ssl/s3_srvr.c:1500: error: NULL_DEREFERENCE
  pointer `pkey` last assigned on line 1387 could be null and is dereferenced by call to `EVP_PKEY_free()` at line 1500, column 2.
Showing all 68 steps of the trace


ssl/s3_srvr.c:1366:1: start of procedure ssl3_get_cert_verify()
1364.   	}
1365.   
1366. > static int ssl3_get_cert_verify(SSL *s)
1367.   	{
1368.   	EVP_PKEY *pkey=NULL;

ssl/s3_srvr.c:1368:2: 
1366.   static int ssl3_get_cert_verify(SSL *s)
1367.   	{
1368. > 	EVP_PKEY *pkey=NULL;
1369.   	unsigned char *p;
1370.   	int al,ok,ret=0;

ssl/s3_srvr.c:1370:2: 
1368.   	EVP_PKEY *pkey=NULL;
1369.   	unsigned char *p;
1370. > 	int al,ok,ret=0;
1371.   	long n;
1372.   	int type=0,i,j;

ssl/s3_srvr.c:1372:2: 
1370.   	int al,ok,ret=0;
1371.   	long n;
1372. > 	int type=0,i,j;
1373.   	X509 *peer;
1374.   

ssl/s3_srvr.c:1375:2: Skipping ssl3_get_message(): empty list of specs
1373.   	X509 *peer;
1374.   
1375.   	n=ssl3_get_message(s,
         ^
1376.   		SSL3_ST_SR_CERT_VRFY_A,
1377.   		SSL3_ST_SR_CERT_VRFY_B,

ssl/s3_srvr.c:1382:7: Taking false branch
1380.   		&ok);
1381.   
1382.   	if (!ok) return((int)n);
              ^
1383.   
1384.   	if (s->session->peer != NULL)

ssl/s3_srvr.c:1384:6: Taking true branch
1382.   	if (!ok) return((int)n);
1383.   
1384.   	if (s->session->peer != NULL)
             ^
1385.   		{
1386.   		peer=s->session->peer;

ssl/s3_srvr.c:1386:3: 
1384.   	if (s->session->peer != NULL)
1385.   		{
1386. > 		peer=s->session->peer;
1387.   		pkey=X509_get_pubkey(peer);
1388.   		type=X509_certificate_type(peer,pkey);

ssl/s3_srvr.c:1387:3: 
1385.   		{
1386.   		peer=s->session->peer;
1387. > 		pkey=X509_get_pubkey(peer);
1388.   		type=X509_certificate_type(peer,pkey);
1389.   		}

crypto/x509/x509_cmp.c:250:1: start of procedure X509_get_pubkey()
  248.   	}
  249.   
  250. > EVP_PKEY *X509_get_pubkey(X509 *x)
  251.   	{
  252.   	if ((x == NULL) || (x->cert_info == NULL))

crypto/x509/x509_cmp.c:252:7: Taking false branch
  250.   EVP_PKEY *X509_get_pubkey(X509 *x)
  251.   	{
  252.   	if ((x == NULL) || (x->cert_info == NULL))
               ^
  253.   		return(NULL);
  254.   	return(X509_PUBKEY_get(x->cert_info->key));

crypto/x509/x509_cmp.c:252:22: Taking true branch
  250.   EVP_PKEY *X509_get_pubkey(X509 *x)
  251.   	{
  252.   	if ((x == NULL) || (x->cert_info == NULL))
                              ^
  253.   		return(NULL);
  254.   	return(X509_PUBKEY_get(x->cert_info->key));

crypto/x509/x509_cmp.c:253:3: 
  251.   	{
  252.   	if ((x == NULL) || (x->cert_info == NULL))
  253. > 		return(NULL);
  254.   	return(X509_PUBKEY_get(x->cert_info->key));
  255.   	}

crypto/x509/x509_cmp.c:255:2: return from a call to X509_get_pubkey
  253.   		return(NULL);
  254.   	return(X509_PUBKEY_get(x->cert_info->key));
  255.   	}
          ^
  256.   
  257.   int X509_check_private_key(X509 *x, EVP_PKEY *k)

