ssl/s3_srvr.c:2936: error: NULL_DEREFERENCE
  pointer `pkey` last assigned on line 2892 could be null and is dereferenced at line 2936, column 21.
Showing all 27 steps of the trace


ssl/s3_srvr.c:2870:1: start of procedure ssl3_get_cert_verify()
2868.   }
2869.   
2870. > int ssl3_get_cert_verify(SSL *s)
2871.   {
2872.       EVP_PKEY *pkey = NULL;

ssl/s3_srvr.c:2872:5: 
2870.   int ssl3_get_cert_verify(SSL *s)
2871.   {
2872. >     EVP_PKEY *pkey = NULL;
2873.       unsigned char *p;
2874.       int al, ok, ret = 0;

ssl/s3_srvr.c:2874:5: 
2872.       EVP_PKEY *pkey = NULL;
2873.       unsigned char *p;
2874. >     int al, ok, ret = 0;
2875.       long n;
2876.       int type = 0, i, j;

ssl/s3_srvr.c:2876:5: 
2874.       int al, ok, ret = 0;
2875.       long n;
2876. >     int type = 0, i, j;
2877.       X509 *peer;
2878.       const EVP_MD *md = NULL;

ssl/s3_srvr.c:2878:5: 
2876.       int type = 0, i, j;
2877.       X509 *peer;
2878. >     const EVP_MD *md = NULL;
2879.       EVP_MD_CTX mctx;
2880.       EVP_MD_CTX_init(&mctx);

ssl/s3_srvr.c:2880:5: 
2878.       const EVP_MD *md = NULL;
2879.       EVP_MD_CTX mctx;
2880. >     EVP_MD_CTX_init(&mctx);
2881.   
2882.       n = s->method->ssl_get_message(s,

crypto/evp/digest.c:120:1: start of procedure EVP_MD_CTX_init()
  118.   #endif
  119.   
  120. > void EVP_MD_CTX_init(EVP_MD_CTX *ctx)
  121.   {
  122.       memset(ctx, '\0', sizeof *ctx);

crypto/evp/digest.c:122:5: 
  120.   void EVP_MD_CTX_init(EVP_MD_CTX *ctx)
  121.   {
  122. >     memset(ctx, '\0', sizeof *ctx);
  123.   }
  124.   

crypto/evp/digest.c:123:1: return from a call to EVP_MD_CTX_init
  121.   {
  122.       memset(ctx, '\0', sizeof *ctx);
  123. > }
  124.   
  125.   EVP_MD_CTX *EVP_MD_CTX_create(void)

ssl/s3_srvr.c:2882:5: Skipping __function_pointer__(): unresolved function pointer
2880.       EVP_MD_CTX_init(&mctx);
2881.   
2882.       n = s->method->ssl_get_message(s,
            ^
2883.                                      SSL3_ST_SR_CERT_VRFY_A,
2884.                                      SSL3_ST_SR_CERT_VRFY_B,

ssl/s3_srvr.c:2887:10: Taking false branch
2885.                                      -1, SSL3_RT_MAX_PLAIN_LENGTH, &ok);
2886.   
2887.       if (!ok)
                 ^
2888.           return ((int)n);
2889.   

ssl/s3_srvr.c:2890:9: Taking true branch
2888.           return ((int)n);
2889.   
2890.       if (s->session->peer != NULL) {
                ^
2891.           peer = s->session->peer;
2892.           pkey = X509_get_pubkey(peer);

ssl/s3_srvr.c:2891:9: 
2889.   
2890.       if (s->session->peer != NULL) {
2891. >         peer = s->session->peer;
2892.           pkey = X509_get_pubkey(peer);
2893.           type = X509_certificate_type(peer, pkey);

ssl/s3_srvr.c:2892:9: 
2890.       if (s->session->peer != NULL) {
2891.           peer = s->session->peer;
2892. >         pkey = X509_get_pubkey(peer);
2893.           type = X509_certificate_type(peer, pkey);
2894.       } else {

crypto/x509/x509_cmp.c:306:1: start of procedure X509_get_pubkey()
  304.   }
  305.   
  306. > EVP_PKEY *X509_get_pubkey(X509 *x)
  307.   {
  308.       if ((x == NULL) || (x->cert_info == NULL))

