ssl/s3_both.c:383: error: NULL_DEREFERENCE
  pointer `pk` last assigned on line 343 could be null and is dereferenced by call to `EVP_PKEY_free()` at line 383, column 12.
Showing all 24 steps of the trace


ssl/s3_both.c:337:1: start of procedure ssl_cert_type()
335.   	}
336.   
337. > int ssl_cert_type(X509 *x, EVP_PKEY *pkey)
338.   	{
339.   	EVP_PKEY *pk;

ssl/s3_both.c:340:2: 
338.   	{
339.   	EVP_PKEY *pk;
340. > 	int ret= -1,i,j;
341.   
342.   	if (pkey == NULL)

ssl/s3_both.c:342:6: Taking true branch
340.   	int ret= -1,i,j;
341.   
342.   	if (pkey == NULL)
            ^
343.   		pk=X509_get_pubkey(x);
344.   	else

ssl/s3_both.c:343:3: 
341.   
342.   	if (pkey == NULL)
343. > 		pk=X509_get_pubkey(x);
344.   	else
345.   		pk=pkey;

crypto/x509/x509_cmp.c:239:1: start of procedure X509_get_pubkey()
  237.   	}
  238.   
  239. > EVP_PKEY *X509_get_pubkey(X509 *x)
  240.   	{
  241.   	if ((x == NULL) || (x->cert_info == NULL))

crypto/x509/x509_cmp.c:241:7: Taking false branch
  239.   EVP_PKEY *X509_get_pubkey(X509 *x)
  240.   	{
  241.   	if ((x == NULL) || (x->cert_info == NULL))
               ^
  242.   		return(NULL);
  243.   	return(X509_PUBKEY_get(x->cert_info->key));

crypto/x509/x509_cmp.c:241:22: Taking true branch
  239.   EVP_PKEY *X509_get_pubkey(X509 *x)
  240.   	{
  241.   	if ((x == NULL) || (x->cert_info == NULL))
                              ^
  242.   		return(NULL);
  243.   	return(X509_PUBKEY_get(x->cert_info->key));

crypto/x509/x509_cmp.c:242:3: 
  240.   	{
  241.   	if ((x == NULL) || (x->cert_info == NULL))
  242. > 		return(NULL);
  243.   	return(X509_PUBKEY_get(x->cert_info->key));
  244.   	}

crypto/x509/x509_cmp.c:244:2: return from a call to X509_get_pubkey
  242.   		return(NULL);
  243.   	return(X509_PUBKEY_get(x->cert_info->key));
  244.   	}
          ^
  245.   
  246.   int X509_check_private_key(X509 *x, EVP_PKEY *k)

ssl/s3_both.c:346:6: Taking true branch
344.   	else
345.   		pk=pkey;
346.   	if (pk == NULL) goto err;
            ^
347.   
348.   	i=pk->type;

ssl/s3_both.c:382:1: 
380.   		ret= -1;
381.   
382. > err:
383.   	if(!pkey) EVP_PKEY_free(pk);
384.   	return(ret);

ssl/s3_both.c:383:6: Taking true branch
381.   
382.   err:
383.   	if(!pkey) EVP_PKEY_free(pk);
            ^
384.   	return(ret);
385.   	}

ssl/s3_both.c:383:12: 
381.   
382.   err:
383. > 	if(!pkey) EVP_PKEY_free(pk);
384.   	return(ret);
385.   	}

crypto/evp/p_lib.c:228:1: start of procedure EVP_PKEY_free()
  226.   	}
  227.   
  228. > void EVP_PKEY_free(EVP_PKEY *x)
  229.   	{
  230.   	int i;

crypto/evp/p_lib.c:232:6: Taking false branch
  230.   	int i;
  231.   
  232.   	if (x == NULL) return;
              ^
  233.   
  234.   	i=CRYPTO_add(&x->references,-1,CRYPTO_LOCK_EVP_PKEY);

crypto/evp/p_lib.c:234:2: 
  232.   	if (x == NULL) return;
  233.   
  234. > 	i=CRYPTO_add(&x->references,-1,CRYPTO_LOCK_EVP_PKEY);
  235.   #ifdef REF_PRINT
  236.   	REF_PRINT("EVP_PKEY",x);

