ssl/s3_clnt.c:956: error: NULL_DEREFERENCE
  pointer `pkey` last assigned on line 787 could be null and is dereferenced by call to `EVP_PKEY_free()` at line 956, column 2.
Showing all 51 steps of the trace


ssl/s3_clnt.c:779:1: start of procedure ssl3_get_server_certificate()
777.   	}
778.   
779. > static int ssl3_get_server_certificate(SSL *s)
780.   	{
781.   	int al,i,ok,ret= -1;

ssl/s3_clnt.c:781:2: 
779.   static int ssl3_get_server_certificate(SSL *s)
780.   	{
781. > 	int al,i,ok,ret= -1;
782.   	unsigned long n,nc,llen,l;
783.   	X509 *x=NULL;

ssl/s3_clnt.c:783:2: 
781.   	int al,i,ok,ret= -1;
782.   	unsigned long n,nc,llen,l;
783. > 	X509 *x=NULL;
784.   	unsigned char *p,*d,*q;
785.   	STACK_OF(X509) *sk=NULL;

ssl/s3_clnt.c:785:2: 
783.   	X509 *x=NULL;
784.   	unsigned char *p,*d,*q;
785. > 	STACK_OF(X509) *sk=NULL;
786.   	SESS_CERT *sc;
787.   	EVP_PKEY *pkey=NULL;

ssl/s3_clnt.c:787:2: 
785.   	STACK_OF(X509) *sk=NULL;
786.   	SESS_CERT *sc;
787. > 	EVP_PKEY *pkey=NULL;
788.   	int need_cert = 1; /* VRS: 0=> will allow null cert if auth == KRB5 */
789.   

ssl/s3_clnt.c:788:2: 
786.   	SESS_CERT *sc;
787.   	EVP_PKEY *pkey=NULL;
788. > 	int need_cert = 1; /* VRS: 0=> will allow null cert if auth == KRB5 */
789.   
790.   	n=ssl3_get_message(s,

ssl/s3_clnt.c:790:2: Skipping ssl3_get_message(): empty list of specs
788.   	int need_cert = 1; /* VRS: 0=> will allow null cert if auth == KRB5 */
789.   
790.   	n=ssl3_get_message(s,
        ^
791.   		SSL3_ST_CR_CERT_A,
792.   		SSL3_ST_CR_CERT_B,

ssl/s3_clnt.c:797:7: Taking false branch
795.   		&ok);
796.   
797.   	if (!ok) return((int)n);
             ^
798.   
799.   	if (s->s3->tmp.message_type == SSL3_MT_SERVER_KEY_EXCHANGE)

ssl/s3_clnt.c:799:6: Taking false branch
797.   	if (!ok) return((int)n);
798.   
799.   	if (s->s3->tmp.message_type == SSL3_MT_SERVER_KEY_EXCHANGE)
            ^
800.   		{
801.   		s->s3->tmp.reuse_message=1;

ssl/s3_clnt.c:805:6: Taking false branch
803.   		}
804.   
805.   	if (s->s3->tmp.message_type != SSL3_MT_CERTIFICATE)
            ^
806.   		{
807.   		al=SSL_AD_UNEXPECTED_MESSAGE;

ssl/s3_clnt.c:811:2: 
809.   		goto f_err;
810.   		}
811. > 	d=p=(unsigned char *)s->init_msg;
812.   
813.   	if ((sk=sk_X509_new_null()) == NULL)

ssl/s3_clnt.c:813:6: 
811.   	d=p=(unsigned char *)s->init_msg;
812.   
813. > 	if ((sk=sk_X509_new_null()) == NULL)
814.   		{
815.   		SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,ERR_R_MALLOC_FAILURE);

crypto/stack/stack.c:115:1: start of procedure sk_new_null()
  113.   	}
  114.   
  115. > STACK *sk_new_null(void)
  116.   	{
  117.   	return sk_new((int (*)(const char * const *, const char * const *))0);

crypto/stack/stack.c:117:2: 
  115.   STACK *sk_new_null(void)
  116.   	{
  117. > 	return sk_new((int (*)(const char * const *, const char * const *))0);
  118.   	}
  119.   

