ssl/t1_lib.c:4013: error: NULL_DEREFERENCE
  pointer `cpk` last assigned on line 4012 could be null and is dereferenced at line 4013, column 45.
Showing all 30 steps of the trace


ssl/t1_lib.c:4001:1: start of procedure ssl_get_auto_dh()
3999.   
4000.   #ifndef OPENSSL_NO_DH
4001. > DH *ssl_get_auto_dh(SSL *s)
4002.   {
4003.       int dh_secbits = 80;

ssl/t1_lib.c:4003:5: 
4001.   DH *ssl_get_auto_dh(SSL *s)
4002.   {
4003. >     int dh_secbits = 80;
4004.       if (s->cert->dh_tmp_auto == 2)
4005.           return DH_get_1024_160();

ssl/t1_lib.c:4004:9: Taking false branch
4002.   {
4003.       int dh_secbits = 80;
4004.       if (s->cert->dh_tmp_auto == 2)
                ^
4005.           return DH_get_1024_160();
4006.       if (s->s3->tmp.new_cipher->algorithm_auth & (SSL_aNULL | SSL_aPSK)) {

ssl/t1_lib.c:4006:9: Taking false branch
4004.       if (s->cert->dh_tmp_auto == 2)
4005.           return DH_get_1024_160();
4006.       if (s->s3->tmp.new_cipher->algorithm_auth & (SSL_aNULL | SSL_aPSK)) {
                ^
4007.           if (s->s3->tmp.new_cipher->strength_bits == 256)
4008.               dh_secbits = 128;

ssl/t1_lib.c:4012:9: 
4010.               dh_secbits = 80;
4011.       } else {
4012. >         CERT_PKEY *cpk = ssl_get_server_send_pkey(s);
4013.           dh_secbits = EVP_PKEY_security_bits(cpk->privatekey);
4014.       }

ssl/ssl_lib.c:2641:1: start of procedure ssl_get_server_send_pkey()
  2639.   }
  2640.   
  2641. > CERT_PKEY *ssl_get_server_send_pkey(SSL *s)
  2642.   {
  2643.       CERT *c;

ssl/ssl_lib.c:2646:5: 
  2644.       int i;
  2645.   
  2646. >     c = s->cert;
  2647.       if (!s->s3 || !s->s3->tmp.new_cipher)
  2648.           return NULL;

ssl/ssl_lib.c:2647:10: Taking false branch
  2645.   
  2646.       c = s->cert;
  2647.       if (!s->s3 || !s->s3->tmp.new_cipher)
                   ^
  2648.           return NULL;
  2649.       ssl_set_masks(s, s->s3->tmp.new_cipher);

ssl/ssl_lib.c:2647:20: Taking false branch
  2645.   
  2646.       c = s->cert;
  2647.       if (!s->s3 || !s->s3->tmp.new_cipher)
                             ^
  2648.           return NULL;
  2649.       ssl_set_masks(s, s->s3->tmp.new_cipher);

ssl/ssl_lib.c:2649:5: Skipping ssl_set_masks(): empty list of specs
  2647.       if (!s->s3 || !s->s3->tmp.new_cipher)
  2648.           return NULL;
  2649.       ssl_set_masks(s, s->s3->tmp.new_cipher);
              ^
  2650.   
  2651.   #ifdef OPENSSL_SSL_DEBUG_BROKEN_PROTOCOL

ssl/ssl_lib.c:2660:5: 
  2658.   #endif
  2659.   
  2660. >     i = ssl_get_server_cert_index(s);
  2661.   
  2662.       /* This may or may not be an error. */

ssl/ssl_lib.c:2620:1: start of procedure ssl_get_server_cert_index()
    2618.   #endif
    2619.   
    2620. > static int ssl_get_server_cert_index(const SSL *s)
    2621.   {
    2622.       int idx;

ssl/ssl_lib.c:2623:5: 
    2621.   {
    2622.       int idx;
    2623. >     idx = ssl_cipher_get_cert_index(s->s3->tmp.new_cipher);
    2624.       if (idx == SSL_PKEY_RSA_ENC && !s->cert->pkeys[SSL_PKEY_RSA_ENC].x509)
    2625.           idx = SSL_PKEY_RSA_SIGN;

ssl/ssl_ciph.c:1924:1: start of procedure ssl_cipher_get_cert_index()
      1922.   
      1923.   /* For a cipher return the index corresponding to the certificate type */
      1924. > int ssl_cipher_get_cert_index(const SSL_CIPHER *c)
      1925.   {
      1926.       uint32_t alg_a;

ssl/ssl_ciph.c:1928:5: 
      1926.       uint32_t alg_a;
      1927.   
      1928. >     alg_a = c->algorithm_auth;
      1929.   
      1930.       if (alg_a & SSL_aECDSA)

ssl/ssl_ciph.c:1930:9: Taking false branch
      1928.       alg_a = c->algorithm_auth;
      1929.   
      1930.       if (alg_a & SSL_aECDSA)
                      ^
      1931.           return SSL_PKEY_ECC;
      1932.       else if (alg_a & SSL_aDSS)