ssl/s3_srvr.c:1388:3: Skipping X509_certificate_type(): empty list of specs
1386.   		peer=s->session->peer;
1387.   		pkey=X509_get_pubkey(peer);
1388.   		type=X509_certificate_type(peer,pkey);
          ^
1389.   		}
1390.   	else

ssl/s3_srvr.c:1396:6: Taking false branch
1394.   		}
1395.   
1396.   	if (s->s3->tmp.message_type != SSL3_MT_CERTIFICATE_VERIFY)
             ^
1397.   		{
1398.   		s->s3->tmp.reuse_message=1;

ssl/s3_srvr.c:1409:6: Taking false branch
1407.   		}
1408.   
1409.   	if (peer == NULL)
             ^
1410.   		{
1411.   		SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_NO_CLIENT_CERT_RECEIVED);

ssl/s3_srvr.c:1416:8: Taking false branch
1414.   		}
1415.   
1416.   	if (!(type & EVP_PKT_SIGN))
               ^
1417.   		{
1418.   		SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_SIGNATURE_FOR_NON_SIGNING_CERTIFICATE);

ssl/s3_srvr.c:1423:6: Taking false branch
1421.   		}
1422.   
1423.   	if (s->s3->change_cipher_spec)
             ^
1424.   		{
1425.   		SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_CCS_RECEIVED_EARLY);

ssl/s3_srvr.c:1431:2: 
1429.   
1430.   	/* we now have a signature that we need to verify */
1431. > 	p=(unsigned char *)s->init_buf->data;
1432.   	n2s(p,i);
1433.   	n-=2;

ssl/s3_srvr.c:1432:2: 
1430.   	/* we now have a signature that we need to verify */
1431.   	p=(unsigned char *)s->init_buf->data;
1432. > 	n2s(p,i);
1433.   	n-=2;
1434.   	if (i > n)

ssl/s3_srvr.c:1433:2: 
1431.   	p=(unsigned char *)s->init_buf->data;
1432.   	n2s(p,i);
1433. > 	n-=2;
1434.   	if (i > n)
1435.   		{

ssl/s3_srvr.c:1434:6: Taking true branch
1432.   	n2s(p,i);
1433.   	n-=2;
1434.   	if (i > n)
             ^
1435.   		{
1436.   		SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_LENGTH_MISMATCH);

ssl/s3_srvr.c:1436:3: 
1434.   	if (i > n)
1435.   		{
1436. > 		SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_LENGTH_MISMATCH);
1437.   		al=SSL_AD_DECODE_ERROR;
1438.   		goto f_err;

crypto/err/err.c:245:1: start of procedure ERR_put_error()
  243.   /********************************************************/
  244.   
  245. > void ERR_put_error(int lib, int func, int reason, const char *file,
  246.   	     int line)
  247.   	{

crypto/err/err.c:269:2: Skipping ERR_get_state(): empty list of specs
  267.   	}
  268.   #endif
  269.   	es=ERR_get_state();
          ^
  270.   
  271.   	es->top=(es->top+1)%ERR_NUM_ERRORS;

crypto/err/err.c:271:2: 
  269.   	es=ERR_get_state();
  270.   
  271. > 	es->top=(es->top+1)%ERR_NUM_ERRORS;
  272.   	if (es->top == es->bottom)
  273.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;

crypto/err/err.c:272:6: Taking false branch
  270.   
  271.   	es->top=(es->top+1)%ERR_NUM_ERRORS;
  272.   	if (es->top == es->bottom)
              ^
  273.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
  274.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);

crypto/err/err.c:274:2: 
  272.   	if (es->top == es->bottom)
  273.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
  274. > 	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
  275.   	es->err_file[es->top]=file;
  276.   	es->err_line[es->top]=line;

crypto/err/err.c:275:2: 
  273.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
  274.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
  275. > 	es->err_file[es->top]=file;
  276.   	es->err_line[es->top]=line;
  277.   	err_clear_data(es,es->top);

crypto/err/err.c:276:2: 
  274.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
  275.   	es->err_file[es->top]=file;
  276. > 	es->err_line[es->top]=line;
  277.   	err_clear_data(es,es->top);
  278.   	}

crypto/err/err.c:277:2: Taking true branch
  275.   	es->err_file[es->top]=file;
  276.   	es->err_line[es->top]=line;
  277.   	err_clear_data(es,es->top);
          ^
  278.   	}
  279.   

