ssl/s3_srvr.c:3138: error: NULL_DEREFERENCE
  pointer `pkey` last assigned on line 3090 could be null and is dereferenced at line 3138, column 16.
Showing all 27 steps of the trace


ssl/s3_srvr.c:3066:1: start of procedure ssl3_get_cert_verify()
3064.   	}
3065.   
3066. > int ssl3_get_cert_verify(SSL *s)
3067.   	{
3068.   	EVP_PKEY *pkey=NULL;

ssl/s3_srvr.c:3068:2: 
3066.   int ssl3_get_cert_verify(SSL *s)
3067.   	{
3068. > 	EVP_PKEY *pkey=NULL;
3069.   	unsigned char *p;
3070.   	int al,ok,ret=0;

ssl/s3_srvr.c:3070:2: 
3068.   	EVP_PKEY *pkey=NULL;
3069.   	unsigned char *p;
3070. > 	int al,ok,ret=0;
3071.   	long n;
3072.   	int type=0,i,j;

ssl/s3_srvr.c:3072:2: 
3070.   	int al,ok,ret=0;
3071.   	long n;
3072. > 	int type=0,i,j;
3073.   	X509 *peer;
3074.   	const EVP_MD *md = NULL;

ssl/s3_srvr.c:3074:2: 
3072.   	int type=0,i,j;
3073.   	X509 *peer;
3074. > 	const EVP_MD *md = NULL;
3075.   	EVP_MD_CTX mctx;
3076.   	EVP_MD_CTX_init(&mctx);

ssl/s3_srvr.c:3076:2: 
3074.   	const EVP_MD *md = NULL;
3075.   	EVP_MD_CTX mctx;
3076. > 	EVP_MD_CTX_init(&mctx);
3077.   
3078.   	n=s->method->ssl_get_message(s,

crypto/evp/digest.c:120:1: start of procedure EVP_MD_CTX_init()
  118.   #endif
  119.   
  120. > void EVP_MD_CTX_init(EVP_MD_CTX *ctx)
  121.   	{
  122.   	memset(ctx,'\0',sizeof *ctx);

crypto/evp/digest.c:122:2: 
  120.   void EVP_MD_CTX_init(EVP_MD_CTX *ctx)
  121.   	{
  122. > 	memset(ctx,'\0',sizeof *ctx);
  123.   	}
  124.   

crypto/evp/digest.c:123:2: return from a call to EVP_MD_CTX_init
  121.   	{
  122.   	memset(ctx,'\0',sizeof *ctx);
  123.   	}
          ^
  124.   
  125.   EVP_MD_CTX *EVP_MD_CTX_create(void)

ssl/s3_srvr.c:3078:2: Skipping __function_pointer__(): unresolved function pointer
3076.   	EVP_MD_CTX_init(&mctx);
3077.   
3078.   	n=s->method->ssl_get_message(s,
         ^
3079.   		SSL3_ST_SR_CERT_VRFY_A,
3080.   		SSL3_ST_SR_CERT_VRFY_B,

ssl/s3_srvr.c:3085:7: Taking false branch
3083.   		&ok);
3084.   
3085.   	if (!ok) return((int)n);
              ^
3086.   
3087.   	if (s->session->peer != NULL)

ssl/s3_srvr.c:3087:6: Taking true branch
3085.   	if (!ok) return((int)n);
3086.   
3087.   	if (s->session->peer != NULL)
             ^
3088.   		{
3089.   		peer=s->session->peer;

ssl/s3_srvr.c:3089:3: 
3087.   	if (s->session->peer != NULL)
3088.   		{
3089. > 		peer=s->session->peer;
3090.   		pkey=X509_get_pubkey(peer);
3091.   		type=X509_certificate_type(peer,pkey);

ssl/s3_srvr.c:3090:3: 
3088.   		{
3089.   		peer=s->session->peer;
3090. > 		pkey=X509_get_pubkey(peer);
3091.   		type=X509_certificate_type(peer,pkey);
3092.   		}

