ssl/ssl_rsa.c:198: error: NULL_DEREFERENCE
  pointer `pktmp` last assigned on line 196 could be null and is dereferenced by call to `EVP_PKEY_free()` at line 198, column 3.
Showing all 20 steps of the trace


ssl/ssl_rsa.c:182:1: start of procedure ssl_set_pkey()
180.   #endif
181.   
182. > static int ssl_set_pkey(CERT *c, EVP_PKEY *pkey)
183.   	{
184.   	int i,ok=0,bad=0;

ssl/ssl_rsa.c:184:2: 
182.   static int ssl_set_pkey(CERT *c, EVP_PKEY *pkey)
183.   	{
184. > 	int i,ok=0,bad=0;
185.   
186.   	i=ssl_cert_type(NULL,pkey);

ssl/ssl_rsa.c:186:2: Skipping ssl_cert_type(): empty list of specs
184.   	int i,ok=0,bad=0;
185.   
186.   	i=ssl_cert_type(NULL,pkey);
        ^
187.   	if (i < 0)
188.   		{

ssl/ssl_rsa.c:187:6: Taking false branch
185.   
186.   	i=ssl_cert_type(NULL,pkey);
187.   	if (i < 0)
            ^
188.   		{
189.   		SSLerr(SSL_F_SSL_SET_PKEY,SSL_R_UNKNOWN_CERTIFICATE_TYPE);

ssl/ssl_rsa.c:193:6: Taking true branch
191.   		}
192.   
193.   	if (c->pkeys[i].x509 != NULL)
            ^
194.   		{
195.   		EVP_PKEY *pktmp;

ssl/ssl_rsa.c:196:3: 
194.   		{
195.   		EVP_PKEY *pktmp;
196. > 		pktmp =	X509_get_pubkey(c->pkeys[i].x509);
197.   		EVP_PKEY_copy_parameters(pktmp,pkey);
198.   		EVP_PKEY_free(pktmp);

crypto/x509/x509_cmp.c:250:1: start of procedure X509_get_pubkey()
  248.   	}
  249.   
  250. > EVP_PKEY *X509_get_pubkey(X509 *x)
  251.   	{
  252.   	if ((x == NULL) || (x->cert_info == NULL))

crypto/x509/x509_cmp.c:252:7: Taking false branch
  250.   EVP_PKEY *X509_get_pubkey(X509 *x)
  251.   	{
  252.   	if ((x == NULL) || (x->cert_info == NULL))
               ^
  253.   		return(NULL);
  254.   	return(X509_PUBKEY_get(x->cert_info->key));

crypto/x509/x509_cmp.c:252:22: Taking true branch
  250.   EVP_PKEY *X509_get_pubkey(X509 *x)
  251.   	{
  252.   	if ((x == NULL) || (x->cert_info == NULL))
                              ^
  253.   		return(NULL);
  254.   	return(X509_PUBKEY_get(x->cert_info->key));

crypto/x509/x509_cmp.c:253:3: 
  251.   	{
  252.   	if ((x == NULL) || (x->cert_info == NULL))
  253. > 		return(NULL);
  254.   	return(X509_PUBKEY_get(x->cert_info->key));
  255.   	}

crypto/x509/x509_cmp.c:255:2: return from a call to X509_get_pubkey
  253.   		return(NULL);
  254.   	return(X509_PUBKEY_get(x->cert_info->key));
  255.   	}
          ^
  256.   
  257.   int X509_check_private_key(X509 *x, EVP_PKEY *k)

ssl/ssl_rsa.c:197:3: Skipping EVP_PKEY_copy_parameters(): empty list of specs
195.   		EVP_PKEY *pktmp;
196.   		pktmp =	X509_get_pubkey(c->pkeys[i].x509);
197.   		EVP_PKEY_copy_parameters(pktmp,pkey);
         ^
198.   		EVP_PKEY_free(pktmp);
199.   		ERR_clear_error();

ssl/ssl_rsa.c:198:3: 
196.   		pktmp =	X509_get_pubkey(c->pkeys[i].x509);
197.   		EVP_PKEY_copy_parameters(pktmp,pkey);
198. > 		EVP_PKEY_free(pktmp);
199.   		ERR_clear_error();
200.   

