ssl/statem/statem_clnt.c:2979: error: NULL_DEREFERENCE
  pointer `pkey` last assigned on line 2978 could be null and is dereferenced by call to `EVP_PKEY_get0_RSA()` at line 2979, column 9.
Showing all 33 steps of the trace


ssl/statem/statem_clnt.c:2959:1: start of procedure tls_construct_cke_rsa()
2957.   }
2958.   
2959. > static int tls_construct_cke_rsa(SSL *s, WPACKET *pkt)
2960.   {
2961.   #ifndef OPENSSL_NO_RSA

ssl/statem/statem_clnt.c:2962:5: 
2960.   {
2961.   #ifndef OPENSSL_NO_RSA
2962. >     unsigned char *encdata = NULL;
2963.       EVP_PKEY *pkey = NULL;
2964.       EVP_PKEY_CTX *pctx = NULL;

ssl/statem/statem_clnt.c:2963:5: 
2961.   #ifndef OPENSSL_NO_RSA
2962.       unsigned char *encdata = NULL;
2963. >     EVP_PKEY *pkey = NULL;
2964.       EVP_PKEY_CTX *pctx = NULL;
2965.       size_t enclen;

ssl/statem/statem_clnt.c:2964:5: 
2962.       unsigned char *encdata = NULL;
2963.       EVP_PKEY *pkey = NULL;
2964. >     EVP_PKEY_CTX *pctx = NULL;
2965.       size_t enclen;
2966.       unsigned char *pms = NULL;

ssl/statem/statem_clnt.c:2966:5: 
2964.       EVP_PKEY_CTX *pctx = NULL;
2965.       size_t enclen;
2966. >     unsigned char *pms = NULL;
2967.       size_t pmslen = 0;
2968.   

ssl/statem/statem_clnt.c:2967:5: 
2965.       size_t enclen;
2966.       unsigned char *pms = NULL;
2967. >     size_t pmslen = 0;
2968.   
2969.       if (s->session->peer == NULL) {

ssl/statem/statem_clnt.c:2969:9: Taking false branch
2967.       size_t pmslen = 0;
2968.   
2969.       if (s->session->peer == NULL) {
                ^
2970.           /*
2971.            * We should always have a server certificate with SSL_kRSA.

ssl/statem/statem_clnt.c:2978:5: 
2976.       }
2977.   
2978. >     pkey = X509_get0_pubkey(s->session->peer);
2979.       if (EVP_PKEY_get0_RSA(pkey) == NULL) {
2980.           SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CKE_RSA,

crypto/x509/x509_cmp.c:264:1: start of procedure X509_get0_pubkey()
  262.   }
  263.   
  264. > EVP_PKEY *X509_get0_pubkey(const X509 *x)
  265.   {
  266.       if (x == NULL)

crypto/x509/x509_cmp.c:266:9: Taking false branch
  264.   EVP_PKEY *X509_get0_pubkey(const X509 *x)
  265.   {
  266.       if (x == NULL)
                 ^
  267.           return NULL;
  268.       return X509_PUBKEY_get0(x->cert_info.key);

crypto/x509/x509_cmp.c:268:5: 
  266.       if (x == NULL)
  267.           return NULL;
  268. >     return X509_PUBKEY_get0(x->cert_info.key);
  269.   }
  270.   

crypto/x509/x_pubkey.c:141:1: start of procedure X509_PUBKEY_get0()
    139.   }
    140.   
    141. > EVP_PKEY *X509_PUBKEY_get0(X509_PUBKEY *key)
    142.   {
    143.       EVP_PKEY *ret = NULL;

crypto/x509/x_pubkey.c:143:5: 
    141.   EVP_PKEY *X509_PUBKEY_get0(X509_PUBKEY *key)
    142.   {
    143. >     EVP_PKEY *ret = NULL;
    144.   
    145.       if (key == NULL || key->public_key == NULL)

crypto/x509/x_pubkey.c:145:9: Taking false branch
    143.       EVP_PKEY *ret = NULL;
    144.   
    145.       if (key == NULL || key->public_key == NULL)
                   ^
    146.           return NULL;
    147.   

crypto/x509/x_pubkey.c:145:24: Taking false branch
    143.       EVP_PKEY *ret = NULL;
    144.   
    145.       if (key == NULL || key->public_key == NULL)
                                  ^
    146.           return NULL;
    147.   

crypto/x509/x_pubkey.c:148:9: Taking false branch
    146.           return NULL;
    147.   
    148.       if (key->pkey != NULL)
                   ^
    149.           return key->pkey;
    150.   

