ssl/statem/statem_clnt.c:2802: error: NULL_DEREFERENCE
  pointer `pkey` last assigned on line 2801 could be null and is dereferenced by call to `EVP_PKEY_get0_RSA()` at line 2802, column 9.
Showing all 46 steps of the trace


ssl/statem/statem_clnt.c:2783:1: start of procedure tls_construct_cke_rsa()
2781.   }
2782.   
2783. > static int tls_construct_cke_rsa(SSL *s, WPACKET *pkt, int *al)
2784.   {
2785.   #ifndef OPENSSL_NO_RSA

ssl/statem/statem_clnt.c:2786:5: 
2784.   {
2785.   #ifndef OPENSSL_NO_RSA
2786. >     unsigned char *encdata = NULL;
2787.       EVP_PKEY *pkey = NULL;
2788.       EVP_PKEY_CTX *pctx = NULL;

ssl/statem/statem_clnt.c:2787:5: 
2785.   #ifndef OPENSSL_NO_RSA
2786.       unsigned char *encdata = NULL;
2787. >     EVP_PKEY *pkey = NULL;
2788.       EVP_PKEY_CTX *pctx = NULL;
2789.       size_t enclen;

ssl/statem/statem_clnt.c:2788:5: 
2786.       unsigned char *encdata = NULL;
2787.       EVP_PKEY *pkey = NULL;
2788. >     EVP_PKEY_CTX *pctx = NULL;
2789.       size_t enclen;
2790.       unsigned char *pms = NULL;

ssl/statem/statem_clnt.c:2790:5: 
2788.       EVP_PKEY_CTX *pctx = NULL;
2789.       size_t enclen;
2790. >     unsigned char *pms = NULL;
2791.       size_t pmslen = 0;
2792.   

ssl/statem/statem_clnt.c:2791:5: 
2789.       size_t enclen;
2790.       unsigned char *pms = NULL;
2791. >     size_t pmslen = 0;
2792.   
2793.       if (s->session->peer == NULL) {

ssl/statem/statem_clnt.c:2793:9: Taking false branch
2791.       size_t pmslen = 0;
2792.   
2793.       if (s->session->peer == NULL) {
                ^
2794.           /*
2795.            * We should always have a server certificate with SSL_kRSA.

ssl/statem/statem_clnt.c:2801:5: 
2799.       }
2800.   
2801. >     pkey = X509_get0_pubkey(s->session->peer);
2802.       if (EVP_PKEY_get0_RSA(pkey) == NULL) {
2803.           SSLerr(SSL_F_TLS_CONSTRUCT_CKE_RSA, ERR_R_INTERNAL_ERROR);

crypto/x509/x509_cmp.c:265:1: start of procedure X509_get0_pubkey()
  263.   }
  264.   
  265. > EVP_PKEY *X509_get0_pubkey(const X509 *x)
  266.   {
  267.       if (x == NULL)

crypto/x509/x509_cmp.c:267:9: Taking false branch
  265.   EVP_PKEY *X509_get0_pubkey(const X509 *x)
  266.   {
  267.       if (x == NULL)
                 ^
  268.           return NULL;
  269.       return X509_PUBKEY_get0(x->cert_info.key);

crypto/x509/x509_cmp.c:269:5: 
  267.       if (x == NULL)
  268.           return NULL;
  269. >     return X509_PUBKEY_get0(x->cert_info.key);
  270.   }
  271.   

crypto/x509/x_pubkey.c:140:1: start of procedure X509_PUBKEY_get0()
    138.   }
    139.   
    140. > EVP_PKEY *X509_PUBKEY_get0(X509_PUBKEY *key)
    141.   {
    142.       EVP_PKEY *ret = NULL;

crypto/x509/x_pubkey.c:142:5: 
    140.   EVP_PKEY *X509_PUBKEY_get0(X509_PUBKEY *key)
    141.   {
    142. >     EVP_PKEY *ret = NULL;
    143.   
    144.       if (key == NULL || key->public_key == NULL)

crypto/x509/x_pubkey.c:144:9: Taking false branch
    142.       EVP_PKEY *ret = NULL;
    143.   
    144.       if (key == NULL || key->public_key == NULL)
                   ^
    145.           return NULL;
    146.   

