ssl/s2_srvr.c:941: error: NULL_DEREFERENCE
  pointer `x509` last assigned on line 792 could be null and is dereferenced by call to `X509_free()` at line 941, column 2.
Showing all 45 steps of the trace


ssl/s2_srvr.c:787:1: start of procedure request_certificate()
785.   
786.   /* send the request and check the response */
787. > static int request_certificate(SSL *s)
788.   	{
789.   	unsigned char *p,*p2,*buf2;

ssl/s2_srvr.c:791:2: 
789.   	unsigned char *p,*p2,*buf2;
790.   	unsigned char *ccd;
791. > 	int i,j,ctype,ret= -1;
792.   	X509 *x509=NULL;
793.   	STACK_OF(X509) *sk=NULL;

ssl/s2_srvr.c:792:2: 
790.   	unsigned char *ccd;
791.   	int i,j,ctype,ret= -1;
792. > 	X509 *x509=NULL;
793.   	STACK_OF(X509) *sk=NULL;
794.   

ssl/s2_srvr.c:793:2: 
791.   	int i,j,ctype,ret= -1;
792.   	X509 *x509=NULL;
793. > 	STACK_OF(X509) *sk=NULL;
794.   
795.   	ccd=s->s2->tmp.ccl;

ssl/s2_srvr.c:795:2: 
793.   	STACK_OF(X509) *sk=NULL;
794.   
795. > 	ccd=s->s2->tmp.ccl;
796.   	if (s->state == SSL2_ST_SEND_REQUEST_CERTIFICATE_A)
797.   		{

ssl/s2_srvr.c:796:6: Taking false branch
794.   
795.   	ccd=s->s2->tmp.ccl;
796.   	if (s->state == SSL2_ST_SEND_REQUEST_CERTIFICATE_A)
            ^
797.   		{
798.   		p=(unsigned char *)s->init_buf->data;

ssl/s2_srvr.c:809:6: Taking false branch
807.   		}
808.   
809.   	if (s->state == SSL2_ST_SEND_REQUEST_CERTIFICATE_B)
            ^
810.   		{
811.   		i=ssl2_do_write(s);

ssl/s2_srvr.c:822:6: Taking true branch
820.   		}
821.   
822.   	if (s->state == SSL2_ST_SEND_REQUEST_CERTIFICATE_C)
            ^
823.   		{
824.   		p=(unsigned char *)s->init_buf->data;

ssl/s2_srvr.c:824:3: 
822.   	if (s->state == SSL2_ST_SEND_REQUEST_CERTIFICATE_C)
823.   		{
824. > 		p=(unsigned char *)s->init_buf->data;
825.   		i=ssl2_read(s,(char *)&(p[s->init_num]),6-s->init_num);
826.   		if (i < 3)

ssl/s2_srvr.c:825:3: Skipping ssl2_read(): empty list of specs
823.   		{
824.   		p=(unsigned char *)s->init_buf->data;
825.   		i=ssl2_read(s,(char *)&(p[s->init_num]),6-s->init_num);
         ^
826.   		if (i < 3)
827.   			{

ssl/s2_srvr.c:826:7: Taking false branch
824.   		p=(unsigned char *)s->init_buf->data;
825.   		i=ssl2_read(s,(char *)&(p[s->init_num]),6-s->init_num);
826.   		if (i < 3)
             ^
827.   			{
828.   			ret=ssl2_part_read(s,SSL_F_REQUEST_CERTIFICATE,i);

ssl/s2_srvr.c:832:8: Taking false branch
830.   			}
831.   
832.   		if ((*p == SSL2_MT_ERROR) && (i >= 3))
              ^
833.   			{
834.   			n2s(p,i);

ssl/s2_srvr.c:844:8: Taking false branch
842.   			goto end;
843.   			}
844.   		if ((*(p++) != SSL2_MT_CLIENT_CERTIFICATE) || (i < 6))
              ^
845.   			{
846.   			ssl2_return_error(s,SSL2_PE_UNDEFINED_ERROR);

ssl/s2_srvr.c:844:50: Taking false branch
842.   			goto end;
843.   			}
844.   		if ((*(p++) != SSL2_MT_CLIENT_CERTIFICATE) || (i < 6))
                                                        ^
845.   			{
846.   			ssl2_return_error(s,SSL2_PE_UNDEFINED_ERROR);

