crypto/x509/x509_vfy.c:634: error: NULL_DEREFERENCE
  pointer `x` last assigned on line 616 could be null and is dereferenced by call to `X509_check_ca()` at line 634, column 15.
Showing all 26 steps of the trace


crypto/x509/x509_vfy.c:576:1: start of procedure check_chain_extensions()
574.    */
575.   
576. > static int check_chain_extensions(X509_STORE_CTX *ctx)
577.   {
578.       int i, ok = 0, must_be_ca, plen = 0;

crypto/x509/x509_vfy.c:578:5: 
576.   static int check_chain_extensions(X509_STORE_CTX *ctx)
577.   {
578. >     int i, ok = 0, must_be_ca, plen = 0;
579.       X509 *x;
580.       int (*cb) (int xok, X509_STORE_CTX *xctx);

crypto/x509/x509_vfy.c:581:5: 
579.       X509 *x;
580.       int (*cb) (int xok, X509_STORE_CTX *xctx);
581. >     int proxy_path_length = 0;
582.       int purpose;
583.       int allow_proxy_certs;

crypto/x509/x509_vfy.c:584:5: 
582.       int purpose;
583.       int allow_proxy_certs;
584. >     cb = ctx->verify_cb;
585.   
586.       /*-

crypto/x509/x509_vfy.c:595:5: 
593.        *     all certificates in the chain except the leaf certificate.
594.        */
595. >     must_be_ca = -1;
596.   
597.       /* CRL path validation */

crypto/x509/x509_vfy.c:598:9: Taking false branch
596.   
597.       /* CRL path validation */
598.       if (ctx->parent) {
               ^
599.           allow_proxy_certs = 0;
600.           purpose = X509_PURPOSE_CRL_SIGN;

crypto/x509/x509_vfy.c:603:17: Condition is true
601.       } else {
602.           allow_proxy_certs =
603.               ! !(ctx->param->flags & X509_V_FLAG_ALLOW_PROXY_CERTS);
                       ^
604.           /*
605.            * A hack to keep people who don't want to modify their software

crypto/x509/x509_vfy.c:603:13: 
601.       } else {
602.           allow_proxy_certs =
603. >             ! !(ctx->param->flags & X509_V_FLAG_ALLOW_PROXY_CERTS);
604.           /*
605.            * A hack to keep people who don't want to modify their software

crypto/x509/x509_vfy.c:602:9: 
600.           purpose = X509_PURPOSE_CRL_SIGN;
601.       } else {
602. >         allow_proxy_certs =
603.               ! !(ctx->param->flags & X509_V_FLAG_ALLOW_PROXY_CERTS);
604.           /*

crypto/x509/x509_vfy.c:608:13: Taking false branch
606.            * happy
607.            */
608.           if (getenv("OPENSSL_ALLOW_PROXY_CERTS"))
                   ^
609.               allow_proxy_certs = 1;
610.           purpose = ctx->param->purpose;

crypto/x509/x509_vfy.c:610:9: 
608.           if (getenv("OPENSSL_ALLOW_PROXY_CERTS"))
609.               allow_proxy_certs = 1;
610. >         purpose = ctx->param->purpose;
611.       }
612.   

crypto/x509/x509_vfy.c:614:10: 
612.   
613.       /* Check all untrusted certificates */
614. >     for (i = 0; i < ctx->last_untrusted; i++) {
615.           int ret;
616.           x = sk_X509_value(ctx->chain, i);

crypto/x509/x509_vfy.c:614:17: Loop condition is true. Entering loop body
612.   
613.       /* Check all untrusted certificates */
614.       for (i = 0; i < ctx->last_untrusted; i++) {
                       ^
615.           int ret;
616.           x = sk_X509_value(ctx->chain, i);

crypto/x509/x509_vfy.c:616:13: Condition is true
614.       for (i = 0; i < ctx->last_untrusted; i++) {
615.           int ret;
616.           x = sk_X509_value(ctx->chain, i);
                   ^
617.           if (!(ctx->param->flags & X509_V_FLAG_IGNORE_CRITICAL)
618.               && (x->ex_flags & EXFLAG_CRITICAL)) {

crypto/x509/x509_vfy.c:616:9: 
614.       for (i = 0; i < ctx->last_untrusted; i++) {
615.           int ret;
616. >         x = sk_X509_value(ctx->chain, i);
617.           if (!(ctx->param->flags & X509_V_FLAG_IGNORE_CRITICAL)
618.               && (x->ex_flags & EXFLAG_CRITICAL)) {

crypto/stack/stack.c:334:1: start of procedure sk_value()
  332.   }
  333.   
  334. > void *sk_value(const _STACK *st, int i)
  335.   {
  336.       if (!st || (i < 0) || (i >= st->num))

crypto/stack/stack.c:336:10: Taking false branch
  334.   void *sk_value(const _STACK *st, int i)
  335.   {
  336.       if (!st || (i < 0) || (i >= st->num))
                  ^
  337.           return NULL;
  338.       return st->data[i];

crypto/stack/stack.c:336:17: Taking false branch
  334.   void *sk_value(const _STACK *st, int i)
  335.   {
  336.       if (!st || (i < 0) || (i >= st->num))
                         ^
  337.           return NULL;
  338.       return st->data[i];

crypto/stack/stack.c:336:28: Taking true branch
  334.   void *sk_value(const _STACK *st, int i)
  335.   {
  336.       if (!st || (i < 0) || (i >= st->num))
                                    ^
  337.           return NULL;
  338.       return st->data[i];

crypto/stack/stack.c:337:9: 
  335.   {
  336.       if (!st || (i < 0) || (i >= st->num))
  337. >         return NULL;
  338.       return st->data[i];
  339.   }

crypto/stack/stack.c:339:1: return from a call to sk_value
  337.           return NULL;
  338.       return st->data[i];
  339. > }
  340.   
  341.   void *sk_set(_STACK *st, int i, void *value)

crypto/x509/x509_vfy.c:617:15: Taking false branch
615.           int ret;
616.           x = sk_X509_value(ctx->chain, i);
617.           if (!(ctx->param->flags & X509_V_FLAG_IGNORE_CRITICAL)
                     ^
618.               && (x->ex_flags & EXFLAG_CRITICAL)) {
619.               ctx->error = X509_V_ERR_UNHANDLED_CRITICAL_EXTENSION;

crypto/x509/x509_vfy.c:626:14: Taking false branch
624.                   goto end;
625.           }
626.           if (!allow_proxy_certs && (x->ex_flags & EXFLAG_PROXY)) {
                    ^
627.               ctx->error = X509_V_ERR_PROXY_CERTIFICATES_NOT_ALLOWED;
628.               ctx->error_depth = i;

crypto/x509/x509_vfy.c:634:9: 
632.                   goto end;
633.           }
634. >         ret = X509_check_ca(x);
635.           switch (must_be_ca) {
636.           case -1:

crypto/x509v3/v3_purp.c:569:1: start of procedure X509_check_ca()
  567.   }
  568.   
  569. > int X509_check_ca(X509 *x)
  570.   {
  571.       if (!(x->ex_flags & EXFLAG_SET)) {

crypto/x509v3/v3_purp.c:571:11: 
  569.   int X509_check_ca(X509 *x)
  570.   {
  571. >     if (!(x->ex_flags & EXFLAG_SET)) {
  572.           CRYPTO_w_lock(CRYPTO_LOCK_X509);
  573.           x509v3_cache_extensions(x);
