apps/x509.c:1226: error: NULL_DEREFERENCE
  pointer `pktmp` last assigned on line 1225 could be null and is dereferenced by call to `EVP_PKEY_copy_parameters()` at line 1226, column 2.
Showing all 84 steps of the trace


apps/x509.c:1219:1: start of procedure sign()
1217.   
1218.   /* self sign */
1219. > static int sign(X509 *x, EVP_PKEY *pkey, int days, int clrext, const EVP_MD *digest, 
1220.   						CONF *conf, char *section)
1221.   	{

apps/x509.c:1225:2: 
1223.   	EVP_PKEY *pktmp;
1224.   
1225. > 	pktmp = X509_get_pubkey(x);
1226.   	EVP_PKEY_copy_parameters(pktmp,pkey);
1227.   	EVP_PKEY_save_parameters(pktmp,1);

crypto/x509/x509_cmp.c:358:1: start of procedure X509_get_pubkey()
  356.   	}
  357.   
  358. > EVP_PKEY *X509_get_pubkey(X509 *x)
  359.   	{
  360.   	if ((x == NULL) || (x->cert_info == NULL))

crypto/x509/x509_cmp.c:360:7: Taking false branch
  358.   EVP_PKEY *X509_get_pubkey(X509 *x)
  359.   	{
  360.   	if ((x == NULL) || (x->cert_info == NULL))
               ^
  361.   		return(NULL);
  362.   	return(X509_PUBKEY_get(x->cert_info->key));

crypto/x509/x509_cmp.c:360:22: Taking false branch
  358.   EVP_PKEY *X509_get_pubkey(X509 *x)
  359.   	{
  360.   	if ((x == NULL) || (x->cert_info == NULL))
                              ^
  361.   		return(NULL);
  362.   	return(X509_PUBKEY_get(x->cert_info->key));

crypto/x509/x509_cmp.c:362:2: 
  360.   	if ((x == NULL) || (x->cert_info == NULL))
  361.   		return(NULL);
  362. > 	return(X509_PUBKEY_get(x->cert_info->key));
  363.   	}
  364.   

crypto/asn1/x_pubkey.c:226:1: start of procedure X509_PUBKEY_get()
    224.   	}
    225.   
    226. > EVP_PKEY *X509_PUBKEY_get(X509_PUBKEY *key)
    227.   	{
    228.   	EVP_PKEY *ret=NULL;

crypto/asn1/x_pubkey.c:228:2: 
    226.   EVP_PKEY *X509_PUBKEY_get(X509_PUBKEY *key)
    227.   	{
    228. > 	EVP_PKEY *ret=NULL;
    229.   	long j;
    230.   	int type;

crypto/asn1/x_pubkey.c:237:6: Taking false branch
    235.   #endif
    236.   
    237.   	if (key == NULL) goto err;
                ^
    238.   
    239.   	if (key->pkey != NULL)

crypto/asn1/x_pubkey.c:239:6: Taking false branch
    237.   	if (key == NULL) goto err;
    238.   
    239.   	if (key->pkey != NULL)
                ^
    240.   		{
    241.   		CRYPTO_add(&key->pkey->references, 1, CRYPTO_LOCK_EVP_PKEY);

crypto/asn1/x_pubkey.c:245:6: Taking false branch
    243.   		}
    244.   
    245.   	if (key->public_key == NULL) goto err;
                ^
    246.   
    247.   	type=OBJ_obj2nid(key->algor->algorithm);

crypto/asn1/x_pubkey.c:247:2: 
    245.   	if (key->public_key == NULL) goto err;
    246.   
    247. > 	type=OBJ_obj2nid(key->algor->algorithm);
    248.   	if ((ret = EVP_PKEY_new()) == NULL)
    249.   		{

crypto/objects/obj_dat.c:366:1: start of procedure OBJ_obj2nid()
      364.   	}
      365.   
      366. > int OBJ_obj2nid(const ASN1_OBJECT *a)
      367.   	{
      368.   	ASN1_OBJECT **op;

crypto/objects/obj_dat.c:371:6: Taking false branch
      369.   	ADDED_OBJ ad,*adp;
      370.   
      371.   	if (a == NULL)
                  ^
      372.   		return(NID_undef);
      373.   	if (a->nid != 0)

crypto/objects/obj_dat.c:373:6: Taking false branch
      371.   	if (a == NULL)
      372.   		return(NID_undef);
      373.   	if (a->nid != 0)
                  ^
      374.   		return(a->nid);
      375.   

