crypto/x509/x509_lu.c:642: error: NULL_DEREFERENCE
  pointer `pobj` last assigned on line 640 could be null and is dereferenced at line 642, column 17.
Showing all 45 steps of the trace


crypto/x509/x509_lu.c:603:1: start of procedure X509_STORE_CTX_get1_issuer()
601.    * -1 some other error.
602.    */
603. > int X509_STORE_CTX_get1_issuer(X509 **issuer, X509_STORE_CTX *ctx, X509 *x)
604.   {
605.       X509_NAME *xn;

crypto/x509/x509_lu.c:608:5: 
606.       X509_OBJECT obj, *pobj;
607.       int i, ok, idx, ret;
608. >     *issuer = NULL;
609.       xn = X509_get_issuer_name(x);
610.       ok = X509_STORE_get_by_subject(ctx, X509_LU_X509, xn, &obj);

crypto/x509/x509_lu.c:609:5: 
607.       int i, ok, idx, ret;
608.       *issuer = NULL;
609. >     xn = X509_get_issuer_name(x);
610.       ok = X509_STORE_get_by_subject(ctx, X509_LU_X509, xn, &obj);
611.       if (ok != X509_LU_X509) {

crypto/x509/x509_cmp.c:131:1: start of procedure X509_get_issuer_name()
  129.   }
  130.   
  131. > X509_NAME *X509_get_issuer_name(X509 *a)
  132.   {
  133.       return (a->cert_info.issuer);

crypto/x509/x509_cmp.c:133:5: 
  131.   X509_NAME *X509_get_issuer_name(X509 *a)
  132.   {
  133. >     return (a->cert_info.issuer);
  134.   }
  135.   

crypto/x509/x509_cmp.c:134:1: return from a call to X509_get_issuer_name
  132.   {
  133.       return (a->cert_info.issuer);
  134. > }
  135.   
  136.   unsigned long X509_issuer_name_hash(X509 *x)

crypto/x509/x509_lu.c:610:5: Skipping X509_STORE_get_by_subject(): empty list of specs
608.       *issuer = NULL;
609.       xn = X509_get_issuer_name(x);
610.       ok = X509_STORE_get_by_subject(ctx, X509_LU_X509, xn, &obj);
           ^
611.       if (ok != X509_LU_X509) {
612.           if (ok == X509_LU_RETRY) {

crypto/x509/x509_lu.c:611:9: Taking false branch
609.       xn = X509_get_issuer_name(x);
610.       ok = X509_STORE_get_by_subject(ctx, X509_LU_X509, xn, &obj);
611.       if (ok != X509_LU_X509) {
               ^
612.           if (ok == X509_LU_RETRY) {
613.               X509_OBJECT_free_contents(&obj);

crypto/x509/x509_lu.c:624:9: Taking false branch
622.       }
623.       /* If certificate matches all OK */
624.       if (ctx->check_issued(ctx, x, obj.data.x509)) {
               ^
625.           if (x509_check_cert_time(ctx, obj.data.x509, 1)) {
626.               *issuer = obj.data.x509;

crypto/x509/x509_lu.c:630:5: 
628.           }
629.       }
630. >     X509_OBJECT_free_contents(&obj);
631.   
632.       /* Else find index of first cert accepted by 'check_issued' */

crypto/x509/x509_lu.c:407:1: start of procedure X509_OBJECT_free_contents()
  405.   }
  406.   
  407. > void X509_OBJECT_free_contents(X509_OBJECT *a)
  408.   {
  409.       if (!a)

crypto/x509/x509_lu.c:409:10: Taking false branch
  407.   void X509_OBJECT_free_contents(X509_OBJECT *a)
  408.   {
  409.       if (!a)
                  ^
  410.           return;
  411.       switch (a->type) {

crypto/x509/x509_lu.c:411:5: 
  409.       if (!a)
  410.           return;
  411. >     switch (a->type) {
  412.       default:
  413.           break;

crypto/x509/x509_lu.c:414:5: Switch condition is false. Skipping switch case
  412.       default:
  413.           break;
  414.       case X509_LU_X509:
             ^
  415.           X509_free(a->data.x509);
  416.           break;

crypto/x509/x509_lu.c:417:5: Switch condition is false. Skipping switch case
  415.           X509_free(a->data.x509);
  416.           break;
  417.       case X509_LU_CRL:
             ^
  418.           X509_CRL_free(a->data.crl);
  419.           break;

