crypto/x509/x509_vfy.c:169: error: NULL_DEREFERENCE
  pointer `sktmp` last assigned on line 108 could be null and is dereferenced by call to `sk_delete_ptr()` at line 169, column 11.
Showing all 69 steps of the trace


crypto/x509/x509_vfy.c:99:1: start of procedure X509_verify_cert()
97.   #endif
98.   
99. > int X509_verify_cert(X509_STORE_CTX *ctx)
100.   	{
101.   	X509 *x,*xtmp,*chain_ss=NULL;

crypto/x509/x509_vfy.c:101:2: 
99.   int X509_verify_cert(X509_STORE_CTX *ctx)
100.   	{
101. > 	X509 *x,*xtmp,*chain_ss=NULL;
102.   	X509_NAME *xn;
103.   	int bad_chain = 0;

crypto/x509/x509_vfy.c:103:2: 
101.   	X509 *x,*xtmp,*chain_ss=NULL;
102.   	X509_NAME *xn;
103. > 	int bad_chain = 0;
104.   	X509_VERIFY_PARAM *param = ctx->param;
105.   	int depth,i,ok=0;

crypto/x509/x509_vfy.c:104:2: 
102.   	X509_NAME *xn;
103.   	int bad_chain = 0;
104. > 	X509_VERIFY_PARAM *param = ctx->param;
105.   	int depth,i,ok=0;
106.   	int num;

crypto/x509/x509_vfy.c:105:2: 
103.   	int bad_chain = 0;
104.   	X509_VERIFY_PARAM *param = ctx->param;
105. > 	int depth,i,ok=0;
106.   	int num;
107.   	int (*cb)(int xok,X509_STORE_CTX *xctx);

crypto/x509/x509_vfy.c:108:2: 
106.   	int num;
107.   	int (*cb)(int xok,X509_STORE_CTX *xctx);
108. > 	STACK_OF(X509) *sktmp=NULL;
109.   	if (ctx->cert == NULL)
110.   		{

crypto/x509/x509_vfy.c:109:6: Taking false branch
107.   	int (*cb)(int xok,X509_STORE_CTX *xctx);
108.   	STACK_OF(X509) *sktmp=NULL;
109.   	if (ctx->cert == NULL)
            ^
110.   		{
111.   		X509err(X509_F_X509_VERIFY_CERT,X509_R_NO_CERT_SET_FOR_US_TO_VERIFY);

crypto/x509/x509_vfy.c:115:2: 
113.   		}
114.   
115. > 	cb=ctx->verify_cb;
116.   
117.   	/* first we make sure the chain we are going to build is

crypto/x509/x509_vfy.c:119:6: Taking false branch
117.   	/* first we make sure the chain we are going to build is
118.   	 * present and that the first entry is in place */
119.   	if (ctx->chain == NULL)
            ^
120.   		{
121.   		if (	((ctx->chain=sk_X509_new_null()) == NULL) ||

crypto/x509/x509_vfy.c:132:6: Taking false branch
130.   
131.   	/* We use a temporary STACK so we can chop and hack at it */
132.   	if (ctx->untrusted != NULL
            ^
133.   	    && (sktmp=sk_X509_dup(ctx->untrusted)) == NULL)
134.   		{

crypto/x509/x509_vfy.c:139:6: Condition is true
137.   		}
138.   
139.   	num=sk_X509_num(ctx->chain);
            ^
140.   	x=sk_X509_value(ctx->chain,num-1);
141.   	depth=param->depth;

crypto/x509/x509_vfy.c:139:2: 
137.   		}
138.   
139. > 	num=sk_X509_num(ctx->chain);
140.   	x=sk_X509_value(ctx->chain,num-1);
141.   	depth=param->depth;

crypto/stack/stack.c:302:1: start of procedure sk_num()
  300.   	}
  301.   
  302. > int sk_num(const _STACK *st)
  303.   {
  304.   	if(st == NULL) return -1;

crypto/stack/stack.c:304:5: Taking false branch
  302.   int sk_num(const _STACK *st)
  303.   {
  304.   	if(st == NULL) return -1;
             ^
  305.   	return st->num;
  306.   }

crypto/stack/stack.c:305:2: 
  303.   {
  304.   	if(st == NULL) return -1;
  305. > 	return st->num;
  306.   }
  307.   

crypto/stack/stack.c:306:1: return from a call to sk_num
  304.   	if(st == NULL) return -1;
  305.   	return st->num;
  306. > }
  307.   
  308.   void *sk_value(const _STACK *st, int i)

crypto/x509/x509_vfy.c:140:4: Condition is true
138.   
139.   	num=sk_X509_num(ctx->chain);
140.   	x=sk_X509_value(ctx->chain,num-1);
          ^
141.   	depth=param->depth;
142.   

