ssl/s3_clnt.c:2347: error: NULL_DEREFERENCE
  pointer `pkey` last assigned on line 2345 could be null and is dereferenced by call to `EVP_PKEY_free()` at line 2347, column 2.
Showing all 92 steps of the trace


ssl/s3_clnt.c:2293:1: start of procedure ssl3_check_cert_and_algorithm()
2291.   #define has_bits(i,m)	(((i)&(m)) == (m))
2292.   
2293. > int ssl3_check_cert_and_algorithm(SSL *s)
2294.   	{
2295.   	int i,idx;

ssl/s3_clnt.c:2297:2: 
2295.   	int i,idx;
2296.   	long algs;
2297. > 	EVP_PKEY *pkey=NULL;
2298.   	SESS_CERT *sc;
2299.   #ifndef OPENSSL_NO_RSA

ssl/s3_clnt.c:2306:2: 
2304.   #endif
2305.   
2306. > 	sc=s->session->sess_cert;
2307.   
2308.   	if (sc == NULL)

ssl/s3_clnt.c:2308:6: Taking false branch
2306.   	sc=s->session->sess_cert;
2307.   
2308.   	if (sc == NULL)
             ^
2309.   		{
2310.   		SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,ERR_R_INTERNAL_ERROR);

ssl/s3_clnt.c:2314:2: 
2312.   		}
2313.   
2314. > 	algs=s->s3->tmp.new_cipher->algorithms;
2315.   
2316.   	/* we don't have a certificate */

ssl/s3_clnt.c:2317:6: Taking false branch
2315.   
2316.   	/* we don't have a certificate */
2317.   	if (algs & (SSL_aDH|SSL_aNULL|SSL_aKRB5))
             ^
2318.   		return(1);
2319.   

ssl/s3_clnt.c:2321:2: 
2319.   
2320.   #ifndef OPENSSL_NO_RSA
2321. > 	rsa=s->session->sess_cert->peer_rsa_tmp;
2322.   #endif
2323.   #ifndef OPENSSL_NO_DH

ssl/s3_clnt.c:2324:2: 
2322.   #endif
2323.   #ifndef OPENSSL_NO_DH
2324. > 	dh=s->session->sess_cert->peer_dh_tmp;
2325.   #endif
2326.   

ssl/s3_clnt.c:2329:2: 
2327.   	/* This is the passed certificate */
2328.   
2329. > 	idx=sc->peer_cert_type;
2330.   #ifndef OPENSSL_NO_ECDH
2331.   	if (idx == SSL_PKEY_ECC)

ssl/s3_clnt.c:2331:6: Taking false branch
2329.   	idx=sc->peer_cert_type;
2330.   #ifndef OPENSSL_NO_ECDH
2331.   	if (idx == SSL_PKEY_ECC)
             ^
2332.   		{
2333.   		if (check_srvr_ecc_cert_and_alg(sc->peer_pkeys[idx].x509,

ssl/s3_clnt.c:2345:2: 
2343.   		}
2344.   #endif
2345. > 	pkey=X509_get_pubkey(sc->peer_pkeys[idx].x509);
2346.   	i=X509_certificate_type(sc->peer_pkeys[idx].x509,pkey);
2347.   	EVP_PKEY_free(pkey);

crypto/x509/x509_cmp.c:374:1: start of procedure X509_get_pubkey()
  372.   	}
  373.   
  374. > EVP_PKEY *X509_get_pubkey(X509 *x)
  375.   	{
  376.   	if ((x == NULL) || (x->cert_info == NULL))

crypto/x509/x509_cmp.c:376:7: Taking false branch
  374.   EVP_PKEY *X509_get_pubkey(X509 *x)
  375.   	{
  376.   	if ((x == NULL) || (x->cert_info == NULL))
               ^
  377.   		return(NULL);
  378.   	return(X509_PUBKEY_get(x->cert_info->key));

crypto/x509/x509_cmp.c:376:22: Taking false branch
  374.   EVP_PKEY *X509_get_pubkey(X509 *x)
  375.   	{
  376.   	if ((x == NULL) || (x->cert_info == NULL))
                              ^
  377.   		return(NULL);
  378.   	return(X509_PUBKEY_get(x->cert_info->key));

crypto/x509/x509_cmp.c:378:2: 
  376.   	if ((x == NULL) || (x->cert_info == NULL))
  377.   		return(NULL);
  378. > 	return(X509_PUBKEY_get(x->cert_info->key));
  379.   	}
  380.   

crypto/asn1/x_pubkey.c:254:1: start of procedure X509_PUBKEY_get()
    252.   	}
    253.   
    254. > EVP_PKEY *X509_PUBKEY_get(X509_PUBKEY *key)
    255.   	{
    256.   	EVP_PKEY *ret=NULL;

crypto/asn1/x_pubkey.c:256:2: 
    254.   EVP_PKEY *X509_PUBKEY_get(X509_PUBKEY *key)
    255.   	{
    256. > 	EVP_PKEY *ret=NULL;
    257.   	long j;
    258.   	int type;

crypto/asn1/x_pubkey.c:265:6: Taking false branch
    263.   #endif
    264.   
    265.   	if (key == NULL) goto err;
                ^
    266.   
    267.   	if (key->pkey != NULL)

crypto/asn1/x_pubkey.c:267:6: Taking false branch
    265.   	if (key == NULL) goto err;
    266.   
    267.   	if (key->pkey != NULL)
                ^
    268.   		{
    269.   		CRYPTO_add(&key->pkey->references, 1, CRYPTO_LOCK_EVP_PKEY);

