apps/x509.c:912: error: NULL_DEREFERENCE
  pointer `upkey` last assigned on line 910 could be null and is dereferenced by call to `EVP_PKEY_free()` at line 912, column 2.
Showing all 14 steps of the trace


apps/x509.c:897:1: start of procedure x509_certify()
895.   	}
896.   
897. > static int x509_certify(X509_STORE *ctx, char *CAfile, const EVP_MD *digest,
898.   	     X509 *x, X509 *xca, EVP_PKEY *pkey, char *serialfile, int create,
899.   	     int days, int clrext, LHASH *conf, char *section)

apps/x509.c:901:2: 
899.   	     int days, int clrext, LHASH *conf, char *section)
900.   	{
901. > 	int ret=0;
902.   	BIO *io=NULL;
903.   	MS_STATIC char buf2[1024];

apps/x509.c:902:2: 
900.   	{
901.   	int ret=0;
902. > 	BIO *io=NULL;
903.   	MS_STATIC char buf2[1024];
904.   	char *buf=NULL,*p;

apps/x509.c:904:2: 
902.   	BIO *io=NULL;
903.   	MS_STATIC char buf2[1024];
904. > 	char *buf=NULL,*p;
905.   	BIGNUM *serial=NULL;
906.   	ASN1_INTEGER *bs=NULL,bs2;

apps/x509.c:905:2: 
903.   	MS_STATIC char buf2[1024];
904.   	char *buf=NULL,*p;
905. > 	BIGNUM *serial=NULL;
906.   	ASN1_INTEGER *bs=NULL,bs2;
907.   	X509_STORE_CTX xsc;

apps/x509.c:906:2: 
904.   	char *buf=NULL,*p;
905.   	BIGNUM *serial=NULL;
906. > 	ASN1_INTEGER *bs=NULL,bs2;
907.   	X509_STORE_CTX xsc;
908.   	EVP_PKEY *upkey;

apps/x509.c:910:2: 
908.   	EVP_PKEY *upkey;
909.   
910. > 	upkey = X509_get_pubkey(xca);
911.   	EVP_PKEY_copy_parameters(upkey,pkey);
912.   	EVP_PKEY_free(upkey);

crypto/x509/x509_cmp.c:254:1: start of procedure X509_get_pubkey()
  252.   	}
  253.   
  254. > EVP_PKEY *X509_get_pubkey(X509 *x)
  255.   	{
  256.   	if ((x == NULL) || (x->cert_info == NULL))

crypto/x509/x509_cmp.c:256:7: Taking false branch
  254.   EVP_PKEY *X509_get_pubkey(X509 *x)
  255.   	{
  256.   	if ((x == NULL) || (x->cert_info == NULL))
               ^
  257.   		return(NULL);
  258.   	return(X509_PUBKEY_get(x->cert_info->key));

crypto/x509/x509_cmp.c:256:22: Taking true branch
  254.   EVP_PKEY *X509_get_pubkey(X509 *x)
  255.   	{
  256.   	if ((x == NULL) || (x->cert_info == NULL))
                              ^
  257.   		return(NULL);
  258.   	return(X509_PUBKEY_get(x->cert_info->key));

crypto/x509/x509_cmp.c:257:3: 
  255.   	{
  256.   	if ((x == NULL) || (x->cert_info == NULL))
  257. > 		return(NULL);
  258.   	return(X509_PUBKEY_get(x->cert_info->key));
  259.   	}

crypto/x509/x509_cmp.c:259:2: return from a call to X509_get_pubkey
  257.   		return(NULL);
  258.   	return(X509_PUBKEY_get(x->cert_info->key));
  259.   	}
          ^
  260.   
  261.   int X509_check_private_key(X509 *x, EVP_PKEY *k)

apps/x509.c:911:2: Skipping EVP_PKEY_copy_parameters(): empty list of specs
909.   
910.   	upkey = X509_get_pubkey(xca);
911.   	EVP_PKEY_copy_parameters(upkey,pkey);
        ^
912.   	EVP_PKEY_free(upkey);
913.   

apps/x509.c:912:2: 
910.   	upkey = X509_get_pubkey(xca);
911.   	EVP_PKEY_copy_parameters(upkey,pkey);
912. > 	EVP_PKEY_free(upkey);
913.   
914.   	X509_STORE_CTX_init(&xsc,ctx,x,NULL);

