crypto/ts/ts_conf.c:290: error: NULL_DEREFERENCE
  pointer `key_obj` last assigned on line 285 could be null and is dereferenced by call to `EVP_PKEY_free()` at line 290, column 2.
Showing all 57 steps of the trace


crypto/ts/ts_conf.c:272:1: start of procedure TS_CONF_set_signer_key()
270.   	}
271.   
272. > int TS_CONF_set_signer_key(CONF *conf, const char *section,
273.   			   const char *key, const char *pass,
274.   			   TS_RESP_CTX *ctx)

crypto/ts/ts_conf.c:276:2: 
274.   			   TS_RESP_CTX *ctx)
275.   	{
276. > 	int ret = 0;
277.   	EVP_PKEY *key_obj = NULL;
278.   	if (!key) 

crypto/ts/ts_conf.c:277:2: 
275.   	{
276.   	int ret = 0;
277. > 	EVP_PKEY *key_obj = NULL;
278.   	if (!key) 
279.   		key = NCONF_get_string(conf, section, ENV_SIGNER_KEY);

crypto/ts/ts_conf.c:278:7: Taking false branch
276.   	int ret = 0;
277.   	EVP_PKEY *key_obj = NULL;
278.   	if (!key) 
             ^
279.   		key = NCONF_get_string(conf, section, ENV_SIGNER_KEY);
280.   	if (!key)

crypto/ts/ts_conf.c:280:7: Taking false branch
278.   	if (!key) 
279.   		key = NCONF_get_string(conf, section, ENV_SIGNER_KEY);
280.   	if (!key)
             ^
281.   		{
282.   		TS_CONF_lookup_fail(section, ENV_SIGNER_KEY);

crypto/ts/ts_conf.c:285:8: 
283.   		goto err;
284.   		}
285. > 	if (!(key_obj = TS_CONF_load_key(key, pass))) goto err;
286.   	if (!TS_RESP_CTX_set_signer_key(ctx, key_obj)) goto err;
287.   

crypto/ts/ts_conf.c:132:1: start of procedure TS_CONF_load_key()
  130.   	}
  131.   
  132. > EVP_PKEY *TS_CONF_load_key(const char *file, const char *pass)
  133.   	{
  134.   	BIO *key = NULL;

crypto/ts/ts_conf.c:134:2: 
  132.   EVP_PKEY *TS_CONF_load_key(const char *file, const char *pass)
  133.   	{
  134. > 	BIO *key = NULL;
  135.   	EVP_PKEY *pkey = NULL;
  136.   

crypto/ts/ts_conf.c:135:2: 
  133.   	{
  134.   	BIO *key = NULL;
  135. > 	EVP_PKEY *pkey = NULL;
  136.   
  137.   	if (!(key = BIO_new_file(file, "r"))) goto end;

crypto/ts/ts_conf.c:137:8: 
  135.   	EVP_PKEY *pkey = NULL;
  136.   
  137. > 	if (!(key = BIO_new_file(file, "r"))) goto end;
  138.   	pkey = PEM_read_bio_PrivateKey(key, NULL, NULL, (char *) pass);
  139.    end:

crypto/bio/bss_file.c:115:1: start of procedure BIO_new_file()
    113.   	};
    114.   
    115. > BIO *BIO_new_file(const char *filename, const char *mode)
    116.   	{
    117.   	BIO *ret;

crypto/bio/bss_file.c:120:6: Taking true branch
    118.   	FILE *file;
    119.   
    120.   	if ((file=fopen(filename,mode)) == NULL)
                ^
    121.   		{
    122.   		SYSerr(SYS_F_FOPEN,get_last_sys_error());

crypto/bio/bss_file.c:122:3: 
    120.   	if ((file=fopen(filename,mode)) == NULL)
    121.   		{
    122. > 		SYSerr(SYS_F_FOPEN,get_last_sys_error());
    123.   		ERR_add_error_data(5,"fopen('",filename,"','",mode,"')");
    124.   		if (errno == ENOENT)

crypto/err/err.c:668:1: start of procedure ERR_put_error()
      666.   /********************************************************/
      667.   
      668. > void ERR_put_error(int lib, int func, int reason, const char *file,
      669.   	     int line)
      670.   	{

