ssl/statem/statem_clnt.c:2158: error: NULL_DEREFERENCE
  pointer `pkey` last assigned on line 2157 could be null and is dereferenced by call to `EVP_PKEY_get0_RSA()` at line 2158, column 9.
Showing all 23 steps of the trace


ssl/statem/statem_clnt.c:2139:1: start of procedure tls_construct_cke_rsa()
2137.   }
2138.   
2139. > static int tls_construct_cke_rsa(SSL *s, unsigned char **p, int *len, int *al)
2140.   {
2141.   #ifndef OPENSSL_NO_RSA

ssl/statem/statem_clnt.c:2143:5: 
2141.   #ifndef OPENSSL_NO_RSA
2142.       unsigned char *q;
2143. >     EVP_PKEY *pkey = NULL;
2144.       EVP_PKEY_CTX *pctx = NULL;
2145.       size_t enclen;

ssl/statem/statem_clnt.c:2144:5: 
2142.       unsigned char *q;
2143.       EVP_PKEY *pkey = NULL;
2144. >     EVP_PKEY_CTX *pctx = NULL;
2145.       size_t enclen;
2146.       unsigned char *pms = NULL;

ssl/statem/statem_clnt.c:2146:5: 
2144.       EVP_PKEY_CTX *pctx = NULL;
2145.       size_t enclen;
2146. >     unsigned char *pms = NULL;
2147.       size_t pmslen = 0;
2148.   

ssl/statem/statem_clnt.c:2147:5: 
2145.       size_t enclen;
2146.       unsigned char *pms = NULL;
2147. >     size_t pmslen = 0;
2148.   
2149.       if (s->session->peer == NULL) {

ssl/statem/statem_clnt.c:2149:9: Taking false branch
2147.       size_t pmslen = 0;
2148.   
2149.       if (s->session->peer == NULL) {
                ^
2150.           /*
2151.            * We should always have a server certificate with SSL_kRSA.

ssl/statem/statem_clnt.c:2157:5: 
2155.       }
2156.   
2157. >     pkey = X509_get0_pubkey(s->session->peer);
2158.       if (EVP_PKEY_get0_RSA(pkey) == NULL) {
2159.           SSLerr(SSL_F_TLS_CONSTRUCT_CKE_RSA, ERR_R_INTERNAL_ERROR);

crypto/x509/x509_cmp.c:260:1: start of procedure X509_get0_pubkey()
  258.   }
  259.   
  260. > EVP_PKEY *X509_get0_pubkey(X509 *x)
  261.   {
  262.       if (x == NULL)

crypto/x509/x509_cmp.c:262:9: Taking false branch
  260.   EVP_PKEY *X509_get0_pubkey(X509 *x)
  261.   {
  262.       if (x == NULL)
                 ^
  263.           return NULL;
  264.       return X509_PUBKEY_get0(x->cert_info.key);

crypto/x509/x509_cmp.c:264:5: 
  262.       if (x == NULL)
  263.           return NULL;
  264. >     return X509_PUBKEY_get0(x->cert_info.key);
  265.   }
  266.   

crypto/x509/x_pubkey.c:140:1: start of procedure X509_PUBKEY_get0()
    138.   }
    139.   
    140. > EVP_PKEY *X509_PUBKEY_get0(X509_PUBKEY *key)
    141.   {
    142.       EVP_PKEY *ret = NULL;

crypto/x509/x_pubkey.c:142:5: 
    140.   EVP_PKEY *X509_PUBKEY_get0(X509_PUBKEY *key)
    141.   {
    142. >     EVP_PKEY *ret = NULL;
    143.   
    144.       if (key == NULL || key->public_key == NULL)

crypto/x509/x_pubkey.c:144:9: Taking false branch
    142.       EVP_PKEY *ret = NULL;
    143.   
    144.       if (key == NULL || key->public_key == NULL)
                   ^
    145.           return NULL;
    146.   

crypto/x509/x_pubkey.c:144:24: Taking false branch
    142.       EVP_PKEY *ret = NULL;
    143.   
    144.       if (key == NULL || key->public_key == NULL)
                                  ^
    145.           return NULL;
    146.   

crypto/x509/x_pubkey.c:147:9: Taking false branch
    145.           return NULL;
    146.   
    147.       if (key->pkey != NULL)
                   ^
    148.           return key->pkey;
    149.   

crypto/x509/x_pubkey.c:158:5: Skipping x509_pubkey_decode(): empty list of specs
    156.        * in the queue.
    157.        */
    158.       x509_pubkey_decode(&ret, key);
               ^
    159.       /* If decode doesn't fail something bad happened */
    160.       if (ret != NULL) {

crypto/x509/x_pubkey.c:160:9: Taking false branch
    158.       x509_pubkey_decode(&ret, key);
    159.       /* If decode doesn't fail something bad happened */
    160.       if (ret != NULL) {
                   ^
    161.           X509err(X509_F_X509_PUBKEY_GET0, ERR_R_INTERNAL_ERROR);
    162.           EVP_PKEY_free(ret);

crypto/x509/x_pubkey.c:165:5: 
    163.       }
    164.   
    165. >     return NULL;
    166.   }
    167.   

