str_size)))

crypto/buffer/buffer.c:187:1: start of procedure BUF_memdup()
      185.   	}
      186.   
      187. > void *BUF_memdup(const void *data, size_t siz)
      188.   	{
      189.   	void *ret;

crypto/buffer/buffer.c:191:6: Taking false branch
      189.   	void *ret;
      190.   
      191.   	if (data == NULL) return(NULL);
                  ^
      192.   
      193.   	ret=OPENSSL_malloc(siz);

crypto/buffer/buffer.c:193:2: 
      191.   	if (data == NULL) return(NULL);
      192.   
      193. > 	ret=OPENSSL_malloc(siz);
      194.   	if (ret == NULL) 
      195.   		{

crypto/mem.c:291:1: start of procedure CRYPTO_malloc()
        289.   	}
        290.   
        291. > void *CRYPTO_malloc(int num, const char *file, int line)
        292.   	{
        293.   	void *ret = NULL;

crypto/mem.c:293:2: 
        291.   void *CRYPTO_malloc(int num, const char *file, int line)
        292.   	{
        293. > 	void *ret = NULL;
        294.   	extern unsigned char cleanse_ctr;
        295.   

crypto/mem.c:296:6: Taking false branch
        294.   	extern unsigned char cleanse_ctr;
        295.   
        296.   	if (num <= 0) return NULL;
                    ^
        297.   
        298.   	allow_customize = 0;

crypto/mem.c:298:2: 
        296.   	if (num <= 0) return NULL;
        297.   
        298. > 	allow_customize = 0;
        299.   	if (malloc_debug_func != NULL)
        300.   		{

crypto/mem.c:299:6: Taking false branch
        297.   
        298.   	allow_customize = 0;
        299.   	if (malloc_debug_func != NULL)
                    ^
        300.   		{
        301.   		allow_customize_debug = 0;

crypto/mem.c:304:2: Skipping __function_pointer__(): unresolved function pointer
        302.   		malloc_debug_func(NULL, num, file, line, 0);
        303.   		}
        304.   	ret = malloc_ex_func(num,file,line);
                ^
        305.   #ifdef LEVITTE_DEBUG_MEM
        306.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);

crypto/mem.c:308:6: Taking false branch
        306.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);
        307.   #endif
        308.   	if (malloc_debug_func != NULL)
                    ^
        309.   		malloc_debug_func(ret, num, file, line, 1);
        310.   

crypto/mem.c:314:12: Taking false branch
        312.            * sanitisation function can't be optimised out. NB: We only do
        313.            * this for >2Kb so the overhead doesn't bother us. */
        314.           if(ret && (num > 2048))
                          ^
        315.                   ((unsigned char *)ret)[0] = cleanse_ctr;
        316.   

crypto/mem.c:317:2: 
        315.                   ((unsigned char *)ret)[0] = cleanse_ctr;
        316.   
        317. > 	return ret;
        318.   	}
        319.   

crypto/mem.c:318:2: return from a call to CRYPTO_malloc
        316.   
        317.   	return ret;
        318.   	}
                ^
        319.   
        320.   void *CRYPTO_realloc(void *str, int num, const char *file, int line)

crypto/buffer/buffer.c:194:6: Taking true branch
      192.   
      193.   	ret=OPENSSL_malloc(siz);
      194.   	if (ret == NULL) 
                  ^
      195.   		{
      196.   		BUFerr(BUF_F_BUF_MEMDUP,ERR_R_MALLOC_FAILURE);

crypto/buffer/buffer.c:196:3: 
      194.   	if (ret == NULL) 
      195.   		{
      196. > 		BUFerr(BUF_F_BUF_MEMDUP,ERR_R_MALLOC_FAILURE);
      197.   		return(NULL);
      198.   		}

crypto/err/err.c:664:1: start of procedure ERR_put_error()
        662.   /********************************************************/
        663.   
        664. > void ERR_put_error(int lib, int func, int reason, const char *file,
        665.   	     int line)
        666.   	{