crypto/err/err.c:692:2: Skipping ERR_get_state(): empty list of specs
      690.   	}
      691.   #endif
      692.   	es=ERR_get_state();
              ^
      693.   
      694.   	es->top=(es->top+1)%ERR_NUM_ERRORS;

crypto/err/err.c:694:2: 
      692.   	es=ERR_get_state();
      693.   
      694. > 	es->top=(es->top+1)%ERR_NUM_ERRORS;
      695.   	if (es->top == es->bottom)
      696.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;

crypto/err/err.c:695:6: Taking false branch
      693.   
      694.   	es->top=(es->top+1)%ERR_NUM_ERRORS;
      695.   	if (es->top == es->bottom)
                  ^
      696.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
      697.   	es->err_flags[es->top]=0;

crypto/err/err.c:697:2: 
      695.   	if (es->top == es->bottom)
      696.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
      697. > 	es->err_flags[es->top]=0;
      698.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
      699.   	es->err_file[es->top]=file;

crypto/err/err.c:698:2: 
      696.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
      697.   	es->err_flags[es->top]=0;
      698. > 	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
      699.   	es->err_file[es->top]=file;
      700.   	es->err_line[es->top]=line;

crypto/err/err.c:699:2: 
      697.   	es->err_flags[es->top]=0;
      698.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
      699. > 	es->err_file[es->top]=file;
      700.   	es->err_line[es->top]=line;
      701.   	err_clear_data(es,es->top);

crypto/err/err.c:700:2: 
      698.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
      699.   	es->err_file[es->top]=file;
      700. > 	es->err_line[es->top]=line;
      701.   	err_clear_data(es,es->top);
      702.   	}

crypto/err/err.c:701:2: Taking true branch
      699.   	es->err_file[es->top]=file;
      700.   	es->err_line[es->top]=line;
      701.   	err_clear_data(es,es->top);
              ^
      702.   	}
      703.   

crypto/err/err.c:701:2: Taking false branch
      699.   	es->err_file[es->top]=file;
      700.   	es->err_line[es->top]=line;
      701.   	err_clear_data(es,es->top);
              ^
      702.   	}
      703.   

crypto/err/err.c:701:2: Loop condition is false. Leaving loop
      699.   	es->err_file[es->top]=file;
      700.   	es->err_line[es->top]=line;
      701.   	err_clear_data(es,es->top);
              ^
      702.   	}
      703.   

crypto/err/err.c:702:2: return from a call to ERR_put_error
      700.   	es->err_line[es->top]=line;
      701.   	err_clear_data(es,es->top);
      702.   	}
              ^
      703.   
      704.   void ERR_clear_error(void)

crypto/bio/bss_file.c:123:3: Skipping ERR_add_error_data(): empty list of specs
    121.   		{
    122.   		SYSerr(SYS_F_FOPEN,get_last_sys_error());
    123.   		ERR_add_error_data(5,"fopen('",filename,"','",mode,"')");
             ^
    124.   		if (errno == ENOENT)
    125.   			BIOerr(BIO_F_BIO_NEW_FILE,BIO_R_NO_SUCH_FILE);

crypto/bio/bss_file.c:124:7: Taking false branch
    122.   		SYSerr(SYS_F_FOPEN,get_last_sys_error());
    123.   		ERR_add_error_data(5,"fopen('",filename,"','",mode,"')");
    124.   		if (errno == ENOENT)
                 ^
    125.   			BIOerr(BIO_F_BIO_NEW_FILE,BIO_R_NO_SUCH_FILE);
    126.   		else

crypto/bio/bss_file.c:127:4: 
    125.   			BIOerr(BIO_F_BIO_NEW_FILE,BIO_R_NO_SUCH_FILE);
    126.   		else
    127. > 			BIOerr(BIO_F_BIO_NEW_FILE,ERR_R_SYS_LIB);
    128.   		return(NULL);
    129.   		}

crypto/err/err.c:668:1: start of procedure ERR_put_error()
      666.   /********************************************************/
      667.   
      668. > void ERR_put_error(int lib, int func, int reason, const char *file,
      669.   	     int line)
      670.   	{

