crypto/x509/x509_vfy.c:221: error: NULL_DEREFERENCE
  pointer `sktmp` last assigned on line 161 could be null and is dereferenced by call to `sk_delete_ptr()` at line 221, column 11.
Showing all 65 steps of the trace


crypto/x509/x509_vfy.c:153:1: start of procedure X509_verify_cert()
151.   #endif
152.   
153. > int X509_verify_cert(X509_STORE_CTX *ctx)
154.   	{
155.   	X509 *x,*xtmp,*chain_ss=NULL;

crypto/x509/x509_vfy.c:155:2: 
153.   int X509_verify_cert(X509_STORE_CTX *ctx)
154.   	{
155. > 	X509 *x,*xtmp,*chain_ss=NULL;
156.   	int bad_chain = 0;
157.   	X509_VERIFY_PARAM *param = ctx->param;

crypto/x509/x509_vfy.c:156:2: 
154.   	{
155.   	X509 *x,*xtmp,*chain_ss=NULL;
156. > 	int bad_chain = 0;
157.   	X509_VERIFY_PARAM *param = ctx->param;
158.   	int depth,i,ok=0;

crypto/x509/x509_vfy.c:157:2: 
155.   	X509 *x,*xtmp,*chain_ss=NULL;
156.   	int bad_chain = 0;
157. > 	X509_VERIFY_PARAM *param = ctx->param;
158.   	int depth,i,ok=0;
159.   	int num;

crypto/x509/x509_vfy.c:158:2: 
156.   	int bad_chain = 0;
157.   	X509_VERIFY_PARAM *param = ctx->param;
158. > 	int depth,i,ok=0;
159.   	int num;
160.   	int (*cb)(int xok,X509_STORE_CTX *xctx);

crypto/x509/x509_vfy.c:161:2: 
159.   	int num;
160.   	int (*cb)(int xok,X509_STORE_CTX *xctx);
161. > 	STACK_OF(X509) *sktmp=NULL;
162.   	if (ctx->cert == NULL)
163.   		{

crypto/x509/x509_vfy.c:162:6: Taking false branch
160.   	int (*cb)(int xok,X509_STORE_CTX *xctx);
161.   	STACK_OF(X509) *sktmp=NULL;
162.   	if (ctx->cert == NULL)
            ^
163.   		{
164.   		X509err(X509_F_X509_VERIFY_CERT,X509_R_NO_CERT_SET_FOR_US_TO_VERIFY);

crypto/x509/x509_vfy.c:168:2: 
166.   		}
167.   
168. > 	cb=ctx->verify_cb;
169.   
170.   	/* first we make sure the chain we are going to build is

crypto/x509/x509_vfy.c:172:6: Taking false branch
170.   	/* first we make sure the chain we are going to build is
171.   	 * present and that the first entry is in place */
172.   	if (ctx->chain == NULL)
            ^
173.   		{
174.   		if (	((ctx->chain=sk_X509_new_null()) == NULL) ||

crypto/x509/x509_vfy.c:185:6: Taking false branch
183.   
184.   	/* We use a temporary STACK so we can chop and hack at it */
185.   	if (ctx->untrusted != NULL
            ^
186.   	    && (sktmp=sk_X509_dup(ctx->untrusted)) == NULL)
187.   		{

crypto/x509/x509_vfy.c:192:6: Condition is true
190.   		}
191.   
192.   	num=sk_X509_num(ctx->chain);
            ^
193.   	x=sk_X509_value(ctx->chain,num-1);
194.   	depth=param->depth;

crypto/x509/x509_vfy.c:192:2: 
190.   		}
191.   
192. > 	num=sk_X509_num(ctx->chain);
193.   	x=sk_X509_value(ctx->chain,num-1);
194.   	depth=param->depth;

crypto/stack/stack.c:294:1: start of procedure sk_num()
  292.   	}
  293.   
  294. > int sk_num(const _STACK *st)
  295.   {
  296.   	if(st == NULL) return -1;

crypto/stack/stack.c:296:5: Taking false branch
  294.   int sk_num(const _STACK *st)
  295.   {
  296.   	if(st == NULL) return -1;
             ^
  297.   	return st->num;
  298.   }

crypto/stack/stack.c:297:2: 
  295.   {
  296.   	if(st == NULL) return -1;
  297. > 	return st->num;
  298.   }
  299.   

