ssl/s2_srvr.c:941: error: NULL_DEREFERENCE
  pointer `x509` last assigned on line 792 could be null and is dereferenced by call to `X509_free()` at line 941, column 2.
Showing all 45 steps of the trace


ssl/s2_srvr.c:787:1: start of procedure request_certificate()
785.   
786.   /* send the request and check the response */
787. > static int request_certificate(SSL *s)
788.   	{
789.   	unsigned char *p,*p2,*buf2;

ssl/s2_srvr.c:791:2: 
789.   	unsigned char *p,*p2,*buf2;
790.   	unsigned char *ccd;
791. > 	int i,j,ctype,ret= -1;
792.   	X509 *x509=NULL;
793.   	STACK_OF(X509) *sk=NULL;

ssl/s2_srvr.c:792:2: 
790.   	unsigned char *ccd;
791.   	int i,j,ctype,ret= -1;
792. > 	X509 *x509=NULL;
793.   	STACK_OF(X509) *sk=NULL;
794.   

ssl/s2_srvr.c:793:2: 
791.   	int i,j,ctype,ret= -1;
792.   	X509 *x509=NULL;
793. > 	STACK_OF(X509) *sk=NULL;
794.   
795.   	ccd=s->s2->tmp.ccl;

ssl/s2_srvr.c:795:2: 
793.   	STACK_OF(X509) *sk=NULL;
794.   
795. > 	ccd=s->s2->tmp.ccl;
796.   	if (s->state == SSL2_ST_SEND_REQUEST_CERTIFICATE_A)
797.   		{

ssl/s2_srvr.c:796:6: Taking false branch
794.   
795.   	ccd=s->s2->tmp.ccl;
796.   	if (s->state == SSL2_ST_SEND_REQUEST_CERTIFICATE_A)
            ^
797.   		{
798.   		p=(unsigned char *)s->init_buf->data;

ssl/s2_srvr.c:809:6: Taking false branch
807.   		}
808.   
809.   	if (s->state == SSL2_ST_SEND_REQUEST_CERTIFICATE_B)
            ^
810.   		{
811.   		i=ssl2_do_write(s);

ssl/s2_srvr.c:822:6: Taking true branch
820.   		}
821.   
822.   	if (s->state == SSL2_ST_SEND_REQUEST_CERTIFICATE_C)
            ^
823.   		{
824.   		p=(unsigned char *)s->init_buf->data;

ssl/s2_srvr.c:824:3: 
822.   	if (s->state == SSL2_ST_SEND_REQUEST_CERTIFICATE_C)
823.   		{
824. > 		p=(unsigned char *)s->init_buf->data;
825.   		i=ssl2_read(s,(char *)&(p[s->init_num]),6-s->init_num);
826.   		if (i < 3)

ssl/s2_srvr.c:825:3: Skipping ssl2_read(): empty list of specs
823.   		{
824.   		p=(unsigned char *)s->init_buf->data;
825.   		i=ssl2_read(s,(char *)&(p[s->init_num]),6-s->init_num);
         ^
826.   		if (i < 3)
827.   			{

ssl/s2_srvr.c:826:7: Taking false branch
824.   		p=(unsigned char *)s->init_buf->data;
825.   		i=ssl2_read(s,(char *)&(p[s->init_num]),6-s->init_num);
826.   		if (i < 3)
             ^
827.   			{
828.   			ret=ssl2_part_read(s,SSL_F_REQUEST_CERTIFICATE,i);

ssl/s2_srvr.c:832:8: Taking false branch
830.   			}
831.   
832.   		if ((*p == SSL2_MT_ERROR) && (i >= 3))
              ^
833.   			{
834.   			n2s(p,i);

ssl/s2_srvr.c:844:8: Taking false branch
842.   			goto end;
843.   			}
844.   		if ((*(p++) != SSL2_MT_CLIENT_CERTIFICATE) || (i < 6))
              ^
845.   			{
846.   			ssl2_return_error(s,SSL2_PE_UNDEFINED_ERROR);