crypto/asn1/x_pubkey.c:273:6: Taking false branch
    271.   		}
    272.   
    273.   	if (key->public_key == NULL) goto err;
                ^
    274.   
    275.   	type=OBJ_obj2nid(key->algor->algorithm);

crypto/asn1/x_pubkey.c:275:2: 
    273.   	if (key->public_key == NULL) goto err;
    274.   
    275. > 	type=OBJ_obj2nid(key->algor->algorithm);
    276.   	if ((ret = EVP_PKEY_new()) == NULL)
    277.   		{

crypto/objects/obj_dat.c:368:1: start of procedure OBJ_obj2nid()
      366.   	}
      367.   
      368. > int OBJ_obj2nid(const ASN1_OBJECT *a)
      369.   	{
      370.   	ASN1_OBJECT **op;

crypto/objects/obj_dat.c:373:6: Taking false branch
      371.   	ADDED_OBJ ad,*adp;
      372.   
      373.   	if (a == NULL)
                  ^
      374.   		return(NID_undef);
      375.   	if (a->nid != 0)

crypto/objects/obj_dat.c:375:6: Taking false branch
      373.   	if (a == NULL)
      374.   		return(NID_undef);
      375.   	if (a->nid != 0)
                  ^
      376.   		return(a->nid);
      377.   

crypto/objects/obj_dat.c:378:6: Taking true branch
      376.   		return(a->nid);
      377.   
      378.   	if (added != NULL)
                  ^
      379.   		{
      380.   		ad.type=ADDED_DATA;

crypto/objects/obj_dat.c:380:3: 
      378.   	if (added != NULL)
      379.   		{
      380. > 		ad.type=ADDED_DATA;
      381.   		ad.obj=(ASN1_OBJECT *)a; /* XXX: ugly but harmless */
      382.   		adp=(ADDED_OBJ *)lh_retrieve(added,&ad);

crypto/objects/obj_dat.c:381:3: 
      379.   		{
      380.   		ad.type=ADDED_DATA;
      381. > 		ad.obj=(ASN1_OBJECT *)a; /* XXX: ugly but harmless */
      382.   		adp=(ADDED_OBJ *)lh_retrieve(added,&ad);
      383.   		if (adp != NULL) return (adp->obj->nid);

crypto/objects/obj_dat.c:382:3: 
      380.   		ad.type=ADDED_DATA;
      381.   		ad.obj=(ASN1_OBJECT *)a; /* XXX: ugly but harmless */
      382. > 		adp=(ADDED_OBJ *)lh_retrieve(added,&ad);
      383.   		if (adp != NULL) return (adp->obj->nid);
      384.   		}

crypto/lhash/lhash.c:248:1: start of procedure lh_retrieve()
        246.   	}
        247.   
        248. > void *lh_retrieve(LHASH *lh, const void *data)
        249.   	{
        250.   	unsigned long hash;

crypto/lhash/lhash.c:254:2: 
        252.   	void *ret;
        253.   
        254. > 	lh->error=0;
        255.   	rn=getrn(lh,data,&hash);
        256.   

crypto/lhash/lhash.c:255:2: Skipping getrn(): empty list of specs
        253.   
        254.   	lh->error=0;
        255.   	rn=getrn(lh,data,&hash);
                ^
        256.   
        257.   	if (*rn == NULL)

crypto/lhash/lhash.c:257:6: Taking false branch
        255.   	rn=getrn(lh,data,&hash);
        256.   
        257.   	if (*rn == NULL)
                    ^
        258.   		{
        259.   		lh->num_retrieve_miss++;

crypto/lhash/lhash.c:264:3: 
        262.   	else
        263.   		{
        264. > 		ret= (*rn)->data;
        265.   		lh->num_retrieve++;
        266.   		}

crypto/lhash/lhash.c:265:3: 
        263.   		{
        264.   		ret= (*rn)->data;
        265. > 		lh->num_retrieve++;
        266.   		}
        267.   	return(ret);

crypto/lhash/lhash.c:267:2: 
        265.   		lh->num_retrieve++;
        266.   		}
        267. > 	return(ret);
        268.   	}
        269.   

crypto/lhash/lhash.c:268:2: return from a call to lh_retrieve
        266.   		}
        267.   	return(ret);
        268.   	}
                ^
        269.   
        270.   static void doall_util_fn(LHASH *lh, int use_arg, LHASH_DOALL_FN_TYPE func,

crypto/objects/obj_dat.c:383:7: Taking true branch
      381.   		ad.obj=(ASN1_OBJECT *)a; /* XXX: ugly but harmless */
      382.   		adp=(ADDED_OBJ *)lh_retrieve(added,&ad);
      383.   		if (adp != NULL) return (adp->obj->nid);
                   ^
      384.   		}
      385.   	op=(ASN1_OBJECT **)OBJ_bsearch((const char *)&a,(const char *)obj_objs,

crypto/objects/obj_dat.c:383:20: 
      381.   		ad.obj=(ASN1_OBJECT *)a; /* XXX: ugly but harmless */
      382.   		adp=(ADDED_OBJ *)lh_retrieve(added,&ad);
      383. > 		if (adp != NULL) return (adp->obj->nid);
      384.   		}
      385.   	op=(ASN1_OBJECT **)OBJ_bsearch((const char *)&a,(const char *)obj_objs,

crypto/objects/obj_dat.c:390:2: return from a call to OBJ_obj2nid
      388.   		return(NID_undef);
      389.   	return((*op)->nid);
      390.   	}
              ^
      391.   
      392.   /* Convert an object name into an ASN1_OBJECT