static int x509_certify(X509_STORE *ctx, char *CAfile, const EVP_MD *digest,
	     X509 *x, X509 *xca, EVP_PKEY *pkey, char *serialfile, int create,
	     int days, int clrext, LHASH *conf, char *section)
	{
	int ret=0;
	BIO *io=NULL;
	MS_STATIC char buf2[1024];
	char *buf=NULL,*p;
	BIGNUM *serial=NULL;
	ASN1_INTEGER *bs=NULL,bs2;
	X509_STORE_CTX xsc;
	EVP_PKEY *upkey;
	upkey = X509_get_pubkey(xca);
	EVP_PKEY_copy_parameters(upkey,pkey);
	EVP_PKEY_free(upkey);
	X509_STORE_CTX_init(&xsc,ctx,x,NULL);
	buf=Malloc(EVP_PKEY_size(pkey)*2+
		((serialfile == NULL)
			?(strlen(CAfile)+strlen(POSTFIX)+1)
			:(strlen(serialfile)))+1);
	if (buf == NULL) { BIO_printf(bio_err,"out of mem\n"); goto end; }
	if (serialfile == NULL)
		{
		strcpy(buf,CAfile);
		for (p=buf; *p; p++)
			if (*p == '.')
				{
				*p='\0';
				break;
				}
		strcat(buf,POSTFIX);
		}
	else
		strcpy(buf,serialfile);
	serial=BN_new();
	bs=ASN1_INTEGER_new();
	if ((serial == NULL) || (bs == NULL))
		{
		ERR_print_errors(bio_err);
		goto end;
		}
	io=BIO_new(BIO_s_file());
	if (io == NULL)
		{
		ERR_print_errors(bio_err);
		goto end;
		}
	if (BIO_read_filename(io,buf) <= 0)
		{
		if (!create)
			{
			perror(buf);
			goto end;
			}
		else
			{
			ASN1_INTEGER_set(bs,1);
			BN_one(serial);
			}
		}
	else
		{
		if (!a2i_ASN1_INTEGER(io,bs,buf2,1024))
			{
			BIO_printf(bio_err,"unable to load serial number from %s\n",buf);
			ERR_print_errors(bio_err);
			goto end;
			}
		else
			{
			serial=BN_bin2bn(bs->data,bs->length,serial);
			if (serial == NULL)
				{
				BIO_printf(bio_err,"error converting bin 2 bn");
				goto end;
				}
			}
		}
	if (!BN_add_word(serial,1))
		{ BIO_printf(bio_err,"add_word failure\n"); goto end; }
	bs2.data=(unsigned char *)buf2;
	bs2.length=BN_bn2bin(serial,bs2.data);
	if (BIO_write_filename(io,buf) <= 0)
		{
		BIO_printf(bio_err,"error attempting to write serial number file\n");
		perror(buf);
		goto end;
		}
	i2a_ASN1_INTEGER(io,&bs2);
	BIO_puts(io,"\n");
	BIO_free(io);
	io=NULL;
	if (!X509_STORE_add_cert(ctx,x)) goto end;
	X509_STORE_CTX_set_cert(&xsc,x);
	if (!reqfile && !X509_verify_cert(&xsc))
		goto end;
	if (!X509_check_private_key(xca,pkey))
		{
		BIO_printf(bio_err,"CA certificate and CA private key do not match\n");
		goto end;
		}
	if (!X509_set_issuer_name(x,X509_get_subject_name(xca))) goto end;
	if (!X509_set_serialNumber(x,bs)) goto end;
	if (X509_gmtime_adj(X509_get_notBefore(x),0L) == NULL)
		goto end;
	if (X509_gmtime_adj(X509_get_notAfter(x),(long)60*60*24*days) == NULL)
		goto end;
	if(clrext) {
		while(X509_get_ext_count(x) > 0) X509_delete_ext(x, 0);
	}
	if(conf) {
		X509V3_CTX ctx2;
		X509_set_version(x,2);
                X509V3_set_ctx(&ctx2, xca, x, NULL, NULL, 0);
                X509V3_set_conf_lhash(&ctx2, conf);
                if(!X509V3_EXT_add_conf(conf, &ctx2, section, x)) goto end;
	}
	if (!X509_sign(x,pkey,digest)) goto end;
	ret=1;
end:
	X509_STORE_CTX_cleanup(&xsc);
	if (!ret)
		ERR_print_errors(bio_err);
	if (buf != NULL) Free(buf);
	if (bs != NULL) ASN1_INTEGER_free(bs);
	if (io != NULL)	BIO_free(io);
	if (serial != NULL) BN_free(serial);
	return(ret);
	}
