ssl/s3_srvr.c:1500: error: NULL_DEREFERENCE
  pointer `pkey` last assigned on line 1387 could be null and is dereferenced by call to `EVP_PKEY_free()` at line 1500, column 2.
Showing all 33 steps of the trace


ssl/s3_srvr.c:1366:1: start of procedure ssl3_get_cert_verify()
1364.   	}
1365.   
1366. > static int ssl3_get_cert_verify(SSL *s)
1367.   	{
1368.   	EVP_PKEY *pkey=NULL;

ssl/s3_srvr.c:1368:2: 
1366.   static int ssl3_get_cert_verify(SSL *s)
1367.   	{
1368. > 	EVP_PKEY *pkey=NULL;
1369.   	unsigned char *p;
1370.   	int al,ok,ret=0;

ssl/s3_srvr.c:1370:2: 
1368.   	EVP_PKEY *pkey=NULL;
1369.   	unsigned char *p;
1370. > 	int al,ok,ret=0;
1371.   	long n;
1372.   	int type=0,i,j;

ssl/s3_srvr.c:1372:2: 
1370.   	int al,ok,ret=0;
1371.   	long n;
1372. > 	int type=0,i,j;
1373.   	X509 *peer;
1374.   

ssl/s3_srvr.c:1375:2: Skipping ssl3_get_message(): empty list of specs
1373.   	X509 *peer;
1374.   
1375.   	n=ssl3_get_message(s,
         ^
1376.   		SSL3_ST_SR_CERT_VRFY_A,
1377.   		SSL3_ST_SR_CERT_VRFY_B,

ssl/s3_srvr.c:1382:7: Taking false branch
1380.   		&ok);
1381.   
1382.   	if (!ok) return((int)n);
              ^
1383.   
1384.   	if (s->session->peer != NULL)

ssl/s3_srvr.c:1384:6: Taking true branch
1382.   	if (!ok) return((int)n);
1383.   
1384.   	if (s->session->peer != NULL)
             ^
1385.   		{
1386.   		peer=s->session->peer;

ssl/s3_srvr.c:1386:3: 
1384.   	if (s->session->peer != NULL)
1385.   		{
1386. > 		peer=s->session->peer;
1387.   		pkey=X509_get_pubkey(peer);
1388.   		type=X509_certificate_type(peer,pkey);

ssl/s3_srvr.c:1387:3: 
1385.   		{
1386.   		peer=s->session->peer;
1387. > 		pkey=X509_get_pubkey(peer);
1388.   		type=X509_certificate_type(peer,pkey);
1389.   		}

crypto/x509/x509_cmp.c:239:1: start of procedure X509_get_pubkey()
  237.   	}
  238.   
  239. > EVP_PKEY *X509_get_pubkey(X509 *x)
  240.   	{
  241.   	if ((x == NULL) || (x->cert_info == NULL))

crypto/x509/x509_cmp.c:241:7: Taking false branch
  239.   EVP_PKEY *X509_get_pubkey(X509 *x)
  240.   	{
  241.   	if ((x == NULL) || (x->cert_info == NULL))
               ^
  242.   		return(NULL);
  243.   	return(X509_PUBKEY_get(x->cert_info->key));

crypto/x509/x509_cmp.c:241:22: Taking true branch
  239.   EVP_PKEY *X509_get_pubkey(X509 *x)
  240.   	{
  241.   	if ((x == NULL) || (x->cert_info == NULL))
                              ^
  242.   		return(NULL);
  243.   	return(X509_PUBKEY_get(x->cert_info->key));

crypto/x509/x509_cmp.c:242:3: 
  240.   	{
  241.   	if ((x == NULL) || (x->cert_info == NULL))
  242. > 		return(NULL);
  243.   	return(X509_PUBKEY_get(x->cert_info->key));
  244.   	}

crypto/x509/x509_cmp.c:244:2: return from a call to X509_get_pubkey
  242.   		return(NULL);
  243.   	return(X509_PUBKEY_get(x->cert_info->key));
  244.   	}
          ^
  245.   
  246.   int X509_check_private_key(X509 *x, EVP_PKEY *k)

ssl/s3_srvr.c:1388:3: Skipping X509_certificate_type(): empty list of specs
1386.   		peer=s->session->peer;
1387.   		pkey=X509_get_pubkey(peer);
1388.   		type=X509_certificate_type(peer,pkey);
          ^
1389.   		}
1390.   	else

