crypto/x509v3/v3_asid.c:333: error: NULL_DEREFERENCE
  pointer `a_min` last assigned on line 324 could be null and is dereferenced by call to `ASN1_INTEGER_cmp()` at line 333, column 13.
Showing all 62 steps of the trace


crypto/x509v3/v3_asid.c:299:1: start of procedure ASIdentifierChoice_is_canonical()
297.    * Check whether an ASIdentifierChoice is in canonical form.
298.    */
299. > static int ASIdentifierChoice_is_canonical(ASIdentifierChoice *choice)
300.   {
301.       ASN1_INTEGER *a_max_plus_one = NULL;

crypto/x509v3/v3_asid.c:301:5: 
299.   static int ASIdentifierChoice_is_canonical(ASIdentifierChoice *choice)
300.   {
301. >     ASN1_INTEGER *a_max_plus_one = NULL;
302.       BIGNUM *bn = NULL;
303.       int i, ret = 0;

crypto/x509v3/v3_asid.c:302:5: 
300.   {
301.       ASN1_INTEGER *a_max_plus_one = NULL;
302. >     BIGNUM *bn = NULL;
303.       int i, ret = 0;
304.   

crypto/x509v3/v3_asid.c:303:5: 
301.       ASN1_INTEGER *a_max_plus_one = NULL;
302.       BIGNUM *bn = NULL;
303. >     int i, ret = 0;
304.   
305.       /*

crypto/x509v3/v3_asid.c:308:9: Taking false branch
306.        * Empty element or inheritance is canonical.
307.        */
308.       if (choice == NULL || choice->type == ASIdentifierChoice_inherit)
               ^
309.           return 1;
310.   

crypto/x509v3/v3_asid.c:308:27: Taking false branch
306.        * Empty element or inheritance is canonical.
307.        */
308.       if (choice == NULL || choice->type == ASIdentifierChoice_inherit)
                                 ^
309.           return 1;
310.   

crypto/x509v3/v3_asid.c:314:9: Taking false branch
312.        * If not a list, or if empty list, it's broken.
313.        */
314.       if (choice->type != ASIdentifierChoice_asIdsOrRanges ||
               ^
315.           sk_ASIdOrRange_num(choice->u.asIdsOrRanges) == 0)
316.           return 0;

crypto/x509v3/v3_asid.c:315:9: Condition is true
313.        */
314.       if (choice->type != ASIdentifierChoice_asIdsOrRanges ||
315.           sk_ASIdOrRange_num(choice->u.asIdsOrRanges) == 0)
               ^
316.           return 0;
317.   

crypto/stack/stack.c:319:1: start of procedure sk_num()
  317.   }
  318.   
  319. > int sk_num(const _STACK *st)
  320.   {
  321.       if (st == NULL)

crypto/stack/stack.c:321:9: Taking false branch
  319.   int sk_num(const _STACK *st)
  320.   {
  321.       if (st == NULL)
                 ^
  322.           return -1;
  323.       return st->num;

crypto/stack/stack.c:323:5: 
  321.       if (st == NULL)
  322.           return -1;
  323. >     return st->num;
  324.   }
  325.   

crypto/stack/stack.c:324:1: return from a call to sk_num
  322.           return -1;
  323.       return st->num;
  324. > }
  325.   
  326.   void *sk_value(const _STACK *st, int i)

crypto/x509v3/v3_asid.c:315:9: Taking false branch
313.        */
314.       if (choice->type != ASIdentifierChoice_asIdsOrRanges ||
315.           sk_ASIdOrRange_num(choice->u.asIdsOrRanges) == 0)
               ^
316.           return 0;
317.   

crypto/x509v3/v3_asid.c:321:10: 
319.        * It's a list, check it.
320.        */
321. >     for (i = 0; i < sk_ASIdOrRange_num(choice->u.asIdsOrRanges) - 1; i++) {
322.           ASIdOrRange *a = sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i);
323.           ASIdOrRange *b = sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i + 1);

crypto/x509v3/v3_asid.c:321:21: Condition is true
319.        * It's a list, check it.
320.        */
321.       for (i = 0; i < sk_ASIdOrRange_num(choice->u.asIdsOrRanges) - 1; i++) {
                           ^
322.           ASIdOrRange *a = sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i);
323.           ASIdOrRange *b = sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i + 1);

