ssl/s3_clnt.c:820: error: NULL_DEREFERENCE
  pointer `pkey` last assigned on line 684 could be null and is dereferenced by call to `EVP_PKEY_free()` at line 820, column 2.
Showing all 44 steps of the trace


ssl/s3_clnt.c:676:1: start of procedure ssl3_get_server_certificate()
674.   	}
675.   
676. > static int ssl3_get_server_certificate(SSL *s)
677.   	{
678.   	int al,i,ok,ret= -1;

ssl/s3_clnt.c:678:2: 
676.   static int ssl3_get_server_certificate(SSL *s)
677.   	{
678. > 	int al,i,ok,ret= -1;
679.   	unsigned long n,nc,llen,l;
680.   	X509 *x=NULL;

ssl/s3_clnt.c:680:2: 
678.   	int al,i,ok,ret= -1;
679.   	unsigned long n,nc,llen,l;
680. > 	X509 *x=NULL;
681.   	unsigned char *p,*d,*q;
682.   	STACK_OF(X509) *sk=NULL;

ssl/s3_clnt.c:682:2: 
680.   	X509 *x=NULL;
681.   	unsigned char *p,*d,*q;
682. > 	STACK_OF(X509) *sk=NULL;
683.   	SESS_CERT *sc;
684.   	EVP_PKEY *pkey=NULL;

ssl/s3_clnt.c:684:2: 
682.   	STACK_OF(X509) *sk=NULL;
683.   	SESS_CERT *sc;
684. > 	EVP_PKEY *pkey=NULL;
685.   
686.   	n=ssl3_get_message(s,

ssl/s3_clnt.c:686:2: Skipping ssl3_get_message(): empty list of specs
684.   	EVP_PKEY *pkey=NULL;
685.   
686.   	n=ssl3_get_message(s,
        ^
687.   		SSL3_ST_CR_CERT_A,
688.   		SSL3_ST_CR_CERT_B,

ssl/s3_clnt.c:697:7: Taking false branch
695.   		&ok);
696.   
697.   	if (!ok) return((int)n);
             ^
698.   
699.   	if (s->s3->tmp.message_type == SSL3_MT_SERVER_KEY_EXCHANGE)

ssl/s3_clnt.c:699:6: Taking false branch
697.   	if (!ok) return((int)n);
698.   
699.   	if (s->s3->tmp.message_type == SSL3_MT_SERVER_KEY_EXCHANGE)
            ^
700.   		{
701.   		s->s3->tmp.reuse_message=1;

ssl/s3_clnt.c:705:6: Taking false branch
703.   		}
704.   
705.   	if (s->s3->tmp.message_type != SSL3_MT_CERTIFICATE)
            ^
706.   		{
707.   		al=SSL_AD_UNEXPECTED_MESSAGE;

ssl/s3_clnt.c:711:2: 
709.   		goto f_err;
710.   		}
711. > 	d=p=(unsigned char *)s->init_buf->data;
712.   
713.   	if ((sk=sk_X509_new_null()) == NULL)

ssl/s3_clnt.c:713:6: 
711.   	d=p=(unsigned char *)s->init_buf->data;
712.   
713. > 	if ((sk=sk_X509_new_null()) == NULL)
714.   		{
715.   		SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,ERR_R_MALLOC_FAILURE);

crypto/x509/x509_vfy.c:799:1: start of procedure sk_X509_new_null()
  797.   
  798.   
  799. > IMPLEMENT_STACK_OF(X509)
  800.   IMPLEMENT_ASN1_SET_OF(X509)
  801.   

crypto/x509/x509_vfy.c:799:1: return from a call to sk_X509_new_null
  797.   
  798.   
  799. > IMPLEMENT_STACK_OF(X509)
  800.   IMPLEMENT_ASN1_SET_OF(X509)
  801.   

ssl/s3_clnt.c:713:6: Taking false branch
711.   	d=p=(unsigned char *)s->init_buf->data;
712.   
713.   	if ((sk=sk_X509_new_null()) == NULL)
            ^
714.   		{
715.   		SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,ERR_R_MALLOC_FAILURE);

ssl/s3_clnt.c:719:2: 
717.   		}
718.   
719. > 	n2l3(p,llen);
720.   	if (llen+3 != n)
721.   		{

ssl/s3_clnt.c:720:6: Taking false branch
718.   
719.   	n2l3(p,llen);
720.   	if (llen+3 != n)
            ^
721.   		{
722.   		al=SSL_AD_DECODE_ERROR;

