ssl/t1_lib.c:4213: error: NULL_DEREFERENCE
  pointer `cpk` last assigned on line 4212 could be null and is dereferenced at line 4213, column 45.
Showing all 15 steps of the trace


ssl/t1_lib.c:4201:1: start of procedure ssl_get_auto_dh()
4199.   
4200.   #ifndef OPENSSL_NO_DH
4201. > DH *ssl_get_auto_dh(SSL *s)
4202.   {
4203.       int dh_secbits = 80;

ssl/t1_lib.c:4203:5: 
4201.   DH *ssl_get_auto_dh(SSL *s)
4202.   {
4203. >     int dh_secbits = 80;
4204.       if (s->cert->dh_tmp_auto == 2)
4205.           return DH_get_1024_160();

ssl/t1_lib.c:4204:9: Taking false branch
4202.   {
4203.       int dh_secbits = 80;
4204.       if (s->cert->dh_tmp_auto == 2)
                ^
4205.           return DH_get_1024_160();
4206.       if (s->s3->tmp.new_cipher->algorithm_auth & (SSL_aNULL | SSL_aPSK)) {

ssl/t1_lib.c:4206:9: Taking false branch
4204.       if (s->cert->dh_tmp_auto == 2)
4205.           return DH_get_1024_160();
4206.       if (s->s3->tmp.new_cipher->algorithm_auth & (SSL_aNULL | SSL_aPSK)) {
                ^
4207.           if (s->s3->tmp.new_cipher->strength_bits == 256)
4208.               dh_secbits = 128;

ssl/t1_lib.c:4212:9: 
4210.               dh_secbits = 80;
4211.       } else {
4212. >         CERT_PKEY *cpk = ssl_get_server_send_pkey(s);
4213.           dh_secbits = EVP_PKEY_security_bits(cpk->privatekey);
4214.       }

ssl/ssl_lib.c:2208:1: start of procedure ssl_get_server_send_pkey()
  2206.   }
  2207.   
  2208. > CERT_PKEY *ssl_get_server_send_pkey(SSL *s)
  2209.   {
  2210.       CERT *c;

ssl/ssl_lib.c:2213:5: 
  2211.       int i;
  2212.   
  2213. >     c = s->cert;
  2214.       if (!s->s3 || !s->s3->tmp.new_cipher)
  2215.           return NULL;

ssl/ssl_lib.c:2214:10: Taking false branch
  2212.   
  2213.       c = s->cert;
  2214.       if (!s->s3 || !s->s3->tmp.new_cipher)
                   ^
  2215.           return NULL;
  2216.       ssl_set_masks(s, s->s3->tmp.new_cipher);

ssl/ssl_lib.c:2214:20: Taking false branch
  2212.   
  2213.       c = s->cert;
  2214.       if (!s->s3 || !s->s3->tmp.new_cipher)
                             ^
  2215.           return NULL;
  2216.       ssl_set_masks(s, s->s3->tmp.new_cipher);

ssl/ssl_lib.c:2216:5: Skipping ssl_set_masks(): empty list of specs
  2214.       if (!s->s3 || !s->s3->tmp.new_cipher)
  2215.           return NULL;
  2216.       ssl_set_masks(s, s->s3->tmp.new_cipher);
              ^
  2217.   
  2218.   #ifdef OPENSSL_SSL_DEBUG_BROKEN_PROTOCOL

ssl/ssl_lib.c:2227:5: Skipping ssl_get_server_cert_index(): empty list of specs
  2225.   #endif
  2226.   
  2227.       i = ssl_get_server_cert_index(s);
              ^
  2228.   
  2229.       /* This may or may not be an error. */

ssl/ssl_lib.c:2230:9: Taking true branch
  2228.   
  2229.       /* This may or may not be an error. */
  2230.       if (i < 0)
                  ^
  2231.           return NULL;
  2232.   

ssl/ssl_lib.c:2231:9: 
  2229.       /* This may or may not be an error. */
  2230.       if (i < 0)
  2231. >         return NULL;
  2232.   
  2233.       /* May be NULL. */

ssl/ssl_lib.c:2235:1: return from a call to ssl_get_server_send_pkey
  2233.       /* May be NULL. */
  2234.       return &c->pkeys[i];
  2235. > }
  2236.   
  2237.   EVP_PKEY *ssl_get_sign_pkey(SSL *s, const SSL_CIPHER *cipher,

ssl/t1_lib.c:4213:9: 
4211.       } else {
4212.           CERT_PKEY *cpk = ssl_get_server_send_pkey(s);
4213. >         dh_secbits = EVP_PKEY_security_bits(cpk->privatekey);
4214.       }
4215.   
