crypto/x509v3/v3_purp.c:183: error: NULL_DEREFERENCE
  pointer `ptmp` last assigned on line 180 could be null and is dereferenced at line 183, column 5.
Showing all 20 steps of the trace


crypto/x509v3/v3_purp.c:161:1: start of procedure X509_PURPOSE_add()
159.   }
160.   
161. > int X509_PURPOSE_add(int id, int trust, int flags,
162.   			int (*ck)(const X509_PURPOSE *, const X509 *, int),
163.   					char *name, char *sname, void *arg)

crypto/x509v3/v3_purp.c:168:2: 
166.   	X509_PURPOSE *ptmp;
167.   	/* This is set according to what we change: application can't set it */
168. > 	flags &= ~X509_PURPOSE_DYNAMIC;
169.   	/* This will always be set for application modified trust entries */
170.   	flags |= X509_PURPOSE_DYNAMIC_NAME;

crypto/x509v3/v3_purp.c:170:2: 
168.   	flags &= ~X509_PURPOSE_DYNAMIC;
169.   	/* This will always be set for application modified trust entries */
170. > 	flags |= X509_PURPOSE_DYNAMIC_NAME;
171.   	/* Get existing entry if any */
172.   	idx = X509_PURPOSE_get_by_id(id);

crypto/x509v3/v3_purp.c:172:2: 
170.   	flags |= X509_PURPOSE_DYNAMIC_NAME;
171.   	/* Get existing entry if any */
172. > 	idx = X509_PURPOSE_get_by_id(id);
173.   	/* Need a new entry */
174.   	if(idx == -1) {

crypto/x509v3/v3_purp.c:148:1: start of procedure X509_PURPOSE_get_by_id()
  146.   
  147.   
  148. > int X509_PURPOSE_get_by_id(int purpose)
  149.   {
  150.   	X509_PURPOSE tmp;

crypto/x509v3/v3_purp.c:152:6: Taking true branch
  150.   	X509_PURPOSE tmp;
  151.   	int idx;
  152.   	if((purpose >= X509_PURPOSE_MIN) && (purpose <= X509_PURPOSE_MAX))
              ^
  153.   		return purpose - X509_PURPOSE_MIN;
  154.   	tmp.purpose = purpose;

crypto/x509v3/v3_purp.c:152:39: Taking false branch
  150.   	X509_PURPOSE tmp;
  151.   	int idx;
  152.   	if((purpose >= X509_PURPOSE_MIN) && (purpose <= X509_PURPOSE_MAX))
                                               ^
  153.   		return purpose - X509_PURPOSE_MIN;
  154.   	tmp.purpose = purpose;

crypto/x509v3/v3_purp.c:154:2: 
  152.   	if((purpose >= X509_PURPOSE_MIN) && (purpose <= X509_PURPOSE_MAX))
  153.   		return purpose - X509_PURPOSE_MIN;
  154. > 	tmp.purpose = purpose;
  155.   	if(!xptable) return -1;
  156.   	idx = sk_X509_PURPOSE_find(xptable, &tmp);

crypto/x509v3/v3_purp.c:155:6: Taking false branch
  153.   		return purpose - X509_PURPOSE_MIN;
  154.   	tmp.purpose = purpose;
  155.   	if(!xptable) return -1;
              ^
  156.   	idx = sk_X509_PURPOSE_find(xptable, &tmp);
  157.   	if(idx == -1) return -1;

crypto/x509v3/v3_purp.c:156:2: Skipping sk_find(): empty list of specs
  154.   	tmp.purpose = purpose;
  155.   	if(!xptable) return -1;
  156.   	idx = sk_X509_PURPOSE_find(xptable, &tmp);
          ^
  157.   	if(idx == -1) return -1;
  158.   	return idx + X509_PURPOSE_COUNT;

crypto/x509v3/v3_purp.c:157:5: Taking false branch
  155.   	if(!xptable) return -1;
  156.   	idx = sk_X509_PURPOSE_find(xptable, &tmp);
  157.   	if(idx == -1) return -1;
             ^
  158.   	return idx + X509_PURPOSE_COUNT;
  159.   }

crypto/x509v3/v3_purp.c:158:2: 
  156.   	idx = sk_X509_PURPOSE_find(xptable, &tmp);
  157.   	if(idx == -1) return -1;
  158. > 	return idx + X509_PURPOSE_COUNT;
  159.   }
  160.   

crypto/x509v3/v3_purp.c:159:1: return from a call to X509_PURPOSE_get_by_id
  157.   	if(idx == -1) return -1;
  158.   	return idx + X509_PURPOSE_COUNT;
  159. > }
  160.   
  161.   int X509_PURPOSE_add(int id, int trust, int flags,

crypto/x509v3/v3_purp.c:174:5: Taking false branch
172.   	idx = X509_PURPOSE_get_by_id(id);
173.   	/* Need a new entry */
174.   	if(idx == -1) {
           ^
175.   		if(!(ptmp = OPENSSL_malloc(sizeof(X509_PURPOSE)))) {
176.   			X509V3err(X509V3_F_X509_PURPOSE_ADD,ERR_R_MALLOC_FAILURE);

crypto/x509v3/v3_purp.c:180:9: 
178.   		}
179.   		ptmp->flags = X509_PURPOSE_DYNAMIC;
180. > 	} else ptmp = X509_PURPOSE_get0(idx);
181.   
182.   	/* OPENSSL_free existing name if dynamic */

crypto/x509v3/v3_purp.c:129:1: start of procedure X509_PURPOSE_get0()
  127.   }
  128.   
  129. > X509_PURPOSE * X509_PURPOSE_get0(int idx)
  130.   {
  131.   	if(idx < 0) return NULL;

crypto/x509v3/v3_purp.c:131:5: Taking true branch
  129.   X509_PURPOSE * X509_PURPOSE_get0(int idx)
  130.   {
  131.   	if(idx < 0) return NULL;
             ^
  132.   	if(idx < X509_PURPOSE_COUNT) return xstandard + idx;
  133.   	return sk_X509_PURPOSE_value(xptable, idx - X509_PURPOSE_COUNT);

crypto/x509v3/v3_purp.c:131:14: 
  129.   X509_PURPOSE * X509_PURPOSE_get0(int idx)
  130.   {
  131. > 	if(idx < 0) return NULL;
  132.   	if(idx < X509_PURPOSE_COUNT) return xstandard + idx;
  133.   	return sk_X509_PURPOSE_value(xptable, idx - X509_PURPOSE_COUNT);

crypto/x509v3/v3_purp.c:134:1: return from a call to X509_PURPOSE_get0
  132.   	if(idx < X509_PURPOSE_COUNT) return xstandard + idx;
  133.   	return sk_X509_PURPOSE_value(xptable, idx - X509_PURPOSE_COUNT);
  134. > }
  135.   
  136.   int X509_PURPOSE_get_by_sname(char *sname)

crypto/x509v3/v3_purp.c:183:5: 
181.   
182.   	/* OPENSSL_free existing name if dynamic */
183. > 	if(ptmp->flags & X509_PURPOSE_DYNAMIC_NAME) {
184.   		OPENSSL_free(ptmp->name);
185.   		OPENSSL_free(ptmp->sname);
