crypto/x509/x509_lu.c:639: error: NULL_DEREFERENCE
  pointer `pobj` last assigned on line 637 could be null and is dereferenced at line 639, column 17.
Showing all 45 steps of the trace


crypto/x509/x509_lu.c:600:1: start of procedure X509_STORE_CTX_get1_issuer()
598.    * -1 some other error.
599.    */
600. > int X509_STORE_CTX_get1_issuer(X509 **issuer, X509_STORE_CTX *ctx, X509 *x)
601.   {
602.       X509_NAME *xn;

crypto/x509/x509_lu.c:605:5: 
603.       X509_OBJECT obj, *pobj;
604.       int i, ok, idx, ret;
605. >     *issuer = NULL;
606.       xn = X509_get_issuer_name(x);
607.       ok = X509_STORE_get_by_subject(ctx, X509_LU_X509, xn, &obj);

crypto/x509/x509_lu.c:606:5: 
604.       int i, ok, idx, ret;
605.       *issuer = NULL;
606. >     xn = X509_get_issuer_name(x);
607.       ok = X509_STORE_get_by_subject(ctx, X509_LU_X509, xn, &obj);
608.       if (ok != X509_LU_X509) {

crypto/x509/x509_cmp.c:131:1: start of procedure X509_get_issuer_name()
  129.   }
  130.   
  131. > X509_NAME *X509_get_issuer_name(X509 *a)
  132.   {
  133.       return (a->cert_info.issuer);

crypto/x509/x509_cmp.c:133:5: 
  131.   X509_NAME *X509_get_issuer_name(X509 *a)
  132.   {
  133. >     return (a->cert_info.issuer);
  134.   }
  135.   

crypto/x509/x509_cmp.c:134:1: return from a call to X509_get_issuer_name
  132.   {
  133.       return (a->cert_info.issuer);
  134. > }
  135.   
  136.   unsigned long X509_issuer_name_hash(X509 *x)

crypto/x509/x509_lu.c:607:5: Skipping X509_STORE_get_by_subject(): empty list of specs
605.       *issuer = NULL;
606.       xn = X509_get_issuer_name(x);
607.       ok = X509_STORE_get_by_subject(ctx, X509_LU_X509, xn, &obj);
           ^
608.       if (ok != X509_LU_X509) {
609.           if (ok == X509_LU_RETRY) {

crypto/x509/x509_lu.c:608:9: Taking false branch
606.       xn = X509_get_issuer_name(x);
607.       ok = X509_STORE_get_by_subject(ctx, X509_LU_X509, xn, &obj);
608.       if (ok != X509_LU_X509) {
               ^
609.           if (ok == X509_LU_RETRY) {
610.               X509_OBJECT_free_contents(&obj);

crypto/x509/x509_lu.c:621:9: Taking false branch
619.       }
620.       /* If certificate matches all OK */
621.       if (ctx->check_issued(ctx, x, obj.data.x509)) {
               ^
622.           if (x509_check_cert_time(ctx, obj.data.x509, 1)) {
623.               *issuer = obj.data.x509;

crypto/x509/x509_lu.c:627:5: 
625.           }
626.       }
627. >     X509_OBJECT_free_contents(&obj);
628.   
629.       /* Else find index of first cert accepted by 'check_issued' */

crypto/x509/x509_lu.c:402:1: start of procedure X509_OBJECT_free_contents()
  400.   }
  401.   
  402. > void X509_OBJECT_free_contents(X509_OBJECT *a)
  403.   {
  404.       if (!a)

crypto/x509/x509_lu.c:404:10: Taking false branch
  402.   void X509_OBJECT_free_contents(X509_OBJECT *a)
  403.   {
  404.       if (!a)
                  ^
  405.           return;
  406.       switch (a->type) {

crypto/x509/x509_lu.c:406:5: 
  404.       if (!a)
  405.           return;
  406. >     switch (a->type) {
  407.       default:
  408.           break;

crypto/x509/x509_lu.c:409:5: Switch condition is false. Skipping switch case
  407.       default:
  408.           break;
  409.       case X509_LU_X509:
             ^
  410.           X509_free(a->data.x509);
  411.           break;

crypto/x509/x509_lu.c:412:5: Switch condition is false. Skipping switch case
  410.           X509_free(a->data.x509);
  411.           break;
  412.       case X509_LU_CRL:
             ^
  413.           X509_CRL_free(a->data.crl);
  414.           break;