crypto/asn1/x_pubkey.c:276:6: 
    274.   
    275.   	type=OBJ_obj2nid(key->algor->algorithm);
    276. > 	if ((ret = EVP_PKEY_new()) == NULL)
    277.   		{
    278.   		X509err(X509_F_X509_PUBKEY_GET, ERR_R_MALLOC_FAILURE);

crypto/evp/p_lib.c:307:1: start of procedure EVP_PKEY_new()
      305.   	}
      306.   
      307. > EVP_PKEY *EVP_PKEY_new(void)
      308.   	{
      309.   	EVP_PKEY *ret;

crypto/evp/p_lib.c:311:2: 
      309.   	EVP_PKEY *ret;
      310.   
      311. > 	ret=(EVP_PKEY *)OPENSSL_malloc(sizeof(EVP_PKEY));
      312.   	if (ret == NULL)
      313.   		{

crypto/mem.c:291:1: start of procedure CRYPTO_malloc()
        289.   	}
        290.   
        291. > void *CRYPTO_malloc(int num, const char *file, int line)
        292.   	{
        293.   	void *ret = NULL;

crypto/mem.c:293:2: 
        291.   void *CRYPTO_malloc(int num, const char *file, int line)
        292.   	{
        293. > 	void *ret = NULL;
        294.   	extern unsigned char cleanse_ctr;
        295.   

crypto/mem.c:296:6: Taking false branch
        294.   	extern unsigned char cleanse_ctr;
        295.   
        296.   	if (num <= 0) return NULL;
                    ^
        297.   
        298.   	allow_customize = 0;

crypto/mem.c:298:2: 
        296.   	if (num <= 0) return NULL;
        297.   
        298. > 	allow_customize = 0;
        299.   	if (malloc_debug_func != NULL)
        300.   		{

crypto/mem.c:299:6: Taking true branch
        297.   
        298.   	allow_customize = 0;
        299.   	if (malloc_debug_func != NULL)
                    ^
        300.   		{
        301.   		allow_customize_debug = 0;

crypto/mem.c:301:3: 
        299.   	if (malloc_debug_func != NULL)
        300.   		{
        301. > 		allow_customize_debug = 0;
        302.   		malloc_debug_func(NULL, num, file, line, 0);
        303.   		}

crypto/mem.c:302:3: Skipping __function_pointer__(): unresolved function pointer
        300.   		{
        301.   		allow_customize_debug = 0;
        302.   		malloc_debug_func(NULL, num, file, line, 0);
                 ^
        303.   		}
        304.   	ret = malloc_ex_func(num,file,line);

crypto/mem.c:304:2: Skipping __function_pointer__(): unresolved function pointer
        302.   		malloc_debug_func(NULL, num, file, line, 0);
        303.   		}
        304.   	ret = malloc_ex_func(num,file,line);
                ^
        305.   #ifdef LEVITTE_DEBUG_MEM
        306.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);

crypto/mem.c:308:6: Taking true branch
        306.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);
        307.   #endif
        308.   	if (malloc_debug_func != NULL)
                    ^
        309.   		malloc_debug_func(ret, num, file, line, 1);
        310.   

crypto/mem.c:309:3: Skipping __function_pointer__(): unresolved function pointer
        307.   #endif
        308.   	if (malloc_debug_func != NULL)
        309.   		malloc_debug_func(ret, num, file, line, 1);
                 ^
        310.   
        311.           /* Create a dependency on the value of 'cleanse_ctr' so our memory

crypto/mem.c:314:12: Taking false branch
        312.            * sanitisation function can't be optimised out. NB: We only do
        313.            * this for >2Kb so the overhead doesn't bother us. */
        314.           if(ret && (num > 2048))
                          ^
        315.                   ((unsigned char *)ret)[0] = cleanse_ctr;
        316.   

crypto/mem.c:317:2: 
        315.                   ((unsigned char *)ret)[0] = cleanse_ctr;
        316.   
        317. > 	return ret;
        318.   	}
        319.   

crypto/mem.c:318:2: return from a call to CRYPTO_malloc
        316.   
        317.   	return ret;
        318.   	}
                ^
        319.   
        320.   void *CRYPTO_realloc(void *str, int num, const char *file, int line)

crypto/evp/p_lib.c:312:6: Taking true branch
      310.   
      311.   	ret=(EVP_PKEY *)OPENSSL_malloc(sizeof(EVP_PKEY));
      312.   	if (ret == NULL)
                  ^
      313.   		{
      314.   		EVPerr(EVP_F_EVP_PKEY_NEW,ERR_R_MALLOC_FAILURE);

crypto/evp/p_lib.c:314:3: 
      312.   	if (ret == NULL)
      313.   		{
      314. > 		EVPerr(EVP_F_EVP_PKEY_NEW,ERR_R_MALLOC_FAILURE);
      315.   		return(NULL);
      316.   		}

crypto/err/err.c:666:1: start of procedure ERR_put_error()
        664.   /********************************************************/
        665.   
        666. > void ERR_put_error(int lib, int func, int reason, const char *file,
        667.   	     int line)
        668.   	{

crypto/err/err.c:690:2: Skipping ERR_get_state(): empty list of specs
        688.   	}
        689.   #endif
        690.   	es=ERR_get_state();
                ^
        691.   
        692.   	es->top=(es->top+1)%ERR_NUM_ERRORS;

crypto/err/err.c:692:2: 
        690.   	es=ERR_get_state();
        691.   
        692. > 	es->top=(es->top+1)%ERR_NUM_ERRORS;
        693.   	if (es->top == es->bottom)
        694.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;

