crypto/pkcs12/p12_sbag.c:144: error: NULL_DEREFERENCE
  pointer `pbe_ciph` last assigned on line 139 could be null and is dereferenced by call to `PKCS8_encrypt()` at line 144, column 10.
Showing all 53 steps of the trace


crypto/pkcs12/p12_sbag.c:128:1: start of procedure PKCS12_SAFEBAG_create_pkcs8_encrypt()
126.   }
127.   
128. > PKCS12_SAFEBAG *PKCS12_SAFEBAG_create_pkcs8_encrypt(int pbe_nid,
129.                                                       const char *pass,
130.                                                       int passlen,

crypto/pkcs12/p12_sbag.c:139:5: 
137.       X509_SIG *p8;
138.   
139. >     pbe_ciph = EVP_get_cipherbynid(pbe_nid);
140.   
141.       if (pbe_ciph)

crypto/objects/obj_dat.c:247:1: start of procedure OBJ_nid2sn()
  245.   }
  246.   
  247. > const char *OBJ_nid2sn(int n)
  248.   {
  249.       ADDED_OBJ ad, *adp;

crypto/objects/obj_dat.c:252:10: Taking true branch
  250.       ASN1_OBJECT ob;
  251.   
  252.       if ((n >= 0) && (n < NUM_NID)) {
                  ^
  253.           if ((n != NID_undef) && (nid_objs[n].nid == NID_undef)) {
  254.               OBJerr(OBJ_F_OBJ_NID2SN, OBJ_R_UNKNOWN_NID);

crypto/objects/obj_dat.c:252:22: Taking true branch
  250.       ASN1_OBJECT ob;
  251.   
  252.       if ((n >= 0) && (n < NUM_NID)) {
                              ^
  253.           if ((n != NID_undef) && (nid_objs[n].nid == NID_undef)) {
  254.               OBJerr(OBJ_F_OBJ_NID2SN, OBJ_R_UNKNOWN_NID);

crypto/objects/obj_dat.c:253:14: Taking true branch
  251.   
  252.       if ((n >= 0) && (n < NUM_NID)) {
  253.           if ((n != NID_undef) && (nid_objs[n].nid == NID_undef)) {
                      ^
  254.               OBJerr(OBJ_F_OBJ_NID2SN, OBJ_R_UNKNOWN_NID);
  255.               return (NULL);

crypto/objects/obj_dat.c:253:34: Taking false branch
  251.   
  252.       if ((n >= 0) && (n < NUM_NID)) {
  253.           if ((n != NID_undef) && (nid_objs[n].nid == NID_undef)) {
                                          ^
  254.               OBJerr(OBJ_F_OBJ_NID2SN, OBJ_R_UNKNOWN_NID);
  255.               return (NULL);

crypto/objects/obj_dat.c:257:9: 
  255.               return (NULL);
  256.           }
  257. >         return (nid_objs[n].sn);
  258.       } else if (added == NULL)
  259.           return (NULL);

crypto/objects/obj_dat.c:272:1: return from a call to OBJ_nid2sn
  270.           }
  271.       }
  272. > }
  273.   
  274.   const char *OBJ_nid2ln(int n)

crypto/evp/names.c:58:1: start of procedure EVP_get_cipherbyname()
  56.   }
  57.   
  58. > const EVP_CIPHER *EVP_get_cipherbyname(const char *name)
  59.   {
  60.       const EVP_CIPHER *cp;

crypto/evp/names.c:62:10: Taking false branch
  60.       const EVP_CIPHER *cp;
  61.   
  62.       if (!OPENSSL_init_crypto(OPENSSL_INIT_ADD_ALL_CIPHERS, NULL))
                 ^
  63.           return NULL;
  64.   