crypto/x509/x_pubkey.c:166:1: return from a call to X509_PUBKEY_get0
    164.   
    165.       return NULL;
    166. > }
    167.   
    168.   EVP_PKEY *X509_PUBKEY_get(X509_PUBKEY *key)

crypto/x509/x509_cmp.c:265:1: return from a call to X509_get0_pubkey
  263.           return NULL;
  264.       return X509_PUBKEY_get0(x->cert_info.key);
  265. > }
  266.   
  267.   EVP_PKEY *X509_get_pubkey(X509 *x)

ssl/statem/statem_clnt.c:2158:9: 
2156.   
2157.       pkey = X509_get0_pubkey(s->session->peer);
2158. >     if (EVP_PKEY_get0_RSA(pkey) == NULL) {
2159.           SSLerr(SSL_F_TLS_CONSTRUCT_CKE_RSA, ERR_R_INTERNAL_ERROR);
2160.           return 0;

crypto/evp/p_lib.c:261:1: start of procedure EVP_PKEY_get0_RSA()
  259.   }
  260.   
  261. > RSA *EVP_PKEY_get0_RSA(EVP_PKEY *pkey)
  262.   {
  263.       if (pkey->type != EVP_PKEY_RSA) {

crypto/evp/p_lib.c:263:9: 
  261.   RSA *EVP_PKEY_get0_RSA(EVP_PKEY *pkey)
  262.   {
  263. >     if (pkey->type != EVP_PKEY_RSA) {
  264.           EVPerr(EVP_F_EVP_PKEY_GET0_RSA, EVP_R_EXPECTING_AN_RSA_KEY);
  265.           return NULL;

