ssl/s3_srvr.c:3096: error: NULL_DEREFERENCE
  pointer `pkey` last assigned on line 3048 could be null and is dereferenced at line 3096, column 16.
Showing all 27 steps of the trace


ssl/s3_srvr.c:3024:1: start of procedure ssl3_get_cert_verify()
3022.   	}
3023.   
3024. > int ssl3_get_cert_verify(SSL *s)
3025.   	{
3026.   	EVP_PKEY *pkey=NULL;

ssl/s3_srvr.c:3026:2: 
3024.   int ssl3_get_cert_verify(SSL *s)
3025.   	{
3026. > 	EVP_PKEY *pkey=NULL;
3027.   	unsigned char *p;
3028.   	int al,ok,ret=0;

ssl/s3_srvr.c:3028:2: 
3026.   	EVP_PKEY *pkey=NULL;
3027.   	unsigned char *p;
3028. > 	int al,ok,ret=0;
3029.   	long n;
3030.   	int type=0,i,j;

ssl/s3_srvr.c:3030:2: 
3028.   	int al,ok,ret=0;
3029.   	long n;
3030. > 	int type=0,i,j;
3031.   	X509 *peer;
3032.   	const EVP_MD *md = NULL;

ssl/s3_srvr.c:3032:2: 
3030.   	int type=0,i,j;
3031.   	X509 *peer;
3032. > 	const EVP_MD *md = NULL;
3033.   	EVP_MD_CTX mctx;
3034.   	EVP_MD_CTX_init(&mctx);

ssl/s3_srvr.c:3034:2: 
3032.   	const EVP_MD *md = NULL;
3033.   	EVP_MD_CTX mctx;
3034. > 	EVP_MD_CTX_init(&mctx);
3035.   
3036.   	n=s->method->ssl_get_message(s,

crypto/evp/digest.c:120:1: start of procedure EVP_MD_CTX_init()
  118.   #endif
  119.   
  120. > void EVP_MD_CTX_init(EVP_MD_CTX *ctx)
  121.   	{
  122.   	memset(ctx,'\0',sizeof *ctx);

crypto/evp/digest.c:122:2: 
  120.   void EVP_MD_CTX_init(EVP_MD_CTX *ctx)
  121.   	{
  122. > 	memset(ctx,'\0',sizeof *ctx);
  123.   	}
  124.   

crypto/evp/digest.c:123:2: return from a call to EVP_MD_CTX_init
  121.   	{
  122.   	memset(ctx,'\0',sizeof *ctx);
  123.   	}
          ^
  124.   
  125.   EVP_MD_CTX *EVP_MD_CTX_create(void)

ssl/s3_srvr.c:3036:2: Skipping __function_pointer__(): unresolved function pointer
3034.   	EVP_MD_CTX_init(&mctx);
3035.   
3036.   	n=s->method->ssl_get_message(s,
         ^
3037.   		SSL3_ST_SR_CERT_VRFY_A,
3038.   		SSL3_ST_SR_CERT_VRFY_B,

ssl/s3_srvr.c:3043:7: Taking false branch
3041.   		&ok);
3042.   
3043.   	if (!ok) return((int)n);
              ^
3044.   
3045.   	if (s->session->peer != NULL)

ssl/s3_srvr.c:3045:6: Taking true branch
3043.   	if (!ok) return((int)n);
3044.   
3045.   	if (s->session->peer != NULL)
             ^
3046.   		{
3047.   		peer=s->session->peer;

ssl/s3_srvr.c:3047:3: 
3045.   	if (s->session->peer != NULL)
3046.   		{
3047. > 		peer=s->session->peer;
3048.   		pkey=X509_get_pubkey(peer);
3049.   		type=X509_certificate_type(peer,pkey);

ssl/s3_srvr.c:3048:3: 
3046.   		{
3047.   		peer=s->session->peer;
3048. > 		pkey=X509_get_pubkey(peer);
3049.   		type=X509_certificate_type(peer,pkey);
3050.   		}

crypto/x509/x509_cmp.c:300:1: start of procedure X509_get_pubkey()
  298.   	}
  299.   
  300. > EVP_PKEY *X509_get_pubkey(X509 *x)
  301.   	{
  302.   	if ((x == NULL) || (x->cert_info == NULL))

crypto/x509/x509_cmp.c:302:7: Taking false branch
  300.   EVP_PKEY *X509_get_pubkey(X509 *x)
  301.   	{
  302.   	if ((x == NULL) || (x->cert_info == NULL))
               ^
  303.   		return(NULL);
  304.   	return(X509_PUBKEY_get(x->cert_info->key));

