crypto/ts/ts_rsp_verify.c:375: error: NULL_DEREFERENCE
  pointer `signer` last assigned on line 344 could be null and is dereferenced by call to `ts_check_signer_name()` at line 375, column 25.
Showing all 38 steps of the trace


crypto/ts/ts_rsp_verify.c:341:1: start of procedure int_ts_RESP_verify_token()
339.    *      - Check if the TSA name is the expected TSA.
340.    */
341. > static int int_ts_RESP_verify_token(TS_VERIFY_CTX *ctx,
342.                                       PKCS7 *token, TS_TST_INFO *tst_info)
343.   {

crypto/ts/ts_rsp_verify.c:344:5: 
342.                                       PKCS7 *token, TS_TST_INFO *tst_info)
343.   {
344. >     X509 *signer = NULL;
345.       GENERAL_NAME *tsa_name = tst_info->tsa;
346.       X509_ALGOR *md_alg = NULL;

crypto/ts/ts_rsp_verify.c:345:5: 
343.   {
344.       X509 *signer = NULL;
345. >     GENERAL_NAME *tsa_name = tst_info->tsa;
346.       X509_ALGOR *md_alg = NULL;
347.       unsigned char *imprint = NULL;

crypto/ts/ts_rsp_verify.c:346:5: 
344.       X509 *signer = NULL;
345.       GENERAL_NAME *tsa_name = tst_info->tsa;
346. >     X509_ALGOR *md_alg = NULL;
347.       unsigned char *imprint = NULL;
348.       unsigned imprint_len = 0;

crypto/ts/ts_rsp_verify.c:347:5: 
345.       GENERAL_NAME *tsa_name = tst_info->tsa;
346.       X509_ALGOR *md_alg = NULL;
347. >     unsigned char *imprint = NULL;
348.       unsigned imprint_len = 0;
349.       int ret = 0;

crypto/ts/ts_rsp_verify.c:348:5: 
346.       X509_ALGOR *md_alg = NULL;
347.       unsigned char *imprint = NULL;
348. >     unsigned imprint_len = 0;
349.       int ret = 0;
350.   

crypto/ts/ts_rsp_verify.c:349:5: 
347.       unsigned char *imprint = NULL;
348.       unsigned imprint_len = 0;
349. >     int ret = 0;
350.   
351.       if ((ctx->flags & TS_VFY_SIGNATURE)

crypto/ts/ts_rsp_verify.c:351:10: Taking false branch
349.       int ret = 0;
350.   
351.       if ((ctx->flags & TS_VFY_SIGNATURE)
                ^
352.           && !TS_RESP_verify_signature(token, ctx->certs, ctx->store, &signer))
353.           goto err;

crypto/ts/ts_rsp_verify.c:354:10: Taking false branch
352.           && !TS_RESP_verify_signature(token, ctx->certs, ctx->store, &signer))
353.           goto err;
354.       if ((ctx->flags & TS_VFY_VERSION)
                ^
355.           && TS_TST_INFO_get_version(tst_info) != 1) {
356.           TSerr(TS_F_INT_TS_RESP_VERIFY_TOKEN, TS_R_UNSUPPORTED_VERSION);

crypto/ts/ts_rsp_verify.c:359:10: Taking true branch
357.           goto err;
358.       }
359.       if ((ctx->flags & TS_VFY_POLICY)
                ^
360.           && !ts_check_policy(ctx->policy, tst_info))
361.           goto err;

crypto/ts/ts_rsp_verify.c:360:13: 
358.       }
359.       if ((ctx->flags & TS_VFY_POLICY)
360. >         && !ts_check_policy(ctx->policy, tst_info))
361.           goto err;
362.       if ((ctx->flags & TS_VFY_IMPRINT)

crypto/ts/ts_rsp_verify.c:473:1: start of procedure ts_check_policy()
  471.   }
  472.   
  473. > static int ts_check_policy(ASN1_OBJECT *req_oid, TS_TST_INFO *tst_info)
  474.   {
  475.       ASN1_OBJECT *resp_oid = tst_info->policy_id;