ssl/s2_srvr.c:844:50: Taking false branch
842.   			goto end;
843.   			}
844.   		if ((*(p++) != SSL2_MT_CLIENT_CERTIFICATE) || (i < 6))
                                                        ^
845.   			{
846.   			ssl2_return_error(s,SSL2_PE_UNDEFINED_ERROR);

ssl/s2_srvr.c:852:3: 
850.   		/* ok we have a response */
851.   		/* certificate type, there is only one right now. */
852. > 		ctype= *(p++);
853.   		if (ctype != SSL2_AT_MD5_WITH_RSA_ENCRYPTION)
854.   			{

ssl/s2_srvr.c:853:7: Taking false branch
851.   		/* certificate type, there is only one right now. */
852.   		ctype= *(p++);
853.   		if (ctype != SSL2_AT_MD5_WITH_RSA_ENCRYPTION)
             ^
854.   			{
855.   			ssl2_return_error(s,SSL2_PE_UNSUPPORTED_CERTIFICATE_TYPE);

ssl/s2_srvr.c:859:3: 
857.   			goto end;
858.   			}
859. > 		n2s(p,i); s->s2->tmp.clen=i;
860.   		n2s(p,i); s->s2->tmp.rlen=i;
861.   		s->state=SSL2_ST_SEND_REQUEST_CERTIFICATE_D;

ssl/s2_srvr.c:859:13: 
857.   			goto end;
858.   			}
859. > 		n2s(p,i); s->s2->tmp.clen=i;
860.   		n2s(p,i); s->s2->tmp.rlen=i;
861.   		s->state=SSL2_ST_SEND_REQUEST_CERTIFICATE_D;

ssl/s2_srvr.c:860:3: 
858.   			}
859.   		n2s(p,i); s->s2->tmp.clen=i;
860. > 		n2s(p,i); s->s2->tmp.rlen=i;
861.   		s->state=SSL2_ST_SEND_REQUEST_CERTIFICATE_D;
862.   		s->init_num=0;

ssl/s2_srvr.c:860:13: 
858.   			}
859.   		n2s(p,i); s->s2->tmp.clen=i;
860. > 		n2s(p,i); s->s2->tmp.rlen=i;
861.   		s->state=SSL2_ST_SEND_REQUEST_CERTIFICATE_D;
862.   		s->init_num=0;

ssl/s2_srvr.c:861:3: 
859.   		n2s(p,i); s->s2->tmp.clen=i;
860.   		n2s(p,i); s->s2->tmp.rlen=i;
861. > 		s->state=SSL2_ST_SEND_REQUEST_CERTIFICATE_D;
862.   		s->init_num=0;
863.   		}

ssl/s2_srvr.c:862:3: 
860.   		n2s(p,i); s->s2->tmp.rlen=i;
861.   		s->state=SSL2_ST_SEND_REQUEST_CERTIFICATE_D;
862. > 		s->init_num=0;
863.   		}
864.   

ssl/s2_srvr.c:866:2: 
864.   
865.   	/* SSL2_ST_SEND_REQUEST_CERTIFICATE_D */
866. > 	p=(unsigned char *)s->init_buf->data;
867.   	j=s->s2->tmp.clen+s->s2->tmp.rlen-s->init_num;
868.   	i=ssl2_read(s,(char *)&(p[s->init_num]),j);

ssl/s2_srvr.c:867:2: 
865.   	/* SSL2_ST_SEND_REQUEST_CERTIFICATE_D */
866.   	p=(unsigned char *)s->init_buf->data;
867. > 	j=s->s2->tmp.clen+s->s2->tmp.rlen-s->init_num;
868.   	i=ssl2_read(s,(char *)&(p[s->init_num]),j);
869.   	if (i < j) 

ssl/s2_srvr.c:868:2: Skipping ssl2_read(): empty list of specs
866.   	p=(unsigned char *)s->init_buf->data;
867.   	j=s->s2->tmp.clen+s->s2->tmp.rlen-s->init_num;
868.   	i=ssl2_read(s,(char *)&(p[s->init_num]),j);
        ^
869.   	if (i < j) 
870.   		{