crypto/x509/x509_lu.c:421:1: return from a call to X509_OBJECT_free_contents
  419.           break;
  420.       }
  421. > }
  422.   
  423.   static int x509_object_idx_cnt(STACK_OF(X509_OBJECT) *h, int type,

crypto/x509/x509_lu.c:633:5: 
631.   
632.       /* Else find index of first cert accepted by 'check_issued' */
633. >     ret = 0;
634.       CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);
635.       idx = X509_OBJECT_idx_by_subject(ctx->ctx->objs, X509_LU_X509, xn);

crypto/x509/x509_lu.c:634:5: 
632.       /* Else find index of first cert accepted by 'check_issued' */
633.       ret = 0;
634. >     CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);
635.       idx = X509_OBJECT_idx_by_subject(ctx->ctx->objs, X509_LU_X509, xn);
636.       if (idx != -1) {            /* should be true as we've had at least one

crypto/lock.c:416:1: start of procedure CRYPTO_lock()
  414.   }
  415.   
  416. > void CRYPTO_lock(int mode, int type, const char *file, int line)
  417.   {
  418.   #ifdef LOCK_DEBUG

crypto/lock.c:443:9: Taking false branch
  441.       }
  442.   #endif
  443.       if (type < 0) {
                 ^
  444.           if (dynlock_lock_callback != NULL) {
  445.               struct CRYPTO_dynlock_value *pointer

crypto/lock.c:454:16: Taking true branch
  452.               CRYPTO_destroy_dynlockid(type);
  453.           }
  454.       } else if (locking_callback != NULL)
                        ^
  455.           locking_callback(mode, type, file, line);
  456.   }

crypto/lock.c:455:9: Skipping __function_pointer__(): unresolved function pointer
  453.           }
  454.       } else if (locking_callback != NULL)
  455.           locking_callback(mode, type, file, line);
                 ^
  456.   }
  457.   

crypto/lock.c:443:5: 
  441.       }
  442.   #endif
  443. >     if (type < 0) {
  444.           if (dynlock_lock_callback != NULL) {
  445.               struct CRYPTO_dynlock_value *pointer

crypto/lock.c:456:1: return from a call to CRYPTO_lock
  454.       } else if (locking_callback != NULL)
  455.           locking_callback(mode, type, file, line);
  456. > }
  457.   
  458.   int CRYPTO_add_lock(int *pointer, int amount, int type, const char *file,

crypto/x509/x509_lu.c:635:5: 
633.       ret = 0;
634.       CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);
635. >     idx = X509_OBJECT_idx_by_subject(ctx->ctx->objs, X509_LU_X509, xn);
636.       if (idx != -1) {            /* should be true as we've had at least one
637.                                    * match */

crypto/x509/x509_lu.c:462:1: start of procedure X509_OBJECT_idx_by_subject()
  460.   }
  461.   
  462. > int X509_OBJECT_idx_by_subject(STACK_OF(X509_OBJECT) *h, int type,
  463.                                  X509_NAME *name)
  464.   {

crypto/x509/x509_lu.c:465:5: Skipping x509_object_idx_cnt(): empty list of specs
  463.                                  X509_NAME *name)
  464.   {
  465.       return x509_object_idx_cnt(h, type, name, NULL);
             ^
  466.   }
  467.   

crypto/x509/x509_lu.c:466:1: return from a call to X509_OBJECT_idx_by_subject
  464.   {
  465.       return x509_object_idx_cnt(h, type, name, NULL);
  466. > }
  467.   
  468.   X509_OBJECT *X509_OBJECT_retrieve_by_subject(STACK_OF(X509_OBJECT) *h,

crypto/x509/x509_lu.c:636:9: Taking true branch
634.       CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);
635.       idx = X509_OBJECT_idx_by_subject(ctx->ctx->objs, X509_LU_X509, xn);
636.       if (idx != -1) {            /* should be true as we've had at least one
               ^
637.                                    * match */
638.           /* Look through all matching certs for suitable issuer */

crypto/x509/x509_lu.c:639:14: 
637.                                    * match */
638.           /* Look through all matching certs for suitable issuer */
639. >         for (i = idx; i < sk_X509_OBJECT_num(ctx->ctx->objs); i++) {
640.               pobj = sk_X509_OBJECT_value(ctx->ctx->objs, i);
641.               /* See if we've run past the matches */