crypto/stack/stack.c:120:1: start of procedure sk_new()
    118.   	}
    119.   
    120. > STACK *sk_new(int (*c)(const char * const *, const char * const *))
    121.   	{
    122.   	STACK *ret;

crypto/stack/stack.c:125:6: 
    123.   	int i;
    124.   
    125. > 	if ((ret=(STACK *)OPENSSL_malloc(sizeof(STACK))) == NULL)
    126.   		goto err;
    127.   	if ((ret->data=(char **)OPENSSL_malloc(sizeof(char *)*MIN_NODES)) == NULL)

crypto/mem.c:291:1: start of procedure CRYPTO_malloc()
      289.   	}
      290.   
      291. > void *CRYPTO_malloc(int num, const char *file, int line)
      292.   	{
      293.   	void *ret = NULL;

crypto/mem.c:293:2: 
      291.   void *CRYPTO_malloc(int num, const char *file, int line)
      292.   	{
      293. > 	void *ret = NULL;
      294.   	extern unsigned char cleanse_ctr;
      295.   

crypto/mem.c:296:6: Taking false branch
      294.   	extern unsigned char cleanse_ctr;
      295.   
      296.   	if (num <= 0) return NULL;
                  ^
      297.   
      298.   	allow_customize = 0;

crypto/mem.c:298:2: 
      296.   	if (num <= 0) return NULL;
      297.   
      298. > 	allow_customize = 0;
      299.   	if (malloc_debug_func != NULL)
      300.   		{

crypto/mem.c:299:6: Taking true branch
      297.   
      298.   	allow_customize = 0;
      299.   	if (malloc_debug_func != NULL)
                  ^
      300.   		{
      301.   		allow_customize_debug = 0;

crypto/mem.c:301:3: 
      299.   	if (malloc_debug_func != NULL)
      300.   		{
      301. > 		allow_customize_debug = 0;
      302.   		malloc_debug_func(NULL, num, file, line, 0);
      303.   		}

crypto/mem.c:302:3: Skipping __function_pointer__(): unresolved function pointer
      300.   		{
      301.   		allow_customize_debug = 0;
      302.   		malloc_debug_func(NULL, num, file, line, 0);
               ^
      303.   		}
      304.   	ret = malloc_ex_func(num,file,line);

crypto/mem.c:304:2: Skipping __function_pointer__(): unresolved function pointer
      302.   		malloc_debug_func(NULL, num, file, line, 0);
      303.   		}
      304.   	ret = malloc_ex_func(num,file,line);
              ^
      305.   #ifdef LEVITTE_DEBUG_MEM
      306.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);

crypto/mem.c:308:6: Taking true branch
      306.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);
      307.   #endif
      308.   	if (malloc_debug_func != NULL)
                  ^
      309.   		malloc_debug_func(ret, num, file, line, 1);
      310.   

crypto/mem.c:309:3: Skipping __function_pointer__(): unresolved function pointer
      307.   #endif
      308.   	if (malloc_debug_func != NULL)
      309.   		malloc_debug_func(ret, num, file, line, 1);
               ^
      310.   
      311.           /* Create a dependency on the value of 'cleanse_ctr' so our memory

crypto/mem.c:314:12: Taking false branch
      312.            * sanitisation function can't be optimised out. NB: We only do
      313.            * this for >2Kb so the overhead doesn't bother us. */
      314.           if(ret && (num > 2048))
                        ^
      315.                   ((unsigned char *)ret)[0] = cleanse_ctr;
      316.   

crypto/mem.c:317:2: 
      315.                   ((unsigned char *)ret)[0] = cleanse_ctr;
      316.   
      317. > 	return ret;
      318.   	}
      319.   