crypto/err/err.c:693:6: Taking false branch
        691.   
        692.   	es->top=(es->top+1)%ERR_NUM_ERRORS;
        693.   	if (es->top == es->bottom)
                    ^
        694.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
        695.   	es->err_flags[es->top]=0;

crypto/err/err.c:695:2: 
        693.   	if (es->top == es->bottom)
        694.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
        695. > 	es->err_flags[es->top]=0;
        696.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
        697.   	es->err_file[es->top]=file;

crypto/err/err.c:696:2: 
        694.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
        695.   	es->err_flags[es->top]=0;
        696. > 	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
        697.   	es->err_file[es->top]=file;
        698.   	es->err_line[es->top]=line;

crypto/err/err.c:697:2: 
        695.   	es->err_flags[es->top]=0;
        696.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
        697. > 	es->err_file[es->top]=file;
        698.   	es->err_line[es->top]=line;
        699.   	err_clear_data(es,es->top);

crypto/err/err.c:698:2: 
        696.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
        697.   	es->err_file[es->top]=file;
        698. > 	es->err_line[es->top]=line;
        699.   	err_clear_data(es,es->top);
        700.   	}

crypto/err/err.c:699:2: Taking true branch
        697.   	es->err_file[es->top]=file;
        698.   	es->err_line[es->top]=line;
        699.   	err_clear_data(es,es->top);
                ^
        700.   	}
        701.   

crypto/err/err.c:699:2: Taking false branch
        697.   	es->err_file[es->top]=file;
        698.   	es->err_line[es->top]=line;
        699.   	err_clear_data(es,es->top);
                ^
        700.   	}
        701.   

crypto/err/err.c:699:2: Loop condition is false. Leaving loop
        697.   	es->err_file[es->top]=file;
        698.   	es->err_line[es->top]=line;
        699.   	err_clear_data(es,es->top);
                ^
        700.   	}
        701.   

crypto/err/err.c:700:2: return from a call to ERR_put_error
        698.   	es->err_line[es->top]=line;
        699.   	err_clear_data(es,es->top);
        700.   	}
                ^
        701.   
        702.   void ERR_clear_error(void)

crypto/evp/p_lib.c:315:3: 
      313.   		{
      314.   		EVPerr(EVP_F_EVP_PKEY_NEW,ERR_R_MALLOC_FAILURE);
      315. > 		return(NULL);
      316.   		}
      317.   	ret->type=EVP_PKEY_NONE;

crypto/evp/p_lib.c:323:2: return from a call to EVP_PKEY_new
      321.   	ret->save_parameters=1;
      322.   	return(ret);
      323.   	}
              ^
      324.   
      325.   int EVP_PKEY_assign(EVP_PKEY *pkey, int type, char *key)

crypto/asn1/x_pubkey.c:276:6: Taking true branch
    274.   
    275.   	type=OBJ_obj2nid(key->algor->algorithm);
    276.   	if ((ret = EVP_PKEY_new()) == NULL)
                ^
    277.   		{
    278.   		X509err(X509_F_X509_PUBKEY_GET, ERR_R_MALLOC_FAILURE);

crypto/asn1/x_pubkey.c:278:3: 
    276.   	if ((ret = EVP_PKEY_new()) == NULL)
    277.   		{
    278. > 		X509err(X509_F_X509_PUBKEY_GET, ERR_R_MALLOC_FAILURE);
    279.   		goto err;
    280.   		}

crypto/err/err.c:666:1: start of procedure ERR_put_error()
      664.   /********************************************************/
      665.   
      666. > void ERR_put_error(int lib, int func, int reason, const char *file,
      667.   	     int line)
      668.   	{

crypto/err/err.c:690:2: Skipping ERR_get_state(): empty list of specs
      688.   	}
      689.   #endif
      690.   	es=ERR_get_state();
              ^
      691.   
      692.   	es->top=(es->top+1)%ERR_NUM_ERRORS;

crypto/err/err.c:692:2: 
      690.   	es=ERR_get_state();
      691.   
      692. > 	es->top=(es->top+1)%ERR_NUM_ERRORS;
      693.   	if (es->top == es->bottom)
      694.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;

crypto/err/err.c:693:6: Taking false branch
      691.   
      692.   	es->top=(es->top+1)%ERR_NUM_ERRORS;
      693.   	if (es->top == es->bottom)
                  ^
      694.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
      695.   	es->err_flags[es->top]=0;

crypto/err/err.c:695:2: 
      693.   	if (es->top == es->bottom)
      694.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
      695. > 	es->err_flags[es->top]=0;
      696.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
      697.   	es->err_file[es->top]=file;

crypto/err/err.c:696:2: 
      694.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
      695.   	es->err_flags[es->top]=0;
      696. > 	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
      697.   	es->err_file[es->top]=file;
      698.   	es->err_line[es->top]=line;

crypto/err/err.c:697:2: 
      695.   	es->err_flags[es->top]=0;
      696.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
      697. > 	es->err_file[es->top]=file;
      698.   	es->err_line[es->top]=line;
      699.   	err_clear_data(es,es->top);

crypto/err/err.c:698:2: 
      696.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
      697.   	es->err_file[es->top]=file;
      698. > 	es->err_line[es->top]=line;
      699.   	err_clear_data(es,es->top);
      700.   	}

crypto/err/err.c:699:2: Taking true branch
      697.   	es->err_file[es->top]=file;
      698.   	es->err_line[es->top]=line;
      699.   	err_clear_data(es,es->top);
              ^
      700.   	}
      701.   