ssl/s3_srvr.c:1396:6: Taking true branch
1394.   		}
1395.   
1396.   	if (s->s3->tmp.message_type != SSL3_MT_CERTIFICATE_VERIFY)
             ^
1397.   		{
1398.   		s->s3->tmp.reuse_message=1;

ssl/s3_srvr.c:1398:3: 
1396.   	if (s->s3->tmp.message_type != SSL3_MT_CERTIFICATE_VERIFY)
1397.   		{
1398. > 		s->s3->tmp.reuse_message=1;
1399.   		if ((peer != NULL) && (type | EVP_PKT_SIGN))
1400.   			{

ssl/s3_srvr.c:1399:8: Taking true branch
1397.   		{
1398.   		s->s3->tmp.reuse_message=1;
1399.   		if ((peer != NULL) && (type | EVP_PKT_SIGN))
               ^
1400.   			{
1401.   			al=SSL_AD_UNEXPECTED_MESSAGE;

ssl/s3_srvr.c:1399:26: Taking false branch
1397.   		{
1398.   		s->s3->tmp.reuse_message=1;
1399.   		if ((peer != NULL) && (type | EVP_PKT_SIGN))
                                 ^
1400.   			{
1401.   			al=SSL_AD_UNEXPECTED_MESSAGE;

ssl/s3_srvr.c:1405:3: 
1403.   			goto f_err;
1404.   			}
1405. > 		ret=1;
1406.   		goto end;
1407.   		}

ssl/s3_srvr.c:1499:1: 
1497.   		ssl3_send_alert(s,SSL3_AL_FATAL,al);
1498.   		}
1499. > end:
1500.   	EVP_PKEY_free(pkey);
1501.   	return(ret);

ssl/s3_srvr.c:1500:2: 
1498.   		}
1499.   end:
1500. > 	EVP_PKEY_free(pkey);
1501.   	return(ret);
1502.   	}

crypto/evp/p_lib.c:228:1: start of procedure EVP_PKEY_free()
  226.   	}
  227.   
  228. > void EVP_PKEY_free(EVP_PKEY *x)
  229.   	{
  230.   	int i;

crypto/evp/p_lib.c:232:6: Taking false branch
  230.   	int i;
  231.   
  232.   	if (x == NULL) return;
              ^
  233.   
  234.   	i=CRYPTO_add(&x->references,-1,CRYPTO_LOCK_EVP_PKEY);

crypto/evp/p_lib.c:234:2: 
  232.   	if (x == NULL) return;
  233.   
  234. > 	i=CRYPTO_add(&x->references,-1,CRYPTO_LOCK_EVP_PKEY);
  235.   #ifdef REF_PRINT
  236.   	REF_PRINT("EVP_PKEY",x);

crypto/cryptlib.c:225:1: start of procedure CRYPTO_add_lock()
    223.   	}
    224.   
    225. > int CRYPTO_add_lock(int *pointer, int amount, int type, const char *file,
    226.   	     int line)
    227.   	{

crypto/cryptlib.c:230:6: Taking false branch
    228.   	int ret;
    229.   
    230.   	if (add_lock_callback != NULL)
                ^
    231.   		{
    232.   #ifdef LOCK_DEBUG

crypto/cryptlib.c:248:3: 
    246.   	else
    247.   		{
    248. > 		CRYPTO_lock(CRYPTO_LOCK|CRYPTO_WRITE,type,file,line);
    249.   
    250.   		ret= *pointer+amount;

crypto/cryptlib.c:196:1: start of procedure CRYPTO_lock()
      194.   	}
      195.   
      196. > void CRYPTO_lock(int mode, int type, const char *file, int line)
      197.   	{
      198.   #ifdef LOCK_DEBUG

crypto/cryptlib.c:221:6: Taking false branch
      219.   		}
      220.   #endif
      221.   	if (locking_callback != NULL)
                  ^
      222.   		locking_callback(mode,type,file,line);
      223.   	}

crypto/cryptlib.c:221:2: 
      219.   		}
      220.   #endif
      221. > 	if (locking_callback != NULL)
      222.   		locking_callback(mode,type,file,line);
      223.   	}

crypto/cryptlib.c:223:2: return from a call to CRYPTO_lock
      221.   	if (locking_callback != NULL)
      222.   		locking_callback(mode,type,file,line);
      223.   	}
              ^
      224.   
      225.   int CRYPTO_add_lock(int *pointer, int amount, int type, const char *file,