crypto/err/err.c:277:2: Taking false branch
  275.   	es->err_file[es->top]=file;
  276.   	es->err_line[es->top]=line;
  277.   	err_clear_data(es,es->top);
          ^
  278.   	}
  279.   

crypto/err/err.c:278:2: return from a call to ERR_put_error
  276.   	es->err_line[es->top]=line;
  277.   	err_clear_data(es,es->top);
  278.   	}
          ^
  279.   
  280.   void ERR_clear_error(void)

ssl/s3_srvr.c:1437:3: 
1435.   		{
1436.   		SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_LENGTH_MISMATCH);
1437. > 		al=SSL_AD_DECODE_ERROR;
1438.   		goto f_err;
1439.   		}

ssl/s3_srvr.c:1496:1: 
1494.   	if (0)
1495.   		{
1496. > f_err:
1497.   		ssl3_send_alert(s,SSL3_AL_FATAL,al);
1498.   		}

ssl/s3_srvr.c:1497:3: 
1495.   		{
1496.   f_err:
1497. > 		ssl3_send_alert(s,SSL3_AL_FATAL,al);
1498.   		}
1499.   end:

ssl/s3_pkt.c:991:1: start of procedure ssl3_send_alert()
  989.   	}
  990.   
  991. > void ssl3_send_alert(SSL *s, int level, int desc)
  992.   	{
  993.   	/* Map tls/ssl alert value to correct one */

ssl/s3_pkt.c:994:2: Skipping __function_pointer__(): unresolved function pointer
  992.   	{
  993.   	/* Map tls/ssl alert value to correct one */
  994.   	desc=s->method->ssl3_enc->alert_value(desc);
          ^
  995.   	if (desc < 0) return;
  996.   	/* If a fatal one, remove from cache */

ssl/s3_pkt.c:995:6: Taking false branch
  993.   	/* Map tls/ssl alert value to correct one */
  994.   	desc=s->method->ssl3_enc->alert_value(desc);
  995.   	if (desc < 0) return;
              ^
  996.   	/* If a fatal one, remove from cache */
  997.   	if ((level == 2) && (s->session != NULL))

ssl/s3_pkt.c:997:7: Taking true branch
  995.   	if (desc < 0) return;
  996.   	/* If a fatal one, remove from cache */
  997.   	if ((level == 2) && (s->session != NULL))
                ^
  998.   		SSL_CTX_remove_session(s->ctx,s->session);
  999.   

ssl/s3_pkt.c:997:23: Taking true branch
  995.   	if (desc < 0) return;
  996.   	/* If a fatal one, remove from cache */
  997.   	if ((level == 2) && (s->session != NULL))
                                ^
  998.   		SSL_CTX_remove_session(s->ctx,s->session);
  999.   

ssl/s3_pkt.c:998:3: 
  996.   	/* If a fatal one, remove from cache */
  997.   	if ((level == 2) && (s->session != NULL))
  998. > 		SSL_CTX_remove_session(s->ctx,s->session);
  999.   
  1000.   	s->s3->alert_dispatch=1;

ssl/ssl_sess.c:395:1: start of procedure SSL_CTX_remove_session()
    393.   	}
    394.   
    395. > int SSL_CTX_remove_session(SSL_CTX *ctx, SSL_SESSION *c)
    396.   {
    397.   	return remove_session_lock(ctx, c, 1);

ssl/ssl_sess.c:397:2: 
    395.   int SSL_CTX_remove_session(SSL_CTX *ctx, SSL_SESSION *c)
    396.   {
    397. > 	return remove_session_lock(ctx, c, 1);
    398.   }
    399.   

