crypto/x509v3/v3_purp.c:193: error: NULL_DEREFERENCE
  pointer `ptmp` last assigned on line 190 could be null and is dereferenced at line 193, column 5.
Showing all 20 steps of the trace


crypto/x509v3/v3_purp.c:171:1: start of procedure X509_PURPOSE_add()
169.   }
170.   
171. > int X509_PURPOSE_add(int id, int trust, int flags,
172.   			int (*ck)(const X509_PURPOSE *, const X509 *, int),
173.   					char *name, char *sname, void *arg)

crypto/x509v3/v3_purp.c:178:2: 
176.   	X509_PURPOSE *ptmp;
177.   	/* This is set according to what we change: application can't set it */
178. > 	flags &= ~X509_PURPOSE_DYNAMIC;
179.   	/* This will always be set for application modified trust entries */
180.   	flags |= X509_PURPOSE_DYNAMIC_NAME;

crypto/x509v3/v3_purp.c:180:2: 
178.   	flags &= ~X509_PURPOSE_DYNAMIC;
179.   	/* This will always be set for application modified trust entries */
180. > 	flags |= X509_PURPOSE_DYNAMIC_NAME;
181.   	/* Get existing entry if any */
182.   	idx = X509_PURPOSE_get_by_id(id);

crypto/x509v3/v3_purp.c:182:2: 
180.   	flags |= X509_PURPOSE_DYNAMIC_NAME;
181.   	/* Get existing entry if any */
182. > 	idx = X509_PURPOSE_get_by_id(id);
183.   	/* Need a new entry */
184.   	if(idx == -1) {

crypto/x509v3/v3_purp.c:158:1: start of procedure X509_PURPOSE_get_by_id()
  156.   }
  157.   
  158. > int X509_PURPOSE_get_by_id(int purpose)
  159.   {
  160.   	X509_PURPOSE tmp;

crypto/x509v3/v3_purp.c:162:6: Taking true branch
  160.   	X509_PURPOSE tmp;
  161.   	int idx;
  162.   	if((purpose >= X509_PURPOSE_MIN) && (purpose <= X509_PURPOSE_MAX))
              ^
  163.   		return purpose - X509_PURPOSE_MIN;
  164.   	tmp.purpose = purpose;

crypto/x509v3/v3_purp.c:162:39: Taking false branch
  160.   	X509_PURPOSE tmp;
  161.   	int idx;
  162.   	if((purpose >= X509_PURPOSE_MIN) && (purpose <= X509_PURPOSE_MAX))
                                               ^
  163.   		return purpose - X509_PURPOSE_MIN;
  164.   	tmp.purpose = purpose;

crypto/x509v3/v3_purp.c:164:2: 
  162.   	if((purpose >= X509_PURPOSE_MIN) && (purpose <= X509_PURPOSE_MAX))
  163.   		return purpose - X509_PURPOSE_MIN;
  164. > 	tmp.purpose = purpose;
  165.   	if(!xptable) return -1;
  166.   	idx = sk_X509_PURPOSE_find(xptable, &tmp);

crypto/x509v3/v3_purp.c:165:6: Taking false branch
  163.   		return purpose - X509_PURPOSE_MIN;
  164.   	tmp.purpose = purpose;
  165.   	if(!xptable) return -1;
              ^
  166.   	idx = sk_X509_PURPOSE_find(xptable, &tmp);
  167.   	if(idx == -1) return -1;

crypto/x509v3/v3_purp.c:166:2: Skipping sk_find(): empty list of specs
  164.   	tmp.purpose = purpose;
  165.   	if(!xptable) return -1;
  166.   	idx = sk_X509_PURPOSE_find(xptable, &tmp);
          ^
  167.   	if(idx == -1) return -1;
  168.   	return idx + X509_PURPOSE_COUNT;

crypto/x509v3/v3_purp.c:167:5: Taking false branch
  165.   	if(!xptable) return -1;
  166.   	idx = sk_X509_PURPOSE_find(xptable, &tmp);
  167.   	if(idx == -1) return -1;
             ^
  168.   	return idx + X509_PURPOSE_COUNT;
  169.   }

crypto/x509v3/v3_purp.c:168:2: 
  166.   	idx = sk_X509_PURPOSE_find(xptable, &tmp);
  167.   	if(idx == -1) return -1;
  168. > 	return idx + X509_PURPOSE_COUNT;
  169.   }
  170.   

crypto/x509v3/v3_purp.c:169:1: return from a call to X509_PURPOSE_get_by_id
  167.   	if(idx == -1) return -1;
  168.   	return idx + X509_PURPOSE_COUNT;
  169. > }
  170.   
  171.   int X509_PURPOSE_add(int id, int trust, int flags,

crypto/x509v3/v3_purp.c:184:5: Taking false branch
182.   	idx = X509_PURPOSE_get_by_id(id);
183.   	/* Need a new entry */
184.   	if(idx == -1) {
           ^
185.   		if(!(ptmp = OPENSSL_malloc(sizeof(X509_PURPOSE)))) {
186.   			X509V3err(X509V3_F_X509_PURPOSE_ADD,ERR_R_MALLOC_FAILURE);

crypto/x509v3/v3_purp.c:190:9: 
188.   		}
189.   		ptmp->flags = X509_PURPOSE_DYNAMIC;
190. > 	} else ptmp = X509_PURPOSE_get0(idx);
191.   
192.   	/* OPENSSL_free existing name if dynamic */

crypto/x509v3/v3_purp.c:140:1: start of procedure X509_PURPOSE_get0()
  138.   }
  139.   
  140. > X509_PURPOSE * X509_PURPOSE_get0(int idx)
  141.   {
  142.   	if(idx < 0) return NULL;

crypto/x509v3/v3_purp.c:142:5: Taking true branch
  140.   X509_PURPOSE * X509_PURPOSE_get0(int idx)
  141.   {
  142.   	if(idx < 0) return NULL;
             ^
  143.   	if(idx < X509_PURPOSE_COUNT) return xstandard + idx;
  144.   	return sk_X509_PURPOSE_value(xptable, idx - X509_PURPOSE_COUNT);

crypto/x509v3/v3_purp.c:142:14: 
  140.   X509_PURPOSE * X509_PURPOSE_get0(int idx)
  141.   {
  142. > 	if(idx < 0) return NULL;
  143.   	if(idx < X509_PURPOSE_COUNT) return xstandard + idx;
  144.   	return sk_X509_PURPOSE_value(xptable, idx - X509_PURPOSE_COUNT);

crypto/x509v3/v3_purp.c:145:1: return from a call to X509_PURPOSE_get0
  143.   	if(idx < X509_PURPOSE_COUNT) return xstandard + idx;
  144.   	return sk_X509_PURPOSE_value(xptable, idx - X509_PURPOSE_COUNT);
  145. > }
  146.   
  147.   int X509_PURPOSE_get_by_sname(char *sname)

crypto/x509v3/v3_purp.c:193:5: 
191.   
192.   	/* OPENSSL_free existing name if dynamic */
193. > 	if(ptmp->flags & X509_PURPOSE_DYNAMIC_NAME) {
194.   		OPENSSL_free(ptmp->name);
195.   		OPENSSL_free(ptmp->sname);