crypto/objects/obj_dat.c:376:6: Taking true branch
      374.   		return(a->nid);
      375.   
      376.   	if (added != NULL)
                  ^
      377.   		{
      378.   		ad.type=ADDED_DATA;

crypto/objects/obj_dat.c:378:3: 
      376.   	if (added != NULL)
      377.   		{
      378. > 		ad.type=ADDED_DATA;
      379.   		ad.obj=(ASN1_OBJECT *)a; /* XXX: ugly but harmless */
      380.   		adp=(ADDED_OBJ *)lh_retrieve(added,&ad);

crypto/objects/obj_dat.c:379:3: 
      377.   		{
      378.   		ad.type=ADDED_DATA;
      379. > 		ad.obj=(ASN1_OBJECT *)a; /* XXX: ugly but harmless */
      380.   		adp=(ADDED_OBJ *)lh_retrieve(added,&ad);
      381.   		if (adp != NULL) return (adp->obj->nid);

crypto/objects/obj_dat.c:380:3: 
      378.   		ad.type=ADDED_DATA;
      379.   		ad.obj=(ASN1_OBJECT *)a; /* XXX: ugly but harmless */
      380. > 		adp=(ADDED_OBJ *)lh_retrieve(added,&ad);
      381.   		if (adp != NULL) return (adp->obj->nid);
      382.   		}

crypto/lhash/lhash.c:248:1: start of procedure lh_retrieve()
        246.   	}
        247.   
        248. > void *lh_retrieve(LHASH *lh, const void *data)
        249.   	{
        250.   	unsigned long hash;

crypto/lhash/lhash.c:254:2: 
        252.   	const void *ret;
        253.   
        254. > 	lh->error=0;
        255.   	rn=getrn(lh,data,&hash);
        256.   

crypto/lhash/lhash.c:255:2: Skipping getrn(): empty list of specs
        253.   
        254.   	lh->error=0;
        255.   	rn=getrn(lh,data,&hash);
                ^
        256.   
        257.   	if (*rn == NULL)

crypto/lhash/lhash.c:257:6: Taking false branch
        255.   	rn=getrn(lh,data,&hash);
        256.   
        257.   	if (*rn == NULL)
                    ^
        258.   		{
        259.   		lh->num_retrieve_miss++;

crypto/lhash/lhash.c:264:3: 
        262.   	else
        263.   		{
        264. > 		ret= (*rn)->data;
        265.   		lh->num_retrieve++;
        266.   		}

crypto/lhash/lhash.c:265:3: 
        263.   		{
        264.   		ret= (*rn)->data;
        265. > 		lh->num_retrieve++;
        266.   		}
        267.   	return((void *)ret);

crypto/lhash/lhash.c:267:2: 
        265.   		lh->num_retrieve++;
        266.   		}
        267. > 	return((void *)ret);
        268.   	}
        269.   

crypto/lhash/lhash.c:268:2: return from a call to lh_retrieve
        266.   		}
        267.   	return((void *)ret);
        268.   	}
                ^
        269.   
        270.   static void doall_util_fn(LHASH *lh, int use_arg, LHASH_DOALL_FN_TYPE func,

crypto/objects/obj_dat.c:381:7: Taking true branch
      379.   		ad.obj=(ASN1_OBJECT *)a; /* XXX: ugly but harmless */
      380.   		adp=(ADDED_OBJ *)lh_retrieve(added,&ad);
      381.   		if (adp != NULL) return (adp->obj->nid);
                   ^
      382.   		}
      383.   	op=(ASN1_OBJECT **)OBJ_bsearch((char *)&a,(char *)obj_objs,NUM_OBJ,

crypto/objects/obj_dat.c:381:20: 
      379.   		ad.obj=(ASN1_OBJECT *)a; /* XXX: ugly but harmless */
      380.   		adp=(ADDED_OBJ *)lh_retrieve(added,&ad);
      381. > 		if (adp != NULL) return (adp->obj->nid);
      382.   		}
      383.   	op=(ASN1_OBJECT **)OBJ_bsearch((char *)&a,(char *)obj_objs,NUM_OBJ,

crypto/objects/obj_dat.c:388:2: return from a call to OBJ_obj2nid
      386.   		return(NID_undef);
      387.   	return((*op)->nid);
      388.   	}
              ^
      389.   
      390.   /* Convert an object name into an ASN1_OBJECT

crypto/asn1/x_pubkey.c:248:6: 
    246.   
    247.   	type=OBJ_obj2nid(key->algor->algorithm);
    248. > 	if ((ret = EVP_PKEY_new()) == NULL)
    249.   		{
    250.   		X509err(X509_F_X509_PUBKEY_GET, ERR_R_MALLOC_FAILURE);

