ssl/t1_lib.c:2365: error: NULL_DEREFERENCE
  pointer `ec` last assigned on line 2364 could be null and is dereferenced by call to `EC_KEY_get0_group()` at line 2365, column 53.
Showing all 29 steps of the trace


ssl/t1_lib.c:2296:1: start of procedure tls_choose_sigalg()
2294.    * to the server. In this case no error is set.
2295.    */
2296. > int tls_choose_sigalg(SSL *s, int *al)
2297.   {
2298.       const SIGALG_LOOKUP *lu = NULL;

ssl/t1_lib.c:2298:5: 
2296.   int tls_choose_sigalg(SSL *s, int *al)
2297.   {
2298. >     const SIGALG_LOOKUP *lu = NULL;
2299.   
2300.       s->s3->tmp.cert = NULL;

ssl/t1_lib.c:2300:5: 
2298.       const SIGALG_LOOKUP *lu = NULL;
2299.   
2300. >     s->s3->tmp.cert = NULL;
2301.       s->s3->tmp.sigalg = NULL;
2302.   

ssl/t1_lib.c:2301:5: 
2299.   
2300.       s->s3->tmp.cert = NULL;
2301. >     s->s3->tmp.sigalg = NULL;
2302.   
2303.       if (SSL_IS_TLS13(s)) {

ssl/t1_lib.c:2303:9: Taking false branch
2301.       s->s3->tmp.sigalg = NULL;
2302.   
2303.       if (SSL_IS_TLS13(s)) {
                ^
2304.           size_t i;
2305.   #ifndef OPENSSL_NO_EC

ssl/t1_lib.c:2351:15: Taking false branch
2349.       } else {
2350.           /* If ciphersuite doesn't require a cert nothing to do */
2351.           if (!(s->s3->tmp.new_cipher->algorithm_auth & SSL_aCERT))
                      ^
2352.               return 1;
2353.           if (!s->server && !ssl_has_cert(s, s->cert->key - s->cert->pkeys))

ssl/t1_lib.c:2353:14: Taking true branch
2351.           if (!(s->s3->tmp.new_cipher->algorithm_auth & SSL_aCERT))
2352.               return 1;
2353.           if (!s->server && !ssl_has_cert(s, s->cert->key - s->cert->pkeys))
                     ^
2354.                   return 1;
2355.   

ssl/t1_lib.c:2353:28: 
2351.           if (!(s->s3->tmp.new_cipher->algorithm_auth & SSL_aCERT))
2352.               return 1;
2353. >         if (!s->server && !ssl_has_cert(s, s->cert->key - s->cert->pkeys))
2354.                   return 1;
2355.   

ssl/ssl_locl.h:2069:1: start of procedure ssl_has_cert()
  2067.   
  2068.   /* Returns true if certificate and private key for 'idx' are present */
  2069. > static ossl_inline int ssl_has_cert(const SSL *s, int idx)
  2070.   {
  2071.       if (idx < 0 || idx >= SSL_PKEY_NUM)

ssl/ssl_locl.h:2071:9: Taking false branch
  2069.   static ossl_inline int ssl_has_cert(const SSL *s, int idx)
  2070.   {
  2071.       if (idx < 0 || idx >= SSL_PKEY_NUM)
                  ^
  2072.           return 0;
  2073.       return s->cert->pkeys[idx].x509 != NULL

ssl/ssl_locl.h:2071:20: Taking false branch
  2069.   static ossl_inline int ssl_has_cert(const SSL *s, int idx)
  2070.   {
  2071.       if (idx < 0 || idx >= SSL_PKEY_NUM)
                             ^
  2072.           return 0;
  2073.       return s->cert->pkeys[idx].x509 != NULL

ssl/ssl_locl.h:2073:12: Condition is true
  2071.       if (idx < 0 || idx >= SSL_PKEY_NUM)
  2072.           return 0;
  2073.       return s->cert->pkeys[idx].x509 != NULL
                     ^
  2074.           && s->cert->pkeys[idx].privatekey != NULL;
  2075.   }

ssl/ssl_locl.h:2074:12: Condition is true
  2072.           return 0;
  2073.       return s->cert->pkeys[idx].x509 != NULL
  2074.           && s->cert->pkeys[idx].privatekey != NULL;
                     ^
  2075.   }
  2076.   