crypto/ts/ts_rsp_verify.c:475:5: 
  473.   static int ts_check_policy(ASN1_OBJECT *req_oid, TS_TST_INFO *tst_info)
  474.   {
  475. >     ASN1_OBJECT *resp_oid = tst_info->policy_id;
  476.   
  477.       if (OBJ_cmp(req_oid, resp_oid) != 0) {

crypto/ts/ts_rsp_verify.c:477:9: 
  475.       ASN1_OBJECT *resp_oid = tst_info->policy_id;
  476.   
  477. >     if (OBJ_cmp(req_oid, resp_oid) != 0) {
  478.           TSerr(TS_F_TS_CHECK_POLICY, TS_R_POLICY_MISMATCH);
  479.           return 0;

crypto/objects/obj_lib.c:58:1: start of procedure OBJ_cmp()
    56.   }
    57.   
    58. > int OBJ_cmp(const ASN1_OBJECT *a, const ASN1_OBJECT *b)
    59.   {
    60.       int ret;

crypto/objects/obj_lib.c:62:5: 
    60.       int ret;
    61.   
    62. >     ret = (a->length - b->length);
    63.       if (ret)
    64.           return (ret);

crypto/objects/obj_lib.c:63:9: Taking true branch
    61.   
    62.       ret = (a->length - b->length);
    63.       if (ret)
                  ^
    64.           return (ret);
    65.       return (memcmp(a->data, b->data, a->length));

crypto/objects/obj_lib.c:64:9: 
    62.       ret = (a->length - b->length);
    63.       if (ret)
    64. >         return (ret);
    65.       return (memcmp(a->data, b->data, a->length));
    66.   }

crypto/objects/obj_lib.c:66:1: return from a call to OBJ_cmp
    64.           return (ret);
    65.       return (memcmp(a->data, b->data, a->length));
    66. > }

crypto/ts/ts_rsp_verify.c:477:9: Taking false branch
  475.       ASN1_OBJECT *resp_oid = tst_info->policy_id;
  476.   
  477.       if (OBJ_cmp(req_oid, resp_oid) != 0) {
                 ^
  478.           TSerr(TS_F_TS_CHECK_POLICY, TS_R_POLICY_MISMATCH);
  479.           return 0;

crypto/ts/ts_rsp_verify.c:482:5: 
  480.       }
  481.   
  482. >     return 1;
  483.   }
  484.   

crypto/ts/ts_rsp_verify.c:483:1: return from a call to ts_check_policy
  481.   
  482.       return 1;
  483. > }
  484.   
  485.   static int ts_compute_imprint(BIO *data, TS_TST_INFO *tst_info,

crypto/ts/ts_rsp_verify.c:360:13: Taking false branch
358.       }
359.       if ((ctx->flags & TS_VFY_POLICY)
360.           && !ts_check_policy(ctx->policy, tst_info))
                   ^
361.           goto err;
362.       if ((ctx->flags & TS_VFY_IMPRINT)

crypto/ts/ts_rsp_verify.c:362:10: Taking true branch
360.           && !ts_check_policy(ctx->policy, tst_info))
361.           goto err;
362.       if ((ctx->flags & TS_VFY_IMPRINT)
                ^
363.           && !ts_check_imprints(ctx->md_alg, ctx->imprint, ctx->imprint_len,
364.                                 tst_info))

crypto/ts/ts_rsp_verify.c:363:13: Taking false branch
361.           goto err;
362.       if ((ctx->flags & TS_VFY_IMPRINT)
363.           && !ts_check_imprints(ctx->md_alg, ctx->imprint, ctx->imprint_len,
                   ^
364.                                 tst_info))
365.           goto err;

crypto/ts/ts_rsp_verify.c:366:10: Taking false branch
364.                                 tst_info))
365.           goto err;
366.       if ((ctx->flags & TS_VFY_DATA)
                ^
367.           && (!ts_compute_imprint(ctx->data, tst_info,
368.                                   &md_alg, &imprint, &imprint_len)

