crypto/x509/x509_vfy.c:597: error: NULL_DEREFERENCE
  pointer `x` last assigned on line 579 could be null and is dereferenced by call to `X509_check_ca()` at line 597, column 9.
Showing all 26 steps of the trace


crypto/x509/x509_vfy.c:535:1: start of procedure check_chain_extensions()
533.    */
534.   
535. > static int check_chain_extensions(X509_STORE_CTX *ctx)
536.   {
537.   #ifdef OPENSSL_NO_CHAIN_VERIFY

crypto/x509/x509_vfy.c:540:2: 
538.   	return 1;
539.   #else
540. > 	int i, ok=0, must_be_ca, plen = 0;
541.   	X509 *x;
542.   	int (*cb)(int xok,X509_STORE_CTX *xctx);

crypto/x509/x509_vfy.c:543:2: 
541.   	X509 *x;
542.   	int (*cb)(int xok,X509_STORE_CTX *xctx);
543. > 	int proxy_path_length = 0;
544.   	int purpose;
545.   	int allow_proxy_certs;

crypto/x509/x509_vfy.c:546:2: 
544.   	int purpose;
545.   	int allow_proxy_certs;
546. > 	cb=ctx->verify_cb;
547.   
548.   	/* must_be_ca can have 1 of 3 values:

crypto/x509/x509_vfy.c:556:2: 
554.   	       all certificates in the chain except the leaf certificate.
555.   	*/
556. > 	must_be_ca = -1;
557.   
558.   	/* CRL path validation */

crypto/x509/x509_vfy.c:559:6: Taking false branch
557.   
558.   	/* CRL path validation */
559.   	if (ctx->parent)
            ^
560.   		{
561.   		allow_proxy_certs = 0;

crypto/x509/x509_vfy.c:567:7: Condition is true
565.   		{
566.   		allow_proxy_certs =
567.   			!!(ctx->param->flags & X509_V_FLAG_ALLOW_PROXY_CERTS);
             ^
568.   		/* A hack to keep people who don't want to modify their
569.   		   software happy */

crypto/x509/x509_vfy.c:567:4: 
565.   		{
566.   		allow_proxy_certs =
567. > 			!!(ctx->param->flags & X509_V_FLAG_ALLOW_PROXY_CERTS);
568.   		/* A hack to keep people who don't want to modify their
569.   		   software happy */

crypto/x509/x509_vfy.c:566:3: 
564.   	else
565.   		{
566. > 		allow_proxy_certs =
567.   			!!(ctx->param->flags & X509_V_FLAG_ALLOW_PROXY_CERTS);
568.   		/* A hack to keep people who don't want to modify their

crypto/x509/x509_vfy.c:570:7: Taking false branch
568.   		/* A hack to keep people who don't want to modify their
569.   		   software happy */
570.   		if (getenv("OPENSSL_ALLOW_PROXY_CERTS"))
             ^
571.   			allow_proxy_certs = 1;
572.   		purpose = ctx->param->purpose;

crypto/x509/x509_vfy.c:572:3: 
570.   		if (getenv("OPENSSL_ALLOW_PROXY_CERTS"))
571.   			allow_proxy_certs = 1;
572. > 		purpose = ctx->param->purpose;
573.   		}
574.   

crypto/x509/x509_vfy.c:576:7: 
574.   
575.   	/* Check all untrusted certificates */
576. > 	for (i = 0; i < ctx->last_untrusted; i++)
577.   		{
578.   		int ret;

crypto/x509/x509_vfy.c:576:14: Loop condition is true. Entering loop body
574.   
575.   	/* Check all untrusted certificates */
576.   	for (i = 0; i < ctx->last_untrusted; i++)
                    ^
577.   		{
578.   		int ret;

crypto/x509/x509_vfy.c:579:7: Condition is true
577.   		{
578.   		int ret;
579.   		x = sk_X509_value(ctx->chain, i);
             ^
580.   		if (!(ctx->param->flags & X509_V_FLAG_IGNORE_CRITICAL)
581.   			&& (x->ex_flags & EXFLAG_CRITICAL))

crypto/x509/x509_vfy.c:579:3: 
577.   		{
578.   		int ret;
579. > 		x = sk_X509_value(ctx->chain, i);
580.   		if (!(ctx->param->flags & X509_V_FLAG_IGNORE_CRITICAL)
581.   			&& (x->ex_flags & EXFLAG_CRITICAL))

crypto/stack/stack.c:300:1: start of procedure sk_value()
  298.   }
  299.   
  300. > void *sk_value(const _STACK *st, int i)
  301.   {
  302.   	if(!st || (i < 0) || (i >= st->num)) return NULL;

crypto/stack/stack.c:302:6: Taking false branch
  300.   void *sk_value(const _STACK *st, int i)
  301.   {
  302.   	if(!st || (i < 0) || (i >= st->num)) return NULL;
              ^
  303.   	return st->data[i];
  304.   }

crypto/stack/stack.c:302:13: Taking false branch
  300.   void *sk_value(const _STACK *st, int i)
  301.   {
  302.   	if(!st || (i < 0) || (i >= st->num)) return NULL;
                     ^
  303.   	return st->data[i];
  304.   }

crypto/stack/stack.c:302:24: Taking true branch
  300.   void *sk_value(const _STACK *st, int i)
  301.   {
  302.   	if(!st || (i < 0) || (i >= st->num)) return NULL;
                                ^
  303.   	return st->data[i];
  304.   }

crypto/stack/stack.c:302:39: 
  300.   void *sk_value(const _STACK *st, int i)
  301.   {
  302. > 	if(!st || (i < 0) || (i >= st->num)) return NULL;
  303.   	return st->data[i];
  304.   }

crypto/stack/stack.c:304:1: return from a call to sk_value
  302.   	if(!st || (i < 0) || (i >= st->num)) return NULL;
  303.   	return st->data[i];
  304. > }
  305.   
  306.   void *sk_set(_STACK *st, int i, void *value)

crypto/x509/x509_vfy.c:580:9: Taking false branch
578.   		int ret;
579.   		x = sk_X509_value(ctx->chain, i);
580.   		if (!(ctx->param->flags & X509_V_FLAG_IGNORE_CRITICAL)
               ^
581.   			&& (x->ex_flags & EXFLAG_CRITICAL))
582.   			{

crypto/x509/x509_vfy.c:589:8: Taking false branch
587.   			if (!ok) goto end;
588.   			}
589.   		if (!allow_proxy_certs && (x->ex_flags & EXFLAG_PROXY))
              ^
590.   			{
591.   			ctx->error = X509_V_ERR_PROXY_CERTIFICATES_NOT_ALLOWED;

crypto/x509/x509_vfy.c:597:3: 
595.   			if (!ok) goto end;
596.   			}
597. > 		ret = X509_check_ca(x);
598.   		switch(must_be_ca)
599.   			{

crypto/x509v3/v3_purp.c:538:1: start of procedure X509_check_ca()
  536.   }
  537.   
  538. > int X509_check_ca(X509 *x)
  539.   {
  540.   	if(!(x->ex_flags & EXFLAG_SET)) {

crypto/x509v3/v3_purp.c:540:7: 
  538.   int X509_check_ca(X509 *x)
  539.   {
  540. > 	if(!(x->ex_flags & EXFLAG_SET)) {
  541.   		CRYPTO_w_lock(CRYPTO_LOCK_X509);
  542.   		x509v3_cache_extensions(x);