crypto/x509/x_pubkey.c:144:24: Taking false branch
    142.       EVP_PKEY *ret = NULL;
    143.   
    144.       if (key == NULL || key->public_key == NULL)
                                  ^
    145.           return NULL;
    146.   

crypto/x509/x_pubkey.c:147:9: Taking false branch
    145.           return NULL;
    146.   
    147.       if (key->pkey != NULL)
                   ^
    148.           return key->pkey;
    149.   

crypto/x509/x_pubkey.c:158:5: 
    156.        * in the queue.
    157.        */
    158. >     x509_pubkey_decode(&ret, key);
    159.       /* If decode doesn't fail something bad happened */
    160.       if (ret != NULL) {

crypto/x509/x_pubkey.c:103:1: start of procedure x509_pubkey_decode()
      101.   
      102.   
      103. > static int x509_pubkey_decode(EVP_PKEY **ppkey, X509_PUBKEY *key)
      104.       {
      105.       EVP_PKEY *pkey = EVP_PKEY_new();

crypto/x509/x_pubkey.c:105:5: Skipping EVP_PKEY_new(): empty list of specs
      103.   static int x509_pubkey_decode(EVP_PKEY **ppkey, X509_PUBKEY *key)
      104.       {
      105.       EVP_PKEY *pkey = EVP_PKEY_new();
                 ^
      106.   
      107.       if (pkey == NULL) {

crypto/x509/x_pubkey.c:107:9: Taking true branch
      105.       EVP_PKEY *pkey = EVP_PKEY_new();
      106.   
      107.       if (pkey == NULL) {
                     ^
      108.           X509err(X509_F_X509_PUBKEY_DECODE, ERR_R_MALLOC_FAILURE);
      109.           return -1;

crypto/x509/x_pubkey.c:108:9: 
      106.   
      107.       if (pkey == NULL) {
      108. >         X509err(X509_F_X509_PUBKEY_DECODE, ERR_R_MALLOC_FAILURE);
      109.           return -1;
      110.       }

crypto/err/err.c:365:1: start of procedure ERR_put_error()
        363.   /********************************************************/
        364.   
        365. > void ERR_put_error(int lib, int func, int reason, const char *file, int line)
        366.   {
        367.       ERR_STATE *es;

crypto/err/err.c:388:5: 
        386.       }
        387.   #endif
        388. >     es = ERR_get_state();
        389.       if (es == NULL)
        390.           return;

crypto/err/err.c:679:1: start of procedure ERR_get_state()
          677.   }
          678.   
          679. > ERR_STATE *ERR_get_state(void)
          680.   {
          681.       ERR_STATE *state = NULL;

crypto/err/err.c:681:5: 
          679.   ERR_STATE *ERR_get_state(void)
          680.   {
          681. >     ERR_STATE *state = NULL;
          682.   
          683.       if (!RUN_ONCE(&err_init, err_do_init))

crypto/err/err.c:683:10: 
          681.       ERR_STATE *state = NULL;
          682.   
          683. >     if (!RUN_ONCE(&err_init, err_do_init))
          684.           return NULL;
          685.   

crypto/threads_pthread.c:105:1: start of procedure CRYPTO_THREAD_run_once()
            103.   }
            104.   
            105. > int CRYPTO_THREAD_run_once(CRYPTO_ONCE *once, void (*init)(void))
            106.   {
            107.       if (pthread_once(once, init) != 0)

crypto/threads_pthread.c:107:9: Taking true branch
            105.   int CRYPTO_THREAD_run_once(CRYPTO_ONCE *once, void (*init)(void))
            106.   {
            107.       if (pthread_once(once, init) != 0)
                           ^
            108.           return 0;
            109.   

crypto/threads_pthread.c:108:9: 
            106.   {
            107.       if (pthread_once(once, init) != 0)
            108. >         return 0;
            109.   
            110.       return 1;

crypto/threads_pthread.c:111:1: return from a call to CRYPTO_THREAD_run_once
            109.   
            110.       return 1;
            111. > }
            112.   
            113.   int CRYPTO_THREAD_init_local(CRYPTO_THREAD_LOCAL *key, void (*cleanup)(void *))

crypto/err/err.c:683:10: Condition is false
          681.       ERR_STATE *state = NULL;
          682.   
          683.       if (!RUN_ONCE(&err_init, err_do_init))
                          ^
          684.           return NULL;
          685.   