crypto/x509/x509_cmp.c:302:22: Taking true branch
  300.   EVP_PKEY *X509_get_pubkey(X509 *x)
  301.   	{
  302.   	if ((x == NULL) || (x->cert_info == NULL))
                              ^
  303.   		return(NULL);
  304.   	return(X509_PUBKEY_get(x->cert_info->key));

crypto/x509/x509_cmp.c:303:3: 
  301.   	{
  302.   	if ((x == NULL) || (x->cert_info == NULL))
  303. > 		return(NULL);
  304.   	return(X509_PUBKEY_get(x->cert_info->key));
  305.   	}

crypto/x509/x509_cmp.c:305:2: return from a call to X509_get_pubkey
  303.   		return(NULL);
  304.   	return(X509_PUBKEY_get(x->cert_info->key));
  305.   	}
          ^
  306.   
  307.   ASN1_BIT_STRING *X509_get0_pubkey_bitstr(const X509 *x)

ssl/s3_srvr.c:3049:3: Skipping X509_certificate_type(): empty list of specs
3047.   		peer=s->session->peer;
3048.   		pkey=X509_get_pubkey(peer);
3049.   		type=X509_certificate_type(peer,pkey);
          ^
3050.   		}
3051.   	else

ssl/s3_srvr.c:3057:6: Taking false branch
3055.   		}
3056.   
3057.   	if (s->s3->tmp.message_type != SSL3_MT_CERTIFICATE_VERIFY)
             ^
3058.   		{
3059.   		s->s3->tmp.reuse_message=1;

ssl/s3_srvr.c:3070:6: Taking false branch
3068.   		}
3069.   
3070.   	if (peer == NULL)
             ^
3071.   		{
3072.   		SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_NO_CLIENT_CERT_RECEIVED);

ssl/s3_srvr.c:3077:8: Taking false branch
3075.   		}
3076.   
3077.   	if (!(type & EVP_PKT_SIGN))
               ^
3078.   		{
3079.   		SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_SIGNATURE_FOR_NON_SIGNING_CERTIFICATE);

ssl/s3_srvr.c:3084:6: Taking false branch
3082.   		}
3083.   
3084.   	if (s->s3->change_cipher_spec)
             ^
3085.   		{
3086.   		SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_CCS_RECEIVED_EARLY);

ssl/s3_srvr.c:3092:2: 
3090.   
3091.   	/* we now have a signature that we need to verify */
3092. > 	p=(unsigned char *)s->init_msg;
3093.   	/* Check for broken implementations of GOST ciphersuites */
3094.   	/* If key is GOST and n is exactly 64, it is bare

ssl/s3_srvr.c:3096:6: Taking true branch
3094.   	/* If key is GOST and n is exactly 64, it is bare
3095.   	 * signature without length field */
3096.   	if (n==64 && (pkey->type==NID_id_GostR3410_94 ||
             ^
3097.   		pkey->type == NID_id_GostR3410_2001) )
3098.   		{

ssl/s3_srvr.c:3096:16: 
3094.   	/* If key is GOST and n is exactly 64, it is bare
3095.   	 * signature without length field */
3096. > 	if (n==64 && (pkey->type==NID_id_GostR3410_94 ||
3097.   		pkey->type == NID_id_GostR3410_2001) )
3098.   		{

