ssl/statem/statem_clnt.c:2389: error: NULL_DEREFERENCE
  pointer `pkey` last assigned on line 2388 could be null and is dereferenced by call to `EVP_PKEY_get0_RSA()` at line 2389, column 9.
Showing all 30 steps of the trace


ssl/statem/statem_clnt.c:2370:1: start of procedure tls_construct_cke_rsa()
2368.   }
2369.   
2370. > static int tls_construct_cke_rsa(SSL *s, WPACKET *pkt, int *al)
2371.   {
2372.   #ifndef OPENSSL_NO_RSA

ssl/statem/statem_clnt.c:2373:5: 
2371.   {
2372.   #ifndef OPENSSL_NO_RSA
2373. >     unsigned char *encdata = NULL;
2374.       EVP_PKEY *pkey = NULL;
2375.       EVP_PKEY_CTX *pctx = NULL;

ssl/statem/statem_clnt.c:2374:5: 
2372.   #ifndef OPENSSL_NO_RSA
2373.       unsigned char *encdata = NULL;
2374. >     EVP_PKEY *pkey = NULL;
2375.       EVP_PKEY_CTX *pctx = NULL;
2376.       size_t enclen;

ssl/statem/statem_clnt.c:2375:5: 
2373.       unsigned char *encdata = NULL;
2374.       EVP_PKEY *pkey = NULL;
2375. >     EVP_PKEY_CTX *pctx = NULL;
2376.       size_t enclen;
2377.       unsigned char *pms = NULL;

ssl/statem/statem_clnt.c:2377:5: 
2375.       EVP_PKEY_CTX *pctx = NULL;
2376.       size_t enclen;
2377. >     unsigned char *pms = NULL;
2378.       size_t pmslen = 0;
2379.   

ssl/statem/statem_clnt.c:2378:5: 
2376.       size_t enclen;
2377.       unsigned char *pms = NULL;
2378. >     size_t pmslen = 0;
2379.   
2380.       if (s->session->peer == NULL) {

ssl/statem/statem_clnt.c:2380:9: Taking false branch
2378.       size_t pmslen = 0;
2379.   
2380.       if (s->session->peer == NULL) {
                ^
2381.           /*
2382.            * We should always have a server certificate with SSL_kRSA.

ssl/statem/statem_clnt.c:2388:5: 
2386.       }
2387.   
2388. >     pkey = X509_get0_pubkey(s->session->peer);
2389.       if (EVP_PKEY_get0_RSA(pkey) == NULL) {
2390.           SSLerr(SSL_F_TLS_CONSTRUCT_CKE_RSA, ERR_R_INTERNAL_ERROR);

crypto/x509/x509_cmp.c:265:1: start of procedure X509_get0_pubkey()
  263.   }
  264.   
  265. > EVP_PKEY *X509_get0_pubkey(const X509 *x)
  266.   {
  267.       if (x == NULL)

crypto/x509/x509_cmp.c:267:9: Taking false branch
  265.   EVP_PKEY *X509_get0_pubkey(const X509 *x)
  266.   {
  267.       if (x == NULL)
                 ^
  268.           return NULL;
  269.       return X509_PUBKEY_get0(x->cert_info.key);

crypto/x509/x509_cmp.c:269:5: 
  267.       if (x == NULL)
  268.           return NULL;
  269. >     return X509_PUBKEY_get0(x->cert_info.key);
  270.   }
  271.   

crypto/x509/x_pubkey.c:140:1: start of procedure X509_PUBKEY_get0()
    138.   }
    139.   
    140. > EVP_PKEY *X509_PUBKEY_get0(X509_PUBKEY *key)
    141.   {
    142.       EVP_PKEY *ret = NULL;

crypto/x509/x_pubkey.c:142:5: 
    140.   EVP_PKEY *X509_PUBKEY_get0(X509_PUBKEY *key)
    141.   {
    142. >     EVP_PKEY *ret = NULL;
    143.   
    144.       if (key == NULL || key->public_key == NULL)

crypto/x509/x_pubkey.c:144:9: Taking false branch
    142.       EVP_PKEY *ret = NULL;
    143.   
    144.       if (key == NULL || key->public_key == NULL)
                   ^
    145.           return NULL;
    146.   

crypto/x509/x_pubkey.c:144:24: Taking false branch
    142.       EVP_PKEY *ret = NULL;
    143.   
    144.       if (key == NULL || key->public_key == NULL)
                                  ^
    145.           return NULL;
    146.   