crypto/evp/names.c:65:5: 
  63.           return NULL;
  64.   
  65. >     cp = (const EVP_CIPHER *)OBJ_NAME_get(name, OBJ_NAME_TYPE_CIPHER_METH);
  66.       return (cp);
  67.   }

crypto/objects/o_names.c:150:1: start of procedure OBJ_NAME_get()
    148.   }
    149.   
    150. > const char *OBJ_NAME_get(const char *name, int type)
    151.   {
    152.       OBJ_NAME on, *ret;

crypto/objects/o_names.c:153:5: 
    151.   {
    152.       OBJ_NAME on, *ret;
    153. >     int num = 0, alias;
    154.   
    155.       if (name == NULL)

crypto/objects/o_names.c:155:9: Taking false branch
    153.       int num = 0, alias;
    154.   
    155.       if (name == NULL)
                   ^
    156.           return (NULL);
    157.       if ((names_lh == NULL) && !OBJ_NAME_init())

crypto/objects/o_names.c:157:10: Taking false branch
    155.       if (name == NULL)
    156.           return (NULL);
    157.       if ((names_lh == NULL) && !OBJ_NAME_init())
                    ^
    158.           return (NULL);
    159.   

crypto/objects/o_names.c:160:5: 
    158.           return (NULL);
    159.   
    160. >     alias = type & OBJ_NAME_ALIAS;
    161.       type &= ~OBJ_NAME_ALIAS;
    162.   

crypto/objects/o_names.c:161:5: 
    159.   
    160.       alias = type & OBJ_NAME_ALIAS;
    161. >     type &= ~OBJ_NAME_ALIAS;
    162.   
    163.       on.name = name;

crypto/objects/o_names.c:163:5: 
    161.       type &= ~OBJ_NAME_ALIAS;
    162.   
    163. >     on.name = name;
    164.       on.type = type;
    165.   

crypto/objects/o_names.c:164:5: 
    162.   
    163.       on.name = name;
    164. >     on.type = type;
    165.   
    166.       for (;;) {

crypto/objects/o_names.c:177:5: Loop condition is true. Entering loop body
    175.               return (ret->data);
    176.           }
    177.       }
               ^
    178.   }
    179.   

crypto/objects/o_names.c:167:9: 
    165.   
    166.       for (;;) {
    167. >         ret = lh_OBJ_NAME_retrieve(names_lh, &on);
    168.           if (ret == NULL)
    169.               return (NULL);

crypto/objects/obj_lcl.h:12:1: start of procedure lh_OBJ_NAME_retrieve()
      10.   typedef struct name_funcs_st NAME_FUNCS;
      11.   DEFINE_STACK_OF(NAME_FUNCS)
      12. > DEFINE_LHASH_OF(OBJ_NAME);
      13.   typedef struct added_obj_st ADDED_OBJ;
      14.   DEFINE_LHASH_OF(ADDED_OBJ);

crypto/lhash/lhash.c:131:1: start of procedure OPENSSL_LH_retrieve()
        129.   }
        130.   
        131. > void *OPENSSL_LH_retrieve(OPENSSL_LHASH *lh, const void *data)
        132.   {
        133.       unsigned long hash;

crypto/lhash/lhash.c:137:5: 
        135.       void *ret;
        136.   
        137. >     lh->error = 0;
        138.       rn = getrn(lh, data, &hash);
        139.   

crypto/lhash/lhash.c:138:5: Skipping getrn(): empty list of specs
        136.   
        137.       lh->error = 0;
        138.       rn = getrn(lh, data, &hash);
                   ^
        139.   
        140.       if (*rn == NULL) {

crypto/lhash/lhash.c:140:9: Taking true branch
        138.       rn = getrn(lh, data, &hash);
        139.   
        140.       if (*rn == NULL) {
                       ^
        141.           lh->num_retrieve_miss++;
        142.           return (NULL);

crypto/lhash/lhash.c:141:9: 
        139.   
        140.       if (*rn == NULL) {
        141. >         lh->num_retrieve_miss++;
        142.           return (NULL);
        143.       } else {

