crypto/x509/x509_lu.c:685: error: NULL_DEREFERENCE
  pointer `pobj` last assigned on line 683 could be null and is dereferenced at line 685, column 8.
Showing all 44 steps of the trace


crypto/x509/x509_lu.c:639:1: start of procedure X509_STORE_CTX_get1_issuer()
637.    * -1 some other error.
638.    */
639. > int X509_STORE_CTX_get1_issuer(X509 **issuer, X509_STORE_CTX *ctx, X509 *x)
640.   	{
641.   	X509_NAME *xn;

crypto/x509/x509_lu.c:644:2: 
642.   	X509_OBJECT obj, *pobj;
643.   	int i, ok, idx, ret;
644. > 	*issuer = NULL;
645.   	xn=X509_get_issuer_name(x);
646.   	ok=X509_STORE_get_by_subject(ctx,X509_LU_X509,xn,&obj);

crypto/x509/x509_lu.c:645:2: 
643.   	int i, ok, idx, ret;
644.   	*issuer = NULL;
645. > 	xn=X509_get_issuer_name(x);
646.   	ok=X509_STORE_get_by_subject(ctx,X509_LU_X509,xn,&obj);
647.   	if (ok != X509_LU_X509)

crypto/x509/x509_cmp.c:130:1: start of procedure X509_get_issuer_name()
  128.   #endif
  129.   
  130. > X509_NAME *X509_get_issuer_name(X509 *a)
  131.   	{
  132.   	return(a->cert_info->issuer);

crypto/x509/x509_cmp.c:132:2: 
  130.   X509_NAME *X509_get_issuer_name(X509 *a)
  131.   	{
  132. > 	return(a->cert_info->issuer);
  133.   	}
  134.   

crypto/x509/x509_cmp.c:133:2: return from a call to X509_get_issuer_name
  131.   	{
  132.   	return(a->cert_info->issuer);
  133.   	}
          ^
  134.   
  135.   unsigned long X509_issuer_name_hash(X509 *x)

crypto/x509/x509_lu.c:646:2: Skipping X509_STORE_get_by_subject(): empty list of specs
644.   	*issuer = NULL;
645.   	xn=X509_get_issuer_name(x);
646.   	ok=X509_STORE_get_by_subject(ctx,X509_LU_X509,xn,&obj);
        ^
647.   	if (ok != X509_LU_X509)
648.   		{

crypto/x509/x509_lu.c:647:6: Taking false branch
645.   	xn=X509_get_issuer_name(x);
646.   	ok=X509_STORE_get_by_subject(ctx,X509_LU_X509,xn,&obj);
647.   	if (ok != X509_LU_X509)
            ^
648.   		{
649.   		if (ok == X509_LU_RETRY)

crypto/x509/x509_lu.c:664:6: Taking false branch
662.   		}
663.   	/* If certificate matches all OK */
664.   	if (ctx->check_issued(ctx, x, obj.data.x509))
            ^
665.   		{
666.   		if (x509_check_cert_time(ctx, obj.data.x509, 1))

crypto/x509/x509_lu.c:672:2: 
670.   			}
671.   		}
672. > 	X509_OBJECT_free_contents(&obj);
673.   
674.   	/* Else find index of first cert accepted by 'check_issued' */

crypto/x509/x509_lu.c:427:1: start of procedure X509_OBJECT_free_contents()
  425.   	}
  426.   
  427. > void X509_OBJECT_free_contents(X509_OBJECT *a)
  428.   	{
  429.   	switch (a->type)

crypto/x509/x509_lu.c:429:2: 
  427.   void X509_OBJECT_free_contents(X509_OBJECT *a)
  428.   	{
  429. > 	switch (a->type)
  430.   		{
  431.   	case X509_LU_X509:

crypto/x509/x509_lu.c:431:2: Switch condition is false. Skipping switch case
  429.   	switch (a->type)
  430.   		{
  431.   	case X509_LU_X509:
          ^
  432.   		X509_free(a->data.x509);
  433.   		break;

crypto/x509/x509_lu.c:434:2: Switch condition is false. Skipping switch case
  432.   		X509_free(a->data.x509);
  433.   		break;
  434.   	case X509_LU_CRL:
          ^
  435.   		X509_CRL_free(a->data.crl);
  436.   		break;