crypto/x509/x509_vfy.c:140:2: 
138.   
139.   	num=sk_X509_num(ctx->chain);
140. > 	x=sk_X509_value(ctx->chain,num-1);
141.   	depth=param->depth;
142.   

crypto/stack/stack.c:308:1: start of procedure sk_value()
  306.   }
  307.   
  308. > void *sk_value(const _STACK *st, int i)
  309.   {
  310.   	if(!st || (i < 0) || (i >= st->num)) return NULL;

crypto/stack/stack.c:310:6: Taking false branch
  308.   void *sk_value(const _STACK *st, int i)
  309.   {
  310.   	if(!st || (i < 0) || (i >= st->num)) return NULL;
              ^
  311.   	return st->data[i];
  312.   }

crypto/stack/stack.c:310:13: Taking false branch
  308.   void *sk_value(const _STACK *st, int i)
  309.   {
  310.   	if(!st || (i < 0) || (i >= st->num)) return NULL;
                     ^
  311.   	return st->data[i];
  312.   }

crypto/stack/stack.c:310:24: Taking false branch
  308.   void *sk_value(const _STACK *st, int i)
  309.   {
  310.   	if(!st || (i < 0) || (i >= st->num)) return NULL;
                                ^
  311.   	return st->data[i];
  312.   }

crypto/stack/stack.c:311:2: 
  309.   {
  310.   	if(!st || (i < 0) || (i >= st->num)) return NULL;
  311. > 	return st->data[i];
  312.   }
  313.   

crypto/stack/stack.c:312:1: return from a call to sk_value
  310.   	if(!st || (i < 0) || (i >= st->num)) return NULL;
  311.   	return st->data[i];
  312. > }
  313.   
  314.   void *sk_set(_STACK *st, int i, void *value)

crypto/x509/x509_vfy.c:141:2: 
139.   	num=sk_X509_num(ctx->chain);
140.   	x=sk_X509_value(ctx->chain,num-1);
141. > 	depth=param->depth;
142.   
143.   

crypto/x509/x509_vfy.c:179:3: Loop condition is true. Entering loop body
177.   			}
178.   		break;
179.   		}
         ^
180.   
181.   	/* at this point, chain should contain a list of untrusted

crypto/x509/x509_vfy.c:147:7: Taking false branch
145.   		{
146.   		/* If we have enough, we break */
147.   		if (depth < num) break; /* FIXME: If this happens, we should take
             ^
148.   		                         * note of it and, if appropriate, use the
149.   		                         * X509_V_ERR_CERT_CHAIN_TOO_LONG error

crypto/x509/x509_vfy.c:154:3: 
152.   
153.   		/* If we are self signed, we break */
154. > 		xn=X509_get_issuer_name(x);
155.   		if (ctx->check_issued(ctx, x,x)) break;
156.   

crypto/x509/x509_cmp.c:126:1: start of procedure X509_get_issuer_name()
  124.   #endif
  125.   
  126. > X509_NAME *X509_get_issuer_name(X509 *a)
  127.   	{
  128.   	return(a->cert_info->issuer);

crypto/x509/x509_cmp.c:128:2: 
  126.   X509_NAME *X509_get_issuer_name(X509 *a)
  127.   	{
  128. > 	return(a->cert_info->issuer);
  129.   	}
  130.   

crypto/x509/x509_cmp.c:129:2: return from a call to X509_get_issuer_name
  127.   	{
  128.   	return(a->cert_info->issuer);
  129.   	}
          ^
  130.   
  131.   unsigned long X509_issuer_name_hash(X509 *x)

crypto/x509/x509_vfy.c:155:7: Taking false branch
153.   		/* If we are self signed, we break */
154.   		xn=X509_get_issuer_name(x);
155.   		if (ctx->check_issued(ctx, x,x)) break;
             ^
156.   
157.   		/* If we were passed a cert chain, use it first */

crypto/x509/x509_vfy.c:158:7: Taking true branch
156.   
157.   		/* If we were passed a cert chain, use it first */
158.   		if (ctx->untrusted != NULL)
             ^
159.   			{
160.   			xtmp=find_issuer(ctx, sktmp,x);

crypto/x509/x509_vfy.c:160:4: Skipping find_issuer(): empty list of specs
158.   		if (ctx->untrusted != NULL)
159.   			{
160.   			xtmp=find_issuer(ctx, sktmp,x);
          ^
161.   			if (xtmp != NULL)
162.   				{

