ssl/s3_srvr.c:2819: error: NULL_DEREFERENCE
  pointer `pkey` last assigned on line 2798 could be null and is dereferenced at line 2819, column 20.
Showing all 30 steps of the trace


ssl/s3_srvr.c:2761:1: start of procedure ssl3_get_cert_verify()
2759.   }
2760.   
2761. > int ssl3_get_cert_verify(SSL *s)
2762.   {
2763.       EVP_PKEY *pkey = NULL;

ssl/s3_srvr.c:2763:5: 
2761.   int ssl3_get_cert_verify(SSL *s)
2762.   {
2763. >     EVP_PKEY *pkey = NULL;
2764.       unsigned char *sig, *data;
2765.       int al, ok, ret = 0;

ssl/s3_srvr.c:2765:5: 
2763.       EVP_PKEY *pkey = NULL;
2764.       unsigned char *sig, *data;
2765. >     int al, ok, ret = 0;
2766.       long n;
2767.       int type = 0, i, j;

ssl/s3_srvr.c:2767:5: 
2765.       int al, ok, ret = 0;
2766.       long n;
2767. >     int type = 0, i, j;
2768.       unsigned int len;
2769.       X509 *peer;

ssl/s3_srvr.c:2770:5: 
2768.       unsigned int len;
2769.       X509 *peer;
2770. >     const EVP_MD *md = NULL;
2771.       EVP_MD_CTX mctx;
2772.       PACKET pkt;

ssl/s3_srvr.c:2773:5: 
2771.       EVP_MD_CTX mctx;
2772.       PACKET pkt;
2773. >     EVP_MD_CTX_init(&mctx);
2774.   
2775.       /*

crypto/evp/digest.c:120:1: start of procedure EVP_MD_CTX_init()
  118.   #endif
  119.   
  120. > void EVP_MD_CTX_init(EVP_MD_CTX *ctx)
  121.   {
  122.       memset(ctx, 0, sizeof(*ctx));

crypto/evp/digest.c:122:5: 
  120.   void EVP_MD_CTX_init(EVP_MD_CTX *ctx)
  121.   {
  122. >     memset(ctx, 0, sizeof(*ctx));
  123.   }
  124.   

crypto/evp/digest.c:123:1: return from a call to EVP_MD_CTX_init
  121.   {
  122.       memset(ctx, 0, sizeof(*ctx));
  123. > }
  124.   
  125.   EVP_MD_CTX *EVP_MD_CTX_create(void)

ssl/s3_srvr.c:2783:9: Taking false branch
2781.        * CertificateVerify state so we should not arrive here.
2782.        */
2783.       if (s->session->peer == NULL) {
                ^
2784.           ret = 1;
2785.           goto end;

ssl/s3_srvr.c:2788:5: Skipping __function_pointer__(): unresolved function pointer
2786.       }
2787.   
2788.       n = s->method->ssl_get_message(s,
            ^
2789.                                      SSL3_ST_SR_CERT_VRFY_A,
2790.                                      SSL3_ST_SR_CERT_VRFY_B,

ssl/s3_srvr.c:2794:10: Taking false branch
2792.                                      SSL3_RT_MAX_PLAIN_LENGTH, &ok);
2793.   
2794.       if (!ok)
                 ^
2795.           return ((int)n);
2796.   

ssl/s3_srvr.c:2797:5: 
2795.           return ((int)n);
2796.   
2797. >     peer = s->session->peer;
2798.       pkey = X509_get_pubkey(peer);
2799.       type = X509_certificate_type(peer, pkey);

ssl/s3_srvr.c:2798:5: 
2796.   
2797.       peer = s->session->peer;
2798. >     pkey = X509_get_pubkey(peer);
2799.       type = X509_certificate_type(peer, pkey);
2800.   

