ssl/t1_lib.c:3965: error: NULL_DEREFERENCE
  pointer `cpk` last assigned on line 3964 could be null and is dereferenced at line 3965, column 45.
Showing all 30 steps of the trace


ssl/t1_lib.c:3953:1: start of procedure ssl_get_auto_dh()
3951.   
3952.   #ifndef OPENSSL_NO_DH
3953. > DH *ssl_get_auto_dh(SSL *s)
3954.   {
3955.       int dh_secbits = 80;

ssl/t1_lib.c:3955:5: 
3953.   DH *ssl_get_auto_dh(SSL *s)
3954.   {
3955. >     int dh_secbits = 80;
3956.       if (s->cert->dh_tmp_auto == 2)
3957.           return DH_get_1024_160();

ssl/t1_lib.c:3956:9: Taking false branch
3954.   {
3955.       int dh_secbits = 80;
3956.       if (s->cert->dh_tmp_auto == 2)
                ^
3957.           return DH_get_1024_160();
3958.       if (s->s3->tmp.new_cipher->algorithm_auth & (SSL_aNULL | SSL_aPSK)) {

ssl/t1_lib.c:3958:9: Taking false branch
3956.       if (s->cert->dh_tmp_auto == 2)
3957.           return DH_get_1024_160();
3958.       if (s->s3->tmp.new_cipher->algorithm_auth & (SSL_aNULL | SSL_aPSK)) {
                ^
3959.           if (s->s3->tmp.new_cipher->strength_bits == 256)
3960.               dh_secbits = 128;

ssl/t1_lib.c:3964:9: 
3962.               dh_secbits = 80;
3963.       } else {
3964. >         CERT_PKEY *cpk = ssl_get_server_send_pkey(s);
3965.           dh_secbits = EVP_PKEY_security_bits(cpk->privatekey);
3966.       }

ssl/ssl_lib.c:2743:1: start of procedure ssl_get_server_send_pkey()
  2741.   }
  2742.   
  2743. > CERT_PKEY *ssl_get_server_send_pkey(SSL *s)
  2744.   {
  2745.       CERT *c;

ssl/ssl_lib.c:2748:5: 
  2746.       int i;
  2747.   
  2748. >     c = s->cert;
  2749.       if (!s->s3 || !s->s3->tmp.new_cipher)
  2750.           return NULL;

ssl/ssl_lib.c:2749:10: Taking false branch
  2747.   
  2748.       c = s->cert;
  2749.       if (!s->s3 || !s->s3->tmp.new_cipher)
                   ^
  2750.           return NULL;
  2751.       ssl_set_masks(s);

ssl/ssl_lib.c:2749:20: Taking false branch
  2747.   
  2748.       c = s->cert;
  2749.       if (!s->s3 || !s->s3->tmp.new_cipher)
                             ^
  2750.           return NULL;
  2751.       ssl_set_masks(s);

ssl/ssl_lib.c:2751:5: Skipping ssl_set_masks(): empty list of specs
  2749.       if (!s->s3 || !s->s3->tmp.new_cipher)
  2750.           return NULL;
  2751.       ssl_set_masks(s);
              ^
  2752.   
  2753.       i = ssl_get_server_cert_index(s);

ssl/ssl_lib.c:2753:5: 
  2751.       ssl_set_masks(s);
  2752.   
  2753. >     i = ssl_get_server_cert_index(s);
  2754.   
  2755.       /* This may or may not be an error. */

ssl/ssl_lib.c:2722:1: start of procedure ssl_get_server_cert_index()
    2720.   #endif
    2721.   
    2722. > static int ssl_get_server_cert_index(const SSL *s)
    2723.   {
    2724.       int idx;

ssl/ssl_lib.c:2725:5: 
    2723.   {
    2724.       int idx;
    2725. >     idx = ssl_cipher_get_cert_index(s->s3->tmp.new_cipher);
    2726.       if (idx == SSL_PKEY_RSA_ENC && !s->cert->pkeys[SSL_PKEY_RSA_ENC].x509)
    2727.           idx = SSL_PKEY_RSA_SIGN;

ssl/ssl_ciph.c:1880:1: start of procedure ssl_cipher_get_cert_index()
      1878.   
      1879.   /* For a cipher return the index corresponding to the certificate type */
      1880. > int ssl_cipher_get_cert_index(const SSL_CIPHER *c)
      1881.   {
      1882.       uint32_t alg_a;

ssl/ssl_ciph.c:1884:5: 
      1882.       uint32_t alg_a;
      1883.   
      1884. >     alg_a = c->algorithm_auth;
      1885.   
      1886.       if (alg_a & SSL_aECDSA)

ssl/ssl_ciph.c:1886:9: Taking false branch
      1884.       alg_a = c->algorithm_auth;
      1885.   
      1886.       if (alg_a & SSL_aECDSA)
                      ^
      1887.           return SSL_PKEY_ECC;
      1888.       else if (alg_a & SSL_aDSS)

