ssl/s3_clnt.c:1648: error: NULL_DEREFERENCE
  pointer `pkey` last assigned on line 1646 could be null and is dereferenced by call to `EVP_PKEY_free()` at line 1648, column 2.
Showing all 17 steps of the trace


ssl/s3_clnt.c:1609:1: start of procedure ssl3_check_cert_and_algorithm()
1607.   #define has_bits(i,m)	(((i)&(m)) == (m))
1608.   
1609. > static int ssl3_check_cert_and_algorithm(SSL *s)
1610.   	{
1611.   	int i,idx;

ssl/s3_clnt.c:1613:2: 
1611.   	int i,idx;
1612.   	long algs;
1613. > 	EVP_PKEY *pkey=NULL;
1614.   	SESS_CERT *sc;
1615.   #ifndef NO_RSA

ssl/s3_clnt.c:1622:2: 
1620.   #endif
1621.   
1622. > 	sc=s->session->sess_cert;
1623.   
1624.   	if (sc == NULL)

ssl/s3_clnt.c:1624:6: Taking false branch
1622.   	sc=s->session->sess_cert;
1623.   
1624.   	if (sc == NULL)
             ^
1625.   		{
1626.   		SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_INTERNAL_ERROR);

ssl/s3_clnt.c:1630:2: 
1628.   		}
1629.   
1630. > 	algs=s->s3->tmp.new_cipher->algorithms;
1631.   
1632.   	/* we don't have a certificate */

ssl/s3_clnt.c:1633:6: Taking false branch
1631.   
1632.   	/* we don't have a certificate */
1633.   	if (algs & (SSL_aDH|SSL_aNULL))
             ^
1634.   		return(1);
1635.   

ssl/s3_clnt.c:1637:2: 
1635.   
1636.   #ifndef NO_RSA
1637. > 	rsa=s->session->sess_cert->peer_rsa_tmp;
1638.   #endif
1639.   #ifndef NO_DH

ssl/s3_clnt.c:1640:2: 
1638.   #endif
1639.   #ifndef NO_DH
1640. > 	dh=s->session->sess_cert->peer_dh_tmp;
1641.   #endif
1642.   

ssl/s3_clnt.c:1645:2: 
1643.   	/* This is the passed certificate */
1644.   
1645. > 	idx=sc->peer_cert_type;
1646.   	pkey=X509_get_pubkey(sc->peer_pkeys[idx].x509);
1647.   	i=X509_certificate_type(sc->peer_pkeys[idx].x509,pkey);

ssl/s3_clnt.c:1646:2: 
1644.   
1645.   	idx=sc->peer_cert_type;
1646. > 	pkey=X509_get_pubkey(sc->peer_pkeys[idx].x509);
1647.   	i=X509_certificate_type(sc->peer_pkeys[idx].x509,pkey);
1648.   	EVP_PKEY_free(pkey);

crypto/x509/x509_cmp.c:254:1: start of procedure X509_get_pubkey()
  252.   	}
  253.   
  254. > EVP_PKEY *X509_get_pubkey(X509 *x)
  255.   	{
  256.   	if ((x == NULL) || (x->cert_info == NULL))

crypto/x509/x509_cmp.c:256:7: Taking false branch
  254.   EVP_PKEY *X509_get_pubkey(X509 *x)
  255.   	{
  256.   	if ((x == NULL) || (x->cert_info == NULL))
               ^
  257.   		return(NULL);
  258.   	return(X509_PUBKEY_get(x->cert_info->key));

crypto/x509/x509_cmp.c:256:22: Taking true branch
  254.   EVP_PKEY *X509_get_pubkey(X509 *x)
  255.   	{
  256.   	if ((x == NULL) || (x->cert_info == NULL))
                              ^
  257.   		return(NULL);
  258.   	return(X509_PUBKEY_get(x->cert_info->key));

crypto/x509/x509_cmp.c:257:3: 
  255.   	{
  256.   	if ((x == NULL) || (x->cert_info == NULL))
  257. > 		return(NULL);
  258.   	return(X509_PUBKEY_get(x->cert_info->key));
  259.   	}

crypto/x509/x509_cmp.c:259:2: return from a call to X509_get_pubkey
  257.   		return(NULL);
  258.   	return(X509_PUBKEY_get(x->cert_info->key));
  259.   	}
          ^
  260.   
  261.   int X509_check_private_key(X509 *x, EVP_PKEY *k)

ssl/s3_clnt.c:1647:2: Skipping X509_certificate_type(): empty list of specs
1645.   	idx=sc->peer_cert_type;
1646.   	pkey=X509_get_pubkey(sc->peer_pkeys[idx].x509);
1647.   	i=X509_certificate_type(sc->peer_pkeys[idx].x509,pkey);
         ^
1648.   	EVP_PKEY_free(pkey);
1649.   

