crypto/x509v3/v3_utl.c:367: error: NULL_DEREFERENCE
  pointer `&values` last assigned on line 295 could be null and is dereferenced by call to `X509V3_add_value()` at line 367, column 9.
Showing all 54 steps of the trace


crypto/x509v3/v3_utl.c:291:1: start of procedure X509V3_parse_list()
289.    */
290.   
291. > STACK_OF(CONF_VALUE) *X509V3_parse_list(const char *line)
292.   {
293.       char *p, *q, c;

crypto/x509v3/v3_utl.c:295:5: 
293.       char *p, *q, c;
294.       char *ntmp, *vtmp;
295. >     STACK_OF(CONF_VALUE) *values = NULL;
296.       char *linebuf;
297.       int state;

crypto/x509v3/v3_utl.c:299:5: 
297.       int state;
298.       /* We are going to modify the line so copy it first */
299. >     linebuf = OPENSSL_strdup(line);
300.       if (linebuf == NULL) {
301.           X509V3err(X509V3_F_X509V3_PARSE_LIST, ERR_R_MALLOC_FAILURE);

crypto/o_str.c:121:1: start of procedure CRYPTO_strdup()
  119.   }
  120.   
  121. > char *CRYPTO_strdup(const char *str, const char* file, int line)
  122.   {
  123.       char *ret;

crypto/o_str.c:125:9: Taking false branch
  123.       char *ret;
  124.   
  125.       if (str == NULL)
                 ^
  126.           return NULL;
  127.       ret = CRYPTO_malloc(strlen(str) + 1, file, line);

crypto/o_str.c:127:5: 
  125.       if (str == NULL)
  126.           return NULL;
  127. >     ret = CRYPTO_malloc(strlen(str) + 1, file, line);
  128.       if (ret != NULL)
  129.           strcpy(ret, str);

crypto/mem.c:120:1: start of procedure CRYPTO_malloc()
    118.   }
    119.   
    120. > void *CRYPTO_malloc(size_t num, const char *file, int line)
    121.   {
    122.       void *ret = NULL;

crypto/mem.c:122:5: 
    120.   void *CRYPTO_malloc(size_t num, const char *file, int line)
    121.   {
    122. >     void *ret = NULL;
    123.   
    124.       if (num <= 0)

crypto/mem.c:124:9: Taking false branch
    122.       void *ret = NULL;
    123.   
    124.       if (num <= 0)
                   ^
    125.           return NULL;
    126.   

crypto/mem.c:127:5: 
    125.           return NULL;
    126.   
    127. >     allow_customize = 0;
    128.   #ifndef OPENSSL_NO_CRYPTO_MDEBUG
    129.       if (call_malloc_debug) {

crypto/mem.c:137:5: 
    135.       }
    136.   #else
    137. >     (void)file;
    138.       (void)line;
    139.       ret = malloc(num);

crypto/mem.c:138:5: 
    136.   #else
    137.       (void)file;
    138. >     (void)line;
    139.       ret = malloc(num);
    140.   #endif

crypto/mem.c:139:5: 
    137.       (void)file;
    138.       (void)line;
    139. >     ret = malloc(num);
    140.   #endif
    141.   

crypto/mem.c:154:5: 
    152.   #endif
    153.   
    154. >     return ret;
    155.   }
    156.   

crypto/mem.c:155:1: return from a call to CRYPTO_malloc
    153.   
    154.       return ret;
    155. > }
    156.   
    157.   void *CRYPTO_zalloc(size_t num, const char *file, int line)

crypto/o_str.c:128:9: Taking true branch
  126.           return NULL;
  127.       ret = CRYPTO_malloc(strlen(str) + 1, file, line);
  128.       if (ret != NULL)
                 ^
  129.           strcpy(ret, str);
  130.       return ret;

crypto/o_str.c:129:9: 
  127.       ret = CRYPTO_malloc(strlen(str) + 1, file, line);
  128.       if (ret != NULL)
  129. >         strcpy(ret, str);
  130.       return ret;
  131.   }

crypto/o_str.c:130:5: 
  128.       if (ret != NULL)
  129.           strcpy(ret, str);
  130. >     return ret;
  131.   }
  132.   