ssl/s3_clnt.c:726:7: 
724.   		goto f_err;
725.   		}
726. > 	for (nc=0; nc<llen; )
727.   		{
728.   		n2l3(p,l);

ssl/s3_clnt.c:726:13: Loop condition is true. Entering loop body
724.   		goto f_err;
725.   		}
726.   	for (nc=0; nc<llen; )
                   ^
727.   		{
728.   		n2l3(p,l);

ssl/s3_clnt.c:728:3: 
726.   	for (nc=0; nc<llen; )
727.   		{
728. > 		n2l3(p,l);
729.   		if ((l+nc+3) > llen)
730.   			{

ssl/s3_clnt.c:729:7: Taking false branch
727.   		{
728.   		n2l3(p,l);
729.   		if ((l+nc+3) > llen)
             ^
730.   			{
731.   			al=SSL_AD_DECODE_ERROR;

ssl/s3_clnt.c:736:3: 
734.   			}
735.   
736. > 		q=p;
737.   		x=d2i_X509(NULL,&q,l);
738.   		if (x == NULL)

ssl/s3_clnt.c:737:3: Skipping d2i_X509(): empty list of specs
735.   
736.   		q=p;
737.   		x=d2i_X509(NULL,&q,l);
         ^
738.   		if (x == NULL)
739.   			{

ssl/s3_clnt.c:738:7: Taking false branch
736.   		q=p;
737.   		x=d2i_X509(NULL,&q,l);
738.   		if (x == NULL)
             ^
739.   			{
740.   			al=SSL_AD_BAD_CERTIFICATE;

ssl/s3_clnt.c:744:7: Taking false branch
742.   			goto f_err;
743.   			}
744.   		if (q != (p+l))
             ^
745.   			{
746.   			al=SSL_AD_DECODE_ERROR;

ssl/s3_clnt.c:750:8: 
748.   			goto f_err;
749.   			}
750. > 		if (!sk_X509_push(sk,x))
751.   			{
752.   			SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,ERR_R_MALLOC_FAILURE);

crypto/x509/x509_vfy.c:799:1: start of procedure sk_X509_push()
  797.   
  798.   
  799. > IMPLEMENT_STACK_OF(X509)
  800.   IMPLEMENT_ASN1_SET_OF(X509)
  801.   

crypto/stack/stack.c:233:1: start of procedure sk_push()
    231.   	}
    232.   
    233. > int sk_push(STACK *st, char *data)
    234.   	{
    235.   	return(sk_insert(st,data,st->num));

crypto/stack/stack.c:235:2: Skipping sk_insert(): empty list of specs
    233.   int sk_push(STACK *st, char *data)
    234.   	{
    235.   	return(sk_insert(st,data,st->num));
            ^
    236.   	}
    237.   

crypto/stack/stack.c:236:2: return from a call to sk_push
    234.   	{
    235.   	return(sk_insert(st,data,st->num));
    236.   	}
            ^
    237.   
    238.   int sk_unshift(STACK *st, char *data)

crypto/x509/x509_vfy.c:799:1: return from a call to sk_X509_push
  797.   
  798.   
  799. > IMPLEMENT_STACK_OF(X509)
  800.   IMPLEMENT_ASN1_SET_OF(X509)
  801.   

ssl/s3_clnt.c:750:8: Taking true branch
748.   			goto f_err;
749.   			}
750.   		if (!sk_X509_push(sk,x))
              ^
751.   			{
752.   			SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,ERR_R_MALLOC_FAILURE);

ssl/s3_clnt.c:752:4: 
750.   		if (!sk_X509_push(sk,x))
751.   			{
752. > 			SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,ERR_R_MALLOC_FAILURE);
753.   			goto err;
754.   			}

crypto/err/err.c:246:1: start of procedure ERR_put_error()
  244.   /********************************************************/
  245.   
  246. > void ERR_put_error(int lib, int func, int reason, const char *file,
  247.   	     int line)
  248.   	{

crypto/err/err.c:270:2: Skipping ERR_get_state(): empty list of specs
  268.   	}
  269.   #endif
  270.   	es=ERR_get_state();
          ^
  271.   
  272.   	es->top=(es->top+1)%ERR_NUM_ERRORS;

crypto/err/err.c:272:2: 
  270.   	es=ERR_get_state();
  271.   
  272. > 	es->top=(es->top+1)%ERR_NUM_ERRORS;
  273.   	if (es->top == es->bottom)
  274.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;