ssl/s3_clnt.c:1648:2: 
1646.   	pkey=X509_get_pubkey(sc->peer_pkeys[idx].x509);
1647.   	i=X509_certificate_type(sc->peer_pkeys[idx].x509,pkey);
1648. > 	EVP_PKEY_free(pkey);
1649.   
1650.   	

static int ssl3_check_cert_and_algorithm(SSL *s)
	{
	int i,idx;
	long algs;
	EVP_PKEY *pkey=NULL;
	SESS_CERT *sc;
#ifndef NO_RSA
	RSA *rsa;
#endif
#ifndef NO_DH
	DH *dh;
#endif
	sc=s->session->sess_cert;
	if (sc == NULL)
		{
		SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_INTERNAL_ERROR);
		goto err;
		}
	algs=s->s3->tmp.new_cipher->algorithms;
	if (algs & (SSL_aDH|SSL_aNULL))
		return(1);
#ifndef NO_RSA
	rsa=s->session->sess_cert->peer_rsa_tmp;
#endif
#ifndef NO_DH
	dh=s->session->sess_cert->peer_dh_tmp;
#endif
	idx=sc->peer_cert_type;
	pkey=X509_get_pubkey(sc->peer_pkeys[idx].x509);
	i=X509_certificate_type(sc->peer_pkeys[idx].x509,pkey);
	EVP_PKEY_free(pkey);
	if ((algs & SSL_aRSA) && !has_bits(i,EVP_PK_RSA|EVP_PKT_SIGN))
		{
		SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_MISSING_RSA_SIGNING_CERT);
		goto f_err;
		}
#ifndef NO_DSA
	else if ((algs & SSL_aDSS) && !has_bits(i,EVP_PK_DSA|EVP_PKT_SIGN))
		{
		SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_MISSING_DSA_SIGNING_CERT);
		goto f_err;
		}
#endif
#ifndef NO_RSA
	if ((algs & SSL_kRSA) &&
		!(has_bits(i,EVP_PK_RSA|EVP_PKT_ENC) || (rsa != NULL)))
		{
		SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_MISSING_RSA_ENCRYPTING_CERT);
		goto f_err;
		}
#endif
#ifndef NO_DH
	if ((algs & SSL_kEDH) &&
		!(has_bits(i,EVP_PK_DH|EVP_PKT_EXCH) || (dh != NULL)))
		{
		SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_MISSING_DH_KEY);
		goto f_err;
		}
	else if ((algs & SSL_kDHr) && !has_bits(i,EVP_PK_DH|EVP_PKS_RSA))
		{
		SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_MISSING_DH_RSA_CERT);
		goto f_err;
		}
#ifndef NO_DSA
	else if ((algs & SSL_kDHd) && !has_bits(i,EVP_PK_DH|EVP_PKS_DSA))
		{
		SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_MISSING_DH_DSA_CERT);
		goto f_err;
		}
#endif
#endif
	if (SSL_C_IS_EXPORT(s->s3->tmp.new_cipher) && !has_bits(i,EVP_PKT_EXP))
		{
#ifndef NO_RSA
		if (algs & SSL_kRSA)
			{
			if (rsa == NULL
			    || RSA_size(rsa) > SSL_C_EXPORT_PKEYLENGTH(s->s3->tmp.new_cipher))
				{
				SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_MISSING_EXPORT_TMP_RSA_KEY);
				goto f_err;
				}
			}
		else
#endif
#ifndef NO_DH
			if (algs & (SSL_kEDH|SSL_kDHr|SSL_kDHd))
			    {
			    if (dh == NULL
				|| DH_size(dh) > SSL_C_EXPORT_PKEYLENGTH(s->s3->tmp.new_cipher))
				{
				SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_MISSING_EXPORT_TMP_DH_KEY);
				goto f_err;
				}
			}
		else
#endif
			{
			SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_UNKNOWN_KEY_EXCHANGE_TYPE);
			goto f_err;
			}
		}
	return(1);
f_err:
	ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_HANDSHAKE_FAILURE);
err:
	return(0);
	}
