ssl/s2_clnt.c:955: error: NULL_DEREFERENCE
  pointer `x509` last assigned on line 903 could be null and is dereferenced by call to `X509_free()` at line 955, column 2.
Showing all 28 steps of the trace


ssl/s2_clnt.c:894:1: start of procedure ssl2_set_certificate()
892.   
893.   /* loads in the certificate from the server */
894. > int ssl2_set_certificate(SSL *s, int type, int len, unsigned char *data)
895.   	{
896.   	STACK_OF(X509) *sk=NULL;

ssl/s2_clnt.c:896:2: 
894.   int ssl2_set_certificate(SSL *s, int type, int len, unsigned char *data)
895.   	{
896. > 	STACK_OF(X509) *sk=NULL;
897.   	EVP_PKEY *pkey=NULL;
898.   	SESS_CERT *sc=NULL;

ssl/s2_clnt.c:897:2: 
895.   	{
896.   	STACK_OF(X509) *sk=NULL;
897. > 	EVP_PKEY *pkey=NULL;
898.   	SESS_CERT *sc=NULL;
899.   	int i;

ssl/s2_clnt.c:898:2: 
896.   	STACK_OF(X509) *sk=NULL;
897.   	EVP_PKEY *pkey=NULL;
898. > 	SESS_CERT *sc=NULL;
899.   	int i;
900.   	X509 *x509=NULL;

ssl/s2_clnt.c:900:2: 
898.   	SESS_CERT *sc=NULL;
899.   	int i;
900. > 	X509 *x509=NULL;
901.   	int ret=0;
902.   	

ssl/s2_clnt.c:901:2: 
899.   	int i;
900.   	X509 *x509=NULL;
901. > 	int ret=0;
902.   	
903.   	x509=d2i_X509(NULL,&data,(long)len);

ssl/s2_clnt.c:903:2: Skipping d2i_X509(): empty list of specs
901.   	int ret=0;
902.   	
903.   	x509=d2i_X509(NULL,&data,(long)len);
        ^
904.   	if (x509 == NULL)
905.   		{

ssl/s2_clnt.c:904:6: Taking true branch
902.   	
903.   	x509=d2i_X509(NULL,&data,(long)len);
904.   	if (x509 == NULL)
            ^
905.   		{
906.   		SSLerr(SSL_F_SSL2_SET_CERTIFICATE,ERR_R_X509_LIB);

ssl/s2_clnt.c:906:3: 
904.   	if (x509 == NULL)
905.   		{
906. > 		SSLerr(SSL_F_SSL2_SET_CERTIFICATE,ERR_R_X509_LIB);
907.   		goto err;
908.   		}

crypto/err/err.c:246:1: start of procedure ERR_put_error()
  244.   /********************************************************/
  245.   
  246. > void ERR_put_error(int lib, int func, int reason, const char *file,
  247.   	     int line)
  248.   	{

crypto/err/err.c:270:2: Skipping ERR_get_state(): empty list of specs
  268.   	}
  269.   #endif
  270.   	es=ERR_get_state();
          ^
  271.   
  272.   	es->top=(es->top+1)%ERR_NUM_ERRORS;

crypto/err/err.c:272:2: 
  270.   	es=ERR_get_state();
  271.   
  272. > 	es->top=(es->top+1)%ERR_NUM_ERRORS;
  273.   	if (es->top == es->bottom)
  274.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;

crypto/err/err.c:273:6: Taking false branch
  271.   
  272.   	es->top=(es->top+1)%ERR_NUM_ERRORS;
  273.   	if (es->top == es->bottom)
              ^
  274.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
  275.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);

crypto/err/err.c:275:2: 
  273.   	if (es->top == es->bottom)
  274.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
  275. > 	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
  276.   	es->err_file[es->top]=file;
  277.   	es->err_line[es->top]=line;

crypto/err/err.c:276:2: 
  274.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
  275.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
  276. > 	es->err_file[es->top]=file;
  277.   	es->err_line[es->top]=line;
  278.   	err_clear_data(es,es->top);

crypto/err/err.c:277:2: 
  275.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
  276.   	es->err_file[es->top]=file;
  277. > 	es->err_line[es->top]=line;
  278.   	err_clear_data(es,es->top);
  279.   	}

crypto/err/err.c:278:2: Taking true branch
  276.   	es->err_file[es->top]=file;
  277.   	es->err_line[es->top]=line;
  278.   	err_clear_data(es,es->top);
          ^
  279.   	}
  280.   

