ssl/s3_srvr.c:1566: error: NULL_DEREFERENCE
  pointer `pkey` last assigned on line 1453 could be null and is dereferenced by call to `EVP_PKEY_free()` at line 1566, column 2.
Showing all 22 steps of the trace


ssl/s3_srvr.c:1432:1: start of procedure ssl3_get_cert_verify()
1430.   	}
1431.   
1432. > static int ssl3_get_cert_verify(SSL *s)
1433.   	{
1434.   	EVP_PKEY *pkey=NULL;

ssl/s3_srvr.c:1434:2: 
1432.   static int ssl3_get_cert_verify(SSL *s)
1433.   	{
1434. > 	EVP_PKEY *pkey=NULL;
1435.   	unsigned char *p;
1436.   	int al,ok,ret=0;

ssl/s3_srvr.c:1436:2: 
1434.   	EVP_PKEY *pkey=NULL;
1435.   	unsigned char *p;
1436. > 	int al,ok,ret=0;
1437.   	long n;
1438.   	int type=0,i,j;

ssl/s3_srvr.c:1438:2: 
1436.   	int al,ok,ret=0;
1437.   	long n;
1438. > 	int type=0,i,j;
1439.   	X509 *peer;
1440.   

ssl/s3_srvr.c:1441:2: Skipping ssl3_get_message(): empty list of specs
1439.   	X509 *peer;
1440.   
1441.   	n=ssl3_get_message(s,
         ^
1442.   		SSL3_ST_SR_CERT_VRFY_A,
1443.   		SSL3_ST_SR_CERT_VRFY_B,

ssl/s3_srvr.c:1448:7: Taking false branch
1446.   		&ok);
1447.   
1448.   	if (!ok) return((int)n);
              ^
1449.   
1450.   	if (s->session->peer != NULL)

ssl/s3_srvr.c:1450:6: Taking true branch
1448.   	if (!ok) return((int)n);
1449.   
1450.   	if (s->session->peer != NULL)
             ^
1451.   		{
1452.   		peer=s->session->peer;

ssl/s3_srvr.c:1452:3: 
1450.   	if (s->session->peer != NULL)
1451.   		{
1452. > 		peer=s->session->peer;
1453.   		pkey=X509_get_pubkey(peer);
1454.   		type=X509_certificate_type(peer,pkey);

ssl/s3_srvr.c:1453:3: 
1451.   		{
1452.   		peer=s->session->peer;
1453. > 		pkey=X509_get_pubkey(peer);
1454.   		type=X509_certificate_type(peer,pkey);
1455.   		}

crypto/x509/x509_cmp.c:254:1: start of procedure X509_get_pubkey()
  252.   	}
  253.   
  254. > EVP_PKEY *X509_get_pubkey(X509 *x)
  255.   	{
  256.   	if ((x == NULL) || (x->cert_info == NULL))

crypto/x509/x509_cmp.c:256:7: Taking false branch
  254.   EVP_PKEY *X509_get_pubkey(X509 *x)
  255.   	{
  256.   	if ((x == NULL) || (x->cert_info == NULL))
               ^
  257.   		return(NULL);
  258.   	return(X509_PUBKEY_get(x->cert_info->key));

crypto/x509/x509_cmp.c:256:22: Taking true branch
  254.   EVP_PKEY *X509_get_pubkey(X509 *x)
  255.   	{
  256.   	if ((x == NULL) || (x->cert_info == NULL))
                              ^
  257.   		return(NULL);
  258.   	return(X509_PUBKEY_get(x->cert_info->key));

crypto/x509/x509_cmp.c:257:3: 
  255.   	{
  256.   	if ((x == NULL) || (x->cert_info == NULL))
  257. > 		return(NULL);
  258.   	return(X509_PUBKEY_get(x->cert_info->key));
  259.   	}