crypto/err/err.c:692:2: Skipping ERR_get_state(): empty list of specs
      690.   	}
      691.   #endif
      692.   	es=ERR_get_state();
              ^
      693.   
      694.   	es->top=(es->top+1)%ERR_NUM_ERRORS;

crypto/err/err.c:694:2: 
      692.   	es=ERR_get_state();
      693.   
      694. > 	es->top=(es->top+1)%ERR_NUM_ERRORS;
      695.   	if (es->top == es->bottom)
      696.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;

crypto/err/err.c:695:6: Taking false branch
      693.   
      694.   	es->top=(es->top+1)%ERR_NUM_ERRORS;
      695.   	if (es->top == es->bottom)
                  ^
      696.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
      697.   	es->err_flags[es->top]=0;

crypto/err/err.c:697:2: 
      695.   	if (es->top == es->bottom)
      696.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
      697. > 	es->err_flags[es->top]=0;
      698.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
      699.   	es->err_file[es->top]=file;

crypto/err/err.c:698:2: 
      696.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
      697.   	es->err_flags[es->top]=0;
      698. > 	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
      699.   	es->err_file[es->top]=file;
      700.   	es->err_line[es->top]=line;

crypto/err/err.c:699:2: 
      697.   	es->err_flags[es->top]=0;
      698.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
      699. > 	es->err_file[es->top]=file;
      700.   	es->err_line[es->top]=line;
      701.   	err_clear_data(es,es->top);

crypto/err/err.c:700:2: 
      698.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
      699.   	es->err_file[es->top]=file;
      700. > 	es->err_line[es->top]=line;
      701.   	err_clear_data(es,es->top);
      702.   	}

crypto/err/err.c:701:2: Taking true branch
      699.   	es->err_file[es->top]=file;
      700.   	es->err_line[es->top]=line;
      701.   	err_clear_data(es,es->top);
              ^
      702.   	}
      703.   

crypto/err/err.c:701:2: Taking false branch
      699.   	es->err_file[es->top]=file;
      700.   	es->err_line[es->top]=line;
      701.   	err_clear_data(es,es->top);
              ^
      702.   	}
      703.   

crypto/err/err.c:701:2: Loop condition is false. Leaving loop
      699.   	es->err_file[es->top]=file;
      700.   	es->err_line[es->top]=line;
      701.   	err_clear_data(es,es->top);
              ^
      702.   	}
      703.   

crypto/err/err.c:702:2: return from a call to ERR_put_error
      700.   	es->err_line[es->top]=line;
      701.   	err_clear_data(es,es->top);
      702.   	}
              ^
      703.   
      704.   void ERR_clear_error(void)

crypto/bio/bss_file.c:128:3: 
    126.   		else
    127.   			BIOerr(BIO_F_BIO_NEW_FILE,ERR_R_SYS_LIB);
    128. > 		return(NULL);
    129.   		}
    130.   	if ((ret=BIO_new(BIO_s_file())) == NULL)

crypto/bio/bss_file.c:139:2: return from a call to BIO_new_file
    137.   	BIO_set_fp(ret,file,BIO_CLOSE);
    138.   	return(ret);
    139.   	}
            ^
    140.   
    141.   BIO *BIO_new_fp(FILE *stream, int close_flag)

crypto/ts/ts_conf.c:137:8: Taking true branch
  135.   	EVP_PKEY *pkey = NULL;
  136.   
  137.   	if (!(key = BIO_new_file(file, "r"))) goto end;
                ^
  138.   	pkey = PEM_read_bio_PrivateKey(key, NULL, NULL, (char *) pass);
  139.    end:

crypto/ts/ts_conf.c:139:2: 
  137.   	if (!(key = BIO_new_file(file, "r"))) goto end;
  138.   	pkey = PEM_read_bio_PrivateKey(key, NULL, NULL, (char *) pass);
  139. >  end:
  140.   	if (pkey == NULL)
  141.   		fprintf(stderr, "unable to load private key: %s\n", file);

crypto/ts/ts_conf.c:140:6: Taking true branch
  138.   	pkey = PEM_read_bio_PrivateKey(key, NULL, NULL, (char *) pass);
  139.    end:
  140.   	if (pkey == NULL)
              ^
  141.   		fprintf(stderr, "unable to load private key: %s\n", file);
  142.   	BIO_free(key);