['static int x509_certify(X509_STORE *ctx, char *CAfile, const EVP_MD *digest,\n\t     X509 *x, X509 *xca, EVP_PKEY *pkey, char *serialfile, int create,\n\t     int days, int clrext, LHASH *conf, char *section)\n\t{\n\tint ret=0;\n\tBIO *io=NULL;\n\tMS_STATIC char buf2[1024];\n\tchar *buf=NULL,*p;\n\tBIGNUM *serial=NULL;\n\tASN1_INTEGER *bs=NULL,bs2;\n\tX509_STORE_CTX xsc;\n\tEVP_PKEY *upkey;\n\tupkey = X509_get_pubkey(xca);\n\tEVP_PKEY_copy_parameters(upkey,pkey);\n\tEVP_PKEY_free(upkey);\n\tX509_STORE_CTX_init(&xsc,ctx,x,NULL);\n\tbuf=Malloc(EVP_PKEY_size(pkey)*2+\n\t\t((serialfile == NULL)\n\t\t\t?(strlen(CAfile)+strlen(POSTFIX)+1)\n\t\t\t:(strlen(serialfile)))+1);\n\tif (buf == NULL) { BIO_printf(bio_err,"out of mem\\n"); goto end; }\n\tif (serialfile == NULL)\n\t\t{\n\t\tstrcpy(buf,CAfile);\n\t\tfor (p=buf; *p; p++)\n\t\t\tif (*p == \'.\')\n\t\t\t\t{\n\t\t\t\t*p=\'\\0\';\n\t\t\t\tbreak;\n\t\t\t\t}\n\t\tstrcat(buf,POSTFIX);\n\t\t}\n\telse\n\t\tstrcpy(buf,serialfile);\n\tserial=BN_new();\n\tbs=ASN1_INTEGER_new();\n\tif ((serial == NULL) || (bs == NULL))\n\t\t{\n\t\tERR_print_errors(bio_err);\n\t\tgoto end;\n\t\t}\n\tio=BIO_new(BIO_s_file());\n\tif (io == NULL)\n\t\t{\n\t\tERR_print_errors(bio_err);\n\t\tgoto end;\n\t\t}\n\tif (BIO_read_filename(io,buf) <= 0)\n\t\t{\n\t\tif (!create)\n\t\t\t{\n\t\t\tperror(buf);\n\t\t\tgoto end;\n\t\t\t}\n\t\telse\n\t\t\t{\n\t\t\tASN1_INTEGER_set(bs,1);\n\t\t\tBN_one(serial);\n\t\t\t}\n\t\t}\n\telse\n\t\t{\n\t\tif (!a2i_ASN1_INTEGER(io,bs,buf2,1024))\n\t\t\t{\n\t\t\tBIO_printf(bio_err,"unable to load serial number from %s\\n",buf);\n\t\t\tERR_print_errors(bio_err);\n\t\t\tgoto end;\n\t\t\t}\n\t\telse\n\t\t\t{\n\t\t\tserial=BN_bin2bn(bs->data,bs->length,serial);\n\t\t\tif (serial == NULL)\n\t\t\t\t{\n\t\t\t\tBIO_printf(bio_err,"error converting bin 2 bn");\n\t\t\t\tgoto end;\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\tif (!BN_add_word(serial,1))\n\t\t{ BIO_printf(bio_err,"add_word failure\\n"); goto end; }\n\tbs2.data=(unsigned char *)buf2;\n\tbs2.length=BN_bn2bin(serial,bs2.data);\n\tif (BIO_write_filename(io,buf) <= 0)\n\t\t{\n\t\tBIO_printf(bio_err,"error attempting to write serial number file\\n");\n\t\tperror(buf);\n\t\tgoto end;\n\t\t}\n\ti2a_ASN1_INTEGER(io,&bs2);\n\tBIO_puts(io,"\\n");\n\tBIO_free(io);\n\tio=NULL;\n\tif (!X509_STORE_add_cert(ctx,x)) goto end;\n\tX509_STORE_CTX_set_cert(&xsc,x);\n\tif (!reqfile && !X509_verify_cert(&xsc))\n\t\tgoto end;\n\tif (!X509_check_private_key(xca,pkey))\n\t\t{\n\t\tBIO_printf(bio_err,"CA certificate and CA private key do not match\\n");\n\t\tgoto end;\n\t\t}\n\tif (!X509_set_issuer_name(x,X509_get_subject_name(xca))) goto end;\n\tif (!X509_set_serialNumber(x,bs)) goto end;\n\tif (X509_gmtime_adj(X509_get_notBefore(x),0L) == NULL)\n\t\tgoto end;\n\tif (X509_gmtime_adj(X509_get_notAfter(x),(long)60*60*24*days) == NULL)\n\t\tgoto end;\n\tif(clrext) {\n\t\twhile(X509_get_ext_count(x) > 0) X509_delete_ext(x, 0);\n\t}\n\tif(conf) {\n\t\tX509V3_CTX ctx2;\n\t\tX509_set_version(x,2);\n                X509V3_set_ctx(&ctx2, xca, x, NULL, NULL, 0);\n                X509V3_set_conf_lhash(&ctx2, conf);\n                if(!X509V3_EXT_add_conf(conf, &ctx2, section, x)) goto end;\n\t}\n\tif (!X509_sign(x,pkey,digest)) goto end;\n\tret=1;\nend:\n\tX509_STORE_CTX_cleanup(&xsc);\n\tif (!ret)\n\t\tERR_print_errors(bio_err);\n\tif (buf != NULL) Free(buf);\n\tif (bs != NULL) ASN1_INTEGER_free(bs);\n\tif (io != NULL)\tBIO_free(io);\n\tif (serial != NULL) BN_free(serial);\n\treturn(ret);\n\t}', 'EVP_PKEY *X509_get_pubkey(X509 *x)\n\t{\n\tif ((x == NULL) || (x->cert_info == NULL))\n\t\treturn(NULL);\n\treturn(X509_PUBKEY_get(x->cert_info->key));\n\t}']