crypto/x509/x509_cmp.c:259:2: return from a call to X509_get_pubkey
  257.   		return(NULL);
  258.   	return(X509_PUBKEY_get(x->cert_info->key));
  259.   	}
          ^
  260.   
  261.   int X509_check_private_key(X509 *x, EVP_PKEY *k)

ssl/s3_srvr.c:1454:3: Skipping X509_certificate_type(): empty list of specs
1452.   		peer=s->session->peer;
1453.   		pkey=X509_get_pubkey(peer);
1454.   		type=X509_certificate_type(peer,pkey);
          ^
1455.   		}
1456.   	else

ssl/s3_srvr.c:1462:6: Taking true branch
1460.   		}
1461.   
1462.   	if (s->s3->tmp.message_type != SSL3_MT_CERTIFICATE_VERIFY)
             ^
1463.   		{
1464.   		s->s3->tmp.reuse_message=1;

ssl/s3_srvr.c:1464:3: 
1462.   	if (s->s3->tmp.message_type != SSL3_MT_CERTIFICATE_VERIFY)
1463.   		{
1464. > 		s->s3->tmp.reuse_message=1;
1465.   		if ((peer != NULL) && (type | EVP_PKT_SIGN))
1466.   			{

ssl/s3_srvr.c:1465:8: Taking true branch
1463.   		{
1464.   		s->s3->tmp.reuse_message=1;
1465.   		if ((peer != NULL) && (type | EVP_PKT_SIGN))
               ^
1466.   			{
1467.   			al=SSL_AD_UNEXPECTED_MESSAGE;

ssl/s3_srvr.c:1465:26: Taking false branch
1463.   		{
1464.   		s->s3->tmp.reuse_message=1;
1465.   		if ((peer != NULL) && (type | EVP_PKT_SIGN))
                                 ^
1466.   			{
1467.   			al=SSL_AD_UNEXPECTED_MESSAGE;

ssl/s3_srvr.c:1471:3: 
1469.   			goto f_err;
1470.   			}
1471. > 		ret=1;
1472.   		goto end;
1473.   		}

ssl/s3_srvr.c:1565:1: 
1563.   		ssl3_send_alert(s,SSL3_AL_FATAL,al);
1564.   		}
1565. > end:
1566.   	EVP_PKEY_free(pkey);
1567.   	return(ret);

ssl/s3_srvr.c:1566:2: 
1564.   		}
1565.   end:
1566. > 	EVP_PKEY_free(pkey);
1567.   	return(ret);
1568.   	}