ssl/s2_srvr.c:869:6: Taking true branch
867.   	j=s->s2->tmp.clen+s->s2->tmp.rlen-s->init_num;
868.   	i=ssl2_read(s,(char *)&(p[s->init_num]),j);
869.   	if (i < j) 
            ^
870.   		{
871.   		ret=ssl2_part_read(s,SSL_F_REQUEST_CERTIFICATE,i);

ssl/s2_srvr.c:871:3: 
869.   	if (i < j) 
870.   		{
871. > 		ret=ssl2_part_read(s,SSL_F_REQUEST_CERTIFICATE,i);
872.   		goto end;
873.   		}

ssl/s2_pkt.c:574:1: start of procedure ssl2_part_read()
  572.   	}
  573.   
  574. > int ssl2_part_read(SSL *s, unsigned long f, int i)
  575.   	{
  576.   	unsigned char *p;

ssl/s2_pkt.c:580:7: Taking true branch
  578.   
  579.   	/* check for error */
  580.   	if ((s->init_num == 0) && (i >= 3))
               ^
  581.   		{
  582.   		p=(unsigned char *)s->init_buf->data;

ssl/s2_pkt.c:580:29: Taking true branch
  578.   
  579.   	/* check for error */
  580.   	if ((s->init_num == 0) && (i >= 3))
                                     ^
  581.   		{
  582.   		p=(unsigned char *)s->init_buf->data;

ssl/s2_pkt.c:582:3: 
  580.   	if ((s->init_num == 0) && (i >= 3))
  581.   		{
  582. > 		p=(unsigned char *)s->init_buf->data;
  583.   		if (p[0] == SSL2_MT_ERROR)
  584.   			{

ssl/s2_pkt.c:583:7: Taking false branch
  581.   		{
  582.   		p=(unsigned char *)s->init_buf->data;
  583.   		if (p[0] == SSL2_MT_ERROR)
               ^
  584.   			{
  585.   			j=(p[1]<<8)|p[2];

ssl/s2_pkt.c:590:6: Taking false branch
  588.   		}
  589.   
  590.   	if (i < 0)
              ^
  591.   		{
  592.   		/* ssl2_return_error(s); */

ssl/s2_pkt.c:599:3: 
  597.   	else
  598.   		{
  599. > 		s->init_num+=i;
  600.   		return(0);
  601.   		}

ssl/s2_pkt.c:600:3: 
  598.   		{
  599.   		s->init_num+=i;
  600. > 		return(0);
  601.   		}
  602.   	}

ssl/s2_pkt.c:602:2: return from a call to ssl2_part_read
  600.   		return(0);
  601.   		}
  602.   	}
          ^
  603.   
  604.   int ssl2_do_write(SSL *s)

ssl/s2_srvr.c:939:1: 
937.   		ssl2_return_error(s,SSL2_PE_BAD_CERTIFICATE);
938.   		}
939. > end:
940.   	sk_X509_free(sk);
941.   	X509_free(x509);

ssl/s2_srvr.c:940:2: 
938.   		}
939.   end:
940. > 	sk_X509_free(sk);
941.   	X509_free(x509);
942.   	return(ret);

crypto/x509/x509_vfy.c:799:1: start of procedure sk_X509_free()
  797.   
  798.   
  799. > IMPLEMENT_STACK_OF(X509)
  800.   IMPLEMENT_ASN1_SET_OF(X509)
  801.   

