ssl/s3_srvr.c:1046: error: UNINITIALIZED_VALUE
  The value read from nr[_] was never initialized.
Showing all 1 steps of the trace


ssl/s3_srvr.c:1046:4: 
1044.   			s2n(nr[i],p);
1045.   			BN_bn2bin(r[i],p);
1046. > 			p+=nr[i];
1047.   			}
1048.   

static int ssl3_send_server_key_exchange(SSL *s)
	{
#ifndef NO_RSA
	unsigned char *q;
	int j,num;
	RSA *rsa;
	unsigned char md_buf[MD5_DIGEST_LENGTH+SHA_DIGEST_LENGTH];
#endif
#ifndef NO_DH
	DH *dh,*dhp;
#endif
	EVP_PKEY *pkey;
	unsigned char *p,*d;
	int al,i;
	unsigned long type;
	int n;
	CERT *cert;
	BIGNUM *r[4];
	int nr[4],kn;
	BUF_MEM *buf;
	EVP_MD_CTX md_ctx;
	if (s->state == SSL3_ST_SW_KEY_EXCH_A)
		{
		type=s->s3->tmp.new_cipher->algorithms & SSL_MKEY_MASK;
		cert=s->session->cert;
		buf=s->init_buf;
		r[0]=r[1]=r[2]=r[3]=NULL;
		n=0;
#ifndef NO_RSA
		if (type & SSL_kRSA)
			{
			rsa=cert->rsa_tmp;
			if ((rsa == NULL) && (s->ctx->default_cert->rsa_tmp_cb != NULL))
				{
				rsa=s->ctx->default_cert->rsa_tmp_cb(s,
				      SSL_C_IS_EXPORT(s->s3->tmp.new_cipher),
				      SSL_C_EXPORT_PKEYLENGTH(s->s3->tmp.new_cipher));
				CRYPTO_add(&rsa->references,1,CRYPTO_LOCK_RSA);
				cert->rsa_tmp=rsa;
				}
			if (rsa == NULL)
				{
				al=SSL_AD_HANDSHAKE_FAILURE;
				SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,SSL_R_MISSING_TMP_RSA_KEY);
				goto f_err;
				}
			r[0]=rsa->n;
			r[1]=rsa->e;
			s->s3->tmp.use_rsa_tmp=1;
			}
		else
#endif
#ifndef NO_DH
			if (type & SSL_kEDH)
			{
			dhp=cert->dh_tmp;
			if ((dhp == NULL) && (cert->dh_tmp_cb != NULL))
				dhp=cert->dh_tmp_cb(s,
				      !SSL_C_IS_EXPORT(s->s3->tmp.new_cipher),
				      SSL_C_EXPORT_PKEYLENGTH(s->s3->tmp.new_cipher));
			if (dhp == NULL)
				{
				al=SSL_AD_HANDSHAKE_FAILURE;
				SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,SSL_R_MISSING_TMP_DH_KEY);
				goto f_err;
				}
			if ((dh=DHparams_dup(dhp)) == NULL)
				{
				SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,ERR_R_DH_LIB);
				goto err;
				}
			s->s3->tmp.dh=dh;
			if ((dhp->pub_key == NULL ||
			     dhp->priv_key == NULL ||
			     (s->options & SSL_OP_SINGLE_DH_USE)))
				{
				if(!DH_generate_key(dh))
				    {
				    SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,
					   ERR_R_DH_LIB);
				    goto err;
				    }
				}
			else
				{
				dh->pub_key=BN_dup(dhp->pub_key);
				dh->priv_key=BN_dup(dhp->priv_key);
				if ((dh->pub_key == NULL) ||
					(dh->priv_key == NULL))
					{
					SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,ERR_R_DH_LIB);
					goto err;
					}
				}
			r[0]=dh->p;
			r[1]=dh->g;
			r[2]=dh->pub_key;
			}
		else
#endif
			{
			al=SSL_AD_HANDSHAKE_FAILURE;
			SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,SSL_R_UNKNOWN_KEY_EXCHANGE_TYPE);
			goto f_err;
			}
		for (i=0; r[i] != NULL; i++)
			{
			nr[i]=BN_num_bytes(r[i]);
			n+=2+nr[i];
			}
		if (!(s->s3->tmp.new_cipher->algorithms & SSL_aNULL))
			{
			if ((pkey=ssl_get_sign_pkey(s,s->s3->tmp.new_cipher))
				== NULL)
				{
				al=SSL_AD_DECODE_ERROR;
				goto f_err;
				}
			kn=EVP_PKEY_size(pkey);
			}
		else
			{
			pkey=NULL;
			kn=0;
			}
		if (!BUF_MEM_grow(buf,n+4+kn))
			{
			SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,ERR_LIB_BUF);
			goto err;
			}
		d=(unsigned char *)s->init_buf->data;
		p= &(d[4]);
		for (i=0; r[i] != NULL; i++)
			{
			s2n(nr[i],p);
			BN_bn2bin(r[i],p);
			p+=nr[i];
			}
		if (pkey != NULL)
			{
#ifndef NO_RSA
			if (pkey->type == EVP_PKEY_RSA)
				{
				q=md_buf;
				j=0;
				for (num=2; num > 0; num--)
					{
					EVP_DigestInit(&md_ctx,(num == 2)
						?s->ctx->md5:s->ctx->sha1);
					EVP_DigestUpdate(&md_ctx,&(s->s3->client_random[0]),SSL3_RANDOM_SIZE);
					EVP_DigestUpdate(&md_ctx,&(s->s3->server_random[0]),SSL3_RANDOM_SIZE);
					EVP_DigestUpdate(&md_ctx,&(d[4]),n);
					EVP_DigestFinal(&md_ctx,q,
						(unsigned int *)&i);
					q+=i;
					j+=i;
					}
				i=RSA_private_encrypt(j,md_buf,&(p[2]),
					pkey->pkey.rsa,RSA_PKCS1_PADDING);
				if (i <= 0)
					{
					SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,ERR_LIB_RSA);
					goto err;
					}
				s2n(i,p);
				n+=i+2;
				}
			else
#endif
#if !defined(NO_DSA)
				if (pkey->type == EVP_PKEY_DSA)
				{
				EVP_SignInit(&md_ctx,EVP_dss1());
				EVP_SignUpdate(&md_ctx,&(s->s3->client_random[0]),SSL3_RANDOM_SIZE);
				EVP_SignUpdate(&md_ctx,&(s->s3->server_random[0]),SSL3_RANDOM_SIZE);
				EVP_SignUpdate(&md_ctx,&(d[4]),n);
				if (!EVP_SignFinal(&md_ctx,&(p[2]),
					(unsigned int *)&i,pkey))
					{
					SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,ERR_LIB_DSA);
					goto err;
					}
				s2n(i,p);
				n+=i+2;
				}
			else
#endif
				{
				al=SSL_AD_HANDSHAKE_FAILURE;
				SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,SSL_R_UNKNOWN_PKEY_TYPE);
				goto f_err;
				}
			}
		*(d++)=SSL3_MT_SERVER_KEY_EXCHANGE;
		l2n3(n,d);
		s->init_num=n+4;
		s->init_off=0;
		}
	return(ssl3_do_write(s,SSL3_RT_HANDSHAKE));
f_err:
	ssl3_send_alert(s,SSL3_AL_FATAL,al);
err:
	return(-1);
	}
