ssl/statem/statem_srvr.c:3301: error: NULL_DEREFERENCE
  pointer `pk` last assigned on line 3275 could be null and is dereferenced by call to `EVP_PKEY_CTX_new()` at line 3301, column 16.
Showing all 13 steps of the trace


ssl/statem/statem_srvr.c:3271:1: start of procedure tls_process_cke_gost()
3269.   }
3270.   
3271. > static int tls_process_cke_gost(SSL *s, PACKET *pkt)
3272.   {
3273.   #ifndef OPENSSL_NO_GOST

ssl/statem/statem_srvr.c:3275:5: 
3273.   #ifndef OPENSSL_NO_GOST
3274.       EVP_PKEY_CTX *pkey_ctx;
3275. >     EVP_PKEY *client_pub_pkey = NULL, *pk = NULL;
3276.       unsigned char premaster_secret[32];
3277.       const unsigned char *start;

ssl/statem/statem_srvr.c:3278:5: 
3276.       unsigned char premaster_secret[32];
3277.       const unsigned char *start;
3278. >     size_t outlen = 32, inlen;
3279.       unsigned long alg_a;
3280.       unsigned int asn1id, asn1len;

ssl/statem/statem_srvr.c:3281:5: 
3279.       unsigned long alg_a;
3280.       unsigned int asn1id, asn1len;
3281. >     int ret = 0;
3282.       PACKET encdata;
3283.   

ssl/statem/statem_srvr.c:3285:5: 
3283.   
3284.       /* Get our certificate private key */
3285. >     alg_a = s->s3->tmp.new_cipher->algorithm_auth;
3286.       if (alg_a & SSL_aGOST12) {
3287.           /*

ssl/statem/statem_srvr.c:3286:9: Taking false branch
3284.       /* Get our certificate private key */
3285.       alg_a = s->s3->tmp.new_cipher->algorithm_auth;
3286.       if (alg_a & SSL_aGOST12) {
                ^
3287.           /*
3288.            * New GOST ciphersuites have SSL_aGOST01 bit too

ssl/statem/statem_srvr.c:3297:16: Taking false branch
3295.               pk = s->cert->pkeys[SSL_PKEY_GOST01].privatekey;
3296.           }
3297.       } else if (alg_a & SSL_aGOST01) {
                       ^
3298.           pk = s->cert->pkeys[SSL_PKEY_GOST01].privatekey;
3299.       }

ssl/statem/statem_srvr.c:3301:5: 
3299.       }
3300.   
3301. >     pkey_ctx = EVP_PKEY_CTX_new(pk, NULL);
3302.       if (pkey_ctx == NULL) {
3303.           SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_CKE_GOST,

crypto/evp/pmeth_lib.c:241:1: start of procedure EVP_PKEY_CTX_new()
  239.   }
  240.   
  241. > EVP_PKEY_CTX *EVP_PKEY_CTX_new(EVP_PKEY *pkey, ENGINE *e)
  242.   {
  243.       return int_ctx_new(pkey, e, -1);

crypto/evp/pmeth_lib.c:243:5: 
  241.   EVP_PKEY_CTX *EVP_PKEY_CTX_new(EVP_PKEY *pkey, ENGINE *e)
  242.   {
  243. >     return int_ctx_new(pkey, e, -1);
  244.   }
  245.   

crypto/evp/pmeth_lib.c:103:1: start of procedure int_ctx_new()
    101.   }
    102.   
    103. > static EVP_PKEY_CTX *int_ctx_new(EVP_PKEY *pkey, ENGINE *e, int id)
    104.   {
    105.       EVP_PKEY_CTX *ret;

crypto/evp/pmeth_lib.c:108:9: Taking true branch
    106.       const EVP_PKEY_METHOD *pmeth;
    107.   
    108.       if (id == -1) {
                   ^
    109.           id = pkey->type;
    110.       }

crypto/evp/pmeth_lib.c:109:9: 
    107.   
    108.       if (id == -1) {
    109. >         id = pkey->type;
    110.       }
    111.   #ifndef OPENSSL_NO_ENGINE