crypto/err/err.c:699:2: Taking false branch
      697.   	es->err_file[es->top]=file;
      698.   	es->err_line[es->top]=line;
      699.   	err_clear_data(es,es->top);
              ^
      700.   	}
      701.   

crypto/err/err.c:699:2: Loop condition is false. Leaving loop
      697.   	es->err_file[es->top]=file;
      698.   	es->err_line[es->top]=line;
      699.   	err_clear_data(es,es->top);
              ^
      700.   	}
      701.   

crypto/err/err.c:700:2: return from a call to ERR_put_error
      698.   	es->err_line[es->top]=line;
      699.   	err_clear_data(es,es->top);
      700.   	}
              ^
      701.   
      702.   void ERR_clear_error(void)

crypto/asn1/x_pubkey.c:369:1: 
    367.   	CRYPTO_add(&ret->references, 1, CRYPTO_LOCK_EVP_PKEY);
    368.   	return(ret);
    369. > err:
    370.   	if (ret != NULL)
    371.   		EVP_PKEY_free(ret);

crypto/asn1/x_pubkey.c:370:6: Taking false branch
    368.   	return(ret);
    369.   err:
    370.   	if (ret != NULL)
                ^
    371.   		EVP_PKEY_free(ret);
    372.   	return(NULL);

crypto/asn1/x_pubkey.c:372:2: 
    370.   	if (ret != NULL)
    371.   		EVP_PKEY_free(ret);
    372. > 	return(NULL);
    373.   	}
    374.   

crypto/asn1/x_pubkey.c:373:2: return from a call to X509_PUBKEY_get
    371.   		EVP_PKEY_free(ret);
    372.   	return(NULL);
    373.   	}
            ^
    374.   
    375.   /* Now two pseudo ASN1 routines that take an EVP_PKEY structure

crypto/x509/x509_cmp.c:379:2: return from a call to X509_get_pubkey
  377.   		return(NULL);
  378.   	return(X509_PUBKEY_get(x->cert_info->key));
  379.   	}
          ^
  380.   
  381.   ASN1_BIT_STRING *X509_get0_pubkey_bitstr(const X509 *x)

ssl/s3_clnt.c:2346:2: Skipping X509_certificate_type(): empty list of specs
2344.   #endif
2345.   	pkey=X509_get_pubkey(sc->peer_pkeys[idx].x509);
2346.   	i=X509_certificate_type(sc->peer_pkeys[idx].x509,pkey);
         ^
2347.   	EVP_PKEY_free(pkey);
2348.   

ssl/s3_clnt.c:2347:2: 
2345.   	pkey=X509_get_pubkey(sc->peer_pkeys[idx].x509);
2346.   	i=X509_certificate_type(sc->peer_pkeys[idx].x509,pkey);
2347. > 	EVP_PKEY_free(pkey);
2348.   
2349.   	

