ssl/d1_srvr.c:959: error: NULL_DEREFERENCE
  pointer `dh` last assigned on line 882 could be null and is dereferenced by call to `DH_free()` at line 959, column 5.
Showing all 27 steps of the trace


ssl/d1_srvr.c:872:1: start of procedure dtls1_send_server_key_exchange()
870.   	}
871.   
872. > int dtls1_send_server_key_exchange(SSL *s)
873.   	{
874.   #ifndef OPENSSL_NO_RSA

ssl/d1_srvr.c:882:2: 
880.   #endif
881.   #ifndef OPENSSL_NO_DH
882. > 	DH *dh=NULL,*dhp;
883.   #endif
884.   #ifndef OPENSSL_NO_ECDH

ssl/d1_srvr.c:885:2: 
883.   #endif
884.   #ifndef OPENSSL_NO_ECDH
885. > 	EC_KEY *ecdh=NULL, *ecdhp;
886.   	unsigned char *encodedPoint = NULL;
887.   	int encodedlen = 0;

ssl/d1_srvr.c:886:2: 
884.   #ifndef OPENSSL_NO_ECDH
885.   	EC_KEY *ecdh=NULL, *ecdhp;
886. > 	unsigned char *encodedPoint = NULL;
887.   	int encodedlen = 0;
888.   	int curve_id = 0;

ssl/d1_srvr.c:887:2: 
885.   	EC_KEY *ecdh=NULL, *ecdhp;
886.   	unsigned char *encodedPoint = NULL;
887. > 	int encodedlen = 0;
888.   	int curve_id = 0;
889.   	BN_CTX *bn_ctx = NULL; 

ssl/d1_srvr.c:888:2: 
886.   	unsigned char *encodedPoint = NULL;
887.   	int encodedlen = 0;
888. > 	int curve_id = 0;
889.   	BN_CTX *bn_ctx = NULL; 
890.   #endif

ssl/d1_srvr.c:889:2: 
887.   	int encodedlen = 0;
888.   	int curve_id = 0;
889. > 	BN_CTX *bn_ctx = NULL; 
890.   #endif
891.   	EVP_PKEY *pkey;

ssl/d1_srvr.c:902:2: 
900.   	EVP_MD_CTX md_ctx;
901.   
902. > 	EVP_MD_CTX_init(&md_ctx);
903.   	if (s->state == SSL3_ST_SW_KEY_EXCH_A)
904.   		{

crypto/evp/digest.c:120:1: start of procedure EVP_MD_CTX_init()
  118.   #endif
  119.   
  120. > void EVP_MD_CTX_init(EVP_MD_CTX *ctx)
  121.   	{
  122.   	memset(ctx,'\0',sizeof *ctx);

crypto/evp/digest.c:122:2: 
  120.   void EVP_MD_CTX_init(EVP_MD_CTX *ctx)
  121.   	{
  122. > 	memset(ctx,'\0',sizeof *ctx);
  123.   	}
  124.   

crypto/evp/digest.c:123:2: return from a call to EVP_MD_CTX_init
  121.   	{
  122.   	memset(ctx,'\0',sizeof *ctx);
  123.   	}
          ^
  124.   
  125.   EVP_MD_CTX *EVP_MD_CTX_create(void)

ssl/d1_srvr.c:903:6: Taking true branch
901.   
902.   	EVP_MD_CTX_init(&md_ctx);
903.   	if (s->state == SSL3_ST_SW_KEY_EXCH_A)
            ^
904.   		{
905.   		type=s->s3->tmp.new_cipher->algorithm_mkey;

ssl/d1_srvr.c:905:3: 
903.   	if (s->state == SSL3_ST_SW_KEY_EXCH_A)
904.   		{
905. > 		type=s->s3->tmp.new_cipher->algorithm_mkey;
906.   		cert=s->cert;
907.   

