ssl/statem/statem_lib.c:263: error: NULL_DEREFERENCE
  pointer `pkey` last assigned on line 262 could be null and is dereferenced by call to `EVP_PKEY_id()` at line 263, column 14.
Showing all 53 steps of the trace


ssl/statem/statem_lib.c:238:1: start of procedure tls_process_cert_verify()
236.   }
237.   
238. > MSG_PROCESS_RETURN tls_process_cert_verify(SSL *s, PACKET *pkt)
239.   {
240.       EVP_PKEY *pkey = NULL;

ssl/statem/statem_lib.c:240:5: 
238.   MSG_PROCESS_RETURN tls_process_cert_verify(SSL *s, PACKET *pkt)
239.   {
240. >     EVP_PKEY *pkey = NULL;
241.       const unsigned char *data;
242.   #ifndef OPENSSL_NO_GOST

ssl/statem/statem_lib.c:243:5: 
241.       const unsigned char *data;
242.   #ifndef OPENSSL_NO_GOST
243. >     unsigned char *gost_data = NULL;
244.   #endif
245.       int al = SSL_AD_INTERNAL_ERROR, ret = MSG_PROCESS_ERROR;

ssl/statem/statem_lib.c:245:5: 
243.       unsigned char *gost_data = NULL;
244.   #endif
245. >     int al = SSL_AD_INTERNAL_ERROR, ret = MSG_PROCESS_ERROR;
246.       int type = 0, j, pktype;
247.       unsigned int len;

ssl/statem/statem_lib.c:246:5: 
244.   #endif
245.       int al = SSL_AD_INTERNAL_ERROR, ret = MSG_PROCESS_ERROR;
246. >     int type = 0, j, pktype;
247.       unsigned int len;
248.       X509 *peer;

ssl/statem/statem_lib.c:249:5: 
247.       unsigned int len;
248.       X509 *peer;
249. >     const EVP_MD *md = NULL;
250.       size_t hdatalen = 0;
251.       void *hdata;

ssl/statem/statem_lib.c:250:5: 
248.       X509 *peer;
249.       const EVP_MD *md = NULL;
250. >     size_t hdatalen = 0;
251.       void *hdata;
252.       unsigned char tls13tbs[TLS13_TBS_PREAMBLE_SIZE + EVP_MAX_MD_SIZE];

ssl/statem/statem_lib.c:253:5: 
251.       void *hdata;
252.       unsigned char tls13tbs[TLS13_TBS_PREAMBLE_SIZE + EVP_MAX_MD_SIZE];
253. >     EVP_MD_CTX *mctx = EVP_MD_CTX_new();
254.       EVP_PKEY_CTX *pctx = NULL;
255.   

crypto/evp/digest.c:44:1: start of procedure EVP_MD_CTX_new()
  42.   }
  43.   
  44. > EVP_MD_CTX *EVP_MD_CTX_new(void)
  45.   {
  46.       return OPENSSL_zalloc(sizeof(EVP_MD_CTX));

crypto/evp/digest.c:46:5: 
  44.   EVP_MD_CTX *EVP_MD_CTX_new(void)
  45.   {
  46. >     return OPENSSL_zalloc(sizeof(EVP_MD_CTX));
  47.   }
  48.   

crypto/mem.c:98:1: start of procedure CRYPTO_zalloc()
    96.   }
    97.   
    98. > void *CRYPTO_zalloc(size_t num, const char *file, int line)
    99.   {
    100.       void *ret = CRYPTO_malloc(num, file, line);

crypto/mem.c:100:5: 
    98.   void *CRYPTO_zalloc(size_t num, const char *file, int line)
    99.   {
    100. >     void *ret = CRYPTO_malloc(num, file, line);
    101.   
    102.       if (ret != NULL)

crypto/mem.c:71:1: start of procedure CRYPTO_malloc()
      69.   }
      70.   
      71. > void *CRYPTO_malloc(size_t num, const char *file, int line)
      72.   {
      73.       void *ret = NULL;

crypto/mem.c:73:5: 
      71.   void *CRYPTO_malloc(size_t num, const char *file, int line)
      72.   {
      73. >     void *ret = NULL;
      74.   
      75.       if (malloc_impl != NULL && malloc_impl != CRYPTO_malloc)

crypto/mem.c:75:9: Taking false branch
      73.       void *ret = NULL;
      74.   
      75.       if (malloc_impl != NULL && malloc_impl != CRYPTO_malloc)
                    ^
      76.           return malloc_impl(num, file, line);
      77.   

crypto/mem.c:78:9: Taking false branch
      76.           return malloc_impl(num, file, line);
      77.   
      78.       if (num <= 0)
                    ^
      79.           return NULL;
      80.   