crypto/err/err.c:688:2: Skipping ERR_get_state(): empty list of specs
        686.   	}
        687.   #endif
        688.   	es=ERR_get_state();
                ^
        689.   
        690.   	es->top=(es->top+1)%ERR_NUM_ERRORS;

crypto/err/err.c:690:2: 
        688.   	es=ERR_get_state();
        689.   
        690. > 	es->top=(es->top+1)%ERR_NUM_ERRORS;
        691.   	if (es->top == es->bottom)
        692.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;

crypto/err/err.c:691:6: Taking false branch
        689.   
        690.   	es->top=(es->top+1)%ERR_NUM_ERRORS;
        691.   	if (es->top == es->bottom)
                    ^
        692.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
        693.   	es->err_flags[es->top]=0;

crypto/err/err.c:693:2: 
        691.   	if (es->top == es->bottom)
        692.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
        693. > 	es->err_flags[es->top]=0;
        694.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
        695.   	es->err_file[es->top]=file;

crypto/err/err.c:694:2: 
        692.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
        693.   	es->err_flags[es->top]=0;
        694. > 	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
        695.   	es->err_file[es->top]=file;
        696.   	es->err_line[es->top]=line;

crypto/err/err.c:695:2: 
        693.   	es->err_flags[es->top]=0;
        694.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
        695. > 	es->err_file[es->top]=file;
        696.   	es->err_line[es->top]=line;
        697.   	err_clear_data(es,es->top);

crypto/err/err.c:696:2: 
        694.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
        695.   	es->err_file[es->top]=file;
        696. > 	es->err_line[es->top]=line;
        697.   	err_clear_data(es,es->top);
        698.   	}

crypto/err/err.c:697:2: Taking true branch
        695.   	es->err_file[es->top]=file;
        696.   	es->err_line[es->top]=line;
        697.   	err_clear_data(es,es->top);
                ^
        698.   	}
        699.   

crypto/err/err.c:697:2: Taking true branch
        695.   	es->err_file[es->top]=file;
        696.   	es->err_line[es->top]=line;
        697.   	err_clear_data(es,es->top);
                ^
        698.   	}
        699.   

crypto/mem.c:371:1: start of procedure CRYPTO_free()
          369.   	}
          370.   
          371. > void CRYPTO_free(void *str)
          372.   	{
          373.   	if (free_debug_func != NULL)

crypto/mem.c:373:6: Taking true branch
          371.   void CRYPTO_free(void *str)
          372.   	{
          373.   	if (free_debug_func != NULL)
                      ^
          374.   		free_debug_func(str, 0);
          375.   #ifdef LEVITTE_DEBUG_MEM

crypto/mem.c:374:3: Skipping __function_pointer__(): unresolved function pointer
          372.   	{
          373.   	if (free_debug_func != NULL)
          374.   		free_debug_func(str, 0);
                   ^
          375.   #ifdef LEVITTE_DEBUG_MEM
          376.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         < 0x%p\n", str);

crypto/mem.c:378:2: Skipping __function_pointer__(): unresolved function pointer
          376.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         < 0x%p\n", str);
          377.   #endif
          378.   	free_func(str);
                  ^
          379.   	if (free_debug_func != NULL)
          380.   		free_debug_func(NULL, 1);

crypto/mem.c:379:6: Taking true branch
          377.   #endif
          378.   	free_func(str);
          379.   	if (free_debug_func != NULL)
                      ^
          380.   		free_debug_func(NULL, 1);
          381.   	}

crypto/mem.c:380:3: Skipping __function_pointer__(): unresolved function pointer
          378.   	free_func(str);
          379.   	if (free_debug_func != NULL)
          380.   		free_debug_func(NULL, 1);
                   ^
          381.   	}
          382.   

crypto/mem.c:379:2: 
          377.   #endif
          378.   	free_func(str);
          379. > 	if (free_debug_func != NULL)
          380.   		free_debug_func(NULL, 1);
          381.   	}

crypto/mem.c:381:2: return from a call to CRYPTO_free
          379.   	if (free_debug_func != NULL)
          380.   		free_debug_func(NULL, 1);
          381.   	}
                  ^
          382.   
          383.   void *CRYPTO_remalloc(void *a, int num, const char *file, int line)

crypto/err/err.c:697:2: Loop condition is false. Leaving loop
        695.   	es->err_file[es->top]=file;
        696.   	es->err_line[es->top]=line;
        697.   	err_clear_data(es,es->top);
                ^
        698.   	}
        699.   

