crypto/x509/x509_lu.c:666: error: NULL_DEREFERENCE
  pointer `pobj` last assigned on line 664 could be null and is dereferenced at line 666, column 7.
Showing all 35 steps of the trace


crypto/x509/x509_lu.c:626:1: start of procedure X509_STORE_CTX_get1_issuer()
624.   
625.   
626. > int X509_STORE_CTX_get1_issuer(X509 **issuer, X509_STORE_CTX *ctx, X509 *x)
627.   {
628.   	X509_NAME *xn;

crypto/x509/x509_lu.c:631:2: 
629.   	X509_OBJECT obj, *pobj;
630.   	int i, ok, idx;
631. > 	xn=X509_get_issuer_name(x);
632.   	ok=X509_STORE_get_by_subject(ctx,X509_LU_X509,xn,&obj);
633.   	if (ok != X509_LU_X509)

crypto/x509/x509_cmp.c:131:1: start of procedure X509_get_issuer_name()
  129.   #endif
  130.   
  131. > X509_NAME *X509_get_issuer_name(X509 *a)
  132.   	{
  133.   	return(a->cert_info->issuer);

crypto/x509/x509_cmp.c:133:2: 
  131.   X509_NAME *X509_get_issuer_name(X509 *a)
  132.   	{
  133. > 	return(a->cert_info->issuer);
  134.   	}
  135.   

crypto/x509/x509_cmp.c:134:2: return from a call to X509_get_issuer_name
  132.   	{
  133.   	return(a->cert_info->issuer);
  134.   	}
          ^
  135.   
  136.   unsigned long X509_issuer_name_hash(X509 *x)

crypto/x509/x509_lu.c:632:2: Skipping X509_STORE_get_by_subject(): empty list of specs
630.   	int i, ok, idx;
631.   	xn=X509_get_issuer_name(x);
632.   	ok=X509_STORE_get_by_subject(ctx,X509_LU_X509,xn,&obj);
        ^
633.   	if (ok != X509_LU_X509)
634.   		{

crypto/x509/x509_lu.c:633:6: Taking false branch
631.   	xn=X509_get_issuer_name(x);
632.   	ok=X509_STORE_get_by_subject(ctx,X509_LU_X509,xn,&obj);
633.   	if (ok != X509_LU_X509)
            ^
634.   		{
635.   		if (ok == X509_LU_RETRY)

crypto/x509/x509_lu.c:650:6: Taking false branch
648.   		}
649.   	/* If certificate matches all OK */
650.   	if (ctx->check_issued(ctx, x, obj.data.x509))
            ^
651.   		{
652.   		*issuer = obj.data.x509;

crypto/x509/x509_lu.c:655:2: 
653.   		return 1;
654.   		}
655. > 	X509_OBJECT_free_contents(&obj);
656.   	/* Else find index of first matching cert */
657.   	idx = X509_OBJECT_idx_by_subject(ctx->ctx->objs, X509_LU_X509, xn);

crypto/x509/x509_lu.c:412:1: start of procedure X509_OBJECT_free_contents()
  410.   	}
  411.   
  412. > void X509_OBJECT_free_contents(X509_OBJECT *a)
  413.   	{
  414.   	switch (a->type)

crypto/x509/x509_lu.c:414:2: 
  412.   void X509_OBJECT_free_contents(X509_OBJECT *a)
  413.   	{
  414. > 	switch (a->type)
  415.   		{
  416.   	case X509_LU_X509:

crypto/x509/x509_lu.c:416:2: Switch condition is false. Skipping switch case
  414.   	switch (a->type)
  415.   		{
  416.   	case X509_LU_X509:
          ^
  417.   		X509_free(a->data.x509);
  418.   		break;

crypto/x509/x509_lu.c:419:2: Switch condition is false. Skipping switch case
  417.   		X509_free(a->data.x509);
  418.   		break;
  419.   	case X509_LU_CRL:
          ^
  420.   		X509_CRL_free(a->data.crl);
  421.   		break;

crypto/x509/x509_lu.c:423:2: return from a call to X509_OBJECT_free_contents
  421.   		break;
  422.   		}
  423.   	}
          ^
  424.   
  425.   static int x509_object_idx_cnt(STACK_OF(X509_OBJECT) *h, int type,

crypto/x509/x509_lu.c:657:2: 
655.   	X509_OBJECT_free_contents(&obj);
656.   	/* Else find index of first matching cert */
657. > 	idx = X509_OBJECT_idx_by_subject(ctx->ctx->objs, X509_LU_X509, xn);
658.   	/* This shouldn't normally happen since we already have one match */
659.   	if (idx == -1) return 0;

crypto/x509/x509_lu.c:472:1: start of procedure X509_OBJECT_idx_by_subject()
  470.   
  471.   
  472. > int X509_OBJECT_idx_by_subject(STACK_OF(X509_OBJECT) *h, int type,
  473.   	     X509_NAME *name)
  474.   	{

crypto/x509/x509_lu.c:475:2: Skipping x509_object_idx_cnt(): empty list of specs
  473.   	     X509_NAME *name)
  474.   	{
  475.   	return x509_object_idx_cnt(h, type, name, NULL);
          ^
  476.   	}
  477.   

