crypto/x509/x509_req.c:88: error: NULL_DEREFERENCE
  pointer `xk` last assigned on line 87 could be null and is dereferenced by call to `EVP_PKEY_cmp()` at line 88, column 13.
Showing all 47 steps of the trace


crypto/x509/x509_req.c:82:1: start of procedure X509_REQ_check_private_key()
80.   }
81.   
82. > int X509_REQ_check_private_key(X509_REQ *x, EVP_PKEY *k)
83.   {
84.       EVP_PKEY *xk = NULL;

crypto/x509/x509_req.c:84:5: 
82.   int X509_REQ_check_private_key(X509_REQ *x, EVP_PKEY *k)
83.   {
84. >     EVP_PKEY *xk = NULL;
85.       int ok = 0;
86.   

crypto/x509/x509_req.c:85:5: 
83.   {
84.       EVP_PKEY *xk = NULL;
85. >     int ok = 0;
86.   
87.       xk = X509_REQ_get_pubkey(x);

crypto/x509/x509_req.c:87:5: 
85.       int ok = 0;
86.   
87. >     xk = X509_REQ_get_pubkey(x);
88.       switch (EVP_PKEY_cmp(xk, k)) {
89.       case 1:

crypto/x509/x509_req.c:63:1: start of procedure X509_REQ_get_pubkey()
  61.   }
  62.   
  63. > EVP_PKEY *X509_REQ_get_pubkey(X509_REQ *req)
  64.   {
  65.       if (req == NULL)

crypto/x509/x509_req.c:65:9: Taking false branch
  63.   EVP_PKEY *X509_REQ_get_pubkey(X509_REQ *req)
  64.   {
  65.       if (req == NULL)
                ^
  66.           return (NULL);
  67.       return (X509_PUBKEY_get(req->req_info.pubkey));

crypto/x509/x509_req.c:67:5: 
  65.       if (req == NULL)
  66.           return (NULL);
  67. >     return (X509_PUBKEY_get(req->req_info.pubkey));
  68.   }
  69.   

crypto/x509/x_pubkey.c:168:1: start of procedure X509_PUBKEY_get()
    166.   }
    167.   
    168. > EVP_PKEY *X509_PUBKEY_get(X509_PUBKEY *key)
    169.   {
    170.       EVP_PKEY *ret = X509_PUBKEY_get0(key);

crypto/x509/x_pubkey.c:170:5: 
    168.   EVP_PKEY *X509_PUBKEY_get(X509_PUBKEY *key)
    169.   {
    170. >     EVP_PKEY *ret = X509_PUBKEY_get0(key);
    171.       if (ret != NULL)
    172.           EVP_PKEY_up_ref(ret);

crypto/x509/x_pubkey.c:140:1: start of procedure X509_PUBKEY_get0()
      138.   }
      139.   
      140. > EVP_PKEY *X509_PUBKEY_get0(X509_PUBKEY *key)
      141.   {
      142.       EVP_PKEY *ret = NULL;

crypto/x509/x_pubkey.c:142:5: 
      140.   EVP_PKEY *X509_PUBKEY_get0(X509_PUBKEY *key)
      141.   {
      142. >     EVP_PKEY *ret = NULL;
      143.   
      144.       if (key == NULL || key->public_key == NULL)

crypto/x509/x_pubkey.c:144:9: Taking false branch
      142.       EVP_PKEY *ret = NULL;
      143.   
      144.       if (key == NULL || key->public_key == NULL)
                     ^
      145.           return NULL;
      146.   

crypto/x509/x_pubkey.c:144:24: Taking false branch
      142.       EVP_PKEY *ret = NULL;
      143.   
      144.       if (key == NULL || key->public_key == NULL)
                                    ^
      145.           return NULL;
      146.   

crypto/x509/x_pubkey.c:147:9: Taking false branch
      145.           return NULL;
      146.   
      147.       if (key->pkey != NULL)
                     ^
      148.           return key->pkey;
      149.   

