apps/s_server.c:3170: error: NULL_DEREFERENCE
  pointer `rsa_tmp` last assigned on line 3168 could be null and is dereferenced by call to `RSA_free()` at line 3170, column 13.
Showing all 26 steps of the trace


apps/s_server.c:3155:1: start of procedure tmp_rsa_cb()
3153.   
3154.   #ifndef OPENSSL_NO_RSA
3155. > static RSA *tmp_rsa_cb(SSL *s, int is_export, int keylength)
3156.   {
3157.       BIGNUM *bn = NULL;

apps/s_server.c:3157:5: 
3155.   static RSA *tmp_rsa_cb(SSL *s, int is_export, int keylength)
3156.   {
3157. >     BIGNUM *bn = NULL;
3158.       static RSA *rsa_tmp = NULL;
3159.   

apps/s_server.c:3158:5: 
3156.   {
3157.       BIGNUM *bn = NULL;
3158. >     static RSA *rsa_tmp = NULL;
3159.   
3160.       if (!rsa_tmp && ((bn = BN_new()) == NULL))

apps/s_server.c:3160:10: Taking true branch
3158.       static RSA *rsa_tmp = NULL;
3159.   
3160.       if (!rsa_tmp && ((bn = BN_new()) == NULL))
                 ^
3161.           BIO_printf(bio_err, "Allocation error in generating RSA key\n");
3162.       if (!rsa_tmp && bn) {

apps/s_server.c:3160:22: Taking false branch
3158.       static RSA *rsa_tmp = NULL;
3159.   
3160.       if (!rsa_tmp && ((bn = BN_new()) == NULL))
                             ^
3161.           BIO_printf(bio_err, "Allocation error in generating RSA key\n");
3162.       if (!rsa_tmp && bn) {

apps/s_server.c:3162:10: Taking true branch
3160.       if (!rsa_tmp && ((bn = BN_new()) == NULL))
3161.           BIO_printf(bio_err, "Allocation error in generating RSA key\n");
3162.       if (!rsa_tmp && bn) {
                 ^
3163.           if (!s_quiet) {
3164.               BIO_printf(bio_err, "Generating temp (%d bit) RSA key...",

apps/s_server.c:3162:21: Taking true branch
3160.       if (!rsa_tmp && ((bn = BN_new()) == NULL))
3161.           BIO_printf(bio_err, "Allocation error in generating RSA key\n");
3162.       if (!rsa_tmp && bn) {
                            ^
3163.           if (!s_quiet) {
3164.               BIO_printf(bio_err, "Generating temp (%d bit) RSA key...",

apps/s_server.c:3163:14: Taking false branch
3161.           BIO_printf(bio_err, "Allocation error in generating RSA key\n");
3162.       if (!rsa_tmp && bn) {
3163.           if (!s_quiet) {
                     ^
3164.               BIO_printf(bio_err, "Generating temp (%d bit) RSA key...",
3165.                          keylength);

apps/s_server.c:3168:14: 
3166.               (void)BIO_flush(bio_err);
3167.           }
3168. >         if (!BN_set_word(bn, RSA_F4) || ((rsa_tmp = RSA_new()) == NULL) ||
3169.               !RSA_generate_key_ex(rsa_tmp, keylength, bn, NULL)) {
3170.               RSA_free(rsa_tmp);

crypto/bn/bn_lib.c:527:1: start of procedure BN_set_word()
  525.   }
  526.   
  527. > int BN_set_word(BIGNUM *a, BN_ULONG w)
  528.   {
  529.       bn_check_top(a);

crypto/bn/bn_lib.c:530:9: Condition is true
  528.   {
  529.       bn_check_top(a);
  530.       if (bn_expand(a, (int)sizeof(BN_ULONG) * 8) == NULL)
                 ^
  531.           return (0);
  532.       a->neg = 0;

crypto/bn/bn_lib.c:530:9: Taking false branch
  528.   {
  529.       bn_check_top(a);
  530.       if (bn_expand(a, (int)sizeof(BN_ULONG) * 8) == NULL)
                 ^
  531.           return (0);
  532.       a->neg = 0;

