ssl/ssl_rsa.c:212: error: NULL_DEREFERENCE
  pointer `pktmp` last assigned on line 211 could be null and is dereferenced by call to `EVP_PKEY_copy_parameters()` at line 212, column 3.
Showing all 21 steps of the trace


ssl/ssl_rsa.c:182:1: start of procedure ssl_set_pkey()
180.   #endif
181.   
182. > static int ssl_set_pkey(CERT *c, EVP_PKEY *pkey)
183.   	{
184.   	int i;

ssl/ssl_rsa.c:188:6: Taking false branch
186.   	 * This means for DH certificates we must set the certificate first.
187.   	 */
188.   	if (pkey->type == EVP_PKEY_DH)
            ^
189.   		{
190.   		X509 *x;

ssl/ssl_rsa.c:201:3: Skipping ssl_cert_type(): empty list of specs
199.   		}
200.   	else 
201.   		i=ssl_cert_type(NULL,pkey);
         ^
202.   	if (i < 0)
203.   		{

ssl/ssl_rsa.c:202:6: Taking false branch
200.   	else 
201.   		i=ssl_cert_type(NULL,pkey);
202.   	if (i < 0)
            ^
203.   		{
204.   		SSLerr(SSL_F_SSL_SET_PKEY,SSL_R_UNKNOWN_CERTIFICATE_TYPE);

ssl/ssl_rsa.c:208:6: Taking true branch
206.   		}
207.   
208.   	if (c->pkeys[i].x509 != NULL)
            ^
209.   		{
210.   		EVP_PKEY *pktmp;

ssl/ssl_rsa.c:211:3: 
209.   		{
210.   		EVP_PKEY *pktmp;
211. > 		pktmp =	X509_get_pubkey(c->pkeys[i].x509);
212.   		EVP_PKEY_copy_parameters(pktmp,pkey);
213.   		EVP_PKEY_free(pktmp);

crypto/x509/x509_cmp.c:300:1: start of procedure X509_get_pubkey()
  298.   	}
  299.   
  300. > EVP_PKEY *X509_get_pubkey(X509 *x)
  301.   	{
  302.   	if ((x == NULL) || (x->cert_info == NULL))

crypto/x509/x509_cmp.c:302:7: Taking false branch
  300.   EVP_PKEY *X509_get_pubkey(X509 *x)
  301.   	{
  302.   	if ((x == NULL) || (x->cert_info == NULL))
               ^
  303.   		return(NULL);
  304.   	return(X509_PUBKEY_get(x->cert_info->key));

crypto/x509/x509_cmp.c:302:22: Taking false branch
  300.   EVP_PKEY *X509_get_pubkey(X509 *x)
  301.   	{
  302.   	if ((x == NULL) || (x->cert_info == NULL))
                              ^
  303.   		return(NULL);
  304.   	return(X509_PUBKEY_get(x->cert_info->key));

crypto/x509/x509_cmp.c:304:2: 
  302.   	if ((x == NULL) || (x->cert_info == NULL))
  303.   		return(NULL);
  304. > 	return(X509_PUBKEY_get(x->cert_info->key));
  305.   	}
  306.   

crypto/asn1/x_pubkey.c:133:1: start of procedure X509_PUBKEY_get()
    131.   	}
    132.   
    133. > EVP_PKEY *X509_PUBKEY_get(X509_PUBKEY *key)
    134.   	{
    135.   	EVP_PKEY *ret=NULL;

crypto/asn1/x_pubkey.c:135:2: 
    133.   EVP_PKEY *X509_PUBKEY_get(X509_PUBKEY *key)
    134.   	{
    135. > 	EVP_PKEY *ret=NULL;
    136.   
    137.   	if (key == NULL) goto error;

crypto/asn1/x_pubkey.c:137:6: Taking false branch
    135.   	EVP_PKEY *ret=NULL;
    136.   
    137.   	if (key == NULL) goto error;
                ^
    138.   
    139.   	if (key->pkey != NULL)

crypto/asn1/x_pubkey.c:139:6: Taking false branch
    137.   	if (key == NULL) goto error;
    138.   
    139.   	if (key->pkey != NULL)
                ^
    140.   		{
    141.   		CRYPTO_add(&key->pkey->references, 1, CRYPTO_LOCK_EVP_PKEY);

