crypto/x509/x509_req.c:204: error: NULL_DEREFERENCE
  pointer `attr` last assigned on line 203 could be null and is dereferenced at line 204, column 13.
Showing all 47 steps of the trace


crypto/x509/x509_req.c:190:1: start of procedure X509_REQ_get_extensions()
188.   }
189.   
190. > STACK_OF(X509_EXTENSION) *X509_REQ_get_extensions(X509_REQ *req)
191.   {
192.       X509_ATTRIBUTE *attr;

crypto/x509/x509_req.c:193:5: 
191.   {
192.       X509_ATTRIBUTE *attr;
193. >     ASN1_TYPE *ext = NULL;
194.       int idx, *pnid;
195.       const unsigned char *p;

crypto/x509/x509_req.c:197:10: Taking false branch
195.       const unsigned char *p;
196.   
197.       if ((req == NULL) || (req->req_info == NULL) || !ext_nids)
                ^
198.           return (NULL);
199.       for (pnid = ext_nids; *pnid != NID_undef; pnid++) {

crypto/x509/x509_req.c:197:27: Taking false branch
195.       const unsigned char *p;
196.   
197.       if ((req == NULL) || (req->req_info == NULL) || !ext_nids)
                                 ^
198.           return (NULL);
199.       for (pnid = ext_nids; *pnid != NID_undef; pnid++) {

crypto/x509/x509_req.c:197:54: Taking false branch
195.       const unsigned char *p;
196.   
197.       if ((req == NULL) || (req->req_info == NULL) || !ext_nids)
                                                            ^
198.           return (NULL);
199.       for (pnid = ext_nids; *pnid != NID_undef; pnid++) {

crypto/x509/x509_req.c:199:10: 
197.       if ((req == NULL) || (req->req_info == NULL) || !ext_nids)
198.           return (NULL);
199. >     for (pnid = ext_nids; *pnid != NID_undef; pnid++) {
200.           idx = X509_REQ_get_attr_by_NID(req, *pnid, -1);
201.           if (idx == -1)

crypto/x509/x509_req.c:199:27: Loop condition is true. Entering loop body
197.       if ((req == NULL) || (req->req_info == NULL) || !ext_nids)
198.           return (NULL);
199.       for (pnid = ext_nids; *pnid != NID_undef; pnid++) {
                                 ^
200.           idx = X509_REQ_get_attr_by_NID(req, *pnid, -1);
201.           if (idx == -1)

crypto/x509/x509_req.c:200:9: 
198.           return (NULL);
199.       for (pnid = ext_nids; *pnid != NID_undef; pnid++) {
200. >         idx = X509_REQ_get_attr_by_NID(req, *pnid, -1);
201.           if (idx == -1)
202.               continue;

crypto/x509/x509_req.c:272:1: start of procedure X509_REQ_get_attr_by_NID()
  270.   }
  271.   
  272. > int X509_REQ_get_attr_by_NID(const X509_REQ *req, int nid, int lastpos)
  273.   {
  274.       return X509at_get_attr_by_NID(req->req_info->attributes, nid, lastpos);

crypto/x509/x509_req.c:274:5: 
  272.   int X509_REQ_get_attr_by_NID(const X509_REQ *req, int nid, int lastpos)
  273.   {
  274. >     return X509at_get_attr_by_NID(req->req_info->attributes, nid, lastpos);
  275.   }
  276.   

crypto/x509/x509_att.c:73:1: start of procedure X509at_get_attr_by_NID()
    71.   }
    72.   
    73. > int X509at_get_attr_by_NID(const STACK_OF(X509_ATTRIBUTE) *x, int nid,
    74.                              int lastpos)
    75.   {

crypto/x509/x509_att.c:78:5: 
    76.       ASN1_OBJECT *obj;
    77.   
    78. >     obj = OBJ_nid2obj(nid);
    79.       if (obj == NULL)
    80.           return (-2);

crypto/objects/obj_dat.c:300:1: start of procedure OBJ_nid2obj()
      298.   }
      299.   
      300. > ASN1_OBJECT *OBJ_nid2obj(int n)
      301.   {
      302.       ADDED_OBJ ad, *adp;

crypto/objects/obj_dat.c:305:10: Taking true branch
      303.       ASN1_OBJECT ob;
      304.   
      305.       if ((n >= 0) && (n < NUM_NID)) {
                      ^
      306.           if ((n != NID_undef) && (nid_objs[n].nid == NID_undef)) {
      307.               OBJerr(OBJ_F_OBJ_NID2OBJ, OBJ_R_UNKNOWN_NID);