crypto/ts/ts_conf.c:141:3: 
  139.    end:
  140.   	if (pkey == NULL)
  141. > 		fprintf(stderr, "unable to load private key: %s\n", file);
  142.   	BIO_free(key);
  143.   	return pkey;

crypto/ts/ts_conf.c:142:2: 
  140.   	if (pkey == NULL)
  141.   		fprintf(stderr, "unable to load private key: %s\n", file);
  142. > 	BIO_free(key);
  143.   	return pkey;
  144.   	}

crypto/bio/bio_lib.c:111:1: start of procedure BIO_free()
    109.   	}
    110.   
    111. > int BIO_free(BIO *a)
    112.   	{
    113.   	int ret=0,i;

crypto/bio/bio_lib.c:113:2: 
    111.   int BIO_free(BIO *a)
    112.   	{
    113. > 	int ret=0,i;
    114.   
    115.   	if (a == NULL) return(0);

crypto/bio/bio_lib.c:115:6: Taking true branch
    113.   	int ret=0,i;
    114.   
    115.   	if (a == NULL) return(0);
                ^
    116.   
    117.   	i=CRYPTO_add(&a->references,-1,CRYPTO_LOCK_BIO);

crypto/bio/bio_lib.c:115:17: 
    113.   	int ret=0,i;
    114.   
    115. > 	if (a == NULL) return(0);
    116.   
    117.   	i=CRYPTO_add(&a->references,-1,CRYPTO_LOCK_BIO);

crypto/bio/bio_lib.c:139:2: return from a call to BIO_free
    137.   	OPENSSL_free(a);
    138.   	return(1);
    139.   	}
            ^
    140.   
    141.   void BIO_vfree(BIO *a)

crypto/ts/ts_conf.c:143:2: 
  141.   		fprintf(stderr, "unable to load private key: %s\n", file);
  142.   	BIO_free(key);
  143. > 	return pkey;
  144.   	}
  145.   

crypto/ts/ts_conf.c:144:2: return from a call to TS_CONF_load_key
  142.   	BIO_free(key);
  143.   	return pkey;
  144.   	}
          ^
  145.   
  146.   /* Function definitions for handling configuration options. */

crypto/ts/ts_conf.c:285:8: Taking true branch
283.   		goto err;
284.   		}
285.   	if (!(key_obj = TS_CONF_load_key(key, pass))) goto err;
              ^
286.   	if (!TS_RESP_CTX_set_signer_key(ctx, key_obj)) goto err;
287.   

crypto/ts/ts_conf.c:289:2: 
287.   
288.   	ret = 1;
289. >  err:
290.   	EVP_PKEY_free(key_obj);
291.   	return ret;

crypto/ts/ts_conf.c:290:2: 
288.   	ret = 1;
289.    err:
290. > 	EVP_PKEY_free(key_obj);
291.   	return ret;
292.   	}

