ssl/t1_lib.c:2200: error: NULL_DEREFERENCE
  pointer `cpk` last assigned on line 2199 could be null and is dereferenced at line 2200, column 45.
Showing all 30 steps of the trace


ssl/t1_lib.c:2188:1: start of procedure ssl_get_auto_dh()
2186.   
2187.   #ifndef OPENSSL_NO_DH
2188. > DH *ssl_get_auto_dh(SSL *s)
2189.   {
2190.       int dh_secbits = 80;

ssl/t1_lib.c:2190:5: 
2188.   DH *ssl_get_auto_dh(SSL *s)
2189.   {
2190. >     int dh_secbits = 80;
2191.       if (s->cert->dh_tmp_auto == 2)
2192.           return DH_get_1024_160();

ssl/t1_lib.c:2191:9: Taking false branch
2189.   {
2190.       int dh_secbits = 80;
2191.       if (s->cert->dh_tmp_auto == 2)
                ^
2192.           return DH_get_1024_160();
2193.       if (s->s3->tmp.new_cipher->algorithm_auth & (SSL_aNULL | SSL_aPSK)) {

ssl/t1_lib.c:2193:9: Taking false branch
2191.       if (s->cert->dh_tmp_auto == 2)
2192.           return DH_get_1024_160();
2193.       if (s->s3->tmp.new_cipher->algorithm_auth & (SSL_aNULL | SSL_aPSK)) {
                ^
2194.           if (s->s3->tmp.new_cipher->strength_bits == 256)
2195.               dh_secbits = 128;

ssl/t1_lib.c:2199:9: 
2197.               dh_secbits = 80;
2198.       } else {
2199. >         CERT_PKEY *cpk = ssl_get_server_send_pkey(s);
2200.           dh_secbits = EVP_PKEY_security_bits(cpk->privatekey);
2201.       }

ssl/ssl_lib.c:2850:1: start of procedure ssl_get_server_send_pkey()
  2848.   }
  2849.   
  2850. > CERT_PKEY *ssl_get_server_send_pkey(SSL *s)
  2851.   {
  2852.       CERT *c;

ssl/ssl_lib.c:2855:5: 
  2853.       int i;
  2854.   
  2855. >     c = s->cert;
  2856.       if (!s->s3 || !s->s3->tmp.new_cipher)
  2857.           return NULL;

ssl/ssl_lib.c:2856:10: Taking false branch
  2854.   
  2855.       c = s->cert;
  2856.       if (!s->s3 || !s->s3->tmp.new_cipher)
                   ^
  2857.           return NULL;
  2858.       ssl_set_masks(s);

ssl/ssl_lib.c:2856:20: Taking false branch
  2854.   
  2855.       c = s->cert;
  2856.       if (!s->s3 || !s->s3->tmp.new_cipher)
                             ^
  2857.           return NULL;
  2858.       ssl_set_masks(s);

ssl/ssl_lib.c:2858:5: Skipping ssl_set_masks(): empty list of specs
  2856.       if (!s->s3 || !s->s3->tmp.new_cipher)
  2857.           return NULL;
  2858.       ssl_set_masks(s);
              ^
  2859.   
  2860.       i = ssl_get_server_cert_index(s);

ssl/ssl_lib.c:2860:5: 
  2858.       ssl_set_masks(s);
  2859.   
  2860. >     i = ssl_get_server_cert_index(s);
  2861.   
  2862.       /* This may or may not be an error. */

ssl/ssl_lib.c:2823:1: start of procedure ssl_get_server_cert_index()
    2821.   #endif
    2822.   
    2823. > static int ssl_get_server_cert_index(const SSL *s)
    2824.   {
    2825.       int idx;

ssl/ssl_lib.c:2832:5: 
    2830.        * forces the use of an RSA cert. This will need to change.
    2831.        */
    2832. >     idx = ssl_cipher_get_cert_index(s->s3->tmp.new_cipher);
    2833.       if (idx == SSL_PKEY_RSA_ENC && !s->cert->pkeys[SSL_PKEY_RSA_ENC].x509)
    2834.           idx = SSL_PKEY_RSA_SIGN;

ssl/ssl_ciph.c:1893:1: start of procedure ssl_cipher_get_cert_index()
      1891.   
      1892.   /* For a cipher return the index corresponding to the certificate type */
      1893. > int ssl_cipher_get_cert_index(const SSL_CIPHER *c)
      1894.   {
      1895.       uint32_t alg_a;

ssl/ssl_ciph.c:1897:5: 
      1895.       uint32_t alg_a;
      1896.   
      1897. >     alg_a = c->algorithm_auth;
      1898.   
      1899.       if (alg_a & SSL_aECDSA)

ssl/ssl_ciph.c:1899:9: Taking false branch
      1897.       alg_a = c->algorithm_auth;
      1898.   
      1899.       if (alg_a & SSL_aECDSA)
                      ^
      1900.           return SSL_PKEY_ECC;
      1901.       else if (alg_a & SSL_aDSS)