crypto/ts/ts_rsp_verify.c:371:10: Taking false branch
369.               || !ts_check_imprints(md_alg, imprint, imprint_len, tst_info)))
370.           goto err;
371.       if ((ctx->flags & TS_VFY_NONCE)
                ^
372.           && !ts_check_nonces(ctx->nonce, tst_info))
373.           goto err;

crypto/ts/ts_rsp_verify.c:374:10: Taking true branch
372.           && !ts_check_nonces(ctx->nonce, tst_info))
373.           goto err;
374.       if ((ctx->flags & TS_VFY_SIGNER)
                ^
375.           && tsa_name && !ts_check_signer_name(tsa_name, signer)) {
376.           TSerr(TS_F_INT_TS_RESP_VERIFY_TOKEN, TS_R_TSA_NAME_MISMATCH);

crypto/ts/ts_rsp_verify.c:375:12: Taking true branch
373.           goto err;
374.       if ((ctx->flags & TS_VFY_SIGNER)
375.           && tsa_name && !ts_check_signer_name(tsa_name, signer)) {
                  ^
376.           TSerr(TS_F_INT_TS_RESP_VERIFY_TOKEN, TS_R_TSA_NAME_MISMATCH);
377.           goto err;

crypto/ts/ts_rsp_verify.c:375:25: 
373.           goto err;
374.       if ((ctx->flags & TS_VFY_SIGNER)
375. >         && tsa_name && !ts_check_signer_name(tsa_name, signer)) {
376.           TSerr(TS_F_INT_TS_RESP_VERIFY_TOKEN, TS_R_TSA_NAME_MISMATCH);
377.           goto err;

crypto/ts/ts_rsp_verify.c:589:1: start of procedure ts_check_signer_name()
  587.    * subject alternative names of the TSA certificate.
  588.    */
  589. > static int ts_check_signer_name(GENERAL_NAME *tsa_name, X509 *signer)
  590.   {
  591.       STACK_OF(GENERAL_NAME) *gen_names = NULL;

crypto/ts/ts_rsp_verify.c:591:5: 
  589.   static int ts_check_signer_name(GENERAL_NAME *tsa_name, X509 *signer)
  590.   {
  591. >     STACK_OF(GENERAL_NAME) *gen_names = NULL;
  592.       int idx = -1;
  593.       int found = 0;

crypto/ts/ts_rsp_verify.c:592:5: 
  590.   {
  591.       STACK_OF(GENERAL_NAME) *gen_names = NULL;
  592. >     int idx = -1;
  593.       int found = 0;
  594.   

crypto/ts/ts_rsp_verify.c:593:5: 
  591.       STACK_OF(GENERAL_NAME) *gen_names = NULL;
  592.       int idx = -1;
  593. >     int found = 0;
  594.   
  595.       if (tsa_name->type == GEN_DIRNAME

crypto/ts/ts_rsp_verify.c:595:9: Taking false branch
  593.       int found = 0;
  594.   
  595.       if (tsa_name->type == GEN_DIRNAME
                 ^
  596.           && X509_name_cmp(tsa_name->d.dirn, X509_get_subject_name(signer)) == 0)
  597.           return 1;

crypto/ts/ts_rsp_verify.c:598:5: 
  596.           && X509_name_cmp(tsa_name->d.dirn, X509_get_subject_name(signer)) == 0)
  597.           return 1;
  598. >     gen_names = X509_get_ext_d2i(signer, NID_subject_alt_name, NULL, &idx);
  599.       while (gen_names != NULL) {
  600.           found = ts_find_name(gen_names, tsa_name) >= 0;

crypto/x509/x509_ext.c:102:1: start of procedure X509_get_ext_d2i()
    100.   }
    101.   
    102. > void *X509_get_ext_d2i(X509 *x, int nid, int *crit, int *idx)
    103.   {
    104.       return X509V3_get_d2i(x->cert_info.extensions, nid, crit, idx);

crypto/x509/x509_ext.c:104:5: 
    102.   void *X509_get_ext_d2i(X509 *x, int nid, int *crit, int *idx)
    103.   {
    104. >     return X509V3_get_d2i(x->cert_info.extensions, nid, crit, idx);
    105.   }
    106.   