crypto/err/err.c:278:2: Taking false branch
  276.   	es->err_file[es->top]=file;
  277.   	es->err_line[es->top]=line;
  278.   	err_clear_data(es,es->top);
          ^
  279.   	}
  280.   

crypto/err/err.c:279:2: return from a call to ERR_put_error
  277.   	es->err_line[es->top]=line;
  278.   	err_clear_data(es,es->top);
  279.   	}
          ^
  280.   
  281.   void ERR_clear_error(void)

ssl/s2_clnt.c:953:1: 
951.   		goto err;
952.   	ret=1;
953. > err:
954.   	sk_X509_free(sk);
955.   	X509_free(x509);

ssl/s2_clnt.c:954:2: 
952.   	ret=1;
953.   err:
954. > 	sk_X509_free(sk);
955.   	X509_free(x509);
956.   	EVP_PKEY_free(pkey);

crypto/x509/x509_vfy.c:799:1: start of procedure sk_X509_free()
  797.   
  798.   
  799. > IMPLEMENT_STACK_OF(X509)
  800.   IMPLEMENT_ASN1_SET_OF(X509)
  801.   

crypto/stack/stack.c:276:1: start of procedure sk_free()
    274.   	}
    275.   
    276. > void sk_free(STACK *st)
    277.   	{
    278.   	if (st == NULL) return;

crypto/stack/stack.c:278:6: Taking true branch
    276.   void sk_free(STACK *st)
    277.   	{
    278.   	if (st == NULL) return;
                ^
    279.   	if (st->data != NULL) Free((char *)st->data);
    280.   	Free((char *)st);

crypto/stack/stack.c:278:18: 
    276.   void sk_free(STACK *st)
    277.   	{
    278. > 	if (st == NULL) return;
    279.   	if (st->data != NULL) Free((char *)st->data);
    280.   	Free((char *)st);

crypto/stack/stack.c:281:2: return from a call to sk_free
    279.   	if (st->data != NULL) Free((char *)st->data);
    280.   	Free((char *)st);
    281.   	}
            ^
    282.   
    283.   int sk_num(STACK *st)

crypto/x509/x509_vfy.c:799:1: return from a call to sk_X509_free
  797.   
  798.   
  799. > IMPLEMENT_STACK_OF(X509)
  800.   IMPLEMENT_ASN1_SET_OF(X509)
  801.   

ssl/s2_clnt.c:955:2: 
953.   err:
954.   	sk_X509_free(sk);
955. > 	X509_free(x509);
956.   	EVP_PKEY_free(pkey);
957.   	return(ret);