crypto/err/err.c:273:6: Taking false branch
  271.   
  272.   	es->top=(es->top+1)%ERR_NUM_ERRORS;
  273.   	if (es->top == es->bottom)
              ^
  274.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
  275.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);

crypto/err/err.c:275:2: 
  273.   	if (es->top == es->bottom)
  274.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
  275. > 	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
  276.   	es->err_file[es->top]=file;
  277.   	es->err_line[es->top]=line;

crypto/err/err.c:276:2: 
  274.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
  275.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
  276. > 	es->err_file[es->top]=file;
  277.   	es->err_line[es->top]=line;
  278.   	err_clear_data(es,es->top);

crypto/err/err.c:277:2: 
  275.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
  276.   	es->err_file[es->top]=file;
  277. > 	es->err_line[es->top]=line;
  278.   	err_clear_data(es,es->top);
  279.   	}

crypto/err/err.c:278:2: Taking true branch
  276.   	es->err_file[es->top]=file;
  277.   	es->err_line[es->top]=line;
  278.   	err_clear_data(es,es->top);
          ^
  279.   	}
  280.   

crypto/err/err.c:278:2: Taking false branch
  276.   	es->err_file[es->top]=file;
  277.   	es->err_line[es->top]=line;
  278.   	err_clear_data(es,es->top);
          ^
  279.   	}
  280.   

crypto/err/err.c:279:2: return from a call to ERR_put_error
  277.   	es->err_line[es->top]=line;
  278.   	err_clear_data(es,es->top);
  279.   	}
          ^
  280.   
  281.   void ERR_clear_error(void)

ssl/s3_clnt.c:819:1: 
817.   		ssl3_send_alert(s,SSL3_AL_FATAL,al);
818.   		}
819. > err:
820.   	EVP_PKEY_free(pkey);
821.   	X509_free(x);

ssl/s3_clnt.c:820:2: 
818.   		}
819.   err:
820. > 	EVP_PKEY_free(pkey);
821.   	X509_free(x);
822.   	sk_X509_pop_free(sk,X509_free);