crypto/x509/x509_cmp.c:308:10: Taking false branch
  306.   EVP_PKEY *X509_get_pubkey(X509 *x)
  307.   {
  308.       if ((x == NULL) || (x->cert_info == NULL))
                  ^
  309.           return (NULL);
  310.       return (X509_PUBKEY_get(x->cert_info->key));

crypto/x509/x509_cmp.c:308:25: Taking true branch
  306.   EVP_PKEY *X509_get_pubkey(X509 *x)
  307.   {
  308.       if ((x == NULL) || (x->cert_info == NULL))
                                 ^
  309.           return (NULL);
  310.       return (X509_PUBKEY_get(x->cert_info->key));

crypto/x509/x509_cmp.c:309:9: 
  307.   {
  308.       if ((x == NULL) || (x->cert_info == NULL))
  309. >         return (NULL);
  310.       return (X509_PUBKEY_get(x->cert_info->key));
  311.   }

crypto/x509/x509_cmp.c:311:1: return from a call to X509_get_pubkey
  309.           return (NULL);
  310.       return (X509_PUBKEY_get(x->cert_info->key));
  311. > }
  312.   
  313.   ASN1_BIT_STRING *X509_get0_pubkey_bitstr(const X509 *x)

ssl/s3_srvr.c:2893:9: Skipping X509_certificate_type(): empty list of specs
2891.           peer = s->session->peer;
2892.           pkey = X509_get_pubkey(peer);
2893.           type = X509_certificate_type(peer, pkey);
                ^
2894.       } else {
2895.           peer = NULL;

ssl/s3_srvr.c:2899:9: Taking false branch
2897.       }
2898.   
2899.       if (s->s3->tmp.message_type != SSL3_MT_CERTIFICATE_VERIFY) {
                ^
2900.           s->s3->tmp.reuse_message = 1;
2901.           if (peer != NULL) {

ssl/s3_srvr.c:2910:9: Taking false branch
2908.       }
2909.   
2910.       if (peer == NULL) {
                ^
2911.           SSLerr(SSL_F_SSL3_GET_CERT_VERIFY, SSL_R_NO_CLIENT_CERT_RECEIVED);
2912.           al = SSL_AD_UNEXPECTED_MESSAGE;

ssl/s3_srvr.c:2916:11: Taking false branch
2914.       }
2915.   
2916.       if (!(type & EVP_PKT_SIGN)) {
                  ^
2917.           SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,
2918.                  SSL_R_SIGNATURE_FOR_NON_SIGNING_CERTIFICATE);

ssl/s3_srvr.c:2923:9: Taking false branch
2921.       }
2922.   
2923.       if (s->s3->change_cipher_spec) {
                ^
2924.           SSLerr(SSL_F_SSL3_GET_CERT_VERIFY, SSL_R_CCS_RECEIVED_EARLY);
2925.           al = SSL_AD_UNEXPECTED_MESSAGE;

ssl/s3_srvr.c:2930:5: 
2928.   
2929.       /* we now have a signature that we need to verify */
2930. >     p = (unsigned char *)s->init_msg;
2931.       /* Check for broken implementations of GOST ciphersuites */
2932.       /*

ssl/s3_srvr.c:2936:9: Taking true branch
2934.        * length field
2935.        */
2936.       if (n == 64 && (pkey->type == NID_id_GostR3410_94 ||
                ^
2937.                       pkey->type == NID_id_GostR3410_2001)) {
2938.           i = 64;

ssl/s3_srvr.c:2936:21: 
2934.        * length field
2935.        */
2936. >     if (n == 64 && (pkey->type == NID_id_GostR3410_94 ||
2937.                       pkey->type == NID_id_GostR3410_2001)) {
2938.           i = 64;

