ssl/s3_srvr.c:2122: error: NULL_DEREFERENCE
  pointer `clnt_pub_pkey` last assigned on line 1618 could be null and is dereferenced by call to `EVP_PKEY_free()` at line 2122, column 2.
Showing all 38 steps of the trace


ssl/s3_srvr.c:1598:1: start of procedure ssl3_get_client_key_exchange()
1596.   	}
1597.   
1598. > static int ssl3_get_client_key_exchange(SSL *s)
1599.   	{
1600.   	int i,al,ok;

ssl/s3_srvr.c:1605:2: 
1603.   	unsigned char *p;
1604.   #ifndef OPENSSL_NO_RSA
1605. > 	RSA *rsa=NULL;
1606.   	EVP_PKEY *pkey=NULL;
1607.   #endif

ssl/s3_srvr.c:1606:2: 
1604.   #ifndef OPENSSL_NO_RSA
1605.   	RSA *rsa=NULL;
1606. > 	EVP_PKEY *pkey=NULL;
1607.   #endif
1608.   #ifndef OPENSSL_NO_DH

ssl/s3_srvr.c:1609:2: 
1607.   #endif
1608.   #ifndef OPENSSL_NO_DH
1609. > 	BIGNUM *pub=NULL;
1610.   	DH *dh_srvr;
1611.   #endif

ssl/s3_srvr.c:1617:2: 
1615.   
1616.   #ifndef OPENSSL_NO_ECDH
1617. > 	EC_KEY *srvr_ecdh = NULL;
1618.   	EVP_PKEY *clnt_pub_pkey = NULL;
1619.   	EC_POINT *clnt_ecpoint = NULL;

ssl/s3_srvr.c:1618:2: 
1616.   #ifndef OPENSSL_NO_ECDH
1617.   	EC_KEY *srvr_ecdh = NULL;
1618. > 	EVP_PKEY *clnt_pub_pkey = NULL;
1619.   	EC_POINT *clnt_ecpoint = NULL;
1620.   	BN_CTX *bn_ctx = NULL; 

ssl/s3_srvr.c:1619:2: 
1617.   	EC_KEY *srvr_ecdh = NULL;
1618.   	EVP_PKEY *clnt_pub_pkey = NULL;
1619. > 	EC_POINT *clnt_ecpoint = NULL;
1620.   	BN_CTX *bn_ctx = NULL; 
1621.   #endif

ssl/s3_srvr.c:1620:2: 
1618.   	EVP_PKEY *clnt_pub_pkey = NULL;
1619.   	EC_POINT *clnt_ecpoint = NULL;
1620. > 	BN_CTX *bn_ctx = NULL; 
1621.   #endif
1622.   

ssl/s3_srvr.c:1623:2: Skipping ssl3_get_message(): empty list of specs
1621.   #endif
1622.   
1623.   	n=ssl3_get_message(s,
         ^
1624.   		SSL3_ST_SR_KEY_EXCH_A,
1625.   		SSL3_ST_SR_KEY_EXCH_B,

ssl/s3_srvr.c:1630:7: Taking false branch
1628.   		&ok);
1629.   
1630.   	if (!ok) return((int)n);
              ^
1631.   	p=(unsigned char *)s->init_msg;
1632.   

ssl/s3_srvr.c:1631:2: 
1629.   
1630.   	if (!ok) return((int)n);
1631. > 	p=(unsigned char *)s->init_msg;
1632.   
1633.   	l=s->s3->tmp.new_cipher->algorithms;

ssl/s3_srvr.c:1633:2: 
1631.   	p=(unsigned char *)s->init_msg;
1632.   
1633. > 	l=s->s3->tmp.new_cipher->algorithms;
1634.   
1635.   #ifndef OPENSSL_NO_RSA

ssl/s3_srvr.c:1636:6: Taking true branch
1634.   
1635.   #ifndef OPENSSL_NO_RSA
1636.   	if (l & SSL_kRSA)
             ^
1637.   		{
1638.   		/* FIX THIS UP EAY EAY EAY EAY */

ssl/s3_srvr.c:1639:7: Taking false branch
1637.   		{
1638.   		/* FIX THIS UP EAY EAY EAY EAY */
1639.   		if (s->s3->tmp.use_rsa_tmp)
              ^
1640.   			{
1641.   			if ((s->cert != NULL) && (s->cert->rsa_tmp != NULL))

ssl/s3_srvr.c:1655:4: 
1653.   		else
1654.   			{
1655. > 			pkey=s->cert->pkeys[SSL_PKEY_RSA_ENC].privatekey;
1656.   			if (	(pkey == NULL) ||
1657.   				(pkey->type != EVP_PKEY_RSA) ||

ssl/s3_srvr.c:1656:10: Taking false branch
1654.   			{
1655.   			pkey=s->cert->pkeys[SSL_PKEY_RSA_ENC].privatekey;
1656.   			if (	(pkey == NULL) ||
                 ^
1657.   				(pkey->type != EVP_PKEY_RSA) ||
1658.   				(pkey->pkey.rsa == NULL))

ssl/s3_srvr.c:1657:6: Taking false branch
1655.   			pkey=s->cert->pkeys[SSL_PKEY_RSA_ENC].privatekey;
1656.   			if (	(pkey == NULL) ||
1657.   				(pkey->type != EVP_PKEY_RSA) ||
             ^
1658.   				(pkey->pkey.rsa == NULL))
1659.   				{

ssl/s3_srvr.c:1658:6: Taking false branch
1656.   			if (	(pkey == NULL) ||
1657.   				(pkey->type != EVP_PKEY_RSA) ||
1658.   				(pkey->pkey.rsa == NULL))
             ^
1659.   				{
1660.   				al=SSL_AD_HANDSHAKE_FAILURE;

ssl/s3_srvr.c:1664:4: 
1662.   				goto f_err;
1663.   				}
1664. > 			rsa=pkey->pkey.rsa;
1665.   			}
1666.   