['static int ssl3_check_cert_and_algorithm(SSL *s)\n\t{\n\tint i,idx;\n\tlong algs;\n\tEVP_PKEY *pkey=NULL;\n\tSESS_CERT *sc;\n#ifndef NO_RSA\n\tRSA *rsa;\n#endif\n#ifndef NO_DH\n\tDH *dh;\n#endif\n\tsc=s->session->sess_cert;\n\tif (sc == NULL)\n\t\t{\n\t\tSSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_INTERNAL_ERROR);\n\t\tgoto err;\n\t\t}\n\talgs=s->s3->tmp.new_cipher->algorithms;\n\tif (algs & (SSL_aDH|SSL_aNULL))\n\t\treturn(1);\n#ifndef NO_RSA\n\trsa=s->session->sess_cert->peer_rsa_tmp;\n#endif\n#ifndef NO_DH\n\tdh=s->session->sess_cert->peer_dh_tmp;\n#endif\n\tidx=sc->peer_cert_type;\n\tpkey=X509_get_pubkey(sc->peer_pkeys[idx].x509);\n\ti=X509_certificate_type(sc->peer_pkeys[idx].x509,pkey);\n\tEVP_PKEY_free(pkey);\n\tif ((algs & SSL_aRSA) && !has_bits(i,EVP_PK_RSA|EVP_PKT_SIGN))\n\t\t{\n\t\tSSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_MISSING_RSA_SIGNING_CERT);\n\t\tgoto f_err;\n\t\t}\n#ifndef NO_DSA\n\telse if ((algs & SSL_aDSS) && !has_bits(i,EVP_PK_DSA|EVP_PKT_SIGN))\n\t\t{\n\t\tSSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_MISSING_DSA_SIGNING_CERT);\n\t\tgoto f_err;\n\t\t}\n#endif\n#ifndef NO_RSA\n\tif ((algs & SSL_kRSA) &&\n\t\t!(has_bits(i,EVP_PK_RSA|EVP_PKT_ENC) || (rsa != NULL)))\n\t\t{\n\t\tSSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_MISSING_RSA_ENCRYPTING_CERT);\n\t\tgoto f_err;\n\t\t}\n#endif\n#ifndef NO_DH\n\tif ((algs & SSL_kEDH) &&\n\t\t!(has_bits(i,EVP_PK_DH|EVP_PKT_EXCH) || (dh != NULL)))\n\t\t{\n\t\tSSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_MISSING_DH_KEY);\n\t\tgoto f_err;\n\t\t}\n\telse if ((algs & SSL_kDHr) && !has_bits(i,EVP_PK_DH|EVP_PKS_RSA))\n\t\t{\n\t\tSSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_MISSING_DH_RSA_CERT);\n\t\tgoto f_err;\n\t\t}\n#ifndef NO_DSA\n\telse if ((algs & SSL_kDHd) && !has_bits(i,EVP_PK_DH|EVP_PKS_DSA))\n\t\t{\n\t\tSSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_MISSING_DH_DSA_CERT);\n\t\tgoto f_err;\n\t\t}\n#endif\n#endif\n\tif (SSL_C_IS_EXPORT(s->s3->tmp.new_cipher) && !has_bits(i,EVP_PKT_EXP))\n\t\t{\n#ifndef NO_RSA\n\t\tif (algs & SSL_kRSA)\n\t\t\t{\n\t\t\tif (rsa == NULL\n\t\t\t    || RSA_size(rsa) > SSL_C_EXPORT_PKEYLENGTH(s->s3->tmp.new_cipher))\n\t\t\t\t{\n\t\t\t\tSSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_MISSING_EXPORT_TMP_RSA_KEY);\n\t\t\t\tgoto f_err;\n\t\t\t\t}\n\t\t\t}\n\t\telse\n#endif\n#ifndef NO_DH\n\t\t\tif (algs & (SSL_kEDH|SSL_kDHr|SSL_kDHd))\n\t\t\t    {\n\t\t\t    if (dh == NULL\n\t\t\t\t|| DH_size(dh) > SSL_C_EXPORT_PKEYLENGTH(s->s3->tmp.new_cipher))\n\t\t\t\t{\n\t\t\t\tSSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_MISSING_EXPORT_TMP_DH_KEY);\n\t\t\t\tgoto f_err;\n\t\t\t\t}\n\t\t\t}\n\t\telse\n#endif\n\t\t\t{\n\t\t\tSSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_UNKNOWN_KEY_EXCHANGE_TYPE);\n\t\t\tgoto f_err;\n\t\t\t}\n\t\t}\n\treturn(1);\nf_err:\n\tssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_HANDSHAKE_FAILURE);\nerr:\n\treturn(0);\n\t}', 'EVP_PKEY *X509_get_pubkey(X509 *x)\n\t{\n\tif ((x == NULL) || (x->cert_info == NULL))\n\t\treturn(NULL);\n\treturn(X509_PUBKEY_get(x->cert_info->key));\n\t}']