ssl/t1_lib.c:4177: error: NULL_DEREFERENCE
  pointer `cpk` last assigned on line 4176 could be null and is dereferenced at line 4177, column 45.
Showing all 15 steps of the trace


ssl/t1_lib.c:4165:1: start of procedure ssl_get_auto_dh()
4163.   
4164.   #ifndef OPENSSL_NO_DH
4165. > DH *ssl_get_auto_dh(SSL *s)
4166.   {
4167.       int dh_secbits = 80;

ssl/t1_lib.c:4167:5: 
4165.   DH *ssl_get_auto_dh(SSL *s)
4166.   {
4167. >     int dh_secbits = 80;
4168.       if (s->cert->dh_tmp_auto == 2)
4169.           return DH_get_1024_160();

ssl/t1_lib.c:4168:9: Taking false branch
4166.   {
4167.       int dh_secbits = 80;
4168.       if (s->cert->dh_tmp_auto == 2)
                ^
4169.           return DH_get_1024_160();
4170.       if (s->s3->tmp.new_cipher->algorithm_auth & (SSL_aNULL | SSL_aPSK)) {

ssl/t1_lib.c:4170:9: Taking false branch
4168.       if (s->cert->dh_tmp_auto == 2)
4169.           return DH_get_1024_160();
4170.       if (s->s3->tmp.new_cipher->algorithm_auth & (SSL_aNULL | SSL_aPSK)) {
                ^
4171.           if (s->s3->tmp.new_cipher->strength_bits == 256)
4172.               dh_secbits = 128;

ssl/t1_lib.c:4176:9: 
4174.               dh_secbits = 80;
4175.       } else {
4176. >         CERT_PKEY *cpk = ssl_get_server_send_pkey(s);
4177.           dh_secbits = EVP_PKEY_security_bits(cpk->privatekey);
4178.       }

ssl/ssl_lib.c:2144:1: start of procedure ssl_get_server_send_pkey()
  2142.   }
  2143.   
  2144. > CERT_PKEY *ssl_get_server_send_pkey(SSL *s)
  2145.   {
  2146.       CERT *c;

ssl/ssl_lib.c:2149:5: 
  2147.       int i;
  2148.   
  2149. >     c = s->cert;
  2150.       if (!s->s3 || !s->s3->tmp.new_cipher)
  2151.           return NULL;

ssl/ssl_lib.c:2150:10: Taking false branch
  2148.   
  2149.       c = s->cert;
  2150.       if (!s->s3 || !s->s3->tmp.new_cipher)
                   ^
  2151.           return NULL;
  2152.       ssl_set_masks(s, s->s3->tmp.new_cipher);

ssl/ssl_lib.c:2150:20: Taking false branch
  2148.   
  2149.       c = s->cert;
  2150.       if (!s->s3 || !s->s3->tmp.new_cipher)
                             ^
  2151.           return NULL;
  2152.       ssl_set_masks(s, s->s3->tmp.new_cipher);

ssl/ssl_lib.c:2152:5: Skipping ssl_set_masks(): empty list of specs
  2150.       if (!s->s3 || !s->s3->tmp.new_cipher)
  2151.           return NULL;
  2152.       ssl_set_masks(s, s->s3->tmp.new_cipher);
              ^
  2153.   
  2154.   #ifdef OPENSSL_SSL_DEBUG_BROKEN_PROTOCOL

ssl/ssl_lib.c:2163:5: Skipping ssl_get_server_cert_index(): empty list of specs
  2161.   #endif
  2162.   
  2163.       i = ssl_get_server_cert_index(s);
              ^
  2164.   
  2165.       /* This may or may not be an error. */

ssl/ssl_lib.c:2166:9: Taking true branch
  2164.   
  2165.       /* This may or may not be an error. */
  2166.       if (i < 0)
                  ^
  2167.           return NULL;
  2168.   

