crypto/x509/x509_req.c:88: error: NULL_DEREFERENCE
  pointer `xk` last assigned on line 87 could be null and is dereferenced by call to `EVP_PKEY_cmp()` at line 88, column 13.
Showing all 31 steps of the trace


crypto/x509/x509_req.c:82:1: start of procedure X509_REQ_check_private_key()
80.   }
81.   
82. > int X509_REQ_check_private_key(X509_REQ *x, EVP_PKEY *k)
83.   {
84.       EVP_PKEY *xk = NULL;

crypto/x509/x509_req.c:84:5: 
82.   int X509_REQ_check_private_key(X509_REQ *x, EVP_PKEY *k)
83.   {
84. >     EVP_PKEY *xk = NULL;
85.       int ok = 0;
86.   

crypto/x509/x509_req.c:85:5: 
83.   {
84.       EVP_PKEY *xk = NULL;
85. >     int ok = 0;
86.   
87.       xk = X509_REQ_get_pubkey(x);

crypto/x509/x509_req.c:87:5: 
85.       int ok = 0;
86.   
87. >     xk = X509_REQ_get_pubkey(x);
88.       switch (EVP_PKEY_cmp(xk, k)) {
89.       case 1:

crypto/x509/x509_req.c:63:1: start of procedure X509_REQ_get_pubkey()
  61.   }
  62.   
  63. > EVP_PKEY *X509_REQ_get_pubkey(X509_REQ *req)
  64.   {
  65.       if (req == NULL)

crypto/x509/x509_req.c:65:9: Taking false branch
  63.   EVP_PKEY *X509_REQ_get_pubkey(X509_REQ *req)
  64.   {
  65.       if (req == NULL)
                ^
  66.           return NULL;
  67.       return X509_PUBKEY_get(req->req_info.pubkey);

crypto/x509/x509_req.c:67:5: 
  65.       if (req == NULL)
  66.           return NULL;
  67. >     return X509_PUBKEY_get(req->req_info.pubkey);
  68.   }
  69.   

crypto/x509/x_pubkey.c:168:1: start of procedure X509_PUBKEY_get()
    166.   }
    167.   
    168. > EVP_PKEY *X509_PUBKEY_get(X509_PUBKEY *key)
    169.   {
    170.       EVP_PKEY *ret = X509_PUBKEY_get0(key);

crypto/x509/x_pubkey.c:170:5: 
    168.   EVP_PKEY *X509_PUBKEY_get(X509_PUBKEY *key)
    169.   {
    170. >     EVP_PKEY *ret = X509_PUBKEY_get0(key);
    171.       if (ret != NULL)
    172.           EVP_PKEY_up_ref(ret);

crypto/x509/x_pubkey.c:140:1: start of procedure X509_PUBKEY_get0()
      138.   }
      139.   
      140. > EVP_PKEY *X509_PUBKEY_get0(X509_PUBKEY *key)
      141.   {
      142.       EVP_PKEY *ret = NULL;

crypto/x509/x_pubkey.c:142:5: 
      140.   EVP_PKEY *X509_PUBKEY_get0(X509_PUBKEY *key)
      141.   {
      142. >     EVP_PKEY *ret = NULL;
      143.   
      144.       if (key == NULL || key->public_key == NULL)

crypto/x509/x_pubkey.c:144:9: Taking false branch
      142.       EVP_PKEY *ret = NULL;
      143.   
      144.       if (key == NULL || key->public_key == NULL)
                     ^
      145.           return NULL;
      146.   

crypto/x509/x_pubkey.c:144:24: Taking false branch
      142.       EVP_PKEY *ret = NULL;
      143.   
      144.       if (key == NULL || key->public_key == NULL)
                                    ^
      145.           return NULL;
      146.   

crypto/x509/x_pubkey.c:147:9: Taking false branch
      145.           return NULL;
      146.   
      147.       if (key->pkey != NULL)
                     ^
      148.           return key->pkey;
      149.   

