crypto/x509/x509_req.c:129: error: NULL_DEREFERENCE
  pointer `xk` last assigned on line 128 could be null and is dereferenced by call to `EVP_PKEY_cmp()` at line 129, column 13.
Showing all 29 steps of the trace


crypto/x509/x509_req.c:123:1: start of procedure X509_REQ_check_private_key()
121.   }
122.   
123. > int X509_REQ_check_private_key(X509_REQ *x, EVP_PKEY *k)
124.   {
125.       EVP_PKEY *xk = NULL;

crypto/x509/x509_req.c:125:5: 
123.   int X509_REQ_check_private_key(X509_REQ *x, EVP_PKEY *k)
124.   {
125. >     EVP_PKEY *xk = NULL;
126.       int ok = 0;
127.   

crypto/x509/x509_req.c:126:5: 
124.   {
125.       EVP_PKEY *xk = NULL;
126. >     int ok = 0;
127.   
128.       xk = X509_REQ_get_pubkey(x);

crypto/x509/x509_req.c:128:5: 
126.       int ok = 0;
127.   
128. >     xk = X509_REQ_get_pubkey(x);
129.       switch (EVP_PKEY_cmp(xk, k)) {
130.       case 1:

crypto/x509/x509_req.c:111:1: start of procedure X509_REQ_get_pubkey()
  109.   }
  110.   
  111. > EVP_PKEY *X509_REQ_get_pubkey(X509_REQ *req)
  112.   {
  113.       if (req == NULL)

crypto/x509/x509_req.c:113:9: Taking false branch
  111.   EVP_PKEY *X509_REQ_get_pubkey(X509_REQ *req)
  112.   {
  113.       if (req == NULL)
                 ^
  114.           return (NULL);
  115.       return (X509_PUBKEY_get(req->req_info.pubkey));

crypto/x509/x509_req.c:115:5: 
  113.       if (req == NULL)
  114.           return (NULL);
  115. >     return (X509_PUBKEY_get(req->req_info.pubkey));
  116.   }
  117.   

crypto/asn1/x_pubkey.c:175:1: start of procedure X509_PUBKEY_get()
    173.   }
    174.   
    175. > EVP_PKEY *X509_PUBKEY_get(X509_PUBKEY *key)
    176.   {
    177.       EVP_PKEY *ret = X509_PUBKEY_get0(key);

crypto/asn1/x_pubkey.c:177:5: 
    175.   EVP_PKEY *X509_PUBKEY_get(X509_PUBKEY *key)
    176.   {
    177. >     EVP_PKEY *ret = X509_PUBKEY_get0(key);
    178.       if (ret != NULL)
    179.           EVP_PKEY_up_ref(ret);

crypto/asn1/x_pubkey.c:124:1: start of procedure X509_PUBKEY_get0()
      122.   }
      123.   
      124. > EVP_PKEY *X509_PUBKEY_get0(X509_PUBKEY *key)
      125.   {
      126.       EVP_PKEY *ret = NULL;

crypto/asn1/x_pubkey.c:126:5: 
      124.   EVP_PKEY *X509_PUBKEY_get0(X509_PUBKEY *key)
      125.   {
      126. >     EVP_PKEY *ret = NULL;
      127.   
      128.       if (key == NULL)

crypto/asn1/x_pubkey.c:128:9: Taking false branch
      126.       EVP_PKEY *ret = NULL;
      127.   
      128.       if (key == NULL)
                     ^
      129.           goto error;
      130.   

crypto/asn1/x_pubkey.c:131:9: Taking false branch
      129.           goto error;
      130.   
      131.       if (key->pkey != NULL)
                     ^
      132.           return key->pkey;
      133.   

crypto/asn1/x_pubkey.c:134:9: Taking true branch
      132.           return key->pkey;
      133.   
      134.       if (key->public_key == NULL)
                     ^
      135.           goto error;
      136.   

crypto/asn1/x_pubkey.c:170:2: 
      168.       return ret;
      169.   
      170. >  error:
      171.       EVP_PKEY_free(ret);
      172.       return (NULL);

crypto/asn1/x_pubkey.c:171:5: 
      169.   
      170.    error:
      171. >     EVP_PKEY_free(ret);
      172.       return (NULL);
      173.   }

crypto/evp/p_lib.c:420:1: start of procedure EVP_PKEY_free()
        418.   }
        419.   
        420. > void EVP_PKEY_free(EVP_PKEY *x)
        421.   {
        422.       int i;

crypto/evp/p_lib.c:424:9: Taking true branch
        422.       int i;
        423.   
        424.       if (x == NULL)
                       ^
        425.           return;
        426.   