ssl/ssl_ciph.c:1932:14: Taking false branch
      1930.       if (alg_a & SSL_aECDSA)
      1931.           return SSL_PKEY_ECC;
      1932.       else if (alg_a & SSL_aDSS)
                           ^
      1933.           return SSL_PKEY_DSA_SIGN;
      1934.       else if (alg_a & SSL_aRSA)

ssl/ssl_ciph.c:1934:14: Taking true branch
      1932.       else if (alg_a & SSL_aDSS)
      1933.           return SSL_PKEY_DSA_SIGN;
      1934.       else if (alg_a & SSL_aRSA)
                           ^
      1935.           return SSL_PKEY_RSA_ENC;
      1936.       else if (alg_a & SSL_aGOST12)

ssl/ssl_ciph.c:1935:9: 
      1933.           return SSL_PKEY_DSA_SIGN;
      1934.       else if (alg_a & SSL_aRSA)
      1935. >         return SSL_PKEY_RSA_ENC;
      1936.       else if (alg_a & SSL_aGOST12)
      1937.           return SSL_PKEY_GOST_EC;

ssl/ssl_ciph.c:1942:1: return from a call to ssl_cipher_get_cert_index
      1940.   
      1941.       return -1;
      1942. > }
      1943.   
      1944.   const SSL_CIPHER *ssl_get_cipher_by_char(SSL *ssl, const unsigned char *ptr)

ssl/ssl_lib.c:2624:9: Taking true branch
    2622.       int idx;
    2623.       idx = ssl_cipher_get_cert_index(s->s3->tmp.new_cipher);
    2624.       if (idx == SSL_PKEY_RSA_ENC && !s->cert->pkeys[SSL_PKEY_RSA_ENC].x509)
                    ^
    2625.           idx = SSL_PKEY_RSA_SIGN;
    2626.       if (idx == SSL_PKEY_GOST_EC) {

ssl/ssl_lib.c:2624:37: Taking false branch
    2622.       int idx;
    2623.       idx = ssl_cipher_get_cert_index(s->s3->tmp.new_cipher);
    2624.       if (idx == SSL_PKEY_RSA_ENC && !s->cert->pkeys[SSL_PKEY_RSA_ENC].x509)
                                                ^
    2625.           idx = SSL_PKEY_RSA_SIGN;
    2626.       if (idx == SSL_PKEY_GOST_EC) {

ssl/ssl_lib.c:2626:9: Taking false branch
    2624.       if (idx == SSL_PKEY_RSA_ENC && !s->cert->pkeys[SSL_PKEY_RSA_ENC].x509)
    2625.           idx = SSL_PKEY_RSA_SIGN;
    2626.       if (idx == SSL_PKEY_GOST_EC) {
                    ^
    2627.           if (s->cert->pkeys[SSL_PKEY_GOST12_512].x509)
    2628.               idx = SSL_PKEY_GOST12_512;

ssl/ssl_lib.c:2636:9: Taking false branch
    2634.               idx = -1;
    2635.       }
    2636.       if (idx == -1)
                    ^
    2637.           SSLerr(SSL_F_SSL_GET_SERVER_CERT_INDEX, ERR_R_INTERNAL_ERROR);
    2638.       return idx;

ssl/ssl_lib.c:2638:5: 
    2636.       if (idx == -1)
    2637.           SSLerr(SSL_F_SSL_GET_SERVER_CERT_INDEX, ERR_R_INTERNAL_ERROR);
    2638. >     return idx;
    2639.   }
    2640.   

ssl/ssl_lib.c:2639:1: return from a call to ssl_get_server_cert_index
    2637.           SSLerr(SSL_F_SSL_GET_SERVER_CERT_INDEX, ERR_R_INTERNAL_ERROR);
    2638.       return idx;
    2639. > }
    2640.   
    2641.   CERT_PKEY *ssl_get_server_send_pkey(SSL *s)

ssl/ssl_lib.c:2663:9: Taking true branch
  2661.   
  2662.       /* This may or may not be an error. */
  2663.       if (i < 0)
                  ^
  2664.           return NULL;
  2665.   

ssl/ssl_lib.c:2664:9: 
  2662.       /* This may or may not be an error. */
  2663.       if (i < 0)
  2664. >         return NULL;
  2665.   
  2666.       /* May be NULL. */

ssl/ssl_lib.c:2668:1: return from a call to ssl_get_server_send_pkey
  2666.       /* May be NULL. */
  2667.       return &c->pkeys[i];
  2668. > }
  2669.   
  2670.   EVP_PKEY *ssl_get_sign_pkey(SSL *s, const SSL_CIPHER *cipher,

ssl/t1_lib.c:4013:9: 
4011.       } else {
4012.           CERT_PKEY *cpk = ssl_get_server_send_pkey(s);
4013. >         dh_secbits = EVP_PKEY_security_bits(cpk->privatekey);
4014.       }
4015.   