crypto/mem.c:81:5: 
      79.           return NULL;
      80.   
      81. >     allow_customize = 0;
      82.   #ifndef OPENSSL_NO_CRYPTO_MDEBUG
      83.       if (call_malloc_debug) {

crypto/mem.c:91:5: 
      89.       }
      90.   #else
      91. >     osslargused(file); osslargused(line);
      92.       ret = malloc(num);
      93.   #endif

crypto/mem.c:91:24: 
      89.       }
      90.   #else
      91. >     osslargused(file); osslargused(line);
      92.       ret = malloc(num);
      93.   #endif

crypto/mem.c:92:5: 
      90.   #else
      91.       osslargused(file); osslargused(line);
      92. >     ret = malloc(num);
      93.   #endif
      94.   

crypto/mem.c:95:5: 
      93.   #endif
      94.   
      95. >     return ret;
      96.   }
      97.   

crypto/mem.c:96:1: return from a call to CRYPTO_malloc
      94.   
      95.       return ret;
      96. > }
      97.   
      98.   void *CRYPTO_zalloc(size_t num, const char *file, int line)

crypto/mem.c:102:9: Taking true branch
    100.       void *ret = CRYPTO_malloc(num, file, line);
    101.   
    102.       if (ret != NULL)
                   ^
    103.           memset(ret, 0, num);
    104.       return ret;

crypto/mem.c:103:9: 
    101.   
    102.       if (ret != NULL)
    103. >         memset(ret, 0, num);
    104.       return ret;
    105.   }

crypto/mem.c:104:5: 
    102.       if (ret != NULL)
    103.           memset(ret, 0, num);
    104. >     return ret;
    105.   }
    106.   

crypto/mem.c:105:1: return from a call to CRYPTO_zalloc
    103.           memset(ret, 0, num);
    104.       return ret;
    105. > }
    106.   
    107.   void *CRYPTO_realloc(void *str, size_t num, const char *file, int line)

crypto/evp/digest.c:47:1: return from a call to EVP_MD_CTX_new
  45.   {
  46.       return OPENSSL_zalloc(sizeof(EVP_MD_CTX));
  47. > }
  48.   
  49.   void EVP_MD_CTX_free(EVP_MD_CTX *ctx)

ssl/statem/statem_lib.c:254:5: 
252.       unsigned char tls13tbs[TLS13_TBS_PREAMBLE_SIZE + EVP_MAX_MD_SIZE];
253.       EVP_MD_CTX *mctx = EVP_MD_CTX_new();
254. >     EVP_PKEY_CTX *pctx = NULL;
255.   
256.       if (mctx == NULL) {

ssl/statem/statem_lib.c:256:9: Taking false branch
254.       EVP_PKEY_CTX *pctx = NULL;
255.   
256.       if (mctx == NULL) {
               ^
257.           SSLerr(SSL_F_TLS_PROCESS_CERT_VERIFY, ERR_R_MALLOC_FAILURE);
258.           goto f_err;

ssl/statem/statem_lib.c:261:5: 
259.       }
260.   
261. >     peer = s->session->peer;
262.       pkey = X509_get0_pubkey(peer);
263.       pktype = EVP_PKEY_id(pkey);

ssl/statem/statem_lib.c:262:5: 
260.   
261.       peer = s->session->peer;
262. >     pkey = X509_get0_pubkey(peer);
263.       pktype = EVP_PKEY_id(pkey);
264.       type = X509_certificate_type(peer, pkey);

crypto/x509/x509_cmp.c:265:1: start of procedure X509_get0_pubkey()
  263.   }
  264.   
  265. > EVP_PKEY *X509_get0_pubkey(const X509 *x)
  266.   {
  267.       if (x == NULL)

crypto/x509/x509_cmp.c:267:9: Taking false branch
  265.   EVP_PKEY *X509_get0_pubkey(const X509 *x)
  266.   {
  267.       if (x == NULL)
                 ^
  268.           return NULL;
  269.       return X509_PUBKEY_get0(x->cert_info.key);

crypto/x509/x509_cmp.c:269:5: 
  267.       if (x == NULL)
  268.           return NULL;
  269. >     return X509_PUBKEY_get0(x->cert_info.key);
  270.   }
  271.   

crypto/x509/x_pubkey.c:140:1: start of procedure X509_PUBKEY_get0()
    138.   }
    139.   
    140. > EVP_PKEY *X509_PUBKEY_get0(X509_PUBKEY *key)
    141.   {
    142.       EVP_PKEY *ret = NULL;

crypto/x509/x_pubkey.c:142:5: 
    140.   EVP_PKEY *X509_PUBKEY_get0(X509_PUBKEY *key)
    141.   {
    142. >     EVP_PKEY *ret = NULL;
    143.   
    144.       if (key == NULL || key->public_key == NULL)

crypto/x509/x_pubkey.c:144:9: Taking false branch
    142.       EVP_PKEY *ret = NULL;
    143.   
    144.       if (key == NULL || key->public_key == NULL)
                   ^
    145.           return NULL;
    146.   