crypto/stack/stack.c:276:1: start of procedure sk_free()
    274.   	}
    275.   
    276. > void sk_free(STACK *st)
    277.   	{
    278.   	if (st == NULL) return;

crypto/stack/stack.c:278:6: Taking true branch
    276.   void sk_free(STACK *st)
    277.   	{
    278.   	if (st == NULL) return;
                ^
    279.   	if (st->data != NULL) Free((char *)st->data);
    280.   	Free((char *)st);

crypto/stack/stack.c:278:18: 
    276.   void sk_free(STACK *st)
    277.   	{
    278. > 	if (st == NULL) return;
    279.   	if (st->data != NULL) Free((char *)st->data);
    280.   	Free((char *)st);

crypto/stack/stack.c:281:2: return from a call to sk_free
    279.   	if (st->data != NULL) Free((char *)st->data);
    280.   	Free((char *)st);
    281.   	}
            ^
    282.   
    283.   int sk_num(STACK *st)

crypto/x509/x509_vfy.c:799:1: return from a call to sk_X509_free
  797.   
  798.   
  799. > IMPLEMENT_STACK_OF(X509)
  800.   IMPLEMENT_ASN1_SET_OF(X509)
  801.   

ssl/s2_srvr.c:941:2: 
939.   end:
940.   	sk_X509_free(sk);
941. > 	X509_free(x509);
942.   	return(ret);
943.   	}