crypto/x509/x509_lu.c:416:1: return from a call to X509_OBJECT_free_contents
  414.           break;
  415.       }
  416. > }
  417.   
  418.   static int x509_object_idx_cnt(STACK_OF(X509_OBJECT) *h, int type,

crypto/x509/x509_lu.c:630:5: 
628.   
629.       /* Else find index of first cert accepted by 'check_issued' */
630. >     ret = 0;
631.       CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);
632.       idx = X509_OBJECT_idx_by_subject(ctx->ctx->objs, X509_LU_X509, xn);

crypto/x509/x509_lu.c:631:5: 
629.       /* Else find index of first cert accepted by 'check_issued' */
630.       ret = 0;
631. >     CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);
632.       idx = X509_OBJECT_idx_by_subject(ctx->ctx->objs, X509_LU_X509, xn);
633.       if (idx != -1) {            /* should be true as we've had at least one

crypto/lock.c:417:1: start of procedure CRYPTO_lock()
  415.   }
  416.   
  417. > void CRYPTO_lock(int mode, int type, const char *file, int line)
  418.   {
  419.   #ifdef LOCK_DEBUG

crypto/lock.c:444:9: Taking false branch
  442.       }
  443.   #endif
  444.       if (type < 0) {
                 ^
  445.           if (dynlock_lock_callback != NULL) {
  446.               struct CRYPTO_dynlock_value *pointer

crypto/lock.c:455:16: Taking true branch
  453.               CRYPTO_destroy_dynlockid(type);
  454.           }
  455.       } else if (locking_callback != NULL)
                        ^
  456.           locking_callback(mode, type, file, line);
  457.   }

crypto/lock.c:456:9: Skipping __function_pointer__(): unresolved function pointer
  454.           }
  455.       } else if (locking_callback != NULL)
  456.           locking_callback(mode, type, file, line);
                 ^
  457.   }
  458.   

crypto/lock.c:444:5: 
  442.       }
  443.   #endif
  444. >     if (type < 0) {
  445.           if (dynlock_lock_callback != NULL) {
  446.               struct CRYPTO_dynlock_value *pointer

crypto/lock.c:457:1: return from a call to CRYPTO_lock
  455.       } else if (locking_callback != NULL)
  456.           locking_callback(mode, type, file, line);
  457. > }
  458.   
  459.   int CRYPTO_add_lock(int *pointer, int amount, int type, const char *file,

crypto/x509/x509_lu.c:632:5: 
630.       ret = 0;
631.       CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);
632. >     idx = X509_OBJECT_idx_by_subject(ctx->ctx->objs, X509_LU_X509, xn);
633.       if (idx != -1) {            /* should be true as we've had at least one
634.                                    * match */

crypto/x509/x509_lu.c:457:1: start of procedure X509_OBJECT_idx_by_subject()
  455.   }
  456.   
  457. > int X509_OBJECT_idx_by_subject(STACK_OF(X509_OBJECT) *h, int type,
  458.                                  X509_NAME *name)
  459.   {

crypto/x509/x509_lu.c:460:5: Skipping x509_object_idx_cnt(): empty list of specs
  458.                                  X509_NAME *name)
  459.   {
  460.       return x509_object_idx_cnt(h, type, name, NULL);
             ^
  461.   }
  462.   

crypto/x509/x509_lu.c:461:1: return from a call to X509_OBJECT_idx_by_subject
  459.   {
  460.       return x509_object_idx_cnt(h, type, name, NULL);
  461. > }
  462.   
  463.   X509_OBJECT *X509_OBJECT_retrieve_by_subject(STACK_OF(X509_OBJECT) *h,

crypto/x509/x509_lu.c:633:9: Taking true branch
631.       CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);
632.       idx = X509_OBJECT_idx_by_subject(ctx->ctx->objs, X509_LU_X509, xn);
633.       if (idx != -1) {            /* should be true as we've had at least one
               ^
634.                                    * match */
635.           /* Look through all matching certs for suitable issuer */

crypto/x509/x509_lu.c:636:14: 
634.                                    * match */
635.           /* Look through all matching certs for suitable issuer */
636. >         for (i = idx; i < sk_X509_OBJECT_num(ctx->ctx->objs); i++) {
637.               pobj = sk_X509_OBJECT_value(ctx->ctx->objs, i);
638.               /* See if we've run past the matches */