crypto/mem.c:318:2: return from a call to CRYPTO_malloc
      316.   
      317.   	return ret;
      318.   	}
              ^
      319.   
      320.   void *CRYPTO_realloc(void *str, int num, const char *file, int line)

crypto/stack/stack.c:125:6: Taking true branch
    123.   	int i;
    124.   
    125.   	if ((ret=(STACK *)OPENSSL_malloc(sizeof(STACK))) == NULL)
                ^
    126.   		goto err;
    127.   	if ((ret->data=(char **)OPENSSL_malloc(sizeof(char *)*MIN_NODES)) == NULL)

crypto/stack/stack.c:136:1: 
    134.   	ret->sorted=0;
    135.   	return(ret);
    136. > err:
    137.   	if(ret)
    138.   		OPENSSL_free(ret);

crypto/stack/stack.c:137:5: Taking false branch
    135.   	return(ret);
    136.   err:
    137.   	if(ret)
               ^
    138.   		OPENSSL_free(ret);
    139.   	return(NULL);

crypto/stack/stack.c:139:2: 
    137.   	if(ret)
    138.   		OPENSSL_free(ret);
    139. > 	return(NULL);
    140.   	}
    141.   

crypto/stack/stack.c:140:2: return from a call to sk_new
    138.   		OPENSSL_free(ret);
    139.   	return(NULL);
    140.   	}
            ^
    141.   
    142.   int sk_insert(STACK *st, char *data, int loc)

crypto/stack/stack.c:118:2: return from a call to sk_new_null
  116.   	{
  117.   	return sk_new((int (*)(const char * const *, const char * const *))0);
  118.   	}
          ^
  119.   
  120.   STACK *sk_new(int (*c)(const char * const *, const char * const *))

ssl/s3_clnt.c:813:6: Taking true branch
811.   	d=p=(unsigned char *)s->init_msg;
812.   
813.   	if ((sk=sk_X509_new_null()) == NULL)
            ^
814.   		{
815.   		SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,ERR_R_MALLOC_FAILURE);

ssl/s3_clnt.c:815:3: 
813.   	if ((sk=sk_X509_new_null()) == NULL)
814.   		{
815. > 		SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,ERR_R_MALLOC_FAILURE);
816.   		goto err;
817.   		}

crypto/err/err.c:664:1: start of procedure ERR_put_error()
  662.   /********************************************************/
  663.   
  664. > void ERR_put_error(int lib, int func, int reason, const char *file,
  665.   	     int line)
  666.   	{

crypto/err/err.c:688:2: Skipping ERR_get_state(): empty list of specs
  686.   	}
  687.   #endif
  688.   	es=ERR_get_state();
          ^
  689.   
  690.   	es->top=(es->top+1)%ERR_NUM_ERRORS;

crypto/err/err.c:690:2: 
  688.   	es=ERR_get_state();
  689.   
  690. > 	es->top=(es->top+1)%ERR_NUM_ERRORS;
  691.   	if (es->top == es->bottom)
  692.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;

crypto/err/err.c:691:6: Taking false branch
  689.   
  690.   	es->top=(es->top+1)%ERR_NUM_ERRORS;
  691.   	if (es->top == es->bottom)
              ^
  692.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
  693.   	es->err_flags[es->top]=0;

crypto/err/err.c:693:2: 
  691.   	if (es->top == es->bottom)
  692.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
  693. > 	es->err_flags[es->top]=0;
  694.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
  695.   	es->err_file[es->top]=file;

crypto/err/err.c:694:2: 
  692.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
  693.   	es->err_flags[es->top]=0;
  694. > 	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
  695.   	es->err_file[es->top]=file;
  696.   	es->err_line[es->top]=line;

crypto/err/err.c:695:2: 
  693.   	es->err_flags[es->top]=0;
  694.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
  695. > 	es->err_file[es->top]=file;
  696.   	es->err_line[es->top]=line;
  697.   	err_clear_data(es,es->top);

crypto/err/err.c:696:2: 
  694.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
  695.   	es->err_file[es->top]=file;
  696. > 	es->err_line[es->top]=line;
  697.   	err_clear_data(es,es->top);
  698.   	}

crypto/err/err.c:697:2: Taking true branch
  695.   	es->err_file[es->top]=file;
  696.   	es->err_line[es->top]=line;
  697.   	err_clear_data(es,es->top);
          ^
  698.   	}
  699.   

crypto/err/err.c:697:2: Taking false branch
  695.   	es->err_file[es->top]=file;
  696.   	es->err_line[es->top]=line;
  697.   	err_clear_data(es,es->top);
          ^
  698.   	}
  699.   