ssl/ssl_sess.c:400:1: start of procedure remove_session_lock()
      398.   }
      399.   
      400. > static int remove_session_lock(SSL_CTX *ctx, SSL_SESSION *c, int lck)
      401.   	{
      402.   	SSL_SESSION *r;

ssl/ssl_sess.c:403:2: 
      401.   	{
      402.   	SSL_SESSION *r;
      403. > 	int ret=0;
      404.   
      405.   	if ((c != NULL) && (c->session_id_length != 0))

ssl/ssl_sess.c:405:7: Taking true branch
      403.   	int ret=0;
      404.   
      405.   	if ((c != NULL) && (c->session_id_length != 0))
                   ^
      406.   		{
      407.   		if(lck) CRYPTO_w_lock(CRYPTO_LOCK_SSL_CTX);

ssl/ssl_sess.c:405:22: Taking false branch
      403.   	int ret=0;
      404.   
      405.   	if ((c != NULL) && (c->session_id_length != 0))
                                  ^
      406.   		{
      407.   		if(lck) CRYPTO_w_lock(CRYPTO_LOCK_SSL_CTX);

ssl/ssl_sess.c:426:3: 
      424.   		}
      425.   	else
      426. > 		ret=0;
      427.   	return(ret);
      428.   	}

ssl/ssl_sess.c:427:2: 
      425.   	else
      426.   		ret=0;
      427. > 	return(ret);
      428.   	}
      429.   

ssl/ssl_sess.c:428:2: return from a call to remove_session_lock
      426.   		ret=0;
      427.   	return(ret);
      428.   	}
              ^
      429.   
      430.   void SSL_SESSION_free(SSL_SESSION *ss)

ssl/ssl_sess.c:398:1: return from a call to SSL_CTX_remove_session
    396.   {
    397.   	return remove_session_lock(ctx, c, 1);
    398. > }
    399.   
    400.   static int remove_session_lock(SSL_CTX *ctx, SSL_SESSION *c, int lck)

ssl/s3_pkt.c:1000:2: 
  998.   		SSL_CTX_remove_session(s->ctx,s->session);
  999.   
  1000. > 	s->s3->alert_dispatch=1;
  1001.   	s->s3->send_alert[0]=level;
  1002.   	s->s3->send_alert[1]=desc;

ssl/s3_pkt.c:1001:2: 
  999.   
  1000.   	s->s3->alert_dispatch=1;
  1001. > 	s->s3->send_alert[0]=level;
  1002.   	s->s3->send_alert[1]=desc;
  1003.   	if (s->s3->wbuf.left == 0) /* data still being written out */

ssl/s3_pkt.c:1002:2: 
  1000.   	s->s3->alert_dispatch=1;
  1001.   	s->s3->send_alert[0]=level;
  1002. > 	s->s3->send_alert[1]=desc;
  1003.   	if (s->s3->wbuf.left == 0) /* data still being written out */
  1004.   		ssl3_dispatch_alert(s);

ssl/s3_pkt.c:1003:6: Taking false branch
  1001.   	s->s3->send_alert[0]=level;
  1002.   	s->s3->send_alert[1]=desc;
  1003.   	if (s->s3->wbuf.left == 0) /* data still being written out */
               ^
  1004.   		ssl3_dispatch_alert(s);
  1005.   	/* else data is still being written out, we will get written

ssl/s3_pkt.c:1003:2: 
  1001.   	s->s3->send_alert[0]=level;
  1002.   	s->s3->send_alert[1]=desc;
  1003. > 	if (s->s3->wbuf.left == 0) /* data still being written out */
  1004.   		ssl3_dispatch_alert(s);
  1005.   	/* else data is still being written out, we will get written

ssl/s3_pkt.c:1007:2: return from a call to ssl3_send_alert
  1005.   	/* else data is still being written out, we will get written
  1006.   	 * some time in the future */
  1007.   	}
           ^
  1008.   
  1009.   int ssl3_dispatch_alert(SSL *s)

ssl/s3_srvr.c:1499:1: 
1497.   		ssl3_send_alert(s,SSL3_AL_FATAL,al);
1498.   		}
1499. > end:
1500.   	EVP_PKEY_free(pkey);
1501.   	return(ret);

