apps/s_server.c:722: error: NULL_DEREFERENCE
  pointer `x` last assigned on line 721 could be null and is dereferenced by call to `X509_get1_ocsp()` at line 722, column 8.
Showing all 40 steps of the trace


apps/s_server.c:695:1: start of procedure cert_status_cb()
693.    */
694.   
695. > static int cert_status_cb(SSL *s, void *arg)
696.   	{
697.   	tlsextstatusctx *srctx = arg;

apps/s_server.c:697:2: 
695.   static int cert_status_cb(SSL *s, void *arg)
696.   	{
697. > 	tlsextstatusctx *srctx = arg;
698.   	BIO *err = srctx->err;
699.   	char *host, *port, *path;

apps/s_server.c:698:2: 
696.   	{
697.   	tlsextstatusctx *srctx = arg;
698. > 	BIO *err = srctx->err;
699.   	char *host, *port, *path;
700.   	int use_ssl;

apps/s_server.c:701:2: 
699.   	char *host, *port, *path;
700.   	int use_ssl;
701. > 	unsigned char *rspder = NULL;
702.   	int rspderlen;
703.   	STACK *aia = NULL;

apps/s_server.c:703:2: 
701.   	unsigned char *rspder = NULL;
702.   	int rspderlen;
703. > 	STACK *aia = NULL;
704.   	X509 *x = NULL;
705.   	X509_STORE_CTX inctx;

apps/s_server.c:704:2: 
702.   	int rspderlen;
703.   	STACK *aia = NULL;
704. > 	X509 *x = NULL;
705.   	X509_STORE_CTX inctx;
706.   	X509_OBJECT obj;

apps/s_server.c:707:2: 
705.   	X509_STORE_CTX inctx;
706.   	X509_OBJECT obj;
707. > 	OCSP_REQUEST *req = NULL;
708.   	OCSP_RESPONSE *resp = NULL;
709.   	OCSP_CERTID *id = NULL;

apps/s_server.c:708:2: 
706.   	X509_OBJECT obj;
707.   	OCSP_REQUEST *req = NULL;
708. > 	OCSP_RESPONSE *resp = NULL;
709.   	OCSP_CERTID *id = NULL;
710.   	STACK_OF(X509_EXTENSION) *exts;

apps/s_server.c:709:2: 
707.   	OCSP_REQUEST *req = NULL;
708.   	OCSP_RESPONSE *resp = NULL;
709. > 	OCSP_CERTID *id = NULL;
710.   	STACK_OF(X509_EXTENSION) *exts;
711.   	int ret = SSL_TLSEXT_ERR_NOACK;

apps/s_server.c:711:2: 
709.   	OCSP_CERTID *id = NULL;
710.   	STACK_OF(X509_EXTENSION) *exts;
711. > 	int ret = SSL_TLSEXT_ERR_NOACK;
712.   	int i;
713.   #if 0

apps/s_server.c:718:6: Taking true branch
716.   BIO_printf(err, "cert_status: received %d ids\n", sk_OCSP_RESPID_num(ids));
717.   #endif
718.   	if (srctx->verbose)
            ^
719.   		BIO_puts(err, "cert_status: callback called\n");
720.   	/* Build up OCSP query from server certificate */

apps/s_server.c:719:3: 
717.   #endif
718.   	if (srctx->verbose)
719. > 		BIO_puts(err, "cert_status: callback called\n");
720.   	/* Build up OCSP query from server certificate */
721.   	x = SSL_get_certificate(s);

crypto/bio/bio_lib.c:257:1: start of procedure BIO_puts()
  255.   	}
  256.   
  257. > int BIO_puts(BIO *b, const char *in)
  258.   	{
  259.   	int i;

crypto/bio/bio_lib.c:262:7: Taking false branch
  260.   	long (*cb)(BIO *,int,const char *,int,long,long);
  261.   
  262.   	if ((b == NULL) || (b->method == NULL) || (b->method->bputs == NULL))
               ^
  263.   		{
  264.   		BIOerr(BIO_F_BIO_PUTS,BIO_R_UNSUPPORTED_METHOD);

crypto/bio/bio_lib.c:262:22: Taking false branch
  260.   	long (*cb)(BIO *,int,const char *,int,long,long);
  261.   
  262.   	if ((b == NULL) || (b->method == NULL) || (b->method->bputs == NULL))
                              ^
  263.   		{
  264.   		BIOerr(BIO_F_BIO_PUTS,BIO_R_UNSUPPORTED_METHOD);

crypto/bio/bio_lib.c:262:45: Taking false branch
  260.   	long (*cb)(BIO *,int,const char *,int,long,long);
  261.   
  262.   	if ((b == NULL) || (b->method == NULL) || (b->method->bputs == NULL))
                                                     ^
  263.   		{
  264.   		BIOerr(BIO_F_BIO_PUTS,BIO_R_UNSUPPORTED_METHOD);

crypto/bio/bio_lib.c:268:2: 
  266.   		}
  267.   
  268. > 	cb=b->callback;
  269.   
  270.   	if ((cb != NULL) &&

crypto/bio/bio_lib.c:270:7: Taking false branch
  268.   	cb=b->callback;
  269.   
  270.   	if ((cb != NULL) &&
               ^
  271.   		((i=(int)cb(b,BIO_CB_PUTS,in,0,0L,1L)) <= 0))
  272.   			return(i);

