ssl/s3_clnt.c:820: error: NULL_DEREFERENCE
  pointer `pkey` last assigned on line 684 could be null and is dereferenced by call to `EVP_PKEY_free()` at line 820, column 2.
Showing all 51 steps of the trace


ssl/s3_clnt.c:676:1: start of procedure ssl3_get_server_certificate()
674.   	}
675.   
676. > static int ssl3_get_server_certificate(SSL *s)
677.   	{
678.   	int al,i,ok,ret= -1;

ssl/s3_clnt.c:678:2: 
676.   static int ssl3_get_server_certificate(SSL *s)
677.   	{
678. > 	int al,i,ok,ret= -1;
679.   	unsigned long n,nc,llen,l;
680.   	X509 *x=NULL;

ssl/s3_clnt.c:680:2: 
678.   	int al,i,ok,ret= -1;
679.   	unsigned long n,nc,llen,l;
680. > 	X509 *x=NULL;
681.   	unsigned char *p,*d,*q;
682.   	STACK_OF(X509) *sk=NULL;

ssl/s3_clnt.c:682:2: 
680.   	X509 *x=NULL;
681.   	unsigned char *p,*d,*q;
682. > 	STACK_OF(X509) *sk=NULL;
683.   	SESS_CERT *sc;
684.   	EVP_PKEY *pkey=NULL;

ssl/s3_clnt.c:684:2: 
682.   	STACK_OF(X509) *sk=NULL;
683.   	SESS_CERT *sc;
684. > 	EVP_PKEY *pkey=NULL;
685.   
686.   	n=ssl3_get_message(s,

ssl/s3_clnt.c:686:2: Skipping ssl3_get_message(): empty list of specs
684.   	EVP_PKEY *pkey=NULL;
685.   
686.   	n=ssl3_get_message(s,
        ^
687.   		SSL3_ST_CR_CERT_A,
688.   		SSL3_ST_CR_CERT_B,

ssl/s3_clnt.c:697:7: Taking false branch
695.   		&ok);
696.   
697.   	if (!ok) return((int)n);
             ^
698.   
699.   	if (s->s3->tmp.message_type == SSL3_MT_SERVER_KEY_EXCHANGE)

ssl/s3_clnt.c:699:6: Taking false branch
697.   	if (!ok) return((int)n);
698.   
699.   	if (s->s3->tmp.message_type == SSL3_MT_SERVER_KEY_EXCHANGE)
            ^
700.   		{
701.   		s->s3->tmp.reuse_message=1;

ssl/s3_clnt.c:705:6: Taking false branch
703.   		}
704.   
705.   	if (s->s3->tmp.message_type != SSL3_MT_CERTIFICATE)
            ^
706.   		{
707.   		al=SSL_AD_UNEXPECTED_MESSAGE;

ssl/s3_clnt.c:711:2: 
709.   		goto f_err;
710.   		}
711. > 	d=p=(unsigned char *)s->init_buf->data;
712.   
713.   	if ((sk=sk_X509_new_null()) == NULL)

ssl/s3_clnt.c:713:6: 
711.   	d=p=(unsigned char *)s->init_buf->data;
712.   
713. > 	if ((sk=sk_X509_new_null()) == NULL)
714.   		{
715.   		SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,ERR_R_MALLOC_FAILURE);

crypto/x509/x509_vfy.c:786:1: start of procedure sk_X509_new_null()
  784.   
  785.   
  786. > IMPLEMENT_STACK_OF(X509)
  787.   IMPLEMENT_ASN1_SET_OF(X509)
  788.   

crypto/x509/x509_vfy.c:786:1: return from a call to sk_X509_new_null
  784.   
  785.   
  786. > IMPLEMENT_STACK_OF(X509)
  787.   IMPLEMENT_ASN1_SET_OF(X509)
  788.   