crypto/x509/x509_lu.c:438:2: return from a call to X509_OBJECT_free_contents
  436.   		break;
  437.   		}
  438.   	}
          ^
  439.   
  440.   static int x509_object_idx_cnt(STACK_OF(X509_OBJECT) *h, int type,

crypto/x509/x509_lu.c:675:2: 
673.   
674.   	/* Else find index of first cert accepted by 'check_issued' */
675. > 	ret = 0;
676.   	CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);
677.   	idx = X509_OBJECT_idx_by_subject(ctx->ctx->objs, X509_LU_X509, xn);

crypto/x509/x509_lu.c:676:2: 
674.   	/* Else find index of first cert accepted by 'check_issued' */
675.   	ret = 0;
676. > 	CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);
677.   	idx = X509_OBJECT_idx_by_subject(ctx->ctx->objs, X509_LU_X509, xn);
678.   	if (idx != -1) /* should be true as we've had at least one match */

crypto/lock.c:423:1: start of procedure CRYPTO_lock()
  421.   	}
  422.   
  423. > void CRYPTO_lock(int mode, int type, const char *file, int line)
  424.   	{
  425.   #ifdef LOCK_DEBUG

crypto/lock.c:450:6: Taking false branch
  448.   		}
  449.   #endif
  450.   	if (type < 0)
              ^
  451.   		{
  452.   		if (dynlock_lock_callback != NULL)

crypto/lock.c:465:7: Taking true branch
  463.   		}
  464.   	else
  465.   		if (locking_callback != NULL)
               ^
  466.   			locking_callback(mode,type,file,line);
  467.   	}

crypto/lock.c:466:4: Skipping __function_pointer__(): unresolved function pointer
  464.   	else
  465.   		if (locking_callback != NULL)
  466.   			locking_callback(mode,type,file,line);
            ^
  467.   	}
  468.   

crypto/lock.c:450:2: 
  448.   		}
  449.   #endif
  450. > 	if (type < 0)
  451.   		{
  452.   		if (dynlock_lock_callback != NULL)

crypto/lock.c:467:2: return from a call to CRYPTO_lock
  465.   		if (locking_callback != NULL)
  466.   			locking_callback(mode,type,file,line);
  467.   	}
          ^
  468.   
  469.   int CRYPTO_add_lock(int *pointer, int amount, int type, const char *file,

crypto/x509/x509_lu.c:677:2: 
675.   	ret = 0;
676.   	CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);
677. > 	idx = X509_OBJECT_idx_by_subject(ctx->ctx->objs, X509_LU_X509, xn);
678.   	if (idx != -1) /* should be true as we've had at least one match */
679.   		{

crypto/x509/x509_lu.c:487:1: start of procedure X509_OBJECT_idx_by_subject()
  485.   
  486.   
  487. > int X509_OBJECT_idx_by_subject(STACK_OF(X509_OBJECT) *h, int type,
  488.   	     X509_NAME *name)
  489.   	{

crypto/x509/x509_lu.c:490:2: Skipping x509_object_idx_cnt(): empty list of specs
  488.   	     X509_NAME *name)
  489.   	{
  490.   	return x509_object_idx_cnt(h, type, name, NULL);
          ^
  491.   	}
  492.   

crypto/x509/x509_lu.c:491:2: return from a call to X509_OBJECT_idx_by_subject
  489.   	{
  490.   	return x509_object_idx_cnt(h, type, name, NULL);
  491.   	}
          ^
  492.   
  493.   X509_OBJECT *X509_OBJECT_retrieve_by_subject(STACK_OF(X509_OBJECT) *h, int type,

crypto/x509/x509_lu.c:678:6: Taking true branch
676.   	CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);
677.   	idx = X509_OBJECT_idx_by_subject(ctx->ctx->objs, X509_LU_X509, xn);
678.   	if (idx != -1) /* should be true as we've had at least one match */
            ^
679.   		{
680.   		/* Look through all matching certs for suitable issuer */

crypto/x509/x509_lu.c:681:8: 
679.   		{
680.   		/* Look through all matching certs for suitable issuer */
681. > 		for (i = idx; i < sk_X509_OBJECT_num(ctx->ctx->objs); i++)
682.   			{
683.   			pobj = sk_X509_OBJECT_value(ctx->ctx->objs, i);