static int ssl3_get_cert_verify(SSL *s)
	{
	EVP_PKEY *pkey=NULL;
	unsigned char *p;
	int al,ok,ret=0;
	long n;
	int type=0,i,j;
	X509 *peer;
	n=ssl3_get_message(s,
		SSL3_ST_SR_CERT_VRFY_A,
		SSL3_ST_SR_CERT_VRFY_B,
		-1,
		512,
		&ok);
	if (!ok) return((int)n);
	if (s->session->peer != NULL)
		{
		peer=s->session->peer;
		pkey=X509_get_pubkey(peer);
		type=X509_certificate_type(peer,pkey);
		}
	else
		{
		peer=NULL;
		pkey=NULL;
		}
	if (s->s3->tmp.message_type != SSL3_MT_CERTIFICATE_VERIFY)
		{
		s->s3->tmp.reuse_message=1;
		if ((peer != NULL) && (type | EVP_PKT_SIGN))
			{
			al=SSL_AD_UNEXPECTED_MESSAGE;
			SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_MISSING_VERIFY_MESSAGE);
			goto f_err;
			}
		ret=1;
		goto end;
		}
	if (peer == NULL)
		{
		SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_NO_CLIENT_CERT_RECEIVED);
		al=SSL_AD_UNEXPECTED_MESSAGE;
		goto f_err;
		}
	if (!(type & EVP_PKT_SIGN))
		{
		SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_SIGNATURE_FOR_NON_SIGNING_CERTIFICATE);
		al=SSL_AD_ILLEGAL_PARAMETER;
		goto f_err;
		}
	if (s->s3->change_cipher_spec)
		{
		SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_CCS_RECEIVED_EARLY);
		al=SSL_AD_UNEXPECTED_MESSAGE;
		goto f_err;
		}
	p=(unsigned char *)s->init_buf->data;
	n2s(p,i);
	n-=2;
	if (i > n)
		{
		SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_LENGTH_MISMATCH);
		al=SSL_AD_DECODE_ERROR;
		goto f_err;
		}
	j=EVP_PKEY_size(pkey);
	if ((i > j) || (n > j) || (n <= 0))
		{
		SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_WRONG_SIGNATURE_SIZE);
		al=SSL_AD_DECODE_ERROR;
		goto f_err;
		}
#ifndef NO_RSA
	if (pkey->type == EVP_PKEY_RSA)
		{
		i=RSA_verify(NID_md5_sha1, s->s3->tmp.cert_verify_md,
			MD5_DIGEST_LENGTH+SHA_DIGEST_LENGTH, p, i,
							pkey->pkey.rsa);
		if (i < 0)
			{
			al=SSL_AD_DECRYPT_ERROR;
			SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_BAD_RSA_DECRYPT);
			goto f_err;
			}
		if (i == 0)
			{
			al=SSL_AD_DECRYPT_ERROR;
			SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_BAD_RSA_SIGNATURE);
			goto f_err;
			}
		}
	else
#endif
#ifndef NO_DSA
		if (pkey->type == EVP_PKEY_DSA)
		{
		j=DSA_verify(pkey->save_type,
			&(s->s3->tmp.cert_verify_md[MD5_DIGEST_LENGTH]),
			SHA_DIGEST_LENGTH,p,i,pkey->pkey.dsa);
		if (j <= 0)
			{
			al=SSL_AD_DECRYPT_ERROR;
			SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_BAD_DSA_SIGNATURE);
			goto f_err;
			}
		}
	else
#endif
		{
		SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_INTERNAL_ERROR);
		al=SSL_AD_UNSUPPORTED_CERTIFICATE;
		goto f_err;
		}
	ret=1;
	if (0)
		{
f_err:
		ssl3_send_alert(s,SSL3_AL_FATAL,al);
		}
end:
	EVP_PKEY_free(pkey);
	return(ret);
	}
