ssl/statem/statem_srvr.c:2697: error: NULL_DEREFERENCE
  pointer `pkey` last assigned on line 2681 could be null and is dereferenced at line 2697, column 40.
Showing all 53 steps of the trace


ssl/statem/statem_srvr.c:2660:1: start of procedure tls_process_cert_verify()
2658.   }
2659.   
2660. > MSG_PROCESS_RETURN tls_process_cert_verify(SSL *s, PACKET *pkt)
2661.   {
2662.       EVP_PKEY *pkey = NULL;

ssl/statem/statem_srvr.c:2662:5: 
2660.   MSG_PROCESS_RETURN tls_process_cert_verify(SSL *s, PACKET *pkt)
2661.   {
2662. >     EVP_PKEY *pkey = NULL;
2663.       unsigned char *sig, *data;
2664.       int al, ret = MSG_PROCESS_ERROR;

ssl/statem/statem_srvr.c:2664:5: 
2662.       EVP_PKEY *pkey = NULL;
2663.       unsigned char *sig, *data;
2664. >     int al, ret = MSG_PROCESS_ERROR;
2665.       int type = 0, j;
2666.       unsigned int len;

ssl/statem/statem_srvr.c:2665:5: 
2663.       unsigned char *sig, *data;
2664.       int al, ret = MSG_PROCESS_ERROR;
2665. >     int type = 0, j;
2666.       unsigned int len;
2667.       X509 *peer;

ssl/statem/statem_srvr.c:2668:5: 
2666.       unsigned int len;
2667.       X509 *peer;
2668. >     const EVP_MD *md = NULL;
2669.       long hdatalen = 0;
2670.       void *hdata;

ssl/statem/statem_srvr.c:2669:5: 
2667.       X509 *peer;
2668.       const EVP_MD *md = NULL;
2669. >     long hdatalen = 0;
2670.       void *hdata;
2671.   

ssl/statem/statem_srvr.c:2672:5: 
2670.       void *hdata;
2671.   
2672. >     EVP_MD_CTX *mctx = EVP_MD_CTX_new();
2673.   
2674.       if (mctx == NULL) {

crypto/evp/digest.c:153:1: start of procedure EVP_MD_CTX_new()
  151.   }
  152.   
  153. > EVP_MD_CTX *EVP_MD_CTX_new(void)
  154.   {
  155.       return OPENSSL_zalloc(sizeof(EVP_MD_CTX));

crypto/evp/digest.c:155:5: 
  153.   EVP_MD_CTX *EVP_MD_CTX_new(void)
  154.   {
  155. >     return OPENSSL_zalloc(sizeof(EVP_MD_CTX));
  156.   }
  157.   

crypto/mem.c:157:1: start of procedure CRYPTO_zalloc()
    155.   }
    156.   
    157. > void *CRYPTO_zalloc(size_t num, const char *file, int line)
    158.   {
    159.       void *ret = CRYPTO_malloc(num, file, line);

crypto/mem.c:159:5: 
    157.   void *CRYPTO_zalloc(size_t num, const char *file, int line)
    158.   {
    159. >     void *ret = CRYPTO_malloc(num, file, line);
    160.   
    161.       if (ret != NULL)

crypto/mem.c:120:1: start of procedure CRYPTO_malloc()
      118.   }
      119.   
      120. > void *CRYPTO_malloc(size_t num, const char *file, int line)
      121.   {
      122.       void *ret = NULL;

crypto/mem.c:122:5: 
      120.   void *CRYPTO_malloc(size_t num, const char *file, int line)
      121.   {
      122. >     void *ret = NULL;
      123.   
      124.       if (num <= 0)

crypto/mem.c:124:9: Taking false branch
      122.       void *ret = NULL;
      123.   
      124.       if (num <= 0)
                     ^
      125.           return NULL;
      126.   

crypto/mem.c:127:5: 
      125.           return NULL;
      126.   
      127. >     allow_customize = 0;
      128.   #ifndef OPENSSL_NO_CRYPTO_MDEBUG
      129.       if (call_malloc_debug) {

crypto/mem.c:137:5: 
      135.       }
      136.   #else
      137. >     (void)file;
      138.       (void)line;
      139.       ret = malloc(num);

crypto/mem.c:138:5: 
      136.   #else
      137.       (void)file;
      138. >     (void)line;
      139.       ret = malloc(num);
      140.   #endif

crypto/mem.c:139:5: 
      137.       (void)file;
      138.       (void)line;
      139. >     ret = malloc(num);
      140.   #endif
      141.   

