ssl/t1_lib.c:4225: error: NULL_DEREFERENCE
  pointer `cpk` last assigned on line 4224 could be null and is dereferenced at line 4225, column 45.
Showing all 32 steps of the trace


ssl/t1_lib.c:4213:1: start of procedure ssl_get_auto_dh()
4211.   
4212.   #ifndef OPENSSL_NO_DH
4213. > DH *ssl_get_auto_dh(SSL *s)
4214.   {
4215.       int dh_secbits = 80;

ssl/t1_lib.c:4215:5: 
4213.   DH *ssl_get_auto_dh(SSL *s)
4214.   {
4215. >     int dh_secbits = 80;
4216.       if (s->cert->dh_tmp_auto == 2)
4217.           return DH_get_1024_160();

ssl/t1_lib.c:4216:9: Taking false branch
4214.   {
4215.       int dh_secbits = 80;
4216.       if (s->cert->dh_tmp_auto == 2)
                ^
4217.           return DH_get_1024_160();
4218.       if (s->s3->tmp.new_cipher->algorithm_auth & (SSL_aNULL | SSL_aPSK)) {

ssl/t1_lib.c:4218:9: Taking false branch
4216.       if (s->cert->dh_tmp_auto == 2)
4217.           return DH_get_1024_160();
4218.       if (s->s3->tmp.new_cipher->algorithm_auth & (SSL_aNULL | SSL_aPSK)) {
                ^
4219.           if (s->s3->tmp.new_cipher->strength_bits == 256)
4220.               dh_secbits = 128;

ssl/t1_lib.c:4224:9: 
4222.               dh_secbits = 80;
4223.       } else {
4224. >         CERT_PKEY *cpk = ssl_get_server_send_pkey(s);
4225.           dh_secbits = EVP_PKEY_security_bits(cpk->privatekey);
4226.       }

ssl/ssl_lib.c:2217:1: start of procedure ssl_get_server_send_pkey()
  2215.   }
  2216.   
  2217. > CERT_PKEY *ssl_get_server_send_pkey(SSL *s)
  2218.   {
  2219.       CERT *c;

ssl/ssl_lib.c:2222:5: 
  2220.       int i;
  2221.   
  2222. >     c = s->cert;
  2223.       if (!s->s3 || !s->s3->tmp.new_cipher)
  2224.           return NULL;

ssl/ssl_lib.c:2223:10: Taking false branch
  2221.   
  2222.       c = s->cert;
  2223.       if (!s->s3 || !s->s3->tmp.new_cipher)
                   ^
  2224.           return NULL;
  2225.       ssl_set_masks(s, s->s3->tmp.new_cipher);

ssl/ssl_lib.c:2223:20: Taking false branch
  2221.   
  2222.       c = s->cert;
  2223.       if (!s->s3 || !s->s3->tmp.new_cipher)
                             ^
  2224.           return NULL;
  2225.       ssl_set_masks(s, s->s3->tmp.new_cipher);

ssl/ssl_lib.c:2225:5: Skipping ssl_set_masks(): empty list of specs
  2223.       if (!s->s3 || !s->s3->tmp.new_cipher)
  2224.           return NULL;
  2225.       ssl_set_masks(s, s->s3->tmp.new_cipher);
              ^
  2226.   
  2227.   #ifdef OPENSSL_SSL_DEBUG_BROKEN_PROTOCOL

ssl/ssl_lib.c:2236:5: 
  2234.   #endif
  2235.   
  2236. >     i = ssl_get_server_cert_index(s);
  2237.   
  2238.       /* This may or may not be an error. */

ssl/ssl_lib.c:2196:1: start of procedure ssl_get_server_cert_index()
    2194.   #endif
    2195.   
    2196. > static int ssl_get_server_cert_index(const SSL *s)
    2197.   {
    2198.       int idx;

ssl/ssl_lib.c:2199:5: 
    2197.   {
    2198.       int idx;
    2199. >     idx = ssl_cipher_get_cert_index(s->s3->tmp.new_cipher);
    2200.       if (idx == SSL_PKEY_RSA_ENC && !s->cert->pkeys[SSL_PKEY_RSA_ENC].x509)
    2201.           idx = SSL_PKEY_RSA_SIGN;

ssl/ssl_ciph.c:1949:1: start of procedure ssl_cipher_get_cert_index()
      1947.   
      1948.   /* For a cipher return the index corresponding to the certificate type */
      1949. > int ssl_cipher_get_cert_index(const SSL_CIPHER *c)
      1950.   {
      1951.       uint32_t alg_k, alg_a;

ssl/ssl_ciph.c:1953:5: 
      1951.       uint32_t alg_k, alg_a;
      1952.   
      1953. >     alg_k = c->algorithm_mkey;
      1954.       alg_a = c->algorithm_auth;
      1955.   