crypto/evp/p_lib.c:301:1: start of procedure EVP_PKEY_new()
      299.   	}
      300.   
      301. > EVP_PKEY *EVP_PKEY_new(void)
      302.   	{
      303.   	EVP_PKEY *ret;

crypto/evp/p_lib.c:305:2: 
      303.   	EVP_PKEY *ret;
      304.   
      305. > 	ret=(EVP_PKEY *)OPENSSL_malloc(sizeof(EVP_PKEY));
      306.   	if (ret == NULL)
      307.   		{

crypto/mem.c:291:1: start of procedure CRYPTO_malloc()
        289.   	}
        290.   
        291. > void *CRYPTO_malloc(int num, const char *file, int line)
        292.   	{
        293.   	void *ret = NULL;

crypto/mem.c:293:2: 
        291.   void *CRYPTO_malloc(int num, const char *file, int line)
        292.   	{
        293. > 	void *ret = NULL;
        294.   	extern unsigned char cleanse_ctr;
        295.   

crypto/mem.c:296:6: Taking false branch
        294.   	extern unsigned char cleanse_ctr;
        295.   
        296.   	if (num <= 0) return NULL;
                    ^
        297.   
        298.   	allow_customize = 0;

crypto/mem.c:298:2: 
        296.   	if (num <= 0) return NULL;
        297.   
        298. > 	allow_customize = 0;
        299.   	if (malloc_debug_func != NULL)
        300.   		{

crypto/mem.c:299:6: Taking true branch
        297.   
        298.   	allow_customize = 0;
        299.   	if (malloc_debug_func != NULL)
                    ^
        300.   		{
        301.   		allow_customize_debug = 0;

crypto/mem.c:301:3: 
        299.   	if (malloc_debug_func != NULL)
        300.   		{
        301. > 		allow_customize_debug = 0;
        302.   		malloc_debug_func(NULL, num, file, line, 0);
        303.   		}

crypto/mem.c:302:3: Skipping __function_pointer__(): unresolved function pointer
        300.   		{
        301.   		allow_customize_debug = 0;
        302.   		malloc_debug_func(NULL, num, file, line, 0);
                 ^
        303.   		}
        304.   	ret = malloc_ex_func(num,file,line);

crypto/mem.c:304:2: Skipping __function_pointer__(): unresolved function pointer
        302.   		malloc_debug_func(NULL, num, file, line, 0);
        303.   		}
        304.   	ret = malloc_ex_func(num,file,line);
                ^
        305.   #ifdef LEVITTE_DEBUG_MEM
        306.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);

crypto/mem.c:308:6: Taking true branch
        306.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);
        307.   #endif
        308.   	if (malloc_debug_func != NULL)
                    ^
        309.   		malloc_debug_func(ret, num, file, line, 1);
        310.   

crypto/mem.c:309:3: Skipping __function_pointer__(): unresolved function pointer
        307.   #endif
        308.   	if (malloc_debug_func != NULL)
        309.   		malloc_debug_func(ret, num, file, line, 1);
                 ^
        310.   
        311.           /* Create a dependency on the value of 'cleanse_ctr' so our memory

crypto/mem.c:314:12: Taking false branch
        312.            * sanitisation function can't be optimised out. NB: We only do
        313.            * this for >2Kb so the overhead doesn't bother us. */
        314.           if(ret && (num > 2048))
                          ^
        315.                   ((unsigned char *)ret)[0] = cleanse_ctr;
        316.   

crypto/mem.c:317:2: 
        315.                   ((unsigned char *)ret)[0] = cleanse_ctr;
        316.   
        317. > 	return ret;
        318.   	}
        319.   

crypto/mem.c:318:2: return from a call to CRYPTO_malloc
        316.   
        317.   	return ret;
        318.   	}
                ^
        319.   
        320.   void *CRYPTO_realloc(void *str, int num, const char *file, int line)

crypto/evp/p_lib.c:306:6: Taking true branch
      304.   
      305.   	ret=(EVP_PKEY *)OPENSSL_malloc(sizeof(EVP_PKEY));
      306.   	if (ret == NULL)
                  ^
      307.   		{
      308.   		EVPerr(EVP_F_EVP_PKEY_NEW,ERR_R_MALLOC_FAILURE);

crypto/evp/p_lib.c:308:3: 
      306.   	if (ret == NULL)
      307.   		{
      308. > 		EVPerr(EVP_F_EVP_PKEY_NEW,ERR_R_MALLOC_FAILURE);
      309.   		return(NULL);
      310.   		}

crypto/err/err.c:664:1: start of procedure ERR_put_error()
        662.   /********************************************************/
        663.   
        664. > void ERR_put_error(int lib, int func, int reason, const char *file,
        665.   	     int line)
        666.   	{