crypto/x509/x509_cmp.c:305:1: start of procedure X509_get_pubkey()
  303.   }
  304.   
  305. > EVP_PKEY *X509_get_pubkey(X509 *x)
  306.   {
  307.       if (x == NULL)

crypto/x509/x509_cmp.c:307:9: Taking true branch
  305.   EVP_PKEY *X509_get_pubkey(X509 *x)
  306.   {
  307.       if (x == NULL)
                 ^
  308.           return (NULL);
  309.       return (X509_PUBKEY_get(x->cert_info.key));

crypto/x509/x509_cmp.c:308:9: 
  306.   {
  307.       if (x == NULL)
  308. >         return (NULL);
  309.       return (X509_PUBKEY_get(x->cert_info.key));
  310.   }

crypto/x509/x509_cmp.c:310:1: return from a call to X509_get_pubkey
  308.           return (NULL);
  309.       return (X509_PUBKEY_get(x->cert_info.key));
  310. > }
  311.   
  312.   ASN1_BIT_STRING *X509_get0_pubkey_bitstr(const X509 *x)

ssl/s3_srvr.c:2799:5: Skipping X509_certificate_type(): empty list of specs
2797.       peer = s->session->peer;
2798.       pkey = X509_get_pubkey(peer);
2799.       type = X509_certificate_type(peer, pkey);
            ^
2800.   
2801.       if (!(type & EVP_PKT_SIGN)) {

ssl/s3_srvr.c:2801:11: Taking false branch
2799.       type = X509_certificate_type(peer, pkey);
2800.   
2801.       if (!(type & EVP_PKT_SIGN)) {
                  ^
2802.           SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,
2803.                  SSL_R_SIGNATURE_FOR_NON_SIGNING_CERTIFICATE);

ssl/s3_srvr.c:2809:10: 
2807.   
2808.       /* we now have a signature that we need to verify */
2809. >     if (!PACKET_buf_init(&pkt, s->init_msg, n)) {
2810.           SSLerr(SSL_F_SSL3_GET_CERT_VERIFY, ERR_R_INTERNAL_ERROR);
2811.           al = SSL_AD_INTERNAL_ERROR;

ssl/packet_locl.h:110:8: start of procedure PACKET_buf_init()
  108.    * is being used.
  109.    */
  110.   __owur static inline int PACKET_buf_init(PACKET *pkt, unsigned char *buf,
                ^
  111.                                            size_t len)
  112.   {

ssl/packet_locl.h:114:9: Taking false branch
  112.   {
  113.       /* Sanity check for negative values. */
  114.       if (len > (size_t)(SIZE_MAX / 2))
                 ^
  115.           return 0;
  116.   

ssl/packet_locl.h:117:5: 
  115.           return 0;
  116.   
  117. >     pkt->curr = buf;
  118.       pkt->remaining = len;
  119.       return 1;

ssl/packet_locl.h:118:5: 
  116.   
  117.       pkt->curr = buf;
  118. >     pkt->remaining = len;
  119.       return 1;
  120.   }

ssl/packet_locl.h:119:5: 
  117.       pkt->curr = buf;
  118.       pkt->remaining = len;
  119. >     return 1;
  120.   }
  121.   

ssl/packet_locl.h:120:1: return from a call to PACKET_buf_init
  118.       pkt->remaining = len;
  119.       return 1;
  120. > }
  121.   
  122.   /* Initialize a PACKET to hold zero bytes. */

ssl/s3_srvr.c:2809:10: Taking false branch
2807.   
2808.       /* we now have a signature that we need to verify */
2809.       if (!PACKET_buf_init(&pkt, s->init_msg, n)) {
                 ^
2810.           SSLerr(SSL_F_SSL3_GET_CERT_VERIFY, ERR_R_INTERNAL_ERROR);
2811.           al = SSL_AD_INTERNAL_ERROR;

ssl/s3_srvr.c:2819:9: Taking true branch
2817.        * length field
2818.        */
2819.       if (n == 64 && pkey->type == NID_id_GostR3410_2001) {
                ^
2820.           len = 64;
2821.       } else {

ssl/s3_srvr.c:2819:20: 
2817.        * length field
2818.        */
2819. >     if (n == 64 && pkey->type == NID_id_GostR3410_2001) {
2820.           len = 64;
2821.       } else {