crypto/err/err.c:697:2: Loop condition is false. Leaving loop
  695.   	es->err_file[es->top]=file;
  696.   	es->err_line[es->top]=line;
  697.   	err_clear_data(es,es->top);
          ^
  698.   	}
  699.   

crypto/err/err.c:698:2: return from a call to ERR_put_error
  696.   	es->err_line[es->top]=line;
  697.   	err_clear_data(es,es->top);
  698.   	}
          ^
  699.   
  700.   void ERR_clear_error(void)

ssl/s3_clnt.c:955:1: 
953.   		ssl3_send_alert(s,SSL3_AL_FATAL,al);
954.   		}
955. > err:
956.   	EVP_PKEY_free(pkey);
957.   	X509_free(x);

ssl/s3_clnt.c:956:2: 
954.   		}
955.   err:
956. > 	EVP_PKEY_free(pkey);
957.   	X509_free(x);
958.   	sk_X509_pop_free(sk,X509_free);

static int ssl3_get_server_certificate(SSL *s)
	{
	int al,i,ok,ret= -1;
	unsigned long n,nc,llen,l;
	X509 *x=NULL;
	unsigned char *p,*d,*q;
	STACK_OF(X509) *sk=NULL;
	SESS_CERT *sc;
	EVP_PKEY *pkey=NULL;
	int need_cert = 1;
	n=ssl3_get_message(s,
		SSL3_ST_CR_CERT_A,
		SSL3_ST_CR_CERT_B,
		-1,
		s->max_cert_list,
		&ok);
	if (!ok) return((int)n);
	if (s->s3->tmp.message_type == SSL3_MT_SERVER_KEY_EXCHANGE)
		{
		s->s3->tmp.reuse_message=1;
		return(1);
		}
	if (s->s3->tmp.message_type != SSL3_MT_CERTIFICATE)
		{
		al=SSL_AD_UNEXPECTED_MESSAGE;
		SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,SSL_R_BAD_MESSAGE_TYPE);
		goto f_err;
		}
	d=p=(unsigned char *)s->init_msg;
	if ((sk=sk_X509_new_null()) == NULL)
		{
		SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,ERR_R_MALLOC_FAILURE);
		goto err;
		}
	n2l3(p,llen);
	if (llen+3 != n)
		{
		al=SSL_AD_DECODE_ERROR;
		SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,SSL_R_LENGTH_MISMATCH);
		goto f_err;
		}
	for (nc=0; nc<llen; )
		{
		n2l3(p,l);
		if ((l+nc+3) > llen)
			{
			al=SSL_AD_DECODE_ERROR;
			SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,SSL_R_CERT_LENGTH_MISMATCH);
			goto f_err;
			}
		q=p;
		x=d2i_X509(NULL,&q,l);
		if (x == NULL)
			{
			al=SSL_AD_BAD_CERTIFICATE;
			SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,ERR_R_ASN1_LIB);
			goto f_err;
			}
		if (q != (p+l))
			{
			al=SSL_AD_DECODE_ERROR;
			SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,SSL_R_CERT_LENGTH_MISMATCH);
			goto f_err;
			}
		if (!sk_X509_push(sk,x))
			{
			SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,ERR_R_MALLOC_FAILURE);
			goto err;
			}
		x=NULL;
		nc+=l+3;
		p=q;
		}
	i=ssl_verify_cert_chain(s,sk);
	if ((s->verify_mode != SSL_VERIFY_NONE) && (!i)
#ifndef OPENSSL_NO_KRB5
	        && (s->s3->tmp.new_cipher->algorithms & (SSL_MKEY_MASK|SSL_AUTH_MASK))
	        != (SSL_aKRB5|SSL_kKRB5)
#endif
	        )
		{
		al=ssl_verify_alarm_type(s->verify_result);
		SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,SSL_R_CERTIFICATE_VERIFY_FAILED);