crypto/x509v3/v3_asid.c:321:17: 
319.        * It's a list, check it.
320.        */
321. >     for (i = 0; i < sk_ASIdOrRange_num(choice->u.asIdsOrRanges) - 1; i++) {
322.           ASIdOrRange *a = sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i);
323.           ASIdOrRange *b = sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i + 1);

crypto/stack/stack.c:319:1: start of procedure sk_num()
  317.   }
  318.   
  319. > int sk_num(const _STACK *st)
  320.   {
  321.       if (st == NULL)

crypto/stack/stack.c:321:9: Taking false branch
  319.   int sk_num(const _STACK *st)
  320.   {
  321.       if (st == NULL)
                 ^
  322.           return -1;
  323.       return st->num;

crypto/stack/stack.c:323:5: 
  321.       if (st == NULL)
  322.           return -1;
  323. >     return st->num;
  324.   }
  325.   

crypto/stack/stack.c:324:1: return from a call to sk_num
  322.           return -1;
  323.       return st->num;
  324. > }
  325.   
  326.   void *sk_value(const _STACK *st, int i)

crypto/x509v3/v3_asid.c:321:17: Loop condition is true. Entering loop body
319.        * It's a list, check it.
320.        */
321.       for (i = 0; i < sk_ASIdOrRange_num(choice->u.asIdsOrRanges) - 1; i++) {
                       ^
322.           ASIdOrRange *a = sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i);
323.           ASIdOrRange *b = sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i + 1);

crypto/x509v3/v3_asid.c:322:26: Condition is true
320.        */
321.       for (i = 0; i < sk_ASIdOrRange_num(choice->u.asIdsOrRanges) - 1; i++) {
322.           ASIdOrRange *a = sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i);
                                ^
323.           ASIdOrRange *b = sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i + 1);
324.           ASN1_INTEGER *a_min = NULL, *a_max = NULL, *b_min = NULL, *b_max =

crypto/x509v3/v3_asid.c:322:9: 
320.        */
321.       for (i = 0; i < sk_ASIdOrRange_num(choice->u.asIdsOrRanges) - 1; i++) {
322. >         ASIdOrRange *a = sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i);
323.           ASIdOrRange *b = sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i + 1);
324.           ASN1_INTEGER *a_min = NULL, *a_max = NULL, *b_min = NULL, *b_max =

crypto/stack/stack.c:326:1: start of procedure sk_value()
  324.   }
  325.   
  326. > void *sk_value(const _STACK *st, int i)
  327.   {
  328.       if (!st || (i < 0) || (i >= st->num))

crypto/stack/stack.c:328:10: Taking false branch
  326.   void *sk_value(const _STACK *st, int i)
  327.   {
  328.       if (!st || (i < 0) || (i >= st->num))
                  ^
  329.           return NULL;
  330.       return st->data[i];

crypto/stack/stack.c:328:17: Taking false branch
  326.   void *sk_value(const _STACK *st, int i)
  327.   {
  328.       if (!st || (i < 0) || (i >= st->num))
                         ^
  329.           return NULL;
  330.       return st->data[i];

crypto/stack/stack.c:328:28: Taking false branch
  326.   void *sk_value(const _STACK *st, int i)
  327.   {
  328.       if (!st || (i < 0) || (i >= st->num))
                                    ^
  329.           return NULL;
  330.       return st->data[i];

crypto/stack/stack.c:330:5: 
  328.       if (!st || (i < 0) || (i >= st->num))
  329.           return NULL;
  330. >     return st->data[i];
  331.   }
  332.   

crypto/stack/stack.c:331:1: return from a call to sk_value
  329.           return NULL;
  330.       return st->data[i];
  331. > }
  332.   
  333.   void *sk_set(_STACK *st, int i, void *value)

crypto/x509v3/v3_asid.c:323:26: Condition is true
321.       for (i = 0; i < sk_ASIdOrRange_num(choice->u.asIdsOrRanges) - 1; i++) {
322.           ASIdOrRange *a = sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i);
323.           ASIdOrRange *b = sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i + 1);
                                ^
324.           ASN1_INTEGER *a_min = NULL, *a_max = NULL, *b_min = NULL, *b_max =
325.               NULL;

crypto/x509v3/v3_asid.c:323:9: 
321.       for (i = 0; i < sk_ASIdOrRange_num(choice->u.asIdsOrRanges) - 1; i++) {
322.           ASIdOrRange *a = sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i);
323. >         ASIdOrRange *b = sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i + 1);
324.           ASN1_INTEGER *a_min = NULL, *a_max = NULL, *b_min = NULL, *b_max =
325.               NULL;