crypto/x509/x509_lu.c:476:2: return from a call to X509_OBJECT_idx_by_subject
  474.   	{
  475.   	return x509_object_idx_cnt(h, type, name, NULL);
  476.   	}
          ^
  477.   
  478.   X509_OBJECT *X509_OBJECT_retrieve_by_subject(STACK_OF(X509_OBJECT) *h, int type,

crypto/x509/x509_lu.c:659:6: Taking false branch
657.   	idx = X509_OBJECT_idx_by_subject(ctx->ctx->objs, X509_LU_X509, xn);
658.   	/* This shouldn't normally happen since we already have one match */
659.   	if (idx == -1) return 0;
            ^
660.   
661.   	/* Look through all matching certificates for a suitable issuer */

crypto/x509/x509_lu.c:662:7: 
660.   
661.   	/* Look through all matching certificates for a suitable issuer */
662. > 	for (i = idx; i < sk_X509_OBJECT_num(ctx->ctx->objs); i++)
663.   		{
664.   		pobj = sk_X509_OBJECT_value(ctx->ctx->objs, i);

crypto/x509/x509_lu.c:662:20: Condition is true
660.   
661.   	/* Look through all matching certificates for a suitable issuer */
662.   	for (i = idx; i < sk_X509_OBJECT_num(ctx->ctx->objs); i++)
                          ^
663.   		{
664.   		pobj = sk_X509_OBJECT_value(ctx->ctx->objs, i);

crypto/x509/x509_lu.c:662:16: 
660.   
661.   	/* Look through all matching certificates for a suitable issuer */
662. > 	for (i = idx; i < sk_X509_OBJECT_num(ctx->ctx->objs); i++)
663.   		{
664.   		pobj = sk_X509_OBJECT_value(ctx->ctx->objs, i);

crypto/stack/stack.c:294:1: start of procedure sk_num()
  292.   	}
  293.   
  294. > int sk_num(const _STACK *st)
  295.   {
  296.   	if(st == NULL) return -1;

crypto/stack/stack.c:296:5: Taking false branch
  294.   int sk_num(const _STACK *st)
  295.   {
  296.   	if(st == NULL) return -1;
             ^
  297.   	return st->num;
  298.   }

crypto/stack/stack.c:297:2: 
  295.   {
  296.   	if(st == NULL) return -1;
  297. > 	return st->num;
  298.   }
  299.   

crypto/stack/stack.c:298:1: return from a call to sk_num
  296.   	if(st == NULL) return -1;
  297.   	return st->num;
  298. > }
  299.   
  300.   void *sk_value(const _STACK *st, int i)

crypto/x509/x509_lu.c:662:16: Loop condition is true. Entering loop body
660.   
661.   	/* Look through all matching certificates for a suitable issuer */
662.   	for (i = idx; i < sk_X509_OBJECT_num(ctx->ctx->objs); i++)
                      ^
663.   		{
664.   		pobj = sk_X509_OBJECT_value(ctx->ctx->objs, i);

crypto/x509/x509_lu.c:664:10: Condition is true
662.   	for (i = idx; i < sk_X509_OBJECT_num(ctx->ctx->objs); i++)
663.   		{
664.   		pobj = sk_X509_OBJECT_value(ctx->ctx->objs, i);
                ^
665.   		/* See if we've ran out of matches */
666.   		if (pobj->type != X509_LU_X509) return 0;

crypto/x509/x509_lu.c:664:3: 
662.   	for (i = idx; i < sk_X509_OBJECT_num(ctx->ctx->objs); i++)
663.   		{
664. > 		pobj = sk_X509_OBJECT_value(ctx->ctx->objs, i);
665.   		/* See if we've ran out of matches */
666.   		if (pobj->type != X509_LU_X509) return 0;

crypto/stack/stack.c:300:1: start of procedure sk_value()
  298.   }
  299.   
  300. > void *sk_value(const _STACK *st, int i)
  301.   {
  302.   	if(!st || (i < 0) || (i >= st->num)) return NULL;

crypto/stack/stack.c:302:6: Taking false branch
  300.   void *sk_value(const _STACK *st, int i)
  301.   {
  302.   	if(!st || (i < 0) || (i >= st->num)) return NULL;
              ^
  303.   	return st->data[i];
  304.   }

crypto/stack/stack.c:302:13: Taking true branch
  300.   void *sk_value(const _STACK *st, int i)
  301.   {
  302.   	if(!st || (i < 0) || (i >= st->num)) return NULL;
                     ^
  303.   	return st->data[i];
  304.   }

crypto/stack/stack.c:302:39: 
  300.   void *sk_value(const _STACK *st, int i)
  301.   {
  302. > 	if(!st || (i < 0) || (i >= st->num)) return NULL;
  303.   	return st->data[i];
  304.   }

crypto/stack/stack.c:304:1: return from a call to sk_value
  302.   	if(!st || (i < 0) || (i >= st->num)) return NULL;
  303.   	return st->data[i];
  304. > }
  305.   
  306.   void *sk_set(_STACK *st, int i, void *value)

crypto/x509/x509_lu.c:666:7: 
664.   		pobj = sk_X509_OBJECT_value(ctx->ctx->objs, i);
665.   		/* See if we've ran out of matches */
666. > 		if (pobj->type != X509_LU_X509) return 0;
667.   		if (X509_NAME_cmp(xn, X509_get_subject_name(pobj->data.x509))) return 0;
668.   		if (ctx->check_issued(ctx, x, pobj->data.x509))
