ssl/t1_lib.c:4224: error: NULL_DEREFERENCE
  pointer `cpk` last assigned on line 4223 could be null and is dereferenced at line 4224, column 45.
Showing all 34 steps of the trace


ssl/t1_lib.c:4212:1: start of procedure ssl_get_auto_dh()
4210.   
4211.   #ifndef OPENSSL_NO_DH
4212. > DH *ssl_get_auto_dh(SSL *s)
4213.   {
4214.       int dh_secbits = 80;

ssl/t1_lib.c:4214:5: 
4212.   DH *ssl_get_auto_dh(SSL *s)
4213.   {
4214. >     int dh_secbits = 80;
4215.       if (s->cert->dh_tmp_auto == 2)
4216.           return DH_get_1024_160();

ssl/t1_lib.c:4215:9: Taking false branch
4213.   {
4214.       int dh_secbits = 80;
4215.       if (s->cert->dh_tmp_auto == 2)
                ^
4216.           return DH_get_1024_160();
4217.       if (s->s3->tmp.new_cipher->algorithm_auth & (SSL_aNULL | SSL_aPSK)) {

ssl/t1_lib.c:4217:9: Taking false branch
4215.       if (s->cert->dh_tmp_auto == 2)
4216.           return DH_get_1024_160();
4217.       if (s->s3->tmp.new_cipher->algorithm_auth & (SSL_aNULL | SSL_aPSK)) {
                ^
4218.           if (s->s3->tmp.new_cipher->strength_bits == 256)
4219.               dh_secbits = 128;

ssl/t1_lib.c:4223:9: 
4221.               dh_secbits = 80;
4222.       } else {
4223. >         CERT_PKEY *cpk = ssl_get_server_send_pkey(s);
4224.           dh_secbits = EVP_PKEY_security_bits(cpk->privatekey);
4225.       }

ssl/ssl_lib.c:2216:1: start of procedure ssl_get_server_send_pkey()
  2214.   }
  2215.   
  2216. > CERT_PKEY *ssl_get_server_send_pkey(SSL *s)
  2217.   {
  2218.       CERT *c;

ssl/ssl_lib.c:2221:5: 
  2219.       int i;
  2220.   
  2221. >     c = s->cert;
  2222.       if (!s->s3 || !s->s3->tmp.new_cipher)
  2223.           return NULL;

ssl/ssl_lib.c:2222:10: Taking false branch
  2220.   
  2221.       c = s->cert;
  2222.       if (!s->s3 || !s->s3->tmp.new_cipher)
                   ^
  2223.           return NULL;
  2224.       ssl_set_masks(s, s->s3->tmp.new_cipher);

ssl/ssl_lib.c:2222:20: Taking false branch
  2220.   
  2221.       c = s->cert;
  2222.       if (!s->s3 || !s->s3->tmp.new_cipher)
                             ^
  2223.           return NULL;
  2224.       ssl_set_masks(s, s->s3->tmp.new_cipher);

ssl/ssl_lib.c:2224:5: Skipping ssl_set_masks(): empty list of specs
  2222.       if (!s->s3 || !s->s3->tmp.new_cipher)
  2223.           return NULL;
  2224.       ssl_set_masks(s, s->s3->tmp.new_cipher);
              ^
  2225.   
  2226.   #ifdef OPENSSL_SSL_DEBUG_BROKEN_PROTOCOL

ssl/ssl_lib.c:2235:5: 
  2233.   #endif
  2234.   
  2235. >     i = ssl_get_server_cert_index(s);
  2236.   
  2237.       /* This may or may not be an error. */

ssl/ssl_lib.c:2195:1: start of procedure ssl_get_server_cert_index()
    2193.   #endif
    2194.   
    2195. > static int ssl_get_server_cert_index(const SSL *s)
    2196.   {
    2197.       int idx;

ssl/ssl_lib.c:2198:5: 
    2196.   {
    2197.       int idx;
    2198. >     idx = ssl_cipher_get_cert_index(s->s3->tmp.new_cipher);
    2199.       if (idx == SSL_PKEY_RSA_ENC && !s->cert->pkeys[SSL_PKEY_RSA_ENC].x509)
    2200.           idx = SSL_PKEY_RSA_SIGN;

ssl/ssl_ciph.c:1959:1: start of procedure ssl_cipher_get_cert_index()
      1957.   
      1958.   /* For a cipher return the index corresponding to the certificate type */
      1959. > int ssl_cipher_get_cert_index(const SSL_CIPHER *c)
      1960.   {
      1961.       uint32_t alg_k, alg_a;

ssl/ssl_ciph.c:1963:5: 
      1961.       uint32_t alg_k, alg_a;
      1962.   
      1963. >     alg_k = c->algorithm_mkey;
      1964.       alg_a = c->algorithm_auth;
      1965.   