crypto/stack/stack.c:326:1: start of procedure sk_value()
  324.   }
  325.   
  326. > void *sk_value(const _STACK *st, int i)
  327.   {
  328.       if (!st || (i < 0) || (i >= st->num))

crypto/stack/stack.c:328:10: Taking false branch
  326.   void *sk_value(const _STACK *st, int i)
  327.   {
  328.       if (!st || (i < 0) || (i >= st->num))
                  ^
  329.           return NULL;
  330.       return st->data[i];

crypto/stack/stack.c:328:17: Taking false branch
  326.   void *sk_value(const _STACK *st, int i)
  327.   {
  328.       if (!st || (i < 0) || (i >= st->num))
                         ^
  329.           return NULL;
  330.       return st->data[i];

crypto/stack/stack.c:328:28: Taking false branch
  326.   void *sk_value(const _STACK *st, int i)
  327.   {
  328.       if (!st || (i < 0) || (i >= st->num))
                                    ^
  329.           return NULL;
  330.       return st->data[i];

crypto/stack/stack.c:330:5: 
  328.       if (!st || (i < 0) || (i >= st->num))
  329.           return NULL;
  330. >     return st->data[i];
  331.   }
  332.   

crypto/stack/stack.c:331:1: return from a call to sk_value
  329.           return NULL;
  330.       return st->data[i];
  331. > }
  332.   
  333.   void *sk_set(_STACK *st, int i, void *value)

crypto/x509v3/v3_asid.c:324:9: 
322.           ASIdOrRange *a = sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i);
323.           ASIdOrRange *b = sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i + 1);
324. >         ASN1_INTEGER *a_min = NULL, *a_max = NULL, *b_min = NULL, *b_max =
325.               NULL;
326.   

crypto/x509v3/v3_asid.c:327:9: 
325.               NULL;
326.   
327. >         extract_min_max(a, &a_min, &a_max);
328.           extract_min_max(b, &b_min, &b_max);
329.   

crypto/x509v3/v3_asid.c:280:1: start of procedure extract_min_max()
  278.    * Extract min and max values from an ASIdOrRange.
  279.    */
  280. > static void extract_min_max(ASIdOrRange *aor,
  281.                               ASN1_INTEGER **min, ASN1_INTEGER **max)
  282.   {

crypto/x509v3/v3_asid.c:283:5: Condition is true
  281.                               ASN1_INTEGER **min, ASN1_INTEGER **max)
  282.   {
  283.       OPENSSL_assert(aor != NULL && min != NULL && max != NULL);
             ^
  284.       switch (aor->type) {
  285.       case ASIdOrRange_id:

crypto/x509v3/v3_asid.c:283:5: Condition is true
  281.                               ASN1_INTEGER **min, ASN1_INTEGER **max)
  282.   {
  283.       OPENSSL_assert(aor != NULL && min != NULL && max != NULL);
             ^
  284.       switch (aor->type) {
  285.       case ASIdOrRange_id:

crypto/x509v3/v3_asid.c:283:5: Condition is true
  281.                               ASN1_INTEGER **min, ASN1_INTEGER **max)
  282.   {
  283.       OPENSSL_assert(aor != NULL && min != NULL && max != NULL);
             ^
  284.       switch (aor->type) {
  285.       case ASIdOrRange_id:

crypto/x509v3/v3_asid.c:284:5: 
  282.   {
  283.       OPENSSL_assert(aor != NULL && min != NULL && max != NULL);
  284. >     switch (aor->type) {
  285.       case ASIdOrRange_id:
  286.           *min = aor->u.id;

crypto/x509v3/v3_asid.c:285:5: Switch condition is false. Skipping switch case
  283.       OPENSSL_assert(aor != NULL && min != NULL && max != NULL);
  284.       switch (aor->type) {
  285.       case ASIdOrRange_id:
             ^
  286.           *min = aor->u.id;
  287.           *max = aor->u.id;

crypto/x509v3/v3_asid.c:289:5: Switch condition is false. Skipping switch case
  287.           *max = aor->u.id;
  288.           return;
  289.       case ASIdOrRange_range:
             ^
  290.           *min = aor->u.range->min;
  291.           *max = aor->u.range->max;

