ssl/ssl_rsa.c:198: error: NULL_DEREFERENCE
  pointer `pktmp` last assigned on line 196 could be null and is dereferenced by call to `EVP_PKEY_free()` at line 198, column 3.
Showing all 13 steps of the trace


ssl/ssl_rsa.c:182:1: start of procedure ssl_set_pkey()
180.   #endif
181.   
182. > static int ssl_set_pkey(CERT *c, EVP_PKEY *pkey)
183.   	{
184.   	int i,ok=0,bad=0;

ssl/ssl_rsa.c:184:2: 
182.   static int ssl_set_pkey(CERT *c, EVP_PKEY *pkey)
183.   	{
184. > 	int i,ok=0,bad=0;
185.   
186.   	i=ssl_cert_type(NULL,pkey);

ssl/ssl_rsa.c:186:2: Skipping ssl_cert_type(): empty list of specs
184.   	int i,ok=0,bad=0;
185.   
186.   	i=ssl_cert_type(NULL,pkey);
        ^
187.   	if (i < 0)
188.   		{

ssl/ssl_rsa.c:187:6: Taking false branch
185.   
186.   	i=ssl_cert_type(NULL,pkey);
187.   	if (i < 0)
            ^
188.   		{
189.   		SSLerr(SSL_F_SSL_SET_PKEY,SSL_R_UNKNOWN_CERTIFICATE_TYPE);

ssl/ssl_rsa.c:193:6: Taking true branch
191.   		}
192.   
193.   	if (c->pkeys[i].x509 != NULL)
            ^
194.   		{
195.   		EVP_PKEY *pktmp;

ssl/ssl_rsa.c:196:3: 
194.   		{
195.   		EVP_PKEY *pktmp;
196. > 		pktmp =	X509_get_pubkey(c->pkeys[i].x509);
197.   		EVP_PKEY_copy_parameters(pktmp,pkey);
198.   		EVP_PKEY_free(pktmp);

crypto/x509/x509_cmp.c:254:1: start of procedure X509_get_pubkey()
  252.   	}
  253.   
  254. > EVP_PKEY *X509_get_pubkey(X509 *x)
  255.   	{
  256.   	if ((x == NULL) || (x->cert_info == NULL))

crypto/x509/x509_cmp.c:256:7: Taking false branch
  254.   EVP_PKEY *X509_get_pubkey(X509 *x)
  255.   	{
  256.   	if ((x == NULL) || (x->cert_info == NULL))
               ^
  257.   		return(NULL);
  258.   	return(X509_PUBKEY_get(x->cert_info->key));

crypto/x509/x509_cmp.c:256:22: Taking true branch
  254.   EVP_PKEY *X509_get_pubkey(X509 *x)
  255.   	{
  256.   	if ((x == NULL) || (x->cert_info == NULL))
                              ^
  257.   		return(NULL);
  258.   	return(X509_PUBKEY_get(x->cert_info->key));

crypto/x509/x509_cmp.c:257:3: 
  255.   	{
  256.   	if ((x == NULL) || (x->cert_info == NULL))
  257. > 		return(NULL);
  258.   	return(X509_PUBKEY_get(x->cert_info->key));
  259.   	}

crypto/x509/x509_cmp.c:259:2: return from a call to X509_get_pubkey
  257.   		return(NULL);
  258.   	return(X509_PUBKEY_get(x->cert_info->key));
  259.   	}
          ^
  260.   
  261.   int X509_check_private_key(X509 *x, EVP_PKEY *k)

ssl/ssl_rsa.c:197:3: Skipping EVP_PKEY_copy_parameters(): empty list of specs
195.   		EVP_PKEY *pktmp;
196.   		pktmp =	X509_get_pubkey(c->pkeys[i].x509);
197.   		EVP_PKEY_copy_parameters(pktmp,pkey);
         ^
198.   		EVP_PKEY_free(pktmp);
199.   		ERR_clear_error();

ssl/ssl_rsa.c:198:3: 
196.   		pktmp =	X509_get_pubkey(c->pkeys[i].x509);
197.   		EVP_PKEY_copy_parameters(pktmp,pkey);
198. > 		EVP_PKEY_free(pktmp);
199.   		ERR_clear_error();
200.   