crypto/bn/bn_lib.c:532:5: 
  530.       if (bn_expand(a, (int)sizeof(BN_ULONG) * 8) == NULL)
  531.           return (0);
  532. >     a->neg = 0;
  533.       a->d[0] = w;
  534.       a->top = (w ? 1 : 0);

crypto/bn/bn_lib.c:533:5: 
  531.           return (0);
  532.       a->neg = 0;
  533. >     a->d[0] = w;
  534.       a->top = (w ? 1 : 0);
  535.       bn_check_top(a);

crypto/bn/bn_lib.c:534:15: Condition is true
  532.       a->neg = 0;
  533.       a->d[0] = w;
  534.       a->top = (w ? 1 : 0);
                       ^
  535.       bn_check_top(a);
  536.       return (1);

crypto/bn/bn_lib.c:534:5: 
  532.       a->neg = 0;
  533.       a->d[0] = w;
  534. >     a->top = (w ? 1 : 0);
  535.       bn_check_top(a);
  536.       return (1);

crypto/bn/bn_lib.c:536:5: 
  534.       a->top = (w ? 1 : 0);
  535.       bn_check_top(a);
  536. >     return (1);
  537.   }
  538.   

crypto/bn/bn_lib.c:537:1: return from a call to BN_set_word
  535.       bn_check_top(a);
  536.       return (1);
  537. > }
  538.   
  539.   BIGNUM *BN_bin2bn(const unsigned char *s, int len, BIGNUM *ret)

apps/s_server.c:3168:14: Taking false branch
3166.               (void)BIO_flush(bio_err);
3167.           }
3168.           if (!BN_set_word(bn, RSA_F4) || ((rsa_tmp = RSA_new()) == NULL) ||
                     ^
3169.               !RSA_generate_key_ex(rsa_tmp, keylength, bn, NULL)) {
3170.               RSA_free(rsa_tmp);

apps/s_server.c:3168:42: 
3166.               (void)BIO_flush(bio_err);
3167.           }
3168. >         if (!BN_set_word(bn, RSA_F4) || ((rsa_tmp = RSA_new()) == NULL) ||
3169.               !RSA_generate_key_ex(rsa_tmp, keylength, bn, NULL)) {
3170.               RSA_free(rsa_tmp);

crypto/rsa/rsa_lib.c:72:1: start of procedure RSA_new()
  70.   static const RSA_METHOD *default_RSA_meth = NULL;
  71.   
  72. > RSA *RSA_new(void)
  73.   {
  74.       RSA *r = RSA_new_method(NULL);

crypto/rsa/rsa_lib.c:74:5: Skipping RSA_new_method(): empty list of specs
  72.   RSA *RSA_new(void)
  73.   {
  74.       RSA *r = RSA_new_method(NULL);
            ^
  75.   
  76.       return r;

crypto/rsa/rsa_lib.c:76:5: 
  74.       RSA *r = RSA_new_method(NULL);
  75.   
  76. >     return r;
  77.   }
  78.   

crypto/rsa/rsa_lib.c:77:1: return from a call to RSA_new
  75.   
  76.       return r;
  77. > }
  78.   
  79.   void RSA_set_default_method(const RSA_METHOD *meth)

apps/s_server.c:3168:42: Taking true branch
3166.               (void)BIO_flush(bio_err);
3167.           }
3168.           if (!BN_set_word(bn, RSA_F4) || ((rsa_tmp = RSA_new()) == NULL) ||
                                                 ^
3169.               !RSA_generate_key_ex(rsa_tmp, keylength, bn, NULL)) {
3170.               RSA_free(rsa_tmp);

apps/s_server.c:3170:13: 
3168.           if (!BN_set_word(bn, RSA_F4) || ((rsa_tmp = RSA_new()) == NULL) ||
3169.               !RSA_generate_key_ex(rsa_tmp, keylength, bn, NULL)) {
3170. >             RSA_free(rsa_tmp);
3171.               rsa_tmp = NULL;
3172.           }
