crypto/ts/ts_rsp_verify.c:420: error: NULL_DEREFERENCE
  pointer `signer` last assigned on line 384 could be null and is dereferenced by call to `ts_check_signer_name()` at line 420, column 13.
Showing all 30 steps of the trace


crypto/ts/ts_rsp_verify.c:381:1: start of procedure int_ts_RESP_verify_token()
379.    *      - Check if the TSA name is the expected TSA.
380.    */
381. > static int int_ts_RESP_verify_token(TS_VERIFY_CTX *ctx,
382.                                       PKCS7 *token, TS_TST_INFO *tst_info)
383.   {

crypto/ts/ts_rsp_verify.c:384:5: 
382.                                       PKCS7 *token, TS_TST_INFO *tst_info)
383.   {
384. >     X509 *signer = NULL;
385.       GENERAL_NAME *tsa_name = tst_info->tsa;
386.       X509_ALGOR *md_alg = NULL;

crypto/ts/ts_rsp_verify.c:385:5: 
383.   {
384.       X509 *signer = NULL;
385. >     GENERAL_NAME *tsa_name = tst_info->tsa;
386.       X509_ALGOR *md_alg = NULL;
387.       unsigned char *imprint = NULL;

crypto/ts/ts_rsp_verify.c:386:5: 
384.       X509 *signer = NULL;
385.       GENERAL_NAME *tsa_name = tst_info->tsa;
386. >     X509_ALGOR *md_alg = NULL;
387.       unsigned char *imprint = NULL;
388.       unsigned imprint_len = 0;

crypto/ts/ts_rsp_verify.c:387:5: 
385.       GENERAL_NAME *tsa_name = tst_info->tsa;
386.       X509_ALGOR *md_alg = NULL;
387. >     unsigned char *imprint = NULL;
388.       unsigned imprint_len = 0;
389.       int ret = 0;

crypto/ts/ts_rsp_verify.c:388:5: 
386.       X509_ALGOR *md_alg = NULL;
387.       unsigned char *imprint = NULL;
388. >     unsigned imprint_len = 0;
389.       int ret = 0;
390.   

crypto/ts/ts_rsp_verify.c:389:5: 
387.       unsigned char *imprint = NULL;
388.       unsigned imprint_len = 0;
389. >     int ret = 0;
390.   
391.       if ((ctx->flags & TS_VFY_SIGNATURE)

crypto/ts/ts_rsp_verify.c:391:10: Taking false branch
389.       int ret = 0;
390.   
391.       if ((ctx->flags & TS_VFY_SIGNATURE)
                ^
392.           && !TS_RESP_verify_signature(token, ctx->certs, ctx->store, &signer))
393.           goto err;

crypto/ts/ts_rsp_verify.c:394:10: Taking false branch
392.           && !TS_RESP_verify_signature(token, ctx->certs, ctx->store, &signer))
393.           goto err;
394.       if ((ctx->flags & TS_VFY_VERSION)
                ^
395.           && TS_TST_INFO_get_version(tst_info) != 1) {
396.           TSerr(TS_F_INT_TS_RESP_VERIFY_TOKEN, TS_R_UNSUPPORTED_VERSION);

crypto/ts/ts_rsp_verify.c:399:10: Taking true branch
397.           goto err;
398.       }
399.       if ((ctx->flags & TS_VFY_POLICY)
                ^
400.           && !ts_check_policy(ctx->policy, tst_info))
401.           goto err;

crypto/ts/ts_rsp_verify.c:400:13: 
398.       }
399.       if ((ctx->flags & TS_VFY_POLICY)
400. >         && !ts_check_policy(ctx->policy, tst_info))
401.           goto err;
402.       if ((ctx->flags & TS_VFY_IMPRINT)

crypto/ts/ts_rsp_verify.c:513:1: start of procedure ts_check_policy()
  511.   }
  512.   
  513. > static int ts_check_policy(ASN1_OBJECT *req_oid, TS_TST_INFO *tst_info)
  514.   {
  515.       ASN1_OBJECT *resp_oid = tst_info->policy_id;

crypto/ts/ts_rsp_verify.c:515:5: 
  513.   static int ts_check_policy(ASN1_OBJECT *req_oid, TS_TST_INFO *tst_info)
  514.   {
  515. >     ASN1_OBJECT *resp_oid = tst_info->policy_id;
  516.   
  517.       if (OBJ_cmp(req_oid, resp_oid) != 0) {

crypto/ts/ts_rsp_verify.c:517:9: 
  515.       ASN1_OBJECT *resp_oid = tst_info->policy_id;
  516.   
  517. >     if (OBJ_cmp(req_oid, resp_oid) != 0) {
  518.           TSerr(TS_F_TS_CHECK_POLICY, TS_R_POLICY_MISMATCH);
  519.           return 0;