		goto f_err;
		}
	ERR_clear_error();
	sc=ssl_sess_cert_new();
	if (sc == NULL) goto err;
	if (s->session->sess_cert) ssl_sess_cert_free(s->session->sess_cert);
	s->session->sess_cert=sc;
	sc->cert_chain=sk;
	x=sk_X509_value(sk,0);
	sk=NULL;
	pkey=X509_get_pubkey(x);
	need_cert =	((s->s3->tmp.new_cipher->algorithms
	                 & (SSL_MKEY_MASK|SSL_AUTH_MASK))
	                 == (SSL_aKRB5|SSL_kKRB5))? 0: 1;
#ifdef KSSL_DEBUG
	printf("pkey,x = %p, %p\n", pkey,x);
	printf("ssl_cert_type(x,pkey) = %d\n", ssl_cert_type(x,pkey));
	printf("cipher, alg, nc = %s, %lx, %d\n", s->s3->tmp.new_cipher->name,
	        s->s3->tmp.new_cipher->algorithms, need_cert);
#endif
	if (need_cert && ((pkey == NULL) || EVP_PKEY_missing_parameters(pkey)))
		{
		x=NULL;
		al=SSL3_AL_FATAL;
		SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,
			SSL_R_UNABLE_TO_FIND_PUBLIC_KEY_PARAMETERS);
		goto f_err;
		}
	i=ssl_cert_type(x,pkey);
	if (need_cert && i < 0)
		{
		x=NULL;
		al=SSL3_AL_FATAL;
		SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,
			SSL_R_UNKNOWN_CERTIFICATE_TYPE);
		goto f_err;
		}
	if (need_cert)
		{
		sc->peer_cert_type=i;
		CRYPTO_add(&x->references,1,CRYPTO_LOCK_X509);
		if (sc->peer_pkeys[i].x509 != NULL)
			X509_free(sc->peer_pkeys[i].x509);
		sc->peer_pkeys[i].x509=x;
		sc->peer_key= &(sc->peer_pkeys[i]);
		if (s->session->peer != NULL)
			X509_free(s->session->peer);
		CRYPTO_add(&x->references,1,CRYPTO_LOCK_X509);
		s->session->peer=x;
		}
	else
		{
		sc->peer_cert_type=i;
		sc->peer_key= NULL;
		if (s->session->peer != NULL)
			X509_free(s->session->peer);
		s->session->peer=NULL;
		}
	s->session->verify_result = s->verify_result;
	x=NULL;
	ret=1;
	if (0)
		{
f_err:
		ssl3_send_alert(s,SSL3_AL_FATAL,al);
		}
err:
	EVP_PKEY_free(pkey);
	X509_free(x);
	sk_X509_pop_free(sk,X509_free);
	return(ret);
	}
['static int ssl3_get_server_certificate(SSL *s)\n\t{\n\tint al,i,ok,ret= -1;\n\tunsigned long n,nc,llen,l;\n\tX509 *x=NULL;\n\tunsigned char *p,*d,*q;\n\tSTACK_OF(X509) *sk=NULL;\n\tSESS_CERT *sc;\n\tEVP_PKEY *pkey=NULL;\n\tint need_cert = 1;\n\tn=ssl3_get_message(s,\n\t\tSSL3_ST_CR_CERT_A,\n\t\tSSL3_ST_CR_CERT_B,\n\t\t-1,\n\t\ts->max_cert_list,\n\t\t&ok);\n\tif (!ok) return((int)n);\n\tif (s->s3->tmp.message_type == SSL3_MT_SERVER_KEY_EXCHANGE)\n\t\t{\n\t\ts->s3->tmp.reuse_message=1;\n\t\treturn(1);\n\t\t}\n\tif (s->s3->tmp.message_type != SSL3_MT_CERTIFICATE)\n\t\t{\n\t\tal=SSL_AD_UNEXPECTED_MESSAGE;\n\t\tSSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,SSL_R_BAD_MESSAGE_TYPE);\n\t\tgoto f_err;\n\t\t}\n\td=p=(unsigned char *)s->init_msg;\n\tif ((sk=sk_X509_new_null()) == NULL)\n\t\t{\n\t\tSSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,ERR_R_MALLOC_FAILURE);\n\t\tgoto