ssl/t1_lib.c:4208: error: NULL_DEREFERENCE
  pointer `cpk` last assigned on line 4207 could be null and is dereferenced at line 4208, column 45.
Showing all 15 steps of the trace


ssl/t1_lib.c:4196:1: start of procedure ssl_get_auto_dh()
4194.   
4195.   #ifndef OPENSSL_NO_DH
4196. > DH *ssl_get_auto_dh(SSL *s)
4197.   {
4198.       int dh_secbits = 80;

ssl/t1_lib.c:4198:5: 
4196.   DH *ssl_get_auto_dh(SSL *s)
4197.   {
4198. >     int dh_secbits = 80;
4199.       if (s->cert->dh_tmp_auto == 2)
4200.           return DH_get_1024_160();

ssl/t1_lib.c:4199:9: Taking false branch
4197.   {
4198.       int dh_secbits = 80;
4199.       if (s->cert->dh_tmp_auto == 2)
                ^
4200.           return DH_get_1024_160();
4201.       if (s->s3->tmp.new_cipher->algorithm_auth & (SSL_aNULL | SSL_aPSK)) {

ssl/t1_lib.c:4201:9: Taking false branch
4199.       if (s->cert->dh_tmp_auto == 2)
4200.           return DH_get_1024_160();
4201.       if (s->s3->tmp.new_cipher->algorithm_auth & (SSL_aNULL | SSL_aPSK)) {
                ^
4202.           if (s->s3->tmp.new_cipher->strength_bits == 256)
4203.               dh_secbits = 128;

ssl/t1_lib.c:4207:9: 
4205.               dh_secbits = 80;
4206.       } else {
4207. >         CERT_PKEY *cpk = ssl_get_server_send_pkey(s);
4208.           dh_secbits = EVP_PKEY_security_bits(cpk->privatekey);
4209.       }

ssl/ssl_lib.c:2213:1: start of procedure ssl_get_server_send_pkey()
  2211.   }
  2212.   
  2213. > CERT_PKEY *ssl_get_server_send_pkey(SSL *s)
  2214.   {
  2215.       CERT *c;

ssl/ssl_lib.c:2218:5: 
  2216.       int i;
  2217.   
  2218. >     c = s->cert;
  2219.       if (!s->s3 || !s->s3->tmp.new_cipher)
  2220.           return NULL;

ssl/ssl_lib.c:2219:10: Taking false branch
  2217.   
  2218.       c = s->cert;
  2219.       if (!s->s3 || !s->s3->tmp.new_cipher)
                   ^
  2220.           return NULL;
  2221.       ssl_set_masks(s, s->s3->tmp.new_cipher);

ssl/ssl_lib.c:2219:20: Taking false branch
  2217.   
  2218.       c = s->cert;
  2219.       if (!s->s3 || !s->s3->tmp.new_cipher)
                             ^
  2220.           return NULL;
  2221.       ssl_set_masks(s, s->s3->tmp.new_cipher);

ssl/ssl_lib.c:2221:5: Skipping ssl_set_masks(): empty list of specs
  2219.       if (!s->s3 || !s->s3->tmp.new_cipher)
  2220.           return NULL;
  2221.       ssl_set_masks(s, s->s3->tmp.new_cipher);
              ^
  2222.   
  2223.   #ifdef OPENSSL_SSL_DEBUG_BROKEN_PROTOCOL

ssl/ssl_lib.c:2232:5: Skipping ssl_get_server_cert_index(): empty list of specs
  2230.   #endif
  2231.   
  2232.       i = ssl_get_server_cert_index(s);
              ^
  2233.   
  2234.       /* This may or may not be an error. */

ssl/ssl_lib.c:2235:9: Taking true branch
  2233.   
  2234.       /* This may or may not be an error. */
  2235.       if (i < 0)
                  ^
  2236.           return NULL;
  2237.   

ssl/ssl_lib.c:2236:9: 
  2234.       /* This may or may not be an error. */
  2235.       if (i < 0)
  2236. >         return NULL;
  2237.   
  2238.       /* May be NULL. */

ssl/ssl_lib.c:2240:1: return from a call to ssl_get_server_send_pkey
  2238.       /* May be NULL. */
  2239.       return &c->pkeys[i];
  2240. > }
  2241.   
  2242.   EVP_PKEY *ssl_get_sign_pkey(SSL *s, const SSL_CIPHER *cipher,

ssl/t1_lib.c:4208:9: 
4206.       } else {
4207.           CERT_PKEY *cpk = ssl_get_server_send_pkey(s);
4208. >         dh_secbits = EVP_PKEY_security_bits(cpk->privatekey);
4209.       }
4210.   