crypto/x509/x_pubkey.c:158:5: 
      156.        * in the queue.
      157.        */
      158. >     x509_pubkey_decode(&ret, key);
      159.       /* If decode doesn't fail something bad happened */
      160.       if (ret != NULL) {

crypto/x509/x_pubkey.c:103:1: start of procedure x509_pubkey_decode()
        101.   
        102.   
        103. > static int x509_pubkey_decode(EVP_PKEY **ppkey, X509_PUBKEY *key)
        104.   {
        105.       EVP_PKEY *pkey = EVP_PKEY_new();

crypto/x509/x_pubkey.c:105:5: Skipping EVP_PKEY_new(): empty list of specs
        103.   static int x509_pubkey_decode(EVP_PKEY **ppkey, X509_PUBKEY *key)
        104.   {
        105.       EVP_PKEY *pkey = EVP_PKEY_new();
                   ^
        106.   
        107.       if (pkey == NULL) {

crypto/x509/x_pubkey.c:107:9: Taking true branch
        105.       EVP_PKEY *pkey = EVP_PKEY_new();
        106.   
        107.       if (pkey == NULL) {
                       ^
        108.           X509err(X509_F_X509_PUBKEY_DECODE, ERR_R_MALLOC_FAILURE);
        109.           return -1;

crypto/x509/x_pubkey.c:108:9: Skipping ERR_put_error(): empty list of specs
        106.   
        107.       if (pkey == NULL) {
        108.           X509err(X509_F_X509_PUBKEY_DECODE, ERR_R_MALLOC_FAILURE);
                       ^
        109.           return -1;
        110.       }

crypto/x509/x_pubkey.c:109:9: 
        107.       if (pkey == NULL) {
        108.           X509err(X509_F_X509_PUBKEY_DECODE, ERR_R_MALLOC_FAILURE);
        109. >         return -1;
        110.       }
        111.   

crypto/x509/x_pubkey.c:138:1: return from a call to x509_pubkey_decode
        136.       EVP_PKEY_free(pkey);
        137.       return 0;
        138. > }
        139.   
        140.   EVP_PKEY *X509_PUBKEY_get0(X509_PUBKEY *key)

crypto/x509/x_pubkey.c:160:9: Taking false branch
      158.       x509_pubkey_decode(&ret, key);
      159.       /* If decode doesn't fail something bad happened */
      160.       if (ret != NULL) {
                     ^
      161.           X509err(X509_F_X509_PUBKEY_GET0, ERR_R_INTERNAL_ERROR);
      162.           EVP_PKEY_free(ret);

crypto/x509/x_pubkey.c:165:5: 
      163.       }
      164.   
      165. >     return NULL;
      166.   }
      167.   

crypto/x509/x_pubkey.c:166:1: return from a call to X509_PUBKEY_get0
      164.   
      165.       return NULL;
      166. > }
      167.   
      168.   EVP_PKEY *X509_PUBKEY_get(X509_PUBKEY *key)

crypto/x509/x_pubkey.c:171:9: Taking false branch
    169.   {
    170.       EVP_PKEY *ret = X509_PUBKEY_get0(key);
    171.       if (ret != NULL)
                   ^
    172.           EVP_PKEY_up_ref(ret);
    173.       return ret;

crypto/x509/x_pubkey.c:173:5: 
    171.       if (ret != NULL)
    172.           EVP_PKEY_up_ref(ret);
    173. >     return ret;
    174.   }
    175.   

crypto/x509/x_pubkey.c:174:1: return from a call to X509_PUBKEY_get
    172.           EVP_PKEY_up_ref(ret);
    173.       return ret;
    174. > }
    175.   
    176.   /*

crypto/x509/x509_req.c:68:1: return from a call to X509_REQ_get_pubkey
  66.           return NULL;
  67.       return X509_PUBKEY_get(req->req_info.pubkey);
  68. > }
  69.   
  70.   EVP_PKEY *X509_REQ_get0_pubkey(X509_REQ *req)

crypto/x509/x509_req.c:88:5: 
86.   
87.       xk = X509_REQ_get_pubkey(x);
88. >     switch (EVP_PKEY_cmp(xk, k)) {
89.       case 1:
90.           ok = 1;

crypto/evp/p_lib.c:119:1: start of procedure EVP_PKEY_cmp()
  117.   }
  118.   
  119. > int EVP_PKEY_cmp(const EVP_PKEY *a, const EVP_PKEY *b)
  120.   {
  121.       if (a->type != b->type)

crypto/evp/p_lib.c:121:9: 
  119.   int EVP_PKEY_cmp(const EVP_PKEY *a, const EVP_PKEY *b)
  120.   {
  121. >     if (a->type != b->type)
  122.           return -1;
  123.   