crypto/err/err.c:698:2: return from a call to ERR_put_error
        696.   	es->err_line[es->top]=line;
        697.   	err_clear_data(es,es->top);
        698.   	}
                ^
        699.   
        700.   void ERR_clear_error(void)

crypto/buffer/buffer.c:197:3: 
      195.   		{
      196.   		BUFerr(BUF_F_BUF_MEMDUP,ERR_R_MALLOC_FAILURE);
      197. > 		return(NULL);
      198.   		}
      199.   	return memcpy(ret, data, siz);

crypto/buffer/buffer.c:200:2: return from a call to BUF_memdup
      198.   		}
      199.   	return memcpy(ret, data, siz);
      200.   	}	
              ^
      201.   
      202.   size_t BUF_strlcpy(char *dst, const char *src, size_t size)

crypto/store/str_lib.c:1411:8: Taking false branch
    1409.   	if (!ATTR_IS_SET(attrs,code))
    1410.   		{
    1411.   		if ((attrs->values[code].sha1string =
                   ^
    1412.   			    (unsigned char *)BUF_memdup(sha1str,
    1413.   				    sha1str_size)))

crypto/store/str_lib.c:1415:3: 
    1413.   				    sha1str_size)))
    1414.   			return 1;
    1415. > 		STOREerr(STORE_F_STORE_ATTR_INFO_SET_CSTR,
    1416.   			ERR_R_MALLOC_FAILURE);
    1417.   		return 0;

crypto/err/err.c:664:1: start of procedure ERR_put_error()
      662.   /********************************************************/
      663.   
      664. > void ERR_put_error(int lib, int func, int reason, const char *file,
      665.   	     int line)
      666.   	{

crypto/err/err.c:688:2: Skipping ERR_get_state(): empty list of specs
      686.   	}
      687.   #endif
      688.   	es=ERR_get_state();
              ^
      689.   
      690.   	es->top=(es->top+1)%ERR_NUM_ERRORS;

crypto/err/err.c:690:2: 
      688.   	es=ERR_get_state();
      689.   
      690. > 	es->top=(es->top+1)%ERR_NUM_ERRORS;
      691.   	if (es->top == es->bottom)
      692.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;

crypto/err/err.c:691:6: Taking false branch
      689.   
      690.   	es->top=(es->top+1)%ERR_NUM_ERRORS;
      691.   	if (es->top == es->bottom)
                  ^
      692.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
      693.   	es->err_flags[es->top]=0;

crypto/err/err.c:693:2: 
      691.   	if (es->top == es->bottom)
      692.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
      693. > 	es->err_flags[es->top]=0;
      694.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
      695.   	es->err_file[es->top]=file;

crypto/err/err.c:694:2: 
      692.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
      693.   	es->err_flags[es->top]=0;
      694. > 	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
      695.   	es->err_file[es->top]=file;
      696.   	es->err_line[es->top]=line;

crypto/err/err.c:695:2: 
      693.   	es->err_flags[es->top]=0;
      694.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
      695. > 	es->err_file[es->top]=file;
      696.   	es->err_line[es->top]=line;
      697.   	err_clear_data(es,es->top);

crypto/err/err.c:696:2: 
      694.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
      695.   	es->err_file[es->top]=file;
      696. > 	es->err_line[es->top]=line;
      697.   	err_clear_data(es,es->top);
      698.   	}

crypto/err/err.c:697:2: Taking true branch
      695.   	es->err_file[es->top]=file;
      696.   	es->err_line[es->top]=line;
      697.   	err_clear_data(es,es->top);
              ^
      698.   	}
      699.   

crypto/err/err.c:697:2: Taking true branch
      695.   	es->err_file[es->top]=file;
      696.   	es->err_line[es->top]=line;
      697.   	err_clear_data(es,es->top);
              ^
      698.   	}
      699.   