crypto/evp/p_lib.c:286:1: start of procedure EVP_PKEY_free()
  284.   	}
  285.   
  286. > void EVP_PKEY_free(EVP_PKEY *x)
  287.   	{
  288.   	int i;

crypto/evp/p_lib.c:290:6: Taking false branch
  288.   	int i;
  289.   
  290.   	if (x == NULL) return;
              ^
  291.   
  292.   	i=CRYPTO_add(&x->references,-1,CRYPTO_LOCK_EVP_PKEY);

crypto/evp/p_lib.c:292:2: 
  290.   	if (x == NULL) return;
  291.   
  292. > 	i=CRYPTO_add(&x->references,-1,CRYPTO_LOCK_EVP_PKEY);
  293.   #ifdef REF_PRINT
  294.   	REF_PRINT("EVP_PKEY",x);

crypto/cryptlib.c:226:1: start of procedure CRYPTO_add_lock()
    224.   	}
    225.   
    226. > int CRYPTO_add_lock(int *pointer, int amount, int type, const char *file,
    227.   	     int line)
    228.   	{

crypto/cryptlib.c:231:6: Taking true branch
    229.   	int ret;
    230.   
    231.   	if (add_lock_callback != NULL)
                ^
    232.   		{
    233.   #ifdef LOCK_DEBUG

crypto/cryptlib.c:237:3: Skipping __function_pointer__(): unresolved function pointer
    235.   #endif
    236.   
    237.   		ret=add_lock_callback(pointer,amount,type,file,line);
             ^
    238.   #ifdef LOCK_DEBUG
    239.   		fprintf(stderr,"ladd:%08lx:%2d+%2d->%2d %-18s %s:%d\n",

crypto/cryptlib.c:245:3: 
    243.   			file,line);
    244.   #endif
    245. > 		*pointer=ret;
    246.   		}
    247.   	else