ssl/ssl_ciph.c:1964:5: 
      1962.   
      1963.       alg_k = c->algorithm_mkey;
      1964. >     alg_a = c->algorithm_auth;
      1965.   
      1966.       if (alg_k & (SSL_kECDHr | SSL_kECDHe)) {

ssl/ssl_ciph.c:1966:9: Taking false branch
      1964.       alg_a = c->algorithm_auth;
      1965.   
      1966.       if (alg_k & (SSL_kECDHr | SSL_kECDHe)) {
                      ^
      1967.           /*
      1968.            * we don't need to look at SSL_kECDHE since no certificate is needed

ssl/ssl_ciph.c:1976:16: Taking false branch
      1974.            */
      1975.           return SSL_PKEY_ECC;
      1976.       } else if (alg_a & SSL_aECDSA)
                             ^
      1977.           return SSL_PKEY_ECC;
      1978.       else if (alg_k & SSL_kDHr)

ssl/ssl_ciph.c:1978:14: Taking false branch
      1976.       } else if (alg_a & SSL_aECDSA)
      1977.           return SSL_PKEY_ECC;
      1978.       else if (alg_k & SSL_kDHr)
                           ^
      1979.           return SSL_PKEY_DH_RSA;
      1980.       else if (alg_k & SSL_kDHd)

ssl/ssl_ciph.c:1980:14: Taking false branch
      1978.       else if (alg_k & SSL_kDHr)
      1979.           return SSL_PKEY_DH_RSA;
      1980.       else if (alg_k & SSL_kDHd)
                           ^
      1981.           return SSL_PKEY_DH_DSA;
      1982.       else if (alg_a & SSL_aDSS)

ssl/ssl_ciph.c:1982:14: Taking false branch
      1980.       else if (alg_k & SSL_kDHd)
      1981.           return SSL_PKEY_DH_DSA;
      1982.       else if (alg_a & SSL_aDSS)
                           ^
      1983.           return SSL_PKEY_DSA_SIGN;
      1984.       else if (alg_a & SSL_aRSA)

ssl/ssl_ciph.c:1984:14: Taking true branch
      1982.       else if (alg_a & SSL_aDSS)
      1983.           return SSL_PKEY_DSA_SIGN;
      1984.       else if (alg_a & SSL_aRSA)
                           ^
      1985.           return SSL_PKEY_RSA_ENC;
      1986.       else if (alg_a & SSL_aGOST12)

ssl/ssl_ciph.c:1985:9: 
      1983.           return SSL_PKEY_DSA_SIGN;
      1984.       else if (alg_a & SSL_aRSA)
      1985. >         return SSL_PKEY_RSA_ENC;
      1986.       else if (alg_a & SSL_aGOST12)
      1987.           return SSL_PKEY_GOST_EC;

ssl/ssl_ciph.c:1992:1: return from a call to ssl_cipher_get_cert_index
      1990.   
      1991.       return -1;
      1992. > }
      1993.   
      1994.   const SSL_CIPHER *ssl_get_cipher_by_char(SSL *ssl, const unsigned char *ptr)

ssl/ssl_lib.c:2199:9: Taking true branch
    2197.       int idx;
    2198.       idx = ssl_cipher_get_cert_index(s->s3->tmp.new_cipher);
    2199.       if (idx == SSL_PKEY_RSA_ENC && !s->cert->pkeys[SSL_PKEY_RSA_ENC].x509)
                    ^
    2200.           idx = SSL_PKEY_RSA_SIGN;
    2201.       if (idx == SSL_PKEY_GOST_EC) {