crypto/x509/x509_vfy.c:161:8: Taking true branch
159.   			{
160.   			xtmp=find_issuer(ctx, sktmp,x);
161.   			if (xtmp != NULL)
              ^
162.   				{
163.   				if (!sk_X509_push(ctx->chain,xtmp))

crypto/x509/x509_vfy.c:163:10: Condition is true
161.   			if (xtmp != NULL)
162.   				{
163.   				if (!sk_X509_push(ctx->chain,xtmp))
                ^
164.   					{
165.   					X509err(X509_F_X509_VERIFY_CERT,ERR_R_MALLOC_FAILURE);

crypto/x509/x509_vfy.c:163:10: Condition is true
161.   			if (xtmp != NULL)
162.   				{
163.   				if (!sk_X509_push(ctx->chain,xtmp))
                ^
164.   					{
165.   					X509err(X509_F_X509_VERIFY_CERT,ERR_R_MALLOC_FAILURE);

crypto/stack/stack.c:252:1: start of procedure sk_push()
  250.   	}
  251.   
  252. > int sk_push(_STACK *st, void *data)
  253.   	{
  254.   	return(sk_insert(st,data,st->num));

crypto/stack/stack.c:254:2: Skipping sk_insert(): empty list of specs
  252.   int sk_push(_STACK *st, void *data)
  253.   	{
  254.   	return(sk_insert(st,data,st->num));
          ^
  255.   	}
  256.   

crypto/stack/stack.c:255:2: return from a call to sk_push
  253.   	{
  254.   	return(sk_insert(st,data,st->num));
  255.   	}
          ^
  256.   
  257.   int sk_unshift(_STACK *st, void *data)

crypto/x509/x509_vfy.c:163:10: Taking false branch
161.   			if (xtmp != NULL)
162.   				{
163.   				if (!sk_X509_push(ctx->chain,xtmp))
                ^
164.   					{
165.   					X509err(X509_F_X509_VERIFY_CERT,ERR_R_MALLOC_FAILURE);

crypto/x509/x509_vfy.c:168:5: 
166.   					goto end;
167.   					}
168. > 				CRYPTO_add(&xtmp->references,1,CRYPTO_LOCK_X509);
169.   				(void)sk_X509_delete_ptr(sktmp,xtmp);
170.   				ctx->last_untrusted++;

crypto/cryptlib.c:516:1: start of procedure CRYPTO_add_lock()
  514.   	}
  515.   
  516. > int CRYPTO_add_lock(int *pointer, int amount, int type, const char *file,
  517.   	     int line)
  518.   	{

crypto/cryptlib.c:519:2: 
  517.   	     int line)
  518.   	{
  519. > 	int ret = 0;
  520.   
  521.   	if (add_lock_callback != NULL)

crypto/cryptlib.c:521:6: Taking false branch
  519.   	int ret = 0;
  520.   
  521.   	if (add_lock_callback != NULL)
              ^
  522.   		{
  523.   #ifdef LOCK_DEBUG

crypto/cryptlib.c:538:3: 
  536.   	else
  537.   		{
  538. > 		CRYPTO_lock(CRYPTO_LOCK|CRYPTO_WRITE,type,file,line);
  539.   
  540.   		ret= *pointer+amount;

crypto/cryptlib.c:472:1: start of procedure CRYPTO_lock()
    470.   	}
    471.   
    472. > void CRYPTO_lock(int mode, int type, const char *file, int line)
    473.   	{
    474.   #ifdef LOCK_DEBUG

crypto/cryptlib.c:497:6: Taking false branch
    495.   		}
    496.   #endif
    497.   	if (type < 0)
                ^
    498.   		{
    499.   		if (dynlock_lock_callback != NULL)

crypto/cryptlib.c:512:7: Taking false branch
    510.   		}
    511.   	else
    512.   		if (locking_callback != NULL)
                 ^
    513.   			locking_callback(mode,type,file,line);
    514.   	}

crypto/cryptlib.c:497:2: 
    495.   		}
    496.   #endif
    497. > 	if (type < 0)
    498.   		{
    499.   		if (dynlock_lock_callback != NULL)

crypto/cryptlib.c:514:2: return from a call to CRYPTO_lock
    512.   		if (locking_callback != NULL)
    513.   			locking_callback(mode,type,file,line);
    514.   	}
            ^
    515.   
    516.   int CRYPTO_add_lock(int *pointer, int amount, int type, const char *file,