['static int ssl3_get_cert_verify(SSL *s)\n\t{\n\tEVP_PKEY *pkey=NULL;\n\tunsigned char *p;\n\tint al,ok,ret=0;\n\tlong n;\n\tint type=0,i,j;\n\tX509 *peer;\n\tn=ssl3_get_message(s,\n\t\tSSL3_ST_SR_CERT_VRFY_A,\n\t\tSSL3_ST_SR_CERT_VRFY_B,\n\t\t-1,\n\t\t512,\n\t\t&ok);\n\tif (!ok) return((int)n);\n\tif (s->session->peer != NULL)\n\t\t{\n\t\tpeer=s->session->peer;\n\t\tpkey=X509_get_pubkey(peer);\n\t\ttype=X509_certificate_type(peer,pkey);\n\t\t}\n\telse\n\t\t{\n\t\tpeer=NULL;\n\t\tpkey=NULL;\n\t\t}\n\tif (s->s3->tmp.message_type != SSL3_MT_CERTIFICATE_VERIFY)\n\t\t{\n\t\ts->s3->tmp.reuse_message=1;\n\t\tif ((peer != NULL) && (type | EVP_PKT_SIGN))\n\t\t\t{\n\t\t\tal=SSL_AD_UNEXPECTED_MESSAGE;\n\t\t\tSSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_MISSING_VERIFY_MESSAGE);\n\t\t\tgoto f_err;\n\t\t\t}\n\t\tret=1;\n\t\tgoto end;\n\t\t}\n\tif (peer == NULL)\n\t\t{\n\t\tSSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_NO_CLIENT_CERT_RECEIVED);\n\t\tal=SSL_AD_UNEXPECTED_MESSAGE;\n\t\tgoto f_err;\n\t\t}\n\tif (!(type & EVP_PKT_SIGN))\n\t\t{\n\t\tSSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_SIGNATURE_FOR_NON_SIGNING_CERTIFICATE);\n\t\tal=SSL_AD_ILLEGAL_PARAMETER;\n\t\tgoto f_err;\n\t\t}\n\tif (s->s3->change_cipher_spec)\n\t\t{\n\t\tSSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_CCS_RECEIVED_EARLY);\n\t\tal=SSL_AD_UNEXPECTED_MESSAGE;\n\t\tgoto f_err;\n\t\t}\n\tp=(unsigned char *)s->init_buf->data;\n\tn2s(p,i);\n\tn-=2;\n\tif (i > n)\n\t\t{\n\t\tSSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_LENGTH_MISMATCH);\n\t\tal=SSL_AD_DECODE_ERROR;\n\t\tgoto f_err;\n\t\t}\n\tj=EVP_PKEY_size(pkey);\n\tif ((i > j) || (n > j) || (n <= 0))\n\t\t{\n\t\tSSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_WRONG_SIGNATURE_SIZE);\n\t\tal=SSL_AD_DECODE_ERROR;\n\t\tgoto f_err;\n\t\t}\n#ifndef NO_RSA\n\tif (pkey->type == EVP_PKEY_RSA)\n\t\t{\n\t\ti=RSA_verify(NID_md5_sha1, s->s3->tmp.cert_verify_md,\n\t\t\tMD5_DIGEST_LENGTH+SHA_DIGEST_LENGTH, p, i,\n\t\t\t\t\t\t\tpkey->pkey.rsa);\n\t\tif (i < 0)\n\t\t\t{\n\t\t\tal=SSL_AD_DECRYPT_ERROR;\n\t\t\tSSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_BAD_RSA_DECRYPT);\n\t\t\tgoto f_err;\n\t\t\t}\n\t\tif (i == 0)\n\t\t\t{\n\t\t\tal=SSL_AD_DECRYPT_ERROR;\n\t\t\tSSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_BAD_RSA_SIGNATURE);\n\t\t\tgoto f_err;\n\t\t\t}\n\t\t}\n\telse\n#endif\n#ifndef NO_DSA\n\t\tif (pkey->type == EVP_PKEY_DSA)\n\t\t{\n\t\tj=DSA_verify(pkey->save_type,\n\t\t\t&(s->s3->tmp.cert_verify_md[MD5_DIGEST_LENGTH]),\n\t\t\tSHA_DIGEST_LENGTH,p,i,pkey->pkey.dsa);\n\t\tif (j <= 0)\n\t\t\t{\n\t\t\tal=SSL_AD_DECRYPT_ERROR;\n\t\t\tSSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_BAD_DSA_SIGNATURE);\n\t\t\tgoto f_err;\n\t\t\t}\n\t\t}\n\telse\n#endif\n\t\t{\n\t\tSSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_INTERNAL_ERROR);\n\t\tal=SSL_AD_UNSUPPORTED_CERTIFICATE;\n\t\tgoto f_err;\n\t\t}\n\tret=1;\n\tif (0)\n\t\t{\nf_err:\n\t\tssl3_send_alert(s,SSL3_AL_FATAL,al);\n\t\t}\nend:\n\tEVP_PKEY_free(pkey);\n\treturn(ret);\n\t}', 'EVP_PKEY *X509_get_pubkey(X509 *x)\n\t{\n\tif ((x == NULL) || (x->cert_info == NULL))\n\t\treturn(NULL);\n\treturn(X509_PUBKEY_get(x->cert_info->key));\n\t}']