int ssl3_check_cert_and_algorithm(SSL *s)
	{
	int i,idx;
	long algs;
	EVP_PKEY *pkey=NULL;
	SESS_CERT *sc;
#ifndef OPENSSL_NO_RSA
	RSA *rsa;
#endif
#ifndef OPENSSL_NO_DH
	DH *dh;
#endif
	sc=s->session->sess_cert;
	if (sc == NULL)
		{
		SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,ERR_R_INTERNAL_ERROR);
		goto err;
		}
	algs=s->s3->tmp.new_cipher->algorithms;
	if (algs & (SSL_aDH|SSL_aNULL|SSL_aKRB5))
		return(1);
#ifndef OPENSSL_NO_RSA
	rsa=s->session->sess_cert->peer_rsa_tmp;
#endif
#ifndef OPENSSL_NO_DH
	dh=s->session->sess_cert->peer_dh_tmp;
#endif
	idx=sc->peer_cert_type;
#ifndef OPENSSL_NO_ECDH
	if (idx == SSL_PKEY_ECC)
		{
		if (check_srvr_ecc_cert_and_alg(sc->peer_pkeys[idx].x509,
		    s->s3->tmp.new_cipher) == 0)
			{
			SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_BAD_ECC_CERT);
			goto f_err;
			}
		else
			{
			return 1;
			}
		}
#endif
	pkey=X509_get_pubkey(sc->peer_pkeys[idx].x509);
	i=X509_certificate_type(sc->peer_pkeys[idx].x509,pkey);
	EVP_PKEY_free(pkey);
	if ((algs & SSL_aRSA) && !has_bits(i,EVP_PK_RSA|EVP_PKT_SIGN))
		{
		SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_MISSING_RSA_SIGNING_CERT);
		goto f_err;
		}
#ifndef OPENSSL_NO_DSA
	else if ((algs & SSL_aDSS) && !has_bits(i,EVP_PK_DSA|EVP_PKT_SIGN))
		{
		SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_MISSING_DSA_SIGNING_CERT);
		goto f_err;
		}
#endif
#ifndef OPENSSL_NO_RSA
	if ((algs & SSL_kRSA) &&
		!(has_bits(i,EVP_PK_RSA|EVP_PKT_ENC) || (rsa != NULL)))
		{
		SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_MISSING_RSA_ENCRYPTING_CERT);
		goto f_err;
		}
#endif
#ifndef OPENSSL_NO_DH
	if ((algs & SSL_kEDH) &&
		!(has_bits(i,EVP_PK_DH|EVP_PKT_EXCH) || (dh != NULL)))
		{
		SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_MISSING_DH_KEY);
		goto f_err;
		}
	else if ((algs & SSL_kDHr) && !has_bits(i,EVP_PK_DH|EVP_PKS_RSA))
		{
		SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_MISSING_DH_RSA_CERT);
		goto f_err;
		}
#ifndef OPENSSL_NO_DSA
	else if ((algs & SSL_kDHd) && !has_bits(i,EVP_PK_DH|EVP_PKS_DSA))
		{
		SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_MISSING_DH_DSA_CERT);
		goto f_err;
		}
#endif
#endif
	if (SSL_C_IS_EXPORT(s->s3->tmp.new_cipher) && !has_bits(i,EVP_PKT_EXP))
		{
#ifndef OPENSSL_NO_RSA
		if (algs & SSL_kRSA)
			{
			if (rsa == NULL
			    || RSA_size(rsa)*8 > SSL_C_EXPORT_PKEYLENGTH(s->s3->tmp.new_cipher))
				{
				SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_MISSING_EXPORT_TMP_RSA_KEY);
				goto f_err;
				}
			}
		else
#endif
#ifndef OPENSSL_NO_DH
			if (algs & (SSL_kEDH|SSL_kDHr|SSL_kDHd))
			    {
			    if (dh == NULL
				|| DH_size(dh)*8 > SSL_C_EXPORT_PKEYLENGTH(s->s3->tmp.new_cipher))
				{
				SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_MISSING_EXPORT_TMP_DH_KEY);
				goto f_err;
				}
			}
		else
#endif
			{
			SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_UNKNOWN_KEY_EXCHANGE_TYPE);
			goto f_err;
			}
		}
	return(1);
f_err:
	ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_HANDSHAKE_FAILURE);
err:
	return(0);
	}
['int ssl3_check_cert_and_algorithm(SSL *s)\n\t{\n\tint i,idx;\n\tlong algs;\n\tEVP_PKEY *pkey=NULL;\n\tSESS_CERT *sc;\n#ifndef OPENSSL_NO_RSA\n\tRSA *rsa;\n#endif\n#ifndef OPENSSL_NO_DH\n\tDH *dh;\n#endif\n\tsc=s->session->sess_cert;\n\tif (sc == NULL)\n\t\t{\n\t\tSSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,ERR_R_INTERNAL_ERROR);\n\t\tgoto err;\n\t\t}\n\talgs=s->s3->tmp.new_cipher->algorithms;\n\tif (algs & (SSL_aDH|SSL_aNULL|SSL_aKRB5))\n\t\treturn(1);\n#ifndef OPENSSL_NO_RSA\n\trsa=s->session->sess_cert->peer_rsa_tmp;\n#endif\n#ifndef OPENSSL_NO_DH\n\tdh=s->session->sess_cert->peer_dh_tmp;\n#endif\n\tidx=sc->peer_cert_type;\n#ifndef OPENSSL_NO_ECDH\n\tif (idx == SSL_PKEY_ECC)\n\t\t{\n\t\tif (check_srvr_ecc_cert_and_alg(sc->peer_pkeys[idx].x509,\n\t\t    s->s3->tmp.new_cipher) == 0)\n\t\t\t{\n\t\t\tSSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_BAD_ECC_CERT);\n\t\t\tgoto f_err;\n\t\t\t}\n\t\telse\n\t\t\t{\n\t\t\treturn 