ssl/ssl_lib.c:2199:37: Taking false branch
    2197.       int idx;
    2198.       idx = ssl_cipher_get_cert_index(s->s3->tmp.new_cipher);
    2199.       if (idx == SSL_PKEY_RSA_ENC && !s->cert->pkeys[SSL_PKEY_RSA_ENC].x509)
                                                ^
    2200.           idx = SSL_PKEY_RSA_SIGN;
    2201.       if (idx == SSL_PKEY_GOST_EC) {

ssl/ssl_lib.c:2201:9: Taking false branch
    2199.       if (idx == SSL_PKEY_RSA_ENC && !s->cert->pkeys[SSL_PKEY_RSA_ENC].x509)
    2200.           idx = SSL_PKEY_RSA_SIGN;
    2201.       if (idx == SSL_PKEY_GOST_EC) {
                    ^
    2202.           if (s->cert->pkeys[SSL_PKEY_GOST12_512].x509)
    2203.               idx = SSL_PKEY_GOST12_512;

ssl/ssl_lib.c:2211:9: Taking false branch
    2209.               idx = -1;
    2210.       }
    2211.       if (idx == -1)
                    ^
    2212.           SSLerr(SSL_F_SSL_GET_SERVER_CERT_INDEX, ERR_R_INTERNAL_ERROR);
    2213.       return idx;

ssl/ssl_lib.c:2213:5: 
    2211.       if (idx == -1)
    2212.           SSLerr(SSL_F_SSL_GET_SERVER_CERT_INDEX, ERR_R_INTERNAL_ERROR);
    2213. >     return idx;
    2214.   }
    2215.   

ssl/ssl_lib.c:2214:1: return from a call to ssl_get_server_cert_index
    2212.           SSLerr(SSL_F_SSL_GET_SERVER_CERT_INDEX, ERR_R_INTERNAL_ERROR);
    2213.       return idx;
    2214. > }
    2215.   
    2216.   CERT_PKEY *ssl_get_server_send_pkey(SSL *s)

ssl/ssl_lib.c:2238:9: Taking true branch
  2236.   
  2237.       /* This may or may not be an error. */
  2238.       if (i < 0)
                  ^
  2239.           return NULL;
  2240.   

ssl/ssl_lib.c:2239:9: 
  2237.       /* This may or may not be an error. */
  2238.       if (i < 0)
  2239. >         return NULL;
  2240.   
  2241.       /* May be NULL. */

ssl/ssl_lib.c:2243:1: return from a call to ssl_get_server_send_pkey
  2241.       /* May be NULL. */
  2242.       return &c->pkeys[i];
  2243. > }
  2244.   
  2245.   EVP_PKEY *ssl_get_sign_pkey(SSL *s, const SSL_CIPHER *cipher,

ssl/t1_lib.c:4224:9: 
4222.       } else {
4223.           CERT_PKEY *cpk = ssl_get_server_send_pkey(s);
4224. >         dh_secbits = EVP_PKEY_security_bits(cpk->privatekey);
4225.       }
4226.   