crypto/objects/obj_dat.c:305:22: Taking false branch
      303.       ASN1_OBJECT ob;
      304.   
      305.       if ((n >= 0) && (n < NUM_NID)) {
                                  ^
      306.           if ((n != NID_undef) && (nid_objs[n].nid == NID_undef)) {
      307.               OBJerr(OBJ_F_OBJ_NID2OBJ, OBJ_R_UNKNOWN_NID);

crypto/objects/obj_dat.c:311:16: Taking false branch
      309.           }
      310.           return ((ASN1_OBJECT *)&(nid_objs[n]));
      311.       } else if (added == NULL)
                            ^
      312.           return (NULL);
      313.       else {

crypto/objects/obj_dat.c:314:9: 
      312.           return (NULL);
      313.       else {
      314. >         ad.type = ADDED_NID;
      315.           ad.obj = &ob;
      316.           ob.nid = n;

crypto/objects/obj_dat.c:315:9: 
      313.       else {
      314.           ad.type = ADDED_NID;
      315. >         ad.obj = &ob;
      316.           ob.nid = n;
      317.           adp = lh_ADDED_OBJ_retrieve(added, &ad);

crypto/objects/obj_dat.c:316:9: 
      314.           ad.type = ADDED_NID;
      315.           ad.obj = &ob;
      316. >         ob.nid = n;
      317.           adp = lh_ADDED_OBJ_retrieve(added, &ad);
      318.           if (adp != NULL)

crypto/objects/obj_dat.c:317:15: Condition is true
      315.           ad.obj = &ob;
      316.           ob.nid = n;
      317.           adp = lh_ADDED_OBJ_retrieve(added, &ad);
                           ^
      318.           if (adp != NULL)
      319.               return (adp->obj);

crypto/objects/obj_dat.c:317:15: Condition is true
      315.           ad.obj = &ob;
      316.           ob.nid = n;
      317.           adp = lh_ADDED_OBJ_retrieve(added, &ad);
                           ^
      318.           if (adp != NULL)
      319.               return (adp->obj);

crypto/objects/obj_dat.c:317:9: 
      315.           ad.obj = &ob;
      316.           ob.nid = n;
      317. >         adp = lh_ADDED_OBJ_retrieve(added, &ad);
      318.           if (adp != NULL)
      319.               return (adp->obj);

crypto/lhash/lhash.c:239:1: start of procedure lh_retrieve()
        237.   }
        238.   
        239. > void *lh_retrieve(_LHASH *lh, const void *data)
        240.   {
        241.       unsigned long hash;

crypto/lhash/lhash.c:245:5: 
        243.       void *ret;
        244.   
        245. >     lh->error = 0;
        246.       rn = getrn(lh, data, &hash);
        247.   

crypto/lhash/lhash.c:246:5: Skipping getrn(): empty list of specs
        244.   
        245.       lh->error = 0;
        246.       rn = getrn(lh, data, &hash);
                   ^
        247.   
        248.       if (*rn == NULL) {

crypto/lhash/lhash.c:248:9: Taking false branch
        246.       rn = getrn(lh, data, &hash);
        247.   
        248.       if (*rn == NULL) {
                       ^
        249.           lh->num_retrieve_miss++;
        250.           return (NULL);

crypto/lhash/lhash.c:252:9: 
        250.           return (NULL);
        251.       } else {
        252. >         ret = (*rn)->data;
        253.           lh->num_retrieve++;
        254.       }

crypto/lhash/lhash.c:253:9: 
        251.       } else {
        252.           ret = (*rn)->data;
        253. >         lh->num_retrieve++;
        254.       }
        255.       return (ret);

crypto/lhash/lhash.c:255:5: 
        253.           lh->num_retrieve++;
        254.       }
        255. >     return (ret);
        256.   }
        257.   

crypto/lhash/lhash.c:256:1: return from a call to lh_retrieve
        254.       }
        255.       return (ret);
        256. > }
        257.   
        258.   static void doall_util_fn(_LHASH *lh, int use_arg, LHASH_DOALL_FN_TYPE func,

crypto/objects/obj_dat.c:318:13: Taking true branch
      316.           ob.nid = n;
      317.           adp = lh_ADDED_OBJ_retrieve(added, &ad);
      318.           if (adp != NULL)
                         ^
      319.               return (adp->obj);
      320.           else {

crypto/objects/obj_dat.c:319:13: 
      317.           adp = lh_ADDED_OBJ_retrieve(added, &ad);
      318.           if (adp != NULL)
      319. >             return (adp->obj);
      320.           else {
      321.               OBJerr(OBJ_F_OBJ_NID2OBJ, OBJ_R_UNKNOWN_NID);