static int tls_process_cke_gost(SSL *s, PACKET *pkt)
{
#ifndef OPENSSL_NO_GOST
    EVP_PKEY_CTX *pkey_ctx;
    EVP_PKEY *client_pub_pkey = NULL, *pk = NULL;
    unsigned char premaster_secret[32];
    const unsigned char *start;
    size_t outlen = 32, inlen;
    unsigned long alg_a;
    unsigned int asn1id, asn1len;
    int ret = 0;
    PACKET encdata;
    alg_a = s->s3->tmp.new_cipher->algorithm_auth;
    if (alg_a & SSL_aGOST12) {
        pk = s->cert->pkeys[SSL_PKEY_GOST12_512].privatekey;
        if (pk == NULL) {
            pk = s->cert->pkeys[SSL_PKEY_GOST12_256].privatekey;
        }
        if (pk == NULL) {
            pk = s->cert->pkeys[SSL_PKEY_GOST01].privatekey;
        }
    } else if (alg_a & SSL_aGOST01) {
        pk = s->cert->pkeys[SSL_PKEY_GOST01].privatekey;
    }
    pkey_ctx = EVP_PKEY_CTX_new(pk, NULL);
    if (pkey_ctx == NULL) {
        SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_CKE_GOST,
                 ERR_R_MALLOC_FAILURE);
        return 0;
    }
    if (EVP_PKEY_decrypt_init(pkey_ctx) <= 0) {
        SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_CKE_GOST,
                 ERR_R_INTERNAL_ERROR);
        return 0;
    }
    client_pub_pkey = X509_get0_pubkey(s->session->peer);
    if (client_pub_pkey) {
        if (EVP_PKEY_derive_set_peer(pkey_ctx, client_pub_pkey) <= 0)
            ERR_clear_error();
    }
    if (!PACKET_get_1(pkt, &asn1id)
            || asn1id != (V_ASN1_SEQUENCE | V_ASN1_CONSTRUCTED)
            || !PACKET_peek_1(pkt, &asn1len)) {
        SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_CKE_GOST,
                 SSL_R_DECRYPTION_FAILED);
        goto err;
    }
    if (asn1len == 0x81) {
        if (!PACKET_forward(pkt, 1)) {
            SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_CKE_GOST,
                     SSL_R_DECRYPTION_FAILED);
            goto err;
        }
    } else  if (asn1len >= 0x80) {
        SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_CKE_GOST,
                 SSL_R_DECRYPTION_FAILED);
        goto err;
    }
    if (!PACKET_as_length_prefixed_1(pkt, &encdata)) {
        SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_CKE_GOST,
                 SSL_R_DECRYPTION_FAILED);
        goto err;
    }
    inlen = PACKET_remaining(&encdata);
    start = PACKET_data(&encdata);
    if (EVP_PKEY_decrypt(pkey_ctx, premaster_secret, &outlen, start,
                         inlen) <= 0) {
        SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_CKE_GOST,
                 SSL_R_DECRYPTION_FAILED);
        goto err;
    }
    if (!ssl_generate_master_secret(s, premaster_secret,
                                    sizeof(premaster_secret), 0)) {
        goto err;
    }
    if (EVP_PKEY_CTX_ctrl(pkey_ctx, -1, -1, EVP_PKEY_CTRL_PEER_KEY, 2,
                          NULL) > 0)
        s->statem.no_cert_verify = 1;
    ret = 1;
 err:
    EVP_PKEY_CTX_free(pkey_ctx);
    return ret;
#else
    SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_CKE_GOST,
             ERR_R_INTERNAL_ERROR);
    return 0;
#endif
}
['static int tls_process_cke_gost(SSL *s, PACKET *pkt)\n{\n#ifndef OPENSSL_NO_GOST\n    EVP_PKEY_CTX *pkey_ctx;\n    EVP_PKEY *client_pub_pkey = NULL, *pk = NULL;\n    unsigned char premaster_secret[32];\n    const unsigned char *start;\n    size_t outlen = 32, inlen;\n    unsigned long alg_a;\n    unsigned int asn1id, asn1len;\n    int ret = 0;\n    PACKET encdata;\n    alg_a = s->s3->tmp.new_cipher->algorithm_auth;\n    if (alg_a & SSL_aGOST12) {\n        pk = s->cert->pkeys[SSL_PKEY_GOST12_512].privatekey;\n        if (pk == NULL) {\n            pk = s->cert->pkeys[SSL_PKEY_GOST12_256].privatekey;\n        }\n        if (pk == NULL) {\n            pk = s->cert->pkeys[SSL_PKEY_GOST01].privatekey;\n        }\n    } else if (alg_a & SSL_aGOST01) {\n        pk = s->cert->pkeys[SSL_PKEY_GOST01].privatekey;\n    }\n    pkey_ctx = EVP_PKEY_CTX_new(pk, NULL);\n    if (pkey_ctx == NULL) {\n        SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_CKE_GOST,\n                 ERR_R_MALLOC_FAILURE);\n        return 0;\n    }\n    if (EVP_PKEY_decrypt_init(pkey_ctx) <= 0) {\n        SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_CKE_GOST,\n                 ERR_R_INTERNAL_ERROR);\n        return 0;\n    }\n    client_pub_pkey = X509_get0_pubkey(s->session->peer);\n    if (client_pub_pkey) {\n        if (EVP_PKEY_derive_set_peer(pkey_ctx, client_pub_pkey) <= 0)\n            ERR_clear_error();\n    }\n    if (!PACKET_get_1(pkt, &asn1id)\n            || asn1id != (V_ASN1_SEQUENCE | V_ASN1_CONSTRUCTED)\n            || !PACKET_peek_1(pkt, &asn1len)) {\n        SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_CKE_GOST,\n                 SSL_R_DECRYPTION_FAILED);\n        goto err;\n    }\n    if (asn1len == 0x81) {\n        if (!PACKET_forward(pkt, 1)) {\n            SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_CKE_GOST,\n                     SSL_R_DECRYPTION_FAILED);\n            goto err;\n        }\n    } else  if (asn1len >= 0x80) {\n        SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_CKE_GOST,\n                 SSL_R_DECRYPTION_FAILED);\n        goto err;\n    }\n    if (!PACKET_as_length_prefixed_1(pkt, &encdata)) {\n        SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_CKE_GOST,\n                 SSL_R_DECRYPTION_FAILED);\n        goto err;\n    }\n    inlen = PACKET_remaining(&encdata);\n    start = PACKET_data(&encdata);\n    if (EVP_PKEY_decrypt(pkey_ctx, premaster_secret, &outlen, start,\n                         inlen) <= 0) {\n        SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_CKE_GOST,\n                 SSL_R_DECRYPTION_FAILED);\n        goto err;\n    }\n    if (!ssl_generate_master_secret(s, premaster_secret,\n                                    sizeof(premaster_secret), 0)) {\n        goto err;\n    }\n    if (EVP_PKEY_CTX_ctrl(pkey_ctx, -1, -1, EVP_PKEY_CTRL_PEER_KEY, 2,\n                          NULL) > 0)\n        s->statem.no_cert_verify = 1;\n    ret = 1;\n err:\n    EVP_PKEY_CTX_free(pkey_ctx);\n    return ret;\n#else\n    SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_CKE_GOST,\n             ERR_R_INTERNAL_ERROR);\n    return 0;\n#endif\n}', 'EVP_PKEY_CTX *EVP_PKEY_CTX_new(EVP_PKEY *pkey, ENGINE *e)\n{\n    return int_ctx_new(pkey, e, -1);\n}', 'static EVP_PKEY_CTX *int_ctx_new(EVP_PKEY *pkey, ENGINE *e, int id)\n{\n    EVP_PKEY_CTX *ret;\n    const EVP_PKEY_METHOD *pmeth;\n    if (id == -1) {\n        id = pkey->type;\n    }\n#ifndef OPENSSL_NO_ENGINE\n    if (e == NULL && pkey != NULL)\n        e = pkey->pmeth_engine != NULL ? pkey->pmeth_engine : pkey->engine;\n    if (e) {\n        if (!ENGINE_init(e)) {\n            EVPerr(EVP_F_INT_CTX_NEW, ERR_R_ENGINE_LIB);\n            return NULL;\n        }\n    } else {\n        e = ENGINE_get_pkey_meth_engine(id);\n    }\n    if (e)\n        pmeth = ENGINE_get_pkey_meth(e, id);\n    else\n#endif\n        pmeth = EVP_PKEY_meth_find(id);\n    if (pmeth == NULL) {\n#ifndef OPENSSL_NO_ENGINE\n        ENGINE_finish(e);\n#endif\n        EVPerr(EVP_F_INT_CTX_NEW, EVP_R_UNSUPPORTED_ALGORITHM);\n        return NULL;\n    }\n    ret = OPENSSL_zalloc(sizeof(*ret));\n    if (ret == NULL) {\n#ifndef OPENSSL_NO_ENGINE\n        ENGINE_finish(e);\n#endif\n        EVPerr(EVP_F_INT_CTX_NEW, ERR_R_MALLOC_FAILURE);\n        return NULL;\n    }\n    ret->engine = e;\n    ret->pmeth = pmeth;\n    ret->operation = EVP_PKEY_OP_UNDEFINED;\n    ret->pkey = pkey;\n    if (pkey)\n        EVP_PKEY_up_ref(pkey);\n    if (pmeth->init) {\n        if (pmeth->init(ret) <= 0) {\n            ret->pmeth = NULL;\n            EVP_PKEY_CTX_free(ret);\n            return NULL;\n        }\n    }\n    return ret;\n}']