crypto/stack/stack.c:298:1: return from a call to sk_num
  296.   	if(st == NULL) return -1;
  297.   	return st->num;
  298. > }
  299.   
  300.   void *sk_value(const _STACK *st, int i)

crypto/x509/x509_vfy.c:193:4: Condition is true
191.   
192.   	num=sk_X509_num(ctx->chain);
193.   	x=sk_X509_value(ctx->chain,num-1);
          ^
194.   	depth=param->depth;
195.   

crypto/x509/x509_vfy.c:193:2: 
191.   
192.   	num=sk_X509_num(ctx->chain);
193. > 	x=sk_X509_value(ctx->chain,num-1);
194.   	depth=param->depth;
195.   

crypto/stack/stack.c:300:1: start of procedure sk_value()
  298.   }
  299.   
  300. > void *sk_value(const _STACK *st, int i)
  301.   {
  302.   	if(!st || (i < 0) || (i >= st->num)) return NULL;

crypto/stack/stack.c:302:6: Taking false branch
  300.   void *sk_value(const _STACK *st, int i)
  301.   {
  302.   	if(!st || (i < 0) || (i >= st->num)) return NULL;
              ^
  303.   	return st->data[i];
  304.   }

crypto/stack/stack.c:302:13: Taking false branch
  300.   void *sk_value(const _STACK *st, int i)
  301.   {
  302.   	if(!st || (i < 0) || (i >= st->num)) return NULL;
                     ^
  303.   	return st->data[i];
  304.   }

crypto/stack/stack.c:302:24: Taking false branch
  300.   void *sk_value(const _STACK *st, int i)
  301.   {
  302.   	if(!st || (i < 0) || (i >= st->num)) return NULL;
                                ^
  303.   	return st->data[i];
  304.   }

crypto/stack/stack.c:303:2: 
  301.   {
  302.   	if(!st || (i < 0) || (i >= st->num)) return NULL;
  303. > 	return st->data[i];
  304.   }
  305.   

crypto/stack/stack.c:304:1: return from a call to sk_value
  302.   	if(!st || (i < 0) || (i >= st->num)) return NULL;
  303.   	return st->data[i];
  304. > }
  305.   
  306.   void *sk_set(_STACK *st, int i, void *value)

crypto/x509/x509_vfy.c:194:2: 
192.   	num=sk_X509_num(ctx->chain);
193.   	x=sk_X509_value(ctx->chain,num-1);
194. > 	depth=param->depth;
195.   
196.   

crypto/x509/x509_vfy.c:231:3: Loop condition is true. Entering loop body
229.   			}
230.   		break;
231.   		}
         ^
232.   
233.   	/* at this point, chain should contain a list of untrusted

crypto/x509/x509_vfy.c:200:7: Taking false branch
198.   		{
199.   		/* If we have enough, we break */
200.   		if (depth < num) break; /* FIXME: If this happens, we should take
             ^
201.   		                         * note of it and, if appropriate, use the
202.   		                         * X509_V_ERR_CERT_CHAIN_TOO_LONG error

crypto/x509/x509_vfy.c:207:7: Taking false branch
205.   
206.   		/* If we are self signed, we break */
207.   		if (ctx->check_issued(ctx, x,x)) break;
             ^
208.   
209.   		/* If we were passed a cert chain, use it first */

crypto/x509/x509_vfy.c:210:7: Taking true branch
208.   
209.   		/* If we were passed a cert chain, use it first */
210.   		if (ctx->untrusted != NULL)
             ^
211.   			{
212.   			xtmp=find_issuer(ctx, sktmp,x);

crypto/x509/x509_vfy.c:212:4: Skipping find_issuer(): empty list of specs
210.   		if (ctx->untrusted != NULL)
211.   			{
212.   			xtmp=find_issuer(ctx, sktmp,x);
          ^
213.   			if (xtmp != NULL)
214.   				{

crypto/x509/x509_vfy.c:213:8: Taking true branch
211.   			{
212.   			xtmp=find_issuer(ctx, sktmp,x);
213.   			if (xtmp != NULL)
              ^
214.   				{
215.   				if (!sk_X509_push(ctx->chain,xtmp))