ssl/ssl_ciph.c:1954:5: 
      1952.   
      1953.       alg_k = c->algorithm_mkey;
      1954. >     alg_a = c->algorithm_auth;
      1955.   
      1956.       if (alg_k & (SSL_kECDHr | SSL_kECDHe)) {

ssl/ssl_ciph.c:1956:9: Taking false branch
      1954.       alg_a = c->algorithm_auth;
      1955.   
      1956.       if (alg_k & (SSL_kECDHr | SSL_kECDHe)) {
                      ^
      1957.           /*
      1958.            * we don't need to look at SSL_kECDHE since no certificate is needed

ssl/ssl_ciph.c:1966:16: Taking false branch
      1964.            */
      1965.           return SSL_PKEY_ECC;
      1966.       } else if (alg_a & SSL_aECDSA)
                             ^
      1967.           return SSL_PKEY_ECC;
      1968.       else if (alg_a & SSL_aDSS)

ssl/ssl_ciph.c:1968:14: Taking false branch
      1966.       } else if (alg_a & SSL_aECDSA)
      1967.           return SSL_PKEY_ECC;
      1968.       else if (alg_a & SSL_aDSS)
                           ^
      1969.           return SSL_PKEY_DSA_SIGN;
      1970.       else if (alg_a & SSL_aRSA)

ssl/ssl_ciph.c:1970:14: Taking true branch
      1968.       else if (alg_a & SSL_aDSS)
      1969.           return SSL_PKEY_DSA_SIGN;
      1970.       else if (alg_a & SSL_aRSA)
                           ^
      1971.           return SSL_PKEY_RSA_ENC;
      1972.       else if (alg_a & SSL_aGOST12)

ssl/ssl_ciph.c:1971:9: 
      1969.           return SSL_PKEY_DSA_SIGN;
      1970.       else if (alg_a & SSL_aRSA)
      1971. >         return SSL_PKEY_RSA_ENC;
      1972.       else if (alg_a & SSL_aGOST12)
      1973.           return SSL_PKEY_GOST_EC;

ssl/ssl_ciph.c:1978:1: return from a call to ssl_cipher_get_cert_index
      1976.   
      1977.       return -1;
      1978. > }
      1979.   
      1980.   const SSL_CIPHER *ssl_get_cipher_by_char(SSL *ssl, const unsigned char *ptr)

ssl/ssl_lib.c:2200:9: Taking true branch
    2198.       int idx;
    2199.       idx = ssl_cipher_get_cert_index(s->s3->tmp.new_cipher);
    2200.       if (idx == SSL_PKEY_RSA_ENC && !s->cert->pkeys[SSL_PKEY_RSA_ENC].x509)
                    ^
    2201.           idx = SSL_PKEY_RSA_SIGN;
    2202.       if (idx == SSL_PKEY_GOST_EC) {

ssl/ssl_lib.c:2200:37: Taking false branch
    2198.       int idx;
    2199.       idx = ssl_cipher_get_cert_index(s->s3->tmp.new_cipher);
    2200.       if (idx == SSL_PKEY_RSA_ENC && !s->cert->pkeys[SSL_PKEY_RSA_ENC].x509)
                                                ^
    2201.           idx = SSL_PKEY_RSA_SIGN;
    2202.       if (idx == SSL_PKEY_GOST_EC) {

ssl/ssl_lib.c:2202:9: Taking false branch
    2200.       if (idx == SSL_PKEY_RSA_ENC && !s->cert->pkeys[SSL_PKEY_RSA_ENC].x509)
    2201.           idx = SSL_PKEY_RSA_SIGN;
    2202.       if (idx == SSL_PKEY_GOST_EC) {
                    ^
    2203.           if (s->cert->pkeys[SSL_PKEY_GOST12_512].x509)
    2204.               idx = SSL_PKEY_GOST12_512;

ssl/ssl_lib.c:2212:9: Taking false branch
    2210.               idx = -1;
    2211.       }
    2212.       if (idx == -1)
                    ^
    2213.           SSLerr(SSL_F_SSL_GET_SERVER_CERT_INDEX, ERR_R_INTERNAL_ERROR);
    2214.       return idx;

ssl/ssl_lib.c:2214:5: 
    2212.       if (idx == -1)
    2213.           SSLerr(SSL_F_SSL_GET_SERVER_CERT_INDEX, ERR_R_INTERNAL_ERROR);
    2214. >     return idx;
    2215.   }
    2216.   

ssl/ssl_lib.c:2215:1: return from a call to ssl_get_server_cert_index
    2213.           SSLerr(SSL_F_SSL_GET_SERVER_CERT_INDEX, ERR_R_INTERNAL_ERROR);
    2214.       return idx;
    2215. > }
    2216.   
    2217.   CERT_PKEY *ssl_get_server_send_pkey(SSL *s)

ssl/ssl_lib.c:2239:9: Taking true branch
  2237.   
  2238.       /* This may or may not be an error. */
  2239.       if (i < 0)
                  ^
  2240.           return NULL;
  2241.   

ssl/ssl_lib.c:2240:9: 
  2238.       /* This may or may not be an error. */
  2239.       if (i < 0)
  2240. >         return NULL;
  2241.   
  2242.       /* May be NULL. */

ssl/ssl_lib.c:2244:1: return from a call to ssl_get_server_send_pkey
  2242.       /* May be NULL. */
  2243.       return &c->pkeys[i];
  2244. > }
  2245.   
  2246.   EVP_PKEY *ssl_get_sign_pkey(SSL *s, const SSL_CIPHER *cipher,

ssl/t1_lib.c:4225:9: 
4223.       } else {
4224.           CERT_PKEY *cpk = ssl_get_server_send_pkey(s);
4225. >         dh_secbits = EVP_PKEY_security_bits(cpk->privatekey);
4226.       }
4227.   