crypto/lhash/lhash.c:142:9: 
        140.       if (*rn == NULL) {
        141.           lh->num_retrieve_miss++;
        142. >         return (NULL);
        143.       } else {
        144.           ret = (*rn)->data;

crypto/lhash/lhash.c:148:1: return from a call to OPENSSL_LH_retrieve
        146.       }
        147.       return (ret);
        148. > }
        149.   
        150.   static void doall_util_fn(OPENSSL_LHASH *lh, int use_arg,

crypto/objects/obj_lcl.h:12:1: return from a call to lh_OBJ_NAME_retrieve
      10.   typedef struct name_funcs_st NAME_FUNCS;
      11.   DEFINE_STACK_OF(NAME_FUNCS)
      12. > DEFINE_LHASH_OF(OBJ_NAME);
      13.   typedef struct added_obj_st ADDED_OBJ;
      14.   DEFINE_LHASH_OF(ADDED_OBJ);

crypto/objects/o_names.c:168:13: Taking true branch
    166.       for (;;) {
    167.           ret = lh_OBJ_NAME_retrieve(names_lh, &on);
    168.           if (ret == NULL)
                       ^
    169.               return (NULL);
    170.           if ((ret->alias) && !alias) {

crypto/objects/o_names.c:169:13: 
    167.           ret = lh_OBJ_NAME_retrieve(names_lh, &on);
    168.           if (ret == NULL)
    169. >             return (NULL);
    170.           if ((ret->alias) && !alias) {
    171.               if (++num > 10)

crypto/objects/o_names.c:178:1: return from a call to OBJ_NAME_get
    176.           }
    177.       }
    178. > }
    179.   
    180.   int OBJ_NAME_add(const char *name, int type, const char *data)

crypto/evp/names.c:66:5: 
  64.   
  65.       cp = (const EVP_CIPHER *)OBJ_NAME_get(name, OBJ_NAME_TYPE_CIPHER_METH);
  66. >     return (cp);
  67.   }
  68.   

crypto/evp/names.c:67:1: return from a call to EVP_get_cipherbyname
  65.       cp = (const EVP_CIPHER *)OBJ_NAME_get(name, OBJ_NAME_TYPE_CIPHER_METH);
  66.       return (cp);
  67. > }
  68.   
  69.   const EVP_MD *EVP_get_digestbyname(const char *name)

crypto/pkcs12/p12_sbag.c:141:9: Taking false branch
139.       pbe_ciph = EVP_get_cipherbynid(pbe_nid);
140.   
141.       if (pbe_ciph)
               ^
142.           pbe_nid = -1;
143.   

crypto/pkcs12/p12_sbag.c:144:5: 
142.           pbe_nid = -1;
143.   
144. >     p8 = PKCS8_encrypt(pbe_nid, pbe_ciph, pass, passlen, salt, saltlen, iter,
145.                          p8inf);
146.   

crypto/pkcs12/p12_p8e.c:15:1: start of procedure PKCS8_encrypt()
  13.   #include "internal/x509_int.h"
  14.   
  15. > X509_SIG *PKCS8_encrypt(int pbe_nid, const EVP_CIPHER *cipher,
  16.                           const char *pass, int passlen,
  17.                           unsigned char *salt, int saltlen, int iter,

crypto/pkcs12/p12_p8e.c:20:5: 
  18.                           PKCS8_PRIV_KEY_INFO *p8inf)
  19.   {
  20. >     X509_SIG *p8 = NULL;
  21.       X509_ALGOR *pbe;
  22.   