crypto/cryptlib.c:250:3: 
    248.   		CRYPTO_lock(CRYPTO_LOCK|CRYPTO_WRITE,type,file,line);
    249.   
    250. > 		ret= *pointer+amount;
    251.   #ifdef LOCK_DEBUG
    252.   		fprintf(stderr,"ladd:%08lx:%2d+%2d->%2d %-18s %s:%d\n",

static int ssl3_get_cert_verify(SSL *s)
	{
	EVP_PKEY *pkey=NULL;
	unsigned char *p;
	int al,ok,ret=0;
	long n;
	int type=0,i,j;
	X509 *peer;
	n=ssl3_get_message(s,
		SSL3_ST_SR_CERT_VRFY_A,
		SSL3_ST_SR_CERT_VRFY_B,
		-1,
		512,
		&ok);
	if (!ok) return((int)n);
	if (s->session->peer != NULL)
		{
		peer=s->session->peer;
		pkey=X509_get_pubkey(peer);
		type=X509_certificate_type(peer,pkey);
		}
	else
		{
		peer=NULL;
		pkey=NULL;
		}
	if (s->s3->tmp.message_type != SSL3_MT_CERTIFICATE_VERIFY)
		{
		s->s3->tmp.reuse_message=1;
		if ((peer != NULL) && (type | EVP_PKT_SIGN))
			{
			al=SSL_AD_UNEXPECTED_MESSAGE;
			SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_MISSING_VERIFY_MESSAGE);
			goto f_err;
			}
		ret=1;
		goto end;
		}
	if (peer == NULL)
		{
		SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_NO_CLIENT_CERT_RECEIVED);
		al=SSL_AD_UNEXPECTED_MESSAGE;
		goto f_err;
		}
	if (!(type & EVP_PKT_SIGN))
		{
		SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_SIGNATURE_FOR_NON_SIGNING_CERTIFICATE);
		al=SSL_AD_ILLEGAL_PARAMETER;
		goto f_err;
		}
	if (s->s3->change_cipher_spec)
		{
		SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_CCS_RECEIVED_EARLY);
		al=SSL_AD_UNEXPECTED_MESSAGE;
		goto f_err;
		}
	p=(unsigned char *)s->init_buf->data;
	n2s(p,i);
	n-=2;
	if (i > n)
		{
		SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_LENGTH_MISMATCH);
		al=SSL_AD_DECODE_ERROR;
		goto f_err;
		}
	j=EVP_PKEY_size(pkey);
	if ((i > j) || (n > j) || (n <= 0))
		{
		SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_WRONG_SIGNATURE_SIZE);
		al=SSL_AD_DECODE_ERROR;
		goto f_err;
		}
#ifndef NO_RSA
	if (pkey->type == EVP_PKEY_RSA)
		{
		i=RSA_public_decrypt(i,p,p,pkey->pkey.rsa,RSA_PKCS1_PADDING);
		if (i < 0)
			{
			al=SSL_AD_DECRYPT_ERROR;
			SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_BAD_RSA_DECRYPT);
			goto f_err;
			}
		if ((i != (MD5_DIGEST_LENGTH+SHA_DIGEST_LENGTH)) ||
			memcmp(&(s->s3->tmp.finish_md[0]),p,
				MD5_DIGEST_LENGTH+SHA_DIGEST_LENGTH))
			{
			al=SSL_AD_DECRYPT_ERROR;
			SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_BAD_RSA_SIGNATURE);
			goto f_err;
			}
		}
	else
#endif
#ifndef NO_DSA
		if (pkey->type == EVP_PKEY_DSA)
		{
		j=DSA_verify(pkey->save_type,
			&(s->s3->tmp.finish_md[MD5_DIGEST_LENGTH]),
			SHA_DIGEST_LENGTH,p,i,pkey->pkey.dsa);
		if (j <= 0)
			{
			al=SSL_AD_DECRYPT_ERROR;
			SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_BAD_DSA_SIGNATURE);
			goto f_err;
			}
		}
	else
#endif
		{
		SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_INTERNAL_ERROR);
		al=SSL_AD_UNSUPPORTED_CERTIFICATE;
		goto f_err;
		}
	ret=1;
	if (0)
		{
f_err:
		ssl3_send_alert(s,SSL3_AL_FATAL,al);
		}
end:
	EVP_PKEY_free(pkey);
	return(ret);
	}
['static int ssl3_get_cert_verify(SSL *s)\n\t{\n\tEVP_PKEY *pkey=NULL;\n\tunsigned char *p;\n\tint al,ok,ret=0;\n\tlong n;\n\tint type=0,i,j;\n\tX509 *peer;\n\tn=ssl3_get_message(s,\n\t\tSSL3_ST_SR_CERT_VRFY_A,\n\t\tSSL3_ST_SR_CERT_VRFY_B,\n\t\t-1,\n\t\t512,\n\t\t&ok);\n\tif (!ok) return((int)n);\n\tif (s->session->peer != NULL)\n\t\t{\n\t\tpeer=s->session->peer;\n\t\tpkey=X509_get_pubkey(peer);\n\t\ttype=X509_certificate_type(peer,pkey);\n\t\t}\n\telse\n\t\t{\n\t\tpeer=NULL;\n\t\tpkey=NULL;\n\t\t}\n\tif (s->s3->tmp.message_type != SSL3_MT_CERTIFICATE_VERIFY)\n\t\t{\n\t\ts->s3->tmp.reuse_message=1;\n\t\tif ((peer != NULL) && (type | EVP_PKT_SIGN))\n\t\t\t{\n\t\t\tal=SSL_AD_UNEXPECTED_MESSAGE;\n\t\t\tSSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_MISSING_VERIFY_MESSAGE);\n\t\t\tgoto f_err;\n\t\t\t}\n\t\tret=1;\n\t\tgoto end;\n\t\t}\n\tif (peer == NULL)\n\t\t{\n\t\tSSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_NO_CLIENT_CERT_RECEIVED);\n\t\tal=SSL_AD_UNEXPECTED_MESSAGE;\n\t\tgoto f_err;\n\t\t}\n\tif (!(type & EVP_PKT_SIGN))\n\t\t{\n\t\tSSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_SIGNATURE_FOR_NON_SIGNING_CERTIFICATE);\n\t\tal=SSL_AD_ILLEGAL_PARAMETER;\n\t\tgoto f_err;\n\t\t}\n\tif (s->s3->change_cipher_spec)\n\t\t{\n\t\tSSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_CCS_RECEIVED_EARLY);\n\t\tal=SSL_AD_UNEXPECTED_MESSAGE;\n\t\tgoto f_err;\n\t\t}\n\tp=(unsigned char *)s->init_buf->data;\n\tn2s(p,i);\n\tn-=2;\n\tif (i > n)\n\t\t{\n\t\tSSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_LENGTH_MISMATCH);\n\t\tal=SSL_AD_DECODE_ERROR;\n\t\tgoto f_err;\n\t\t}\n\tj=EVP_PKEY_size(pkey);\n\tif ((i > j) || (n > j) || (n <= 0))\n\t\t{\n\t\tSSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_WRONG_SIGNATURE_SIZE);\n\t\tal=SSL_AD_DECODE_ERROR;\n\t\tgoto f_err;\n\t\t}\n#ifndef NO_RSA\n\tif (pkey->type == EVP_PKEY_RSA)\n\t\t{\n\t\ti=RSA_public_decrypt(i,p,p,pkey->pkey.rsa,RSA_PKCS1_PADDING);\n\t\tif (i < 0)\n\t\t\t{\n\t\t\tal=SSL_AD_DECRYPT_ERROR;\n\t\t\tSSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_BAD_RSA_DECRYPT);\n\t\t\tgoto f_err;\n\t\t\t}\n\t\tif ((i != (MD5_DIGEST_LENGTH+SHA_DIGEST_LENGTH)) ||\n\t\t\tmemcmp(&(s->s3->tmp.finish_md[0]),p,\n\t\t\t\tMD5_DIGEST_LENGTH+SHA_DIGEST_LENGTH))\n\t\t\t{\n\t\t\tal=SSL_AD_DECRYPT_ERROR;\n\t\t\tSSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_BAD_RSA_SIGNATURE);\n\t\t\tgoto f_err;\n\t\t\t}\n\t\t}\n\telse\n#endif\n#ifndef NO_DSA\n\t\tif (pkey->type == EVP_PKEY_DSA)\n\t\t{\n\t\tj=DSA_verify(pkey->save_type,\n\t\t\t&(s->s3->tmp.finish_md[MD5_DIGEST_LENGTH]),\n\t\t\tSHA_DIGEST_LENGTH,p,i,pkey->pkey.dsa);\n\t\tif (j <= 0)\n\t\t\t{\n\t\t\tal=SSL_AD_DECRYPT_ERROR;\n\t\t\tSSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_BAD_DSA_SIGNATURE);\n\t\t\tgoto f_err;\n\t\t\t}\n\t\t}\n\telse\n#endif\n\t\t{\n\t\tSSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_INTERNAL_ERROR);\n\t\tal=SSL_AD_UNSUPPORTED_CERTIFICATE;\n\t\tgoto f_err;\n\t\t}\n\tret=1;\n\tif (0)\n\t\t{\nf_err:\n\t\tssl3_send_alert(s,SSL3_AL_FATAL,al);\n\t\t}\nend:\n\tEVP_PKEY_free(pkey);\n\treturn(ret);\n\t}', 'EVP_PKEY *X509_get_pubkey(X509 *x)\n\t{\n\tif ((x == NULL) || (x->cert_info == NULL))\n\t\treturn(NULL);\n\treturn(X509_PUBKEY_get(x->cert_info->key));\n\t}', 'void EVP_PKEY_free(EVP_PKEY *x)\n\t{\n\tint i;\n\tif (x == NULL) return;\n\ti=CRYPTO_add(&x->references,-1,CRYPTO_LOCK_EVP_PKEY);\n#ifdef REF_PRINT\n\tREF_PRINT("EVP_PKEY",x);\n#endif\n\tif (i > 0) return;\n#ifdef REF_CHECK\n\tif (i < 0)\n\t\t{\n\t\tfprintf(stderr,"EVP_PKEY_free, bad reference count\\n");\n\t\tabort();\n\t\t}\n#endif\n\tEVP_PKEY_free_it(x);\n\tFree((char *)x);\n\t}', 'int CRYPTO_add_lock(int *pointer, int amount, int type, const char *file,\n\t     int line)\n\t{\n\tint ret;\n\tif (add_lock_callback != NULL)\n\t\t{\n#ifdef LOCK_DEBUG\n\t\tint before= *pointer;\n#endif\n\t\tret=add_lock_callback(pointer,amount,type,file,line);\n#ifdef LOCK_DEBUG\n\t\tfprintf(stderr,"ladd:%08lx:%2d+%2d->%2d %-18s %s:%d\\n",\n\t\t\tCRYPTO_thread_id(),\n\t\t\tbefore,amount,ret,\n\t\t\tCRYPTO_get_lock_name(type),\n\t\t\tfile,line);\n#endif\n\t\t*pointer=ret;\n\t\t}\n\telse\n\t\t{\n\t\tCRYPTO_lock(CRYPTO_LOCK|CRYPTO_WRITE,type,file,line);\n\t\tret= *pointer+amount;\n#ifdef LOCK_DEBUG\n\t\tfprintf(stderr,"ladd:%08lx:%2d+%2d->%2d %-18s %s:%d\\n",\n\t\t\tCRYPTO_thread_id(),\n\t\t\t*pointer,amount,ret,\n\t\t\tCRYPTO_get_lock_name(type),\n\t\t\tfile,line);\n#endif\n\t\t*pointer=ret;\n\t\tCRYPTO_lock(CRYPTO_UNLOCK|CRYPTO_WRITE,type,file,line);\n\t\t}\n\treturn(ret);\n\t}', 'void CRYPTO_lock(int mode, int type, const char *file, int line)\n\t{\n#ifdef LOCK_DEBUG\n\t\t{\n\t\tchar *rw_text,*operation_text;\n\t\tif (mode & CRYPTO_LOCK)\n\t\t\toperation_text="lock  ";\n\t\telse if (mode & CRYPTO_UNLOCK)\n\t\t\toperation_text="unlock";\n\t\telse\n\t\t\toperation_text="ERROR ";\n\t\tif (mode & CRYPTO_READ)\n\t\t\trw_text="r";\n\t\telse if (mode & CRYPTO_WRITE)\n\t\t\trw_text="w";\n\t\telse\n\t\t\trw_text="ERROR";\n\t\tfprintf(stderr,"lock:%08lx:(%s)%s %-18s %s:%d\\n",\n\t\t\tCRYPTO_thread_id(), rw_text, operation_text,\n\t\t\tCRYPTO_get_lock_name(type), file, line);\n\t\t}\n#endif\n\tif (locking_callback != NULL)\n\t\tlocking_callback(mode,type,file,line);\n\t}']