crypto/o_str.c:131:1: return from a call to CRYPTO_strdup
  129.           strcpy(ret, str);
  130.       return ret;
  131. > }
  132.   
  133.   char *CRYPTO_strndup(const char *str, size_t s, const char* file, int line)

crypto/x509v3/v3_utl.c:300:9: Taking false branch
298.       /* We are going to modify the line so copy it first */
299.       linebuf = OPENSSL_strdup(line);
300.       if (linebuf == NULL) {
               ^
301.           X509V3err(X509V3_F_X509V3_PARSE_LIST, ERR_R_MALLOC_FAILURE);
302.           goto err;

crypto/x509v3/v3_utl.c:304:5: 
302.           goto err;
303.       }
304. >     state = HDR_NAME;
305.       ntmp = NULL;
306.       /* Go through all characters */

crypto/x509v3/v3_utl.c:305:5: 
303.       }
304.       state = HDR_NAME;
305. >     ntmp = NULL;
306.       /* Go through all characters */
307.       for (p = linebuf, q = linebuf; (c = *p) && (c != '\r') && (c != '\n');

crypto/x509v3/v3_utl.c:307:10: 
305.       ntmp = NULL;
306.       /* Go through all characters */
307. >     for (p = linebuf, q = linebuf; (c = *p) && (c != '\r') && (c != '\n');
308.            p++) {
309.   

crypto/x509v3/v3_utl.c:307:37: 
305.       ntmp = NULL;
306.       /* Go through all characters */
307. >     for (p = linebuf, q = linebuf; (c = *p) && (c != '\r') && (c != '\n');
308.            p++) {
309.   

crypto/x509v3/v3_utl.c:307:36: Loop condition is true. Entering loop body
305.       ntmp = NULL;
306.       /* Go through all characters */
307.       for (p = linebuf, q = linebuf; (c = *p) && (c != '\r') && (c != '\n');
                                          ^
308.            p++) {
309.   

crypto/x509v3/v3_utl.c:307:49: Loop condition is false. Leaving loop
305.       ntmp = NULL;
306.       /* Go through all characters */
307.       for (p = linebuf, q = linebuf; (c = *p) && (c != '\r') && (c != '\n');
                                                       ^
308.            p++) {
309.   

crypto/x509v3/v3_utl.c:353:9: Taking false branch
351.       }
352.   
353.       if (state == HDR_VALUE) {
               ^
354.           vtmp = strip_spaces(q);
355.           if (!vtmp) {

crypto/x509v3/v3_utl.c:362:9: Skipping strip_spaces(): empty list of specs
360.           X509V3_add_value(ntmp, vtmp, &values);
361.       } else {
362.           ntmp = strip_spaces(q);
               ^
363.           if (!ntmp) {
364.               X509V3err(X509V3_F_X509V3_PARSE_LIST, X509V3_R_INVALID_NULL_NAME);

crypto/x509v3/v3_utl.c:363:14: Taking false branch
361.       } else {
362.           ntmp = strip_spaces(q);
363.           if (!ntmp) {
                    ^
364.               X509V3err(X509V3_F_X509V3_PARSE_LIST, X509V3_R_INVALID_NULL_NAME);
365.               goto err;

crypto/x509v3/v3_utl.c:367:9: 
365.               goto err;
366.           }
367. >         X509V3_add_value(ntmp, NULL, &values);
368.       }
369.       OPENSSL_free(linebuf);

crypto/x509v3/v3_utl.c:83:1: start of procedure X509V3_add_value()
  81.   /* Add a CONF_VALUE name value pair to stack */
  82.   
  83. > int X509V3_add_value(const char *name, const char *value,
  84.                        STACK_OF(CONF_VALUE) **extlist)
  85.   {

crypto/x509v3/v3_utl.c:86:5: 
  84.                        STACK_OF(CONF_VALUE) **extlist)
  85.   {
  86. >     CONF_VALUE *vtmp = NULL;
  87.       char *tname = NULL, *tvalue = NULL;
  88.   

crypto/x509v3/v3_utl.c:87:5: 
  85.   {
  86.       CONF_VALUE *vtmp = NULL;
  87. >     char *tname = NULL, *tvalue = NULL;
  88.   
  89.       if (name && (tname = OPENSSL_strdup(name)) == NULL)

crypto/x509v3/v3_utl.c:89:9: Taking false branch
  87.       char *tname = NULL, *tvalue = NULL;
  88.   
  89.       if (name && (tname = OPENSSL_strdup(name)) == NULL)
                ^
  90.           goto err;
  91.       if (value && (tvalue = OPENSSL_strdup(value)) == NULL)

crypto/x509v3/v3_utl.c:91:9: Taking false branch
  89.       if (name && (tname = OPENSSL_strdup(name)) == NULL)
  90.           goto err;
  91.       if (value && (tvalue = OPENSSL_strdup(value)) == NULL)
                ^
  92.           goto err;
  93.       if ((vtmp = OPENSSL_malloc(sizeof(*vtmp))) == NULL)