crypto/x509/x509_vfy.c:215:10: Condition is true
213.   			if (xtmp != NULL)
214.   				{
215.   				if (!sk_X509_push(ctx->chain,xtmp))
                ^
216.   					{
217.   					X509err(X509_F_X509_VERIFY_CERT,ERR_R_MALLOC_FAILURE);

crypto/x509/x509_vfy.c:215:10: Condition is true
213.   			if (xtmp != NULL)
214.   				{
215.   				if (!sk_X509_push(ctx->chain,xtmp))
                ^
216.   					{
217.   					X509err(X509_F_X509_VERIFY_CERT,ERR_R_MALLOC_FAILURE);

crypto/stack/stack.c:244:1: start of procedure sk_push()
  242.   	}
  243.   
  244. > int sk_push(_STACK *st, void *data)
  245.   	{
  246.   	return(sk_insert(st,data,st->num));

crypto/stack/stack.c:246:2: Skipping sk_insert(): empty list of specs
  244.   int sk_push(_STACK *st, void *data)
  245.   	{
  246.   	return(sk_insert(st,data,st->num));
          ^
  247.   	}
  248.   

crypto/stack/stack.c:247:2: return from a call to sk_push
  245.   	{
  246.   	return(sk_insert(st,data,st->num));
  247.   	}
          ^
  248.   
  249.   int sk_unshift(_STACK *st, void *data)

crypto/x509/x509_vfy.c:215:10: Taking false branch
213.   			if (xtmp != NULL)
214.   				{
215.   				if (!sk_X509_push(ctx->chain,xtmp))
                ^
216.   					{
217.   					X509err(X509_F_X509_VERIFY_CERT,ERR_R_MALLOC_FAILURE);

crypto/x509/x509_vfy.c:220:5: 
218.   					goto end;
219.   					}
220. > 				CRYPTO_add(&xtmp->references,1,CRYPTO_LOCK_X509);
221.   				(void)sk_X509_delete_ptr(sktmp,xtmp);
222.   				ctx->last_untrusted++;

crypto/cryptlib.c:607:1: start of procedure CRYPTO_add_lock()
  605.   	}
  606.   
  607. > int CRYPTO_add_lock(int *pointer, int amount, int type, const char *file,
  608.   	     int line)
  609.   	{

crypto/cryptlib.c:610:2: 
  608.   	     int line)
  609.   	{
  610. > 	int ret = 0;
  611.   
  612.   	if (add_lock_callback != NULL)

crypto/cryptlib.c:612:6: Taking false branch
  610.   	int ret = 0;
  611.   
  612.   	if (add_lock_callback != NULL)
              ^
  613.   		{
  614.   #ifdef LOCK_DEBUG

crypto/cryptlib.c:632:3: 
  630.   	else
  631.   		{
  632. > 		CRYPTO_lock(CRYPTO_LOCK|CRYPTO_WRITE,type,file,line);
  633.   
  634.   		ret= *pointer+amount;

crypto/cryptlib.c:561:1: start of procedure CRYPTO_lock()
    559.   #endif
    560.   
    561. > void CRYPTO_lock(int mode, int type, const char *file, int line)
    562.   	{
    563.   #ifdef LOCK_DEBUG

crypto/cryptlib.c:588:6: Taking false branch
    586.   		}
    587.   #endif
    588.   	if (type < 0)
                ^
    589.   		{
    590.   		if (dynlock_lock_callback != NULL)

crypto/cryptlib.c:603:7: Taking false branch
    601.   		}
    602.   	else
    603.   		if (locking_callback != NULL)
                 ^
    604.   			locking_callback(mode,type,file,line);
    605.   	}

crypto/cryptlib.c:588:2: 
    586.   		}
    587.   #endif
    588. > 	if (type < 0)
    589.   		{
    590.   		if (dynlock_lock_callback != NULL)

crypto/cryptlib.c:605:2: return from a call to CRYPTO_lock
    603.   		if (locking_callback != NULL)
    604.   			locking_callback(mode,type,file,line);
    605.   	}
            ^
    606.   
    607.   int CRYPTO_add_lock(int *pointer, int amount, int type, const char *file,

crypto/cryptlib.c:634:3: 
  632.   		CRYPTO_lock(CRYPTO_LOCK|CRYPTO_WRITE,type,file,line);
  633.   
  634. > 		ret= *pointer+amount;
  635.   #ifdef LOCK_DEBUG
  636.   		{