crypto/asn1/x_pubkey.c:145:6: Taking true branch
    143.   		}
    144.   
    145.   	if (key->public_key == NULL) goto error;
                ^
    146.   
    147.   	if ((ret = EVP_PKEY_new()) == NULL)

crypto/asn1/x_pubkey.c:179:2: 
    177.   	return ret;
    178.   
    179. > 	error:
    180.   	if (ret != NULL)
    181.   		EVP_PKEY_free(ret);

crypto/asn1/x_pubkey.c:180:6: Taking false branch
    178.   
    179.   	error:
    180.   	if (ret != NULL)
                ^
    181.   		EVP_PKEY_free(ret);
    182.   	return(NULL);

crypto/asn1/x_pubkey.c:182:2: 
    180.   	if (ret != NULL)
    181.   		EVP_PKEY_free(ret);
    182. > 	return(NULL);
    183.   	}
    184.   

crypto/asn1/x_pubkey.c:183:2: return from a call to X509_PUBKEY_get
    181.   		EVP_PKEY_free(ret);
    182.   	return(NULL);
    183.   	}
            ^
    184.   
    185.   /* Now two pseudo ASN1 routines that take an EVP_PKEY structure

crypto/x509/x509_cmp.c:305:2: return from a call to X509_get_pubkey
  303.   		return(NULL);
  304.   	return(X509_PUBKEY_get(x->cert_info->key));
  305.   	}
          ^
  306.   
  307.   ASN1_BIT_STRING *X509_get0_pubkey_bitstr(const X509 *x)

ssl/ssl_rsa.c:212:3: 
210.   		EVP_PKEY *pktmp;
211.   		pktmp =	X509_get_pubkey(c->pkeys[i].x509);
212. > 		EVP_PKEY_copy_parameters(pktmp,pkey);
213.   		EVP_PKEY_free(pktmp);
214.   		ERR_clear_error();