['static int ssl3_send_server_key_exchange(SSL *s)\n\t{\n#ifndef NO_RSA\n\tunsigned char *q;\n\tint j,num;\n\tRSA *rsa;\n\tunsigned char md_buf[MD5_DIGEST_LENGTH+SHA_DIGEST_LENGTH];\n#endif\n#ifndef NO_DH\n\tDH *dh,*dhp;\n#endif\n\tEVP_PKEY *pkey;\n\tunsigned char *p,*d;\n\tint al,i;\n\tunsigned long type;\n\tint n;\n\tCERT *cert;\n\tBIGNUM *r[4];\n\tint nr[4],kn;\n\tBUF_MEM *buf;\n\tEVP_MD_CTX md_ctx;\n\tif (s->state == SSL3_ST_SW_KEY_EXCH_A)\n\t\t{\n\t\ttype=s->s3->tmp.new_cipher->algorithms & SSL_MKEY_MASK;\n\t\tcert=s->session->cert;\n\t\tbuf=s->init_buf;\n\t\tr[0]=r[1]=r[2]=r[3]=NULL;\n\t\tn=0;\n#ifndef NO_RSA\n\t\tif (type & SSL_kRSA)\n\t\t\t{\n\t\t\trsa=cert->rsa_tmp;\n\t\t\tif ((rsa == NULL) && (s->ctx->default_cert->rsa_tmp_cb != NULL))\n\t\t\t\t{\n\t\t\t\trsa=s->ctx->default_cert->rsa_tmp_cb(s,\n\t\t\t\t      SSL_C_IS_EXPORT(s->s3->tmp.new_cipher),\n\t\t\t\t      SSL_C_EXPORT_PKEYLENGTH(s->s3->tmp.new_cipher));\n\t\t\t\tCRYPTO_add(&rsa->references,1,CRYPTO_LOCK_RSA);\n\t\t\t\tcert->rsa_tmp=rsa;\n\t\t\t\t}\n\t\t\tif (rsa == NULL)\n\t\t\t\t{\n\t\t\t\tal=SSL_AD_HANDSHAKE_FAILURE;\n\t\t\t\tSSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,SSL_R_MISSING_TMP_RSA_KEY);\n\t\t\t\tgoto f_err;\n\t\t\t\t}\n\t\t\tr[0]=rsa->n;\n\t\t\tr[1]=rsa->e;\n\t\t\ts->s3->tmp.use_rsa_tmp=1;\n\t\t\t}\n\t\telse\n#endif\n#ifndef NO_DH\n\t\t\tif (type & SSL_kEDH)\n\t\t\t{\n\t\t\tdhp=cert->dh_tmp;\n\t\t\tif ((dhp == NULL) && (cert->dh_tmp_cb != NULL))\n\t\t\t\tdhp=cert->dh_tmp_cb(s,\n\t\t\t\t      !SSL_C_IS_EXPORT(s->s3->tmp.new_cipher),\n\t\t\t\t      SSL_C_EXPORT_PKEYLENGTH(s->s3->tmp.new_cipher));\n\t\t\tif (dhp == NULL)\n\t\t\t\t{\n\t\t\t\tal=SSL_AD_HANDSHAKE_FAILURE;\n\t\t\t\tSSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,SSL_R_MISSING_TMP_DH_KEY);\n\t\t\t\tgoto f_err;\n\t\t\t\t}\n\t\t\tif ((dh=DHparams_dup(dhp)) == NULL)\n\t\t\t\t{\n\t\t\t\tSSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,ERR_R_DH_LIB);\n\t\t\t\tgoto err;\n\t\t\t\t}\n\t\t\ts->s3->tmp.dh=dh;\n\t\t\tif ((dhp->pub_key == NULL ||\n\t\t\t     dhp->priv_key == NULL ||\n\t\t\t     (s->options & SSL_OP_SINGLE_DH_USE)))\n\t\t\t\t{\n\t\t\t\tif(!DH_generate_key(dh))\n\t\t\t\t    {\n\t\t\t\t    SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,\n\t\t\t\t\t   ERR_R_DH_LIB);\n\t\t\t\t    goto err;\n\t\t\t\t    }\n\t\t\t\t}\n\t\t\telse\n\t\t\t\t{\n\t\t\t\tdh->pub_key=BN_dup(dhp->pub_key);\n\t\t\t\tdh->priv_key=BN_dup(dhp->priv_key);\n\t\t\t\tif ((dh->pub_key == NULL) ||\n\t\t\t\t\t(dh->priv_key == NULL))\n\t\t\t\t\t{\n\t\t\t\t\tSSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,ERR_R_DH_LIB);\n\t\t\t\t\tgoto err;\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\tr[0]=dh->p;\n\t\t\tr[1]=dh->g;\n\t\t\tr[2]=dh->pub_key;\n\t\t\t}\n\t\telse\n#endif\n\t\t\t{\n\t\t\tal=SSL_AD_HANDSHAKE_FAILURE;\n\t\t\tSSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,SSL_R_UNKNOWN_KEY_EXCHANGE_TYPE);\n\t\t\tgoto f_err;\n\t\t\t}\n\t\tfor (i=0; r[i] != NULL; i++)\n\t\t\t{\n\t\t\tnr[i]=BN_num_bytes(r[i]);\n\t\t\tn+=2+nr[i];\n\t\t\t}\n\t\tif (!