crypto/cryptlib.c:540:3: 
  538.   		CRYPTO_lock(CRYPTO_LOCK|CRYPTO_WRITE,type,file,line);
  539.   
  540. > 		ret= *pointer+amount;
  541.   #ifdef LOCK_DEBUG
  542.   		fprintf(stderr,"ladd:%08lx/%0xp:%2d+%2d->%2d %-18s %s:%d\n",

crypto/cryptlib.c:548:3: 
  546.   			file,line);
  547.   #endif
  548. > 		*pointer=ret;
  549.   		CRYPTO_lock(CRYPTO_UNLOCK|CRYPTO_WRITE,type,file,line);
  550.   		}

crypto/cryptlib.c:549:3: 
  547.   #endif
  548.   		*pointer=ret;
  549. > 		CRYPTO_lock(CRYPTO_UNLOCK|CRYPTO_WRITE,type,file,line);
  550.   		}
  551.   	return(ret);

crypto/cryptlib.c:472:1: start of procedure CRYPTO_lock()
    470.   	}
    471.   
    472. > void CRYPTO_lock(int mode, int type, const char *file, int line)
    473.   	{
    474.   #ifdef LOCK_DEBUG

crypto/cryptlib.c:497:6: Taking false branch
    495.   		}
    496.   #endif
    497.   	if (type < 0)
                ^
    498.   		{
    499.   		if (dynlock_lock_callback != NULL)

crypto/cryptlib.c:512:7: Taking false branch
    510.   		}
    511.   	else
    512.   		if (locking_callback != NULL)
                 ^
    513.   			locking_callback(mode,type,file,line);
    514.   	}

crypto/cryptlib.c:497:2: 
    495.   		}
    496.   #endif
    497. > 	if (type < 0)
    498.   		{
    499.   		if (dynlock_lock_callback != NULL)

crypto/cryptlib.c:514:2: return from a call to CRYPTO_lock
    512.   		if (locking_callback != NULL)
    513.   			locking_callback(mode,type,file,line);
    514.   	}
            ^
    515.   
    516.   int CRYPTO_add_lock(int *pointer, int amount, int type, const char *file,

crypto/cryptlib.c:551:2: 
  549.   		CRYPTO_lock(CRYPTO_UNLOCK|CRYPTO_WRITE,type,file,line);
  550.   		}
  551. > 	return(ret);
  552.   	}
  553.   

crypto/cryptlib.c:552:2: return from a call to CRYPTO_add_lock
  550.   		}
  551.   	return(ret);
  552.   	}
          ^
  553.   
  554.   const char *CRYPTO_get_lock_name(int type)

crypto/x509/x509_vfy.c:169:11: Condition is true
167.   					}
168.   				CRYPTO_add(&xtmp->references,1,CRYPTO_LOCK_X509);
169.   				(void)sk_X509_delete_ptr(sktmp,xtmp);
                 ^
170.   				ctx->last_untrusted++;
171.   				x=xtmp;

crypto/x509/x509_vfy.c:169:11: Condition is true
167.   					}
168.   				CRYPTO_add(&xtmp->references,1,CRYPTO_LOCK_X509);
169.   				(void)sk_X509_delete_ptr(sktmp,xtmp);
                 ^
170.   				ctx->last_untrusted++;
171.   				x=xtmp;

crypto/stack/stack.c:181:1: start of procedure sk_delete_ptr()
  179.   	}
  180.   
  181. > void *sk_delete_ptr(_STACK *st, void *p)
  182.   	{
  183.   	int i;

crypto/stack/stack.c:185:7: 
  183.   	int i;
  184.   
  185. > 	for (i=0; i<st->num; i++)
  186.   		if (st->data[i] == p)
  187.   			return(sk_delete(st,i));

crypto/stack/stack.c:185:12: Loop condition is true. Entering loop body
  183.   	int i;
  184.   
  185.   	for (i=0; i<st->num; i++)
                    ^
  186.   		if (st->data[i] == p)
  187.   			return(sk_delete(st,i));

crypto/stack/stack.c:186:7: Taking false branch
  184.   
  185.   	for (i=0; i<st->num; i++)
  186.   		if (st->data[i] == p)
               ^
  187.   			return(sk_delete(st,i));
  188.   	return(NULL);

crypto/stack/stack.c:185:23: 
  183.   	int i;
  184.   
  185. > 	for (i=0; i<st->num; i++)
  186.   		if (st->data[i] == p)
  187.   			return(sk_delete(st,i));

crypto/stack/stack.c:185:12: 
  183.   	int i;
  184.   
  185. > 	for (i=0; i<st->num; i++)
  186.   		if (st->data[i] == p)
  187.   			return(sk_delete(st,i));
