ssl/s3_both.c:450: error: NULL_DEREFERENCE
  pointer `pk` last assigned on line 410 could be null and is dereferenced by call to `EVP_PKEY_free()` at line 450, column 12.
Showing all 13 steps of the trace


ssl/s3_both.c:404:1: start of procedure ssl_cert_type()
402.   	}
403.   
404. > int ssl_cert_type(X509 *x, EVP_PKEY *pkey)
405.   	{
406.   	EVP_PKEY *pk;

ssl/s3_both.c:407:2: 
405.   	{
406.   	EVP_PKEY *pk;
407. > 	int ret= -1,i,j;
408.   
409.   	if (pkey == NULL)

ssl/s3_both.c:409:6: Taking true branch
407.   	int ret= -1,i,j;
408.   
409.   	if (pkey == NULL)
            ^
410.   		pk=X509_get_pubkey(x);
411.   	else

ssl/s3_both.c:410:3: 
408.   
409.   	if (pkey == NULL)
410. > 		pk=X509_get_pubkey(x);
411.   	else
412.   		pk=pkey;

crypto/x509/x509_cmp.c:254:1: start of procedure X509_get_pubkey()
  252.   	}
  253.   
  254. > EVP_PKEY *X509_get_pubkey(X509 *x)
  255.   	{
  256.   	if ((x == NULL) || (x->cert_info == NULL))

crypto/x509/x509_cmp.c:256:7: Taking false branch
  254.   EVP_PKEY *X509_get_pubkey(X509 *x)
  255.   	{
  256.   	if ((x == NULL) || (x->cert_info == NULL))
               ^
  257.   		return(NULL);
  258.   	return(X509_PUBKEY_get(x->cert_info->key));

crypto/x509/x509_cmp.c:256:22: Taking true branch
  254.   EVP_PKEY *X509_get_pubkey(X509 *x)
  255.   	{
  256.   	if ((x == NULL) || (x->cert_info == NULL))
                              ^
  257.   		return(NULL);
  258.   	return(X509_PUBKEY_get(x->cert_info->key));

crypto/x509/x509_cmp.c:257:3: 
  255.   	{
  256.   	if ((x == NULL) || (x->cert_info == NULL))
  257. > 		return(NULL);
  258.   	return(X509_PUBKEY_get(x->cert_info->key));
  259.   	}

crypto/x509/x509_cmp.c:259:2: return from a call to X509_get_pubkey
  257.   		return(NULL);
  258.   	return(X509_PUBKEY_get(x->cert_info->key));
  259.   	}
          ^
  260.   
  261.   int X509_check_private_key(X509 *x, EVP_PKEY *k)

ssl/s3_both.c:413:6: Taking true branch
411.   	else
412.   		pk=pkey;
413.   	if (pk == NULL) goto err;
            ^
414.   
415.   	i=pk->type;

ssl/s3_both.c:449:1: 
447.   		ret= -1;
448.   
449. > err:
450.   	if(!pkey) EVP_PKEY_free(pk);
451.   	return(ret);

ssl/s3_both.c:450:6: Taking true branch
448.   
449.   err:
450.   	if(!pkey) EVP_PKEY_free(pk);
            ^
451.   	return(ret);
452.   	}

ssl/s3_both.c:450:12: 
448.   
449.   err:
450. > 	if(!pkey) EVP_PKEY_free(pk);
451.   	return(ret);
452.   	}

int ssl_cert_type(X509 *x, EVP_PKEY *pkey)
	{
	EVP_PKEY *pk;
	int ret= -1,i,j;
	if (pkey == NULL)
		pk=X509_get_pubkey(x);
	else
		pk=pkey;
	if (pk == NULL) goto err;
	i=pk->type;
	if (i == EVP_PKEY_RSA)
		{
		ret=SSL_PKEY_RSA_ENC;
		if (x != NULL)
			{
			j=X509_get_ext_count(x);
			}
		}
	else if (i == EVP_PKEY_DSA)
		{
		ret=SSL_PKEY_DSA_SIGN;
		}
	else if (i == EVP_PKEY_DH)
		{
		if (x == NULL)
			ret=SSL_PKEY_DH_DSA;
		else
			{
			j=X509_get_signature_type(x);
			if (j == EVP_PKEY_RSA)
				ret=SSL_PKEY_DH_RSA;
			else if (j== EVP_PKEY_DSA)
				ret=SSL_PKEY_DH_DSA;
			else ret= -1;
			}
		}
	else
		ret= -1;
err:
	if(!pkey) EVP_PKEY_free(pk);
	return(ret);
	}
['int ssl_cert_type(X509 *x, EVP_PKEY *pkey)\n\t{\n\tEVP_PKEY *pk;\n\tint ret= -1,i,j;\n\tif (pkey == NULL)\n\t\tpk=X509_get_pubkey(x);\n\telse\n\t\tpk=pkey;\n\tif (pk == NULL) goto err;\n\ti=pk->type;\n\tif (i == EVP_PKEY_RSA)\n\t\t{\n\t\tret=SSL_PKEY_RSA_ENC;\n\t\tif (x != NULL)\n\t\t\t{\n\t\t\tj=X509_get_ext_count(x);\n\t\t\t}\n\t\t}\n\telse if (i == EVP_PKEY_DSA)\n\t\t{\n\t\tret=SSL_PKEY_DSA_SIGN;\n\t\t}\n\telse if (i == EVP_PKEY_DH)\n\t\t{\n\t\tif (x == NULL)\n\t\t\tret=SSL_PKEY_DH_DSA;\n\t\telse\n\t\t\t{\n\t\t\tj=X509_get_signature_type(x);\n\t\t\tif (j == EVP_PKEY_RSA)\n\t\t\t\tret=SSL_PKEY_DH_RSA;\n\t\t\telse if (j== EVP_PKEY_DSA)\n\t\t\t\tret=SSL_PKEY_DH_DSA;\n\t\t\telse ret= -1;\n\t\t\t}\n\t\t}\n\telse\n\t\tret= -1;\nerr:\n\tif(!pkey) EVP_PKEY_free(pk);\n\treturn(ret);\n\t}', 'EVP_PKEY *X509_get_pubkey(X509 *x)\n\t{\n\tif ((x == NULL) || (x->cert_info == NULL))\n\t\treturn(NULL);\n\treturn(X509_PUBKEY_get(x->cert_info->key));\n\t}']