crypto/bio/bio_lib.c:274:7: Taking true branch
  272.   			return(i);
  273.   
  274.   	if (!b->init)
               ^
  275.   		{
  276.   		BIOerr(BIO_F_BIO_PUTS,BIO_R_UNINITIALIZED);

crypto/bio/bio_lib.c:276:3: 
  274.   	if (!b->init)
  275.   		{
  276. > 		BIOerr(BIO_F_BIO_PUTS,BIO_R_UNINITIALIZED);
  277.   		return(-2);
  278.   		}

crypto/err/err.c:680:1: start of procedure ERR_put_error()
    678.   /********************************************************/
    679.   
    680. > void ERR_put_error(int lib, int func, int reason, const char *file,
    681.   	     int line)
    682.   	{

crypto/err/err.c:704:2: Skipping ERR_get_state(): empty list of specs
    702.   	}
    703.   #endif
    704.   	es=ERR_get_state();
            ^
    705.   
    706.   	es->top=(es->top+1)%ERR_NUM_ERRORS;

crypto/err/err.c:706:2: 
    704.   	es=ERR_get_state();
    705.   
    706. > 	es->top=(es->top+1)%ERR_NUM_ERRORS;
    707.   	if (es->top == es->bottom)
    708.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;

crypto/err/err.c:707:6: Taking false branch
    705.   
    706.   	es->top=(es->top+1)%ERR_NUM_ERRORS;
    707.   	if (es->top == es->bottom)
                ^
    708.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
    709.   	es->err_flags[es->top]=0;

crypto/err/err.c:709:2: 
    707.   	if (es->top == es->bottom)
    708.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
    709. > 	es->err_flags[es->top]=0;
    710.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
    711.   	es->err_file[es->top]=file;

crypto/err/err.c:710:2: 
    708.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
    709.   	es->err_flags[es->top]=0;
    710. > 	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
    711.   	es->err_file[es->top]=file;
    712.   	es->err_line[es->top]=line;

crypto/err/err.c:711:2: 
    709.   	es->err_flags[es->top]=0;
    710.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
    711. > 	es->err_file[es->top]=file;
    712.   	es->err_line[es->top]=line;
    713.   	err_clear_data(es,es->top);

crypto/err/err.c:712:2: 
    710.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
    711.   	es->err_file[es->top]=file;
    712. > 	es->err_line[es->top]=line;
    713.   	err_clear_data(es,es->top);
    714.   	}

crypto/err/err.c:713:2: Taking true branch
    711.   	es->err_file[es->top]=file;
    712.   	es->err_line[es->top]=line;
    713.   	err_clear_data(es,es->top);
            ^
    714.   	}
    715.   

crypto/err/err.c:713:2: Taking false branch
    711.   	es->err_file[es->top]=file;
    712.   	es->err_line[es->top]=line;
    713.   	err_clear_data(es,es->top);
            ^
    714.   	}
    715.   

crypto/err/err.c:713:2: Loop condition is false. Leaving loop
    711.   	es->err_file[es->top]=file;
    712.   	es->err_line[es->top]=line;
    713.   	err_clear_data(es,es->top);
            ^
    714.   	}
    715.   

crypto/err/err.c:714:2: return from a call to ERR_put_error
    712.   	es->err_line[es->top]=line;
    713.   	err_clear_data(es,es->top);
    714.   	}
            ^
    715.   
    716.   void ERR_clear_error(void)

crypto/bio/bio_lib.c:277:3: 
  275.   		{
  276.   		BIOerr(BIO_F_BIO_PUTS,BIO_R_UNINITIALIZED);
  277. > 		return(-2);
  278.   		}
  279.   

crypto/bio/bio_lib.c:288:2: return from a call to BIO_puts
  286.   			0L,(long)i);
  287.   	return(i);
  288.   	}
          ^
  289.   
  290.   int BIO_gets(BIO *b, char *in, int inl)

apps/s_server.c:721:2: 
719.   		BIO_puts(err, "cert_status: callback called\n");
720.   	/* Build up OCSP query from server certificate */
721. > 	x = SSL_get_certificate(s);
722.   	aia = X509_get1_ocsp(x);
723.   	if (aia)

ssl/ssl_lib.c:2449:1: start of procedure SSL_get_certificate()
  2447.   
  2448.   /* Fix this function so that it takes an optional type parameter */
  2449. > X509 *SSL_get_certificate(const SSL *s)
  2450.   	{
  2451.   	if (s->cert != NULL)

ssl/ssl_lib.c:2451:6: Taking false branch
  2449.   X509 *SSL_get_certificate(const SSL *s)
  2450.   	{
  2451.   	if (s->cert != NULL)
               ^
  2452.   		return(s->cert->key->x509);
  2453.   	else

ssl/ssl_lib.c:2454:3: 
  2452.   		return(s->cert->key->x509);
  2453.   	else
  2454. > 		return(NULL);
  2455.   	}
  2456.   

ssl/ssl_lib.c:2455:2: return from a call to SSL_get_certificate
  2453.   	else
  2454.   		return(NULL);
  2455.   	}
           ^
  2456.   
  2457.   /* Fix this function so that it takes an optional type parameter */

apps/s_server.c:722:2: 
720.   	/* Build up OCSP query from server certificate */
721.   	x = SSL_get_certificate(s);
722. > 	aia = X509_get1_ocsp(x);
723.   	if (aia)
724.   		{