static int ssl_set_pkey(CERT *c, EVP_PKEY *pkey)
	{
	int i,ok=0,bad=0;
	i=ssl_cert_type(NULL,pkey);
	if (i < 0)
		{
		SSLerr(SSL_F_SSL_SET_PKEY,SSL_R_UNKNOWN_CERTIFICATE_TYPE);
		return(0);
		}
	if (c->pkeys[i].x509 != NULL)
		{
		EVP_PKEY *pktmp;
		pktmp =	X509_get_pubkey(c->pkeys[i].x509);
		EVP_PKEY_copy_parameters(pktmp,pkey);
		EVP_PKEY_free(pktmp);
		ERR_clear_error();
#ifndef NO_RSA
		if ((pkey->type == EVP_PKEY_RSA) &&
			(RSA_flags(pkey->pkey.rsa) &
			 RSA_METHOD_FLAG_NO_CHECK))
			 ok=1;
		else
#endif
			if (!X509_check_private_key(c->pkeys[i].x509,pkey))
			{
			if ((i == SSL_PKEY_DH_RSA) || (i == SSL_PKEY_DH_DSA))
				{
				i=(i == SSL_PKEY_DH_RSA)?
					SSL_PKEY_DH_DSA:SSL_PKEY_DH_RSA;
				if (c->pkeys[i].x509 == NULL)
					ok=1;
				else
					{
					if (!X509_check_private_key(
						c->pkeys[i].x509,pkey))
						bad=1;
					else
						ok=1;
					}
				}
			else
				bad=1;
			}
		else
			ok=1;
		}
	else
		ok=1;
	if (bad)
		{
		X509_free(c->pkeys[i].x509);
		c->pkeys[i].x509=NULL;
		return(0);
		}
	if (c->pkeys[i].privatekey != NULL)
		EVP_PKEY_free(c->pkeys[i].privatekey);
	CRYPTO_add(&pkey->references,1,CRYPTO_LOCK_EVP_PKEY);
	c->pkeys[i].privatekey=pkey;
	c->key= &(c->pkeys[i]);
	c->valid=0;
	return(1);
	}
['static int ssl_set_pkey(CERT *c, EVP_PKEY *pkey)\n\t{\n\tint i,ok=0,bad=0;\n\ti=ssl_cert_type(NULL,pkey);\n\tif (i < 0)\n\t\t{\n\t\tSSLerr(SSL_F_SSL_SET_PKEY,SSL_R_UNKNOWN_CERTIFICATE_TYPE);\n\t\treturn(0);\n\t\t}\n\tif (c->pkeys[i].x509 != NULL)\n\t\t{\n\t\tEVP_PKEY *pktmp;\n\t\tpktmp =\tX509_get_pubkey(c->pkeys[i].x509);\n\t\tEVP_PKEY_copy_parameters(pktmp,pkey);\n\t\tEVP_PKEY_free(pktmp);\n\t\tERR_clear_error();\n#ifndef NO_RSA\n\t\tif ((pkey->type == EVP_PKEY_RSA) &&\n\t\t\t(RSA_flags(pkey->pkey.rsa) &\n\t\t\t RSA_METHOD_FLAG_NO_CHECK))\n\t\t\t ok=1;\n\t\telse\n#endif\n\t\t\tif (!X509_check_private_key(c->pkeys[i].x509,pkey))\n\t\t\t{\n\t\t\tif ((i == SSL_PKEY_DH_RSA) || (i == SSL_PKEY_DH_DSA))\n\t\t\t\t{\n\t\t\t\ti=(i == SSL_PKEY_DH_RSA)?\n\t\t\t\t\tSSL_PKEY_DH_DSA:SSL_PKEY_DH_RSA;\n\t\t\t\tif (c->pkeys[i].x509 == NULL)\n\t\t\t\t\tok=1;\n\t\t\t\telse\n\t\t\t\t\t{\n\t\t\t\t\tif (!X509_check_private_key(\n\t\t\t\t\t\tc->pkeys[i].x509,pkey))\n\t\t\t\t\t\tbad=1;\n\t\t\t\t\telse\n\t\t\t\t\t\tok=1;\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\telse\n\t\t\t\tbad=1;\n\t\t\t}\n\t\telse\n\t\t\tok=1;\n\t\t}\n\telse\n\t\tok=1;\n\tif (bad)\n\t\t{\n\t\tX509_free(c->pkeys[i].x509);\n\t\tc->pkeys[i].x509=NULL;\n\t\treturn(0);\n\t\t}\n\tif (c->pkeys[i].privatekey != NULL)\n\t\tEVP_PKEY_free(c->pkeys[i].privatekey);\n\tCRYPTO_add(&pkey->references,1,CRYPTO_LOCK_EVP_PKEY);\n\tc->pkeys[i].privatekey=pkey;\n\tc->key= &(c->pkeys[i]);\n\tc->valid=0;\n\treturn(1);\n\t}', 'EVP_PKEY *X509_get_pubkey(X509 *x)\n\t{\n\tif ((x == NULL) || (x->cert_info == NULL))\n\t\treturn(NULL);\n\treturn(X509_PUBKEY_get(x->cert_info->key));\n\t}', 'void EVP_PKEY_free(EVP_PKEY *x)\n\t{\n\tint i;\n\tif (x == NULL) return;\n\ti=CRYPTO_add(&x->references,-1,CRYPTO_LOCK_EVP_PKEY);\n#ifdef REF_PRINT\n\tREF_PRINT("EVP_PKEY",x);\n#endif\n\tif (i > 0) return;\n#ifdef REF_CHECK\n\tif (i < 0)\n\t\t{\n\t\tfprintf(stderr,"EVP_PKEY_free, bad reference count\\n");\n\t\tabort();\n\t\t}\n#endif\n\tEVP_PKEY_free_it(x);\n\tFree((char *)x);\n\t}', 'int CRYPTO_add_lock(int *pointer, int amount, int type, const char *file,\n\t     int line)\n\t{\n\tint ret;\n\tif (add_lock_callback != NULL)\n\t\t{\n#ifdef LOCK_DEBUG\n\t\tint before= *pointer;\n#endif\n\t\tret=add_lock_callback(pointer,amount,type,file,line);\n#ifdef LOCK_DEBUG\n\t\tfprintf(stderr,"ladd:%08lx:%2d+%2d->%2d %-18s %s:%d\\n",\n\t\t\tCRYPTO_thread_id(),\n\t\t\tbefore,amount,ret,\n\t\t\tCRYPTO_get_lock_name(type),\n\t\t\tfile,line);\n#endif\n\t\t*pointer=ret;\n\t\t}\n\telse\n\t\t{\n\t\tCRYPTO_lock(CRYPTO_LOCK|CRYPTO_WRITE,type,file,line);\n\t\tret= *pointer+amount;\n#ifdef LOCK_DEBUG\n\t\tfprintf(stderr,"ladd:%08lx:%2d+%2d->%2d %-18s %s:%d\\n",\n\t\t\tCRYPTO_thread_id(),\n\t\t\t*pointer,amount,ret,\n\t\t\tCRYPTO_get_lock_name(type),\n\t\t\tfile,line);\n#endif\n\t\t*pointer=ret;\n\t\tCRYPTO_lock(CRYPTO_UNLOCK|CRYPTO_WRITE,type,file,line);\n\t\t}\n\treturn(ret);\n\t}']