static int request_certificate(SSL *s)
	{
	unsigned char *p,*p2,*buf2;
	unsigned char *ccd;
	int i,j,ctype,ret= -1;
	X509 *x509=NULL;
	STACK_OF(X509) *sk=NULL;
	ccd=s->s2->tmp.ccl;
	if (s->state == SSL2_ST_SEND_REQUEST_CERTIFICATE_A)
		{
		p=(unsigned char *)s->init_buf->data;
		*(p++)=SSL2_MT_REQUEST_CERTIFICATE;
		*(p++)=SSL2_AT_MD5_WITH_RSA_ENCRYPTION;
		RAND_pseudo_bytes(ccd,SSL2_MIN_CERT_CHALLENGE_LENGTH);
		memcpy(p,ccd,SSL2_MIN_CERT_CHALLENGE_LENGTH);
		s->state=SSL2_ST_SEND_REQUEST_CERTIFICATE_B;
		s->init_num=SSL2_MIN_CERT_CHALLENGE_LENGTH+2;
		s->init_off=0;
		}
	if (s->state == SSL2_ST_SEND_REQUEST_CERTIFICATE_B)
		{
		i=ssl2_do_write(s);
		if (i <= 0)
			{
			ret=i;
			goto end;
			}
		s->init_num=0;
		s->state=SSL2_ST_SEND_REQUEST_CERTIFICATE_C;
		}
	if (s->state == SSL2_ST_SEND_REQUEST_CERTIFICATE_C)
		{
		p=(unsigned char *)s->init_buf->data;
		i=ssl2_read(s,(char *)&(p[s->init_num]),6-s->init_num);
		if (i < 3)
			{
			ret=ssl2_part_read(s,SSL_F_REQUEST_CERTIFICATE,i);
			goto end;
			}
		if ((*p == SSL2_MT_ERROR) && (i >= 3))
			{
			n2s(p,i);
			if (s->verify_mode & SSL_VERIFY_FAIL_IF_NO_PEER_CERT)
				{
				ssl2_return_error(s,SSL2_PE_BAD_CERTIFICATE);
				SSLerr(SSL_F_REQUEST_CERTIFICATE,SSL_R_PEER_DID_NOT_RETURN_A_CERTIFICATE);
				goto end;
				}
			ret=1;
			goto end;
			}
		if ((*(p++) != SSL2_MT_CLIENT_CERTIFICATE) || (i < 6))
			{
			ssl2_return_error(s,SSL2_PE_UNDEFINED_ERROR);
			SSLerr(SSL_F_REQUEST_CERTIFICATE,SSL_R_SHORT_READ);
			goto end;
			}
		ctype= *(p++);
		if (ctype != SSL2_AT_MD5_WITH_RSA_ENCRYPTION)
			{
			ssl2_return_error(s,SSL2_PE_UNSUPPORTED_CERTIFICATE_TYPE);
			SSLerr(SSL_F_REQUEST_CERTIFICATE,SSL_R_BAD_RESPONSE_ARGUMENT);
			goto end;
			}
		n2s(p,i); s->s2->tmp.clen=i;
		n2s(p,i); s->s2->tmp.rlen=i;
		s->state=SSL2_ST_SEND_REQUEST_CERTIFICATE_D;
		s->init_num=0;
		}
	p=(unsigned char *)s->init_buf->data;
	j=s->s2->tmp.clen+s->s2->tmp.rlen-s->init_num;
	i=ssl2_read(s,(char *)&(p[s->init_num]),j);
	if (i < j)
		{
		ret=ssl2_part_read(s,SSL_F_REQUEST_CERTIFICATE,i);
		goto end;
		}
	x509=(X509 *)d2i_X509(NULL,&p,(long)s->s2->tmp.clen);
	if (x509 == NULL)
		{
		SSLerr(SSL_F_REQUEST_CERTIFICATE,ERR_R_X509_LIB);
		goto msg_end;
		}
	if (((sk=sk_X509_new_null()) == NULL) || (!sk_X509_push(sk,x509)))
		{
		SSLerr(SSL_F_REQUEST_CERTIFICATE,ERR_R_MALLOC_FAILURE);
		goto msg_end;
		}
	i=ssl_verify_cert_chain(s,sk);
	if (i)
		{
		EVP_MD_CTX ctx;
		EVP_PKEY *pkey=NULL;
		EVP_VerifyInit(&ctx,s->ctx->rsa_md5);
		EVP_VerifyUpdate(&ctx,s->s2->key_material,
			(unsigned int)s->s2->key_material_length);
		EVP_VerifyUpdate(&ctx,ccd,SSL2_MIN_CERT_CHALLENGE_LENGTH);
		i=i2d_X509(s->cert->pkeys[SSL_PKEY_RSA_ENC].x509,NULL);
		buf2=(unsigned char *)Malloc((unsigned int)i);