crypto/cryptlib.c:225:1: start of procedure CRYPTO_add_lock()
    223.   	}
    224.   
    225. > int CRYPTO_add_lock(int *pointer, int amount, int type, const char *file,
    226.   	     int line)
    227.   	{

crypto/cryptlib.c:230:6: Taking false branch
    228.   	int ret;
    229.   
    230.   	if (add_lock_callback != NULL)
                ^
    231.   		{
    232.   #ifdef LOCK_DEBUG

crypto/cryptlib.c:248:3: 
    246.   	else
    247.   		{
    248. > 		CRYPTO_lock(CRYPTO_LOCK|CRYPTO_WRITE,type,file,line);
    249.   
    250.   		ret= *pointer+amount;

crypto/cryptlib.c:196:1: start of procedure CRYPTO_lock()
      194.   	}
      195.   
      196. > void CRYPTO_lock(int mode, int type, const char *file, int line)
      197.   	{
      198.   #ifdef LOCK_DEBUG

crypto/cryptlib.c:221:6: Taking false branch
      219.   		}
      220.   #endif
      221.   	if (locking_callback != NULL)
                  ^
      222.   		locking_callback(mode,type,file,line);
      223.   	}

crypto/cryptlib.c:221:2: 
      219.   		}
      220.   #endif
      221. > 	if (locking_callback != NULL)
      222.   		locking_callback(mode,type,file,line);
      223.   	}

crypto/cryptlib.c:223:2: return from a call to CRYPTO_lock
      221.   	if (locking_callback != NULL)
      222.   		locking_callback(mode,type,file,line);
      223.   	}
              ^
      224.   
      225.   int CRYPTO_add_lock(int *pointer, int amount, int type, const char *file,

crypto/cryptlib.c:250:3: 
    248.   		CRYPTO_lock(CRYPTO_LOCK|CRYPTO_WRITE,type,file,line);
    249.   
    250. > 		ret= *pointer+amount;
    251.   #ifdef LOCK_DEBUG
    252.   		fprintf(stderr,"ladd:%08lx:%2d+%2d->%2d %-18s %s:%d\n",