static int ssl_set_pkey(CERT *c, EVP_PKEY *pkey)
	{
	int i;
	if (pkey->type == EVP_PKEY_DH)
		{
		X509 *x;
		i = -1;
		x = c->pkeys[SSL_PKEY_DH_RSA].x509;
		if (x && X509_check_private_key(x, pkey))
				i = SSL_PKEY_DH_RSA;
		x = c->pkeys[SSL_PKEY_DH_DSA].x509;
		if (i == -1 && x && X509_check_private_key(x, pkey))
				i = SSL_PKEY_DH_DSA;
		ERR_clear_error();
		}
	else
		i=ssl_cert_type(NULL,pkey);
	if (i < 0)
		{
		SSLerr(SSL_F_SSL_SET_PKEY,SSL_R_UNKNOWN_CERTIFICATE_TYPE);
		return(0);
		}
	if (c->pkeys[i].x509 != NULL)
		{
		EVP_PKEY *pktmp;
		pktmp =	X509_get_pubkey(c->pkeys[i].x509);
		EVP_PKEY_copy_parameters(pktmp,pkey);
		EVP_PKEY_free(pktmp);
		ERR_clear_error();
#ifndef OPENSSL_NO_RSA
		if ((pkey->type == EVP_PKEY_RSA) &&
			(RSA_flags(pkey->pkey.rsa) & RSA_METHOD_FLAG_NO_CHECK))
			;
		else
#endif
		if (!X509_check_private_key(c->pkeys[i].x509,pkey))
			{
			X509_free(c->pkeys[i].x509);
			c->pkeys[i].x509 = NULL;
			return 0;
			}
		}
	if (c->pkeys[i].privatekey != NULL)
		EVP_PKEY_free(c->pkeys[i].privatekey);
	CRYPTO_add(&pkey->references,1,CRYPTO_LOCK_EVP_PKEY);
	c->pkeys[i].privatekey=pkey;
	c->key= &(c->pkeys[i]);
	c->valid=0;
	return(1);
	}
['static int ssl_set_pkey(CERT *c, EVP_PKEY *pkey)\n\t{\n\tint i;\n\tif (pkey->type == EVP_PKEY_DH)\n\t\t{\n\t\tX509 *x;\n\t\ti = -1;\n\t\tx = c->pkeys[SSL_PKEY_DH_RSA].x509;\n\t\tif (x && X509_check_private_key(x, pkey))\n\t\t\t\ti = SSL_PKEY_DH_RSA;\n\t\tx = c->pkeys[SSL_PKEY_DH_DSA].x509;\n\t\tif (i == -1 && x && X509_check_private_key(x, pkey))\n\t\t\t\ti = SSL_PKEY_DH_DSA;\n\t\tERR_clear_error();\n\t\t}\n\telse\n\t\ti=ssl_cert_type(NULL,pkey);\n\tif (i < 0)\n\t\t{\n\t\tSSLerr(SSL_F_SSL_SET_PKEY,SSL_R_UNKNOWN_CERTIFICATE_TYPE);\n\t\treturn(0);\n\t\t}\n\tif (c->pkeys[i].x509 != NULL)\n\t\t{\n\t\tEVP_PKEY *pktmp;\n\t\tpktmp =\tX509_get_pubkey(c->pkeys[i].x509);\n\t\tEVP_PKEY_copy_parameters(pktmp,pkey);\n\t\tEVP_PKEY_free(pktmp);\n\t\tERR_clear_error();\n#ifndef OPENSSL_NO_RSA\n\t\tif ((pkey->type == EVP_PKEY_RSA) &&\n\t\t\t(RSA_flags(pkey->pkey.rsa) & RSA_METHOD_FLAG_NO_CHECK))\n\t\t\t;\n\t\telse\n#endif\n\t\tif (!X509_check_private_key(c->pkeys[i].x509,pkey))\n\t\t\t{\n\t\t\tX509_free(c->pkeys[i].x509);\n\t\t\tc->pkeys[i].x509 = NULL;\n\t\t\treturn 0;\n\t\t\t}\n\t\t}\n\tif (c->pkeys[i].privatekey != NULL)\n\t\tEVP_PKEY_free(c->pkeys[i].privatekey);\n\tCRYPTO_add(&pkey->references,1,CRYPTO_LOCK_EVP_PKEY);\n\tc->pkeys[i].privatekey=pkey;\n\tc->key= &(c->pkeys[i]);\n\tc->valid=0;\n\treturn(1);\n\t}', 'EVP_PKEY *X509_get_pubkey(X509 *x)\n\t{\n\tif ((x == NULL) || (x->cert_info == NULL))\n\t\treturn(NULL);\n\treturn(X509_PUBKEY_get(x->cert_info->key));\n\t}', 'EVP_PKEY *X509_PUBKEY_get(X509_PUBKEY *key)\n\t{\n\tEVP_PKEY *ret=NULL;\n\tif (key == NULL) goto error;\n\tif (key->pkey != NULL)\n\t\t{\n\t\tCRYPTO_add(&key->pkey->references, 1, CRYPTO_LOCK_EVP_PKEY);\n\t\treturn key->pkey;\n\t\t}\n\tif (key->public_key == NULL) goto error;\n\tif ((ret = EVP_PKEY_new()) == NULL)\n\t\t{\n\t\tX509err(X509_F_X509_PUBKEY_GET, ERR_R_MALLOC_FAILURE);\n\t\tgoto error;\n\t\t}\n\tif (!EVP_PKEY_set_type(ret, OBJ_obj2nid(key->algor->algorithm)))\n\t\t{\n\t\tX509err(X509_F_X509_PUBKEY_GET,X509_R_UNSUPPORTED_ALGORITHM);\n\t\tgoto error;\n\t\t}\n\tif (ret->ameth->pub_decode)\n\t\t{\n\t\tif (!ret->ameth->pub_decode(ret, key))\n\t\t\t{\n\t\t\tX509err(X509_F_X509_PUBKEY_GET,\n\t\t\t\t\t\tX509_R_PUBLIC_KEY_DECODE_ERROR);\n\t\t\tgoto error;\n\t\t\t}\n\t\t}\n\telse\n\t\t{\n\t\tX509err(X509_F_X509_PUBKEY_GET, X509_R_METHOD_NOT_SUPPORTED);\n\t\tgoto error;\n\t\t}\n\tkey->pkey = ret;\n\tCRYPTO_add(&ret->references, 1, CRYPTO_LOCK_EVP_PKEY);\n\treturn ret;\n\terror:\n\tif (ret != NULL)\n\t\tEVP_PKEY_free(ret);\n\treturn(NULL);\n\t}']