crypto/store/str_lib.c:1126: error: NULL_DEREFERENCE
  pointer `null` is dereferenced by call to `STORE_ATTR_INFO_modify_sha1str()` at line 1126, column 4.
Showing all 80 steps of the trace


crypto/store/str_lib.c:1109:1: start of procedure STORE_ATTR_INFO_attr_free()
1107.   	return (STORE_ATTR_INFO *)OPENSSL_malloc(sizeof(STORE_ATTR_INFO));
1108.   	}
1109. > static void STORE_ATTR_INFO_attr_free(STORE_ATTR_INFO *attrs,
1110.   	STORE_ATTR_TYPES code)
1111.   	{

crypto/store/str_lib.c:1112:6: Taking true branch
1110.   	STORE_ATTR_TYPES code)
1111.   	{
1112.   	if (ATTR_IS_SET(attrs,code))
             ^
1113.   		{
1114.   		switch(code)

crypto/store/str_lib.c:1112:6: Taking true branch
1110.   	STORE_ATTR_TYPES code)
1111.   	{
1112.   	if (ATTR_IS_SET(attrs,code))
             ^
1113.   		{
1114.   		switch(code)

crypto/store/str_lib.c:1112:6: Taking true branch
1110.   	STORE_ATTR_TYPES code)
1111.   	{
1112.   	if (ATTR_IS_SET(attrs,code))
             ^
1113.   		{
1114.   		switch(code)

crypto/store/str_lib.c:1114:3: 
1112.   	if (ATTR_IS_SET(attrs,code))
1113.   		{
1114. > 		switch(code)
1115.   			{
1116.   		case STORE_ATTR_FRIENDLYNAME:

crypto/store/str_lib.c:1116:3: Switch condition is false. Skipping switch case
1114.   		switch(code)
1115.   			{
1116.   		case STORE_ATTR_FRIENDLYNAME:
          ^
1117.   		case STORE_ATTR_EMAIL:
1118.   		case STORE_ATTR_FILENAME:

crypto/store/str_lib.c:1117:3: Switch condition is false. Skipping switch case
1115.   			{
1116.   		case STORE_ATTR_FRIENDLYNAME:
1117.   		case STORE_ATTR_EMAIL:
          ^
1118.   		case STORE_ATTR_FILENAME:
1119.   			STORE_ATTR_INFO_modify_cstr(attrs, code, NULL, 0);

crypto/store/str_lib.c:1118:3: Switch condition is false. Skipping switch case
1116.   		case STORE_ATTR_FRIENDLYNAME:
1117.   		case STORE_ATTR_EMAIL:
1118.   		case STORE_ATTR_FILENAME:
          ^
1119.   			STORE_ATTR_INFO_modify_cstr(attrs, code, NULL, 0);
1120.   			break;

crypto/store/str_lib.c:1121:3: Switch condition is true. Entering switch case
1119.   			STORE_ATTR_INFO_modify_cstr(attrs, code, NULL, 0);
1120.   			break;
1121.   		case STORE_ATTR_KEYID:
          ^
1122.   		case STORE_ATTR_ISSUERKEYID:
1123.   		case STORE_ATTR_SUBJECTKEYID:

crypto/store/str_lib.c:1126:4: 
1124.   		case STORE_ATTR_ISSUERSERIALHASH:
1125.   		case STORE_ATTR_CERTHASH:
1126. > 			STORE_ATTR_INFO_modify_sha1str(attrs, code, NULL, 0);
1127.   			break;
1128.   		case STORE_ATTR_ISSUER:

crypto/store/str_lib.c:1307:1: start of procedure STORE_ATTR_INFO_modify_sha1str()
  1305.   	return STORE_ATTR_INFO_set_cstr(attrs, code, cstr, cstr_size);
  1306.   	}
  1307. > int STORE_ATTR_INFO_modify_sha1str(STORE_ATTR_INFO *attrs, STORE_ATTR_TYPES code,
  1308.   	unsigned char *sha1str, size_t sha1str_size)
  1309.   	{

crypto/store/str_lib.c:1310:7: Taking false branch
  1308.   	unsigned char *sha1str, size_t sha1str_size)
  1309.   	{
  1310.   	if (!attrs)
                ^
  1311.   		{
  1312.   		STOREerr(STORE_F_STORE_ATTR_INFO_MODIFY_SHA1STR,

crypto/store/str_lib.c:1316:6: Taking true branch
  1314.   		return 0;
  1315.   		}
  1316.   	if (ATTR_IS_SET(attrs,code))
               ^
  1317.   		{
  1318.   		OPENSSL_free(attrs->values[code].sha1string);