1;\n\t\t\t}\n\t\t}\n#endif\n\tpkey=X509_get_pubkey(sc->peer_pkeys[idx].x509);\n\ti=X509_certificate_type(sc->peer_pkeys[idx].x509,pkey);\n\tEVP_PKEY_free(pkey);\n\tif ((algs & SSL_aRSA) && !has_bits(i,EVP_PK_RSA|EVP_PKT_SIGN))\n\t\t{\n\t\tSSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_MISSING_RSA_SIGNING_CERT);\n\t\tgoto f_err;\n\t\t}\n#ifndef OPENSSL_NO_DSA\n\telse if ((algs & SSL_aDSS) && !has_bits(i,EVP_PK_DSA|EVP_PKT_SIGN))\n\t\t{\n\t\tSSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_MISSING_DSA_SIGNING_CERT);\n\t\tgoto f_err;\n\t\t}\n#endif\n#ifndef OPENSSL_NO_RSA\n\tif ((algs & SSL_kRSA) &&\n\t\t!(has_bits(i,EVP_PK_RSA|EVP_PKT_ENC) || (rsa != NULL)))\n\t\t{\n\t\tSSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_MISSING_RSA_ENCRYPTING_CERT);\n\t\tgoto f_err;\n\t\t}\n#endif\n#ifndef OPENSSL_NO_DH\n\tif ((algs & SSL_kEDH) &&\n\t\t!(has_bits(i,EVP_PK_DH|EVP_PKT_EXCH) || (dh != NULL)))\n\t\t{\n\t\tSSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_MISSING_DH_KEY);\n\t\tgoto f_err;\n\t\t}\n\telse if ((algs & SSL_kDHr) && !has_bits(i,EVP_PK_DH|EVP_PKS_RSA))\n\t\t{\n\t\tSSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_MISSING_DH_RSA_CERT);\n\t\tgoto f_err;\n\t\t}\n#ifndef OPENSSL_NO_DSA\n\telse if ((algs & SSL_kDHd) && !has_bits(i,EVP_PK_DH|EVP_PKS_DSA))\n\t\t{\n\t\tSSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_MISSING_DH_DSA_CERT);\n\t\tgoto f_err;\n\t\t}\n#endif\n#endif\n\tif (SSL_C_IS_EXPORT(s->s3->tmp.new_cipher) && !has_bits(i,EVP_PKT_EXP))\n\t\t{\n#ifndef OPENSSL_NO_RSA\n\t\tif (algs & SSL_kRSA)\n\t\t\t{\n\t\t\tif (rsa == NULL\n\t\t\t    || RSA_size(rsa)*8 > SSL_C_EXPORT_PKEYLENGTH(s->s3->tmp.new_cipher))\n\t\t\t\t{\n\t\t\t\tSSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_MISSING_EXPORT_TMP_RSA_KEY);\n\t\t\t\tgoto f_err;\n\t\t\t\t}\n\t\t\t}\n\t\telse\n#endif\n#ifndef OPENSSL_NO_DH\n\t\t\tif (algs & (SSL_kEDH|SSL_kDHr|SSL_kDHd))\n\t\t\t    {\n\t\t\t    if (dh == NULL\n\t\t\t\t|| DH_size(dh)*8 > SSL_C_EXPORT_PKEYLENGTH(s->s3->tmp.new_cipher))\n\t\t\t\t{\n\t\t\t\tSSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_MISSING_EXPORT_TMP_DH_KEY);\n\t\t\t\tgoto f_err;\n\t\t\t\t}\n\t\t\t}\n\t\telse\n#endif\n\t\t\t{\n\t\t\tSSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_UNKNOWN_KEY_EXCHANGE_TYPE);\n\t\t\tgoto f_err;\n\t\t\t}\n\t\t}\n\treturn(1);\nf_err:\n\tssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_HANDSHAKE_FAILURE);\nerr:\n\treturn(0);\n\t}', 'EVP_PKEY *X509_get_pubkey(X509 *x)\n\t{\n\tif ((x == NULL) || (x->cert_info == NULL))\n\t\treturn(NULL);\n\treturn(X509_PUBKEY_get(x->cert_info->key));\n\t}', 'EVP_PKEY *X509_PUBKEY_get(X509_PUBKEY *key)\n\t{\n\tEVP_PKEY *ret=NULL;\n\tlong j;\n\tint type;\n\tconst unsigned char *p;\n#if !defined(OPENSSL_NO_DSA) || !defined(OPENSSL_NO_ECDSA)\n\tconst unsigned char *cp;\n\tX509_ALGOR *a;\n#endif\n\tif (key == NULL) goto err;\n\tif (key->pkey != NULL)\n\t\t{\n\t\tCRYPTO_add(&key->pkey->references, 1, CRYPTO_LOCK_EVP_PKEY);\n\t\treturn(key->pkey);\n\t\t}\n\tif (key->public_key == NULL) goto err;\n\ttype=OBJ_obj2nid(key->algor->algorithm);\n\tif ((ret = EVP_PKEY_new()) == NULL)\n\t\t{\n\t\tX509err(X509_F_X509_PUBKEY_GET, ERR_R_MALLOC_FAILURE);\n\t\tgoto err;\n\t\t}\n\tret->type = EVP_PKEY_type(type);\n#if !defined(OPENSSL_NO_DSA) || !defined(OPENSSL_NO_ECDSA)\n\ta=key->algor;\n#endif\n\tif (0)\n\t\t;\n#ifndef OPENSSL_NO_DSA\n\telse if (ret->type == EVP_PKEY_DSA)\n\t\t{\n\t\tif (a->parameter && (a->parameter->type == V_ASN1_SEQUENCE))\n\t\t\t{\n\t\t\tif ((ret->pkey.dsa = DSA_new()) == NULL)\n\t\t\t\t{\n\t\t\t\tX509err(X509_F_X509_PUBKEY_GET, ERR_R_MALLOC_FAILURE);\n\t\t\t\tgoto err;\n\t\t\t\t}\n\t\t\tret->pkey.dsa->write_params=0;\n\t\t\tcp=p=a->parameter->value.sequence->data;\n\t\t\tj=a->parameter->value.sequence->length;\n\t\t\tif (!d2i_DSAparams(&ret->pkey.dsa, &cp, (long)j))\n\t\t\t\tgoto err;\n\t\t\t}\n\t\tret->save_parameters=1;\n\t\t}\n#endif\n#ifndef OPENSSL_NO_EC\n\telse if (ret->type == EVP_PKEY_EC)\n\t\t{\n\t\tif (a->parameter && (a->parameter->type == V_ASN1_SEQUENCE))\n\t\t\t{\n\t\t\tif ((ret->pkey.ec= EC_KEY_new()) == NULL)\n\t\t\t\t{\n\t\t\t\tX509err(X509_F_X509_PUBKEY_GET,\n\t\t\t\t\tERR_R_MALLOC_FAILURE);\n\t\t\t\tgoto err;\n\t\t\t\t}\n\t\t\tcp = p = a->parameter->value.sequence->data;\n\t\t\tj = a->parameter->value.sequence->length;\n\t\t\tif (!d2i_ECParameters(&ret->pkey.ec, &cp, (long)j))\n\t\t\t\t{\n\t\t\t\tX509err(X509_F_X509_PUBKEY_GET, ERR_R_EC_LIB);\n\t\t\t\tgoto err;\n\t\t\t\t}\n\t\t\t}\n\t\telse if (a->parameter && (a->parameter->type == V_ASN1_OBJECT))\n\t\t\t{\n\t\t\tEC_KEY   *ec_key;\n\t\t\tEC_GROUP *group;\n\t\t\tif (ret->pkey.ec == NULL)\n\t\t\t\tret->pkey.ec = EC_KEY_new();\n\t\t\tec_key = ret->pkey.ec;\n\t\t\tif (ec_key == NULL)\n\t\t\t\tgoto err;\n\t\t\tgroup = EC_GROUP_new_by_curve_name(OBJ_obj2nid(a->parameter->value.object));\n\t\t\tif (group == NULL)\n\t\t\t\tgoto err;\n\t\t\tEC_GROUP_set_asn1_flag(group, OPENSSL_EC_NAMED_CURVE);\n\t\t\tif (EC_KEY_set_group(ec_key, group) == 0)\n\t\t\t\tgoto err;\n\t\t\tEC_GROUP_free(group);\n\t\t\t}\n\t\tret->save_parameters = 1;\n\t\t}\n#endif\n\tp=key->public_key->data;\n        j=key->public_key->length;\n        if (!d2i_PublicKey(type, &ret, &p, (long)j))\n\t\t{\n\t\tX509err(X509_F_X509_PUBKEY_GET, X509_R_ERR_ASN1_LIB);\n\t\tgoto err;\n\t\t}\n\tkey->pkey = ret;\n\tCRYPTO_add(&ret->references, 1, CRYPTO_LOCK_EVP_PKEY);\n\treturn(ret);\nerr:\n\tif (ret != NULL)\n\t\tEVP_PKEY_free(ret);\n\treturn(NULL);\n\t}', 'int OBJ_obj2nid(const ASN1_OBJECT *a)\n\t{\n\tASN1_OBJECT **op;\n\tADDED_OBJ ad,*adp;\n\tif (a == NULL)\n\t\treturn(NID_undef);\n\tif (a->nid != 0)\n\t\treturn(a->nid);\n\tif (added != NULL)\n\t\t{\n\t\tad.type=ADDED_DATA;\n\t\tad.obj=(ASN1_OBJECT *)a;\n\t\tadp=(ADDED_OBJ *)lh_retrieve(added,&ad);\n\t\tif (adp != NULL) return (adp->obj->nid);\n\t\t}\n\top=(ASN1_OBJECT **)OBJ_bsearch((const char *)&a,(const char *)obj_objs,\n\t\tNUM_OBJ, sizeof(ASN1_OBJECT *),obj_cmp);\n\tif (op == NULL)\n\t\treturn(NID_undef);\n\treturn((*op)->nid);\n\t}', 'void *lh_retrieve(LHASH *lh, const void *data)\n\t{\n\tunsigned long hash;\n\tLHASH_NODE **rn;\n\tvoid *ret;\n\tlh->error=0;\n\trn=getrn(lh,data,&hash);\n\tif (*rn == NULL)\n\t\t{\n\t\tlh->num_retrieve_miss++;\n\t\treturn(NULL);\n\t\t}\n\telse\n\t\t{\n\t\tret= (*rn)->data;\n\t\tlh->num_retrieve++;\n\t\t}\n\treturn(ret);\n\t}', 'EVP_PKEY *EVP_PKEY_new(void)\n\t{\n\tEVP_PKEY *ret;\n\tret=(EVP_PKEY *)OPENSSL_malloc(sizeof(EVP_PKEY));\n\tif (ret == NULL)\n\t\t{\n\t\tEVPerr(EVP_F_EVP_PKEY_NEW,ERR_R_MALLOC_FAILURE);\n\t\treturn(NULL);\n\t\t}\n\tret->type=EVP_PKEY_NONE;\n\tret->references=1;\n\tret->pkey.ptr=NULL;\n\tret->attributes=NULL;\n\tret->save_parameters=1;\n\treturn(ret);\n\t}', 'void *CRYPTO_malloc(int num, const char *file, int line)\n\t{\n\tvoid *ret = NULL;\n\textern unsigned char cleanse_ctr;\n\tif (num <= 0) return NULL;\n\tallow_customize = 0;\n\tif (malloc_debug_func != NULL)\n\t\t{\n\t\tallow_customize_debug = 0;\n\t\tmalloc_debug_func(NULL, num, file, line, 0);\n\t\t}\n\tret = malloc_ex_func(num,file,line);\n#ifdef LEVITTE_DEBUG_MEM\n\tfprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\\n", ret, num);\n#endif\n\tif (malloc_debug_func != NULL)\n\t\tmalloc_debug_func(ret, num, file, line, 1);\n        if(ret && (num > 2048))\n                ((unsigned char *)ret)[0] = cleanse_ctr;\n\treturn ret;\n\t}', 'void ERR_put_error(int lib, int func, int reason, const char *file,\n\t     int line)\n\t{\n\tERR_STATE *es;\n#ifdef _OSD_POSIX\n\tif (strncmp(file,"*POSIX(", sizeof("*POSIX(")-1) == 0) {\n\t\tchar *end;\n\t\tfile += sizeof("*POSIX(")-1;\n\t\tend = &file[strlen(file)-1];\n\t\tif (*end == \')\')\n\t\t\t*end = \'\\0\';\n\t\tif ((end = strrchr(file, \'/\')) != NULL)\n\t\t\tfile = &end[1];\n\t}\n#endif\n\tes=ERR_get_state();\n\tes->top=(es->top+1)%ERR_NUM_ERRORS;\n\tif (es->top == es->bottom)\n\t\tes->bottom=(es->bottom+1)%ERR_NUM_ERRORS;\n\tes->err_flags[es->top]=0;\n\tes->err_buffer[es->top]=ERR_PACK(lib,func,reason);\n\tes->err_file[es->top]=file;\n\tes->err_line[es->top]=line;\n\terr_clear_data(es,es->top);\n\t}']