ssl/s3_clnt.c:2499: error: NULL_DEREFERENCE
  pointer `pub_key` last assigned on line 2499 could be null and is dereferenced by call to `EVP_PKEY_CTX_new()` at line 2499, column 13.
Showing all 27 steps of the trace


ssl/s3_clnt.c:2006:1: start of procedure ssl3_send_client_key_exchange()
2004.   
2005.   
2006. > int ssl3_send_client_key_exchange(SSL *s)
2007.   	{
2008.   	unsigned char *p,*d;

ssl/s3_clnt.c:2013:2: 
2011.   #ifndef OPENSSL_NO_RSA
2012.   	unsigned char *q;
2013. > 	EVP_PKEY *pkey=NULL;
2014.   #endif
2015.   #ifndef OPENSSL_NO_KRB5

ssl/s3_clnt.c:2019:2: 
2017.   #endif /* OPENSSL_NO_KRB5 */
2018.   #ifndef OPENSSL_NO_ECDH
2019. > 	EC_KEY *clnt_ecdh = NULL;
2020.   	const EC_POINT *srvr_ecpoint = NULL;
2021.   	EVP_PKEY *srvr_pub_pkey = NULL;

ssl/s3_clnt.c:2020:2: 
2018.   #ifndef OPENSSL_NO_ECDH
2019.   	EC_KEY *clnt_ecdh = NULL;
2020. > 	const EC_POINT *srvr_ecpoint = NULL;
2021.   	EVP_PKEY *srvr_pub_pkey = NULL;
2022.   	unsigned char *encodedPoint = NULL;

ssl/s3_clnt.c:2021:2: 
2019.   	EC_KEY *clnt_ecdh = NULL;
2020.   	const EC_POINT *srvr_ecpoint = NULL;
2021. > 	EVP_PKEY *srvr_pub_pkey = NULL;
2022.   	unsigned char *encodedPoint = NULL;
2023.   	int encoded_pt_len = 0;

ssl/s3_clnt.c:2022:2: 
2020.   	const EC_POINT *srvr_ecpoint = NULL;
2021.   	EVP_PKEY *srvr_pub_pkey = NULL;
2022. > 	unsigned char *encodedPoint = NULL;
2023.   	int encoded_pt_len = 0;
2024.   	BN_CTX * bn_ctx = NULL;

ssl/s3_clnt.c:2023:2: 
2021.   	EVP_PKEY *srvr_pub_pkey = NULL;
2022.   	unsigned char *encodedPoint = NULL;
2023. > 	int encoded_pt_len = 0;
2024.   	BN_CTX * bn_ctx = NULL;
2025.   #endif

ssl/s3_clnt.c:2024:2: 
2022.   	unsigned char *encodedPoint = NULL;
2023.   	int encoded_pt_len = 0;
2024. > 	BN_CTX * bn_ctx = NULL;
2025.   #endif
2026.   

ssl/s3_clnt.c:2027:6: Taking true branch
2025.   #endif
2026.   
2027.   	if (s->state == SSL3_ST_CW_KEY_EXCH_A)
             ^
2028.   		{
2029.   		d=(unsigned char *)s->init_buf->data;

ssl/s3_clnt.c:2029:3: 
2027.   	if (s->state == SSL3_ST_CW_KEY_EXCH_A)
2028.   		{
2029. > 		d=(unsigned char *)s->init_buf->data;
2030.   		p= &(d[4]);
2031.   

ssl/s3_clnt.c:2030:3: 
2028.   		{
2029.   		d=(unsigned char *)s->init_buf->data;
2030. > 		p= &(d[4]);
2031.   
2032.   		alg_k=s->s3->tmp.new_cipher->algorithm_mkey;

ssl/s3_clnt.c:2032:3: 
2030.   		p= &(d[4]);
2031.   
2032. > 		alg_k=s->s3->tmp.new_cipher->algorithm_mkey;
2033.   
2034.   		/* Fool emacs indentation */

ssl/s3_clnt.c:2035:7: Taking false branch
2033.   
2034.   		/* Fool emacs indentation */
2035.   		if (0) {}
              ^
2036.   #ifndef OPENSSL_NO_RSA
2037.   		else if (alg_k & SSL_kRSA)

ssl/s3_clnt.c:2037:12: Taking false branch
2035.   		if (0) {}
2036.   #ifndef OPENSSL_NO_RSA
2037.   		else if (alg_k & SSL_kRSA)
                   ^
2038.   			{
2039.   			RSA *rsa;