crypto/x509/x_pubkey.c:158:5: 
      156.        * in the queue.
      157.        */
      158. >     x509_pubkey_decode(&ret, key);
      159.       /* If decode doesn't fail something bad happened */
      160.       if (ret != NULL) {

crypto/x509/x_pubkey.c:103:1: start of procedure x509_pubkey_decode()
        101.   
        102.   
        103. > static int x509_pubkey_decode(EVP_PKEY **ppkey, X509_PUBKEY *key)
        104.       {
        105.       EVP_PKEY *pkey = EVP_PKEY_new();

crypto/x509/x_pubkey.c:105:5: Skipping EVP_PKEY_new(): empty list of specs
        103.   static int x509_pubkey_decode(EVP_PKEY **ppkey, X509_PUBKEY *key)
        104.       {
        105.       EVP_PKEY *pkey = EVP_PKEY_new();
                   ^
        106.   
        107.       if (pkey == NULL) {

crypto/x509/x_pubkey.c:107:9: Taking true branch
        105.       EVP_PKEY *pkey = EVP_PKEY_new();
        106.   
        107.       if (pkey == NULL) {
                       ^
        108.           X509err(X509_F_X509_PUBKEY_DECODE, ERR_R_MALLOC_FAILURE);
        109.           return -1;

crypto/x509/x_pubkey.c:108:9: 
        106.   
        107.       if (pkey == NULL) {
        108. >         X509err(X509_F_X509_PUBKEY_DECODE, ERR_R_MALLOC_FAILURE);
        109.           return -1;
        110.       }

crypto/err/err.c:365:1: start of procedure ERR_put_error()
          363.   /********************************************************/
          364.   
          365. > void ERR_put_error(int lib, int func, int reason, const char *file, int line)
          366.   {
          367.       ERR_STATE *es;

crypto/err/err.c:388:5: 
          386.       }
          387.   #endif
          388. >     es = ERR_get_state();
          389.       if (es == NULL)
          390.           return;

crypto/err/err.c:679:1: start of procedure ERR_get_state()
            677.   }
            678.   
            679. > ERR_STATE *ERR_get_state(void)
            680.   {
            681.       ERR_STATE *state = NULL;

crypto/err/err.c:681:5: 
            679.   ERR_STATE *ERR_get_state(void)
            680.   {
            681. >     ERR_STATE *state = NULL;
            682.   
            683.       if (!RUN_ONCE(&err_init, err_do_init))

crypto/err/err.c:683:10: 
            681.       ERR_STATE *state = NULL;
            682.   
            683. >     if (!RUN_ONCE(&err_init, err_do_init))
            684.           return NULL;
            685.   

crypto/threads_pthread.c:105:1: start of procedure CRYPTO_THREAD_run_once()
              103.   }
              104.   
              105. > int CRYPTO_THREAD_run_once(CRYPTO_ONCE *once, void (*init)(void))
              106.   {
              107.       if (pthread_once(once, init) != 0)

crypto/threads_pthread.c:107:9: Taking true branch
              105.   int CRYPTO_THREAD_run_once(CRYPTO_ONCE *once, void (*init)(void))
              106.   {
              107.       if (pthread_once(once, init) != 0)
                             ^
              108.           return 0;
              109.   

crypto/threads_pthread.c:108:9: 
              106.   {
              107.       if (pthread_once(once, init) != 0)
              108. >         return 0;
              109.   
              110.       return 1;

crypto/threads_pthread.c:111:1: return from a call to CRYPTO_THREAD_run_once
              109.   
              110.       return 1;
              111. > }
              112.   
              113.   int CRYPTO_THREAD_init_local(CRYPTO_THREAD_LOCAL *key, void (*cleanup)(void *))

crypto/err/err.c:683:10: Condition is false
            681.       ERR_STATE *state = NULL;
            682.   
            683.       if (!RUN_ONCE(&err_init, err_do_init))
                            ^
            684.           return NULL;
            685.   

crypto/err/err.c:683:10: Taking true branch
            681.       ERR_STATE *state = NULL;
            682.   
            683.       if (!RUN_ONCE(&err_init, err_do_init))
                            ^
            684.           return NULL;
            685.   