crypto/x509/x509_lu.c:636:27: Condition is true
634.                                    * match */
635.           /* Look through all matching certs for suitable issuer */
636.           for (i = idx; i < sk_X509_OBJECT_num(ctx->ctx->objs); i++) {
                                 ^
637.               pobj = sk_X509_OBJECT_value(ctx->ctx->objs, i);
638.               /* See if we've run past the matches */

crypto/x509/x509_lu.c:636:23: 
634.                                    * match */
635.           /* Look through all matching certs for suitable issuer */
636. >         for (i = idx; i < sk_X509_OBJECT_num(ctx->ctx->objs); i++) {
637.               pobj = sk_X509_OBJECT_value(ctx->ctx->objs, i);
638.               /* See if we've run past the matches */

crypto/stack/stack.c:317:1: start of procedure sk_num()
  315.   }
  316.   
  317. > int sk_num(const _STACK *st)
  318.   {
  319.       if (st == NULL)

crypto/stack/stack.c:319:9: Taking false branch
  317.   int sk_num(const _STACK *st)
  318.   {
  319.       if (st == NULL)
                 ^
  320.           return -1;
  321.       return st->num;

crypto/stack/stack.c:321:5: 
  319.       if (st == NULL)
  320.           return -1;
  321. >     return st->num;
  322.   }
  323.   

crypto/stack/stack.c:322:1: return from a call to sk_num
  320.           return -1;
  321.       return st->num;
  322. > }
  323.   
  324.   void *sk_value(const _STACK *st, int i)

crypto/x509/x509_lu.c:636:23: Loop condition is true. Entering loop body
634.                                    * match */
635.           /* Look through all matching certs for suitable issuer */
636.           for (i = idx; i < sk_X509_OBJECT_num(ctx->ctx->objs); i++) {
                             ^
637.               pobj = sk_X509_OBJECT_value(ctx->ctx->objs, i);
638.               /* See if we've run past the matches */

crypto/x509/x509_lu.c:637:20: Condition is true
635.           /* Look through all matching certs for suitable issuer */
636.           for (i = idx; i < sk_X509_OBJECT_num(ctx->ctx->objs); i++) {
637.               pobj = sk_X509_OBJECT_value(ctx->ctx->objs, i);
                          ^
638.               /* See if we've run past the matches */
639.               if (pobj->type != X509_LU_X509)

crypto/x509/x509_lu.c:637:13: 
635.           /* Look through all matching certs for suitable issuer */
636.           for (i = idx; i < sk_X509_OBJECT_num(ctx->ctx->objs); i++) {
637. >             pobj = sk_X509_OBJECT_value(ctx->ctx->objs, i);
638.               /* See if we've run past the matches */
639.               if (pobj->type != X509_LU_X509)

crypto/stack/stack.c:324:1: start of procedure sk_value()
  322.   }
  323.   
  324. > void *sk_value(const _STACK *st, int i)
  325.   {
  326.       if (!st || (i < 0) || (i >= st->num))

crypto/stack/stack.c:326:10: Taking false branch
  324.   void *sk_value(const _STACK *st, int i)
  325.   {
  326.       if (!st || (i < 0) || (i >= st->num))
                  ^
  327.           return NULL;
  328.       return st->data[i];

crypto/stack/stack.c:326:17: Taking true branch
  324.   void *sk_value(const _STACK *st, int i)
  325.   {
  326.       if (!st || (i < 0) || (i >= st->num))
                         ^
  327.           return NULL;
  328.       return st->data[i];

crypto/stack/stack.c:327:9: 
  325.   {
  326.       if (!st || (i < 0) || (i >= st->num))
  327. >         return NULL;
  328.       return st->data[i];
  329.   }

crypto/stack/stack.c:329:1: return from a call to sk_value
  327.           return NULL;
  328.       return st->data[i];
  329. > }
  330.   
  331.   void *sk_set(_STACK *st, int i, void *value)

crypto/x509/x509_lu.c:639:17: 
637.               pobj = sk_X509_OBJECT_value(ctx->ctx->objs, i);
638.               /* See if we've run past the matches */
639. >             if (pobj->type != X509_LU_X509)
640.                   break;
641.               if (X509_NAME_cmp(xn, X509_get_subject_name(pobj->data.x509)))