crypto/x509v3/v3_asid.c:294:1: return from a call to extract_min_max
  292.           return;
  293.       }
  294. > }
  295.   
  296.   /*

crypto/x509v3/v3_asid.c:328:9: 
326.   
327.           extract_min_max(a, &a_min, &a_max);
328. >         extract_min_max(b, &b_min, &b_max);
329.   
330.           /*

crypto/x509v3/v3_asid.c:280:1: start of procedure extract_min_max()
  278.    * Extract min and max values from an ASIdOrRange.
  279.    */
  280. > static void extract_min_max(ASIdOrRange *aor,
  281.                               ASN1_INTEGER **min, ASN1_INTEGER **max)
  282.   {

crypto/x509v3/v3_asid.c:283:5: Condition is true
  281.                               ASN1_INTEGER **min, ASN1_INTEGER **max)
  282.   {
  283.       OPENSSL_assert(aor != NULL && min != NULL && max != NULL);
             ^
  284.       switch (aor->type) {
  285.       case ASIdOrRange_id:

crypto/x509v3/v3_asid.c:283:5: Condition is true
  281.                               ASN1_INTEGER **min, ASN1_INTEGER **max)
  282.   {
  283.       OPENSSL_assert(aor != NULL && min != NULL && max != NULL);
             ^
  284.       switch (aor->type) {
  285.       case ASIdOrRange_id:

crypto/x509v3/v3_asid.c:283:5: Condition is true
  281.                               ASN1_INTEGER **min, ASN1_INTEGER **max)
  282.   {
  283.       OPENSSL_assert(aor != NULL && min != NULL && max != NULL);
             ^
  284.       switch (aor->type) {
  285.       case ASIdOrRange_id:

crypto/x509v3/v3_asid.c:284:5: 
  282.   {
  283.       OPENSSL_assert(aor != NULL && min != NULL && max != NULL);
  284. >     switch (aor->type) {
  285.       case ASIdOrRange_id:
  286.           *min = aor->u.id;

crypto/x509v3/v3_asid.c:285:5: Switch condition is false. Skipping switch case
  283.       OPENSSL_assert(aor != NULL && min != NULL && max != NULL);
  284.       switch (aor->type) {
  285.       case ASIdOrRange_id:
             ^
  286.           *min = aor->u.id;
  287.           *max = aor->u.id;

crypto/x509v3/v3_asid.c:289:5: Switch condition is true. Entering switch case
  287.           *max = aor->u.id;
  288.           return;
  289.       case ASIdOrRange_range:
             ^
  290.           *min = aor->u.range->min;
  291.           *max = aor->u.range->max;

crypto/x509v3/v3_asid.c:290:9: 
  288.           return;
  289.       case ASIdOrRange_range:
  290. >         *min = aor->u.range->min;
  291.           *max = aor->u.range->max;
  292.           return;

crypto/x509v3/v3_asid.c:291:9: 
  289.       case ASIdOrRange_range:
  290.           *min = aor->u.range->min;
  291. >         *max = aor->u.range->max;
  292.           return;
  293.       }

crypto/x509v3/v3_asid.c:292:9: 
  290.           *min = aor->u.range->min;
  291.           *max = aor->u.range->max;
  292. >         return;
  293.       }
  294.   }

crypto/x509v3/v3_asid.c:294:1: return from a call to extract_min_max
  292.           return;
  293.       }
  294. > }
  295.   
  296.   /*

crypto/x509v3/v3_asid.c:333:13: 
331.            * Punt misordered list, overlapping start, or inverted range.
332.            */
333. >         if (ASN1_INTEGER_cmp(a_min, b_min) >= 0 ||
334.               ASN1_INTEGER_cmp(a_min, a_max) > 0 ||
335.               ASN1_INTEGER_cmp(b_min, b_max) > 0)

crypto/asn1/a_int.c:69:1: start of procedure ASN1_INTEGER_cmp()
  67.   }
  68.   
  69. > int ASN1_INTEGER_cmp(const ASN1_INTEGER *x, const ASN1_INTEGER *y)
  70.   {
  71.       int neg, ret;

crypto/asn1/a_int.c:73:5: 
  71.       int neg, ret;
  72.       /* Compare signs */
  73. >     neg = x->type & V_ASN1_NEG;
  74.       if (neg != (y->type & V_ASN1_NEG)) {
  75.           if (neg)