ssl/s3_srvr.c:1500:2: 
1498.   		}
1499.   end:
1500. > 	EVP_PKEY_free(pkey);
1501.   	return(ret);
1502.   	}

crypto/evp/p_lib.c:286:1: start of procedure EVP_PKEY_free()
  284.   	}
  285.   
  286. > void EVP_PKEY_free(EVP_PKEY *x)
  287.   	{
  288.   	int i;

crypto/evp/p_lib.c:290:6: Taking false branch
  288.   	int i;
  289.   
  290.   	if (x == NULL) return;
              ^
  291.   
  292.   	i=CRYPTO_add(&x->references,-1,CRYPTO_LOCK_EVP_PKEY);

crypto/evp/p_lib.c:292:2: 
  290.   	if (x == NULL) return;
  291.   
  292. > 	i=CRYPTO_add(&x->references,-1,CRYPTO_LOCK_EVP_PKEY);
  293.   #ifdef REF_PRINT
  294.   	REF_PRINT("EVP_PKEY",x);

crypto/cryptlib.c:226:1: start of procedure CRYPTO_add_lock()
    224.   	}
    225.   
    226. > int CRYPTO_add_lock(int *pointer, int amount, int type, const char *file,
    227.   	     int line)
    228.   	{

crypto/cryptlib.c:231:6: Taking true branch
    229.   	int ret;
    230.   
    231.   	if (add_lock_callback != NULL)
                ^
    232.   		{
    233.   #ifdef LOCK_DEBUG

crypto/cryptlib.c:237:3: Skipping __function_pointer__(): unresolved function pointer
    235.   #endif
    236.   
    237.   		ret=add_lock_callback(pointer,amount,type,file,line);
             ^
    238.   #ifdef LOCK_DEBUG
    239.   		fprintf(stderr,"ladd:%08lx:%2d+%2d->%2d %-18s %s:%d\n",

crypto/cryptlib.c:245:3: 
    243.   			file,line);
    244.   #endif
    245. > 		*pointer=ret;
    246.   		}
    247.   	else