ssl/s3_srvr.c:1668:7: Taking true branch
1666.   
1667.   		/* TLS */
1668.   		if (s->version > SSL3_VERSION)
              ^
1669.   			{
1670.   			n2s(p,i);

ssl/s3_srvr.c:1670:4: 
1668.   		if (s->version > SSL3_VERSION)
1669.   			{
1670. > 			n2s(p,i);
1671.   			if (n != i+2)
1672.   				{

ssl/s3_srvr.c:1671:8: Taking true branch
1669.   			{
1670.   			n2s(p,i);
1671.   			if (n != i+2)
               ^
1672.   				{
1673.   				if (!(s->options & SSL_OP_TLS_D5_BUG))

ssl/s3_srvr.c:1673:11: Taking true branch
1671.   			if (n != i+2)
1672.   				{
1673.   				if (!(s->options & SSL_OP_TLS_D5_BUG))
                  ^
1674.   					{
1675.   					SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,SSL_R_TLS_RSA_ENCRYPTED_VALUE_LENGTH_IS_WRONG);

ssl/s3_srvr.c:1675:6: 
1673.   				if (!(s->options & SSL_OP_TLS_D5_BUG))
1674.   					{
1675. > 					SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,SSL_R_TLS_RSA_ENCRYPTED_VALUE_LENGTH_IS_WRONG);
1676.   					goto err;
1677.   					}

crypto/err/err.c:630:1: start of procedure ERR_put_error()
  628.   /********************************************************/
  629.   
  630. > void ERR_put_error(int lib, int func, int reason, const char *file,
  631.   	     int line)
  632.   	{

crypto/err/err.c:654:2: Skipping ERR_get_state(): empty list of specs
  652.   	}
  653.   #endif
  654.   	es=ERR_get_state();
          ^
  655.   
  656.   	es->top=(es->top+1)%ERR_NUM_ERRORS;

crypto/err/err.c:656:2: 
  654.   	es=ERR_get_state();
  655.   
  656. > 	es->top=(es->top+1)%ERR_NUM_ERRORS;
  657.   	if (es->top == es->bottom)
  658.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;

crypto/err/err.c:657:6: Taking false branch
  655.   
  656.   	es->top=(es->top+1)%ERR_NUM_ERRORS;
  657.   	if (es->top == es->bottom)
              ^
  658.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
  659.   	es->err_flags[es->top]=0;

crypto/err/err.c:659:2: 
  657.   	if (es->top == es->bottom)
  658.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
  659. > 	es->err_flags[es->top]=0;
  660.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
  661.   	es->err_file[es->top]=file;

crypto/err/err.c:660:2: 
  658.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
  659.   	es->err_flags[es->top]=0;
  660. > 	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
  661.   	es->err_file[es->top]=file;
  662.   	es->err_line[es->top]=line;

crypto/err/err.c:661:2: 
  659.   	es->err_flags[es->top]=0;
  660.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
  661. > 	es->err_file[es->top]=file;
  662.   	es->err_line[es->top]=line;
  663.   	err_clear_data(es,es->top);

crypto/err/err.c:662:2: 
  660.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
  661.   	es->err_file[es->top]=file;
  662. > 	es->err_line[es->top]=line;
  663.   	err_clear_data(es,es->top);
  664.   	}

crypto/err/err.c:663:2: Taking true branch
  661.   	es->err_file[es->top]=file;
  662.   	es->err_line[es->top]=line;
  663.   	err_clear_data(es,es->top);
          ^
  664.   	}
  665.   

crypto/err/err.c:663:2: Taking false branch
  661.   	es->err_file[es->top]=file;
  662.   	es->err_line[es->top]=line;
  663.   	err_clear_data(es,es->top);
          ^
  664.   	}
  665.   

crypto/err/err.c:663:2: Loop condition is false. Leaving loop
  661.   	es->err_file[es->top]=file;
  662.   	es->err_line[es->top]=line;
  663.   	err_clear_data(es,es->top);
          ^
  664.   	}
  665.   

crypto/err/err.c:664:2: return from a call to ERR_put_error
  662.   	es->err_line[es->top]=line;
  663.   	err_clear_data(es,es->top);
  664.   	}
          ^
  665.   
  666.   void ERR_clear_error(void)

ssl/s3_srvr.c:2119:1: 
2117.   	ssl3_send_alert(s,SSL3_AL_FATAL,al);
2118.   #if !defined(OPENSSL_NO_DH) || !defined(OPENSSL_NO_RSA) || !defined(OPENSSL_NO_ECDH)
2119. > err:
2120.   #endif
2121.   #ifndef OPENSSL_NO_ECDH

ssl/s3_srvr.c:2122:2: 
2120.   #endif
2121.   #ifndef OPENSSL_NO_ECDH
2122. > 	EVP_PKEY_free(clnt_pub_pkey);
2123.   	EC_POINT_free(clnt_ecpoint);
2124.   	if (srvr_ecdh != NULL) 