DH *ssl_get_auto_dh(SSL *s)
{
    int dh_secbits = 80;
    if (s->cert->dh_tmp_auto == 2)
        return DH_get_1024_160();
    if (s->s3->tmp.new_cipher->algorithm_auth & (SSL_aNULL | SSL_aPSK)) {
        if (s->s3->tmp.new_cipher->strength_bits == 256)
            dh_secbits = 128;
        else
            dh_secbits = 80;
    } else {
        CERT_PKEY *cpk = ssl_get_server_send_pkey(s);
        dh_secbits = EVP_PKEY_security_bits(cpk->privatekey);
    }
    if (dh_secbits >= 128) {
        DH *dhp = DH_new();
        if (dhp == NULL)
            return NULL;
        dhp->g = BN_new();
        if (dhp->g != NULL)
            BN_set_word(dhp->g, 2);
        if (dh_secbits >= 192)
            dhp->p = get_rfc3526_prime_8192(NULL);
        else
            dhp->p = get_rfc3526_prime_3072(NULL);
        if (dhp->p == NULL || dhp->g == NULL) {
            DH_free(dhp);
            return NULL;
        }
        return dhp;
    }
    if (dh_secbits >= 112)
        return DH_get_2048_224();
    return DH_get_1024_160();
}
['DH *ssl_get_auto_dh(SSL *s)\n{\n    int dh_secbits = 80;\n    if (s->cert->dh_tmp_auto == 2)\n        return DH_get_1024_160();\n    if (s->s3->tmp.new_cipher->algorithm_auth & (SSL_aNULL | SSL_aPSK)) {\n        if (s->s3->tmp.new_cipher->strength_bits == 256)\n            dh_secbits = 128;\n        else\n            dh_secbits = 80;\n    } else {\n        CERT_PKEY *cpk = ssl_get_server_send_pkey(s);\n        dh_secbits = EVP_PKEY_security_bits(cpk->privatekey);\n    }\n    if (dh_secbits >= 128) {\n        DH *dhp = DH_new();\n        if (dhp == NULL)\n            return NULL;\n        dhp->g = BN_new();\n        if (dhp->g != NULL)\n            BN_set_word(dhp->g, 2);\n        if (dh_secbits >= 192)\n            dhp->p = get_rfc3526_prime_8192(NULL);\n        else\n            dhp->p = get_rfc3526_prime_3072(NULL);\n        if (dhp->p == NULL || dhp->g == NULL) {\n            DH_free(dhp);\n            return NULL;\n        }\n        return dhp;\n    }\n    if (dh_secbits >= 112)\n        return DH_get_2048_224();\n    return DH_get_1024_160();\n}', 'CERT_PKEY *ssl_get_server_send_pkey(SSL *s)\n{\n    CERT *c;\n    int i;\n    c = s->cert;\n    if (!s->s3 || !s->s3->tmp.new_cipher)\n        return NULL;\n    ssl_set_masks(s, s->s3->tmp.new_cipher);\n#ifdef OPENSSL_SSL_DEBUG_BROKEN_PROTOCOL\n    if (c->cert_flags & SSL_CERT_FLAG_BROKEN_PROTOCOL)\n        return c->key;\n#endif\n    i = ssl_get_server_cert_index(s);\n    if (i < 0)\n        return NULL;\n    return &c->pkeys[i];\n}', 'static int ssl_get_server_cert_index(const SSL *s)\n{\n    int idx;\n    idx = ssl_cipher_get_cert_index(s->s3->tmp.new_cipher);\n    if (idx == SSL_PKEY_RSA_ENC && !s->cert->pkeys[SSL_PKEY_RSA_ENC].x509)\n        idx = SSL_PKEY_RSA_SIGN;\n    if (idx == SSL_PKEY_GOST_EC) {\n        if (s->cert->pkeys[SSL_PKEY_GOST12_512].x509)\n            idx = SSL_PKEY_GOST12_512;\n        else if (s->cert->pkeys[SSL_PKEY_GOST12_256].x509)\n            idx = SSL_PKEY_GOST12_256;\n        else if (s->cert->pkeys[SSL_PKEY_GOST01].x509)\n            idx = SSL_PKEY_GOST01;\n        else\n            idx = -1;\n    }\n    if (idx == -1)\n        SSLerr(SSL_F_SSL_GET_SERVER_CERT_INDEX, ERR_R_INTERNAL_ERROR);\n    return idx;\n}', 'int ssl_cipher_get_cert_index(const SSL_CIPHER *c)\n{\n    uint32_t alg_k, alg_a;\n    alg_k = c->algorithm_mkey;\n    alg_a = c->algorithm_auth;\n    if (alg_k & (SSL_kECDHr | SSL_kECDHe)) {\n        return SSL_PKEY_ECC;\n    } else if (alg_a & SSL_aECDSA)\n        return SSL_PKEY_ECC;\n    else if (alg_k & SSL_kDHr)\n        return SSL_PKEY_DH_RSA;\n    else if (alg_k & SSL_kDHd)\n        return SSL_PKEY_DH_DSA;\n    else if (alg_a & SSL_aDSS)\n        return SSL_PKEY_DSA_SIGN;\n    else if (alg_a & SSL_aRSA)\n        return SSL_PKEY_RSA_ENC;\n    else if (alg_a & SSL_aGOST12)\n        return SSL_PKEY_GOST_EC;\n    else if (alg_a & SSL_aGOST01)\n        return SSL_PKEY_GOST01;\n    return -1;\n}']