ssl/d1_srvr.c:906:3: 
904.   		{
905.   		type=s->s3->tmp.new_cipher->algorithm_mkey;
906. > 		cert=s->cert;
907.   
908.   		buf=s->init_buf;

ssl/d1_srvr.c:908:3: 
906.   		cert=s->cert;
907.   
908. > 		buf=s->init_buf;
909.   
910.   		r[0]=r[1]=r[2]=r[3]=NULL;

ssl/d1_srvr.c:910:3: 
908.   		buf=s->init_buf;
909.   
910. > 		r[0]=r[1]=r[2]=r[3]=NULL;
911.   		n=0;
912.   #ifndef OPENSSL_NO_RSA

ssl/d1_srvr.c:911:3: 
909.   
910.   		r[0]=r[1]=r[2]=r[3]=NULL;
911. > 		n=0;
912.   #ifndef OPENSSL_NO_RSA
913.   		if (type & SSL_kRSA)

ssl/d1_srvr.c:913:7: Taking false branch
911.   		n=0;
912.   #ifndef OPENSSL_NO_RSA
913.   		if (type & SSL_kRSA)
             ^
914.   			{
915.   			rsa=cert->rsa_tmp;

ssl/d1_srvr.c:943:8: Taking true branch
941.   #endif
942.   #ifndef OPENSSL_NO_DH
943.   			if (type & SSL_kEDH)
              ^
944.   			{
945.   			dhp=cert->dh_tmp;

ssl/d1_srvr.c:945:4: 
943.   			if (type & SSL_kEDH)
944.   			{
945. > 			dhp=cert->dh_tmp;
946.   			if ((dhp == NULL) && (s->cert->dh_tmp_cb != NULL))
947.   				dhp=s->cert->dh_tmp_cb(s,

ssl/d1_srvr.c:946:9: Taking true branch
944.   			{
945.   			dhp=cert->dh_tmp;
946.   			if ((dhp == NULL) && (s->cert->dh_tmp_cb != NULL))
               ^
947.   				dhp=s->cert->dh_tmp_cb(s,
948.   				      SSL_C_IS_EXPORT(s->s3->tmp.new_cipher),

ssl/d1_srvr.c:946:26: Taking true branch
944.   			{
945.   			dhp=cert->dh_tmp;
946.   			if ((dhp == NULL) && (s->cert->dh_tmp_cb != NULL))
                                ^
947.   				dhp=s->cert->dh_tmp_cb(s,
948.   				      SSL_C_IS_EXPORT(s->s3->tmp.new_cipher),

ssl/d1_srvr.c:949:11: Condition is false
947.   				dhp=s->cert->dh_tmp_cb(s,
948.   				      SSL_C_IS_EXPORT(s->s3->tmp.new_cipher),
949.   				      SSL_C_EXPORT_PKEYLENGTH(s->s3->tmp.new_cipher));
                 ^
950.   			if (dhp == NULL)
951.   				{

ssl/d1_srvr.c:947:5: Skipping __function_pointer__(): unresolved function pointer
945.   			dhp=cert->dh_tmp;
946.   			if ((dhp == NULL) && (s->cert->dh_tmp_cb != NULL))
947.   				dhp=s->cert->dh_tmp_cb(s,
           ^
948.   				      SSL_C_IS_EXPORT(s->s3->tmp.new_cipher),
949.   				      SSL_C_EXPORT_PKEYLENGTH(s->s3->tmp.new_cipher));

ssl/d1_srvr.c:950:8: Taking false branch
948.   				      SSL_C_IS_EXPORT(s->s3->tmp.new_cipher),
949.   				      SSL_C_EXPORT_PKEYLENGTH(s->s3->tmp.new_cipher));
950.   			if (dhp == NULL)
              ^
951.   				{
952.   				al=SSL_AD_HANDSHAKE_FAILURE;

ssl/d1_srvr.c:957:8: Taking true branch
955.   				}
956.   
957.   			if (s->s3->tmp.dh != NULL)
              ^
958.   				{
959.   				DH_free(dh);

ssl/d1_srvr.c:959:5: 
957.   			if (s->s3->tmp.dh != NULL)
958.   				{
959. > 				DH_free(dh);
960.   				SSLerr(SSL_F_DTLS1_SEND_SERVER_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR);
961.   				goto err;
