ssl/statem/statem_srvr.c:3062: error: NULL_DEREFERENCE
  pointer `pkey` last assigned on line 3047 could be null and is dereferenced at line 3062, column 40.
Showing all 23 steps of the trace


ssl/statem/statem_srvr.c:3034:1: start of procedure tls_process_cert_verify()
3032.   }
3033.   
3034. > MSG_PROCESS_RETURN tls_process_cert_verify(SSL *s, PACKET *pkt)
3035.   {
3036.       EVP_PKEY *pkey = NULL;

ssl/statem/statem_srvr.c:3036:5: 
3034.   MSG_PROCESS_RETURN tls_process_cert_verify(SSL *s, PACKET *pkt)
3035.   {
3036. >     EVP_PKEY *pkey = NULL;
3037.       unsigned char *sig, *data;
3038.       int al, ret = MSG_PROCESS_ERROR;

ssl/statem/statem_srvr.c:3038:5: 
3036.       EVP_PKEY *pkey = NULL;
3037.       unsigned char *sig, *data;
3038. >     int al, ret = MSG_PROCESS_ERROR;
3039.       int type = 0, i, j;
3040.       unsigned int len;

ssl/statem/statem_srvr.c:3039:5: 
3037.       unsigned char *sig, *data;
3038.       int al, ret = MSG_PROCESS_ERROR;
3039. >     int type = 0, i, j;
3040.       unsigned int len;
3041.       X509 *peer;

ssl/statem/statem_srvr.c:3042:5: 
3040.       unsigned int len;
3041.       X509 *peer;
3042. >     const EVP_MD *md = NULL;
3043.       EVP_MD_CTX mctx;
3044.       EVP_MD_CTX_init(&mctx);

ssl/statem/statem_srvr.c:3044:5: 
3042.       const EVP_MD *md = NULL;
3043.       EVP_MD_CTX mctx;
3044. >     EVP_MD_CTX_init(&mctx);
3045.   
3046.       peer = s->session->peer;

crypto/evp/digest.c:120:1: start of procedure EVP_MD_CTX_init()
  118.   #endif
  119.   
  120. > void EVP_MD_CTX_init(EVP_MD_CTX *ctx)
  121.   {
  122.       memset(ctx, 0, sizeof(*ctx));

crypto/evp/digest.c:122:5: 
  120.   void EVP_MD_CTX_init(EVP_MD_CTX *ctx)
  121.   {
  122. >     memset(ctx, 0, sizeof(*ctx));
  123.   }
  124.   

crypto/evp/digest.c:123:1: return from a call to EVP_MD_CTX_init
  121.   {
  122.       memset(ctx, 0, sizeof(*ctx));
  123. > }
  124.   
  125.   EVP_MD_CTX *EVP_MD_CTX_create(void)

ssl/statem/statem_srvr.c:3046:5: 
3044.       EVP_MD_CTX_init(&mctx);
3045.   
3046. >     peer = s->session->peer;
3047.       pkey = X509_get_pubkey(peer);
3048.       type = X509_certificate_type(peer, pkey);

ssl/statem/statem_srvr.c:3047:5: 
3045.   
3046.       peer = s->session->peer;
3047. >     pkey = X509_get_pubkey(peer);
3048.       type = X509_certificate_type(peer, pkey);
3049.   

crypto/x509/x509_cmp.c:305:1: start of procedure X509_get_pubkey()
  303.   }
  304.   
  305. > EVP_PKEY *X509_get_pubkey(X509 *x)
  306.   {
  307.       if (x == NULL)

crypto/x509/x509_cmp.c:307:9: Taking true branch
  305.   EVP_PKEY *X509_get_pubkey(X509 *x)
  306.   {
  307.       if (x == NULL)
                 ^
  308.           return (NULL);
  309.       return (X509_PUBKEY_get(x->cert_info.key));

crypto/x509/x509_cmp.c:308:9: 
  306.   {
  307.       if (x == NULL)
  308. >         return (NULL);
  309.       return (X509_PUBKEY_get(x->cert_info.key));
  310.   }

crypto/x509/x509_cmp.c:310:1: return from a call to X509_get_pubkey
  308.           return (NULL);
  309.       return (X509_PUBKEY_get(x->cert_info.key));
  310. > }
  311.   
  312.   ASN1_BIT_STRING *X509_get0_pubkey_bitstr(const X509 *x)

ssl/statem/statem_srvr.c:3048:5: Skipping X509_certificate_type(): empty list of specs
3046.       peer = s->session->peer;
3047.       pkey = X509_get_pubkey(peer);
3048.       type = X509_certificate_type(peer, pkey);
            ^
3049.   
3050.       if (!(type & EVP_PKT_SIGN)) {

ssl/statem/statem_srvr.c:3050:11: Taking false branch
3048.       type = X509_certificate_type(peer, pkey);
3049.   
3050.       if (!(type & EVP_PKT_SIGN)) {
                  ^
3051.           SSLerr(SSL_F_TLS_PROCESS_CERT_VERIFY,
3052.                  SSL_R_SIGNATURE_FOR_NON_SIGNING_CERTIFICATE);

ssl/statem/statem_srvr.c:3062:9: 
3060.        * length field (CryptoPro implementations at least till CSP 4.0)
3061.        */
3062. >     if (PACKET_remaining(pkt) == 64 && pkey->type == NID_id_GostR3410_2001) {
3063.           len = 64;
3064.       } else {

ssl/packet_locl.h:89:1: start of procedure PACKET_remaining()
  87.    * Returns the number of bytes remaining to be read in the PACKET
  88.    */
  89. > static inline size_t PACKET_remaining(const PACKET *pkt)
  90.   {
  91.       return pkt->remaining;

ssl/packet_locl.h:91:5: 
  89.   static inline size_t PACKET_remaining(const PACKET *pkt)
  90.   {
  91. >     return pkt->remaining;
  92.   }
  93.   

ssl/packet_locl.h:92:1: return from a call to PACKET_remaining
  90.   {
  91.       return pkt->remaining;
  92. > }
  93.   
  94.   /*

ssl/statem/statem_srvr.c:3062:9: Taking true branch
3060.        * length field (CryptoPro implementations at least till CSP 4.0)
3061.        */
3062.       if (PACKET_remaining(pkt) == 64 && pkey->type == NID_id_GostR3410_2001) {
                ^
3063.           len = 64;
3064.       } else {

ssl/statem/statem_srvr.c:3062:40: 
3060.        * length field (CryptoPro implementations at least till CSP 4.0)
3061.        */
3062. >     if (PACKET_remaining(pkt) == 64 && pkey->type == NID_id_GostR3410_2001) {
3063.           len = 64;
3064.       } else {