ssl/s3_clnt.c:713:6: Taking false branch
711.   	d=p=(unsigned char *)s->init_buf->data;
712.   
713.   	if ((sk=sk_X509_new_null()) == NULL)
            ^
714.   		{
715.   		SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,ERR_R_MALLOC_FAILURE);

ssl/s3_clnt.c:719:2: 
717.   		}
718.   
719. > 	n2l3(p,llen);
720.   	if (llen+3 != n)
721.   		{

ssl/s3_clnt.c:720:6: Taking false branch
718.   
719.   	n2l3(p,llen);
720.   	if (llen+3 != n)
            ^
721.   		{
722.   		al=SSL_AD_DECODE_ERROR;

ssl/s3_clnt.c:726:7: 
724.   		goto f_err;
725.   		}
726. > 	for (nc=0; nc<llen; )
727.   		{
728.   		n2l3(p,l);

ssl/s3_clnt.c:726:13: Loop condition is true. Entering loop body
724.   		goto f_err;
725.   		}
726.   	for (nc=0; nc<llen; )
                   ^
727.   		{
728.   		n2l3(p,l);

ssl/s3_clnt.c:728:3: 
726.   	for (nc=0; nc<llen; )
727.   		{
728. > 		n2l3(p,l);
729.   		if ((l+nc+3) > llen)
730.   			{

ssl/s3_clnt.c:729:7: Taking false branch
727.   		{
728.   		n2l3(p,l);
729.   		if ((l+nc+3) > llen)
             ^
730.   			{
731.   			al=SSL_AD_DECODE_ERROR;

ssl/s3_clnt.c:736:3: 
734.   			}
735.   
736. > 		q=p;
737.   		x=d2i_X509(NULL,&q,l);
738.   		if (x == NULL)

ssl/s3_clnt.c:737:3: Skipping d2i_X509(): empty list of specs
735.   
736.   		q=p;
737.   		x=d2i_X509(NULL,&q,l);
         ^
738.   		if (x == NULL)
739.   			{

ssl/s3_clnt.c:738:7: Taking false branch
736.   		q=p;
737.   		x=d2i_X509(NULL,&q,l);
738.   		if (x == NULL)
             ^
739.   			{
740.   			al=SSL_AD_BAD_CERTIFICATE;

ssl/s3_clnt.c:744:7: Taking false branch
742.   			goto f_err;
743.   			}
744.   		if (q != (p+l))
             ^
745.   			{
746.   			al=SSL_AD_DECODE_ERROR;

ssl/s3_clnt.c:750:8: 
748.   			goto f_err;
749.   			}
750. > 		if (!sk_X509_push(sk,x))
751.   			{
752.   			SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,ERR_R_MALLOC_FAILURE);

crypto/x509/x509_vfy.c:786:1: start of procedure sk_X509_push()
  784.   
  785.   
  786. > IMPLEMENT_STACK_OF(X509)
  787.   IMPLEMENT_ASN1_SET_OF(X509)
  788.   

crypto/stack/stack.c:233:1: start of procedure sk_push()
    231.   	}
    232.   
    233. > int sk_push(STACK *st, char *data)
    234.   	{
    235.   	return(sk_insert(st,data,st->num));

crypto/stack/stack.c:235:2: Skipping sk_insert(): empty list of specs
    233.   int sk_push(STACK *st, char *data)
    234.   	{
    235.   	return(sk_insert(st,data,st->num));
            ^
    236.   	}
    237.   

crypto/stack/stack.c:236:2: return from a call to sk_push
    234.   	{
    235.   	return(sk_insert(st,data,st->num));
    236.   	}
            ^
    237.   
    238.   int sk_unshift(STACK *st, char *data)

crypto/x509/x509_vfy.c:786:1: return from a call to sk_X509_push
  784.   
  785.   
  786. > IMPLEMENT_STACK_OF(X509)
  787.   IMPLEMENT_ASN1_SET_OF(X509)
  788.   

ssl/s3_clnt.c:750:8: Taking true branch
748.   			goto f_err;
749.   			}
750.   		if (!sk_X509_push(sk,x))
              ^
751.   			{
752.   			SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,ERR_R_MALLOC_FAILURE);

ssl/s3_clnt.c:752:4: 
750.   		if (!sk_X509_push(sk,x))
751.   			{
752. > 			SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,ERR_R_MALLOC_FAILURE);
753.   			goto err;
754.   			}

crypto/err/err.c:245:1: start of procedure ERR_put_error()
  243.   /********************************************************/
  244.   
  245. > void ERR_put_error(int lib, int func, int reason, const char *file,
  246.   	     int line)
  247.   	{

