apps/s_server.c:3171: error: NULL_DEREFERENCE
  pointer `rsa_tmp` last assigned on line 3169 could be null and is dereferenced by call to `RSA_free()` at line 3171, column 13.
Showing all 26 steps of the trace


apps/s_server.c:3156:1: start of procedure tmp_rsa_cb()
3154.   
3155.   #ifndef OPENSSL_NO_RSA
3156. > static RSA *tmp_rsa_cb(SSL *s, int is_export, int keylength)
3157.   {
3158.       BIGNUM *bn = NULL;

apps/s_server.c:3158:5: 
3156.   static RSA *tmp_rsa_cb(SSL *s, int is_export, int keylength)
3157.   {
3158. >     BIGNUM *bn = NULL;
3159.       static RSA *rsa_tmp = NULL;
3160.   

apps/s_server.c:3159:5: 
3157.   {
3158.       BIGNUM *bn = NULL;
3159. >     static RSA *rsa_tmp = NULL;
3160.   
3161.       if (!rsa_tmp && ((bn = BN_new()) == NULL))

apps/s_server.c:3161:10: Taking true branch
3159.       static RSA *rsa_tmp = NULL;
3160.   
3161.       if (!rsa_tmp && ((bn = BN_new()) == NULL))
                 ^
3162.           BIO_printf(bio_err, "Allocation error in generating RSA key\n");
3163.       if (!rsa_tmp && bn) {

apps/s_server.c:3161:22: Taking false branch
3159.       static RSA *rsa_tmp = NULL;
3160.   
3161.       if (!rsa_tmp && ((bn = BN_new()) == NULL))
                             ^
3162.           BIO_printf(bio_err, "Allocation error in generating RSA key\n");
3163.       if (!rsa_tmp && bn) {

apps/s_server.c:3163:10: Taking true branch
3161.       if (!rsa_tmp && ((bn = BN_new()) == NULL))
3162.           BIO_printf(bio_err, "Allocation error in generating RSA key\n");
3163.       if (!rsa_tmp && bn) {
                 ^
3164.           if (!s_quiet) {
3165.               BIO_printf(bio_err, "Generating temp (%d bit) RSA key...",

apps/s_server.c:3163:21: Taking true branch
3161.       if (!rsa_tmp && ((bn = BN_new()) == NULL))
3162.           BIO_printf(bio_err, "Allocation error in generating RSA key\n");
3163.       if (!rsa_tmp && bn) {
                            ^
3164.           if (!s_quiet) {
3165.               BIO_printf(bio_err, "Generating temp (%d bit) RSA key...",

apps/s_server.c:3164:14: Taking false branch
3162.           BIO_printf(bio_err, "Allocation error in generating RSA key\n");
3163.       if (!rsa_tmp && bn) {
3164.           if (!s_quiet) {
                     ^
3165.               BIO_printf(bio_err, "Generating temp (%d bit) RSA key...",
3166.                          keylength);

apps/s_server.c:3169:14: 
3167.               (void)BIO_flush(bio_err);
3168.           }
3169. >         if (!BN_set_word(bn, RSA_F4) || ((rsa_tmp = RSA_new()) == NULL) ||
3170.               !RSA_generate_key_ex(rsa_tmp, keylength, bn, NULL)) {
3171.               RSA_free(rsa_tmp);

crypto/bn/bn_lib.c:511:1: start of procedure BN_set_word()
  509.   }
  510.   
  511. > int BN_set_word(BIGNUM *a, BN_ULONG w)
  512.   {
  513.       bn_check_top(a);

crypto/bn/bn_lib.c:514:9: Condition is true
  512.   {
  513.       bn_check_top(a);
  514.       if (bn_expand(a, (int)sizeof(BN_ULONG) * 8) == NULL)
                 ^
  515.           return (0);
  516.       a->neg = 0;

crypto/bn/bn_lib.c:514:9: Taking false branch
  512.   {
  513.       bn_check_top(a);
  514.       if (bn_expand(a, (int)sizeof(BN_ULONG) * 8) == NULL)
                 ^
  515.           return (0);
  516.       a->neg = 0;

crypto/bn/bn_lib.c:516:5: 
  514.       if (bn_expand(a, (int)sizeof(BN_ULONG) * 8) == NULL)
  515.           return (0);
  516. >     a->neg = 0;
  517.       a->d[0] = w;
  518.       a->top = (w ? 1 : 0);

crypto/bn/bn_lib.c:517:5: 
  515.           return (0);
  516.       a->neg = 0;
  517. >     a->d[0] = w;
  518.       a->top = (w ? 1 : 0);
  519.       bn_check_top(a);

crypto/bn/bn_lib.c:518:15: Condition is true
  516.       a->neg = 0;
  517.       a->d[0] = w;
  518.       a->top = (w ? 1 : 0);
                       ^
  519.       bn_check_top(a);
  520.       return (1);

crypto/bn/bn_lib.c:518:5: 
  516.       a->neg = 0;
  517.       a->d[0] = w;
  518. >     a->top = (w ? 1 : 0);
  519.       bn_check_top(a);
  520.       return (1);

crypto/bn/bn_lib.c:520:5: 
  518.       a->top = (w ? 1 : 0);
  519.       bn_check_top(a);
  520. >     return (1);
  521.   }
  522.   