crypto/err/err.c:688:2: Skipping ERR_get_state(): empty list of specs
        686.   	}
        687.   #endif
        688.   	es=ERR_get_state();
                ^
        689.   
        690.   	es->top=(es->top+1)%ERR_NUM_ERRORS;

crypto/err/err.c:690:2: 
        688.   	es=ERR_get_state();
        689.   
        690. > 	es->top=(es->top+1)%ERR_NUM_ERRORS;
        691.   	if (es->top == es->bottom)
        692.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;

crypto/err/err.c:691:6: Taking false branch
        689.   
        690.   	es->top=(es->top+1)%ERR_NUM_ERRORS;
        691.   	if (es->top == es->bottom)
                    ^
        692.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
        693.   	es->err_flags[es->top]=0;

crypto/err/err.c:693:2: 
        691.   	if (es->top == es->bottom)
        692.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
        693. > 	es->err_flags[es->top]=0;
        694.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
        695.   	es->err_file[es->top]=file;

crypto/err/err.c:694:2: 
        692.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
        693.   	es->err_flags[es->top]=0;
        694. > 	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
        695.   	es->err_file[es->top]=file;
        696.   	es->err_line[es->top]=line;

crypto/err/err.c:695:2: 
        693.   	es->err_flags[es->top]=0;
        694.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
        695. > 	es->err_file[es->top]=file;
        696.   	es->err_line[es->top]=line;
        697.   	err_clear_data(es,es->top);

crypto/err/err.c:696:2: 
        694.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
        695.   	es->err_file[es->top]=file;
        696. > 	es->err_line[es->top]=line;
        697.   	err_clear_data(es,es->top);
        698.   	}

crypto/err/err.c:697:2: Taking true branch
        695.   	es->err_file[es->top]=file;
        696.   	es->err_line[es->top]=line;
        697.   	err_clear_data(es,es->top);
                ^
        698.   	}
        699.   

crypto/err/err.c:697:2: Taking false branch
        695.   	es->err_file[es->top]=file;
        696.   	es->err_line[es->top]=line;
        697.   	err_clear_data(es,es->top);
                ^
        698.   	}
        699.   

crypto/err/err.c:697:2: Loop condition is false. Leaving loop
        695.   	es->err_file[es->top]=file;
        696.   	es->err_line[es->top]=line;
        697.   	err_clear_data(es,es->top);
                ^
        698.   	}
        699.   

crypto/err/err.c:698:2: return from a call to ERR_put_error
        696.   	es->err_line[es->top]=line;
        697.   	err_clear_data(es,es->top);
        698.   	}
                ^
        699.   
        700.   void ERR_clear_error(void)

crypto/evp/p_lib.c:309:3: 
      307.   		{
      308.   		EVPerr(EVP_F_EVP_PKEY_NEW,ERR_R_MALLOC_FAILURE);
      309. > 		return(NULL);
      310.   		}
      311.   	ret->type=EVP_PKEY_NONE;

crypto/evp/p_lib.c:317:2: return from a call to EVP_PKEY_new
      315.   	ret->save_parameters=1;
      316.   	return(ret);
      317.   	}
              ^
      318.   
      319.   int EVP_PKEY_assign(EVP_PKEY *pkey, int type, char *key)

crypto/asn1/x_pubkey.c:248:6: Taking true branch
    246.   
    247.   	type=OBJ_obj2nid(key->algor->algorithm);
    248.   	if ((ret = EVP_PKEY_new()) == NULL)
                ^
    249.   		{
    250.   		X509err(X509_F_X509_PUBKEY_GET, ERR_R_MALLOC_FAILURE);

crypto/asn1/x_pubkey.c:250:3: 
    248.   	if ((ret = EVP_PKEY_new()) == NULL)
    249.   		{
    250. > 		X509err(X509_F_X509_PUBKEY_GET, ERR_R_MALLOC_FAILURE);
    251.   		goto err;
    252.   		}

crypto/err/err.c:664:1: start of procedure ERR_put_error()
      662.   /********************************************************/
      663.   
      664. > void ERR_put_error(int lib, int func, int reason, const char *file,
      665.   	     int line)
      666.   	{

crypto/err/err.c:688:2: Skipping ERR_get_state(): empty list of specs
      686.   	}
      687.   #endif
      688.   	es=ERR_get_state();
              ^
      689.   
      690.   	es->top=(es->top+1)%ERR_NUM_ERRORS;

crypto/err/err.c:690:2: 
      688.   	es=ERR_get_state();
      689.   
      690. > 	es->top=(es->top+1)%ERR_NUM_ERRORS;
      691.   	if (es->top == es->bottom)
      692.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;