ssl/ssl_ciph.c:1888:14: Taking false branch
      1886.       if (alg_a & SSL_aECDSA)
      1887.           return SSL_PKEY_ECC;
      1888.       else if (alg_a & SSL_aDSS)
                           ^
      1889.           return SSL_PKEY_DSA_SIGN;
      1890.       else if (alg_a & SSL_aRSA)

ssl/ssl_ciph.c:1890:14: Taking true branch
      1888.       else if (alg_a & SSL_aDSS)
      1889.           return SSL_PKEY_DSA_SIGN;
      1890.       else if (alg_a & SSL_aRSA)
                           ^
      1891.           return SSL_PKEY_RSA_ENC;
      1892.       else if (alg_a & SSL_aGOST12)

ssl/ssl_ciph.c:1891:9: 
      1889.           return SSL_PKEY_DSA_SIGN;
      1890.       else if (alg_a & SSL_aRSA)
      1891. >         return SSL_PKEY_RSA_ENC;
      1892.       else if (alg_a & SSL_aGOST12)
      1893.           return SSL_PKEY_GOST_EC;

ssl/ssl_ciph.c:1898:1: return from a call to ssl_cipher_get_cert_index
      1896.   
      1897.       return -1;
      1898. > }
      1899.   
      1900.   const SSL_CIPHER *ssl_get_cipher_by_char(SSL *ssl, const unsigned char *ptr)

ssl/ssl_lib.c:2726:9: Taking true branch
    2724.       int idx;
    2725.       idx = ssl_cipher_get_cert_index(s->s3->tmp.new_cipher);
    2726.       if (idx == SSL_PKEY_RSA_ENC && !s->cert->pkeys[SSL_PKEY_RSA_ENC].x509)
                    ^
    2727.           idx = SSL_PKEY_RSA_SIGN;
    2728.       if (idx == SSL_PKEY_GOST_EC) {

ssl/ssl_lib.c:2726:37: Taking false branch
    2724.       int idx;
    2725.       idx = ssl_cipher_get_cert_index(s->s3->tmp.new_cipher);
    2726.       if (idx == SSL_PKEY_RSA_ENC && !s->cert->pkeys[SSL_PKEY_RSA_ENC].x509)
                                                ^
    2727.           idx = SSL_PKEY_RSA_SIGN;
    2728.       if (idx == SSL_PKEY_GOST_EC) {

ssl/ssl_lib.c:2728:9: Taking false branch
    2726.       if (idx == SSL_PKEY_RSA_ENC && !s->cert->pkeys[SSL_PKEY_RSA_ENC].x509)
    2727.           idx = SSL_PKEY_RSA_SIGN;
    2728.       if (idx == SSL_PKEY_GOST_EC) {
                    ^
    2729.           if (s->cert->pkeys[SSL_PKEY_GOST12_512].x509)
    2730.               idx = SSL_PKEY_GOST12_512;

ssl/ssl_lib.c:2738:9: Taking false branch
    2736.               idx = -1;
    2737.       }
    2738.       if (idx == -1)
                    ^
    2739.           SSLerr(SSL_F_SSL_GET_SERVER_CERT_INDEX, ERR_R_INTERNAL_ERROR);
    2740.       return idx;

ssl/ssl_lib.c:2740:5: 
    2738.       if (idx == -1)
    2739.           SSLerr(SSL_F_SSL_GET_SERVER_CERT_INDEX, ERR_R_INTERNAL_ERROR);
    2740. >     return idx;
    2741.   }
    2742.   

ssl/ssl_lib.c:2741:1: return from a call to ssl_get_server_cert_index
    2739.           SSLerr(SSL_F_SSL_GET_SERVER_CERT_INDEX, ERR_R_INTERNAL_ERROR);
    2740.       return idx;
    2741. > }
    2742.   
    2743.   CERT_PKEY *ssl_get_server_send_pkey(SSL *s)

ssl/ssl_lib.c:2756:9: Taking true branch
  2754.   
  2755.       /* This may or may not be an error. */
  2756.       if (i < 0)
                  ^
  2757.           return NULL;
  2758.   

ssl/ssl_lib.c:2757:9: 
  2755.       /* This may or may not be an error. */
  2756.       if (i < 0)
  2757. >         return NULL;
  2758.   
  2759.       /* May be NULL. */

ssl/ssl_lib.c:2761:1: return from a call to ssl_get_server_send_pkey
  2759.       /* May be NULL. */
  2760.       return &c->pkeys[i];
  2761. > }
  2762.   
  2763.   EVP_PKEY *ssl_get_sign_pkey(SSL *s, const SSL_CIPHER *cipher,

ssl/t1_lib.c:3965:9: 
3963.       } else {
3964.           CERT_PKEY *cpk = ssl_get_server_send_pkey(s);
3965. >         dh_secbits = EVP_PKEY_security_bits(cpk->privatekey);
3966.       }
3967.   
