ssl/d1_srvr.c:1110: error: NULL_DEREFERENCE
  pointer `dh` last assigned on line 1033 could be null and is dereferenced by call to `DH_free()` at line 1110, column 5.
Showing all 27 steps of the trace


ssl/d1_srvr.c:1023:1: start of procedure dtls1_send_server_key_exchange()
1021.   	}
1022.   
1023. > int dtls1_send_server_key_exchange(SSL *s)
1024.   	{
1025.   #ifndef OPENSSL_NO_RSA

ssl/d1_srvr.c:1033:2: 
1031.   #endif
1032.   #ifndef OPENSSL_NO_DH
1033. > 	DH *dh=NULL,*dhp;
1034.   #endif
1035.   #ifndef OPENSSL_NO_ECDH

ssl/d1_srvr.c:1036:2: 
1034.   #endif
1035.   #ifndef OPENSSL_NO_ECDH
1036. > 	EC_KEY *ecdh=NULL, *ecdhp;
1037.   	unsigned char *encodedPoint = NULL;
1038.   	int encodedlen = 0;

ssl/d1_srvr.c:1037:2: 
1035.   #ifndef OPENSSL_NO_ECDH
1036.   	EC_KEY *ecdh=NULL, *ecdhp;
1037. > 	unsigned char *encodedPoint = NULL;
1038.   	int encodedlen = 0;
1039.   	int curve_id = 0;

ssl/d1_srvr.c:1038:2: 
1036.   	EC_KEY *ecdh=NULL, *ecdhp;
1037.   	unsigned char *encodedPoint = NULL;
1038. > 	int encodedlen = 0;
1039.   	int curve_id = 0;
1040.   	BN_CTX *bn_ctx = NULL; 

ssl/d1_srvr.c:1039:2: 
1037.   	unsigned char *encodedPoint = NULL;
1038.   	int encodedlen = 0;
1039. > 	int curve_id = 0;
1040.   	BN_CTX *bn_ctx = NULL; 
1041.   #endif

ssl/d1_srvr.c:1040:2: 
1038.   	int encodedlen = 0;
1039.   	int curve_id = 0;
1040. > 	BN_CTX *bn_ctx = NULL; 
1041.   #endif
1042.   	EVP_PKEY *pkey;

ssl/d1_srvr.c:1053:2: 
1051.   	EVP_MD_CTX md_ctx;
1052.   
1053. > 	EVP_MD_CTX_init(&md_ctx);
1054.   	if (s->state == SSL3_ST_SW_KEY_EXCH_A)
1055.   		{

crypto/evp/digest.c:120:1: start of procedure EVP_MD_CTX_init()
  118.   #endif
  119.   
  120. > void EVP_MD_CTX_init(EVP_MD_CTX *ctx)
  121.   	{
  122.   	memset(ctx,'\0',sizeof *ctx);

crypto/evp/digest.c:122:2: 
  120.   void EVP_MD_CTX_init(EVP_MD_CTX *ctx)
  121.   	{
  122. > 	memset(ctx,'\0',sizeof *ctx);
  123.   	}
  124.   

crypto/evp/digest.c:123:2: return from a call to EVP_MD_CTX_init
  121.   	{
  122.   	memset(ctx,'\0',sizeof *ctx);
  123.   	}
          ^
  124.   
  125.   EVP_MD_CTX *EVP_MD_CTX_create(void)

ssl/d1_srvr.c:1054:6: Taking true branch
1052.   
1053.   	EVP_MD_CTX_init(&md_ctx);
1054.   	if (s->state == SSL3_ST_SW_KEY_EXCH_A)
             ^
1055.   		{
1056.   		type=s->s3->tmp.new_cipher->algorithm_mkey;

ssl/d1_srvr.c:1056:3: 
1054.   	if (s->state == SSL3_ST_SW_KEY_EXCH_A)
1055.   		{
1056. > 		type=s->s3->tmp.new_cipher->algorithm_mkey;
1057.   		cert=s->cert;
1058.   