crypto/x509/x509_lu.c:639:27: Condition is true
637.                                    * match */
638.           /* Look through all matching certs for suitable issuer */
639.           for (i = idx; i < sk_X509_OBJECT_num(ctx->ctx->objs); i++) {
                                 ^
640.               pobj = sk_X509_OBJECT_value(ctx->ctx->objs, i);
641.               /* See if we've run past the matches */

crypto/x509/x509_lu.c:639:23: 
637.                                    * match */
638.           /* Look through all matching certs for suitable issuer */
639. >         for (i = idx; i < sk_X509_OBJECT_num(ctx->ctx->objs); i++) {
640.               pobj = sk_X509_OBJECT_value(ctx->ctx->objs, i);
641.               /* See if we've run past the matches */

crypto/stack/stack.c:317:1: start of procedure sk_num()
  315.   }
  316.   
  317. > int sk_num(const _STACK *st)
  318.   {
  319.       if (st == NULL)

crypto/stack/stack.c:319:9: Taking false branch
  317.   int sk_num(const _STACK *st)
  318.   {
  319.       if (st == NULL)
                 ^
  320.           return -1;
  321.       return st->num;

crypto/stack/stack.c:321:5: 
  319.       if (st == NULL)
  320.           return -1;
  321. >     return st->num;
  322.   }
  323.   

crypto/stack/stack.c:322:1: return from a call to sk_num
  320.           return -1;
  321.       return st->num;
  322. > }
  323.   
  324.   void *sk_value(const _STACK *st, int i)

crypto/x509/x509_lu.c:639:23: Loop condition is true. Entering loop body
637.                                    * match */
638.           /* Look through all matching certs for suitable issuer */
639.           for (i = idx; i < sk_X509_OBJECT_num(ctx->ctx->objs); i++) {
                             ^
640.               pobj = sk_X509_OBJECT_value(ctx->ctx->objs, i);
641.               /* See if we've run past the matches */

crypto/x509/x509_lu.c:640:20: Condition is true
638.           /* Look through all matching certs for suitable issuer */
639.           for (i = idx; i < sk_X509_OBJECT_num(ctx->ctx->objs); i++) {
640.               pobj = sk_X509_OBJECT_value(ctx->ctx->objs, i);
                          ^
641.               /* See if we've run past the matches */
642.               if (pobj->type != X509_LU_X509)

crypto/x509/x509_lu.c:640:13: 
638.           /* Look through all matching certs for suitable issuer */
639.           for (i = idx; i < sk_X509_OBJECT_num(ctx->ctx->objs); i++) {
640. >             pobj = sk_X509_OBJECT_value(ctx->ctx->objs, i);
641.               /* See if we've run past the matches */
642.               if (pobj->type != X509_LU_X509)

crypto/stack/stack.c:324:1: start of procedure sk_value()
  322.   }
  323.   
  324. > void *sk_value(const _STACK *st, int i)
  325.   {
  326.       if (!st || (i < 0) || (i >= st->num))

crypto/stack/stack.c:326:10: Taking false branch
  324.   void *sk_value(const _STACK *st, int i)
  325.   {
  326.       if (!st || (i < 0) || (i >= st->num))
                  ^
  327.           return NULL;
  328.       return st->data[i];

crypto/stack/stack.c:326:17: Taking true branch
  324.   void *sk_value(const _STACK *st, int i)
  325.   {
  326.       if (!st || (i < 0) || (i >= st->num))
                         ^
  327.           return NULL;
  328.       return st->data[i];

crypto/stack/stack.c:327:9: 
  325.   {
  326.       if (!st || (i < 0) || (i >= st->num))
  327. >         return NULL;
  328.       return st->data[i];
  329.   }

crypto/stack/stack.c:329:1: return from a call to sk_value
  327.           return NULL;
  328.       return st->data[i];
  329. > }
  330.   
  331.   void *sk_set(_STACK *st, int i, void *value)

crypto/x509/x509_lu.c:642:17: 
640.               pobj = sk_X509_OBJECT_value(ctx->ctx->objs, i);
641.               /* See if we've run past the matches */
642. >             if (pobj->type != X509_LU_X509)
643.                   break;
644.               if (X509_NAME_cmp(xn, X509_get_subject_name(pobj->data.x509)))
