ssl/statem/statem_srvr.c:3032: error: NULL_DEREFERENCE
  pointer `pkey` last assigned on line 3017 could be null and is dereferenced at line 3032, column 40.
Showing all 23 steps of the trace


ssl/statem/statem_srvr.c:3004:1: start of procedure tls_process_cert_verify()
3002.   }
3003.   
3004. > enum MSG_PROCESS_RETURN tls_process_cert_verify(SSL *s, PACKET *pkt)
3005.   {
3006.       EVP_PKEY *pkey = NULL;

ssl/statem/statem_srvr.c:3006:5: 
3004.   enum MSG_PROCESS_RETURN tls_process_cert_verify(SSL *s, PACKET *pkt)
3005.   {
3006. >     EVP_PKEY *pkey = NULL;
3007.       unsigned char *sig, *data;
3008.       int al, ret = MSG_PROCESS_ERROR;

ssl/statem/statem_srvr.c:3008:5: 
3006.       EVP_PKEY *pkey = NULL;
3007.       unsigned char *sig, *data;
3008. >     int al, ret = MSG_PROCESS_ERROR;
3009.       int type = 0, i, j;
3010.       unsigned int len;

ssl/statem/statem_srvr.c:3009:5: 
3007.       unsigned char *sig, *data;
3008.       int al, ret = MSG_PROCESS_ERROR;
3009. >     int type = 0, i, j;
3010.       unsigned int len;
3011.       X509 *peer;

ssl/statem/statem_srvr.c:3012:5: 
3010.       unsigned int len;
3011.       X509 *peer;
3012. >     const EVP_MD *md = NULL;
3013.       EVP_MD_CTX mctx;
3014.       EVP_MD_CTX_init(&mctx);

ssl/statem/statem_srvr.c:3014:5: 
3012.       const EVP_MD *md = NULL;
3013.       EVP_MD_CTX mctx;
3014. >     EVP_MD_CTX_init(&mctx);
3015.   
3016.       peer = s->session->peer;

crypto/evp/digest.c:120:1: start of procedure EVP_MD_CTX_init()
  118.   #endif
  119.   
  120. > void EVP_MD_CTX_init(EVP_MD_CTX *ctx)
  121.   {
  122.       memset(ctx, 0, sizeof(*ctx));

crypto/evp/digest.c:122:5: 
  120.   void EVP_MD_CTX_init(EVP_MD_CTX *ctx)
  121.   {
  122. >     memset(ctx, 0, sizeof(*ctx));
  123.   }
  124.   

crypto/evp/digest.c:123:1: return from a call to EVP_MD_CTX_init
  121.   {
  122.       memset(ctx, 0, sizeof(*ctx));
  123. > }
  124.   
  125.   EVP_MD_CTX *EVP_MD_CTX_create(void)

ssl/statem/statem_srvr.c:3016:5: 
3014.       EVP_MD_CTX_init(&mctx);
3015.   
3016. >     peer = s->session->peer;
3017.       pkey = X509_get_pubkey(peer);
3018.       type = X509_certificate_type(peer, pkey);

ssl/statem/statem_srvr.c:3017:5: 
3015.   
3016.       peer = s->session->peer;
3017. >     pkey = X509_get_pubkey(peer);
3018.       type = X509_certificate_type(peer, pkey);
3019.   

crypto/x509/x509_cmp.c:305:1: start of procedure X509_get_pubkey()
  303.   }
  304.   
  305. > EVP_PKEY *X509_get_pubkey(X509 *x)
  306.   {
  307.       if (x == NULL)

crypto/x509/x509_cmp.c:307:9: Taking true branch
  305.   EVP_PKEY *X509_get_pubkey(X509 *x)
  306.   {
  307.       if (x == NULL)
                 ^
  308.           return (NULL);
  309.       return (X509_PUBKEY_get(x->cert_info.key));

crypto/x509/x509_cmp.c:308:9: 
  306.   {
  307.       if (x == NULL)
  308. >         return (NULL);
  309.       return (X509_PUBKEY_get(x->cert_info.key));
  310.   }

crypto/x509/x509_cmp.c:310:1: return from a call to X509_get_pubkey
  308.           return (NULL);
  309.       return (X509_PUBKEY_get(x->cert_info.key));
  310. > }
  311.   
  312.   ASN1_BIT_STRING *X509_get0_pubkey_bitstr(const X509 *x)

ssl/statem/statem_srvr.c:3018:5: Skipping X509_certificate_type(): empty list of specs
3016.       peer = s->session->peer;
3017.       pkey = X509_get_pubkey(peer);
3018.       type = X509_certificate_type(peer, pkey);
            ^
3019.   
3020.       if (!(type & EVP_PKT_SIGN)) {

ssl/statem/statem_srvr.c:3020:11: Taking false branch
3018.       type = X509_certificate_type(peer, pkey);
3019.   
3020.       if (!(type & EVP_PKT_SIGN)) {
                  ^
3021.           SSLerr(SSL_F_TLS_PROCESS_CERT_VERIFY,
3022.                  SSL_R_SIGNATURE_FOR_NON_SIGNING_CERTIFICATE);

ssl/statem/statem_srvr.c:3032:9: 
3030.        * length field
3031.        */
3032. >     if (PACKET_remaining(pkt) == 64 && pkey->type == NID_id_GostR3410_2001) {
3033.           len = 64;
3034.       } else {

ssl/packet_locl.h:89:1: start of procedure PACKET_remaining()
  87.    * Returns the number of bytes remaining to be read in the PACKET
  88.    */
  89. > static inline size_t PACKET_remaining(const PACKET *pkt)
  90.   {
  91.       return pkt->remaining;

ssl/packet_locl.h:91:5: 
  89.   static inline size_t PACKET_remaining(const PACKET *pkt)
  90.   {
  91. >     return pkt->remaining;
  92.   }
  93.   

ssl/packet_locl.h:92:1: return from a call to PACKET_remaining
  90.   {
  91.       return pkt->remaining;
  92. > }
  93.   
  94.   /*

ssl/statem/statem_srvr.c:3032:9: Taking true branch
3030.        * length field
3031.        */
3032.       if (PACKET_remaining(pkt) == 64 && pkey->type == NID_id_GostR3410_2001) {
                ^
3033.           len = 64;
3034.       } else {

ssl/statem/statem_srvr.c:3032:40: 
3030.        * length field
3031.        */
3032. >     if (PACKET_remaining(pkt) == 64 && pkey->type == NID_id_GostR3410_2001) {
3033.           len = 64;
3034.       } else {