int ssl3_get_cert_verify(SSL *s)
	{
	EVP_PKEY *pkey=NULL;
	unsigned char *p;
	int al,ok,ret=0;
	long n;
	int type=0,i,j;
	X509 *peer;
	const EVP_MD *md = NULL;
	EVP_MD_CTX mctx;
	EVP_MD_CTX_init(&mctx);
	n=s->method->ssl_get_message(s,
		SSL3_ST_SR_CERT_VRFY_A,
		SSL3_ST_SR_CERT_VRFY_B,
		-1,
		516,
		&ok);
	if (!ok) return((int)n);
	if (s->session->peer != NULL)
		{
		peer=s->session->peer;
		pkey=X509_get_pubkey(peer);
		type=X509_certificate_type(peer,pkey);
		}
	else
		{
		peer=NULL;
		pkey=NULL;
		}
	if (s->s3->tmp.message_type != SSL3_MT_CERTIFICATE_VERIFY)
		{
		s->s3->tmp.reuse_message=1;
		if ((peer != NULL) && (type & EVP_PKT_SIGN))
			{
			al=SSL_AD_UNEXPECTED_MESSAGE;
			SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_MISSING_VERIFY_MESSAGE);
			goto f_err;
			}
		ret=1;
		goto end;
		}
	if (peer == NULL)
		{
		SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_NO_CLIENT_CERT_RECEIVED);
		al=SSL_AD_UNEXPECTED_MESSAGE;
		goto f_err;
		}
	if (!(type & EVP_PKT_SIGN))
		{
		SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_SIGNATURE_FOR_NON_SIGNING_CERTIFICATE);
		al=SSL_AD_ILLEGAL_PARAMETER;
		goto f_err;
		}
	if (s->s3->change_cipher_spec)
		{
		SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_CCS_RECEIVED_EARLY);
		al=SSL_AD_UNEXPECTED_MESSAGE;
		goto f_err;
		}
	p=(unsigned char *)s->init_msg;
	if (n==64 && (pkey->type==NID_id_GostR3410_94 ||
		pkey->type == NID_id_GostR3410_2001) )
		{
		i=64;
		}
	else
		{
		if (SSL_USE_SIGALGS(s))
			{
			int rv = tls12_check_peer_sigalg(&md, s, p, pkey);
			if (rv == -1)
				{
				al = SSL_AD_INTERNAL_ERROR;
				goto f_err;
				}
			else if (rv == 0)
				{
				al = SSL_AD_DECODE_ERROR;
				goto f_err;
				}
#ifdef SSL_DEBUG
fprintf(stderr, "USING TLSv1.2 HASH %s\n", EVP_MD_name(md));
#endif
			p += 2;
			n -= 2;
			}
		n2s(p,i);
		n-=2;
		if (i > n)
			{
			SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_LENGTH_MISMATCH);
			al=SSL_AD_DECODE_ERROR;
			goto f_err;
			}
    	}
	j=EVP_PKEY_size(pkey);
	if ((i > j) || (n > j) || (n <= 0))
		{
		SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_WRONG_SIGNATURE_SIZE);
		al=SSL_AD_DECODE_ERROR;
		goto f_err;
		}
	if (SSL_USE_SIGALGS(s))
		{
		long hdatalen = 0;
		void *hdata;
		hdatalen = BIO_get_mem_data(s->s3->handshake_buffer, &hdata);
		if (hdatalen <= 0)
			{
			SSLerr(SSL_F_SSL3_GET_CERT_VERIFY, ERR_R_INTERNAL_ERROR);
			al=SSL_AD_INTERNAL_ERROR;
			goto f_err;
			}
#ifdef SSL_DEBUG
		fprintf(stderr, "Using TLS 1.2 with client verify alg %s\n",
							EVP_MD_name(md));
#endif
		if (!EVP_VerifyInit_ex(&mctx, md, NULL)
			|| !EVP_VerifyUpdate(&mctx, hdata, hdatalen))
			{
			SSLerr(SSL_F_SSL3_GET_CERT_VERIFY, ERR_R_EVP_LIB);
			al=SSL_AD_INTERNAL_ERROR;
			goto f_err;
			}
		if (EVP_VerifyFinal(&mctx, p , i, pkey) <= 0)
			{
			al=SSL_AD_DECRYPT_ERROR;
			SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_BAD_SIGNATURE);
			goto f_err;
			}
		}
	else
#ifndef OPENSSL_NO_RSA
	if (pkey->type == EVP_PKEY_RSA)
		{
		i=RSA_verify(NID_md5_sha1, s->s3->tmp.cert_verify_md,
			MD5_DIGEST_LENGTH+SHA_DIGEST_LENGTH, p, i,
							pkey->pkey.rsa);
		if (i < 0)
			{
			al=SSL_AD_DECRYPT_ERROR;
			SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_BAD_RSA_DECRYPT);
			goto f_err;
			}
		if (i == 0)
			{
			al=SSL_AD_DECRYPT_ERROR;
			SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_BAD_RSA_SIGNATURE);
			goto f_err;
			}
		}
	else
#endif
#ifndef OPENSSL_NO_DSA
		if (pkey->type == EVP_PKEY_DSA)
		{
		j=DSA_verify(pkey->save_type,
			&(s->s3->tmp.cert_verify_md[MD5_DIGEST_LENGTH]),
			SHA_DIGEST_LENGTH,p,i,pkey->pkey.dsa);
		if (j <= 0)
			{
			al=SSL_AD_DECRYPT_ERROR;
			SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_BAD_DSA_SIGNATURE);
			goto f_err;
			}
		}
	else
#endif
#ifndef OPENSSL_NO_ECDSA
		if (pkey->type == EVP_PKEY_EC)
		{
		j=ECDSA_verify(pkey->save_type,
			&(s->s3->tmp.cert_verify_md[MD5_DIGEST_LENGTH]),
			SHA_DIGEST_LENGTH,p,i,pkey->pkey.ec);
		if (j <= 0)
			{
			al=SSL_AD_DECRYPT_ERROR;
			SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,
			    SSL_R_BAD_ECDSA_SIGNATURE);
			goto f_err;
			}
		}
	else
#endif
	if (pkey->type == NID_id_GostR3410_94 || pkey->type == NID_id_GostR3410_2001)
		{   unsigned char signature[64];
			int idx;
			EVP_PKEY_CTX *pctx = EVP_PKEY_CTX_new(pkey,NULL);
			EVP_PKEY_verify_init(pctx);
			if (i!=64) {
				fprintf(stderr,"GOST signature length is %d",i);
			}
			for (idx=0;idx<64;idx++) {
				signature[63-idx]=p[idx];
			}
			j=EVP_PKEY_verify(pctx,signature,64,s->s3->tmp.cert_verify_md,32);
			EVP_PKEY_CTX_free(pctx);
			if (j<=0)
				{
				al=SSL_AD_DECRYPT_ERROR;
				SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,
					SSL_R_BAD_ECDSA_SIGNATURE);
				goto f_err;
				}
		}
	else
		{
		SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,ERR_R_INTERNAL_ERROR);
		al=SSL_AD_UNSUPPORTED_CERTIFICATE;
		goto f_err;
		}
	ret=1;
	if (0)
		{
f_err:
		ssl3_send_alert(s,SSL3_AL_FATAL,al);
		}
end:
	if (s->s3->handshake_buffer)
		{
		BIO_free(s->s3->handshake_buffer);
		s->s3->handshake_buffer = NULL;
		s->s3->flags &= ~TLS1_FLAGS_KEEP_HANDSHAKE;
		}
	EVP_MD_CTX_cleanup(&mctx);
	EVP_PKEY_free(pkey);
	return(ret);
	}
['int ssl3_get_cert_verify(SSL *s)\n\t{\n\tEVP_PKEY *pkey=NULL;\n\tunsigned char *p;\n\tint al,ok,ret=0;\n\tlong n;\n\tint type=0,i,j;\n\tX509 *peer;\n\tconst EVP_MD *md = NULL;\n\tEVP_MD_CTX mctx;\n\tEVP_MD_CTX_init(&mctx);\n\tn=s->method->ssl_get_message(s,\n\t\tSSL3_ST_SR_CERT_VRFY_A,\n\t\tSSL3_ST_SR_CERT_VRFY_B,\n\t\t-1,\n\t\t516,\n\t\t&ok);\n\tif (!ok) return((int)n);\n\tif (s->session->peer != NULL)\n\t\t{\n\t\tpeer=s->session->peer;\n\t\tpkey=X509_get_pubkey(peer);\n\t\ttype=X509_certificate_type(peer,pkey);\n\t\t}\n\telse\n\t\t{\n\t\tpeer=NULL;\n\t\tpkey=NULL;\n\t\t}\n\tif (s->s3->tmp.message_type != SSL3_MT_CERTIFICATE_VERIFY)\n\t\t{\n\t\ts->s3->tmp.reuse_message=1;\n\t\tif ((peer != NULL) && (type & EVP_PKT_SIGN))\n\t\t\t{\n\t\t\tal=SSL_AD_UNEXPECTED_MESSAGE;\n\t\t\tSSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_MISSING_VERIFY_MESSAGE);\n\t\t\tgoto f_err;\n\t\t\t}\n\t\tret=1;\n\t\tgoto end;\n\t\t}\n\tif (peer == NULL)\n\t\t{\n\t\tSSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_NO_CLIENT_CERT_RECEIVED);\n\t\tal=SSL_AD_UNEXPECTED_MESSAGE;\n\t\tgoto f_err;\n\t\t}\n\tif (!(type & EVP_PKT_SIGN))\n\t\t{\n\t\tSSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_SIGNATURE_FOR_NON_SIGNING_CERTIFICATE);\n\t\tal=SSL_AD_ILLEGAL_PARAMETER;\n\t\tgoto f_err;\n\t\t}\n\tif (s->s3->change_cipher_spec)\n\t\t{\n\t\tSSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_CCS_RECEIVED_EARLY);\n\t\tal=SSL_AD_UNEXPECTED_MESSAGE;\n\t\tgoto f_err;\n\t\t}\n\tp=(unsigned char *)s->init_msg;\n\tif (n==64 && (pkey->type==NID_id_GostR3410_94 ||\n\t\tpkey->type == NID_id_GostR3410_2001) )\n\t\t{\n\t\ti=64;\n\t\t}\n\telse\n\t\t{\n\t\tif (SSL_USE_SIGALGS(s))\n\t\t\t{\n\t\t\tint rv = tls12_check_peer_sigalg(&md, s, p, pkey);\n\t\t\tif (rv == -1)\n\t\t\t\t{\n\t\t\t\tal = SSL_AD_INTERNAL_ERROR;\n\t\t\t\tgoto f_err;\n\t\t\t\t}\n\t\t\telse if (rv == 0)\n\t\t\t\t{\n\t\t\t\tal = SSL_AD_DECODE_ERROR;\n\t\t\t\tgoto f_err;\n\t\t\t\t}\n#ifdef SSL_DEBUG\nfprintf(stderr, "USING TLSv1.2 HASH %s\\n", EVP_MD_name(md));\n#endif\n\t\t\tp += 2;\n\t\t\tn -= 2;\n\t\t\t}\n\t\tn2s(p,i);\n\t\tn-=2;\n\t\tif (i > n)\n\t\t\t{\n\t\t\tSSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_LENGTH_MISMATCH);\n\t\t\tal=SSL_AD_DECODE_ERROR;\n\t\t\tgoto f_err;\n\t\t\t}\n    \t}\n\tj=EVP_PKEY_size(pkey);\n\tif ((i > j) || (n > j) || (n <= 0))\n\t\t{\n\t\tSSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_WRONG_SIGNATURE_SIZE);\n\t\tal=SSL_AD_DECODE_ERROR;\n\t\tgoto f_err;\n\t\t}\n\tif (SSL_USE_SIGALGS(s))\n\t\t{\n\t\tlong hdatalen = 0;\n\t\tvoid *hdata;\n\t\thdatalen = BIO_get_mem_data(s->s3->handshake_buffer, &hdata);\n\t\tif (hdatalen <= 0)\n\t\t\t{\n\t\t\tSSLerr(SSL_F_SSL3_GET_CERT_VERIFY, ERR_R_INTERNAL_ERROR);\n\t\t\tal=SSL_AD_INTERNAL_ERROR;\n\t\t\tgoto f_err;\n\t\t\t}\n#ifdef SSL_DEBUG\n\t\tfprintf(stderr, "Using TLS 1.2 with client verify alg %s\\n",\n\t\t\t\t\t\t\tEVP_MD_name(md));\n#endif\n\t\tif (!EVP_VerifyInit_ex(&mctx, md, NULL)\n\t\t\t|| !EVP_VerifyUpdate(&mctx, hdata, hdatalen))\n\t\t\t{\n\t\t\tSSLerr(SSL_F_SSL3_GET_CERT_VERIFY, ERR_R_EVP_LIB);\n\t\t\tal=SSL_AD_INTERNAL_ERROR;\n\t\t\tgoto f_err;\n\t\t\t}\n\t\tif (EVP_VerifyFinal(&mctx, p , i, pkey) <= 0)\n\t\t\t{\n\t\t\tal=SSL_AD_DECRYPT_ERROR;\n\t\t\tSSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_BAD_SIGNATURE);\n\t\t\tgoto