crypto/x509/x509_lu.c:681:21: Condition is true
679.   		{
680.   		/* Look through all matching certs for suitable issuer */
681.   		for (i = idx; i < sk_X509_OBJECT_num(ctx->ctx->objs); i++)
                           ^
682.   			{
683.   			pobj = sk_X509_OBJECT_value(ctx->ctx->objs, i);

crypto/x509/x509_lu.c:681:17: 
679.   		{
680.   		/* Look through all matching certs for suitable issuer */
681. > 		for (i = idx; i < sk_X509_OBJECT_num(ctx->ctx->objs); i++)
682.   			{
683.   			pobj = sk_X509_OBJECT_value(ctx->ctx->objs, i);

crypto/stack/stack.c:331:1: start of procedure sk_num()
  329.   	}
  330.   
  331. > int sk_num(const _STACK *st)
  332.   {
  333.   	if(st == NULL) return -1;

crypto/stack/stack.c:333:5: Taking false branch
  331.   int sk_num(const _STACK *st)
  332.   {
  333.   	if(st == NULL) return -1;
             ^
  334.   	return st->num;
  335.   }

crypto/stack/stack.c:334:2: 
  332.   {
  333.   	if(st == NULL) return -1;
  334. > 	return st->num;
  335.   }
  336.   

crypto/stack/stack.c:335:1: return from a call to sk_num
  333.   	if(st == NULL) return -1;
  334.   	return st->num;
  335. > }
  336.   
  337.   void *sk_value(const _STACK *st, int i)

crypto/x509/x509_lu.c:681:17: Loop condition is true. Entering loop body
679.   		{
680.   		/* Look through all matching certs for suitable issuer */
681.   		for (i = idx; i < sk_X509_OBJECT_num(ctx->ctx->objs); i++)
                       ^
682.   			{
683.   			pobj = sk_X509_OBJECT_value(ctx->ctx->objs, i);

crypto/x509/x509_lu.c:683:11: Condition is true
681.   		for (i = idx; i < sk_X509_OBJECT_num(ctx->ctx->objs); i++)
682.   			{
683.   			pobj = sk_X509_OBJECT_value(ctx->ctx->objs, i);
                 ^
684.   			/* See if we've run past the matches */
685.   			if (pobj->type != X509_LU_X509)

crypto/x509/x509_lu.c:683:4: 
681.   		for (i = idx; i < sk_X509_OBJECT_num(ctx->ctx->objs); i++)
682.   			{
683. > 			pobj = sk_X509_OBJECT_value(ctx->ctx->objs, i);
684.   			/* See if we've run past the matches */
685.   			if (pobj->type != X509_LU_X509)

crypto/stack/stack.c:337:1: start of procedure sk_value()
  335.   }
  336.   
  337. > void *sk_value(const _STACK *st, int i)
  338.   {
  339.   	if(!st || (i < 0) || (i >= st->num)) return NULL;

crypto/stack/stack.c:339:6: Taking false branch
  337.   void *sk_value(const _STACK *st, int i)
  338.   {
  339.   	if(!st || (i < 0) || (i >= st->num)) return NULL;
              ^
  340.   	return st->data[i];
  341.   }

crypto/stack/stack.c:339:13: Taking true branch
  337.   void *sk_value(const _STACK *st, int i)
  338.   {
  339.   	if(!st || (i < 0) || (i >= st->num)) return NULL;
                     ^
  340.   	return st->data[i];
  341.   }

crypto/stack/stack.c:339:39: 
  337.   void *sk_value(const _STACK *st, int i)
  338.   {
  339. > 	if(!st || (i < 0) || (i >= st->num)) return NULL;
  340.   	return st->data[i];
  341.   }

crypto/stack/stack.c:341:1: return from a call to sk_value
  339.   	if(!st || (i < 0) || (i >= st->num)) return NULL;
  340.   	return st->data[i];
  341. > }
  342.   
  343.   void *sk_set(_STACK *st, int i, void *value)

crypto/x509/x509_lu.c:685:8: 
683.   			pobj = sk_X509_OBJECT_value(ctx->ctx->objs, i);
684.   			/* See if we've run past the matches */
685. > 			if (pobj->type != X509_LU_X509)
686.   				break;
687.   			if (X509_NAME_cmp(xn, X509_get_subject_name(pobj->data.x509)))