crypto/err/err.c:684:9: 
            682.   
            683.       if (!RUN_ONCE(&err_init, err_do_init))
            684. >         return NULL;
            685.   
            686.       state = CRYPTO_THREAD_get_local(&err_thread_local);

crypto/err/err.c:704:1: return from a call to ERR_get_state
            702.   
            703.       return state;
            704. > }
            705.   
            706.   int ERR_get_next_error_library(void)

crypto/err/err.c:389:9: Taking true branch
          387.   #endif
          388.       es = ERR_get_state();
          389.       if (es == NULL)
                         ^
          390.           return;
          391.   

crypto/err/err.c:390:9: 
          388.       es = ERR_get_state();
          389.       if (es == NULL)
          390. >         return;
          391.   
          392.       es->top = (es->top + 1) % ERR_NUM_ERRORS;

crypto/err/err.c:400:1: return from a call to ERR_put_error
          398.       es->err_line[es->top] = line;
          399.       err_clear_data(es, es->top);
          400. > }
          401.   
          402.   void ERR_clear_error(void)

crypto/x509/x_pubkey.c:109:9: 
        107.       if (pkey == NULL) {
        108.           X509err(X509_F_X509_PUBKEY_DECODE, ERR_R_MALLOC_FAILURE);
        109. >         return -1;
        110.       }
        111.   

crypto/x509/x_pubkey.c:138:1: return from a call to x509_pubkey_decode
        136.       EVP_PKEY_free(pkey);
        137.       return 0;
        138. > }
        139.   
        140.   EVP_PKEY *X509_PUBKEY_get0(X509_PUBKEY *key)

crypto/x509/x_pubkey.c:160:9: Taking false branch
      158.       x509_pubkey_decode(&ret, key);
      159.       /* If decode doesn't fail something bad happened */
      160.       if (ret != NULL) {
                     ^
      161.           X509err(X509_F_X509_PUBKEY_GET0, ERR_R_INTERNAL_ERROR);
      162.           EVP_PKEY_free(ret);

crypto/x509/x_pubkey.c:165:5: 
      163.       }
      164.   
      165. >     return NULL;
      166.   }
      167.   

crypto/x509/x_pubkey.c:166:1: return from a call to X509_PUBKEY_get0
      164.   
      165.       return NULL;
      166. > }
      167.   
      168.   EVP_PKEY *X509_PUBKEY_get(X509_PUBKEY *key)

crypto/x509/x_pubkey.c:171:9: Taking false branch
    169.   {
    170.       EVP_PKEY *ret = X509_PUBKEY_get0(key);
    171.       if (ret != NULL)
                   ^
    172.           EVP_PKEY_up_ref(ret);
    173.       return ret;

crypto/x509/x_pubkey.c:173:5: 
    171.       if (ret != NULL)
    172.           EVP_PKEY_up_ref(ret);
    173. >     return ret;
    174.   }
    175.   

crypto/x509/x_pubkey.c:174:1: return from a call to X509_PUBKEY_get
    172.           EVP_PKEY_up_ref(ret);
    173.       return ret;
    174. > }
    175.   
    176.   /*

crypto/x509/x509_req.c:68:1: return from a call to X509_REQ_get_pubkey
  66.           return (NULL);
  67.       return (X509_PUBKEY_get(req->req_info.pubkey));
  68. > }
  69.   
  70.   EVP_PKEY *X509_REQ_get0_pubkey(X509_REQ *req)

crypto/x509/x509_req.c:88:5: 
86.   
87.       xk = X509_REQ_get_pubkey(x);
88. >     switch (EVP_PKEY_cmp(xk, k)) {
89.       case 1:
90.           ok = 1;

crypto/evp/p_lib.c:117:1: start of procedure EVP_PKEY_cmp()
  115.   }
  116.   
  117. > int EVP_PKEY_cmp(const EVP_PKEY *a, const EVP_PKEY *b)
  118.   {
  119.       if (a->type != b->type)

crypto/evp/p_lib.c:119:9: 
  117.   int EVP_PKEY_cmp(const EVP_PKEY *a, const EVP_PKEY *b)
  118.   {
  119. >     if (a->type != b->type)
  120.           return -1;
  121.   