ssl/s2_srvr.c:852:3: 
850.   		/* ok we have a response */
851.   		/* certificate type, there is only one right now. */
852. > 		ctype= *(p++);
853.   		if (ctype != SSL2_AT_MD5_WITH_RSA_ENCRYPTION)
854.   			{

ssl/s2_srvr.c:853:7: Taking false branch
851.   		/* certificate type, there is only one right now. */
852.   		ctype= *(p++);
853.   		if (ctype != SSL2_AT_MD5_WITH_RSA_ENCRYPTION)
             ^
854.   			{
855.   			ssl2_return_error(s,SSL2_PE_UNSUPPORTED_CERTIFICATE_TYPE);

ssl/s2_srvr.c:859:3: 
857.   			goto end;
858.   			}
859. > 		n2s(p,i); s->s2->tmp.clen=i;
860.   		n2s(p,i); s->s2->tmp.rlen=i;
861.   		s->state=SSL2_ST_SEND_REQUEST_CERTIFICATE_D;

ssl/s2_srvr.c:859:13: 
857.   			goto end;
858.   			}
859. > 		n2s(p,i); s->s2->tmp.clen=i;
860.   		n2s(p,i); s->s2->tmp.rlen=i;
861.   		s->state=SSL2_ST_SEND_REQUEST_CERTIFICATE_D;

ssl/s2_srvr.c:860:3: 
858.   			}
859.   		n2s(p,i); s->s2->tmp.clen=i;
860. > 		n2s(p,i); s->s2->tmp.rlen=i;
861.   		s->state=SSL2_ST_SEND_REQUEST_CERTIFICATE_D;
862.   		s->init_num=0;

ssl/s2_srvr.c:860:13: 
858.   			}
859.   		n2s(p,i); s->s2->tmp.clen=i;
860. > 		n2s(p,i); s->s2->tmp.rlen=i;
861.   		s->state=SSL2_ST_SEND_REQUEST_CERTIFICATE_D;
862.   		s->init_num=0;

ssl/s2_srvr.c:861:3: 
859.   		n2s(p,i); s->s2->tmp.clen=i;
860.   		n2s(p,i); s->s2->tmp.rlen=i;
861. > 		s->state=SSL2_ST_SEND_REQUEST_CERTIFICATE_D;
862.   		s->init_num=0;
863.   		}

ssl/s2_srvr.c:862:3: 
860.   		n2s(p,i); s->s2->tmp.rlen=i;
861.   		s->state=SSL2_ST_SEND_REQUEST_CERTIFICATE_D;
862. > 		s->init_num=0;
863.   		}
864.   

ssl/s2_srvr.c:866:2: 
864.   
865.   	/* SSL2_ST_SEND_REQUEST_CERTIFICATE_D */
866. > 	p=(unsigned char *)s->init_buf->data;
867.   	j=s->s2->tmp.clen+s->s2->tmp.rlen-s->init_num;
868.   	i=ssl2_read(s,(char *)&(p[s->init_num]),j);

ssl/s2_srvr.c:867:2: 
865.   	/* SSL2_ST_SEND_REQUEST_CERTIFICATE_D */
866.   	p=(unsigned char *)s->init_buf->data;
867. > 	j=s->s2->tmp.clen+s->s2->tmp.rlen-s->init_num;
868.   	i=ssl2_read(s,(char *)&(p[s->init_num]),j);
869.   	if (i < j) 

ssl/s2_srvr.c:868:2: Skipping ssl2_read(): empty list of specs
866.   	p=(unsigned char *)s->init_buf->data;
867.   	j=s->s2->tmp.clen+s->s2->tmp.rlen-s->init_num;
868.   	i=ssl2_read(s,(char *)&(p[s->init_num]),j);
        ^
869.   	if (i < j) 
870.   		{

ssl/s2_srvr.c:869:6: Taking true branch
867.   	j=s->s2->tmp.clen+s->s2->tmp.rlen-s->init_num;
868.   	i=ssl2_read(s,(char *)&(p[s->init_num]),j);
869.   	if (i < j) 
            ^
870.   		{
871.   		ret=ssl2_part_read(s,SSL_F_REQUEST_CERTIFICATE,i);