crypto/x509/x_pubkey.c:144:24: Taking false branch
    142.       EVP_PKEY *ret = NULL;
    143.   
    144.       if (key == NULL || key->public_key == NULL)
                                  ^
    145.           return NULL;
    146.   

crypto/x509/x_pubkey.c:147:9: Taking false branch
    145.           return NULL;
    146.   
    147.       if (key->pkey != NULL)
                   ^
    148.           return key->pkey;
    149.   

crypto/x509/x_pubkey.c:158:5: 
    156.        * in the queue.
    157.        */
    158. >     x509_pubkey_decode(&ret, key);
    159.       /* If decode doesn't fail something bad happened */
    160.       if (ret != NULL) {

crypto/x509/x_pubkey.c:103:1: start of procedure x509_pubkey_decode()
      101.   
      102.   
      103. > static int x509_pubkey_decode(EVP_PKEY **ppkey, X509_PUBKEY *key)
      104.       {
      105.       EVP_PKEY *pkey = EVP_PKEY_new();

crypto/x509/x_pubkey.c:105:5: Skipping EVP_PKEY_new(): empty list of specs
      103.   static int x509_pubkey_decode(EVP_PKEY **ppkey, X509_PUBKEY *key)
      104.       {
      105.       EVP_PKEY *pkey = EVP_PKEY_new();
                 ^
      106.   
      107.       if (pkey == NULL) {

crypto/x509/x_pubkey.c:107:9: Taking true branch
      105.       EVP_PKEY *pkey = EVP_PKEY_new();
      106.   
      107.       if (pkey == NULL) {
                     ^
      108.           X509err(X509_F_X509_PUBKEY_DECODE, ERR_R_MALLOC_FAILURE);
      109.           return -1;

crypto/x509/x_pubkey.c:108:9: Skipping ERR_put_error(): empty list of specs
      106.   
      107.       if (pkey == NULL) {
      108.           X509err(X509_F_X509_PUBKEY_DECODE, ERR_R_MALLOC_FAILURE);
                     ^
      109.           return -1;
      110.       }

crypto/x509/x_pubkey.c:109:9: 
      107.       if (pkey == NULL) {
      108.           X509err(X509_F_X509_PUBKEY_DECODE, ERR_R_MALLOC_FAILURE);
      109. >         return -1;
      110.       }
      111.   

crypto/x509/x_pubkey.c:138:1: return from a call to x509_pubkey_decode
      136.       EVP_PKEY_free(pkey);
      137.       return 0;
      138. > }
      139.   
      140.   EVP_PKEY *X509_PUBKEY_get0(X509_PUBKEY *key)

crypto/x509/x_pubkey.c:160:9: Taking false branch
    158.       x509_pubkey_decode(&ret, key);
    159.       /* If decode doesn't fail something bad happened */
    160.       if (ret != NULL) {
                   ^
    161.           X509err(X509_F_X509_PUBKEY_GET0, ERR_R_INTERNAL_ERROR);
    162.           EVP_PKEY_free(ret);

crypto/x509/x_pubkey.c:165:5: 
    163.       }
    164.   
    165. >     return NULL;
    166.   }
    167.   

crypto/x509/x_pubkey.c:166:1: return from a call to X509_PUBKEY_get0
    164.   
    165.       return NULL;
    166. > }
    167.   
    168.   EVP_PKEY *X509_PUBKEY_get(X509_PUBKEY *key)

crypto/x509/x509_cmp.c:270:1: return from a call to X509_get0_pubkey
  268.           return NULL;
  269.       return X509_PUBKEY_get0(x->cert_info.key);
  270. > }
  271.   
  272.   EVP_PKEY *X509_get_pubkey(X509 *x)

ssl/statem/statem_lib.c:263:5: 
261.       peer = s->session->peer;
262.       pkey = X509_get0_pubkey(peer);
263. >     pktype = EVP_PKEY_id(pkey);
264.       type = X509_certificate_type(peer, pkey);
265.   

crypto/evp/p_lib.c:378:1: start of procedure EVP_PKEY_id()
  376.   }
  377.   
  378. > int EVP_PKEY_id(const EVP_PKEY *pkey)
  379.   {
  380.       return pkey->type;

crypto/evp/p_lib.c:380:5: 
  378.   int EVP_PKEY_id(const EVP_PKEY *pkey)
  379.   {
  380. >     return pkey->type;
  381.   }
  382.   