int X509_REQ_check_private_key(X509_REQ *x, EVP_PKEY *k)
{
    EVP_PKEY *xk = NULL;
    int ok = 0;
    xk = X509_REQ_get_pubkey(x);
    switch (EVP_PKEY_cmp(xk, k)) {
    case 1:
        ok = 1;
        break;
    case 0:
        X509err(X509_F_X509_REQ_CHECK_PRIVATE_KEY,
                X509_R_KEY_VALUES_MISMATCH);
        break;
    case -1:
        X509err(X509_F_X509_REQ_CHECK_PRIVATE_KEY, X509_R_KEY_TYPE_MISMATCH);
        break;
    case -2:
#ifndef OPENSSL_NO_EC
        if (EVP_PKEY_id(k) == EVP_PKEY_EC) {
            X509err(X509_F_X509_REQ_CHECK_PRIVATE_KEY, ERR_R_EC_LIB);
            break;
        }
#endif
#ifndef OPENSSL_NO_DH
        if (EVP_PKEY_id(k) == EVP_PKEY_DH) {
            X509err(X509_F_X509_REQ_CHECK_PRIVATE_KEY,
                    X509_R_CANT_CHECK_DH_KEY);
            break;
        }
#endif
        X509err(X509_F_X509_REQ_CHECK_PRIVATE_KEY, X509_R_UNKNOWN_KEY_TYPE);
    }
    EVP_PKEY_free(xk);
    return (ok);
}
['int X509_REQ_check_private_key(X509_REQ *x, EVP_PKEY *k)\n{\n    EVP_PKEY *xk = NULL;\n    int ok = 0;\n    xk = X509_REQ_get_pubkey(x);\n    switch (EVP_PKEY_cmp(xk, k)) {\n    case 1:\n        ok = 1;\n        break;\n    case 0:\n        X509err(X509_F_X509_REQ_CHECK_PRIVATE_KEY,\n                X509_R_KEY_VALUES_MISMATCH);\n        break;\n    case -1:\n        X509err(X509_F_X509_REQ_CHECK_PRIVATE_KEY, X509_R_KEY_TYPE_MISMATCH);\n        break;\n    case -2:\n#ifndef OPENSSL_NO_EC\n        if (EVP_PKEY_id(k) == EVP_PKEY_EC) {\n            X509err(X509_F_X509_REQ_CHECK_PRIVATE_KEY, ERR_R_EC_LIB);\n            break;\n        }\n#endif\n#ifndef OPENSSL_NO_DH\n        if (EVP_PKEY_id(k) == EVP_PKEY_DH) {\n            X509err(X509_F_X509_REQ_CHECK_PRIVATE_KEY,\n                    X509_R_CANT_CHECK_DH_KEY);\n            break;\n        }\n#endif\n        X509err(X509_F_X509_REQ_CHECK_PRIVATE_KEY, X509_R_UNKNOWN_KEY_TYPE);\n    }\n    EVP_PKEY_free(xk);\n    return (ok);\n}', 'EVP_PKEY *X509_REQ_get_pubkey(X509_REQ *req)\n{\n    if (req == NULL)\n        return (NULL);\n    return (X509_PUBKEY_get(req->req_info.pubkey));\n}', 'EVP_PKEY *X509_PUBKEY_get(X509_PUBKEY *key)\n{\n    EVP_PKEY *ret = X509_PUBKEY_get0(key);\n    if (ret != NULL)\n        EVP_PKEY_up_ref(ret);\n    return ret;\n}', 'EVP_PKEY *X509_PUBKEY_get0(X509_PUBKEY *key)\n{\n    EVP_PKEY *ret = NULL;\n    if (key == NULL || key->public_key == NULL)\n        return NULL;\n    if (key->pkey != NULL)\n        return key->pkey;\n    x509_pubkey_decode(&ret, key);\n    if (ret != NULL) {\n        X509err(X509_F_X509_PUBKEY_GET0, ERR_R_INTERNAL_ERROR);\n        EVP_PKEY_free(ret);\n    }\n    return NULL;\n}', 'static int x509_pubkey_decode(EVP_PKEY **ppkey, X509_PUBKEY *key)\n    {\n    EVP_PKEY *pkey = EVP_PKEY_new();\n    if (pkey == NULL) {\n        X509err(X509_F_X509_PUBKEY_DECODE, ERR_R_MALLOC_FAILURE);\n        return -1;\n    }\n    if (!EVP_PKEY_set_type(pkey, OBJ_obj2nid(key->algor->algorithm))) {\n        X509err(X509_F_X509_PUBKEY_DECODE, X509_R_UNSUPPORTED_ALGORITHM);\n        goto error;\n    }\n    if (pkey->ameth->pub_decode) {\n        if (!pkey->ameth->pub_decode(pkey, key)) {\n            X509err(X509_F_X509_PUBKEY_DECODE, X509_R_PUBLIC_KEY_DECODE_ERROR);\n            goto error;\n        }\n    } else {\n        X509err(X509_F_X509_PUBKEY_DECODE, X509_R_METHOD_NOT_SUPPORTED);\n        goto error;\n    }\n    *ppkey = pkey;\n    return 1;\n error:\n    EVP_PKEY_free(pkey);\n    return 0;\n}', 'void ERR_put_error(int lib, int func, int reason, const char *file, int line)\n{\n    ERR_STATE *es;\n#ifdef _OSD_POSIX\n    if (strncmp(file, "*POSIX(", sizeof("*POSIX(") - 1) == 0) {\n        char *end;\n        file += sizeof("*POSIX(") - 1;\n        end = &file[strlen(file) - 1];\n        if (*end == \')\')\n            *end = \'\\0\';\n        if ((end = strrchr(file, \'/\')) != NULL)\n            file = &end[1];\n    }\n#endif\n    es = ERR_get_state();\n    if (es == NULL)\n        return;\n    es->top = (es->top + 1) % ERR_NUM_ERRORS;\n    if (es->top == es->bottom)\n        es->bottom = (es->bottom + 1) % ERR_NUM_ERRORS;\n    es->err_flags[es->top] = 0;\n    es->err_buffer[es->top] = ERR_PACK(lib, func, reason);\n    es->err_file[es->top] = file;\n    es->err_line[es->top] = line;\n    err_clear_data(es, es->top);\n}', 'ERR_STATE *ERR_get_state(void)\n{\n    ERR_STATE *state = NULL;\n    if (!RUN_ONCE(&err_init, err_do_init))\n        return NULL;\n    state = CRYPTO_THREAD_get_local(&err_thread_local);\n    if (state == NULL) {\n        state = OPENSSL_zalloc(sizeof(*state));\n        if (state == NULL)\n            return NULL;\n        if (!ossl_init_thread_start(OPENSSL_INIT_THREAD_ERR_STATE)\n            || !CRYPTO_THREAD_set_local(&err_thread_local, state)) {\n            ERR_STATE_free(state);\n            return NULL;\n        }\n        OPENSSL_init_crypto(OPENSSL_INIT_LOAD_CRYPTO_STRINGS, NULL);\n    }\n    return state;\n}', 'int CRYPTO_THREAD_run_once(CRYPTO_ONCE *once, void (*init)(void))\n{\n    if (pthread_once(once, init) != 0)\n        return 0;\n    return 1;\n}', 'int EVP_PKEY_cmp(const EVP_PKEY *a, const EVP_PKEY *b)\n{\n    if (a->type != b->type)\n        return -1;\n    if (a->ameth) {\n        int ret;\n        if (a->ameth->param_cmp) {\n            ret = a->ameth->param_cmp(a, b);\n            if (ret <= 0)\n                return ret;\n        }\n        if (a->ameth->pub_cmp)\n            return a->ameth->pub_cmp(a, b);\n    }\n    return -2;\n}']