crypto/mem.c:154:5: 
      152.   #endif
      153.   
      154. >     return ret;
      155.   }
      156.   

crypto/mem.c:155:1: return from a call to CRYPTO_malloc
      153.   
      154.       return ret;
      155. > }
      156.   
      157.   void *CRYPTO_zalloc(size_t num, const char *file, int line)

crypto/mem.c:161:9: Taking true branch
    159.       void *ret = CRYPTO_malloc(num, file, line);
    160.   
    161.       if (ret != NULL)
                   ^
    162.           memset(ret, 0, num);
    163.       return ret;

crypto/mem.c:162:9: 
    160.   
    161.       if (ret != NULL)
    162. >         memset(ret, 0, num);
    163.       return ret;
    164.   }

crypto/mem.c:163:5: 
    161.       if (ret != NULL)
    162.           memset(ret, 0, num);
    163. >     return ret;
    164.   }
    165.   

crypto/mem.c:164:1: return from a call to CRYPTO_zalloc
    162.           memset(ret, 0, num);
    163.       return ret;
    164. > }
    165.   
    166.   void *CRYPTO_realloc(void *str, size_t num, const char *file, int line)

crypto/evp/digest.c:156:1: return from a call to EVP_MD_CTX_new
  154.   {
  155.       return OPENSSL_zalloc(sizeof(EVP_MD_CTX));
  156. > }
  157.   
  158.   void EVP_MD_CTX_free(EVP_MD_CTX *ctx)

ssl/statem/statem_srvr.c:2674:9: Taking false branch
2672.       EVP_MD_CTX *mctx = EVP_MD_CTX_new();
2673.   
2674.       if (mctx == NULL) {
                ^
2675.           SSLerr(SSL_F_TLS_PROCESS_CERT_VERIFY, ERR_R_MALLOC_FAILURE);
2676.           al = SSL_AD_INTERNAL_ERROR;

ssl/statem/statem_srvr.c:2680:5: 
2678.       }
2679.   
2680. >     peer = s->session->peer;
2681.       pkey = X509_get0_pubkey(peer);
2682.       type = X509_certificate_type(peer, pkey);

ssl/statem/statem_srvr.c:2681:5: 
2679.   
2680.       peer = s->session->peer;
2681. >     pkey = X509_get0_pubkey(peer);
2682.       type = X509_certificate_type(peer, pkey);
2683.   

crypto/x509/x509_cmp.c:308:1: start of procedure X509_get0_pubkey()
  306.   }
  307.   
  308. > EVP_PKEY *X509_get0_pubkey(X509 *x)
  309.   {
  310.       if (x == NULL)

crypto/x509/x509_cmp.c:310:9: Taking false branch
  308.   EVP_PKEY *X509_get0_pubkey(X509 *x)
  309.   {
  310.       if (x == NULL)
                 ^
  311.           return NULL;
  312.       return X509_PUBKEY_get0(x->cert_info.key);

crypto/x509/x509_cmp.c:312:5: 
  310.       if (x == NULL)
  311.           return NULL;
  312. >     return X509_PUBKEY_get0(x->cert_info.key);
  313.   }
  314.   

crypto/asn1/x_pubkey.c:124:1: start of procedure X509_PUBKEY_get0()
    122.   }
    123.   
    124. > EVP_PKEY *X509_PUBKEY_get0(X509_PUBKEY *key)
    125.   {
    126.       EVP_PKEY *ret = NULL;

crypto/asn1/x_pubkey.c:126:5: 
    124.   EVP_PKEY *X509_PUBKEY_get0(X509_PUBKEY *key)
    125.   {
    126. >     EVP_PKEY *ret = NULL;
    127.   
    128.       if (key == NULL)

crypto/asn1/x_pubkey.c:128:9: Taking false branch
    126.       EVP_PKEY *ret = NULL;
    127.   
    128.       if (key == NULL)
                   ^
    129.           goto error;
    130.   

crypto/asn1/x_pubkey.c:131:9: Taking false branch
    129.           goto error;
    130.   
    131.       if (key->pkey != NULL)
                   ^
    132.           return key->pkey;
    133.   

crypto/asn1/x_pubkey.c:134:9: Taking true branch
    132.           return key->pkey;
    133.   
    134.       if (key->public_key == NULL)
                   ^
    135.           goto error;
    136.   