		if (buf2 == NULL)
			{
			SSLerr(SSL_F_REQUEST_CERTIFICATE,ERR_R_MALLOC_FAILURE);
			goto msg_end;
			}
		p2=buf2;
		i=i2d_X509(s->cert->pkeys[SSL_PKEY_RSA_ENC].x509,&p2);
		EVP_VerifyUpdate(&ctx,buf2,(unsigned int)i);
		Free(buf2);
		pkey=X509_get_pubkey(x509);
		if (pkey == NULL) goto end;
		i=EVP_VerifyFinal(&ctx,p,s->s2->tmp.rlen,pkey);
		EVP_PKEY_free(pkey);
		memset(&ctx,0,sizeof(ctx));
		if (i)
			{
			if (s->session->peer != NULL)
				X509_free(s->session->peer);
			s->session->peer=x509;
			CRYPTO_add(&x509->references,1,CRYPTO_LOCK_X509);
			s->session->verify_result = s->verify_result;
			ret=1;
			goto end;
			}
		else
			{
			SSLerr(SSL_F_REQUEST_CERTIFICATE,SSL_R_BAD_CHECKSUM);
			goto msg_end;
			}
		}
	else
		{
msg_end:
		ssl2_return_error(s,SSL2_PE_BAD_CERTIFICATE);
		}
end:
	sk_X509_free(sk);
	X509_free(x509);
	return(ret);
	}
['static int request_certificate(SSL *s)\n\t{\n\tunsigned char *p,*p2,*buf2;\n\tunsigned char *ccd;\n\tint i,j,ctype,ret= -1;\n\tX509 *x509=NULL;\n\tSTACK_OF(X509) *sk=NULL;\n\tccd=s->s2->tmp.ccl;\n\tif (s->state == SSL2_ST_SEND_REQUEST_CERTIFICATE_A)\n\t\t{\n\t\tp=(unsigned char *)s->init_buf->data;\n\t\t*(p++)=SSL2_MT_REQUEST_CERTIFICATE;\n\t\t*(p++)=SSL2_AT_MD5_WITH_RSA_ENCRYPTION;\n\t\tRAND_pseudo_bytes(ccd,SSL2_MIN_CERT_CHALLENGE_LENGTH);\n\t\tmemcpy(p,ccd,SSL2_MIN_CERT_CHALLENGE_LENGTH);\n\t\ts->state=SSL2_ST_SEND_REQUEST_CERTIFICATE_B;\n\t\ts->init_num=SSL2_MIN_CERT_CHALLENGE_LENGTH+2;\n\t\ts->init_off=0;\n\t\t}\n\tif (s->state == SSL2_ST_SEND_REQUEST_CERTIFICATE_B)\n\t\t{\n\t\ti=ssl2_do_write(s);\n\t\tif (i <= 0)\n\t\t\t{\n\t\t\tret=i;\n\t\t\tgoto end;\n\t\t\t}\n\t\ts->init_num=0;\n\t\ts->state=SSL2_ST_SEND_REQUEST_CERTIFICATE_C;\n\t\t}\n\tif (s->state == SSL2_ST_SEND_REQUEST_CERTIFICATE_C)\n\t\t{\n\t\tp=(unsigned char *)s->init_buf->data;\n\t\ti=ssl2_read(s,(char *)&(p[s->init_num]),6-s->init_num);\n\t\tif (i < 3)\n\t\t\t{\n\t\t\tret=ssl2_part_read(s,SSL_F_REQUEST_CERTIFICATE,i);\n\t\t\tgoto end;\n\t\t\t}\n\t\tif ((*p == SSL2_MT_ERROR) && (i >= 3))\n\t\t\t{\n\t\t\tn2s(p,i);\n\t\t\tif (s->verify_mode & SSL_VERIFY_FAIL_IF_NO_PEER_CERT)\n\t\t\t\t{\n\t\t\t\tssl2_return_error(s,SSL2_PE_BAD_CERTIFICATE);\n\t\t\t\tSSLerr(SSL_F_REQUEST_CERTIFICATE,SSL_R_PEER_DID_NOT_RETURN_A_CERTIFICATE);\n\t\t\t\tgoto end;\n\t\t\t\t}\n\t\t\tret=1;\n\t\t\tgoto end;\n\t\t\t}\n\t\tif ((*(p++) != SSL2_MT_CLIENT_CERTIFICATE) || (i < 6))\n\t\t\t{\n\t\t\tssl2_return_error(s,SSL2_PE_UNDEFINED_ERROR);\n\t\t\tSSLerr(SSL_F_REQUEST_CERTIFICATE,SSL_R_SHORT_READ);\n\t\t\tgoto end;\n\t\t\t}\n\t\tctype= *(p++);\n\t\tif (ctype != SSL2_AT_MD5_WITH_RSA_ENCRYPTION)\n\t\t\t{\n\t\t\tssl2_return_error(s,SSL2_PE_UNSUPPORTED_CERTIFICATE_TYPE);\n\t\t\tSSLerr(SSL_F_REQUEST_CERTIFICATE,SSL_R_BAD_RESPONSE_ARGUMENT);\n\t\t\tgoto