crypto/x509/x509_vfy.c:167: error: NULL_DEREFERENCE
  pointer `sktmp` last assigned on line 106 could be null and is dereferenced by call to `sk_delete_ptr()` at line 167, column 5.
Showing all 65 steps of the trace


crypto/x509/x509_vfy.c:97:1: start of procedure X509_verify_cert()
95.   #endif
96.   
97. > int X509_verify_cert(X509_STORE_CTX *ctx)
98.   	{
99.   	X509 *x,*xtmp,*chain_ss=NULL;

crypto/x509/x509_vfy.c:99:2: 
97.   int X509_verify_cert(X509_STORE_CTX *ctx)
98.   	{
99. > 	X509 *x,*xtmp,*chain_ss=NULL;
100.   	X509_NAME *xn;
101.   	int bad_chain = 0;

crypto/x509/x509_vfy.c:101:2: 
99.   	X509 *x,*xtmp,*chain_ss=NULL;
100.   	X509_NAME *xn;
101. > 	int bad_chain = 0;
102.   	X509_VERIFY_PARAM *param = ctx->param;
103.   	int depth,i,ok=0;

crypto/x509/x509_vfy.c:102:2: 
100.   	X509_NAME *xn;
101.   	int bad_chain = 0;
102. > 	X509_VERIFY_PARAM *param = ctx->param;
103.   	int depth,i,ok=0;
104.   	int num;

crypto/x509/x509_vfy.c:103:2: 
101.   	int bad_chain = 0;
102.   	X509_VERIFY_PARAM *param = ctx->param;
103. > 	int depth,i,ok=0;
104.   	int num;
105.   	int (*cb)(int xok,X509_STORE_CTX *xctx);

crypto/x509/x509_vfy.c:106:2: 
104.   	int num;
105.   	int (*cb)(int xok,X509_STORE_CTX *xctx);
106. > 	STACK_OF(X509) *sktmp=NULL;
107.   	if (ctx->cert == NULL)
108.   		{

crypto/x509/x509_vfy.c:107:6: Taking false branch
105.   	int (*cb)(int xok,X509_STORE_CTX *xctx);
106.   	STACK_OF(X509) *sktmp=NULL;
107.   	if (ctx->cert == NULL)
            ^
108.   		{
109.   		X509err(X509_F_X509_VERIFY_CERT,X509_R_NO_CERT_SET_FOR_US_TO_VERIFY);

crypto/x509/x509_vfy.c:113:2: 
111.   		}
112.   
113. > 	cb=ctx->verify_cb;
114.   
115.   	/* first we make sure the chain we are going to build is

crypto/x509/x509_vfy.c:117:6: Taking false branch
115.   	/* first we make sure the chain we are going to build is
116.   	 * present and that the first entry is in place */
117.   	if (ctx->chain == NULL)
            ^
118.   		{
119.   		if (	((ctx->chain=sk_X509_new_null()) == NULL) ||

crypto/x509/x509_vfy.c:130:6: Taking false branch
128.   
129.   	/* We use a temporary STACK so we can chop and hack at it */
130.   	if (ctx->untrusted != NULL
            ^
131.   	    && (sktmp=sk_X509_dup(ctx->untrusted)) == NULL)
132.   		{

crypto/x509/x509_vfy.c:137:2: 
135.   		}
136.   
137. > 	num=sk_X509_num(ctx->chain);
138.   	x=sk_X509_value(ctx->chain,num-1);
139.   	depth=param->depth;

crypto/stack/stack.c:301:1: start of procedure sk_num()
  299.   	}
  300.   
  301. > int sk_num(const STACK *st)
  302.   {
  303.   	if(st == NULL) return -1;

crypto/stack/stack.c:303:5: Taking false branch
  301.   int sk_num(const STACK *st)
  302.   {
  303.   	if(st == NULL) return -1;
             ^
  304.   	return st->num;
  305.   }

crypto/stack/stack.c:304:2: 
  302.   {
  303.   	if(st == NULL) return -1;
  304. > 	return st->num;
  305.   }
  306.   

crypto/stack/stack.c:305:1: return from a call to sk_num
  303.   	if(st == NULL) return -1;
  304.   	return st->num;
  305. > }
  306.   
  307.   char *sk_value(const STACK *st, int i)

crypto/x509/x509_vfy.c:138:2: 
136.   
137.   	num=sk_X509_num(ctx->chain);
138. > 	x=sk_X509_value(ctx->chain,num-1);
139.   	depth=param->depth;
140.   