crypto/evp/p_lib.c:425:9: 
        423.   
        424.       if (x == NULL)
        425. >         return;
        426.   
        427.       i = CRYPTO_add(&x->references, -1, CRYPTO_LOCK_EVP_PKEY);

crypto/evp/p_lib.c:442:1: return from a call to EVP_PKEY_free
        440.       sk_X509_ATTRIBUTE_pop_free(x->attributes, X509_ATTRIBUTE_free);
        441.       OPENSSL_free(x);
        442. > }
        443.   
        444.   static void EVP_PKEY_free_it(EVP_PKEY *x)

crypto/asn1/x_pubkey.c:172:5: 
      170.    error:
      171.       EVP_PKEY_free(ret);
      172. >     return (NULL);
      173.   }
      174.   

crypto/asn1/x_pubkey.c:173:1: return from a call to X509_PUBKEY_get0
      171.       EVP_PKEY_free(ret);
      172.       return (NULL);
      173. > }
      174.   
      175.   EVP_PKEY *X509_PUBKEY_get(X509_PUBKEY *key)

crypto/asn1/x_pubkey.c:178:9: Taking false branch
    176.   {
    177.       EVP_PKEY *ret = X509_PUBKEY_get0(key);
    178.       if (ret != NULL)
                   ^
    179.           EVP_PKEY_up_ref(ret);
    180.       return ret;

crypto/asn1/x_pubkey.c:180:5: 
    178.       if (ret != NULL)
    179.           EVP_PKEY_up_ref(ret);
    180. >     return ret;
    181.   }
    182.   

crypto/asn1/x_pubkey.c:181:1: return from a call to X509_PUBKEY_get
    179.           EVP_PKEY_up_ref(ret);
    180.       return ret;
    181. > }
    182.   
    183.   /*

crypto/x509/x509_req.c:116:1: return from a call to X509_REQ_get_pubkey
  114.           return (NULL);
  115.       return (X509_PUBKEY_get(req->req_info.pubkey));
  116. > }
  117.   
  118.   X509_PUBKEY *X509_REQ_get_X509_PUBKEY(X509_REQ *req)

crypto/x509/x509_req.c:129:5: 
127.   
128.       xk = X509_REQ_get_pubkey(x);
129. >     switch (EVP_PKEY_cmp(xk, k)) {
130.       case 1:
131.           ok = 1;

crypto/evp/p_lib.c:166:1: start of procedure EVP_PKEY_cmp()
  164.   }
  165.   
  166. > int EVP_PKEY_cmp(const EVP_PKEY *a, const EVP_PKEY *b)
  167.   {
  168.       if (a->type != b->type)

crypto/evp/p_lib.c:168:9: 
  166.   int EVP_PKEY_cmp(const EVP_PKEY *a, const EVP_PKEY *b)
  167.   {
  168. >     if (a->type != b->type)
  169.           return -1;
  170.   