static int ssl3_get_cert_verify(SSL *s)
	{
	EVP_PKEY *pkey=NULL;
	unsigned char *p;
	int al,ok,ret=0;
	long n;
	int type=0,i,j;
	X509 *peer;
	n=ssl3_get_message(s,
		SSL3_ST_SR_CERT_VRFY_A,
		SSL3_ST_SR_CERT_VRFY_B,
		-1,
		512,
		&ok);
	if (!ok) return((int)n);
	if (s->session->peer != NULL)
		{
		peer=s->session->peer;
		pkey=X509_get_pubkey(peer);
		type=X509_certificate_type(peer,pkey);
		}
	else
		{
		peer=NULL;
		pkey=NULL;
		}
	if (s->s3->tmp.message_type != SSL3_MT_CERTIFICATE_VERIFY)
		{
		s->s3->tmp.reuse_message=1;
		if ((peer != NULL) && (type | EVP_PKT_SIGN))
			{
			al=SSL_AD_UNEXPECTED_MESSAGE;
			SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_MISSING_VERIFY_MESSAGE);
			goto f_err;
			}
		ret=1;
		goto end;
		}
	if (peer == NULL)
		{
		SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_NO_CLIENT_CERT_RECEIVED);
		al=SSL_AD_UNEXPECTED_MESSAGE;
		goto f_err;
		}
	if (!(type & EVP_PKT_SIGN))
		{
		SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_SIGNATURE_FOR_NON_SIGNING_CERTIFICATE);
		al=SSL_AD_ILLEGAL_PARAMETER;
		goto f_err;
		}
	if (s->s3->change_cipher_spec)
		{
		SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_CCS_RECEIVED_EARLY);
		al=SSL_AD_UNEXPECTED_MESSAGE;
		goto f_err;
		}
	p=(unsigned char *)s->init_buf->data;
	n2s(p,i);
	n-=2;
	if (i > n)
		{
		SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_LENGTH_MISMATCH);
		al=SSL_AD_DECODE_ERROR;
		goto f_err;
		}
	j=EVP_PKEY_size(pkey);
	if ((i > j) || (n > j) || (n <= 0))
		{
		SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_WRONG_SIGNATURE_SIZE);
		al=SSL_AD_DECODE_ERROR;
		goto f_err;
		}
#ifndef NO_RSA
	if (pkey->type == EVP_PKEY_RSA)
		{
		i=RSA_verify(NID_md5_sha1, s->s3->tmp.finish_md,
			MD5_DIGEST_LENGTH+SHA_DIGEST_LENGTH, p, i,
							pkey->pkey.rsa);
		if (i < 0)
			{
			al=SSL_AD_DECRYPT_ERROR;
			SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_BAD_RSA_DECRYPT);
			goto f_err;
			}
		if (i == 0)
			{
			al=SSL_AD_DECRYPT_ERROR;
			SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_BAD_RSA_SIGNATURE);
			goto f_err;
			}
		}
	else
#endif
#ifndef NO_DSA
		if (pkey->type == EVP_PKEY_DSA)
		{
		j=DSA_verify(pkey->save_type,
			&(s->s3->tmp.finish_md[MD5_DIGEST_LENGTH]),
			SHA_DIGEST_LENGTH,p,i,pkey->pkey.dsa);
		if (j <= 0)
			{
			al=SSL_AD_DECRYPT_ERROR;
			SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_BAD_DSA_SIGNATURE);
			goto f_err;
			}
		}
	else
#endif
		{
		SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_INTERNAL_ERROR);
		al=SSL_AD_UNSUPPORTED_CERTIFICATE;
		goto f_err;
		}
	ret=1;
	if (0)
		{
f_err:
		ssl3_send_alert(s,SSL3_AL_FATAL,al);
		}
end:
	EVP_PKEY_free(pkey);
	return(ret);
	}