crypto/x509v3/v3_utl.c:93:9: 
  91.       if (value && (tvalue = OPENSSL_strdup(value)) == NULL)
  92.           goto err;
  93. >     if ((vtmp = OPENSSL_malloc(sizeof(*vtmp))) == NULL)
  94.           goto err;
  95.       if (*extlist == NULL && (*extlist = sk_CONF_VALUE_new_null()) == NULL)

crypto/mem.c:120:1: start of procedure CRYPTO_malloc()
    118.   }
    119.   
    120. > void *CRYPTO_malloc(size_t num, const char *file, int line)
    121.   {
    122.       void *ret = NULL;

crypto/mem.c:122:5: 
    120.   void *CRYPTO_malloc(size_t num, const char *file, int line)
    121.   {
    122. >     void *ret = NULL;
    123.   
    124.       if (num <= 0)

crypto/mem.c:124:9: Taking false branch
    122.       void *ret = NULL;
    123.   
    124.       if (num <= 0)
                   ^
    125.           return NULL;
    126.   

crypto/mem.c:127:5: 
    125.           return NULL;
    126.   
    127. >     allow_customize = 0;
    128.   #ifndef OPENSSL_NO_CRYPTO_MDEBUG
    129.       if (call_malloc_debug) {

crypto/mem.c:137:5: 
    135.       }
    136.   #else
    137. >     (void)file;
    138.       (void)line;
    139.       ret = malloc(num);

crypto/mem.c:138:5: 
    136.   #else
    137.       (void)file;
    138. >     (void)line;
    139.       ret = malloc(num);
    140.   #endif

crypto/mem.c:139:5: 
    137.       (void)file;
    138.       (void)line;
    139. >     ret = malloc(num);
    140.   #endif
    141.   

crypto/mem.c:154:5: 
    152.   #endif
    153.   
    154. >     return ret;
    155.   }
    156.   

crypto/mem.c:155:1: return from a call to CRYPTO_malloc
    153.   
    154.       return ret;
    155. > }
    156.   
    157.   void *CRYPTO_zalloc(size_t num, const char *file, int line)

crypto/x509v3/v3_utl.c:93:9: Taking false branch
  91.       if (value && (tvalue = OPENSSL_strdup(value)) == NULL)
  92.           goto err;
  93.       if ((vtmp = OPENSSL_malloc(sizeof(*vtmp))) == NULL)
                ^
  94.           goto err;
  95.       if (*extlist == NULL && (*extlist = sk_CONF_VALUE_new_null()) == NULL)

crypto/x509v3/v3_utl.c:95:9: Taking false branch
  93.       if ((vtmp = OPENSSL_malloc(sizeof(*vtmp))) == NULL)
  94.           goto err;
  95.       if (*extlist == NULL && (*extlist = sk_CONF_VALUE_new_null()) == NULL)
                ^
  96.           goto err;
  97.       vtmp->section = NULL;

crypto/x509v3/v3_utl.c:97:5: 
  95.       if (*extlist == NULL && (*extlist = sk_CONF_VALUE_new_null()) == NULL)
  96.           goto err;
  97. >     vtmp->section = NULL;
  98.       vtmp->name = tname;
  99.       vtmp->value = tvalue;

crypto/x509v3/v3_utl.c:98:5: 
  96.           goto err;
  97.       vtmp->section = NULL;
  98. >     vtmp->name = tname;
  99.       vtmp->value = tvalue;
  100.       if (!sk_CONF_VALUE_push(*extlist, vtmp))

crypto/x509v3/v3_utl.c:99:5: 
  97.       vtmp->section = NULL;
  98.       vtmp->name = tname;
  99. >     vtmp->value = tvalue;
  100.       if (!sk_CONF_VALUE_push(*extlist, vtmp))
  101.           goto err;

crypto/x509v3/v3_utl.c:100:10: 
  98.       vtmp->name = tname;
  99.       vtmp->value = tvalue;
  100. >     if (!sk_CONF_VALUE_push(*extlist, vtmp))
  101.           goto err;
  102.       return 1;

include/openssl/conf.h:80:1: start of procedure sk_CONF_VALUE_push()
    78.   } CONF_VALUE;
    79.   
    80. > DEFINE_STACK_OF(CONF_VALUE)
    81.   DEFINE_LHASH_OF(CONF_VALUE);
    82.   

crypto/stack/stack.c:259:1: start of procedure sk_push()
      257.   }
      258.   
      259. > int sk_push(_STACK *st, void *data)
      260.   {
      261.       return (sk_insert(st, data, st->num));

crypto/stack/stack.c:261:5: 
      259.   int sk_push(_STACK *st, void *data)
      260.   {
      261. >     return (sk_insert(st, data, st->num));
      262.   }
      263.   