int ssl3_get_cert_verify(SSL *s)
{
    EVP_PKEY *pkey = NULL;
    unsigned char *p;
    int al, ok, ret = 0;
    long n;
    int type = 0, i, j;
    X509 *peer;
    const EVP_MD *md = NULL;
    EVP_MD_CTX mctx;
    EVP_MD_CTX_init(&mctx);
    n = s->method->ssl_get_message(s,
                                   SSL3_ST_SR_CERT_VRFY_A,
                                   SSL3_ST_SR_CERT_VRFY_B,
                                   -1, SSL3_RT_MAX_PLAIN_LENGTH, &ok);
    if (!ok)
        return ((int)n);
    if (s->session->peer != NULL) {
        peer = s->session->peer;
        pkey = X509_get_pubkey(peer);
        type = X509_certificate_type(peer, pkey);
    } else {
        peer = NULL;
        pkey = NULL;
    }
    if (s->s3->tmp.message_type != SSL3_MT_CERTIFICATE_VERIFY) {
        s->s3->tmp.reuse_message = 1;
        if (peer != NULL) {
            al = SSL_AD_UNEXPECTED_MESSAGE;
            SSLerr(SSL_F_SSL3_GET_CERT_VERIFY, SSL_R_MISSING_VERIFY_MESSAGE);
            goto f_err;
        }
        ret = 1;
        goto end;
    }
    if (peer == NULL) {
        SSLerr(SSL_F_SSL3_GET_CERT_VERIFY, SSL_R_NO_CLIENT_CERT_RECEIVED);
        al = SSL_AD_UNEXPECTED_MESSAGE;
        goto f_err;
    }
    if (!(type & EVP_PKT_SIGN)) {
        SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,
               SSL_R_SIGNATURE_FOR_NON_SIGNING_CERTIFICATE);
        al = SSL_AD_ILLEGAL_PARAMETER;
        goto f_err;
    }
    if (s->s3->change_cipher_spec) {
        SSLerr(SSL_F_SSL3_GET_CERT_VERIFY, SSL_R_CCS_RECEIVED_EARLY);
        al = SSL_AD_UNEXPECTED_MESSAGE;
        goto f_err;
    }
    p = (unsigned char *)s->init_msg;
    if (n == 64 && (pkey->type == NID_id_GostR3410_94 ||
                    pkey->type == NID_id_GostR3410_2001)) {
        i = 64;
    } else {
        if (SSL_USE_SIGALGS(s)) {
            int rv = tls12_check_peer_sigalg(&md, s, p, pkey);
            if (rv == -1) {
                al = SSL_AD_INTERNAL_ERROR;
                goto f_err;
            } else if (rv == 0) {
                al = SSL_AD_DECODE_ERROR;
                goto f_err;
            }
#ifdef SSL_DEBUG
            fprintf(stderr, "USING TLSv1.2 HASH %s\n", EVP_MD_name(md));
#endif
            p += 2;
            n -= 2;
        }
        n2s(p, i);
        n -= 2;
        if (i > n) {
            SSLerr(SSL_F_SSL3_GET_CERT_VERIFY, SSL_R_LENGTH_MISMATCH);
            al = SSL_AD_DECODE_ERROR;
            goto f_err;
        }
    }
    j = EVP_PKEY_size(pkey);
    if ((i > j) || (n > j) || (n <= 0)) {
        SSLerr(SSL_F_SSL3_GET_CERT_VERIFY, SSL_R_WRONG_SIGNATURE_SIZE);
        al = SSL_AD_DECODE_ERROR;
        goto f_err;
    }
    if (SSL_USE_SIGALGS(s)) {
        long hdatalen = 0;
        void *hdata;
        hdatalen = BIO_get_mem_data(s->s3->handshake_buffer, &hdata);
        if (hdatalen <= 0) {
            SSLerr(SSL_F_SSL3_GET_CERT_VERIFY, ERR_R_INTERNAL_ERROR);
            al = SSL_AD_INTERNAL_ERROR;
            goto f_err;
        }
#ifdef SSL_DEBUG
        fprintf(stderr, "Using TLS 1.2 with client verify alg %s\n",
                EVP_MD_name(md));
#endif
        if (!EVP_VerifyInit_ex(&mctx, md, NULL)
            || !EVP_VerifyUpdate(&mctx, hdata, hdatalen)) {