err;\n\t\t}\n\tn2l3(p,llen);\n\tif (llen+3 != n)\n\t\t{\n\t\tal=SSL_AD_DECODE_ERROR;\n\t\tSSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,SSL_R_LENGTH_MISMATCH);\n\t\tgoto f_err;\n\t\t}\n\tfor (nc=0; nc<llen; )\n\t\t{\n\t\tn2l3(p,l);\n\t\tif ((l+nc+3) > llen)\n\t\t\t{\n\t\t\tal=SSL_AD_DECODE_ERROR;\n\t\t\tSSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,SSL_R_CERT_LENGTH_MISMATCH);\n\t\t\tgoto f_err;\n\t\t\t}\n\t\tq=p;\n\t\tx=d2i_X509(NULL,&q,l);\n\t\tif (x == NULL)\n\t\t\t{\n\t\t\tal=SSL_AD_BAD_CERTIFICATE;\n\t\t\tSSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,ERR_R_ASN1_LIB);\n\t\t\tgoto f_err;\n\t\t\t}\n\t\tif (q != (p+l))\n\t\t\t{\n\t\t\tal=SSL_AD_DECODE_ERROR;\n\t\t\tSSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,SSL_R_CERT_LENGTH_MISMATCH);\n\t\t\tgoto f_err;\n\t\t\t}\n\t\tif (!sk_X509_push(sk,x))\n\t\t\t{\n\t\t\tSSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,ERR_R_MALLOC_FAILURE);\n\t\t\tgoto err;\n\t\t\t}\n\t\tx=NULL;\n\t\tnc+=l+3;\n\t\tp=q;\n\t\t}\n\ti=ssl_verify_cert_chain(s,sk);\n\tif ((s->verify_mode != SSL_VERIFY_NONE) && (!i)\n#ifndef OPENSSL_NO_KRB5\n\t        && (s->s3->tmp.new_cipher->algorithms & (SSL_MKEY_MASK|SSL_AUTH_MASK))\n\t        != (SSL_aKRB5|SSL_kKRB5)\n#endif\n\t        )\n\t\t{\n\t\tal=ssl_verify_alarm_type(s->verify_result);\n\t\tSSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,SSL_R_CERTIFICATE_VERIFY_FAILED);\n\t\tgoto f_err;\n\t\t}\n\tERR_clear_error();\n\tsc=ssl_sess_cert_new();\n\tif (sc == NULL) goto err;\n\tif (s->session->sess_cert) ssl_sess_cert_free(s->session->sess_cert);\n\ts->session->sess_cert=sc;\n\tsc->cert_chain=sk;\n\tx=sk_X509_value(sk,0);\n\tsk=NULL;\n\tpkey=X509_get_pubkey(x);\n\tneed_cert =\t((s->s3->tmp.new_cipher->algorithms\n\t                 & (SSL_MKEY_MASK|SSL_AUTH_MASK))\n\t                 == (SSL_aKRB5|SSL_kKRB5))? 0: 1;\n#ifdef KSSL_DEBUG\n\tprintf("pkey,x = %p, %p\\n", pkey,x);\n\tprintf("ssl_cert_type(x,pkey) = %d\\n", ssl_cert_type(x,pkey));\n\tprintf("cipher, alg, nc = %s, %lx, %d\\n", s->s3->tmp.new_cipher->name,\n\t        s->s3->tmp.new_cipher->algorithms, need_cert);\n#endif\n\tif (need_cert && ((pkey == NULL) || EVP_PKEY_missing_parameters(pkey)))\n\t\t{\n\t\tx=NULL;\n\t\tal=SSL3_AL_FATAL;\n\t\tSSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,\n\t\t\tSSL_R_UNABLE_TO_FIND_PUBLIC_KEY_PARAMETERS);\n\t\tgoto f_err;\n\t\t}\n\ti=ssl_cert_type(x,pkey);\n\tif (need_cert && i < 0)\n\t\t{\n\t\tx=NULL;\n\t\tal=SSL3_AL_FATAL;\n\t\tSSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,\n\t\t\tSSL_R_UNKNOWN_CERTIFICATE_TYPE);\n\t\tgoto f_err;\n\t\t}\n\tif (need_cert)\n\t\t{\n\t\tsc->peer_cert_type=i;\n\t\tCRYPTO_add(&x->references,1,CRYPTO_LOCK_X509);\n\t\tif (sc->peer_pkeys[i].x509 != NULL)\n\t\t\tX509_free(sc->peer_pkeys[i].x509);\n\t\tsc->peer_pkeys[i].x509=x;\n\t\tsc->peer_key= &(sc->peer_pkeys[i]);\n\t\tif (s->session->peer != NULL)\n\t\t\tX509_free(s->session->peer);\n\t\tCRYPTO_add(&x->references,1,CRYPTO_LOCK_X509);\n\t\ts->session->peer=x;\n\t\t}\n\telse\n\t\t{\n\t\tsc->peer_cert_type=i;\n\t\tsc->peer_key= NULL;\n\t\tif (s->session->peer != NULL)\n\t\t\tX509_free(s->session->peer);\n\t\ts->session->peer=NULL;\n\t\t}\n\ts->session->verify_result = s->verify_result;\n\tx=NULL;\n\tret=1;\n\tif (0)\n\t\t{\nf_err:\n\t\tssl3_send_alert(s,SSL3_AL_FATAL,al);\n\t\t}\nerr:\n\tEVP_PKEY_free(pkey);\n\tX509_free(x);\n\tsk_X509_pop_free(sk,X509_free);\n\treturn(ret);\n\t}', 'STACK *sk_new_null(void)\n\t{\n\treturn sk_new((int (*)(const char * const *, const char * const *))0);\n\t}', 'STACK *sk_new(int (*c)(const char * const *, const char * const *))\n\t{\n\tSTACK *ret;\n\tint i;\n\tif ((ret=(STACK *)OPENSSL_malloc(sizeof(STACK))) == NULL)\n\t\tgoto err;\n\tif ((ret->data=(char **)OPENSSL_malloc(sizeof(char *)*MIN_NODES)) == NULL)\n\t\tgoto err;\n\tfor (i=0; i<MIN_NODES; i++)\n\t\tret->data[i]=NULL;\n\tret->comp=c;\n\tret->num_alloc=MIN_NODES;\n\tret->num=0;\n\tret->sorted=0;\n\treturn(ret);\nerr:\n\tif(ret)\n\t\tOPENSSL_free(ret);\n\treturn(NULL);\n\t}', 'void *CRYPTO_malloc(int num, const char *file, int line)\n\t{\n\tvoid *ret = NULL;\n\textern unsigned char cleanse_ctr;\n\tif (num <= 0) return NULL;\n\tallow_customize = 0;\n\tif (malloc_debug_func != NULL)\n\t\t{\n\t\tallow_customize_debug = 0;\n\t\tmalloc_debug_func(NULL, num, file, line, 0);\n\t\t}\n\tret = malloc_ex_func(num,file,line);\n#ifdef LEVITTE_DEBUG_MEM\n\tfprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\\n", ret, num);\n#endif\n\tif (malloc_debug_func != NULL)\n\t\tmalloc_debug_func(ret, num, file, line, 1);\n        if(ret && (num > 2048))\n                ((unsigned char *)ret)[0] = cleanse_ctr;\n\treturn ret;\n\t}', 'void ERR_put_error(int lib, int func, int reason, const char *file,\n\t     int line)\n\t{\n\tERR_STATE *es;\n#ifdef _OSD_POSIX\n\tif (strncmp(file,"*POSIX(", sizeof("*POSIX(")-1) == 0) {\n\t\tchar *end;\n\t\tfile += sizeof("*POSIX(")-1;\n\t\tend = &file[strlen(file)-1];\n\t\tif (*end == \')\')\n\t\t\t*end = \'\\0\';\n\t\tif ((end = strrchr(file, \'/\')) != NULL)\n\t\t\tfile = &end[1];\n\t}\n#endif\n\tes=ERR_get_state();\n\tes->top=(es->top+1)%ERR_NUM_ERRORS;\n\tif (es->top == es->bottom)\n\t\tes->bottom=(es->bottom+1)%ERR_NUM_ERRORS;\n\tes->err_flags[es->top]=0;\n\tes->err_buffer[es->top]=ERR_PACK(lib,func,reason);\n\tes->err_file[es->top]=file;\n\tes->err_line[es->top]=line;\n\terr_clear_data(es,es->top);\n\t}']