int ssl2_set_certificate(SSL *s, int type, int len, unsigned char *data)
	{
	STACK_OF(X509) *sk=NULL;
	EVP_PKEY *pkey=NULL;
	SESS_CERT *sc=NULL;
	int i;
	X509 *x509=NULL;
	int ret=0;
	x509=d2i_X509(NULL,&data,(long)len);
	if (x509 == NULL)
		{
		SSLerr(SSL_F_SSL2_SET_CERTIFICATE,ERR_R_X509_LIB);
		goto err;
		}
	if ((sk=sk_X509_new_null()) == NULL || !sk_X509_push(sk,x509))
		{
		SSLerr(SSL_F_SSL2_SET_CERTIFICATE,ERR_R_MALLOC_FAILURE);
		goto err;
		}
	i=ssl_verify_cert_chain(s,sk);
	if ((s->verify_mode != SSL_VERIFY_NONE) && (!i))
		{
		SSLerr(SSL_F_SSL2_SET_CERTIFICATE,SSL_R_CERTIFICATE_VERIFY_FAILED);
		goto err;
		}
	sc=ssl_sess_cert_new();
	if (sc == NULL)
		{
		ret= -1;
		goto err;
		}
	if (s->session->sess_cert) ssl_sess_cert_free(s->session->sess_cert);
	s->session->sess_cert=sc;
	sc->peer_pkeys[SSL_PKEY_RSA_ENC].x509=x509;
	sc->peer_key= &(sc->peer_pkeys[SSL_PKEY_RSA_ENC]);
	pkey=X509_get_pubkey(x509);
	x509=NULL;
	if (pkey == NULL)
		{
		SSLerr(SSL_F_SSL2_SET_CERTIFICATE,SSL_R_UNABLE_TO_EXTRACT_PUBLIC_KEY);
		goto err;
		}
	if (pkey->type != EVP_PKEY_RSA)
		{
		SSLerr(SSL_F_SSL2_SET_CERTIFICATE,SSL_R_PUBLIC_KEY_NOT_RSA);
		goto err;
		}
	if (!ssl_set_peer_cert_type(sc,SSL2_CT_X509_CERTIFICATE))
		goto err;
	ret=1;
err:
	sk_X509_free(sk);
	X509_free(x509);
	EVP_PKEY_free(pkey);
	return(ret);
	}
['int ssl2_set_certificate(SSL *s, int type, int len, unsigned char *data)\n\t{\n\tSTACK_OF(X509) *sk=NULL;\n\tEVP_PKEY *pkey=NULL;\n\tSESS_CERT *sc=NULL;\n\tint i;\n\tX509 *x509=NULL;\n\tint ret=0;\n\tx509=d2i_X509(NULL,&data,(long)len);\n\tif (x509 == NULL)\n\t\t{\n\t\tSSLerr(SSL_F_SSL2_SET_CERTIFICATE,ERR_R_X509_LIB);\n\t\tgoto err;\n\t\t}\n\tif ((sk=sk_X509_new_null()) == NULL || !sk_X509_push(sk,x509))\n\t\t{\n\t\tSSLerr(SSL_F_SSL2_SET_CERTIFICATE,ERR_R_MALLOC_FAILURE);\n\t\tgoto err;\n\t\t}\n\ti=ssl_verify_cert_chain(s,sk);\n\tif ((s->verify_mode != SSL_VERIFY_NONE) && (!i))\n\t\t{\n\t\tSSLerr(SSL_F_SSL2_SET_CERTIFICATE,SSL_R_CERTIFICATE_VERIFY_FAILED);\n\t\tgoto err;\n\t\t}\n\tsc=ssl_sess_cert_new();\n\tif (sc == NULL)\n\t\t{\n\t\tret= -1;\n\t\tgoto err;\n\t\t}\n\tif (s->session->sess_cert) ssl_sess_cert_free(s->session->sess_cert);\n\ts->session->sess_cert=sc;\n\tsc->peer_pkeys[SSL_PKEY_RSA_ENC].x509=x509;\n\tsc->peer_key= &(sc->peer_pkeys[SSL_PKEY_RSA_ENC]);\n\tpkey=X509_get_pubkey(x509);\n\tx509=NULL;\n\tif (pkey == NULL)\n\t\t{\n\t\tSSLerr(SSL_F_SSL2_SET_CERTIFICATE,SSL_R_UNABLE_TO_EXTRACT_PUBLIC_KEY);\n\t\tgoto err;\n\t\t}\n\tif (pkey->type != EVP_PKEY_RSA)\n\t\t{\n\t\tSSLerr(SSL_F_SSL2_SET_CERTIFICATE,SSL_R_PUBLIC_KEY_NOT_RSA);\n\t\tgoto err;\n\t\t}\n\tif (!ssl_set_peer_cert_type(sc,SSL2_CT_X509_CERTIFICATE))\n\t\tgoto err;\n\tret=1;\nerr:\n\tsk_X509_free(sk);\n\tX509_free(x509);\n\tEVP_PKEY_free(pkey);\n\treturn(ret);\n\t}', 'void ERR_put_error(int lib, int func, int reason, const char *file,\n\t     int line)\n\t{\n\tERR_STATE *es;\n#ifdef _OSD_POSIX\n\tif (strncmp(file,"*POSIX(", sizeof("*POSIX(")-1) == 0) {\n\t\tchar *end;\n\t\tfile += sizeof("*POSIX(")-1;\n\t\tend = &file[strlen(file)-1];\n\t\tif (*end == \')\')\n\t\t\t*end = \'\\0\';\n\t\tif ((end = strrchr(file, \'/\')) != NULL)\n\t\t\tfile = &end[1];\n\t}\n#endif\n\tes=ERR_get_state();\n\tes->top=(es->top+1)%ERR_NUM_ERRORS;\n\tif (es->top == es->bottom)\n\t\tes->bottom=(es->bottom+1)%ERR_NUM_ERRORS;\n\tes->err_buffer[es->top]=ERR_PACK(lib,func,reason);\n\tes->err_file[es->top]=file;\n\tes->err_line[es->top]=line;\n\terr_clear_data(es,es->top);\n\t}', 'IMPLEMENT_STACK_OF(X509)', 'void sk_free(STACK *st)\n\t{\n\tif (st == NULL) return;\n\tif (st->data != NULL) Free((char *)st->data);\n\tFree((char *)st);\n\t}']