['static int ssl3_get_cert_verify(SSL *s)\n\t{\n\tEVP_PKEY *pkey=NULL;\n\tunsigned char *p;\n\tint al,ok,ret=0;\n\tlong n;\n\tint type=0,i,j;\n\tX509 *peer;\n\tn=ssl3_get_message(s,\n\t\tSSL3_ST_SR_CERT_VRFY_A,\n\t\tSSL3_ST_SR_CERT_VRFY_B,\n\t\t-1,\n\t\t512,\n\t\t&ok);\n\tif (!ok) return((int)n);\n\tif (s->session->peer != NULL)\n\t\t{\n\t\tpeer=s->session->peer;\n\t\tpkey=X509_get_pubkey(peer);\n\t\ttype=X509_certificate_type(peer,pkey);\n\t\t}\n\telse\n\t\t{\n\t\tpeer=NULL;\n\t\tpkey=NULL;\n\t\t}\n\tif (s->s3->tmp.message_type != SSL3_MT_CERTIFICATE_VERIFY)\n\t\t{\n\t\ts->s3->tmp.reuse_message=1;\n\t\tif ((peer != NULL) && (type | EVP_PKT_SIGN))\n\t\t\t{\n\t\t\tal=SSL_AD_UNEXPECTED_MESSAGE;\n\t\t\tSSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_MISSING_VERIFY_MESSAGE);\n\t\t\tgoto f_err;\n\t\t\t}\n\t\tret=1;\n\t\tgoto end;\n\t\t}\n\tif (peer == NULL)\n\t\t{\n\t\tSSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_NO_CLIENT_CERT_RECEIVED);\n\t\tal=SSL_AD_UNEXPECTED_MESSAGE;\n\t\tgoto f_err;\n\t\t}\n\tif (!(type & EVP_PKT_SIGN))\n\t\t{\n\t\tSSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_SIGNATURE_FOR_NON_SIGNING_CERTIFICATE);\n\t\tal=SSL_AD_ILLEGAL_PARAMETER;\n\t\tgoto f_err;\n\t\t}\n\tif (s->s3->change_cipher_spec)\n\t\t{\n\t\tSSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_CCS_RECEIVED_EARLY);\n\t\tal=SSL_AD_UNEXPECTED_MESSAGE;\n\t\tgoto f_err;\n\t\t}\n\tp=(unsigned char *)s->init_buf->data;\n\tn2s(p,i);\n\tn-=2;\n\tif (i > n)\n\t\t{\n\t\tSSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_LENGTH_MISMATCH);\n\t\tal=SSL_AD_DECODE_ERROR;\n\t\tgoto f_err;\n\t\t}\n\tj=EVP_PKEY_size(pkey);\n\tif ((i > j) || (n > j) || (n <= 0))\n\t\t{\n\t\tSSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_WRONG_SIGNATURE_SIZE);\n\t\tal=SSL_AD_DECODE_ERROR;\n\t\tgoto f_err;\n\t\t}\n#ifndef NO_RSA\n\tif (pkey->type == EVP_PKEY_RSA)\n\t\t{\n\t\ti=RSA_verify(NID_md5_sha1, s->s3->tmp.finish_md,\n\t\t\tMD5_DIGEST_LENGTH+SHA_DIGEST_LENGTH, p, i,\n\t\t\t\t\t\t\tpkey->pkey.rsa);\n\t\tif (i < 0)\n\t\t\t{\n\t\t\tal=SSL_AD_DECRYPT_ERROR;\n\t\t\tSSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_BAD_RSA_DECRYPT);\n\t\t\tgoto f_err;\n\t\t\t}\n\t\tif (i == 0)\n\t\t\t{\n\t\t\tal=SSL_AD_DECRYPT_ERROR;\n\t\t\tSSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_BAD_RSA_SIGNATURE);\n\t\t\tgoto f_err;\n\t\t\t}\n\t\t}\n\telse\n#endif\n#ifndef NO_DSA\n\t\tif (pkey->type == EVP_PKEY_DSA)\n\t\t{\n\t\tj=DSA_verify(pkey->save_type,\n\t\t\t&(s->s3->tmp.finish_md[MD5_DIGEST_LENGTH]),\n\t\t\tSHA_DIGEST_LENGTH,p,i,pkey->pkey.dsa);\n\t\tif (j <= 0)\n\t\t\t{\n\t\t\tal=SSL_AD_DECRYPT_ERROR;\n\t\t\tSSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_BAD_DSA_SIGNATURE);\n\t\t\tgoto f_err;\n\t\t\t}\n\t\t}\n\telse\n#endif\n\t\t{\n\t\tSSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_INTERNAL_ERROR);\n\t\tal=SSL_AD_UNSUPPORTED_CERTIFICATE;\n\t\tgoto f_err;\n\t\t}\n\tret=1;\n\tif (0)\n\t\t{\nf_err:\n\t\tssl3_send_alert(s,SSL3_AL_FATAL,al);\n\t\t}\nend:\n\tEVP_PKEY_free(pkey);\n\treturn(ret);\n\t}', 'EVP_PKEY *X509_get_pubkey(X509 *x)\n\t{\n\tif ((x == NULL) || (x->cert_info == NULL))\n\t\treturn(NULL);\n\treturn(X509_PUBKEY_get(x->cert_info->key));\n\t}', 'void ERR_put_error(int lib, int func, int reason, const char *file,\n\t     int line)\n\t{\n\tERR_STATE *es;\n#ifdef _OSD_POSIX\n\tif (strncmp(file,"*POSIX(", sizeof("*POSIX(")-1) == 0) {\n\t\tchar *end;\n\t\tfile += sizeof("*POSIX(")-1;\n\t\tend = &file[strlen(file)-1];\n\t\tif (*end == \')\')\n\t\t\t*end = \'\\0\';\n\t\tif ((end = strrchr(file, \'/\')) != NULL)\n\t\t\tfile = &end[1];\n\t}\n#endif\n\tes=ERR_get_state();\n\tes->top=(es->top+1)%ERR_NUM_ERRORS;\n\tif (es->top == es->bottom)\n\t\tes->bottom=(es->bottom+1)%ERR_NUM_ERRORS;\n\tes->err_buffer[es->top]=ERR_PACK(lib,func,reason);\n\tes->err_file[es->top]=file;\n\tes->err_line[es->top]=line;\n\terr_clear_data(es,es->top);\n\t}', 'void ssl3_send_alert(SSL *s, int level, int desc)\n\t{\n\tdesc=s->method->ssl3_enc->alert_value(desc);\n\tif (desc < 0) return;\n\tif ((level == 2) && (s->session != NULL))\n\t\tSSL_CTX_remove_session(s->ctx,s->session);\n\ts->s3->alert_dispatch=1;\n\ts->s3->send_alert[0]=level;\n\ts->s3->send_alert[1]=desc;\n\tif (s->s3->wbuf.left == 0)\n\t\tssl3_dispatch_alert(s);\n\t}', 'int SSL_CTX_remove_session(SSL_CTX *ctx, SSL_SESSION *c)\n{\n\treturn remove_session_lock(ctx, c, 1);\n}', 'static int remove_session_lock(SSL_CTX *ctx, SSL_SESSION *c, int lck)\n\t{\n\tSSL_SESSION *r;\n\tint ret=0;\n\tif ((c != NULL) && (c->session_id_length != 0))\n\t\t{\n\t\tif(lck) CRYPTO_w_lock(CRYPTO_LOCK_SSL_CTX);\n\t\tr=(SSL_SESSION *)lh_delete(ctx->sessions,(char *)c);\n\t\tif (r != NULL)\n\t\t\t{\n\t\t\tret=1;\n\t\t\tSSL_SESSION_list_remove(ctx,c);\n\t\t\t}\n\t\tif(lck) CRYPTO_w_unlock(CRYPTO_LOCK_SSL_CTX);\n\t\tif (ret)\n\t\t\t{\n\t\t\tr->not_resumable=1;\n\t\t\tif (ctx->remove_session_cb != NULL)\n\t\t\t\tctx->remove_session_cb(ctx,r);\n\t\t\tSSL_SESSION_free(r);\n\t\t\t}\n\t\t}\n\telse\n\t\tret=0;\n\treturn(ret);\n\t}', 'void EVP_PKEY_free(EVP_PKEY *x)\n\t{\n\tint i;\n\tif (x == NULL) return;\n\ti=CRYPTO_add(&x->references,-1,CRYPTO_LOCK_EVP_PKEY);\n#ifdef REF_PRINT\n\tREF_PRINT("EVP_PKEY",x);\n#endif\n\tif (i > 0) return;\n#ifdef REF_CHECK\n\tif (i < 0)\n\t\t{\n\t\tfprintf(stderr,"EVP_PKEY_free, bad reference count\\n");\n\t\tabort();\n\t\t}\n#endif\n\tEVP_PKEY_free_it(x);\n\tFree((char *)x);\n\t}', 'int CRYPTO_add_lock(int *pointer, int amount, int type, const char *file,\n\t     int line)\n\t{\n\tint ret;\n\tif (add_lock_callback != NULL)\n\t\t{\n#ifdef LOCK_DEBUG\n\t\tint before= *pointer;\n#endif\n\t\tret=add_lock_callback(pointer,amount,type,file,line);\n#ifdef LOCK_DEBUG\n\t\tfprintf(stderr,"ladd:%08lx:%2d+%2d->%2d %-18s %s:%d\\n",\n\t\t\tCRYPTO_thread_id(),\n\t\t\tbefore,amount,ret,\n\t\t\tCRYPTO_get_lock_name(type),\n\t\t\tfile,line);\n#endif\n\t\t*pointer=ret;\n\t\t}\n\telse\n\t\t{\n\t\tCRYPTO_lock(CRYPTO_LOCK|CRYPTO_WRITE,type,file,line);\n\t\tret= *pointer+amount;\n#ifdef LOCK_DEBUG\n\t\tfprintf(stderr,"ladd:%08lx:%2d+%2d->%2d %-18s %s:%d\\n",\n\t\t\tCRYPTO_thread_id(),\n\t\t\t*pointer,amount,ret,\n\t\t\tCRYPTO_get_lock_name(type),\n\t\t\tfile,line);\n#endif\n\t\t*pointer=ret;\n\t\tCRYPTO_lock(CRYPTO_UNLOCK|CRYPTO_WRITE,type,file,line);\n\t\t}\n\treturn(ret);\n\t}']