crypto/x509v3/v3_purp.c:173: error: NULL_DEREFERENCE
  pointer `ptmp` last assigned on line 170 could be null and is dereferenced at line 173, column 9.
Showing all 11 steps of the trace


crypto/x509v3/v3_purp.c:148:1: start of procedure X509_PURPOSE_add()
146.   }
147.   
148. > int X509_PURPOSE_add(int id, int trust, int flags,
149.                        int (*ck) (const X509_PURPOSE *, const X509 *, int),
150.                        const char *name, const char *sname, void *arg)

crypto/x509v3/v3_purp.c:157:5: 
155.        * This is set according to what we change: application can't set it
156.        */
157. >     flags &= ~X509_PURPOSE_DYNAMIC;
158.       /* This will always be set for application modified trust entries */
159.       flags |= X509_PURPOSE_DYNAMIC_NAME;

crypto/x509v3/v3_purp.c:159:5: 
157.       flags &= ~X509_PURPOSE_DYNAMIC;
158.       /* This will always be set for application modified trust entries */
159. >     flags |= X509_PURPOSE_DYNAMIC_NAME;
160.       /* Get existing entry if any */
161.       idx = X509_PURPOSE_get_by_id(id);

crypto/x509v3/v3_purp.c:161:5: Skipping X509_PURPOSE_get_by_id(): empty list of specs
159.       flags |= X509_PURPOSE_DYNAMIC_NAME;
160.       /* Get existing entry if any */
161.       idx = X509_PURPOSE_get_by_id(id);
           ^
162.       /* Need a new entry */
163.       if (idx == -1) {

crypto/x509v3/v3_purp.c:163:9: Taking false branch
161.       idx = X509_PURPOSE_get_by_id(id);
162.       /* Need a new entry */
163.       if (idx == -1) {
               ^
164.           if ((ptmp = OPENSSL_malloc(sizeof(*ptmp))) == NULL) {
165.               X509V3err(X509V3_F_X509_PURPOSE_ADD, ERR_R_MALLOC_FAILURE);

crypto/x509v3/v3_purp.c:170:9: 
168.           ptmp->flags = X509_PURPOSE_DYNAMIC;
169.       } else
170. >         ptmp = X509_PURPOSE_get0(idx);
171.   
172.       /* OPENSSL_free existing name if dynamic */

crypto/x509v3/v3_purp.c:111:1: start of procedure X509_PURPOSE_get0()
  109.   }
  110.   
  111. > X509_PURPOSE *X509_PURPOSE_get0(int idx)
  112.   {
  113.       if (idx < 0)

crypto/x509v3/v3_purp.c:113:9: Taking true branch
  111.   X509_PURPOSE *X509_PURPOSE_get0(int idx)
  112.   {
  113.       if (idx < 0)
                 ^
  114.           return NULL;
  115.       if (idx < (int)X509_PURPOSE_COUNT)

crypto/x509v3/v3_purp.c:114:9: 
  112.   {
  113.       if (idx < 0)
  114. >         return NULL;
  115.       if (idx < (int)X509_PURPOSE_COUNT)
  116.           return xstandard + idx;

crypto/x509v3/v3_purp.c:118:1: return from a call to X509_PURPOSE_get0
  116.           return xstandard + idx;
  117.       return sk_X509_PURPOSE_value(xptable, idx - X509_PURPOSE_COUNT);
  118. > }
  119.   
  120.   int X509_PURPOSE_get_by_sname(const char *sname)

crypto/x509v3/v3_purp.c:173:9: 
171.   
172.       /* OPENSSL_free existing name if dynamic */
173. >     if (ptmp->flags & X509_PURPOSE_DYNAMIC_NAME) {
174.           OPENSSL_free(ptmp->name);
175.           OPENSSL_free(ptmp->sname);