crypto/stack/stack.c:307:1: start of procedure sk_value()
  305.   }
  306.   
  307. > char *sk_value(const STACK *st, int i)
  308.   {
  309.   	if(!st || (i < 0) || (i >= st->num)) return NULL;

crypto/stack/stack.c:309:6: Taking false branch
  307.   char *sk_value(const STACK *st, int i)
  308.   {
  309.   	if(!st || (i < 0) || (i >= st->num)) return NULL;
              ^
  310.   	return st->data[i];
  311.   }

crypto/stack/stack.c:309:13: Taking false branch
  307.   char *sk_value(const STACK *st, int i)
  308.   {
  309.   	if(!st || (i < 0) || (i >= st->num)) return NULL;
                     ^
  310.   	return st->data[i];
  311.   }

crypto/stack/stack.c:309:24: Taking false branch
  307.   char *sk_value(const STACK *st, int i)
  308.   {
  309.   	if(!st || (i < 0) || (i >= st->num)) return NULL;
                                ^
  310.   	return st->data[i];
  311.   }

crypto/stack/stack.c:310:2: 
  308.   {
  309.   	if(!st || (i < 0) || (i >= st->num)) return NULL;
  310. > 	return st->data[i];
  311.   }
  312.   

crypto/stack/stack.c:311:1: return from a call to sk_value
  309.   	if(!st || (i < 0) || (i >= st->num)) return NULL;
  310.   	return st->data[i];
  311. > }
  312.   
  313.   char *sk_set(STACK *st, int i, char *value)

crypto/x509/x509_vfy.c:139:2: 
137.   	num=sk_X509_num(ctx->chain);
138.   	x=sk_X509_value(ctx->chain,num-1);
139. > 	depth=param->depth;
140.   
141.   

crypto/x509/x509_vfy.c:177:3: Loop condition is true. Entering loop body
175.   			}
176.   		break;
177.   		}
         ^
178.   
179.   	/* at this point, chain should contain a list of untrusted

crypto/x509/x509_vfy.c:145:7: Taking false branch
143.   		{
144.   		/* If we have enough, we break */
145.   		if (depth < num) break; /* FIXME: If this happens, we should take
             ^
146.   		                         * note of it and, if appropriate, use the
147.   		                         * X509_V_ERR_CERT_CHAIN_TOO_LONG error

crypto/x509/x509_vfy.c:152:3: 
150.   
151.   		/* If we are self signed, we break */
152. > 		xn=X509_get_issuer_name(x);
153.   		if (ctx->check_issued(ctx, x,x)) break;
154.   

crypto/x509/x509_cmp.c:119:1: start of procedure X509_get_issuer_name()
  117.   	}
  118.   
  119. > X509_NAME *X509_get_issuer_name(X509 *a)
  120.   	{
  121.   	return(a->cert_info->issuer);

crypto/x509/x509_cmp.c:121:2: 
  119.   X509_NAME *X509_get_issuer_name(X509 *a)
  120.   	{
  121. > 	return(a->cert_info->issuer);
  122.   	}
  123.   

crypto/x509/x509_cmp.c:122:2: return from a call to X509_get_issuer_name
  120.   	{
  121.   	return(a->cert_info->issuer);
  122.   	}
          ^
  123.   
  124.   unsigned long X509_issuer_name_hash(X509 *x)

crypto/x509/x509_vfy.c:153:7: Taking false branch
151.   		/* If we are self signed, we break */
152.   		xn=X509_get_issuer_name(x);
153.   		if (ctx->check_issued(ctx, x,x)) break;
             ^
154.   
155.   		/* If we were passed a cert chain, use it first */

crypto/x509/x509_vfy.c:156:7: Taking true branch
154.   
155.   		/* If we were passed a cert chain, use it first */
156.   		if (ctx->untrusted != NULL)
             ^
157.   			{
158.   			xtmp=find_issuer(ctx, sktmp,x);