crypto/store/str_lib.c:1316:6: Taking false branch
  1314.   		return 0;
  1315.   		}
  1316.   	if (ATTR_IS_SET(attrs,code))
               ^
  1317.   		{
  1318.   		OPENSSL_free(attrs->values[code].sha1string);

crypto/store/str_lib.c:1322:2: 
  1320.   		CLEAR_ATTRBIT(attrs, code);
  1321.   		}
  1322. > 	return STORE_ATTR_INFO_set_sha1str(attrs, code, sha1str, sha1str_size);
  1323.   	}
  1324.   int STORE_ATTR_INFO_modify_dn(STORE_ATTR_INFO *attrs, STORE_ATTR_TYPES code,

crypto/store/str_lib.c:1228:1: start of procedure STORE_ATTR_INFO_set_sha1str()
    1226.   	return 0;
    1227.   	}
    1228. > int STORE_ATTR_INFO_set_sha1str(STORE_ATTR_INFO *attrs, STORE_ATTR_TYPES code,
    1229.   	unsigned char *sha1str, size_t sha1str_size)
    1230.   	{

crypto/store/str_lib.c:1231:7: Taking false branch
    1229.   	unsigned char *sha1str, size_t sha1str_size)
    1230.   	{
    1231.   	if (!attrs)
                  ^
    1232.   		{
    1233.   		STOREerr(STORE_F_STORE_ATTR_INFO_SET_SHA1STR,

crypto/store/str_lib.c:1237:7: Taking false branch
    1235.   		return 0;
    1236.   		}
    1237.   	if (!ATTR_IS_SET(attrs,code))
                  ^
    1238.   		{
    1239.   		if ((attrs->values[code].sha1string =

crypto/store/str_lib.c:1237:7: Taking true branch
    1235.   		return 0;
    1236.   		}
    1237.   	if (!ATTR_IS_SET(attrs,code))
                  ^
    1238.   		{
    1239.   		if ((attrs->values[code].sha1string =

crypto/store/str_lib.c:1239:8: 
    1237.   	if (!ATTR_IS_SET(attrs,code))
    1238.   		{
    1239. > 		if ((attrs->values[code].sha1string =
    1240.   			    (unsigned char *)BUF_memdup(sha1str,
    1241.   				    sha1str_size)))

crypto/buffer/buffer.c:187:1: start of procedure BUF_memdup()
      185.   	}
      186.   
      187. > void *BUF_memdup(const void *data, size_t siz)
      188.   	{
      189.   	void *ret;

crypto/buffer/buffer.c:191:6: Taking false branch
      189.   	void *ret;
      190.   
      191.   	if (data == NULL) return(NULL);
                  ^
      192.   
      193.   	ret=OPENSSL_malloc(siz);

crypto/buffer/buffer.c:193:2: 
      191.   	if (data == NULL) return(NULL);
      192.   
      193. > 	ret=OPENSSL_malloc(siz);
      194.   	if (ret == NULL) 
      195.   		{

crypto/mem.c:291:1: start of procedure CRYPTO_malloc()
        289.   	}
        290.   
        291. > void *CRYPTO_malloc(int num, const char *file, int line)
        292.   	{
        293.   	void *ret = NULL;

crypto/mem.c:293:2: 
        291.   void *CRYPTO_malloc(int num, const char *file, int line)
        292.   	{
        293. > 	void *ret = NULL;
        294.   	extern unsigned char cleanse_ctr;
        295.   

crypto/mem.c:296:6: Taking false branch
        294.   	extern unsigned char cleanse_ctr;
        295.   
        296.   	if (num < 0) return NULL;
                    ^
        297.   
        298.   	allow_customize = 0;

crypto/mem.c:298:2: 
        296.   	if (num < 0) return NULL;
        297.   
        298. > 	allow_customize = 0;
        299.   	if (malloc_debug_func != NULL)
        300.   		{

crypto/mem.c:299:6: Taking false branch
        297.   
        298.   	allow_customize = 0;
        299.   	if (malloc_debug_func != NULL)
                    ^
        300.   		{
        301.   		allow_customize_debug = 0;

crypto/mem.c:304:2: Skipping __function_pointer__(): unresolved function pointer
        302.   		malloc_debug_func(NULL, num, file, line, 0);
        303.   		}
        304.   	ret = malloc_ex_func(num,file,line);
                ^
        305.   #ifdef LEVITTE_DEBUG_MEM
        306.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);

crypto/mem.c:308:6: Taking false branch
        306.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);
        307.   #endif
        308.   	if (malloc_debug_func != NULL)
                    ^
        309.   		malloc_debug_func(ret, num, file, line, 1);
        310.   