int TS_CONF_set_signer_key(CONF *conf, const char *section,
			   const char *key, const char *pass,
			   TS_RESP_CTX *ctx)
	{
	int ret = 0;
	EVP_PKEY *key_obj = NULL;
	if (!key)
		key = NCONF_get_string(conf, section, ENV_SIGNER_KEY);
	if (!key)
		{
		TS_CONF_lookup_fail(section, ENV_SIGNER_KEY);
		goto err;
		}
	if (!(key_obj = TS_CONF_load_key(key, pass))) goto err;
	if (!TS_RESP_CTX_set_signer_key(ctx, key_obj)) goto err;
	ret = 1;
 err:
	EVP_PKEY_free(key_obj);
	return ret;
	}
['int TS_CONF_set_signer_key(CONF *conf, const char *section,\n\t\t\t   const char *key, const char *pass,\n\t\t\t   TS_RESP_CTX *ctx)\n\t{\n\tint ret = 0;\n\tEVP_PKEY *key_obj = NULL;\n\tif (!key)\n\t\tkey = NCONF_get_string(conf, section, ENV_SIGNER_KEY);\n\tif (!key)\n\t\t{\n\t\tTS_CONF_lookup_fail(section, ENV_SIGNER_KEY);\n\t\tgoto err;\n\t\t}\n\tif (!(key_obj = TS_CONF_load_key(key, pass))) goto err;\n\tif (!TS_RESP_CTX_set_signer_key(ctx, key_obj)) goto err;\n\tret = 1;\n err:\n\tEVP_PKEY_free(key_obj);\n\treturn ret;\n\t}', 'EVP_PKEY *TS_CONF_load_key(const char *file, const char *pass)\n\t{\n\tBIO *key = NULL;\n\tEVP_PKEY *pkey = NULL;\n\tif (!(key = BIO_new_file(file, "r"))) goto end;\n\tpkey = PEM_read_bio_PrivateKey(key, NULL, NULL, (char *) pass);\n end:\n\tif (pkey == NULL)\n\t\tfprintf(stderr, "unable to load private key: %s\\n", file);\n\tBIO_free(key);\n\treturn pkey;\n\t}', 'BIO *BIO_new_file(const char *filename, const char *mode)\n\t{\n\tBIO *ret;\n\tFILE *file;\n\tif ((file=fopen(filename,mode)) == NULL)\n\t\t{\n\t\tSYSerr(SYS_F_FOPEN,get_last_sys_error());\n\t\tERR_add_error_data(5,"fopen(\'",filename,"\',\'",mode,"\')");\n\t\tif (errno == ENOENT)\n\t\t\tBIOerr(BIO_F_BIO_NEW_FILE,BIO_R_NO_SUCH_FILE);\n\t\telse\n\t\t\tBIOerr(BIO_F_BIO_NEW_FILE,ERR_R_SYS_LIB);\n\t\treturn(NULL);\n\t\t}\n\tif ((ret=BIO_new(BIO_s_file())) == NULL)\n\t\t{\n\t\tfclose(file);\n\t\treturn(NULL);\n\t\t}\n\tBIO_clear_flags(ret,BIO_FLAGS_UPLINK);\n\tBIO_set_fp(ret,file,BIO_CLOSE);\n\treturn(ret);\n\t}', 'void ERR_put_error(int lib, int func, int reason, const char *file,\n\t     int line)\n\t{\n\tERR_STATE *es;\n#ifdef _OSD_POSIX\n\tif (strncmp(file,"*POSIX(", sizeof("*POSIX(")-1) == 0) {\n\t\tchar *end;\n\t\tfile += sizeof("*POSIX(")-1;\n\t\tend = &file[strlen(file)-1];\n\t\tif (*end == \')\')\n\t\t\t*end = \'\\0\';\n\t\tif ((end = strrchr(file, \'/\')) != NULL)\n\t\t\tfile = &end[1];\n\t}\n#endif\n\tes=ERR_get_state();\n\tes->top=(es->top+1)%ERR_NUM_ERRORS;\n\tif (es->top == es->bottom)\n\t\tes->bottom=(es->bottom+1)%ERR_NUM_ERRORS;\n\tes->err_flags[es->top]=0;\n\tes->err_buffer[es->top]=ERR_PACK(lib,func,reason);\n\tes->err_file[es->top]=file;\n\tes->err_line[es->top]=line;\n\terr_clear_data(es,es->top);\n\t}', 'int BIO_free(BIO *a)\n\t{\n\tint ret=0,i;\n\tif (a == NULL) return(0);\n\ti=CRYPTO_add(&a->references,-1,CRYPTO_LOCK_BIO);\n#ifdef REF_PRINT\n\tREF_PRINT("BIO",a);\n#endif\n\tif (i > 0) return(1);\n#ifdef REF_CHECK\n\tif (i < 0)\n\t\t{\n\t\tfprintf(stderr,"BIO_free, bad reference count\\n");\n\t\tabort();\n\t\t}\n#endif\n\tif ((a->callback != NULL) &&\n\t\t((i=(int)a->callback(a,BIO_CB_FREE,NULL,0,0L,1L)) <= 0))\n\t\t\treturn(i);\n\tCRYPTO_free_ex_data(CRYPTO_EX_INDEX_BIO, a, &a->ex_data);\n\tif ((a->method == NULL) || (a->method->destroy == NULL)) return(1);\n\tret=a->method->destroy(a);\n\tOPENSSL_free(a);\n\treturn(1);\n\t}']