crypto/x509/x509_vfy.c:158:4: Skipping find_issuer(): empty list of specs
156.   		if (ctx->untrusted != NULL)
157.   			{
158.   			xtmp=find_issuer(ctx, sktmp,x);
          ^
159.   			if (xtmp != NULL)
160.   				{

crypto/x509/x509_vfy.c:159:8: Taking true branch
157.   			{
158.   			xtmp=find_issuer(ctx, sktmp,x);
159.   			if (xtmp != NULL)
              ^
160.   				{
161.   				if (!sk_X509_push(ctx->chain,xtmp))

crypto/x509/x509_vfy.c:161:10: 
159.   			if (xtmp != NULL)
160.   				{
161. > 				if (!sk_X509_push(ctx->chain,xtmp))
162.   					{
163.   					X509err(X509_F_X509_VERIFY_CERT,ERR_R_MALLOC_FAILURE);

crypto/stack/stack.c:251:1: start of procedure sk_push()
  249.   	}
  250.   
  251. > int sk_push(STACK *st, char *data)
  252.   	{
  253.   	return(sk_insert(st,data,st->num));

crypto/stack/stack.c:253:2: Skipping sk_insert(): empty list of specs
  251.   int sk_push(STACK *st, char *data)
  252.   	{
  253.   	return(sk_insert(st,data,st->num));
          ^
  254.   	}
  255.   

crypto/stack/stack.c:254:2: return from a call to sk_push
  252.   	{
  253.   	return(sk_insert(st,data,st->num));
  254.   	}
          ^
  255.   
  256.   int sk_unshift(STACK *st, char *data)

crypto/x509/x509_vfy.c:161:10: Taking false branch
159.   			if (xtmp != NULL)
160.   				{
161.   				if (!sk_X509_push(ctx->chain,xtmp))
                ^
162.   					{
163.   					X509err(X509_F_X509_VERIFY_CERT,ERR_R_MALLOC_FAILURE);

crypto/x509/x509_vfy.c:166:5: 
164.   					goto end;
165.   					}
166. > 				CRYPTO_add(&xtmp->references,1,CRYPTO_LOCK_X509);
167.   				sk_X509_delete_ptr(sktmp,xtmp);
168.   				ctx->last_untrusted++;

crypto/cryptlib.c:517:1: start of procedure CRYPTO_add_lock()
  515.   	}
  516.   
  517. > int CRYPTO_add_lock(int *pointer, int amount, int type, const char *file,
  518.   	     int line)
  519.   	{

crypto/cryptlib.c:520:2: 
  518.   	     int line)
  519.   	{
  520. > 	int ret = 0;
  521.   
  522.   	if (add_lock_callback != NULL)

crypto/cryptlib.c:522:6: Taking false branch
  520.   	int ret = 0;
  521.   
  522.   	if (add_lock_callback != NULL)
              ^
  523.   		{
  524.   #ifdef LOCK_DEBUG

crypto/cryptlib.c:539:3: 
  537.   	else
  538.   		{
  539. > 		CRYPTO_lock(CRYPTO_LOCK|CRYPTO_WRITE,type,file,line);
  540.   
  541.   		ret= *pointer+amount;

crypto/cryptlib.c:473:1: start of procedure CRYPTO_lock()
    471.   	}
    472.   
    473. > void CRYPTO_lock(int mode, int type, const char *file, int line)
    474.   	{
    475.   #ifdef LOCK_DEBUG

crypto/cryptlib.c:498:6: Taking false branch
    496.   		}
    497.   #endif
    498.   	if (type < 0)
                ^
    499.   		{
    500.   		if (dynlock_lock_callback != NULL)

crypto/cryptlib.c:513:7: Taking false branch
    511.   		}
    512.   	else
    513.   		if (locking_callback != NULL)
                 ^
    514.   			locking_callback(mode,type,file,line);
    515.   	}

crypto/cryptlib.c:498:2: 
    496.   		}
    497.   #endif
    498. > 	if (type < 0)
    499.   		{
    500.   		if (dynlock_lock_callback != NULL)

crypto/cryptlib.c:515:2: return from a call to CRYPTO_lock
    513.   		if (locking_callback != NULL)
    514.   			locking_callback(mode,type,file,line);
    515.   	}
            ^
    516.   
    517.   int CRYPTO_add_lock(int *pointer, int amount, int type, const char *file,