crypto/err/err.c:269:2: Skipping ERR_get_state(): empty list of specs
  267.   	}
  268.   #endif
  269.   	es=ERR_get_state();
          ^
  270.   
  271.   	es->top=(es->top+1)%ERR_NUM_ERRORS;

crypto/err/err.c:271:2: 
  269.   	es=ERR_get_state();
  270.   
  271. > 	es->top=(es->top+1)%ERR_NUM_ERRORS;
  272.   	if (es->top == es->bottom)
  273.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;

crypto/err/err.c:272:6: Taking false branch
  270.   
  271.   	es->top=(es->top+1)%ERR_NUM_ERRORS;
  272.   	if (es->top == es->bottom)
              ^
  273.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
  274.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);

crypto/err/err.c:274:2: 
  272.   	if (es->top == es->bottom)
  273.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
  274. > 	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
  275.   	es->err_file[es->top]=file;
  276.   	es->err_line[es->top]=line;

crypto/err/err.c:275:2: 
  273.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
  274.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
  275. > 	es->err_file[es->top]=file;
  276.   	es->err_line[es->top]=line;
  277.   	err_clear_data(es,es->top);

crypto/err/err.c:276:2: 
  274.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
  275.   	es->err_file[es->top]=file;
  276. > 	es->err_line[es->top]=line;
  277.   	err_clear_data(es,es->top);
  278.   	}

crypto/err/err.c:277:2: Taking true branch
  275.   	es->err_file[es->top]=file;
  276.   	es->err_line[es->top]=line;
  277.   	err_clear_data(es,es->top);
          ^
  278.   	}
  279.   

crypto/err/err.c:277:2: Taking false branch
  275.   	es->err_file[es->top]=file;
  276.   	es->err_line[es->top]=line;
  277.   	err_clear_data(es,es->top);
          ^
  278.   	}
  279.   

crypto/err/err.c:278:2: return from a call to ERR_put_error
  276.   	es->err_line[es->top]=line;
  277.   	err_clear_data(es,es->top);
  278.   	}
          ^
  279.   
  280.   void ERR_clear_error(void)

ssl/s3_clnt.c:819:1: 
817.   		ssl3_send_alert(s,SSL3_AL_FATAL,al);
818.   		}
819. > err:
820.   	EVP_PKEY_free(pkey);
821.   	X509_free(x);

ssl/s3_clnt.c:820:2: 
818.   		}
819.   err:
820. > 	EVP_PKEY_free(pkey);
821.   	X509_free(x);
822.   	sk_X509_pop_free(sk,X509_free);

crypto/evp/p_lib.c:286:1: start of procedure EVP_PKEY_free()
  284.   	}
  285.   
  286. > void EVP_PKEY_free(EVP_PKEY *x)
  287.   	{
  288.   	int i;

crypto/evp/p_lib.c:290:6: Taking false branch
  288.   	int i;
  289.   
  290.   	if (x == NULL) return;
              ^
  291.   
  292.   	i=CRYPTO_add(&x->references,-1,CRYPTO_LOCK_EVP_PKEY);

crypto/evp/p_lib.c:292:2: 
  290.   	if (x == NULL) return;
  291.   
  292. > 	i=CRYPTO_add(&x->references,-1,CRYPTO_LOCK_EVP_PKEY);
  293.   #ifdef REF_PRINT
  294.   	REF_PRINT("EVP_PKEY",x);

crypto/cryptlib.c:226:1: start of procedure CRYPTO_add_lock()
    224.   	}
    225.   
    226. > int CRYPTO_add_lock(int *pointer, int amount, int type, const char *file,
    227.   	     int line)
    228.   	{

crypto/cryptlib.c:231:6: Taking true branch
    229.   	int ret;
    230.   
    231.   	if (add_lock_callback != NULL)
                ^
    232.   		{
    233.   #ifdef LOCK_DEBUG

crypto/cryptlib.c:237:3: Skipping __function_pointer__(): unresolved function pointer
    235.   #endif
    236.   
    237.   		ret=add_lock_callback(pointer,amount,type,file,line);
             ^
    238.   #ifdef LOCK_DEBUG
    239.   		fprintf(stderr,"ladd:%08lx:%2d+%2d->%2d %-18s %s:%d\n",

crypto/cryptlib.c:245:3: 
    243.   			file,line);
    244.   #endif
    245. > 		*pointer=ret;
    246.   		}
    247.   	else