crypto/x509/x_pubkey.c:159:5: 
    157.        * in the queue.
    158.        */
    159. >     x509_pubkey_decode(&ret, key);
    160.       /* If decode doesn't fail something bad happened */
    161.       if (ret != NULL) {

crypto/x509/x_pubkey.c:104:1: start of procedure x509_pubkey_decode()
      102.   
      103.   
      104. > static int x509_pubkey_decode(EVP_PKEY **ppkey, X509_PUBKEY *key)
      105.   {
      106.       EVP_PKEY *pkey = EVP_PKEY_new();

crypto/x509/x_pubkey.c:106:5: Skipping EVP_PKEY_new(): empty list of specs
      104.   static int x509_pubkey_decode(EVP_PKEY **ppkey, X509_PUBKEY *key)
      105.   {
      106.       EVP_PKEY *pkey = EVP_PKEY_new();
                 ^
      107.   
      108.       if (pkey == NULL) {

crypto/x509/x_pubkey.c:108:9: Taking true branch
      106.       EVP_PKEY *pkey = EVP_PKEY_new();
      107.   
      108.       if (pkey == NULL) {
                     ^
      109.           X509err(X509_F_X509_PUBKEY_DECODE, ERR_R_MALLOC_FAILURE);
      110.           return -1;

crypto/x509/x_pubkey.c:109:9: 
      107.   
      108.       if (pkey == NULL) {
      109. >         X509err(X509_F_X509_PUBKEY_DECODE, ERR_R_MALLOC_FAILURE);
      110.           return -1;
      111.       }

providers/fips/fipsprov.c:227:1: start of procedure ERR_put_error()
        225.   }
        226.   
        227. > void ERR_put_error(int lib, int func, int reason, const char *file, int line)
        228.   {
        229.       /*

providers/fips/fipsprov.c:235:5: Skipping __function_pointer__(): unresolved function pointer
        233.        * so we'll need to come up with something else for them.
        234.        */
        235.       c_put_error(lib, func, reason, file, line);
                   ^
        236.   }
        237.   

providers/fips/fipsprov.c:236:1: return from a call to ERR_put_error
        234.        */
        235.       c_put_error(lib, func, reason, file, line);
        236. > }
        237.   
        238.   void ERR_add_error_data(int num, ...)

crypto/x509/x_pubkey.c:110:9: 
      108.       if (pkey == NULL) {
      109.           X509err(X509_F_X509_PUBKEY_DECODE, ERR_R_MALLOC_FAILURE);
      110. >         return -1;
      111.       }
      112.   

crypto/x509/x_pubkey.c:139:1: return from a call to x509_pubkey_decode
      137.       EVP_PKEY_free(pkey);
      138.       return 0;
      139. > }
      140.   
      141.   EVP_PKEY *X509_PUBKEY_get0(X509_PUBKEY *key)

crypto/x509/x_pubkey.c:161:9: Taking false branch
    159.       x509_pubkey_decode(&ret, key);
    160.       /* If decode doesn't fail something bad happened */
    161.       if (ret != NULL) {
                   ^
    162.           X509err(X509_F_X509_PUBKEY_GET0, ERR_R_INTERNAL_ERROR);
    163.           EVP_PKEY_free(ret);

crypto/x509/x_pubkey.c:166:5: 
    164.       }
    165.   
    166. >     return NULL;
    167.   }
    168.   

crypto/x509/x_pubkey.c:167:1: return from a call to X509_PUBKEY_get0
    165.   
    166.       return NULL;
    167. > }
    168.   
    169.   EVP_PKEY *X509_PUBKEY_get(X509_PUBKEY *key)

crypto/x509/x509_cmp.c:269:1: return from a call to X509_get0_pubkey
  267.           return NULL;
  268.       return X509_PUBKEY_get0(x->cert_info.key);
  269. > }
  270.   
  271.   EVP_PKEY *X509_get_pubkey(X509 *x)

ssl/statem/statem_clnt.c:2979:9: 
2977.   
2978.       pkey = X509_get0_pubkey(s->session->peer);
2979. >     if (EVP_PKEY_get0_RSA(pkey) == NULL) {
2980.           SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CKE_RSA,
2981.                    ERR_R_INTERNAL_ERROR);

crypto/evp/p_lib.c:468:1: start of procedure EVP_PKEY_get0_RSA()
  466.   }
  467.   
  468. > RSA *EVP_PKEY_get0_RSA(const EVP_PKEY *pkey)
  469.   {
  470.       if (pkey->type != EVP_PKEY_RSA) {