ssl/ssl_locl.h:2073:12: 
  2071.       if (idx < 0 || idx >= SSL_PKEY_NUM)
  2072.           return 0;
  2073. >     return s->cert->pkeys[idx].x509 != NULL
  2074.           && s->cert->pkeys[idx].privatekey != NULL;
  2075.   }

ssl/ssl_locl.h:2073:5: 
  2071.       if (idx < 0 || idx >= SSL_PKEY_NUM)
  2072.           return 0;
  2073. >     return s->cert->pkeys[idx].x509 != NULL
  2074.           && s->cert->pkeys[idx].privatekey != NULL;
  2075.   }

ssl/ssl_locl.h:2075:1: return from a call to ssl_has_cert
  2073.       return s->cert->pkeys[idx].x509 != NULL
  2074.           && s->cert->pkeys[idx].privatekey != NULL;
  2075. > }
  2076.   
  2077.   # ifndef OPENSSL_UNIT_TEST

ssl/t1_lib.c:2353:28: Taking false branch
2351.           if (!(s->s3->tmp.new_cipher->algorithm_auth & SSL_aCERT))
2352.               return 1;
2353.           if (!s->server && !ssl_has_cert(s, s->cert->key - s->cert->pkeys))
                                   ^
2354.                   return 1;
2355.   

ssl/t1_lib.c:2356:13: Taking true branch
2354.                   return 1;
2355.   
2356.           if (SSL_USE_SIGALGS(s)) {
                    ^
2357.               if (s->s3->tmp.peer_sigalgs != NULL) {
2358.                   size_t i;

ssl/t1_lib.c:2357:17: Taking true branch
2355.   
2356.           if (SSL_USE_SIGALGS(s)) {
2357.               if (s->s3->tmp.peer_sigalgs != NULL) {
                        ^
2358.                   size_t i;
2359.   #ifndef OPENSSL_NO_EC

ssl/t1_lib.c:2363:21: Taking true branch
2361.   
2362.                   /* For Suite B need to match signature algorithm to curve */
2363.                   if (tls1_suiteb(s)) {
                            ^
2364.                       EC_KEY *ec = EVP_PKEY_get0_EC_KEY(s->cert->pkeys[SSL_PKEY_ECC].privatekey);
2365.                       curve = EC_GROUP_get_curve_name(EC_KEY_get0_group(ec));

ssl/t1_lib.c:2364:21: 
2362.                   /* For Suite B need to match signature algorithm to curve */
2363.                   if (tls1_suiteb(s)) {
2364. >                     EC_KEY *ec = EVP_PKEY_get0_EC_KEY(s->cert->pkeys[SSL_PKEY_ECC].privatekey);
2365.                       curve = EC_GROUP_get_curve_name(EC_KEY_get0_group(ec));
2366.                   } else {

crypto/evp/p_lib.c:346:1: start of procedure EVP_PKEY_get0_EC_KEY()
  344.   }
  345.   
  346. > EC_KEY *EVP_PKEY_get0_EC_KEY(EVP_PKEY *pkey)
  347.   {
  348.       if (pkey->type != EVP_PKEY_EC) {

crypto/evp/p_lib.c:348:9: Taking true branch
  346.   EC_KEY *EVP_PKEY_get0_EC_KEY(EVP_PKEY *pkey)
  347.   {
  348.       if (pkey->type != EVP_PKEY_EC) {
                 ^
  349.           EVPerr(EVP_F_EVP_PKEY_GET0_EC_KEY, EVP_R_EXPECTING_A_EC_KEY);
  350.           return NULL;

crypto/evp/p_lib.c:349:9: Skipping ERR_put_error(): empty list of specs
  347.   {
  348.       if (pkey->type != EVP_PKEY_EC) {
  349.           EVPerr(EVP_F_EVP_PKEY_GET0_EC_KEY, EVP_R_EXPECTING_A_EC_KEY);
                 ^
  350.           return NULL;
  351.       }

crypto/evp/p_lib.c:350:9: 
  348.       if (pkey->type != EVP_PKEY_EC) {
  349.           EVPerr(EVP_F_EVP_PKEY_GET0_EC_KEY, EVP_R_EXPECTING_A_EC_KEY);
  350. >         return NULL;
  351.       }
  352.       return pkey->pkey.ec;

crypto/evp/p_lib.c:353:1: return from a call to EVP_PKEY_get0_EC_KEY
  351.       }
  352.       return pkey->pkey.ec;
  353. > }
  354.   
  355.   EC_KEY *EVP_PKEY_get1_EC_KEY(EVP_PKEY *pkey)

ssl/t1_lib.c:2365:21: 
2363.                   if (tls1_suiteb(s)) {
2364.                       EC_KEY *ec = EVP_PKEY_get0_EC_KEY(s->cert->pkeys[SSL_PKEY_ECC].privatekey);
2365. >                     curve = EC_GROUP_get_curve_name(EC_KEY_get0_group(ec));
2366.                   } else {
2367.                       curve = -1;

crypto/ec/ec_key.c:419:1: start of procedure EC_KEY_get0_group()
  417.   }
  418.   
  419. > const EC_GROUP *EC_KEY_get0_group(const EC_KEY *key)
  420.   {
  421.       return key->group;

crypto/ec/ec_key.c:421:5: 
  419.   const EC_GROUP *EC_KEY_get0_group(const EC_KEY *key)
  420.   {
  421. >     return key->group;
  422.   }
  423.   