(s->s3->tmp.new_cipher->algorithms & SSL_aNULL))\n\t\t\t{\n\t\t\tif ((pkey=ssl_get_sign_pkey(s,s->s3->tmp.new_cipher))\n\t\t\t\t== NULL)\n\t\t\t\t{\n\t\t\t\tal=SSL_AD_DECODE_ERROR;\n\t\t\t\tgoto f_err;\n\t\t\t\t}\n\t\t\tkn=EVP_PKEY_size(pkey);\n\t\t\t}\n\t\telse\n\t\t\t{\n\t\t\tpkey=NULL;\n\t\t\tkn=0;\n\t\t\t}\n\t\tif (!BUF_MEM_grow(buf,n+4+kn))\n\t\t\t{\n\t\t\tSSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,ERR_LIB_BUF);\n\t\t\tgoto err;\n\t\t\t}\n\t\td=(unsigned char *)s->init_buf->data;\n\t\tp= &(d[4]);\n\t\tfor (i=0; r[i] != NULL; i++)\n\t\t\t{\n\t\t\ts2n(nr[i],p);\n\t\t\tBN_bn2bin(r[i],p);\n\t\t\tp+=nr[i];\n\t\t\t}\n\t\tif (pkey != NULL)\n\t\t\t{\n#ifndef NO_RSA\n\t\t\tif (pkey->type == EVP_PKEY_RSA)\n\t\t\t\t{\n\t\t\t\tq=md_buf;\n\t\t\t\tj=0;\n\t\t\t\tfor (num=2; num > 0; num--)\n\t\t\t\t\t{\n\t\t\t\t\tEVP_DigestInit(&md_ctx,(num == 2)\n\t\t\t\t\t\t?s->ctx->md5:s->ctx->sha1);\n\t\t\t\t\tEVP_DigestUpdate(&md_ctx,&(s->s3->client_random[0]),SSL3_RANDOM_SIZE);\n\t\t\t\t\tEVP_DigestUpdate(&md_ctx,&(s->s3->server_random[0]),SSL3_RANDOM_SIZE);\n\t\t\t\t\tEVP_DigestUpdate(&md_ctx,&(d[4]),n);\n\t\t\t\t\tEVP_DigestFinal(&md_ctx,q,\n\t\t\t\t\t\t(unsigned int *)&i);\n\t\t\t\t\tq+=i;\n\t\t\t\t\tj+=i;\n\t\t\t\t\t}\n\t\t\t\ti=RSA_private_encrypt(j,md_buf,&(p[2]),\n\t\t\t\t\tpkey->pkey.rsa,RSA_PKCS1_PADDING);\n\t\t\t\tif (i <= 0)\n\t\t\t\t\t{\n\t\t\t\t\tSSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,ERR_LIB_RSA);\n\t\t\t\t\tgoto err;\n\t\t\t\t\t}\n\t\t\t\ts2n(i,p);\n\t\t\t\tn+=i+2;\n\t\t\t\t}\n\t\t\telse\n#endif\n#if !defined(NO_DSA)\n\t\t\t\tif (pkey->type == EVP_PKEY_DSA)\n\t\t\t\t{\n\t\t\t\tEVP_SignInit(&md_ctx,EVP_dss1());\n\t\t\t\tEVP_SignUpdate(&md_ctx,&(s->s3->client_random[0]),SSL3_RANDOM_SIZE);\n\t\t\t\tEVP_SignUpdate(&md_ctx,&(s->s3->server_random[0]),SSL3_RANDOM_SIZE);\n\t\t\t\tEVP_SignUpdate(&md_ctx,&(d[4]),n);\n\t\t\t\tif (!EVP_SignFinal(&md_ctx,&(p[2]),\n\t\t\t\t\t(unsigned int *)&i,pkey))\n\t\t\t\t\t{\n\t\t\t\t\tSSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,ERR_LIB_DSA);\n\t\t\t\t\tgoto err;\n\t\t\t\t\t}\n\t\t\t\ts2n(i,p);\n\t\t\t\tn+=i+2;\n\t\t\t\t}\n\t\t\telse\n#endif\n\t\t\t\t{\n\t\t\t\tal=SSL_AD_HANDSHAKE_FAILURE;\n\t\t\t\tSSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,SSL_R_UNKNOWN_PKEY_TYPE);\n\t\t\t\tgoto f_err;\n\t\t\t\t}\n\t\t\t}\n\t\t*(d++)=SSL3_MT_SERVER_KEY_EXCHANGE;\n\t\tl2n3(n,d);\n\t\ts->init_num=n+4;\n\t\ts->init_off=0;\n\t\t}\n\treturn(ssl3_do_write(s,SSL3_RT_HANDSHAKE));\nf_err:\n\tssl3_send_alert(s,SSL3_AL_FATAL,al);\nerr:\n\treturn(-1);\n\t}']