            SSLerr(SSL_F_SSL3_GET_CERT_VERIFY, ERR_R_EVP_LIB);
            al = SSL_AD_INTERNAL_ERROR;
            goto f_err;
        }
        if (EVP_VerifyFinal(&mctx, p, i, pkey) <= 0) {
            al = SSL_AD_DECRYPT_ERROR;
            SSLerr(SSL_F_SSL3_GET_CERT_VERIFY, SSL_R_BAD_SIGNATURE);
            goto f_err;
        }
    } else
#ifndef OPENSSL_NO_RSA
    if (pkey->type == EVP_PKEY_RSA) {
        i = RSA_verify(NID_md5_sha1, s->s3->tmp.cert_verify_md,
                       MD5_DIGEST_LENGTH + SHA_DIGEST_LENGTH, p, i,
                       pkey->pkey.rsa);
        if (i < 0) {
            al = SSL_AD_DECRYPT_ERROR;
            SSLerr(SSL_F_SSL3_GET_CERT_VERIFY, SSL_R_BAD_RSA_DECRYPT);
            goto f_err;
        }
        if (i == 0) {
            al = SSL_AD_DECRYPT_ERROR;
            SSLerr(SSL_F_SSL3_GET_CERT_VERIFY, SSL_R_BAD_RSA_SIGNATURE);
            goto f_err;
        }
    } else
#endif
#ifndef OPENSSL_NO_DSA
    if (pkey->type == EVP_PKEY_DSA) {
        j = DSA_verify(pkey->save_type,
                       &(s->s3->tmp.cert_verify_md[MD5_DIGEST_LENGTH]),
                       SHA_DIGEST_LENGTH, p, i, pkey->pkey.dsa);
        if (j <= 0) {
            al = SSL_AD_DECRYPT_ERROR;
            SSLerr(SSL_F_SSL3_GET_CERT_VERIFY, SSL_R_BAD_DSA_SIGNATURE);
            goto f_err;
        }
    } else
#endif
#ifndef OPENSSL_NO_ECDSA
    if (pkey->type == EVP_PKEY_EC) {
        j = ECDSA_verify(pkey->save_type,
                         &(s->s3->tmp.cert_verify_md[MD5_DIGEST_LENGTH]),
                         SHA_DIGEST_LENGTH, p, i, pkey->pkey.ec);
        if (j <= 0) {
            al = SSL_AD_DECRYPT_ERROR;
            SSLerr(SSL_F_SSL3_GET_CERT_VERIFY, SSL_R_BAD_ECDSA_SIGNATURE);
            goto f_err;
        }
    } else
#endif
    if (pkey->type == NID_id_GostR3410_94
            || pkey->type == NID_id_GostR3410_2001) {
        unsigned char signature[64];
        int idx;
        EVP_PKEY_CTX *pctx = EVP_PKEY_CTX_new(pkey, NULL);
        EVP_PKEY_verify_init(pctx);
        if (i != 64) {
            fprintf(stderr, "GOST signature length is %d", i);
        }
        for (idx = 0; idx < 64; idx++) {
            signature[63 - idx] = p[idx];
        }
        j = EVP_PKEY_verify(pctx, signature, 64, s->s3->tmp.cert_verify_md,
                            32);
        EVP_PKEY_CTX_free(pctx);
        if (j <= 0) {
            al = SSL_AD_DECRYPT_ERROR;
            SSLerr(SSL_F_SSL3_GET_CERT_VERIFY, SSL_R_BAD_ECDSA_SIGNATURE);
            goto f_err;
        }
    } else {
        SSLerr(SSL_F_SSL3_GET_CERT_VERIFY, ERR_R_INTERNAL_ERROR);
        al = SSL_AD_UNSUPPORTED_CERTIFICATE;
        goto f_err;
    }
    ret = 1;
    if (0) {
 f_err:
        ssl3_send_alert(s, SSL3_AL_FATAL, al);
    }
 end:
    if (s->s3->handshake_buffer) {
        BIO_free(s->s3->handshake_buffer);
        s->s3->handshake_buffer = NULL;
        s->s3->flags &= ~TLS1_FLAGS_KEEP_HANDSHAKE;
    }
    EVP_MD_CTX_cleanup(&mctx);
    EVP_PKEY_free(pkey);
    return (ret);
}