crypto/x509/x509_cmp.c:313:1: start of procedure X509_get_pubkey()
  311.   	}
  312.   
  313. > EVP_PKEY *X509_get_pubkey(X509 *x)
  314.   	{
  315.   	if ((x == NULL) || (x->cert_info == NULL))

crypto/x509/x509_cmp.c:315:7: Taking false branch
  313.   EVP_PKEY *X509_get_pubkey(X509 *x)
  314.   	{
  315.   	if ((x == NULL) || (x->cert_info == NULL))
               ^
  316.   		return(NULL);
  317.   	return(X509_PUBKEY_get(x->cert_info->key));

crypto/x509/x509_cmp.c:315:22: Taking true branch
  313.   EVP_PKEY *X509_get_pubkey(X509 *x)
  314.   	{
  315.   	if ((x == NULL) || (x->cert_info == NULL))
                              ^
  316.   		return(NULL);
  317.   	return(X509_PUBKEY_get(x->cert_info->key));

crypto/x509/x509_cmp.c:316:3: 
  314.   	{
  315.   	if ((x == NULL) || (x->cert_info == NULL))
  316. > 		return(NULL);
  317.   	return(X509_PUBKEY_get(x->cert_info->key));
  318.   	}

crypto/x509/x509_cmp.c:318:2: return from a call to X509_get_pubkey
  316.   		return(NULL);
  317.   	return(X509_PUBKEY_get(x->cert_info->key));
  318.   	}
          ^
  319.   
  320.   ASN1_BIT_STRING *X509_get0_pubkey_bitstr(const X509 *x)

ssl/s3_srvr.c:3091:3: Skipping X509_certificate_type(): empty list of specs
3089.   		peer=s->session->peer;
3090.   		pkey=X509_get_pubkey(peer);
3091.   		type=X509_certificate_type(peer,pkey);
          ^
3092.   		}
3093.   	else

ssl/s3_srvr.c:3099:6: Taking false branch
3097.   		}
3098.   
3099.   	if (s->s3->tmp.message_type != SSL3_MT_CERTIFICATE_VERIFY)
             ^
3100.   		{
3101.   		s->s3->tmp.reuse_message=1;

ssl/s3_srvr.c:3112:6: Taking false branch
3110.   		}
3111.   
3112.   	if (peer == NULL)
             ^
3113.   		{
3114.   		SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_NO_CLIENT_CERT_RECEIVED);

ssl/s3_srvr.c:3119:8: Taking false branch
3117.   		}
3118.   
3119.   	if (!(type & EVP_PKT_SIGN))
               ^
3120.   		{
3121.   		SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_SIGNATURE_FOR_NON_SIGNING_CERTIFICATE);

ssl/s3_srvr.c:3126:6: Taking false branch
3124.   		}
3125.   
3126.   	if (s->s3->change_cipher_spec)
             ^
3127.   		{
3128.   		SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_CCS_RECEIVED_EARLY);

ssl/s3_srvr.c:3134:2: 
3132.   
3133.   	/* we now have a signature that we need to verify */
3134. > 	p=(unsigned char *)s->init_msg;
3135.   	/* Check for broken implementations of GOST ciphersuites */
3136.   	/* If key is GOST and n is exactly 64, it is bare

ssl/s3_srvr.c:3138:6: Taking true branch
3136.   	/* If key is GOST and n is exactly 64, it is bare
3137.   	 * signature without length field */
3138.   	if (n==64 && (pkey->type==NID_id_GostR3410_94 ||
             ^
3139.   		pkey->type == NID_id_GostR3410_2001) )
3140.   		{

ssl/s3_srvr.c:3138:16: 
3136.   	/* If key is GOST and n is exactly 64, it is bare
3137.   	 * signature without length field */
3138. > 	if (n==64 && (pkey->type==NID_id_GostR3410_94 ||
3139.   		pkey->type == NID_id_GostR3410_2001) )
3140.   		{