crypto/err/err.c:683:10: Taking true branch
          681.       ERR_STATE *state = NULL;
          682.   
          683.       if (!RUN_ONCE(&err_init, err_do_init))
                          ^
          684.           return NULL;
          685.   

crypto/err/err.c:684:9: 
          682.   
          683.       if (!RUN_ONCE(&err_init, err_do_init))
          684. >         return NULL;
          685.   
          686.       state = CRYPTO_THREAD_get_local(&err_thread_local);

crypto/err/err.c:704:1: return from a call to ERR_get_state
          702.   
          703.       return state;
          704. > }
          705.   
          706.   int ERR_get_next_error_library(void)

crypto/err/err.c:389:9: Taking true branch
        387.   #endif
        388.       es = ERR_get_state();
        389.       if (es == NULL)
                       ^
        390.           return;
        391.   

crypto/err/err.c:390:9: 
        388.       es = ERR_get_state();
        389.       if (es == NULL)
        390. >         return;
        391.   
        392.       es->top = (es->top + 1) % ERR_NUM_ERRORS;

crypto/err/err.c:400:1: return from a call to ERR_put_error
        398.       es->err_line[es->top] = line;
        399.       err_clear_data(es, es->top);
        400. > }
        401.   
        402.   void ERR_clear_error(void)

crypto/x509/x_pubkey.c:109:9: 
      107.       if (pkey == NULL) {
      108.           X509err(X509_F_X509_PUBKEY_DECODE, ERR_R_MALLOC_FAILURE);
      109. >         return -1;
      110.       }
      111.   

crypto/x509/x_pubkey.c:138:1: return from a call to x509_pubkey_decode
      136.       EVP_PKEY_free(pkey);
      137.       return 0;
      138. > }
      139.   
      140.   EVP_PKEY *X509_PUBKEY_get0(X509_PUBKEY *key)

crypto/x509/x_pubkey.c:160:9: Taking false branch
    158.       x509_pubkey_decode(&ret, key);
    159.       /* If decode doesn't fail something bad happened */
    160.       if (ret != NULL) {
                   ^
    161.           X509err(X509_F_X509_PUBKEY_GET0, ERR_R_INTERNAL_ERROR);
    162.           EVP_PKEY_free(ret);

crypto/x509/x_pubkey.c:165:5: 
    163.       }
    164.   
    165. >     return NULL;
    166.   }
    167.   

crypto/x509/x_pubkey.c:166:1: return from a call to X509_PUBKEY_get0
    164.   
    165.       return NULL;
    166. > }
    167.   
    168.   EVP_PKEY *X509_PUBKEY_get(X509_PUBKEY *key)

crypto/x509/x509_cmp.c:270:1: return from a call to X509_get0_pubkey
  268.           return NULL;
  269.       return X509_PUBKEY_get0(x->cert_info.key);
  270. > }
  271.   
  272.   EVP_PKEY *X509_get_pubkey(X509 *x)

ssl/statem/statem_clnt.c:2802:9: 
2800.   
2801.       pkey = X509_get0_pubkey(s->session->peer);
2802. >     if (EVP_PKEY_get0_RSA(pkey) == NULL) {
2803.           SSLerr(SSL_F_TLS_CONSTRUCT_CKE_RSA, ERR_R_INTERNAL_ERROR);
2804.           return 0;

crypto/evp/p_lib.c:290:1: start of procedure EVP_PKEY_get0_RSA()
  288.   }
  289.   
  290. > RSA *EVP_PKEY_get0_RSA(EVP_PKEY *pkey)
  291.   {
  292.       if (pkey->type != EVP_PKEY_RSA) {

crypto/evp/p_lib.c:292:9: 
  290.   RSA *EVP_PKEY_get0_RSA(EVP_PKEY *pkey)
  291.   {
  292. >     if (pkey->type != EVP_PKEY_RSA) {
  293.           EVPerr(EVP_F_EVP_PKEY_GET0_RSA, EVP_R_EXPECTING_AN_RSA_KEY);
  294.           return NULL;