crypto/objects/obj_lib.c:124:1: start of procedure OBJ_cmp()
    122.   }
    123.   
    124. > int OBJ_cmp(const ASN1_OBJECT *a, const ASN1_OBJECT *b)
    125.   {
    126.       int ret;

crypto/objects/obj_lib.c:128:5: 
    126.       int ret;
    127.   
    128. >     ret = (a->length - b->length);
    129.       if (ret)
    130.           return (ret);

crypto/objects/obj_lib.c:129:9: Taking true branch
    127.   
    128.       ret = (a->length - b->length);
    129.       if (ret)
                   ^
    130.           return (ret);
    131.       return (memcmp(a->data, b->data, a->length));

crypto/objects/obj_lib.c:130:9: 
    128.       ret = (a->length - b->length);
    129.       if (ret)
    130. >         return (ret);
    131.       return (memcmp(a->data, b->data, a->length));
    132.   }

crypto/objects/obj_lib.c:132:1: return from a call to OBJ_cmp
    130.           return (ret);
    131.       return (memcmp(a->data, b->data, a->length));
    132. > }

crypto/ts/ts_rsp_verify.c:517:9: Taking false branch
  515.       ASN1_OBJECT *resp_oid = tst_info->policy_id;
  516.   
  517.       if (OBJ_cmp(req_oid, resp_oid) != 0) {
                 ^
  518.           TSerr(TS_F_TS_CHECK_POLICY, TS_R_POLICY_MISMATCH);
  519.           return 0;

crypto/ts/ts_rsp_verify.c:522:5: 
  520.       }
  521.   
  522. >     return 1;
  523.   }
  524.   

crypto/ts/ts_rsp_verify.c:523:1: return from a call to ts_check_policy
  521.   
  522.       return 1;
  523. > }
  524.   
  525.   static int ts_compute_imprint(BIO *data, TS_TST_INFO *tst_info,

crypto/ts/ts_rsp_verify.c:400:13: Taking false branch
398.       }
399.       if ((ctx->flags & TS_VFY_POLICY)
400.           && !ts_check_policy(ctx->policy, tst_info))
                   ^
401.           goto err;
402.       if ((ctx->flags & TS_VFY_IMPRINT)

crypto/ts/ts_rsp_verify.c:402:10: Taking true branch
400.           && !ts_check_policy(ctx->policy, tst_info))
401.           goto err;
402.       if ((ctx->flags & TS_VFY_IMPRINT)
                ^
403.           && !ts_check_imprints(ctx->md_alg, ctx->imprint, ctx->imprint_len,
404.                                 tst_info))

crypto/ts/ts_rsp_verify.c:403:13: Taking false branch
401.           goto err;
402.       if ((ctx->flags & TS_VFY_IMPRINT)
403.           && !ts_check_imprints(ctx->md_alg, ctx->imprint, ctx->imprint_len,
                   ^
404.                                 tst_info))
405.           goto err;

crypto/ts/ts_rsp_verify.c:406:10: Taking false branch
404.                                 tst_info))
405.           goto err;
406.       if ((ctx->flags & TS_VFY_DATA)
                ^
407.           && (!ts_compute_imprint(ctx->data, tst_info,
408.                                   &md_alg, &imprint, &imprint_len)

crypto/ts/ts_rsp_verify.c:411:10: Taking false branch
409.               || !ts_check_imprints(md_alg, imprint, imprint_len, tst_info)))
410.           goto err;
411.       if ((ctx->flags & TS_VFY_NONCE)
                ^
412.           && !ts_check_nonces(ctx->nonce, tst_info))
413.           goto err;

crypto/ts/ts_rsp_verify.c:414:10: Taking false branch
412.           && !ts_check_nonces(ctx->nonce, tst_info))
413.           goto err;
414.       if ((ctx->flags & TS_VFY_SIGNER)
                ^
415.           && tsa_name && !ts_check_signer_name(tsa_name, signer)) {
416.           TSerr(TS_F_INT_TS_RESP_VERIFY_TOKEN, TS_R_TSA_NAME_MISMATCH);

crypto/ts/ts_rsp_verify.c:419:10: Taking true branch
417.           goto err;
418.       }
419.       if ((ctx->flags & TS_VFY_TSA_NAME)
                ^
420.           && !ts_check_signer_name(ctx->tsa_name, signer)) {
421.           TSerr(TS_F_INT_TS_RESP_VERIFY_TOKEN, TS_R_TSA_UNTRUSTED);

crypto/ts/ts_rsp_verify.c:420:13: 
418.       }
419.       if ((ctx->flags & TS_VFY_TSA_NAME)
420. >         && !ts_check_signer_name(ctx->tsa_name, signer)) {
421.           TSerr(TS_F_INT_TS_RESP_VERIFY_TOKEN, TS_R_TSA_UNTRUSTED);
422.           goto err;