f_err;\n\t\t\t}\n\t\t}\n\telse\n#ifndef OPENSSL_NO_RSA\n\tif (pkey->type == EVP_PKEY_RSA)\n\t\t{\n\t\ti=RSA_verify(NID_md5_sha1, s->s3->tmp.cert_verify_md,\n\t\t\tMD5_DIGEST_LENGTH+SHA_DIGEST_LENGTH, p, i,\n\t\t\t\t\t\t\tpkey->pkey.rsa);\n\t\tif (i < 0)\n\t\t\t{\n\t\t\tal=SSL_AD_DECRYPT_ERROR;\n\t\t\tSSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_BAD_RSA_DECRYPT);\n\t\t\tgoto f_err;\n\t\t\t}\n\t\tif (i == 0)\n\t\t\t{\n\t\t\tal=SSL_AD_DECRYPT_ERROR;\n\t\t\tSSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_BAD_RSA_SIGNATURE);\n\t\t\tgoto f_err;\n\t\t\t}\n\t\t}\n\telse\n#endif\n#ifndef OPENSSL_NO_DSA\n\t\tif (pkey->type == EVP_PKEY_DSA)\n\t\t{\n\t\tj=DSA_verify(pkey->save_type,\n\t\t\t&(s->s3->tmp.cert_verify_md[MD5_DIGEST_LENGTH]),\n\t\t\tSHA_DIGEST_LENGTH,p,i,pkey->pkey.dsa);\n\t\tif (j <= 0)\n\t\t\t{\n\t\t\tal=SSL_AD_DECRYPT_ERROR;\n\t\t\tSSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_BAD_DSA_SIGNATURE);\n\t\t\tgoto f_err;\n\t\t\t}\n\t\t}\n\telse\n#endif\n#ifndef OPENSSL_NO_ECDSA\n\t\tif (pkey->type == EVP_PKEY_EC)\n\t\t{\n\t\tj=ECDSA_verify(pkey->save_type,\n\t\t\t&(s->s3->tmp.cert_verify_md[MD5_DIGEST_LENGTH]),\n\t\t\tSHA_DIGEST_LENGTH,p,i,pkey->pkey.ec);\n\t\tif (j <= 0)\n\t\t\t{\n\t\t\tal=SSL_AD_DECRYPT_ERROR;\n\t\t\tSSLerr(SSL_F_SSL3_GET_CERT_VERIFY,\n\t\t\t    SSL_R_BAD_ECDSA_SIGNATURE);\n\t\t\tgoto f_err;\n\t\t\t}\n\t\t}\n\telse\n#endif\n\tif (pkey->type == NID_id_GostR3410_94 || pkey->type == NID_id_GostR3410_2001)\n\t\t{   unsigned char signature[64];\n\t\t\tint idx;\n\t\t\tEVP_PKEY_CTX *pctx = EVP_PKEY_CTX_new(pkey,NULL);\n\t\t\tEVP_PKEY_verify_init(pctx);\n\t\t\tif (i!=64) {\n\t\t\t\tfprintf(stderr,"GOST signature length is %d",i);\n\t\t\t}\n\t\t\tfor (idx=0;idx<64;idx++) {\n\t\t\t\tsignature[63-idx]=p[idx];\n\t\t\t}\n\t\t\tj=EVP_PKEY_verify(pctx,signature,64,s->s3->tmp.cert_verify_md,32);\n\t\t\tEVP_PKEY_CTX_free(pctx);\n\t\t\tif (j<=0)\n\t\t\t\t{\n\t\t\t\tal=SSL_AD_DECRYPT_ERROR;\n\t\t\t\tSSLerr(SSL_F_SSL3_GET_CERT_VERIFY,\n\t\t\t\t\tSSL_R_BAD_ECDSA_SIGNATURE);\n\t\t\t\tgoto f_err;\n\t\t\t\t}\n\t\t}\n\telse\n\t\t{\n\t\tSSLerr(SSL_F_SSL3_GET_CERT_VERIFY,ERR_R_INTERNAL_ERROR);\n\t\tal=SSL_AD_UNSUPPORTED_CERTIFICATE;\n\t\tgoto f_err;\n\t\t}\n\tret=1;\n\tif (0)\n\t\t{\nf_err:\n\t\tssl3_send_alert(s,SSL3_AL_FATAL,al);\n\t\t}\nend:\n\tif (s->s3->handshake_buffer)\n\t\t{\n\t\tBIO_free(s->s3->handshake_buffer);\n\t\ts->s3->handshake_buffer = NULL;\n\t\ts->s3->flags &= ~TLS1_FLAGS_KEEP_HANDSHAKE;\n\t\t}\n\tEVP_MD_CTX_cleanup(&mctx);\n\tEVP_PKEY_free(pkey);\n\treturn(ret);\n\t}', "void EVP_MD_CTX_init(EVP_MD_CTX *ctx)\n\t{\n\tmemset(ctx,'\\0',sizeof *ctx);\n\t}", 'EVP_PKEY *X509_get_pubkey(X509 *x)\n\t{\n\tif ((x == NULL) || (x->cert_info == NULL))\n\t\treturn(NULL);\n\treturn(X509_PUBKEY_get(x->cert_info->key));\n\t}']