crypto/x509/x509_trs.c:165: error: NULL_DEREFERENCE
  pointer `trtmp` last assigned on line 162 could be null and is dereferenced at line 165, column 5.
Showing all 20 steps of the trace


crypto/x509/x509_trs.c:144:1: start of procedure X509_TRUST_add()
142.   }
143.   
144. > int X509_TRUST_add(int id, int flags, int (*ck)(X509_TRUST *, X509 *, int),
145.   					char *name, int arg1, void *arg2)
146.   {

crypto/x509/x509_trs.c:150:2: 
148.   	X509_TRUST *trtmp;
149.   	/* This is set according to what we change: application can't set it */
150. > 	flags &= ~X509_TRUST_DYNAMIC;
151.   	/* This will always be set for application modified trust entries */
152.   	flags |= X509_TRUST_DYNAMIC_NAME;

crypto/x509/x509_trs.c:152:2: 
150.   	flags &= ~X509_TRUST_DYNAMIC;
151.   	/* This will always be set for application modified trust entries */
152. > 	flags |= X509_TRUST_DYNAMIC_NAME;
153.   	/* Get existing entry if any */
154.   	idx = X509_TRUST_get_by_id(id);

crypto/x509/x509_trs.c:154:2: 
152.   	flags |= X509_TRUST_DYNAMIC_NAME;
153.   	/* Get existing entry if any */
154. > 	idx = X509_TRUST_get_by_id(id);
155.   	/* Need a new entry */
156.   	if(idx == -1) {

crypto/x509/x509_trs.c:131:1: start of procedure X509_TRUST_get_by_id()
  129.   }
  130.   
  131. > int X509_TRUST_get_by_id(int id)
  132.   {
  133.   	X509_TRUST tmp;

crypto/x509/x509_trs.c:135:6: Taking true branch
  133.   	X509_TRUST tmp;
  134.   	int idx;
  135.   	if((id >= X509_TRUST_MIN) && (id <= X509_TRUST_MAX))
              ^
  136.   				 return id - X509_TRUST_MIN;
  137.   	tmp.trust = id;

crypto/x509/x509_trs.c:135:32: Taking false branch
  133.   	X509_TRUST tmp;
  134.   	int idx;
  135.   	if((id >= X509_TRUST_MIN) && (id <= X509_TRUST_MAX))
                                        ^
  136.   				 return id - X509_TRUST_MIN;
  137.   	tmp.trust = id;

crypto/x509/x509_trs.c:137:2: 
  135.   	if((id >= X509_TRUST_MIN) && (id <= X509_TRUST_MAX))
  136.   				 return id - X509_TRUST_MIN;
  137. > 	tmp.trust = id;
  138.   	if(!trtable) return -1;
  139.   	idx = sk_X509_TRUST_find(trtable, &tmp);

crypto/x509/x509_trs.c:138:6: Taking false branch
  136.   				 return id - X509_TRUST_MIN;
  137.   	tmp.trust = id;
  138.   	if(!trtable) return -1;
              ^
  139.   	idx = sk_X509_TRUST_find(trtable, &tmp);
  140.   	if(idx == -1) return -1;

crypto/x509/x509_trs.c:139:2: Skipping sk_find(): empty list of specs
  137.   	tmp.trust = id;
  138.   	if(!trtable) return -1;
  139.   	idx = sk_X509_TRUST_find(trtable, &tmp);
          ^
  140.   	if(idx == -1) return -1;
  141.   	return idx + X509_TRUST_COUNT;

crypto/x509/x509_trs.c:140:5: Taking false branch
  138.   	if(!trtable) return -1;
  139.   	idx = sk_X509_TRUST_find(trtable, &tmp);
  140.   	if(idx == -1) return -1;
             ^
  141.   	return idx + X509_TRUST_COUNT;
  142.   }

crypto/x509/x509_trs.c:141:2: 
  139.   	idx = sk_X509_TRUST_find(trtable, &tmp);
  140.   	if(idx == -1) return -1;
  141. > 	return idx + X509_TRUST_COUNT;
  142.   }
  143.   

crypto/x509/x509_trs.c:142:1: return from a call to X509_TRUST_get_by_id
  140.   	if(idx == -1) return -1;
  141.   	return idx + X509_TRUST_COUNT;
  142. > }
  143.   
  144.   int X509_TRUST_add(int id, int flags, int (*ck)(X509_TRUST *, X509 *, int),

crypto/x509/x509_trs.c:156:5: Taking false branch
154.   	idx = X509_TRUST_get_by_id(id);
155.   	/* Need a new entry */
156.   	if(idx == -1) {
           ^
157.   		if(!(trtmp = OPENSSL_malloc(sizeof(X509_TRUST)))) {
158.   			X509err(X509_F_X509_TRUST_ADD,ERR_R_MALLOC_FAILURE);

crypto/x509/x509_trs.c:162:9: 
160.   		}
161.   		trtmp->flags = X509_TRUST_DYNAMIC;
162. > 	} else trtmp = X509_TRUST_get0(idx);
163.   
164.   	/* OPENSSL_free existing name if dynamic */

crypto/x509/x509_trs.c:124:1: start of procedure X509_TRUST_get0()
  122.   }
  123.   
  124. > X509_TRUST * X509_TRUST_get0(int idx)
  125.   {
  126.   	if(idx < 0) return NULL;

crypto/x509/x509_trs.c:126:5: Taking true branch
  124.   X509_TRUST * X509_TRUST_get0(int idx)
  125.   {
  126.   	if(idx < 0) return NULL;
             ^
  127.   	if(idx < X509_TRUST_COUNT) return trstandard + idx;
  128.   	return sk_X509_TRUST_value(trtable, idx - X509_TRUST_COUNT);

crypto/x509/x509_trs.c:126:14: 
  124.   X509_TRUST * X509_TRUST_get0(int idx)
  125.   {
  126. > 	if(idx < 0) return NULL;
  127.   	if(idx < X509_TRUST_COUNT) return trstandard + idx;
  128.   	return sk_X509_TRUST_value(trtable, idx - X509_TRUST_COUNT);

crypto/x509/x509_trs.c:129:1: return from a call to X509_TRUST_get0
  127.   	if(idx < X509_TRUST_COUNT) return trstandard + idx;
  128.   	return sk_X509_TRUST_value(trtable, idx - X509_TRUST_COUNT);
  129. > }
  130.   
  131.   int X509_TRUST_get_by_id(int id)

crypto/x509/x509_trs.c:165:5: 
163.   
164.   	/* OPENSSL_free existing name if dynamic */
165. > 	if(trtmp->flags & X509_TRUST_DYNAMIC_NAME) OPENSSL_free(trtmp->name);
166.   	/* dup supplied name */
167.   	if(!(trtmp->name = BUF_strdup(name))) {