end;\n\t\t\t}\n\t\tn2s(p,i); s->s2->tmp.clen=i;\n\t\tn2s(p,i); s->s2->tmp.rlen=i;\n\t\ts->state=SSL2_ST_SEND_REQUEST_CERTIFICATE_D;\n\t\ts->init_num=0;\n\t\t}\n\tp=(unsigned char *)s->init_buf->data;\n\tj=s->s2->tmp.clen+s->s2->tmp.rlen-s->init_num;\n\ti=ssl2_read(s,(char *)&(p[s->init_num]),j);\n\tif (i < j)\n\t\t{\n\t\tret=ssl2_part_read(s,SSL_F_REQUEST_CERTIFICATE,i);\n\t\tgoto end;\n\t\t}\n\tx509=(X509 *)d2i_X509(NULL,&p,(long)s->s2->tmp.clen);\n\tif (x509 == NULL)\n\t\t{\n\t\tSSLerr(SSL_F_REQUEST_CERTIFICATE,ERR_R_X509_LIB);\n\t\tgoto msg_end;\n\t\t}\n\tif (((sk=sk_X509_new_null()) == NULL) || (!sk_X509_push(sk,x509)))\n\t\t{\n\t\tSSLerr(SSL_F_REQUEST_CERTIFICATE,ERR_R_MALLOC_FAILURE);\n\t\tgoto msg_end;\n\t\t}\n\ti=ssl_verify_cert_chain(s,sk);\n\tif (i)\n\t\t{\n\t\tEVP_MD_CTX ctx;\n\t\tEVP_PKEY *pkey=NULL;\n\t\tEVP_VerifyInit(&ctx,s->ctx->rsa_md5);\n\t\tEVP_VerifyUpdate(&ctx,s->s2->key_material,\n\t\t\t(unsigned int)s->s2->key_material_length);\n\t\tEVP_VerifyUpdate(&ctx,ccd,SSL2_MIN_CERT_CHALLENGE_LENGTH);\n\t\ti=i2d_X509(s->cert->pkeys[SSL_PKEY_RSA_ENC].x509,NULL);\n\t\tbuf2=(unsigned char *)Malloc((unsigned int)i);\n\t\tif (buf2 == NULL)\n\t\t\t{\n\t\t\tSSLerr(SSL_F_REQUEST_CERTIFICATE,ERR_R_MALLOC_FAILURE);\n\t\t\tgoto msg_end;\n\t\t\t}\n\t\tp2=buf2;\n\t\ti=i2d_X509(s->cert->pkeys[SSL_PKEY_RSA_ENC].x509,&p2);\n\t\tEVP_VerifyUpdate(&ctx,buf2,(unsigned int)i);\n\t\tFree(buf2);\n\t\tpkey=X509_get_pubkey(x509);\n\t\tif (pkey == NULL) goto end;\n\t\ti=EVP_VerifyFinal(&ctx,p,s->s2->tmp.rlen,pkey);\n\t\tEVP_PKEY_free(pkey);\n\t\tmemset(&ctx,0,sizeof(ctx));\n\t\tif (i)\n\t\t\t{\n\t\t\tif (s->session->peer != NULL)\n\t\t\t\tX509_free(s->session->peer);\n\t\t\ts->session->peer=x509;\n\t\t\tCRYPTO_add(&x509->references,1,CRYPTO_LOCK_X509);\n\t\t\ts->session->verify_result = s->verify_result;\n\t\t\tret=1;\n\t\t\tgoto end;\n\t\t\t}\n\t\telse\n\t\t\t{\n\t\t\tSSLerr(SSL_F_REQUEST_CERTIFICATE,SSL_R_BAD_CHECKSUM);\n\t\t\tgoto msg_end;\n\t\t\t}\n\t\t}\n\telse\n\t\t{\nmsg_end:\n\t\tssl2_return_error(s,SSL2_PE_BAD_CERTIFICATE);\n\t\t}\nend:\n\tsk_X509_free(sk);\n\tX509_free(x509);\n\treturn(ret);\n\t}', 'int ssl2_part_read(SSL *s, unsigned long f, int i)\n\t{\n\tunsigned char *p;\n\tint j;\n\tif ((s->init_num == 0) && (i >= 3))\n\t\t{\n\t\tp=(unsigned char *)s->init_buf->data;\n\t\tif (p[0] == SSL2_MT_ERROR)\n\t\t\t{\n\t\t\tj=(p[1]<<8)|p[2];\n\t\t\tSSLerr((int)f,ssl_mt_error(j));\n\t\t\t}\n\t\t}\n\tif (i < 0)\n\t\t{\n\t\treturn(i);\n\t\t}\n\telse\n\t\t{\n\t\ts->init_num+=i;\n\t\treturn(0);\n\t\t}\n\t}', 'IMPLEMENT_STACK_OF(X509)', 'void sk_free(STACK *st)\n\t{\n\tif (st == NULL) return;\n\tif (st->data != NULL) Free((char *)st->data);\n\tFree((char *)st);\n\t}']