crypto/pkcs12/p12_p8e.c:23:9: Taking true branch
  21.       X509_ALGOR *pbe;
  22.   
  23.       if (pbe_nid == -1)
                ^
  24.           pbe = PKCS5_pbe2_set(cipher, iter, salt, saltlen);
  25.       else if (EVP_PBE_find(EVP_PBE_TYPE_PRF, pbe_nid, NULL, NULL, 0))

crypto/pkcs12/p12_p8e.c:24:9: 
  22.   
  23.       if (pbe_nid == -1)
  24. >         pbe = PKCS5_pbe2_set(cipher, iter, salt, saltlen);
  25.       else if (EVP_PBE_find(EVP_PBE_TYPE_PRF, pbe_nid, NULL, NULL, 0))
  26.           pbe = PKCS5_pbe2_set_iv(cipher, iter, salt, saltlen, NULL, pbe_nid);

crypto/asn1/p5_pbev2.c:147:1: start of procedure PKCS5_pbe2_set()
    145.   }
    146.   
    147. > X509_ALGOR *PKCS5_pbe2_set(const EVP_CIPHER *cipher, int iter,
    148.                              unsigned char *salt, int saltlen)
    149.   {

crypto/asn1/p5_pbev2.c:150:5: 
    148.                              unsigned char *salt, int saltlen)
    149.   {
    150. >     return PKCS5_pbe2_set_iv(cipher, iter, salt, saltlen, NULL, -1);
    151.   }
    152.   

crypto/asn1/p5_pbev2.c:40:1: start of procedure PKCS5_pbe2_set_iv()
      38.    */
      39.   
      40. > X509_ALGOR *PKCS5_pbe2_set_iv(const EVP_CIPHER *cipher, int iter,
      41.                                 unsigned char *salt, int saltlen,
      42.                                 unsigned char *aiv, int prf_nid)

crypto/asn1/p5_pbev2.c:44:5: 
      42.                                 unsigned char *aiv, int prf_nid)
      43.   {
      44. >     X509_ALGOR *scheme = NULL, *kalg = NULL, *ret = NULL;
      45.       int alg_nid, keylen;
      46.       EVP_CIPHER_CTX *ctx = NULL;

crypto/asn1/p5_pbev2.c:46:5: 
      44.       X509_ALGOR *scheme = NULL, *kalg = NULL, *ret = NULL;
      45.       int alg_nid, keylen;
      46. >     EVP_CIPHER_CTX *ctx = NULL;
      47.       unsigned char iv[EVP_MAX_IV_LENGTH];
      48.       PBE2PARAM *pbe2 = NULL;

crypto/asn1/p5_pbev2.c:48:5: 
      46.       EVP_CIPHER_CTX *ctx = NULL;
      47.       unsigned char iv[EVP_MAX_IV_LENGTH];
      48. >     PBE2PARAM *pbe2 = NULL;
      49.       ASN1_OBJECT *obj;
      50.   

crypto/asn1/p5_pbev2.c:51:5: 
      49.       ASN1_OBJECT *obj;
      50.   
      51. >     alg_nid = EVP_CIPHER_type(cipher);
      52.       if (alg_nid == NID_undef) {
      53.           ASN1err(ASN1_F_PKCS5_PBE2_SET_IV,

crypto/evp/evp_lib.c:106:1: start of procedure EVP_CIPHER_type()
        104.   
        105.   /* Convert the various cipher NIDs and dummies to a proper OID NID */
        106. > int EVP_CIPHER_type(const EVP_CIPHER *ctx)
        107.   {
        108.       int nid;

crypto/evp/evp_lib.c:110:5: 
        108.       int nid;
        109.       ASN1_OBJECT *otmp;
        110. >     nid = EVP_CIPHER_nid(ctx);
        111.   
        112.       switch (nid) {

crypto/evp/evp_lib.c:276:1: start of procedure EVP_CIPHER_nid()
          274.   }
          275.   
          276. > int EVP_CIPHER_nid(const EVP_CIPHER *cipher)
          277.   {
          278.       return cipher->nid;

crypto/evp/evp_lib.c:278:5: 
          276.   int EVP_CIPHER_nid(const EVP_CIPHER *cipher)
          277.   {
          278. >     return cipher->nid;
          279.   }
          280.   