int ssl_cert_type(X509 *x, EVP_PKEY *pkey)
	{
	EVP_PKEY *pk;
	int ret= -1,i,j;
	if (pkey == NULL)
		pk=X509_get_pubkey(x);
	else
		pk=pkey;
	if (pk == NULL) goto err;
	i=pk->type;
	if (i == EVP_PKEY_RSA)
		{
		ret=SSL_PKEY_RSA_ENC;
		if (x != NULL)
			{
			j=X509_get_ext_count(x);
			}
		}
	else if (i == EVP_PKEY_DSA)
		{
		ret=SSL_PKEY_DSA_SIGN;
		}
	else if (i == EVP_PKEY_DH)
		{
		if (x == NULL)
			ret=SSL_PKEY_DH_DSA;
		else
			{
			j=X509_get_signature_type(x);
			if (j == EVP_PKEY_RSA)
				ret=SSL_PKEY_DH_RSA;
			else if (j== EVP_PKEY_DSA)
				ret=SSL_PKEY_DH_DSA;
			else ret= -1;
			}
		}
	else
		ret= -1;
err:
	if(!pkey) EVP_PKEY_free(pk);
	return(ret);
	}
['int ssl_cert_type(X509 *x, EVP_PKEY *pkey)\n\t{\n\tEVP_PKEY *pk;\n\tint ret= -1,i,j;\n\tif (pkey == NULL)\n\t\tpk=X509_get_pubkey(x);\n\telse\n\t\tpk=pkey;\n\tif (pk == NULL) goto err;\n\ti=pk->type;\n\tif (i == EVP_PKEY_RSA)\n\t\t{\n\t\tret=SSL_PKEY_RSA_ENC;\n\t\tif (x != NULL)\n\t\t\t{\n\t\t\tj=X509_get_ext_count(x);\n\t\t\t}\n\t\t}\n\telse if (i == EVP_PKEY_DSA)\n\t\t{\n\t\tret=SSL_PKEY_DSA_SIGN;\n\t\t}\n\telse if (i == EVP_PKEY_DH)\n\t\t{\n\t\tif (x == NULL)\n\t\t\tret=SSL_PKEY_DH_DSA;\n\t\telse\n\t\t\t{\n\t\t\tj=X509_get_signature_type(x);\n\t\t\tif (j == EVP_PKEY_RSA)\n\t\t\t\tret=SSL_PKEY_DH_RSA;\n\t\t\telse if (j== EVP_PKEY_DSA)\n\t\t\t\tret=SSL_PKEY_DH_DSA;\n\t\t\telse ret= -1;\n\t\t\t}\n\t\t}\n\telse\n\t\tret= -1;\nerr:\n\tif(!pkey) EVP_PKEY_free(pk);\n\treturn(ret);\n\t}', 'EVP_PKEY *X509_get_pubkey(X509 *x)\n\t{\n\tif ((x == NULL) || (x->cert_info == NULL))\n\t\treturn(NULL);\n\treturn(X509_PUBKEY_get(x->cert_info->key));\n\t}', 'void EVP_PKEY_free(EVP_PKEY *x)\n\t{\n\tint i;\n\tif (x == NULL) return;\n\ti=CRYPTO_add(&x->references,-1,CRYPTO_LOCK_EVP_PKEY);\n#ifdef REF_PRINT\n\tREF_PRINT("EVP_PKEY",x);\n#endif\n\tif (i > 0) return;\n#ifdef REF_CHECK\n\tif (i < 0)\n\t\t{\n\t\tfprintf(stderr,"EVP_PKEY_free, bad reference count\\n");\n\t\tabort();\n\t\t}\n#endif\n\tEVP_PKEY_free_it(x);\n\tFree((char *)x);\n\t}', 'int CRYPTO_add_lock(int *pointer, int amount, int type, const char *file,\n\t     int line)\n\t{\n\tint ret;\n\tif (add_lock_callback != NULL)\n\t\t{\n#ifdef LOCK_DEBUG\n\t\tint before= *pointer;\n#endif\n\t\tret=add_lock_callback(pointer,amount,type,file,line);\n#ifdef LOCK_DEBUG\n\t\tfprintf(stderr,"ladd:%08lx:%2d+%2d->%2d %-18s %s:%d\\n",\n\t\t\tCRYPTO_thread_id(),\n\t\t\tbefore,amount,ret,\n\t\t\tCRYPTO_get_lock_name(type),\n\t\t\tfile,line);\n#endif\n\t\t*pointer=ret;\n\t\t}\n\telse\n\t\t{\n\t\tCRYPTO_lock(CRYPTO_LOCK|CRYPTO_WRITE,type,file,line);\n\t\tret= *pointer+amount;\n#ifdef LOCK_DEBUG\n\t\tfprintf(stderr,"ladd:%08lx:%2d+%2d->%2d %-18s %s:%d\\n",\n\t\t\tCRYPTO_thread_id(),\n\t\t\t*pointer,amount,ret,\n\t\t\tCRYPTO_get_lock_name(type),\n\t\t\tfile,line);\n#endif\n\t\t*pointer=ret;\n\t\tCRYPTO_lock(CRYPTO_UNLOCK|CRYPTO_WRITE,type,file,line);\n\t\t}\n\treturn(ret);\n\t}', 'void CRYPTO_lock(int mode, int type, const char *file, int line)\n\t{\n#ifdef LOCK_DEBUG\n\t\t{\n\t\tchar *rw_text,*operation_text;\n\t\tif (mode & CRYPTO_LOCK)\n\t\t\toperation_text="lock  ";\n\t\telse if (mode & CRYPTO_UNLOCK)\n\t\t\toperation_text="unlock";\n\t\telse\n\t\t\toperation_text="ERROR ";\n\t\tif (mode & CRYPTO_READ)\n\t\t\trw_text="r";\n\t\telse if (mode & CRYPTO_WRITE)\n\t\t\trw_text="w";\n\t\telse\n\t\t\trw_text="ERROR";\n\t\tfprintf(stderr,"lock:%08lx:(%s)%s %-18s %s:%d\\n",\n\t\t\tCRYPTO_thread_id(), rw_text, operation_text,\n\t\t\tCRYPTO_get_lock_name(type), file, line);\n\t\t}\n#endif\n\tif (locking_callback != NULL)\n\t\tlocking_callback(mode,type,file,line);\n\t}']