ssl/s3_clnt.c:2230:12: Taking false branch
2228.   #endif
2229.   #ifndef OPENSSL_NO_DH
2230.   		else if (alg_k & (SSL_kEDH|SSL_kDHr|SSL_kDHd))
                   ^
2231.   			{
2232.   			DH *dh_srvr,*dh_clnt;

ssl/s3_clnt.c:2294:12: Taking false branch
2292.   
2293.   #ifndef OPENSSL_NO_ECDH 
2294.   		else if (alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe))
                   ^
2295.   			{
2296.   			const EC_GROUP *srvr_group = NULL;

ssl/s3_clnt.c:2478:12: Taking true branch
2476.   			}
2477.   #endif /* !OPENSSL_NO_ECDH */
2478.   		else if (alg_k & SSL_kGOST) 
                   ^
2479.   			{
2480.   			/* GOST key exchange message creation */

ssl/s3_clnt.c:2491:4: 
2489.   
2490.   			/* Get server sertificate PKEY and create ctx from it */
2491. > 			peer_cert=s->session->sess_cert->peer_pkeys[(keytype=SSL_PKEY_GOST01)].x509;
2492.   			if (!peer_cert) 
2493.   				peer_cert=s->session->sess_cert->peer_pkeys[(keytype=SSL_PKEY_GOST94)].x509;

ssl/s3_clnt.c:2492:9: Taking true branch
2490.   			/* Get server sertificate PKEY and create ctx from it */
2491.   			peer_cert=s->session->sess_cert->peer_pkeys[(keytype=SSL_PKEY_GOST01)].x509;
2492.   			if (!peer_cert) 
                ^
2493.   				peer_cert=s->session->sess_cert->peer_pkeys[(keytype=SSL_PKEY_GOST94)].x509;
2494.   			if (!peer_cert)		{

ssl/s3_clnt.c:2493:5: 
2491.   			peer_cert=s->session->sess_cert->peer_pkeys[(keytype=SSL_PKEY_GOST01)].x509;
2492.   			if (!peer_cert) 
2493. > 				peer_cert=s->session->sess_cert->peer_pkeys[(keytype=SSL_PKEY_GOST94)].x509;
2494.   			if (!peer_cert)		{
2495.   					SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,SSL_R_NO_GOST_CERTIFICATE_SENT_BY_PEER);

ssl/s3_clnt.c:2494:9: Taking false branch
2492.   			if (!peer_cert) 
2493.   				peer_cert=s->session->sess_cert->peer_pkeys[(keytype=SSL_PKEY_GOST94)].x509;
2494.   			if (!peer_cert)		{
                ^
2495.   					SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,SSL_R_NO_GOST_CERTIFICATE_SENT_BY_PEER);
2496.   					goto err;

ssl/s3_clnt.c:2499:4: 
2497.   				}	
2498.   				
2499. > 			pkey_ctx=EVP_PKEY_CTX_new(pub_key=X509_get_pubkey(peer_cert),NULL);
2500.   			/* If we have send a certificate, and certificate key
2501.   

crypto/x509/x509_cmp.c:295:1: start of procedure X509_get_pubkey()
  293.   	}
  294.   
  295. > EVP_PKEY *X509_get_pubkey(X509 *x)
  296.   	{
  297.   	if ((x == NULL) || (x->cert_info == NULL))

crypto/x509/x509_cmp.c:297:7: Taking false branch
  295.   EVP_PKEY *X509_get_pubkey(X509 *x)
  296.   	{
  297.   	if ((x == NULL) || (x->cert_info == NULL))
               ^
  298.   		return(NULL);
  299.   	return(X509_PUBKEY_get(x->cert_info->key));

crypto/x509/x509_cmp.c:297:22: Taking true branch
  295.   EVP_PKEY *X509_get_pubkey(X509 *x)
  296.   	{
  297.   	if ((x == NULL) || (x->cert_info == NULL))
                              ^
  298.   		return(NULL);
  299.   	return(X509_PUBKEY_get(x->cert_info->key));

crypto/x509/x509_cmp.c:298:3: 
  296.   	{
  297.   	if ((x == NULL) || (x->cert_info == NULL))
  298. > 		return(NULL);
  299.   	return(X509_PUBKEY_get(x->cert_info->key));
  300.   	}

crypto/x509/x509_cmp.c:300:2: return from a call to X509_get_pubkey
  298.   		return(NULL);
  299.   	return(X509_PUBKEY_get(x->cert_info->key));
  300.   	}
          ^
  301.   
  302.   ASN1_BIT_STRING *X509_get0_pubkey_bitstr(const X509 *x)