ssl/s2_srvr.c:871:3: 
869.   	if (i < j) 
870.   		{
871. > 		ret=ssl2_part_read(s,SSL_F_REQUEST_CERTIFICATE,i);
872.   		goto end;
873.   		}

ssl/s2_pkt.c:574:1: start of procedure ssl2_part_read()
  572.   	}
  573.   
  574. > int ssl2_part_read(SSL *s, unsigned long f, int i)
  575.   	{
  576.   	unsigned char *p;

ssl/s2_pkt.c:580:7: Taking true branch
  578.   
  579.   	/* check for error */
  580.   	if ((s->init_num == 0) && (i >= 3))
               ^
  581.   		{
  582.   		p=(unsigned char *)s->init_buf->data;

ssl/s2_pkt.c:580:29: Taking true branch
  578.   
  579.   	/* check for error */
  580.   	if ((s->init_num == 0) && (i >= 3))
                                     ^
  581.   		{
  582.   		p=(unsigned char *)s->init_buf->data;

ssl/s2_pkt.c:582:3: 
  580.   	if ((s->init_num == 0) && (i >= 3))
  581.   		{
  582. > 		p=(unsigned char *)s->init_buf->data;
  583.   		if (p[0] == SSL2_MT_ERROR)
  584.   			{

ssl/s2_pkt.c:583:7: Taking false branch
  581.   		{
  582.   		p=(unsigned char *)s->init_buf->data;
  583.   		if (p[0] == SSL2_MT_ERROR)
               ^
  584.   			{
  585.   			j=(p[1]<<8)|p[2];

ssl/s2_pkt.c:590:6: Taking false branch
  588.   		}
  589.   
  590.   	if (i < 0)
              ^
  591.   		{
  592.   		/* ssl2_return_error(s); */

ssl/s2_pkt.c:599:3: 
  597.   	else
  598.   		{
  599. > 		s->init_num+=i;
  600.   		return(0);
  601.   		}

ssl/s2_pkt.c:600:3: 
  598.   		{
  599.   		s->init_num+=i;
  600. > 		return(0);
  601.   		}
  602.   	}

ssl/s2_pkt.c:602:2: return from a call to ssl2_part_read
  600.   		return(0);
  601.   		}
  602.   	}
          ^
  603.   
  604.   int ssl2_do_write(SSL *s)

ssl/s2_srvr.c:939:1: 
937.   		ssl2_return_error(s,SSL2_PE_BAD_CERTIFICATE);
938.   		}
939. > end:
940.   	sk_X509_free(sk);
941.   	X509_free(x509);

ssl/s2_srvr.c:940:2: 
938.   		}
939.   end:
940. > 	sk_X509_free(sk);
941.   	X509_free(x509);
942.   	return(ret);

crypto/x509/x509_vfy.c:799:1: start of procedure sk_X509_free()
  797.   
  798.   
  799. > IMPLEMENT_STACK_OF(X509)
  800.   IMPLEMENT_ASN1_SET_OF(X509)
  801.   

crypto/stack/stack.c:276:1: start of procedure sk_free()
    274.   	}
    275.   
    276. > void sk_free(STACK *st)
    277.   	{
    278.   	if (st == NULL) return;

crypto/stack/stack.c:278:6: Taking true branch
    276.   void sk_free(STACK *st)
    277.   	{
    278.   	if (st == NULL) return;
                ^
    279.   	if (st->data != NULL) Free((char *)st->data);
    280.   	Free((char *)st);

crypto/stack/stack.c:278:18: 
    276.   void sk_free(STACK *st)
    277.   	{
    278. > 	if (st == NULL) return;
    279.   	if (st->data != NULL) Free((char *)st->data);
    280.   	Free((char *)st);

crypto/stack/stack.c:281:2: return from a call to sk_free
    279.   	if (st->data != NULL) Free((char *)st->data);
    280.   	Free((char *)st);
    281.   	}
            ^
    282.   
    283.   int sk_num(STACK *st)

crypto/x509/x509_vfy.c:799:1: return from a call to sk_X509_free
  797.   
  798.   
  799. > IMPLEMENT_STACK_OF(X509)
  800.   IMPLEMENT_ASN1_SET_OF(X509)
  801.   

ssl/s2_srvr.c:941:2: 
939.   end:
940.   	sk_X509_free(sk);
941. > 	X509_free(x509);
942.   	return(ret);
943.   	}