crypto/mem.c:314:12: Taking false branch
        312.            * sanitisation function can't be optimised out. NB: We only do
        313.            * this for >2Kb so the overhead doesn't bother us. */
        314.           if(ret && (num > 2048))
                          ^
        315.                   ((unsigned char *)ret)[0] = cleanse_ctr;
        316.   

crypto/mem.c:317:2: 
        315.                   ((unsigned char *)ret)[0] = cleanse_ctr;
        316.   
        317. > 	return ret;
        318.   	}
        319.   

crypto/mem.c:318:2: return from a call to CRYPTO_malloc
        316.   
        317.   	return ret;
        318.   	}
                ^
        319.   
        320.   void *CRYPTO_realloc(void *str, int num, const char *file, int line)

crypto/buffer/buffer.c:194:6: Taking true branch
      192.   
      193.   	ret=OPENSSL_malloc(siz);
      194.   	if (ret == NULL) 
                  ^
      195.   		{
      196.   		BUFerr(BUF_F_BUF_MEMDUP,ERR_R_MALLOC_FAILURE);

crypto/buffer/buffer.c:196:3: 
      194.   	if (ret == NULL) 
      195.   		{
      196. > 		BUFerr(BUF_F_BUF_MEMDUP,ERR_R_MALLOC_FAILURE);
      197.   		return(NULL);
      198.   		}

crypto/err/err.c:619:1: start of procedure ERR_put_error()
        617.   /********************************************************/
        618.   
        619. > void ERR_put_error(int lib, int func, int reason, const char *file,
        620.   	     int line)
        621.   	{

crypto/err/err.c:643:2: Skipping ERR_get_state(): empty list of specs
        641.   	}
        642.   #endif
        643.   	es=ERR_get_state();
                ^
        644.   
        645.   	es->top=(es->top+1)%ERR_NUM_ERRORS;

crypto/err/err.c:645:2: 
        643.   	es=ERR_get_state();
        644.   
        645. > 	es->top=(es->top+1)%ERR_NUM_ERRORS;
        646.   	if (es->top == es->bottom)
        647.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;

crypto/err/err.c:646:6: Taking false branch
        644.   
        645.   	es->top=(es->top+1)%ERR_NUM_ERRORS;
        646.   	if (es->top == es->bottom)
                    ^
        647.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
        648.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);

crypto/err/err.c:648:2: 
        646.   	if (es->top == es->bottom)
        647.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
        648. > 	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
        649.   	es->err_file[es->top]=file;
        650.   	es->err_line[es->top]=line;

crypto/err/err.c:649:2: 
        647.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
        648.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
        649. > 	es->err_file[es->top]=file;
        650.   	es->err_line[es->top]=line;
        651.   	err_clear_data(es,es->top);

crypto/err/err.c:650:2: 
        648.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
        649.   	es->err_file[es->top]=file;
        650. > 	es->err_line[es->top]=line;
        651.   	err_clear_data(es,es->top);
        652.   	}

crypto/err/err.c:651:2: Taking true branch
        649.   	es->err_file[es->top]=file;
        650.   	es->err_line[es->top]=line;
        651.   	err_clear_data(es,es->top);
                ^
        652.   	}
        653.   

crypto/err/err.c:651:2: Taking true branch
        649.   	es->err_file[es->top]=file;
        650.   	es->err_line[es->top]=line;
        651.   	err_clear_data(es,es->top);
                ^
        652.   	}
        653.   

crypto/mem.c:367:1: start of procedure CRYPTO_free()
          365.   	}
          366.   
          367. > void CRYPTO_free(void *str)
          368.   	{
          369.   	if (free_debug_func != NULL)

crypto/mem.c:369:6: Taking true branch
          367.   void CRYPTO_free(void *str)
          368.   	{
          369.   	if (free_debug_func != NULL)
                      ^
          370.   		free_debug_func(str, 0);
          371.   #ifdef LEVITTE_DEBUG_MEM

crypto/mem.c:370:3: Skipping __function_pointer__(): unresolved function pointer
          368.   	{
          369.   	if (free_debug_func != NULL)
          370.   		free_debug_func(str, 0);
                   ^
          371.   #ifdef LEVITTE_DEBUG_MEM
          372.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         < 0x%p\n", str);