crypto/cryptlib.c:541:3: 
  539.   		CRYPTO_lock(CRYPTO_LOCK|CRYPTO_WRITE,type,file,line);
  540.   
  541. > 		ret= *pointer+amount;
  542.   #ifdef LOCK_DEBUG
  543.   		fprintf(stderr,"ladd:%08lx/%0xp:%2d+%2d->%2d %-18s %s:%d\n",

crypto/cryptlib.c:549:3: 
  547.   			file,line);
  548.   #endif
  549. > 		*pointer=ret;
  550.   		CRYPTO_lock(CRYPTO_UNLOCK|CRYPTO_WRITE,type,file,line);
  551.   		}

crypto/cryptlib.c:550:3: 
  548.   #endif
  549.   		*pointer=ret;
  550. > 		CRYPTO_lock(CRYPTO_UNLOCK|CRYPTO_WRITE,type,file,line);
  551.   		}
  552.   	return(ret);

crypto/cryptlib.c:473:1: start of procedure CRYPTO_lock()
    471.   	}
    472.   
    473. > void CRYPTO_lock(int mode, int type, const char *file, int line)
    474.   	{
    475.   #ifdef LOCK_DEBUG

crypto/cryptlib.c:498:6: Taking false branch
    496.   		}
    497.   #endif
    498.   	if (type < 0)
                ^
    499.   		{
    500.   		if (dynlock_lock_callback != NULL)

crypto/cryptlib.c:513:7: Taking false branch
    511.   		}
    512.   	else
    513.   		if (locking_callback != NULL)
                 ^
    514.   			locking_callback(mode,type,file,line);
    515.   	}

crypto/cryptlib.c:498:2: 
    496.   		}
    497.   #endif
    498. > 	if (type < 0)
    499.   		{
    500.   		if (dynlock_lock_callback != NULL)

crypto/cryptlib.c:515:2: return from a call to CRYPTO_lock
    513.   		if (locking_callback != NULL)
    514.   			locking_callback(mode,type,file,line);
    515.   	}
            ^
    516.   
    517.   int CRYPTO_add_lock(int *pointer, int amount, int type, const char *file,

crypto/cryptlib.c:552:2: 
  550.   		CRYPTO_lock(CRYPTO_UNLOCK|CRYPTO_WRITE,type,file,line);
  551.   		}
  552. > 	return(ret);
  553.   	}
  554.   

crypto/cryptlib.c:553:2: return from a call to CRYPTO_add_lock
  551.   		}
  552.   	return(ret);
  553.   	}
          ^
  554.   
  555.   const char *CRYPTO_get_lock_name(int type)

crypto/x509/x509_vfy.c:167:5: 
165.   					}
166.   				CRYPTO_add(&xtmp->references,1,CRYPTO_LOCK_X509);
167. > 				sk_X509_delete_ptr(sktmp,xtmp);
168.   				ctx->last_untrusted++;
169.   				x=xtmp;

crypto/stack/stack.c:180:1: start of procedure sk_delete_ptr()
  178.   	}
  179.   
  180. > char *sk_delete_ptr(STACK *st, char *p)
  181.   	{
  182.   	int i;

crypto/stack/stack.c:184:7: 
  182.   	int i;
  183.   
  184. > 	for (i=0; i<st->num; i++)
  185.   		if (st->data[i] == p)
  186.   			return(sk_delete(st,i));

crypto/stack/stack.c:184:12: Loop condition is true. Entering loop body
  182.   	int i;
  183.   
  184.   	for (i=0; i<st->num; i++)
                    ^
  185.   		if (st->data[i] == p)
  186.   			return(sk_delete(st,i));

crypto/stack/stack.c:185:7: Taking false branch
  183.   
  184.   	for (i=0; i<st->num; i++)
  185.   		if (st->data[i] == p)
               ^
  186.   			return(sk_delete(st,i));
  187.   	return(NULL);

crypto/stack/stack.c:184:23: 
  182.   	int i;
  183.   
  184. > 	for (i=0; i<st->num; i++)
  185.   		if (st->data[i] == p)
  186.   			return(sk_delete(st,i));

crypto/stack/stack.c:184:12: 
  182.   	int i;
  183.   
  184. > 	for (i=0; i<st->num; i++)
  185.   		if (st->data[i] == p)
  186.   			return(sk_delete(st,i));