crypto/bn/bn_lib.c:521:1: return from a call to BN_set_word
  519.       bn_check_top(a);
  520.       return (1);
  521. > }
  522.   
  523.   BIGNUM *BN_bin2bn(const unsigned char *s, int len, BIGNUM *ret)

apps/s_server.c:3169:14: Taking false branch
3167.               (void)BIO_flush(bio_err);
3168.           }
3169.           if (!BN_set_word(bn, RSA_F4) || ((rsa_tmp = RSA_new()) == NULL) ||
                     ^
3170.               !RSA_generate_key_ex(rsa_tmp, keylength, bn, NULL)) {
3171.               RSA_free(rsa_tmp);

apps/s_server.c:3169:42: 
3167.               (void)BIO_flush(bio_err);
3168.           }
3169. >         if (!BN_set_word(bn, RSA_F4) || ((rsa_tmp = RSA_new()) == NULL) ||
3170.               !RSA_generate_key_ex(rsa_tmp, keylength, bn, NULL)) {
3171.               RSA_free(rsa_tmp);

crypto/rsa/rsa_lib.c:74:1: start of procedure RSA_new()
  72.   static const RSA_METHOD *default_RSA_meth = NULL;
  73.   
  74. > RSA *RSA_new(void)
  75.   {
  76.       RSA *r = RSA_new_method(NULL);

crypto/rsa/rsa_lib.c:76:5: Skipping RSA_new_method(): empty list of specs
  74.   RSA *RSA_new(void)
  75.   {
  76.       RSA *r = RSA_new_method(NULL);
            ^
  77.   
  78.       return r;

crypto/rsa/rsa_lib.c:78:5: 
  76.       RSA *r = RSA_new_method(NULL);
  77.   
  78. >     return r;
  79.   }
  80.   

crypto/rsa/rsa_lib.c:79:1: return from a call to RSA_new
  77.   
  78.       return r;
  79. > }
  80.   
  81.   void RSA_set_default_method(const RSA_METHOD *meth)

apps/s_server.c:3169:42: Taking true branch
3167.               (void)BIO_flush(bio_err);
3168.           }
3169.           if (!BN_set_word(bn, RSA_F4) || ((rsa_tmp = RSA_new()) == NULL) ||
                                                 ^
3170.               !RSA_generate_key_ex(rsa_tmp, keylength, bn, NULL)) {
3171.               RSA_free(rsa_tmp);

apps/s_server.c:3171:13: 
3169.           if (!BN_set_word(bn, RSA_F4) || ((rsa_tmp = RSA_new()) == NULL) ||
3170.               !RSA_generate_key_ex(rsa_tmp, keylength, bn, NULL)) {
3171. >             RSA_free(rsa_tmp);
3172.               rsa_tmp = NULL;
3173.           }

static RSA *tmp_rsa_cb(SSL *s, int is_export, int keylength)
{
    BIGNUM *bn = NULL;
    static RSA *rsa_tmp = NULL;
    if (!rsa_tmp && ((bn = BN_new()) == NULL))
        BIO_printf(bio_err, "Allocation error in generating RSA key\n");
    if (!rsa_tmp && bn) {
        if (!s_quiet) {
            BIO_printf(bio_err, "Generating temp (%d bit) RSA key...",
                       keylength);
            (void)BIO_flush(bio_err);
        }
        if (!BN_set_word(bn, RSA_F4) || ((rsa_tmp = RSA_new()) == NULL) ||
            !RSA_generate_key_ex(rsa_tmp, keylength, bn, NULL)) {
            RSA_free(rsa_tmp);
            rsa_tmp = NULL;
        }
        if (!s_quiet) {
            BIO_printf(bio_err, "\n");
            (void)BIO_flush(bio_err);
        }
        BN_free(bn);
    }
    return (rsa_tmp);
}
['static RSA *tmp_rsa_cb(SSL *s, int is_export, int keylength)\n{\n    BIGNUM *bn = NULL;\n    static RSA *rsa_tmp = NULL;\n    if (!rsa_tmp && ((bn = BN_new()) == NULL))\n        BIO_printf(bio_err, "Allocation error in generating RSA key\\n");\n    if (!rsa_tmp && bn) {\n        if (!s_quiet) {\n            BIO_printf(bio_err, "Generating temp (%d bit) RSA key...",\n                       keylength);\n            (void)BIO_flush(bio_err);\n        }\n        if (!BN_set_word(bn, RSA_F4) || ((rsa_tmp = RSA_new()) == NULL) ||\n            !RSA_generate_key_ex(rsa_tmp, keylength, bn, NULL)) {\n            RSA_free(rsa_tmp);\n            rsa_tmp = NULL;\n        }\n        if (!s_quiet) {\n            BIO_printf(bio_err, "\\n");\n            (void)BIO_flush(bio_err);\n        }\n        BN_free(bn);\n    }\n    return (rsa_tmp);\n}', 'int BN_set_word(BIGNUM *a, BN_ULONG w)\n{\n    bn_check_top(a);\n    if (bn_expand(a, (int)sizeof(BN_ULONG) * 8) == NULL)\n        return (0);\n    a->neg = 0;\n    a->d[0] = w;\n    a->top = (w ? 1 : 0);\n    bn_check_top(a);\n    return (1);\n}', 'RSA *RSA_new(void)\n{\n    RSA *r = RSA_new_method(NULL);\n    return r;\n}']