crypto/cryptlib.c:646:3: 
  644.   		}
  645.   #endif
  646. > 		*pointer=ret;
  647.   		CRYPTO_lock(CRYPTO_UNLOCK|CRYPTO_WRITE,type,file,line);
  648.   		}

crypto/cryptlib.c:647:3: 
  645.   #endif
  646.   		*pointer=ret;
  647. > 		CRYPTO_lock(CRYPTO_UNLOCK|CRYPTO_WRITE,type,file,line);
  648.   		}
  649.   	return(ret);

crypto/cryptlib.c:561:1: start of procedure CRYPTO_lock()
    559.   #endif
    560.   
    561. > void CRYPTO_lock(int mode, int type, const char *file, int line)
    562.   	{
    563.   #ifdef LOCK_DEBUG

crypto/cryptlib.c:588:6: Taking false branch
    586.   		}
    587.   #endif
    588.   	if (type < 0)
                ^
    589.   		{
    590.   		if (dynlock_lock_callback != NULL)

crypto/cryptlib.c:603:7: Taking false branch
    601.   		}
    602.   	else
    603.   		if (locking_callback != NULL)
                 ^
    604.   			locking_callback(mode,type,file,line);
    605.   	}

crypto/cryptlib.c:588:2: 
    586.   		}
    587.   #endif
    588. > 	if (type < 0)
    589.   		{
    590.   		if (dynlock_lock_callback != NULL)

crypto/cryptlib.c:605:2: return from a call to CRYPTO_lock
    603.   		if (locking_callback != NULL)
    604.   			locking_callback(mode,type,file,line);
    605.   	}
            ^
    606.   
    607.   int CRYPTO_add_lock(int *pointer, int amount, int type, const char *file,

crypto/cryptlib.c:649:2: 
  647.   		CRYPTO_lock(CRYPTO_UNLOCK|CRYPTO_WRITE,type,file,line);
  648.   		}
  649. > 	return(ret);
  650.   	}
  651.   

crypto/cryptlib.c:650:2: return from a call to CRYPTO_add_lock
  648.   		}
  649.   	return(ret);
  650.   	}
          ^
  651.   
  652.   const char *CRYPTO_get_lock_name(int type)

crypto/x509/x509_vfy.c:221:11: Condition is true
219.   					}
220.   				CRYPTO_add(&xtmp->references,1,CRYPTO_LOCK_X509);
221.   				(void)sk_X509_delete_ptr(sktmp,xtmp);
                 ^
222.   				ctx->last_untrusted++;
223.   				x=xtmp;

crypto/x509/x509_vfy.c:221:11: Condition is true
219.   					}
220.   				CRYPTO_add(&xtmp->references,1,CRYPTO_LOCK_X509);
221.   				(void)sk_X509_delete_ptr(sktmp,xtmp);
                 ^
222.   				ctx->last_untrusted++;
223.   				x=xtmp;

crypto/stack/stack.c:180:1: start of procedure sk_delete_ptr()
  178.   	}
  179.   
  180. > void *sk_delete_ptr(_STACK *st, void *p)
  181.   	{
  182.   	int i;

crypto/stack/stack.c:184:7: 
  182.   	int i;
  183.   
  184. > 	for (i=0; i<st->num; i++)
  185.   		if (st->data[i] == p)
  186.   			return(sk_delete(st,i));

crypto/stack/stack.c:184:12: Loop condition is true. Entering loop body
  182.   	int i;
  183.   
  184.   	for (i=0; i<st->num; i++)
                    ^
  185.   		if (st->data[i] == p)
  186.   			return(sk_delete(st,i));

crypto/stack/stack.c:185:7: Taking false branch
  183.   
  184.   	for (i=0; i<st->num; i++)
  185.   		if (st->data[i] == p)
               ^
  186.   			return(sk_delete(st,i));
  187.   	return(NULL);

crypto/stack/stack.c:184:23: 
  182.   	int i;
  183.   
  184. > 	for (i=0; i<st->num; i++)
  185.   		if (st->data[i] == p)
  186.   			return(sk_delete(st,i));

crypto/stack/stack.c:184:12: 
  182.   	int i;
  183.   
  184. > 	for (i=0; i<st->num; i++)
  185.   		if (st->data[i] == p)
  186.   			return(sk_delete(st,i));