crypto/x509/x_pubkey.c:147:9: Taking false branch
    145.           return NULL;
    146.   
    147.       if (key->pkey != NULL)
                   ^
    148.           return key->pkey;
    149.   

crypto/x509/x_pubkey.c:158:5: 
    156.        * in the queue.
    157.        */
    158. >     x509_pubkey_decode(&ret, key);
    159.       /* If decode doesn't fail something bad happened */
    160.       if (ret != NULL) {

crypto/x509/x_pubkey.c:103:1: start of procedure x509_pubkey_decode()
      101.   
      102.   
      103. > static int x509_pubkey_decode(EVP_PKEY **ppkey, X509_PUBKEY *key)
      104.       {
      105.       EVP_PKEY *pkey = EVP_PKEY_new();

crypto/x509/x_pubkey.c:105:5: Skipping EVP_PKEY_new(): empty list of specs
      103.   static int x509_pubkey_decode(EVP_PKEY **ppkey, X509_PUBKEY *key)
      104.       {
      105.       EVP_PKEY *pkey = EVP_PKEY_new();
                 ^
      106.   
      107.       if (pkey == NULL) {

crypto/x509/x_pubkey.c:107:9: Taking true branch
      105.       EVP_PKEY *pkey = EVP_PKEY_new();
      106.   
      107.       if (pkey == NULL) {
                     ^
      108.           X509err(X509_F_X509_PUBKEY_DECODE, ERR_R_MALLOC_FAILURE);
      109.           return -1;

crypto/x509/x_pubkey.c:108:9: Skipping ERR_put_error(): empty list of specs
      106.   
      107.       if (pkey == NULL) {
      108.           X509err(X509_F_X509_PUBKEY_DECODE, ERR_R_MALLOC_FAILURE);
                     ^
      109.           return -1;
      110.       }

crypto/x509/x_pubkey.c:109:9: 
      107.       if (pkey == NULL) {
      108.           X509err(X509_F_X509_PUBKEY_DECODE, ERR_R_MALLOC_FAILURE);
      109. >         return -1;
      110.       }
      111.   

crypto/x509/x_pubkey.c:138:1: return from a call to x509_pubkey_decode
      136.       EVP_PKEY_free(pkey);
      137.       return 0;
      138. > }
      139.   
      140.   EVP_PKEY *X509_PUBKEY_get0(X509_PUBKEY *key)

crypto/x509/x_pubkey.c:160:9: Taking false branch
    158.       x509_pubkey_decode(&ret, key);
    159.       /* If decode doesn't fail something bad happened */
    160.       if (ret != NULL) {
                   ^
    161.           X509err(X509_F_X509_PUBKEY_GET0, ERR_R_INTERNAL_ERROR);
    162.           EVP_PKEY_free(ret);

crypto/x509/x_pubkey.c:165:5: 
    163.       }
    164.   
    165. >     return NULL;
    166.   }
    167.   

crypto/x509/x_pubkey.c:166:1: return from a call to X509_PUBKEY_get0
    164.   
    165.       return NULL;
    166. > }
    167.   
    168.   EVP_PKEY *X509_PUBKEY_get(X509_PUBKEY *key)

crypto/x509/x509_cmp.c:270:1: return from a call to X509_get0_pubkey
  268.           return NULL;
  269.       return X509_PUBKEY_get0(x->cert_info.key);
  270. > }
  271.   
  272.   EVP_PKEY *X509_get_pubkey(X509 *x)

ssl/statem/statem_clnt.c:2389:9: 
2387.   
2388.       pkey = X509_get0_pubkey(s->session->peer);
2389. >     if (EVP_PKEY_get0_RSA(pkey) == NULL) {
2390.           SSLerr(SSL_F_TLS_CONSTRUCT_CKE_RSA, ERR_R_INTERNAL_ERROR);
2391.           return 0;

crypto/evp/p_lib.c:261:1: start of procedure EVP_PKEY_get0_RSA()
  259.   }
  260.   
  261. > RSA *EVP_PKEY_get0_RSA(EVP_PKEY *pkey)
  262.   {
  263.       if (pkey->type != EVP_PKEY_RSA) {

crypto/evp/p_lib.c:263:9: 
  261.   RSA *EVP_PKEY_get0_RSA(EVP_PKEY *pkey)
  262.   {
  263. >     if (pkey->type != EVP_PKEY_RSA) {
  264.           EVPerr(EVP_F_EVP_PKEY_GET0_RSA, EVP_R_EXPECTING_AN_RSA_KEY);
  265.           return NULL;