crypto/objects/obj_dat.c:325:1: return from a call to OBJ_nid2obj
      323.           }
      324.       }
      325. > }
      326.   
      327.   const char *OBJ_nid2sn(int n)

crypto/x509/x509_att.c:79:9: Taking false branch
    77.   
    78.       obj = OBJ_nid2obj(nid);
    79.       if (obj == NULL)
                  ^
    80.           return (-2);
    81.       return (X509at_get_attr_by_OBJ(x, obj, lastpos));

crypto/x509/x509_att.c:81:5: Skipping X509at_get_attr_by_OBJ(): empty list of specs
    79.       if (obj == NULL)
    80.           return (-2);
    81.       return (X509at_get_attr_by_OBJ(x, obj, lastpos));
              ^
    82.   }
    83.   

crypto/x509/x509_att.c:82:1: return from a call to X509at_get_attr_by_NID
    80.           return (-2);
    81.       return (X509at_get_attr_by_OBJ(x, obj, lastpos));
    82. > }
    83.   
    84.   int X509at_get_attr_by_OBJ(const STACK_OF(X509_ATTRIBUTE) *sk,

crypto/x509/x509_req.c:275:1: return from a call to X509_REQ_get_attr_by_NID
  273.   {
  274.       return X509at_get_attr_by_NID(req->req_info->attributes, nid, lastpos);
  275. > }
  276.   
  277.   int X509_REQ_get_attr_by_OBJ(const X509_REQ *req, ASN1_OBJECT *obj,

crypto/x509/x509_req.c:201:13: Taking false branch
199.       for (pnid = ext_nids; *pnid != NID_undef; pnid++) {
200.           idx = X509_REQ_get_attr_by_NID(req, *pnid, -1);
201.           if (idx == -1)
                   ^
202.               continue;
203.           attr = X509_REQ_get_attr(req, idx);

crypto/x509/x509_req.c:203:9: 
201.           if (idx == -1)
202.               continue;
203. >         attr = X509_REQ_get_attr(req, idx);
204.           if (attr->single)
205.               ext = attr->value.single;

crypto/x509/x509_req.c:283:1: start of procedure X509_REQ_get_attr()
  281.   }
  282.   
  283. > X509_ATTRIBUTE *X509_REQ_get_attr(const X509_REQ *req, int loc)
  284.   {
  285.       return X509at_get_attr(req->req_info->attributes, loc);

crypto/x509/x509_req.c:285:5: 
  283.   X509_ATTRIBUTE *X509_REQ_get_attr(const X509_REQ *req, int loc)
  284.   {
  285. >     return X509at_get_attr(req->req_info->attributes, loc);
  286.   }
  287.   

crypto/x509/x509_att.c:104:1: start of procedure X509at_get_attr()
    102.   }
    103.   
    104. > X509_ATTRIBUTE *X509at_get_attr(const STACK_OF(X509_ATTRIBUTE) *x, int loc)
    105.   {
    106.       if (x == NULL || sk_X509_ATTRIBUTE_num(x) <= loc || loc < 0)

crypto/x509/x509_att.c:106:9: Taking true branch
    104.   X509_ATTRIBUTE *X509at_get_attr(const STACK_OF(X509_ATTRIBUTE) *x, int loc)
    105.   {
    106.       if (x == NULL || sk_X509_ATTRIBUTE_num(x) <= loc || loc < 0)
                   ^
    107.           return NULL;
    108.       else

crypto/x509/x509_att.c:107:9: 
    105.   {
    106.       if (x == NULL || sk_X509_ATTRIBUTE_num(x) <= loc || loc < 0)
    107. >         return NULL;
    108.       else
    109.           return sk_X509_ATTRIBUTE_value(x, loc);

crypto/x509/x509_att.c:110:1: return from a call to X509at_get_attr
    108.       else
    109.           return sk_X509_ATTRIBUTE_value(x, loc);
    110. > }
    111.   
    112.   X509_ATTRIBUTE *X509at_delete_attr(STACK_OF(X509_ATTRIBUTE) *x, int loc)

crypto/x509/x509_req.c:286:1: return from a call to X509_REQ_get_attr
  284.   {
  285.       return X509at_get_attr(req->req_info->attributes, loc);
  286. > }
  287.   
  288.   X509_ATTRIBUTE *X509_REQ_delete_attr(X509_REQ *req, int loc)

crypto/x509/x509_req.c:204:13: Taking false branch
202.               continue;
203.           attr = X509_REQ_get_attr(req, idx);
204.           if (attr->single)
                   ^
205.               ext = attr->value.single;
206.           else if (sk_ASN1_TYPE_num(attr->value.set))