crypto/asn1/x_pubkey.c:170:2: 
    168.       return ret;
    169.   
    170. >  error:
    171.       EVP_PKEY_free(ret);
    172.       return (NULL);

crypto/asn1/x_pubkey.c:171:5: 
    169.   
    170.    error:
    171. >     EVP_PKEY_free(ret);
    172.       return (NULL);
    173.   }

crypto/evp/p_lib.c:420:1: start of procedure EVP_PKEY_free()
      418.   }
      419.   
      420. > void EVP_PKEY_free(EVP_PKEY *x)
      421.   {
      422.       int i;

crypto/evp/p_lib.c:424:9: Taking true branch
      422.       int i;
      423.   
      424.       if (x == NULL)
                     ^
      425.           return;
      426.   

crypto/evp/p_lib.c:425:9: 
      423.   
      424.       if (x == NULL)
      425. >         return;
      426.   
      427.       i = CRYPTO_add(&x->references, -1, CRYPTO_LOCK_EVP_PKEY);

crypto/evp/p_lib.c:442:1: return from a call to EVP_PKEY_free
      440.       sk_X509_ATTRIBUTE_pop_free(x->attributes, X509_ATTRIBUTE_free);
      441.       OPENSSL_free(x);
      442. > }
      443.   
      444.   static void EVP_PKEY_free_it(EVP_PKEY *x)

crypto/asn1/x_pubkey.c:172:5: 
    170.    error:
    171.       EVP_PKEY_free(ret);
    172. >     return (NULL);
    173.   }
    174.   

crypto/asn1/x_pubkey.c:173:1: return from a call to X509_PUBKEY_get0
    171.       EVP_PKEY_free(ret);
    172.       return (NULL);
    173. > }
    174.   
    175.   EVP_PKEY *X509_PUBKEY_get(X509_PUBKEY *key)

crypto/x509/x509_cmp.c:313:1: return from a call to X509_get0_pubkey
  311.           return NULL;
  312.       return X509_PUBKEY_get0(x->cert_info.key);
  313. > }
  314.   
  315.   EVP_PKEY *X509_get_pubkey(X509 *x)

ssl/statem/statem_srvr.c:2682:5: Skipping X509_certificate_type(): empty list of specs
2680.       peer = s->session->peer;
2681.       pkey = X509_get0_pubkey(peer);
2682.       type = X509_certificate_type(peer, pkey);
            ^
2683.   
2684.       if (!(type & EVP_PKT_SIGN)) {

ssl/statem/statem_srvr.c:2684:11: Taking false branch
2682.       type = X509_certificate_type(peer, pkey);
2683.   
2684.       if (!(type & EVP_PKT_SIGN)) {
                  ^
2685.           SSLerr(SSL_F_TLS_PROCESS_CERT_VERIFY,
2686.                  SSL_R_SIGNATURE_FOR_NON_SIGNING_CERTIFICATE);

ssl/statem/statem_srvr.c:2697:9: 
2695.        */
2696.   #ifndef OPENSSL_NO_GOST
2697. >     if (PACKET_remaining(pkt) == 64 && pkey->type == NID_id_GostR3410_2001) {
2698.           len = 64;
2699.       } else

ssl/packet_locl.h:91:1: start of procedure PACKET_remaining()
  89.    * Returns the number of bytes remaining to be read in the PACKET
  90.    */
  91. > static ossl_inline size_t PACKET_remaining(const PACKET *pkt)
  92.   {
  93.       return pkt->remaining;

ssl/packet_locl.h:93:5: 
  91.   static ossl_inline size_t PACKET_remaining(const PACKET *pkt)
  92.   {
  93. >     return pkt->remaining;
  94.   }
  95.   

ssl/packet_locl.h:94:1: return from a call to PACKET_remaining
  92.   {
  93.       return pkt->remaining;
  94. > }
  95.   
  96.   /*

ssl/statem/statem_srvr.c:2697:9: Taking true branch
2695.        */
2696.   #ifndef OPENSSL_NO_GOST
2697.       if (PACKET_remaining(pkt) == 64 && pkey->type == NID_id_GostR3410_2001) {
                ^
2698.           len = 64;
2699.       } else

ssl/statem/statem_srvr.c:2697:40: 
2695.        */
2696.   #ifndef OPENSSL_NO_GOST
2697. >     if (PACKET_remaining(pkt) == 64 && pkey->type == NID_id_GostR3410_2001) {
2698.           len = 64;
2699.       } else