crypto/mem.c:374:2: Skipping __function_pointer__(): unresolved function pointer
          372.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         < 0x%p\n", str);
          373.   #endif
          374.   	free_func(str);
                  ^
          375.   	if (free_debug_func != NULL)
          376.   		free_debug_func(NULL, 1);

crypto/mem.c:375:6: Taking true branch
          373.   #endif
          374.   	free_func(str);
          375.   	if (free_debug_func != NULL)
                      ^
          376.   		free_debug_func(NULL, 1);
          377.   	}

crypto/mem.c:376:3: Skipping __function_pointer__(): unresolved function pointer
          374.   	free_func(str);
          375.   	if (free_debug_func != NULL)
          376.   		free_debug_func(NULL, 1);
                   ^
          377.   	}
          378.   

crypto/mem.c:375:2: 
          373.   #endif
          374.   	free_func(str);
          375. > 	if (free_debug_func != NULL)
          376.   		free_debug_func(NULL, 1);
          377.   	}

crypto/mem.c:377:2: return from a call to CRYPTO_free
          375.   	if (free_debug_func != NULL)
          376.   		free_debug_func(NULL, 1);
          377.   	}
                  ^
          378.   
          379.   void *CRYPTO_remalloc(void *a, int num, const char *file, int line)

crypto/err/err.c:651:2: 
        649.   	es->err_file[es->top]=file;
        650.   	es->err_line[es->top]=line;
        651. > 	err_clear_data(es,es->top);
        652.   	}
        653.   

crypto/err/err.c:652:2: return from a call to ERR_put_error
        650.   	es->err_line[es->top]=line;
        651.   	err_clear_data(es,es->top);
        652.   	}
                ^
        653.   
        654.   void ERR_clear_error(void)

crypto/buffer/buffer.c:197:3: 
      195.   		{
      196.   		BUFerr(BUF_F_BUF_MEMDUP,ERR_R_MALLOC_FAILURE);
      197. > 		return(NULL);
      198.   		}
      199.   	return memcpy(ret, data, siz);

crypto/buffer/buffer.c:200:2: return from a call to BUF_memdup
      198.   		}
      199.   	return memcpy(ret, data, siz);
      200.   	}	
              ^
      201.   
      202.   size_t BUF_strlcpy(char *dst, const char *src, size_t size)

crypto/store/str_lib.c:1239:8: Taking false branch
    1237.   	if (!ATTR_IS_SET(attrs,code))
    1238.   		{
    1239.   		if ((attrs->values[code].sha1string =
                   ^
    1240.   			    (unsigned char *)BUF_memdup(sha1str,
    1241.   				    sha1str_size)))

crypto/store/str_lib.c:1243:3: 
    1241.   				    sha1str_size)))
    1242.   			return 1;
    1243. > 		STOREerr(STORE_F_STORE_ATTR_INFO_SET_CSTR,
    1244.   			ERR_R_MALLOC_FAILURE);
    1245.   		return 0;

crypto/err/err.c:619:1: start of procedure ERR_put_error()
      617.   /********************************************************/
      618.   
      619. > void ERR_put_error(int lib, int func, int reason, const char *file,
      620.   	     int line)
      621.   	{

crypto/err/err.c:643:2: Skipping ERR_get_state(): empty list of specs
      641.   	}
      642.   #endif
      643.   	es=ERR_get_state();
              ^
      644.   
      645.   	es->top=(es->top+1)%ERR_NUM_ERRORS;

crypto/err/err.c:645:2: 
      643.   	es=ERR_get_state();
      644.   
      645. > 	es->top=(es->top+1)%ERR_NUM_ERRORS;
      646.   	if (es->top == es->bottom)
      647.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;

crypto/err/err.c:646:6: Taking false branch
      644.   
      645.   	es->top=(es->top+1)%ERR_NUM_ERRORS;
      646.   	if (es->top == es->bottom)
                  ^
      647.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
      648.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);

crypto/err/err.c:648:2: 
      646.   	if (es->top == es->bottom)
      647.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
      648. > 	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
      649.   	es->err_file[es->top]=file;
      650.   	es->err_line[es->top]=line;

crypto/err/err.c:649:2: 
      647.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
      648.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
      649. > 	es->err_file[es->top]=file;
      650.   	es->err_line[es->top]=line;
      651.   	err_clear_data(es,es->top);

crypto/err/err.c:650:2: 
      648.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
      649.   	es->err_file[es->top]=file;
      650. > 	es->err_line[es->top]=line;
      651.   	err_clear_data(es,es->top);
      652.   	}

crypto/err/err.c:651:2: Taking true branch
      649.   	es->err_file[es->top]=file;
      650.   	es->err_line[es->top]=line;
      651.   	err_clear_data(es,es->top);
              ^
      652.   	}
      653.   

