apps/ca.c:2120: error: NULL_DEREFERENCE
  pointer `null` is dereferenced by call to `X509_NAME_oneline()` at line 2120, column 20.
Showing all 34 steps of the trace


apps/ca.c:2109:1: start of procedure do_revoke()
2107.   }
2108.   
2109. > static int do_revoke(X509 *x509, CA_DB *db, REVINFO_TYPE rev_type,
2110.                        const char *value)
2111.   {

apps/ca.c:2112:5: 
2110.                        const char *value)
2111.   {
2112. >     const ASN1_TIME *tm = NULL;
2113.       char *row[DB_NUMBER], **rrow, **irow;
2114.       char *rev_str = NULL;

apps/ca.c:2114:5: 
2112.       const ASN1_TIME *tm = NULL;
2113.       char *row[DB_NUMBER], **rrow, **irow;
2114. >     char *rev_str = NULL;
2115.       BIGNUM *bn = NULL;
2116.       int ok = -1, i;

apps/ca.c:2115:5: 
2113.       char *row[DB_NUMBER], **rrow, **irow;
2114.       char *rev_str = NULL;
2115. >     BIGNUM *bn = NULL;
2116.       int ok = -1, i;
2117.   

apps/ca.c:2116:5: 
2114.       char *rev_str = NULL;
2115.       BIGNUM *bn = NULL;
2116. >     int ok = -1, i;
2117.   
2118.       for (i = 0; i < DB_NUMBER; i++)

apps/ca.c:2118:10: 
2116.       int ok = -1, i;
2117.   
2118. >     for (i = 0; i < DB_NUMBER; i++)
2119.           row[i] = NULL;
2120.       row[DB_name] = X509_NAME_oneline(X509_get_subject_name(x509), NULL, 0);

apps/ca.c:2118:17: Loop condition is true. Entering loop body
2116.       int ok = -1, i;
2117.   
2118.       for (i = 0; i < DB_NUMBER; i++)
                        ^
2119.           row[i] = NULL;
2120.       row[DB_name] = X509_NAME_oneline(X509_get_subject_name(x509), NULL, 0);

apps/ca.c:2119:9: 
2117.   
2118.       for (i = 0; i < DB_NUMBER; i++)
2119. >         row[i] = NULL;
2120.       row[DB_name] = X509_NAME_oneline(X509_get_subject_name(x509), NULL, 0);
2121.       bn = ASN1_INTEGER_to_BN(X509_get_serialNumber(x509), NULL);

apps/ca.c:2118:32: 
2116.       int ok = -1, i;
2117.   
2118. >     for (i = 0; i < DB_NUMBER; i++)
2119.           row[i] = NULL;
2120.       row[DB_name] = X509_NAME_oneline(X509_get_subject_name(x509), NULL, 0);

apps/ca.c:2118:17: Loop condition is true. Entering loop body
2116.       int ok = -1, i;
2117.   
2118.       for (i = 0; i < DB_NUMBER; i++)
                        ^
2119.           row[i] = NULL;
2120.       row[DB_name] = X509_NAME_oneline(X509_get_subject_name(x509), NULL, 0);

apps/ca.c:2119:9: 
2117.   
2118.       for (i = 0; i < DB_NUMBER; i++)
2119. >         row[i] = NULL;
2120.       row[DB_name] = X509_NAME_oneline(X509_get_subject_name(x509), NULL, 0);
2121.       bn = ASN1_INTEGER_to_BN(X509_get_serialNumber(x509), NULL);

apps/ca.c:2118:32: 
2116.       int ok = -1, i;
2117.   
2118. >     for (i = 0; i < DB_NUMBER; i++)
2119.           row[i] = NULL;
2120.       row[DB_name] = X509_NAME_oneline(X509_get_subject_name(x509), NULL, 0);

apps/ca.c:2118:17: Loop condition is true. Entering loop body
2116.       int ok = -1, i;
2117.   
2118.       for (i = 0; i < DB_NUMBER; i++)
                        ^
2119.           row[i] = NULL;
2120.       row[DB_name] = X509_NAME_oneline(X509_get_subject_name(x509), NULL, 0);

apps/ca.c:2119:9: 
2117.   
2118.       for (i = 0; i < DB_NUMBER; i++)
2119. >         row[i] = NULL;
2120.       row[DB_name] = X509_NAME_oneline(X509_get_subject_name(x509), NULL, 0);
2121.       bn = ASN1_INTEGER_to_BN(X509_get_serialNumber(x509), NULL);

apps/ca.c:2118:32: 
2116.       int ok = -1, i;
2117.   
2118. >     for (i = 0; i < DB_NUMBER; i++)
2119.           row[i] = NULL;
2120.       row[DB_name] = X509_NAME_oneline(X509_get_subject_name(x509), NULL, 0);