crypto/err/err.c:691:6: Taking false branch
      689.   
      690.   	es->top=(es->top+1)%ERR_NUM_ERRORS;
      691.   	if (es->top == es->bottom)
                  ^
      692.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
      693.   	es->err_flags[es->top]=0;

crypto/err/err.c:693:2: 
      691.   	if (es->top == es->bottom)
      692.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
      693. > 	es->err_flags[es->top]=0;
      694.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
      695.   	es->err_file[es->top]=file;

crypto/err/err.c:694:2: 
      692.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
      693.   	es->err_flags[es->top]=0;
      694. > 	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
      695.   	es->err_file[es->top]=file;
      696.   	es->err_line[es->top]=line;

crypto/err/err.c:695:2: 
      693.   	es->err_flags[es->top]=0;
      694.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
      695. > 	es->err_file[es->top]=file;
      696.   	es->err_line[es->top]=line;
      697.   	err_clear_data(es,es->top);

crypto/err/err.c:696:2: 
      694.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
      695.   	es->err_file[es->top]=file;
      696. > 	es->err_line[es->top]=line;
      697.   	err_clear_data(es,es->top);
      698.   	}

crypto/err/err.c:697:2: Taking true branch
      695.   	es->err_file[es->top]=file;
      696.   	es->err_line[es->top]=line;
      697.   	err_clear_data(es,es->top);
              ^
      698.   	}
      699.   

crypto/err/err.c:697:2: Taking false branch
      695.   	es->err_file[es->top]=file;
      696.   	es->err_line[es->top]=line;
      697.   	err_clear_data(es,es->top);
              ^
      698.   	}
      699.   

crypto/err/err.c:697:2: Loop condition is false. Leaving loop
      695.   	es->err_file[es->top]=file;
      696.   	es->err_line[es->top]=line;
      697.   	err_clear_data(es,es->top);
              ^
      698.   	}
      699.   

crypto/err/err.c:698:2: return from a call to ERR_put_error
      696.   	es->err_line[es->top]=line;
      697.   	err_clear_data(es,es->top);
      698.   	}
              ^
      699.   
      700.   void ERR_clear_error(void)

crypto/asn1/x_pubkey.c:337:1: 
    335.   	CRYPTO_add(&ret->references, 1, CRYPTO_LOCK_EVP_PKEY);
    336.   	return(ret);
    337. > err:
    338.   	if (ret != NULL)
    339.   		EVP_PKEY_free(ret);

crypto/asn1/x_pubkey.c:338:6: Taking false branch
    336.   	return(ret);
    337.   err:
    338.   	if (ret != NULL)
                ^
    339.   		EVP_PKEY_free(ret);
    340.   	return(NULL);

crypto/asn1/x_pubkey.c:340:2: 
    338.   	if (ret != NULL)
    339.   		EVP_PKEY_free(ret);
    340. > 	return(NULL);
    341.   	}
    342.   

crypto/asn1/x_pubkey.c:341:2: return from a call to X509_PUBKEY_get
    339.   		EVP_PKEY_free(ret);
    340.   	return(NULL);
    341.   	}
            ^
    342.   
    343.   /* Now two pseudo ASN1 routines that take an EVP_PKEY structure

crypto/x509/x509_cmp.c:363:2: return from a call to X509_get_pubkey
  361.   		return(NULL);
  362.   	return(X509_PUBKEY_get(x->cert_info->key));
  363.   	}
          ^
  364.   
  365.   ASN1_BIT_STRING *X509_get0_pubkey_bitstr(const X509 *x)

apps/x509.c:1226:2: 
1224.   
1225.   	pktmp = X509_get_pubkey(x);
1226. > 	EVP_PKEY_copy_parameters(pktmp,pkey);
1227.   	EVP_PKEY_save_parameters(pktmp,1);
1228.   	EVP_PKEY_free(pktmp);

crypto/evp/p_lib.c:156:1: start of procedure EVP_PKEY_copy_parameters()
  154.   	}
  155.   
  156. > int EVP_PKEY_copy_parameters(EVP_PKEY *to, const EVP_PKEY *from)
  157.   	{
  158.   	if (to->type != from->type)

crypto/evp/p_lib.c:158:6: 
  156.   int EVP_PKEY_copy_parameters(EVP_PKEY *to, const EVP_PKEY *from)
  157.   	{
  158. > 	if (to->type != from->type)
  159.   		{
  160.   		EVPerr(EVP_F_EVP_PKEY_COPY_PARAMETERS,EVP_R_DIFFERENT_KEY_TYPES);