crypto/err/err.c:651:2: Taking true branch
      649.   	es->err_file[es->top]=file;
      650.   	es->err_line[es->top]=line;
      651.   	err_clear_data(es,es->top);
              ^
      652.   	}
      653.   

crypto/mem.c:367:1: start of procedure CRYPTO_free()
        365.   	}
        366.   
        367. > void CRYPTO_free(void *str)
        368.   	{
        369.   	if (free_debug_func != NULL)

crypto/mem.c:369:6: Taking true branch
        367.   void CRYPTO_free(void *str)
        368.   	{
        369.   	if (free_debug_func != NULL)
                    ^
        370.   		free_debug_func(str, 0);
        371.   #ifdef LEVITTE_DEBUG_MEM

crypto/mem.c:370:3: Skipping __function_pointer__(): unresolved function pointer
        368.   	{
        369.   	if (free_debug_func != NULL)
        370.   		free_debug_func(str, 0);
                 ^
        371.   #ifdef LEVITTE_DEBUG_MEM
        372.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         < 0x%p\n", str);

crypto/mem.c:374:2: Skipping __function_pointer__(): unresolved function pointer
        372.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         < 0x%p\n", str);
        373.   #endif
        374.   	free_func(str);
                ^
        375.   	if (free_debug_func != NULL)
        376.   		free_debug_func(NULL, 1);

crypto/mem.c:375:6: Taking true branch
        373.   #endif
        374.   	free_func(str);
        375.   	if (free_debug_func != NULL)
                    ^
        376.   		free_debug_func(NULL, 1);
        377.   	}

crypto/mem.c:376:3: Skipping __function_pointer__(): unresolved function pointer
        374.   	free_func(str);
        375.   	if (free_debug_func != NULL)
        376.   		free_debug_func(NULL, 1);
                 ^
        377.   	}
        378.   

crypto/mem.c:375:2: 
        373.   #endif
        374.   	free_func(str);
        375. > 	if (free_debug_func != NULL)
        376.   		free_debug_func(NULL, 1);
        377.   	}

crypto/mem.c:377:2: return from a call to CRYPTO_free
        375.   	if (free_debug_func != NULL)
        376.   		free_debug_func(NULL, 1);
        377.   	}
                ^
        378.   
        379.   void *CRYPTO_remalloc(void *a, int num, const char *file, int line)

crypto/err/err.c:651:2: 
      649.   	es->err_file[es->top]=file;
      650.   	es->err_line[es->top]=line;
      651. > 	err_clear_data(es,es->top);
      652.   	}
      653.   

crypto/err/err.c:652:2: return from a call to ERR_put_error
      650.   	es->err_line[es->top]=line;
      651.   	err_clear_data(es,es->top);
      652.   	}
              ^
      653.   
      654.   void ERR_clear_error(void)

crypto/store/str_lib.c:1245:3: 
    1243.   		STOREerr(STORE_F_STORE_ATTR_INFO_SET_CSTR,
    1244.   			ERR_R_MALLOC_FAILURE);
    1245. > 		return 0;
    1246.   		}
    1247.   	STOREerr(STORE_F_STORE_ATTR_INFO_SET_SHA1STR, STORE_R_ALREADY_HAS_A_VALUE);

crypto/store/str_lib.c:1249:2: return from a call to STORE_ATTR_INFO_set_sha1str
    1247.   	STOREerr(STORE_F_STORE_ATTR_INFO_SET_SHA1STR, STORE_R_ALREADY_HAS_A_VALUE);
    1248.   	return 0;
    1249.   	}
             ^
    1250.   int STORE_ATTR_INFO_set_dn(STORE_ATTR_INFO *attrs, STORE_ATTR_TYPES code,
    1251.   	X509_NAME *dn)

crypto/store/str_lib.c:1323:2: return from a call to STORE_ATTR_INFO_modify_sha1str
  1321.   		}
  1322.   	return STORE_ATTR_INFO_set_sha1str(attrs, code, sha1str, sha1str_size);
  1323.   	}
           ^
  1324.   int STORE_ATTR_INFO_modify_dn(STORE_ATTR_INFO *attrs, STORE_ATTR_TYPES code,
  1325.   	X509_NAME *dn)