['int ssl3_get_cert_verify(SSL *s)\n{\n    EVP_PKEY *pkey = NULL;\n    unsigned char *p;\n    int al, ok, ret = 0;\n    long n;\n    int type = 0, i, j;\n    X509 *peer;\n    const EVP_MD *md = NULL;\n    EVP_MD_CTX mctx;\n    EVP_MD_CTX_init(&mctx);\n    n = s->method->ssl_get_message(s,\n                                   SSL3_ST_SR_CERT_VRFY_A,\n                                   SSL3_ST_SR_CERT_VRFY_B,\n                                   -1, SSL3_RT_MAX_PLAIN_LENGTH, &ok);\n    if (!ok)\n        return ((int)n);\n    if (s->session->peer != NULL) {\n        peer = s->session->peer;\n        pkey = X509_get_pubkey(peer);\n        type = X509_certificate_type(peer, pkey);\n    } else {\n        peer = NULL;\n        pkey = NULL;\n    }\n    if (s->s3->tmp.message_type != SSL3_MT_CERTIFICATE_VERIFY) {\n        s->s3->tmp.reuse_message = 1;\n        if (peer != NULL) {\n            al = SSL_AD_UNEXPECTED_MESSAGE;\n            SSLerr(SSL_F_SSL3_GET_CERT_VERIFY, SSL_R_MISSING_VERIFY_MESSAGE);\n            goto f_err;\n        }\n        ret = 1;\n        goto end;\n    }\n    if (peer == NULL) {\n        SSLerr(SSL_F_SSL3_GET_CERT_VERIFY, SSL_R_NO_CLIENT_CERT_RECEIVED);\n        al = SSL_AD_UNEXPECTED_MESSAGE;\n        goto f_err;\n    }\n    if (!(type & EVP_PKT_SIGN)) {\n        SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,\n               SSL_R_SIGNATURE_FOR_NON_SIGNING_CERTIFICATE);\n        al = SSL_AD_ILLEGAL_PARAMETER;\n        goto f_err;\n    }\n    if (s->s3->change_cipher_spec) {\n        SSLerr(SSL_F_SSL3_GET_CERT_VERIFY, SSL_R_CCS_RECEIVED_EARLY);\n        al = SSL_AD_UNEXPECTED_MESSAGE;\n        goto f_err;\n    }\n    p = (unsigned char *)s->init_msg;\n    if (n == 64 && (pkey->type == NID_id_GostR3410_94 ||\n                    pkey->type == NID_id_GostR3410_2001)) {\n        i = 64;\n    } else {\n        if (SSL_USE_SIGALGS(s)) {\n            int rv = tls12_check_peer_sigalg(&md, s, p, pkey);\n            if (rv == -1) {\n                al = SSL_AD_INTERNAL_ERROR;\n                goto f_err;\n            } else if (rv == 0) {\n                al = SSL_AD_DECODE_ERROR;\n                goto f_err;\n            }\n#ifdef SSL_DEBUG\n            fprintf(stderr, "USING TLSv1.2 HASH %s\\n", EVP_MD_name(md));\n#endif\n            p += 2;\n            n -= 2;\n        }\n        n2s(p, i);\n        n -= 2;\n        if (i > n) {\n            SSLerr(SSL_F_SSL3_GET_CERT_VERIFY, SSL_R_LENGTH_MISMATCH);\n            al = SSL_AD_DECODE_ERROR;\n            goto f_err;\n        }\n    }\n    j = EVP_PKEY_size(pkey);\n    if ((i > j) || (n > j) || (n <= 0)) {\n        SSLerr(SSL_F_SSL3_GET_CERT_VERIFY, SSL_R_WRONG_SIGNATURE_SIZE);\n        al = SSL_AD_DECODE_ERROR;\n        goto f_err;\n    }\n    if (SSL_USE_SIGALGS(s)) {\n        long hdatalen = 0;\n        void *hdata;\n        hdatalen = BIO_get_mem_data(s->s3->handshake_buffer, &hdata);\n        if (hdatalen <= 0) {\n            SSLerr(SSL_F_SSL3_GET_CERT_VERIFY, ERR_R_INTERNAL_ERROR);\n            al = SSL_AD_INTERNAL_ERROR;\n            goto f_err;\n        }\n#ifdef SSL_DEBUG\n        fprintf(stderr, "Using TLS 1.2 with client verify alg %s\\n",\n                EVP_MD_name(md));\n#endif\n        if (!EVP_VerifyInit_ex(&mctx, md, NULL)\n            || !EVP_VerifyUpdate(&mctx, hdata, hdatalen)) {\n            SSLerr(SSL_F_SSL3_GET_CERT_VERIFY, ERR_R_EVP_LIB);\n            al = SSL_AD_INTERNAL_ERROR;\n            goto f_err;\n        }\n        if (EVP_VerifyFinal(&mctx, p, i, pkey) <= 0) {\n            al = SSL_AD_DECRYPT_ERROR;\n            SSLerr(SSL_F_SSL3_GET_CERT_VERIFY, SSL_R_BAD_SIGNATURE);\n            goto f_err;\n        }\n    } else\n#ifndef OPENSSL_NO_RSA\n    if (pkey->type == EVP_PKEY_RSA) {\n        i = RSA_verify(NID_md5_sha1, s->s3->tmp.cert_verify_md,\n                       MD5_DIGEST_LENGTH + SHA_DIGEST_LENGTH, p, i,\n                       pkey->pkey.rsa);\n        if (i < 0) {\n            al = SSL_AD_DECRYPT_ERROR;\n            SSLerr(SSL_F_SSL3_GET_CERT_VERIFY, SSL_R_BAD_RSA_DECRYPT);\n            goto f_err;\n        }\n        if (i == 0) {\n            al = SSL_AD_DECRYPT_ERROR;\n            SSLerr(SSL_F_SSL3_GET_CERT_VERIFY, SSL_R_BAD_RSA_SIGNATURE);\n            goto f_err;\n        }\n    } else\n#endif\n#ifndef OPENSSL_NO_DSA\n    if (pkey->type == EVP_PKEY_DSA) {\n        j = DSA_verify(pkey->save_type,\n                       &(s->s3->tmp.cert_verify_md[MD5_DIGEST_LENGTH]),\n                       SHA_DIGEST_LENGTH, p, i, pkey->pkey.dsa);\n        if (j <= 0) {\n            al = SSL_AD_DECRYPT_ERROR;\n            SSLerr(SSL_F_SSL3_GET_CERT_VERIFY, SSL_R_BAD_DSA_SIGNATURE);\n            goto f_err;\n        }\n    } else\n#endif\n#ifndef OPENSSL_NO_ECDSA\n    if (pkey->type == EVP_PKEY_EC) {\n        j = ECDSA_verify(pkey->save_type,\n                         &(s->s3->tmp.cert_verify_md[MD5_DIGEST_LENGTH]),\n                         SHA_DIGEST_LENGTH, p, i, pkey->pkey.ec);\n        if (j <= 0) {\n            al = SSL_AD_DECRYPT_ERROR;\n            SSLerr(SSL_F_SSL3_GET_CERT_VERIFY, SSL_R_BAD_ECDSA_SIGNATURE);\n            goto f_err;\n        }\n    } else\n#endif\n    if (pkey->type == NID_id_GostR3410_94\n            || pkey->type == NID_id_GostR3410_2001) {\n        unsigned char signature[64];\n        int idx;\n        EVP_PKEY_CTX *pctx = EVP_PKEY_CTX_new(pkey, NULL);\n        EVP_PKEY_verify_init(pctx);\n        if (i != 64) {\n            fprintf(stderr, "GOST signature length is %d", i);\n        }\n        for (idx = 0; idx < 64; idx++) {\n            signature[63 - idx] = p[idx];\n        }\n        j = EVP_PKEY_verify(pctx, signature, 64, s->s3->tmp.cert_verify_md,\n                            32);\n        EVP_PKEY_CTX_free(pctx);\n        if (j <= 0) {\n            al = SSL_AD_DECRYPT_ERROR;\n            SSLerr(SSL_F_SSL3_GET_CERT_VERIFY, SSL_R_BAD_ECDSA_SIGNATURE);\n            goto f_err;\n        }\n    } else {\n        SSLerr(SSL_F_SSL3_GET_CERT_VERIFY, ERR_R_INTERNAL_ERROR);\n        al = SSL_AD_UNSUPPORTED_CERTIFICATE;\n        goto f_err;\n    }\n    ret = 1;\n    if (0) {\n f_err:\n        ssl3_send_alert(s, SSL3_AL_FATAL, al);\n    }\n end:\n    if (s->s3->handshake_buffer) {\n        BIO_free(s->s3->handshake_buffer);\n        s->s3->handshake_buffer = NULL;\n        s->s3->flags &= ~TLS1_FLAGS_KEEP_HANDSHAKE;\n    }\n    EVP_MD_CTX_cleanup(&mctx);\n    EVP_PKEY_free(pkey);\n    return (ret);\n}', "void EVP_MD_CTX_init(EVP_MD_CTX *ctx)\n{\n    memset(ctx, '\\0', sizeof *ctx);\n}", 'EVP_PKEY *X509_get_pubkey(X509 *x)\n{\n    if ((x == NULL) || (x->cert_info == NULL))\n        return (NULL);\n    return (X509_PUBKEY_get(x->cert_info->key));\n}']