apps/ca.c:2118:17: Loop condition is true. Entering loop body
2116.       int ok = -1, i;
2117.   
2118.       for (i = 0; i < DB_NUMBER; i++)
                        ^
2119.           row[i] = NULL;
2120.       row[DB_name] = X509_NAME_oneline(X509_get_subject_name(x509), NULL, 0);

apps/ca.c:2119:9: 
2117.   
2118.       for (i = 0; i < DB_NUMBER; i++)
2119. >         row[i] = NULL;
2120.       row[DB_name] = X509_NAME_oneline(X509_get_subject_name(x509), NULL, 0);
2121.       bn = ASN1_INTEGER_to_BN(X509_get_serialNumber(x509), NULL);

apps/ca.c:2118:32: 
2116.       int ok = -1, i;
2117.   
2118. >     for (i = 0; i < DB_NUMBER; i++)
2119.           row[i] = NULL;
2120.       row[DB_name] = X509_NAME_oneline(X509_get_subject_name(x509), NULL, 0);

apps/ca.c:2118:17: Loop condition is false. Leaving loop
2116.       int ok = -1, i;
2117.   
2118.       for (i = 0; i < DB_NUMBER; i++)
                        ^
2119.           row[i] = NULL;
2120.       row[DB_name] = X509_NAME_oneline(X509_get_subject_name(x509), NULL, 0);

apps/ca.c:2120:5: 
2118.       for (i = 0; i < DB_NUMBER; i++)
2119.           row[i] = NULL;
2120. >     row[DB_name] = X509_NAME_oneline(X509_get_subject_name(x509), NULL, 0);
2121.       bn = ASN1_INTEGER_to_BN(X509_get_serialNumber(x509), NULL);
2122.       if (!bn)

crypto/x509/x509_cmp.c:99:1: start of procedure X509_get_subject_name()
  97.   #endif
  98.   
  99. > X509_NAME *X509_get_subject_name(const X509 *a)
  100.   {
  101.       return a->cert_info.subject;

crypto/x509/x509_cmp.c:101:5: 
  99.   X509_NAME *X509_get_subject_name(const X509 *a)
  100.   {
  101. >     return a->cert_info.subject;
  102.   }
  103.   

crypto/x509/x509_cmp.c:102:1: return from a call to X509_get_subject_name
  100.   {
  101.       return a->cert_info.subject;
  102. > }
  103.   
  104.   ASN1_INTEGER *X509_get_serialNumber(X509 *a)

crypto/x509/x509_obj.c:24:1: start of procedure X509_NAME_oneline()
  22.   #define NAME_ONELINE_MAX    (1024 * 1024)
  23.   
  24. > char *X509_NAME_oneline(const X509_NAME *a, char *buf, int len)
  25.   {
  26.       const X509_NAME_ENTRY *ne;

crypto/x509/x509_obj.c:32:5: 
  30.       char *p;
  31.       unsigned char *q;
  32. >     BUF_MEM *b = NULL;
  33.       static const char hex[17] = "0123456789ABCDEF";
  34.       int gs_doit[4];

crypto/x509/x509_obj.c:33:5: 
  31.       unsigned char *q;
  32.       BUF_MEM *b = NULL;
  33. >     static const char hex[17] = "0123456789ABCDEF";
  34.       int gs_doit[4];
  35.       char tmp_buf[80];

crypto/x509/x509_obj.c:40:9: Taking false branch
  38.   #endif
  39.   
  40.       if (buf == NULL) {
                ^
  41.           if ((b = BUF_MEM_new()) == NULL)
  42.               goto err;

crypto/x509/x509_obj.c:47:16: Taking false branch
  45.           b->data[0] = '\0';
  46.           len = 200;
  47.       } else if (len == 0) {
                       ^
  48.           return NULL;
  49.       }

crypto/x509/x509_obj.c:50:9: Taking true branch
  48.           return NULL;
  49.       }
  50.       if (a == NULL) {
                ^
  51.           if (b) {
  52.               buf = b->data;

crypto/x509/x509_obj.c:51:13: Taking false branch
  49.       }
  50.       if (a == NULL) {
  51.           if (b) {
                    ^
  52.               buf = b->data;
  53.               OPENSSL_free(b);

crypto/x509/x509_obj.c:55:9: 
  53.               OPENSSL_free(b);
  54.           }
  55. >         strncpy(buf, "NO X509_NAME", len);
  56.           buf[len - 1] = '\0';
  57.           return buf;

crypto/x509/x509_obj.c:56:9: 
  54.           }
  55.           strncpy(buf, "NO X509_NAME", len);
  56. >         buf[len - 1] = '\0';
  57.           return buf;
  58.       }

crypto/x509/x509_obj.c:57:9: 
  55.           strncpy(buf, "NO X509_NAME", len);
  56.           buf[len - 1] = '\0';
  57. >         return buf;
  58.       }
  59.   

crypto/x509/x509_obj.c:181:1: return from a call to X509_NAME_oneline
  179.       BUF_MEM_free(b);
  180.       return NULL;
  181. > }