int X509_REQ_check_private_key(X509_REQ *x, EVP_PKEY *k)
{
    EVP_PKEY *xk = NULL;
    int ok = 0;
    xk = X509_REQ_get_pubkey(x);
    switch (EVP_PKEY_cmp(xk, k)) {
    case 1:
        ok = 1;
        break;
    case 0:
        X509err(X509_F_X509_REQ_CHECK_PRIVATE_KEY,
                X509_R_KEY_VALUES_MISMATCH);
        break;
    case -1:
        X509err(X509_F_X509_REQ_CHECK_PRIVATE_KEY, X509_R_KEY_TYPE_MISMATCH);
        break;
    case -2:
#ifndef OPENSSL_NO_EC
        if (EVP_PKEY_id(k) == EVP_PKEY_EC) {
            X509err(X509_F_X509_REQ_CHECK_PRIVATE_KEY, ERR_R_EC_LIB);
            break;
        }
#endif
#ifndef OPENSSL_NO_DH
        if (EVP_PKEY_id(k) == EVP_PKEY_DH) {
            X509err(X509_F_X509_REQ_CHECK_PRIVATE_KEY,
                    X509_R_CANT_CHECK_DH_KEY);
            break;
        }
#endif
        X509err(X509_F_X509_REQ_CHECK_PRIVATE_KEY, X509_R_UNKNOWN_KEY_TYPE);
    }
    EVP_PKEY_free(xk);
    return (ok);
}
['int X509_REQ_check_private_key(X509_REQ *x, EVP_PKEY *k)\n{\n    EVP_PKEY *xk = NULL;\n    int ok = 0;\n    xk = X509_REQ_get_pubkey(x);\n    switch (EVP_PKEY_cmp(xk, k)) {\n    case 1:\n        ok = 1;\n        break;\n    case 0:\n        X509err(X509_F_X509_REQ_CHECK_PRIVATE_KEY,\n                X509_R_KEY_VALUES_MISMATCH);\n        break;\n    case -1:\n        X509err(X509_F_X509_REQ_CHECK_PRIVATE_KEY, X509_R_KEY_TYPE_MISMATCH);\n        break;\n    case -2:\n#ifndef OPENSSL_NO_EC\n        if (EVP_PKEY_id(k) == EVP_PKEY_EC) {\n            X509err(X509_F_X509_REQ_CHECK_PRIVATE_KEY, ERR_R_EC_LIB);\n            break;\n        }\n#endif\n#ifndef OPENSSL_NO_DH\n        if (EVP_PKEY_id(k) == EVP_PKEY_DH) {\n            X509err(X509_F_X509_REQ_CHECK_PRIVATE_KEY,\n                    X509_R_CANT_CHECK_DH_KEY);\n            break;\n        }\n#endif\n        X509err(X509_F_X509_REQ_CHECK_PRIVATE_KEY, X509_R_UNKNOWN_KEY_TYPE);\n    }\n    EVP_PKEY_free(xk);\n    return (ok);\n}', 'EVP_PKEY *X509_REQ_get_pubkey(X509_REQ *req)\n{\n    if (req == NULL)\n        return (NULL);\n    return (X509_PUBKEY_get(req->req_info.pubkey));\n}', 'EVP_PKEY *X509_PUBKEY_get(X509_PUBKEY *key)\n{\n    EVP_PKEY *ret = X509_PUBKEY_get0(key);\n    if (ret != NULL)\n        EVP_PKEY_up_ref(ret);\n    return ret;\n}', 'EVP_PKEY *X509_PUBKEY_get0(X509_PUBKEY *key)\n{\n    EVP_PKEY *ret = NULL;\n    if (key == NULL)\n        goto error;\n    if (key->pkey != NULL)\n        return key->pkey;\n    if (key->public_key == NULL)\n        goto error;\n    if ((ret = EVP_PKEY_new()) == NULL) {\n        X509err(X509_F_X509_PUBKEY_GET0, ERR_R_MALLOC_FAILURE);\n        goto error;\n    }\n    if (!EVP_PKEY_set_type(ret, OBJ_obj2nid(key->algor->algorithm))) {\n        X509err(X509_F_X509_PUBKEY_GET0, X509_R_UNSUPPORTED_ALGORITHM);\n        goto error;\n    }\n    if (ret->ameth->pub_decode) {\n        if (!ret->ameth->pub_decode(ret, key)) {\n            X509err(X509_F_X509_PUBKEY_GET0, X509_R_PUBLIC_KEY_DECODE_ERROR);\n            goto error;\n        }\n    } else {\n        X509err(X509_F_X509_PUBKEY_GET0, X509_R_METHOD_NOT_SUPPORTED);\n        goto error;\n    }\n    CRYPTO_w_lock(CRYPTO_LOCK_EVP_PKEY);\n    if (key->pkey) {\n        CRYPTO_w_unlock(CRYPTO_LOCK_EVP_PKEY);\n        EVP_PKEY_free(ret);\n        ret = key->pkey;\n    } else {\n        key->pkey = ret;\n        CRYPTO_w_unlock(CRYPTO_LOCK_EVP_PKEY);\n    }\n    return ret;\n error:\n    EVP_PKEY_free(ret);\n    return (NULL);\n}', 'void EVP_PKEY_free(EVP_PKEY *x)\n{\n    int i;\n    if (x == NULL)\n        return;\n    i = CRYPTO_add(&x->references, -1, CRYPTO_LOCK_EVP_PKEY);\n#ifdef REF_PRINT\n    REF_PRINT("EVP_PKEY", x);\n#endif\n    if (i > 0)\n        return;\n#ifdef REF_CHECK\n    if (i < 0) {\n        fprintf(stderr, "EVP_PKEY_free, bad reference count\\n");\n        abort();\n    }\n#endif\n    EVP_PKEY_free_it(x);\n    sk_X509_ATTRIBUTE_pop_free(x->attributes, X509_ATTRIBUTE_free);\n    OPENSSL_free(x);\n}', 'int EVP_PKEY_cmp(const EVP_PKEY *a, const EVP_PKEY *b)\n{\n    if (a->type != b->type)\n        return -1;\n    if (a->ameth) {\n        int ret;\n        if (a->ameth->param_cmp) {\n            ret = a->ameth->param_cmp(a, b);\n            if (ret <= 0)\n                return ret;\n        }\n        if (a->ameth->pub_cmp)\n            return a->ameth->pub_cmp(a, b);\n    }\n    return -2;\n}']