ssl/ssl_lib.c:2167:9: 
  2165.       /* This may or may not be an error. */
  2166.       if (i < 0)
  2167. >         return NULL;
  2168.   
  2169.       /* May be NULL. */

ssl/ssl_lib.c:2171:1: return from a call to ssl_get_server_send_pkey
  2169.       /* May be NULL. */
  2170.       return &c->pkeys[i];
  2171. > }
  2172.   
  2173.   EVP_PKEY *ssl_get_sign_pkey(SSL *s, const SSL_CIPHER *cipher,

ssl/t1_lib.c:4177:9: 
4175.       } else {
4176.           CERT_PKEY *cpk = ssl_get_server_send_pkey(s);
4177. >         dh_secbits = EVP_PKEY_security_bits(cpk->privatekey);
4178.       }
4179.   

DH *ssl_get_auto_dh(SSL *s)
{
    int dh_secbits = 80;
    if (s->cert->dh_tmp_auto == 2)
        return DH_get_1024_160();
    if (s->s3->tmp.new_cipher->algorithm_auth & (SSL_aNULL | SSL_aPSK)) {
        if (s->s3->tmp.new_cipher->strength_bits == 256)
            dh_secbits = 128;
        else
            dh_secbits = 80;
    } else {
        CERT_PKEY *cpk = ssl_get_server_send_pkey(s);
        dh_secbits = EVP_PKEY_security_bits(cpk->privatekey);
    }
    if (dh_secbits >= 128) {
        DH *dhp = DH_new();
        if (!dhp)
            return NULL;
        dhp->g = BN_new();
        if (dhp->g)
            BN_set_word(dhp->g, 2);
        if (dh_secbits >= 192)
            dhp->p = get_rfc3526_prime_8192(NULL);
        else
            dhp->p = get_rfc3526_prime_3072(NULL);
        if (!dhp->p || !dhp->g) {
            DH_free(dhp);
            return NULL;
        }
        return dhp;
    }
    if (dh_secbits >= 112)
        return DH_get_2048_224();
    return DH_get_1024_160();
}
['DH *ssl_get_auto_dh(SSL *s)\n{\n    int dh_secbits = 80;\n    if (s->cert->dh_tmp_auto == 2)\n        return DH_get_1024_160();\n    if (s->s3->tmp.new_cipher->algorithm_auth & (SSL_aNULL | SSL_aPSK)) {\n        if (s->s3->tmp.new_cipher->strength_bits == 256)\n            dh_secbits = 128;\n        else\n            dh_secbits = 80;\n    } else {\n        CERT_PKEY *cpk = ssl_get_server_send_pkey(s);\n        dh_secbits = EVP_PKEY_security_bits(cpk->privatekey);\n    }\n    if (dh_secbits >= 128) {\n        DH *dhp = DH_new();\n        if (!dhp)\n            return NULL;\n        dhp->g = BN_new();\n        if (dhp->g)\n            BN_set_word(dhp->g, 2);\n        if (dh_secbits >= 192)\n            dhp->p = get_rfc3526_prime_8192(NULL);\n        else\n            dhp->p = get_rfc3526_prime_3072(NULL);\n        if (!dhp->p || !dhp->g) {\n            DH_free(dhp);\n            return NULL;\n        }\n        return dhp;\n    }\n    if (dh_secbits >= 112)\n        return DH_get_2048_224();\n    return DH_get_1024_160();\n}', 'CERT_PKEY *ssl_get_server_send_pkey(SSL *s)\n{\n    CERT *c;\n    int i;\n    c = s->cert;\n    if (!s->s3 || !s->s3->tmp.new_cipher)\n        return NULL;\n    ssl_set_masks(s, s->s3->tmp.new_cipher);\n#ifdef OPENSSL_SSL_DEBUG_BROKEN_PROTOCOL\n    if (c->cert_flags & SSL_CERT_FLAG_BROKEN_PROTOCOL)\n        return c->key;\n#endif\n    i = ssl_get_server_cert_index(s);\n    if (i < 0)\n        return NULL;\n    return &c->pkeys[i];\n}']