crypto/x509/x509_vfy.c:607: error: NULL_DEREFERENCE
  pointer `x` last assigned on line 589 could be null and is dereferenced by call to `X509_check_ca()` at line 607, column 9.
Showing all 26 steps of the trace


crypto/x509/x509_vfy.c:544:1: start of procedure check_chain_extensions()
542.    */
543.   
544. > static int check_chain_extensions(X509_STORE_CTX *ctx)
545.   {
546.   #ifdef OPENSSL_NO_CHAIN_VERIFY

crypto/x509/x509_vfy.c:549:2: 
547.   	return 1;
548.   #else
549. > 	int i, ok=0, must_be_ca, plen = 0;
550.   	X509 *x;
551.   	int (*cb)(int xok,X509_STORE_CTX *xctx);

crypto/x509/x509_vfy.c:552:2: 
550.   	X509 *x;
551.   	int (*cb)(int xok,X509_STORE_CTX *xctx);
552. > 	int proxy_path_length = 0;
553.   	int purpose;
554.   	int allow_proxy_certs;

crypto/x509/x509_vfy.c:555:2: 
553.   	int purpose;
554.   	int allow_proxy_certs;
555. > 	cb=ctx->verify_cb;
556.   
557.   	/*-

crypto/x509/x509_vfy.c:566:2: 
564.   	 *     all certificates in the chain except the leaf certificate.
565.   	 */
566. > 	must_be_ca = -1;
567.   
568.   	/* CRL path validation */

crypto/x509/x509_vfy.c:569:6: Taking false branch
567.   
568.   	/* CRL path validation */
569.   	if (ctx->parent)
            ^
570.   		{
571.   		allow_proxy_certs = 0;

crypto/x509/x509_vfy.c:577:7: Condition is true
575.   		{
576.   		allow_proxy_certs =
577.   			!!(ctx->param->flags & X509_V_FLAG_ALLOW_PROXY_CERTS);
             ^
578.   		/* A hack to keep people who don't want to modify their
579.   		   software happy */

crypto/x509/x509_vfy.c:577:4: 
575.   		{
576.   		allow_proxy_certs =
577. > 			!!(ctx->param->flags & X509_V_FLAG_ALLOW_PROXY_CERTS);
578.   		/* A hack to keep people who don't want to modify their
579.   		   software happy */

crypto/x509/x509_vfy.c:576:3: 
574.   	else
575.   		{
576. > 		allow_proxy_certs =
577.   			!!(ctx->param->flags & X509_V_FLAG_ALLOW_PROXY_CERTS);
578.   		/* A hack to keep people who don't want to modify their

crypto/x509/x509_vfy.c:580:7: Taking false branch
578.   		/* A hack to keep people who don't want to modify their
579.   		   software happy */
580.   		if (getenv("OPENSSL_ALLOW_PROXY_CERTS"))
             ^
581.   			allow_proxy_certs = 1;
582.   		purpose = ctx->param->purpose;

crypto/x509/x509_vfy.c:582:3: 
580.   		if (getenv("OPENSSL_ALLOW_PROXY_CERTS"))
581.   			allow_proxy_certs = 1;
582. > 		purpose = ctx->param->purpose;
583.   		}
584.   

crypto/x509/x509_vfy.c:586:7: 
584.   
585.   	/* Check all untrusted certificates */
586. > 	for (i = 0; i < ctx->last_untrusted; i++)
587.   		{
588.   		int ret;

crypto/x509/x509_vfy.c:586:14: Loop condition is true. Entering loop body
584.   
585.   	/* Check all untrusted certificates */
586.   	for (i = 0; i < ctx->last_untrusted; i++)
                    ^
587.   		{
588.   		int ret;

crypto/x509/x509_vfy.c:589:7: Condition is true
587.   		{
588.   		int ret;
589.   		x = sk_X509_value(ctx->chain, i);
             ^
590.   		if (!(ctx->param->flags & X509_V_FLAG_IGNORE_CRITICAL)
591.   			&& (x->ex_flags & EXFLAG_CRITICAL))

crypto/x509/x509_vfy.c:589:3: 
587.   		{
588.   		int ret;
589. > 		x = sk_X509_value(ctx->chain, i);
590.   		if (!(ctx->param->flags & X509_V_FLAG_IGNORE_CRITICAL)
591.   			&& (x->ex_flags & EXFLAG_CRITICAL))

crypto/stack/stack.c:338:1: start of procedure sk_value()
  336.   }
  337.   
  338. > void *sk_value(const _STACK *st, int i)
  339.   {
  340.   	if(!st || (i < 0) || (i >= st->num)) return NULL;

crypto/stack/stack.c:340:6: Taking false branch
  338.   void *sk_value(const _STACK *st, int i)
  339.   {
  340.   	if(!st || (i < 0) || (i >= st->num)) return NULL;
              ^
  341.   	return st->data[i];
  342.   }

crypto/stack/stack.c:340:13: Taking false branch
  338.   void *sk_value(const _STACK *st, int i)
  339.   {
  340.   	if(!st || (i < 0) || (i >= st->num)) return NULL;
                     ^
  341.   	return st->data[i];
  342.   }

crypto/stack/stack.c:340:24: Taking true branch
  338.   void *sk_value(const _STACK *st, int i)
  339.   {
  340.   	if(!st || (i < 0) || (i >= st->num)) return NULL;
                                ^
  341.   	return st->data[i];
  342.   }

crypto/stack/stack.c:340:39: 
  338.   void *sk_value(const _STACK *st, int i)
  339.   {
  340. > 	if(!st || (i < 0) || (i >= st->num)) return NULL;
  341.   	return st->data[i];
  342.   }

crypto/stack/stack.c:342:1: return from a call to sk_value
  340.   	if(!st || (i < 0) || (i >= st->num)) return NULL;
  341.   	return st->data[i];
  342. > }
  343.   
  344.   void *sk_set(_STACK *st, int i, void *value)

crypto/x509/x509_vfy.c:590:9: Taking false branch
588.   		int ret;
589.   		x = sk_X509_value(ctx->chain, i);
590.   		if (!(ctx->param->flags & X509_V_FLAG_IGNORE_CRITICAL)
               ^
591.   			&& (x->ex_flags & EXFLAG_CRITICAL))
592.   			{

crypto/x509/x509_vfy.c:599:8: Taking false branch
597.   			if (!ok) goto end;
598.   			}
599.   		if (!allow_proxy_certs && (x->ex_flags & EXFLAG_PROXY))
              ^
600.   			{
601.   			ctx->error = X509_V_ERR_PROXY_CERTIFICATES_NOT_ALLOWED;

crypto/x509/x509_vfy.c:607:3: 
605.   			if (!ok) goto end;
606.   			}
607. > 		ret = X509_check_ca(x);
608.   		switch(must_be_ca)
609.   			{

crypto/x509v3/v3_purp.c:539:1: start of procedure X509_check_ca()
  537.   }
  538.   
  539. > int X509_check_ca(X509 *x)
  540.   {
  541.   	if(!(x->ex_flags & EXFLAG_SET)) {

crypto/x509v3/v3_purp.c:541:7: 
  539.   int X509_check_ca(X509 *x)
  540.   {
  541. > 	if(!(x->ex_flags & EXFLAG_SET)) {
  542.   		CRYPTO_w_lock(CRYPTO_LOCK_X509);
  543.   		x509v3_cache_extensions(x);