static int tls_construct_cke_rsa(SSL *s, unsigned char **p, int *len, int *al)
{
#ifndef OPENSSL_NO_RSA
    unsigned char *q;
    EVP_PKEY *pkey = NULL;
    EVP_PKEY_CTX *pctx = NULL;
    size_t enclen;
    unsigned char *pms = NULL;
    size_t pmslen = 0;
    if (s->session->peer == NULL) {
        SSLerr(SSL_F_TLS_CONSTRUCT_CKE_RSA, ERR_R_INTERNAL_ERROR);
        return 0;
    }
    pkey = X509_get0_pubkey(s->session->peer);
    if (EVP_PKEY_get0_RSA(pkey) == NULL) {
        SSLerr(SSL_F_TLS_CONSTRUCT_CKE_RSA, ERR_R_INTERNAL_ERROR);
        return 0;
    }
    pmslen = SSL_MAX_MASTER_KEY_LENGTH;
    pms = OPENSSL_malloc(pmslen);
    if (pms == NULL) {
        SSLerr(SSL_F_TLS_CONSTRUCT_CKE_RSA, ERR_R_MALLOC_FAILURE);
        *al = SSL_AD_INTERNAL_ERROR;
        return 0;
    }
    pms[0] = s->client_version >> 8;
    pms[1] = s->client_version & 0xff;
    if (RAND_bytes(pms + 2, pmslen - 2) <= 0) {
        goto err;
    }
    q = *p;
    if (s->version > SSL3_VERSION)
        *p += 2;
    pctx = EVP_PKEY_CTX_new(pkey, NULL);
    if (pctx == NULL || EVP_PKEY_encrypt_init(pctx) <= 0
        || EVP_PKEY_encrypt(pctx, NULL, &enclen, pms, pmslen) <= 0) {
        SSLerr(SSL_F_TLS_CONSTRUCT_CKE_RSA, ERR_R_EVP_LIB);
        goto err;
    }
    if (EVP_PKEY_encrypt(pctx, *p, &enclen, pms, pmslen) <= 0) {
        SSLerr(SSL_F_TLS_CONSTRUCT_CKE_RSA, SSL_R_BAD_RSA_ENCRYPT);
        goto err;
    }
    *len = enclen;
    EVP_PKEY_CTX_free(pctx);
    pctx = NULL;
# ifdef PKCS1_CHECK
    if (s->options & SSL_OP_PKCS1_CHECK_1)
        (*p)[1]++;
    if (s->options & SSL_OP_PKCS1_CHECK_2)
        tmp_buf[0] = 0x70;
# endif
    if (s->version > SSL3_VERSION) {
        s2n(*len, q);
        *len += 2;
    }
    s->s3->tmp.pms = pms;
    s->s3->tmp.pmslen = pmslen;
    return 1;
 err:
    OPENSSL_clear_free(pms, pmslen);
    EVP_PKEY_CTX_free(pctx);
    return 0;
#else
    SSLerr(SSL_F_TLS_CONSTRUCT_CKE_RSA, ERR_R_INTERNAL_ERROR);
    *al = SSL_AD_INTERNAL_ERROR;
    return 0;
#endif
}
['static int tls_construct_cke_rsa(SSL *s, unsigned char **p, int *len, int *al)\n{\n#ifndef OPENSSL_NO_RSA\n    unsigned char *q;\n    EVP_PKEY *pkey = NULL;\n    EVP_PKEY_CTX *pctx = NULL;\n    size_t enclen;\n    unsigned char *pms = NULL;\n    size_t pmslen = 0;\n    if (s->session->peer == NULL) {\n        SSLerr(SSL_F_TLS_CONSTRUCT_CKE_RSA, ERR_R_INTERNAL_ERROR);\n        return 0;\n    }\n    pkey = X509_get0_pubkey(s->session->peer);\n    if (EVP_PKEY_get0_RSA(pkey) == NULL) {\n        SSLerr(SSL_F_TLS_CONSTRUCT_CKE_RSA, ERR_R_INTERNAL_ERROR);\n        return 0;\n    }\n    pmslen = SSL_MAX_MASTER_KEY_LENGTH;\n    pms = OPENSSL_malloc(pmslen);\n    if (pms == NULL) {\n        SSLerr(SSL_F_TLS_CONSTRUCT_CKE_RSA, ERR_R_MALLOC_FAILURE);\n        *al = SSL_AD_INTERNAL_ERROR;\n        return 0;\n    }\n    pms[0] = s->client_version >> 8;\n    pms[1] = s->client_version & 0xff;\n    if (RAND_bytes(pms + 2, pmslen - 2) <= 0) {\n        goto err;\n    }\n    q = *p;\n    if (s->version > SSL3_VERSION)\n        *p += 2;\n    pctx = EVP_PKEY_CTX_new(pkey, NULL);\n    if (pctx == NULL || EVP_PKEY_encrypt_init(pctx) <= 0\n        || EVP_PKEY_encrypt(pctx, NULL, &enclen, pms, pmslen) <= 0) {\n        SSLerr(SSL_F_TLS_CONSTRUCT_CKE_RSA, ERR_R_EVP_LIB);\n        goto err;\n    }\n    if (EVP_PKEY_encrypt(pctx, *p, &enclen, pms, pmslen) <= 0) {\n        SSLerr(SSL_F_TLS_CONSTRUCT_CKE_RSA, SSL_R_BAD_RSA_ENCRYPT);\n        goto err;\n    }\n    *len = enclen;\n    EVP_PKEY_CTX_free(pctx);\n    pctx = NULL;\n# ifdef PKCS1_CHECK\n    if (s->options & SSL_OP_PKCS1_CHECK_1)\n        (*p)[1]++;\n    if (s->options & SSL_OP_PKCS1_CHECK_2)\n        tmp_buf[0] = 0x70;\n# endif\n    if (s->version > SSL3_VERSION) {\n        s2n(*len, q);\n        *len += 2;\n    }\n    s->s3->tmp.pms = pms;\n    s->s3->tmp.pmslen = pmslen;\n    return 1;\n err:\n    OPENSSL_clear_free(pms, pmslen);\n    EVP_PKEY_CTX_free(pctx);\n    return 0;\n#else\n    SSLerr(SSL_F_TLS_CONSTRUCT_CKE_RSA, ERR_R_INTERNAL_ERROR);\n    *al = SSL_AD_INTERNAL_ERROR;\n    return 0;\n#endif\n}', 'EVP_PKEY *X509_get0_pubkey(X509 *x)\n{\n    if (x == NULL)\n        return NULL;\n    return X509_PUBKEY_get0(x->cert_info.key);\n}', 'EVP_PKEY *X509_PUBKEY_get0(X509_PUBKEY *key)\n{\n    EVP_PKEY *ret = NULL;\n    if (key == NULL || key->public_key == NULL)\n        return NULL;\n    if (key->pkey != NULL)\n        return key->pkey;\n    x509_pubkey_decode(&ret, key);\n    if (ret != NULL) {\n        X509err(X509_F_X509_PUBKEY_GET0, ERR_R_INTERNAL_ERROR);\n        EVP_PKEY_free(ret);\n    }\n    return NULL;\n}', 'RSA *EVP_PKEY_get0_RSA(EVP_PKEY *pkey)\n{\n    if (pkey->type != EVP_PKEY_RSA) {\n        EVPerr(EVP_F_EVP_PKEY_GET0_RSA, EVP_R_EXPECTING_AN_RSA_KEY);\n        return NULL;\n    }\n    return pkey->pkey.rsa;\n}']