ssl/ssl_ciph.c:1901:14: Taking false branch
      1899.       if (alg_a & SSL_aECDSA)
      1900.           return SSL_PKEY_ECC;
      1901.       else if (alg_a & SSL_aDSS)
                           ^
      1902.           return SSL_PKEY_DSA_SIGN;
      1903.       else if (alg_a & SSL_aRSA)

ssl/ssl_ciph.c:1903:14: Taking true branch
      1901.       else if (alg_a & SSL_aDSS)
      1902.           return SSL_PKEY_DSA_SIGN;
      1903.       else if (alg_a & SSL_aRSA)
                           ^
      1904.           return SSL_PKEY_RSA_ENC;
      1905.       else if (alg_a & SSL_aGOST12)

ssl/ssl_ciph.c:1904:9: 
      1902.           return SSL_PKEY_DSA_SIGN;
      1903.       else if (alg_a & SSL_aRSA)
      1904. >         return SSL_PKEY_RSA_ENC;
      1905.       else if (alg_a & SSL_aGOST12)
      1906.           return SSL_PKEY_GOST_EC;

ssl/ssl_ciph.c:1911:1: return from a call to ssl_cipher_get_cert_index
      1909.   
      1910.       return -1;
      1911. > }
      1912.   
      1913.   const SSL_CIPHER *ssl_get_cipher_by_char(SSL *ssl, const unsigned char *ptr)

ssl/ssl_lib.c:2833:9: Taking true branch
    2831.        */
    2832.       idx = ssl_cipher_get_cert_index(s->s3->tmp.new_cipher);
    2833.       if (idx == SSL_PKEY_RSA_ENC && !s->cert->pkeys[SSL_PKEY_RSA_ENC].x509)
                    ^
    2834.           idx = SSL_PKEY_RSA_SIGN;
    2835.       if (idx == SSL_PKEY_GOST_EC) {

ssl/ssl_lib.c:2833:37: Taking false branch
    2831.        */
    2832.       idx = ssl_cipher_get_cert_index(s->s3->tmp.new_cipher);
    2833.       if (idx == SSL_PKEY_RSA_ENC && !s->cert->pkeys[SSL_PKEY_RSA_ENC].x509)
                                                ^
    2834.           idx = SSL_PKEY_RSA_SIGN;
    2835.       if (idx == SSL_PKEY_GOST_EC) {

ssl/ssl_lib.c:2835:9: Taking false branch
    2833.       if (idx == SSL_PKEY_RSA_ENC && !s->cert->pkeys[SSL_PKEY_RSA_ENC].x509)
    2834.           idx = SSL_PKEY_RSA_SIGN;
    2835.       if (idx == SSL_PKEY_GOST_EC) {
                    ^
    2836.           if (s->cert->pkeys[SSL_PKEY_GOST12_512].x509)
    2837.               idx = SSL_PKEY_GOST12_512;

ssl/ssl_lib.c:2845:9: Taking false branch
    2843.               idx = -1;
    2844.       }
    2845.       if (idx == -1)
                    ^
    2846.           SSLerr(SSL_F_SSL_GET_SERVER_CERT_INDEX, ERR_R_INTERNAL_ERROR);
    2847.       return idx;

ssl/ssl_lib.c:2847:5: 
    2845.       if (idx == -1)
    2846.           SSLerr(SSL_F_SSL_GET_SERVER_CERT_INDEX, ERR_R_INTERNAL_ERROR);
    2847. >     return idx;
    2848.   }
    2849.   

ssl/ssl_lib.c:2848:1: return from a call to ssl_get_server_cert_index
    2846.           SSLerr(SSL_F_SSL_GET_SERVER_CERT_INDEX, ERR_R_INTERNAL_ERROR);
    2847.       return idx;
    2848. > }
    2849.   
    2850.   CERT_PKEY *ssl_get_server_send_pkey(SSL *s)

ssl/ssl_lib.c:2863:9: Taking true branch
  2861.   
  2862.       /* This may or may not be an error. */
  2863.       if (i < 0)
                  ^
  2864.           return NULL;
  2865.   

ssl/ssl_lib.c:2864:9: 
  2862.       /* This may or may not be an error. */
  2863.       if (i < 0)
  2864. >         return NULL;
  2865.   
  2866.       /* May be NULL. */

ssl/ssl_lib.c:2868:1: return from a call to ssl_get_server_send_pkey
  2866.       /* May be NULL. */
  2867.       return &c->pkeys[i];
  2868. > }
  2869.   
  2870.   EVP_PKEY *ssl_get_sign_pkey(SSL *s, const SSL_CIPHER *cipher,

ssl/t1_lib.c:2200:9: 
2198.       } else {
2199.           CERT_PKEY *cpk = ssl_get_server_send_pkey(s);
2200. >         dh_secbits = EVP_PKEY_security_bits(cpk->privatekey);
2201.       }
2202.   