crypto/mem.c:371:1: start of procedure CRYPTO_free()
        369.   	}
        370.   
        371. > void CRYPTO_free(void *str)
        372.   	{
        373.   	if (free_debug_func != NULL)

crypto/mem.c:373:6: Taking true branch
        371.   void CRYPTO_free(void *str)
        372.   	{
        373.   	if (free_debug_func != NULL)
                    ^
        374.   		free_debug_func(str, 0);
        375.   #ifdef LEVITTE_DEBUG_MEM

crypto/mem.c:374:3: Skipping __function_pointer__(): unresolved function pointer
        372.   	{
        373.   	if (free_debug_func != NULL)
        374.   		free_debug_func(str, 0);
                 ^
        375.   #ifdef LEVITTE_DEBUG_MEM
        376.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         < 0x%p\n", str);

crypto/mem.c:378:2: Skipping __function_pointer__(): unresolved function pointer
        376.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         < 0x%p\n", str);
        377.   #endif
        378.   	free_func(str);
                ^
        379.   	if (free_debug_func != NULL)
        380.   		free_debug_func(NULL, 1);

crypto/mem.c:379:6: Taking true branch
        377.   #endif
        378.   	free_func(str);
        379.   	if (free_debug_func != NULL)
                    ^
        380.   		free_debug_func(NULL, 1);
        381.   	}

crypto/mem.c:380:3: Skipping __function_pointer__(): unresolved function pointer
        378.   	free_func(str);
        379.   	if (free_debug_func != NULL)
        380.   		free_debug_func(NULL, 1);
                 ^
        381.   	}
        382.   

crypto/mem.c:379:2: 
        377.   #endif
        378.   	free_func(str);
        379. > 	if (free_debug_func != NULL)
        380.   		free_debug_func(NULL, 1);
        381.   	}

crypto/mem.c:381:2: return from a call to CRYPTO_free
        379.   	if (free_debug_func != NULL)
        380.   		free_debug_func(NULL, 1);
        381.   	}
                ^
        382.   
        383.   void *CRYPTO_remalloc(void *a, int num, const char *file, int line)

crypto/err/err.c:697:2: Loop condition is false. Leaving loop
      695.   	es->err_file[es->top]=file;
      696.   	es->err_line[es->top]=line;
      697.   	err_clear_data(es,es->top);
              ^
      698.   	}
      699.   

crypto/err/err.c:698:2: return from a call to ERR_put_error
      696.   	es->err_line[es->top]=line;
      697.   	err_clear_data(es,es->top);
      698.   	}
              ^
      699.   
      700.   void ERR_clear_error(void)

crypto/store/str_lib.c:1417:3: 
    1415.   		STOREerr(STORE_F_STORE_ATTR_INFO_SET_CSTR,
    1416.   			ERR_R_MALLOC_FAILURE);
    1417. > 		return 0;
    1418.   		}
    1419.   	STOREerr(STORE_F_STORE_ATTR_INFO_SET_SHA1STR, STORE_R_ALREADY_HAS_A_VALUE);

crypto/store/str_lib.c:1421:2: return from a call to STORE_ATTR_INFO_set_sha1str
    1419.   	STOREerr(STORE_F_STORE_ATTR_INFO_SET_SHA1STR, STORE_R_ALREADY_HAS_A_VALUE);
    1420.   	return 0;
    1421.   	}
             ^
    1422.   int STORE_ATTR_INFO_set_dn(STORE_ATTR_INFO *attrs, STORE_ATTR_TYPES code,
    1423.   	X509_NAME *dn)

crypto/store/str_lib.c:1495:2: return from a call to STORE_ATTR_INFO_modify_sha1str
  1493.   		}
  1494.   	return STORE_ATTR_INFO_set_sha1str(attrs, code, sha1str, sha1str_size);
  1495.   	}
           ^
  1496.   int STORE_ATTR_INFO_modify_dn(STORE_ATTR_INFO *attrs, STORE_ATTR_TYPES code,
  1497.   	X509_NAME *dn)