crypto/evp/p_lib.c:470:9: 
  468.   RSA *EVP_PKEY_get0_RSA(const EVP_PKEY *pkey)
  469.   {
  470. >     if (pkey->type != EVP_PKEY_RSA) {
  471.           EVPerr(EVP_F_EVP_PKEY_GET0_RSA, EVP_R_EXPECTING_AN_RSA_KEY);
  472.           return NULL;

static int tls_construct_cke_rsa(SSL *s, WPACKET *pkt)
{
#ifndef OPENSSL_NO_RSA
    unsigned char *encdata = NULL;
    EVP_PKEY *pkey = NULL;
    EVP_PKEY_CTX *pctx = NULL;
    size_t enclen;
    unsigned char *pms = NULL;
    size_t pmslen = 0;
    if (s->session->peer == NULL) {
        SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CKE_RSA,
                 ERR_R_INTERNAL_ERROR);
        return 0;
    }
    pkey = X509_get0_pubkey(s->session->peer);
    if (EVP_PKEY_get0_RSA(pkey) == NULL) {
        SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CKE_RSA,
                 ERR_R_INTERNAL_ERROR);
        return 0;
    }
    pmslen = SSL_MAX_MASTER_KEY_LENGTH;
    pms = OPENSSL_malloc(pmslen);
    if (pms == NULL) {
        SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CKE_RSA,
                 ERR_R_MALLOC_FAILURE);
        return 0;
    }
    pms[0] = s->client_version >> 8;
    pms[1] = s->client_version & 0xff;
    if (RAND_bytes(pms + 2, (int)(pmslen - 2)) <= 0) {
        SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CKE_RSA,
                 ERR_R_MALLOC_FAILURE);
        goto err;
    }
    if (s->version > SSL3_VERSION && !WPACKET_start_sub_packet_u16(pkt)) {
        SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CKE_RSA,
                 ERR_R_INTERNAL_ERROR);
        goto err;
    }
    pctx = EVP_PKEY_CTX_new(pkey, NULL);
    if (pctx == NULL || EVP_PKEY_encrypt_init(pctx) <= 0
        || EVP_PKEY_encrypt(pctx, NULL, &enclen, pms, pmslen) <= 0) {
        SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CKE_RSA,
                 ERR_R_EVP_LIB);
        goto err;
    }
    if (!WPACKET_allocate_bytes(pkt, enclen, &encdata)
            || EVP_PKEY_encrypt(pctx, encdata, &enclen, pms, pmslen) <= 0) {
        SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CKE_RSA,
                 SSL_R_BAD_RSA_ENCRYPT);
        goto err;
    }
    EVP_PKEY_CTX_free(pctx);
    pctx = NULL;
    if (s->version > SSL3_VERSION && !WPACKET_close(pkt)) {
        SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CKE_RSA,
                 ERR_R_INTERNAL_ERROR);
        goto err;
    }
    if (!ssl_log_rsa_client_key_exchange(s, encdata, enclen, pms, pmslen)) {
        goto err;
    }
    s->s3.tmp.pms = pms;
    s->s3.tmp.pmslen = pmslen;
    return 1;
 err:
    OPENSSL_clear_free(pms, pmslen);
    EVP_PKEY_CTX_free(pctx);
    return 0;
#else
    SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CKE_RSA,
             ERR_R_INTERNAL_ERROR);
    return 0;
#endif
}
['static int tls_construct_cke_rsa(SSL *s, WPACKET *pkt)\n{\n#ifndef OPENSSL_NO_RSA\n    unsigned char *encdata = NULL;\n    EVP_PKEY *pkey = NULL;\n    EVP_PKEY_CTX *pctx = NULL;\n    size_t enclen;\n    unsigned char *pms = NULL;\n    size_t pmslen = 0;\n    if (s->session->peer == NULL) {\n        SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CKE_RSA,\n                 ERR_R_INTERNAL_ERROR);\n        return 0;\n    }\n    pkey = X509_get0_pubkey(s->session->peer);\n    if (EVP_PKEY_get0_RSA(pkey) == NULL) {\n        SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CKE_RSA,\n                 ERR_R_INTERNAL_ERROR);\n        return 0;\n    }\n    pmslen = SSL_MAX_MASTER_KEY_LENGTH;\n    pms = OPENSSL_malloc(pmslen);\n    if (pms == NULL) {\n        SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CKE_RSA,\n                 ERR_R_MALLOC_FAILURE);\n        return 0;\n    }\n    pms[0] = s->client_version >> 8;\n    pms[1] = s->client_version & 0xff;\n    if (RAND_bytes(pms + 2, (int)(pmslen - 2)) <= 0) {\n        SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CKE_RSA,\n                 ERR_R_MALLOC_FAILURE);\n        goto err;\n    }\n    if (s->version > SSL3_VERSION && !WPACKET_start_sub_packet_u16(pkt)) {\n        SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CKE_RSA,\n                 ERR_R_INTERNAL_ERROR);\n        goto err;\n    }\n    pctx = EVP_PKEY_CTX_new(pkey, NULL);\n    if (pctx == NULL || EVP_PKEY_encrypt_init(pctx) <= 0\n        || EVP_PKEY_encrypt(pctx, NULL, &enclen, pms, pmslen) <= 0) {\n        SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CKE_RSA,\n                 ERR_R_EVP_LIB);\n        goto err;\n    }\n    if (!WPACKET_allocate_bytes(pkt, enclen, &encdata)\n            || EVP_PKEY_encrypt(pctx, encdata, &enclen, pms, pmslen) <= 0) {\n        SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CKE_RSA,\n                 SSL_R_BAD_RSA_ENCRYPT);\n        goto err;\n    }\n    EVP_PKEY_CTX_free(pctx);\n    pctx = NULL;\n    if (s->version > SSL3_VERSION && !WPACKET_close(pkt)) {\n        SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CKE_RSA,\n                 ERR_R_INTERNAL_ERROR);\n        goto err;\n    }\n    if (!ssl_log_rsa_client_key_exchange(s, encdata, enclen, pms, pmslen)) {\n        goto err;\n    }\n    s->s3.tmp.pms = pms;\n    s->s3.tmp.pmslen = pmslen;\n    return 1;\n err:\n    OPENSSL_clear_free(pms, pmslen);\n    EVP_PKEY_CTX_free(pctx);\n    return 0;\n#else\n    SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CKE_RSA,\n             ERR_R_INTERNAL_ERROR);\n    return 0;\n#endif\n}', 'EVP_PKEY *X509_get0_pubkey(const X509 *x)\n{\n    if (x == NULL)\n        return NULL;\n    return X509_PUBKEY_get0(x->cert_info.key);\n}', 'EVP_PKEY *X509_PUBKEY_get0(X509_PUBKEY *key)\n{\n    EVP_PKEY *ret = NULL;\n    if (key == NULL || key->public_key == NULL)\n        return NULL;\n    if (key->pkey != NULL)\n        return key->pkey;\n    x509_pubkey_decode(&ret, key);\n    if (ret != NULL) {\n        X509err(X509_F_X509_PUBKEY_GET0, ERR_R_INTERNAL_ERROR);\n        EVP_PKEY_free(ret);\n    }\n    return NULL;\n}', 'static int x509_pubkey_decode(EVP_PKEY **ppkey, X509_PUBKEY *key)\n{\n    EVP_PKEY *pkey = EVP_PKEY_new();\n    if (pkey == NULL) {\n        X509err(X509_F_X509_PUBKEY_DECODE, ERR_R_MALLOC_FAILURE);\n        return -1;\n    }\n    if (!EVP_PKEY_set_type(pkey, OBJ_obj2nid(key->algor->algorithm))) {\n        X509err(X509_F_X509_PUBKEY_DECODE, X509_R_UNSUPPORTED_ALGORITHM);\n        goto error;\n    }\n    if (pkey->ameth->pub_decode) {\n        if (!pkey->ameth->pub_decode(pkey, key)) {\n            X509err(X509_F_X509_PUBKEY_DECODE, X509_R_PUBLIC_KEY_DECODE_ERROR);\n            goto error;\n        }\n    } else {\n        X509err(X509_F_X509_PUBKEY_DECODE, X509_R_METHOD_NOT_SUPPORTED);\n        goto error;\n    }\n    *ppkey = pkey;\n    return 1;\n error:\n    EVP_PKEY_free(pkey);\n    return 0;\n}', 'void ERR_put_error(int lib, int func, int reason, const char *file, int line)\n{\n    c_put_error(lib, func, reason, file, line);\n}', 'RSA *EVP_PKEY_get0_RSA(const EVP_PKEY *pkey)\n{\n    if (pkey->type != EVP_PKEY_RSA) {\n        EVPerr(EVP_F_EVP_PKEY_GET0_RSA, EVP_R_EXPECTING_AN_RSA_KEY);\n        return NULL;\n    }\n    return pkey->pkey.rsa;\n}']