ssl/d1_srvr.c:1057:3: 
1055.   		{
1056.   		type=s->s3->tmp.new_cipher->algorithm_mkey;
1057. > 		cert=s->cert;
1058.   
1059.   		buf=s->init_buf;

ssl/d1_srvr.c:1059:3: 
1057.   		cert=s->cert;
1058.   
1059. > 		buf=s->init_buf;
1060.   
1061.   		r[0]=r[1]=r[2]=r[3]=NULL;

ssl/d1_srvr.c:1061:3: 
1059.   		buf=s->init_buf;
1060.   
1061. > 		r[0]=r[1]=r[2]=r[3]=NULL;
1062.   		n=0;
1063.   #ifndef OPENSSL_NO_RSA

ssl/d1_srvr.c:1062:3: 
1060.   
1061.   		r[0]=r[1]=r[2]=r[3]=NULL;
1062. > 		n=0;
1063.   #ifndef OPENSSL_NO_RSA
1064.   		if (type & SSL_kRSA)

ssl/d1_srvr.c:1064:7: Taking false branch
1062.   		n=0;
1063.   #ifndef OPENSSL_NO_RSA
1064.   		if (type & SSL_kRSA)
              ^
1065.   			{
1066.   			rsa=cert->rsa_tmp;

ssl/d1_srvr.c:1094:8: Taking true branch
1092.   #endif
1093.   #ifndef OPENSSL_NO_DH
1094.   			if (type & SSL_kEDH)
               ^
1095.   			{
1096.   			dhp=cert->dh_tmp;

ssl/d1_srvr.c:1096:4: 
1094.   			if (type & SSL_kEDH)
1095.   			{
1096. > 			dhp=cert->dh_tmp;
1097.   			if ((dhp == NULL) && (s->cert->dh_tmp_cb != NULL))
1098.   				dhp=s->cert->dh_tmp_cb(s,

ssl/d1_srvr.c:1097:9: Taking true branch
1095.   			{
1096.   			dhp=cert->dh_tmp;
1097.   			if ((dhp == NULL) && (s->cert->dh_tmp_cb != NULL))
                ^
1098.   				dhp=s->cert->dh_tmp_cb(s,
1099.   				      SSL_C_IS_EXPORT(s->s3->tmp.new_cipher),

ssl/d1_srvr.c:1097:26: Taking true branch
1095.   			{
1096.   			dhp=cert->dh_tmp;
1097.   			if ((dhp == NULL) && (s->cert->dh_tmp_cb != NULL))
                                 ^
1098.   				dhp=s->cert->dh_tmp_cb(s,
1099.   				      SSL_C_IS_EXPORT(s->s3->tmp.new_cipher),

ssl/d1_srvr.c:1100:11: Condition is false
1098.   				dhp=s->cert->dh_tmp_cb(s,
1099.   				      SSL_C_IS_EXPORT(s->s3->tmp.new_cipher),
1100.   				      SSL_C_EXPORT_PKEYLENGTH(s->s3->tmp.new_cipher));
                  ^
1101.   			if (dhp == NULL)
1102.   				{

ssl/d1_srvr.c:1098:5: Skipping __function_pointer__(): unresolved function pointer
1096.   			dhp=cert->dh_tmp;
1097.   			if ((dhp == NULL) && (s->cert->dh_tmp_cb != NULL))
1098.   				dhp=s->cert->dh_tmp_cb(s,
            ^
1099.   				      SSL_C_IS_EXPORT(s->s3->tmp.new_cipher),
1100.   				      SSL_C_EXPORT_PKEYLENGTH(s->s3->tmp.new_cipher));

ssl/d1_srvr.c:1101:8: Taking false branch
1099.   				      SSL_C_IS_EXPORT(s->s3->tmp.new_cipher),
1100.   				      SSL_C_EXPORT_PKEYLENGTH(s->s3->tmp.new_cipher));
1101.   			if (dhp == NULL)
               ^
1102.   				{
1103.   				al=SSL_AD_HANDSHAKE_FAILURE;

ssl/d1_srvr.c:1108:8: Taking true branch
1106.   				}
1107.   
1108.   			if (s->s3->tmp.dh != NULL)
               ^
1109.   				{
1110.   				DH_free(dh);

ssl/d1_srvr.c:1110:5: 
1108.   			if (s->s3->tmp.dh != NULL)
1109.   				{
1110. > 				DH_free(dh);
1111.   				SSLerr(SSL_F_DTLS1_SEND_SERVER_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR);
1112.   				goto err;