static int ssl3_get_server_certificate(SSL *s)
	{
	int al,i,ok,ret= -1;
	unsigned long n,nc,llen,l;
	X509 *x=NULL;
	unsigned char *p,*d,*q;
	STACK_OF(X509) *sk=NULL;
	SESS_CERT *sc;
	EVP_PKEY *pkey=NULL;
	n=ssl3_get_message(s,
		SSL3_ST_CR_CERT_A,
		SSL3_ST_CR_CERT_B,
		-1,
#if defined(MSDOS) && !defined(WIN32)
		1024*30,
#else
		1024*100,
#endif
		&ok);
	if (!ok) return((int)n);
	if (s->s3->tmp.message_type == SSL3_MT_SERVER_KEY_EXCHANGE)
		{
		s->s3->tmp.reuse_message=1;
		return(1);
		}
	if (s->s3->tmp.message_type != SSL3_MT_CERTIFICATE)
		{
		al=SSL_AD_UNEXPECTED_MESSAGE;
		SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,SSL_R_BAD_MESSAGE_TYPE);
		goto f_err;
		}
	d=p=(unsigned char *)s->init_buf->data;
	if ((sk=sk_X509_new_null()) == NULL)
		{
		SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,ERR_R_MALLOC_FAILURE);
		goto err;
		}
	n2l3(p,llen);
	if (llen+3 != n)
		{
		al=SSL_AD_DECODE_ERROR;
		SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,SSL_R_LENGTH_MISMATCH);
		goto f_err;
		}
	for (nc=0; nc<llen; )
		{
		n2l3(p,l);
		if ((l+nc+3) > llen)
			{
			al=SSL_AD_DECODE_ERROR;
			SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,SSL_R_CERT_LENGTH_MISMATCH);
			goto f_err;
			}
		q=p;
		x=d2i_X509(NULL,&q,l);
		if (x == NULL)
			{
			al=SSL_AD_BAD_CERTIFICATE;
			SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,ERR_R_ASN1_LIB);
			goto f_err;
			}
		if (q != (p+l))
			{
			al=SSL_AD_DECODE_ERROR;
			SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,SSL_R_CERT_LENGTH_MISMATCH);
			goto f_err;
			}
		if (!sk_X509_push(sk,x))
			{
			SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,ERR_R_MALLOC_FAILURE);
			goto err;
			}
		x=NULL;
		nc+=l+3;
		p=q;
		}
	i=ssl_verify_cert_chain(s,sk);
	if ((s->verify_mode != SSL_VERIFY_NONE) && (!i))
		{
		al=ssl_verify_alarm_type(s->verify_result);
		SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,SSL_R_CERTIFICATE_VERIFY_FAILED);
		goto f_err;
		}
	sc=ssl_sess_cert_new();
	if (sc == NULL) goto err;
	if (s->session->sess_cert) ssl_sess_cert_free(s->session->sess_cert);
	s->session->sess_cert=sc;
	sc->cert_chain=sk;
	x=sk_X509_value(sk,0);
	sk=NULL;
	pkey=X509_get_pubkey(x);
	if ((pkey == NULL) || EVP_PKEY_missing_parameters(pkey))
		{
		x=NULL;
		al=SSL3_AL_FATAL;
		SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,SSL_R_UNABLE_TO_FIND_PUBLIC_KEY_PARAMETERS);
		goto f_err;
		}
	i=ssl_cert_type(x,pkey);
	if (i < 0)
		{
		x=NULL;
		al=SSL3_AL_FATAL;
		SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,SSL_R_UNKNOWN_CERTIFICATE_TYPE);
		goto f_err;
		}
	sc->peer_cert_type=i;
	CRYPTO_add(&x->references,1,CRYPTO_LOCK_X509);
	if (sc->peer_pkeys[i].x509 != NULL)
		X509_free(sc->peer_pkeys[i].x509);
	sc->peer_pkeys[i].x509=x;
	sc->peer_key= &(sc->peer_pkeys[i]);
	if (s->session->peer != NULL)
		X509_free(s->session->peer);
	CRYPTO_add(&x->references,1,CRYPTO_LOCK_X509);
	s->session->peer=x;
	x=NULL;
	ret=1;
	if (0)
		{
f_err:
		ssl3_send_alert(s,SSL3_AL_FATAL,al);
		}
err:
	EVP_PKEY_free(pkey);
	X509_free(x);
	sk_X509_pop_free(sk,X509_free);
	return(ret);
	}
['static int ssl3_get_server_certificate(SSL *s)\n\t{\n\tint al,i,ok,ret= -1;\n\tunsigned long n,nc,llen,l;\n\tX509 *x=NULL;\n\tunsigned char *p,*d,*q;\n\tSTACK_OF(X509) *sk=NULL;\n\tSESS_CERT *sc;\n\tEVP_PKEY *pkey=NULL;\n\tn=ssl3_get_message(s,\n\t\tSSL3_ST_CR_CERT_A,\n\t\tSSL3_ST_CR_CERT_B,\n\t\t-1,\n#if defined(MSDOS) && !defined(WIN32)\n\t\t1024*30,\n#else\n\t\t1024*100,\n#endif\n\t\t&ok);\n\tif (!ok) return((int)n);\n\tif (s->s3->tmp.message_type == SSL3_MT_SERVER_KEY_EXCHANGE)\n\t\t{\n\t\ts->s3->tmp.reuse_message=1;\n\t\treturn(1);\n\t\t}\n\tif (s->s3->tmp.message_type != SSL3_MT_CERTIFICATE)\n\t\t{\n\t\tal=SSL_AD_UNEXPECTED_MESSAGE;\n\t\tSSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,SSL_R_BAD_MESSAGE_TYPE);\n\t\tgoto f_err;\n\t\t}\n\td=p=(unsigned char *)s->init_buf->data;\n\tif ((sk=sk_X509_new_null()) == NULL)\n\t\t{\n\t\tSSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,ERR_R_MALLOC_FAILURE);\n\t\tgoto err;\n\t\t}\n\tn2l3(p,llen);\n\tif (llen+3 != n)\n\t\t{\n\t\tal=SSL_AD_DECODE_ERROR;\n\t\tSSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,SSL_R_LENGTH_MISMATCH);\n\t\tgoto f_err;\n\t\t}\n\tfor (nc=0; nc<llen; )\n\t\t{\n\t\tn2l3(p,l);\n\t\tif ((l+nc+3) > llen)\n\t\t\t{\n\t\t\tal=SSL_AD_DECODE_ERROR;\n\t\t\tSSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,SSL_R_CERT_LENGTH_MISMATCH);\n\t\t\tgoto f_err;\n\t\t\t}\n\t\tq=p;\n\t\tx=d2i_X509(NULL,&q,l);\n\t\tif (x == NULL)\n\t\t\t{\n\t\t\tal=SSL_AD_BAD_CERTIFICATE;\n\t\t\tSSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,ERR_R_ASN1_LIB);\n\t\t\tgoto f_err;\n\t\t\t}\n\t\tif (q != (p+l))\n\t\t\t{\n\t\t\tal=SSL_AD_DECODE_ERROR;\n\t\t\tSSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,SSL_R_CERT_LENGTH_MISMATCH);\n\t\t\tgoto f_err;\n\t\t\t}\n\t\tif (!sk_X509_push(sk,x))\n\t\t\t{\n\t\t\tSSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,ERR_R_MALLOC_FAILURE);\n\t\t\tgoto err;\n\t\t\t}\n\t\tx=NULL;\n\t\tnc+=l+3;\n\t\tp=q;\n\t\t}\n\ti=ssl_verify_cert_chain(s,sk);\n\tif ((s->verify_mode != SSL_VERIFY_NONE) && (!i))\n\t\t{\n\t\tal=ssl_verify_alarm_type(s->verify_result);\n\t\tSSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,SSL_R_CERTIFICATE_VERIFY_FAILED);\n\t\tgoto f_err;\n\t\t}\n\tsc=ssl_sess_cert_new();\n\tif (sc == NULL) goto err;\n\tif (s->session->sess_cert) ssl_sess_cert_free(s->session->sess_cert);\n\ts->session->sess_cert=sc;\n\tsc->cert_chain=sk;\n\tx=sk_X509_value(sk,0);\n\tsk=NULL;\n\tpkey=X509_get_pubkey(x);\n\tif ((pkey == NULL) || EVP_PKEY_missing_parameters(pkey))\n\t\t{\n\t\tx=NULL;\n\t\tal=SSL3_AL_FATAL;\n\t\tSSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,SSL_R_UNABLE_TO_FIND_PUBLIC_KEY_PARAMETERS);\n\t\tgoto f_err;\n\t\t}\n\ti=ssl_cert_type(x,pkey);\n\tif (i < 0)\n\t\t{\n\t\tx=NULL;\n\t\tal=SSL3_AL_FATAL;\n\t\tSSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,SSL_R_UNKNOWN_CERTIFICATE_TYPE);\n\t\tgoto f_err;\n\t\t}\n\tsc->peer_cert_type=i;\n\tCRYPTO_add(&x->references,1,CRYPTO_LOCK_X509);\n\tif (sc->peer_pkeys[i].x509 != NULL)\n\t\tX509_free(sc->peer_pkeys[i].x509);\n\tsc->peer_pkeys[i].x509=x;\n\tsc->peer_key= &(sc->peer_pkeys[i]);\n\tif (s->session->peer != NULL)\n\t\tX509_free(s->session->peer);\n\tCRYPTO_add(&x->references,1,CRYPTO_LOCK_X509);\n\ts->session->peer=x;\n\tx=NULL;\n\tret=1;\n\tif (0)\n\t\t{\nf_err:\n\t\tssl3_send_alert(s,SSL3_AL_FATAL,al);\n\t\t}\nerr:\n\tEVP_PKEY_free(pkey);\n\tX509_free(x);\n\tsk_X509_pop_free(sk,X509_free);\n\treturn(ret);\n\t}', 'IMPLEMENT_STACK_OF(X509)', 'int sk_push(STACK *st, char *data)\n\t{\n\treturn(sk_insert(st,data,st->num));\n\t}', 'void ERR_put_error(int lib, int func, int reason, const char *file,\n\t     int line)\n\t{\n\tERR_STATE *es;\n#ifdef _OSD_POSIX\n\tif (strncmp(file,"*POSIX(", sizeof("*POSIX(")-1) == 0) {\n\t\tchar *end;\n\t\tfile += sizeof("*POSIX(")-1;\n\t\tend = &file[strlen(file)-1];\n\t\tif (*end == \')\')\n\t\t\t*end = \'\\0\';\n\t\tif ((end = strrchr(file, \'/\')) != NULL)\n\t\t\tfile = &end[1];\n\t}\n#endif\n\tes=ERR_get_state();\n\tes->top=(es->top+1)%ERR_NUM_ERRORS;\n\tif (es->top == es->bottom)\n\t\tes->bottom=(es->bottom+1)%ERR_NUM_ERRORS;\n\tes->err_buffer[es->top]=ERR_PACK(lib,func,reason);\n\tes->err_file[es->top]=file;\n\tes->err_line[es->top]=line;\n\terr_clear_data(es,es->top);\n\t}']