ssl/s3_srvr.c:1566: error: NULL_DEREFERENCE
  pointer `pkey` last assigned on line 1453 could be null and is dereferenced by call to `EVP_PKEY_free()` at line 1566, column 2.
Showing all 22 steps of the trace


ssl/s3_srvr.c:1432:1: start of procedure ssl3_get_cert_verify()
1430.   	}
1431.   
1432. > static int ssl3_get_cert_verify(SSL *s)
1433.   	{
1434.   	EVP_PKEY *pkey=NULL;

ssl/s3_srvr.c:1434:2: 
1432.   static int ssl3_get_cert_verify(SSL *s)
1433.   	{
1434. > 	EVP_PKEY *pkey=NULL;
1435.   	unsigned char *p;
1436.   	int al,ok,ret=0;

ssl/s3_srvr.c:1436:2: 
1434.   	EVP_PKEY *pkey=NULL;
1435.   	unsigned char *p;
1436. > 	int al,ok,ret=0;
1437.   	long n;
1438.   	int type=0,i,j;

ssl/s3_srvr.c:1438:2: 
1436.   	int al,ok,ret=0;
1437.   	long n;
1438. > 	int type=0,i,j;
1439.   	X509 *peer;
1440.   

ssl/s3_srvr.c:1441:2: Skipping ssl3_get_message(): empty list of specs
1439.   	X509 *peer;
1440.   
1441.   	n=ssl3_get_message(s,
         ^
1442.   		SSL3_ST_SR_CERT_VRFY_A,
1443.   		SSL3_ST_SR_CERT_VRFY_B,

ssl/s3_srvr.c:1448:7: Taking false branch
1446.   		&ok);
1447.   
1448.   	if (!ok) return((int)n);
              ^
1449.   
1450.   	if (s->session->peer != NULL)

ssl/s3_srvr.c:1450:6: Taking true branch
1448.   	if (!ok) return((int)n);
1449.   
1450.   	if (s->session->peer != NULL)
             ^
1451.   		{
1452.   		peer=s->session->peer;

ssl/s3_srvr.c:1452:3: 
1450.   	if (s->session->peer != NULL)
1451.   		{
1452. > 		peer=s->session->peer;
1453.   		pkey=X509_get_pubkey(peer);
1454.   		type=X509_certificate_type(peer,pkey);

ssl/s3_srvr.c:1453:3: 
1451.   		{
1452.   		peer=s->session->peer;
1453. > 		pkey=X509_get_pubkey(peer);
1454.   		type=X509_certificate_type(peer,pkey);
1455.   		}

crypto/x509/x509_cmp.c:254:1: start of procedure X509_get_pubkey()
  252.   	}
  253.   
  254. > EVP_PKEY *X509_get_pubkey(X509 *x)
  255.   	{
  256.   	if ((x == NULL) || (x->cert_info == NULL))

crypto/x509/x509_cmp.c:256:7: Taking false branch
  254.   EVP_PKEY *X509_get_pubkey(X509 *x)
  255.   	{
  256.   	if ((x == NULL) || (x->cert_info == NULL))
               ^
  257.   		return(NULL);
  258.   	return(X509_PUBKEY_get(x->cert_info->key));

crypto/x509/x509_cmp.c:256:22: Taking true branch
  254.   EVP_PKEY *X509_get_pubkey(X509 *x)
  255.   	{
  256.   	if ((x == NULL) || (x->cert_info == NULL))
                              ^
  257.   		return(NULL);
  258.   	return(X509_PUBKEY_get(x->cert_info->key));

crypto/x509/x509_cmp.c:257:3: 
  255.   	{
  256.   	if ((x == NULL) || (x->cert_info == NULL))
  257. > 		return(NULL);
  258.   	return(X509_PUBKEY_get(x->cert_info->key));
  259.   	}

crypto/x509/x509_cmp.c:259:2: return from a call to X509_get_pubkey
  257.   		return(NULL);
  258.   	return(X509_PUBKEY_get(x->cert_info->key));
  259.   	}
          ^
  260.   
  261.   int X509_check_private_key(X509 *x, EVP_PKEY *k)

ssl/s3_srvr.c:1454:3: Skipping X509_certificate_type(): empty list of specs
1452.   		peer=s->session->peer;
1453.   		pkey=X509_get_pubkey(peer);
1454.   		type=X509_certificate_type(peer,pkey);
          ^
1455.   		}
1456.   	else

ssl/s3_srvr.c:1462:6: Taking true branch
1460.   		}
1461.   
1462.   	if (s->s3->tmp.message_type != SSL3_MT_CERTIFICATE_VERIFY)
             ^
1463.   		{
1464.   		s->s3->tmp.reuse_message=1;

ssl/s3_srvr.c:1464:3: 
1462.   	if (s->s3->tmp.message_type != SSL3_MT_CERTIFICATE_VERIFY)
1463.   		{
1464. > 		s->s3->tmp.reuse_message=1;
1465.   		if ((peer != NULL) && (type | EVP_PKT_SIGN))
1466.   			{

ssl/s3_srvr.c:1465:8: Taking true branch
1463.   		{
1464.   		s->s3->tmp.reuse_message=1;
1465.   		if ((peer != NULL) && (type | EVP_PKT_SIGN))
               ^
1466.   			{
1467.   			al=SSL_AD_UNEXPECTED_MESSAGE;

ssl/s3_srvr.c:1465:26: Taking false branch
1463.   		{
1464.   		s->s3->tmp.reuse_message=1;
1465.   		if ((peer != NULL) && (type | EVP_PKT_SIGN))
                                 ^
1466.   			{
1467.   			al=SSL_AD_UNEXPECTED_MESSAGE;

ssl/s3_srvr.c:1471:3: 
1469.   			goto f_err;
1470.   			}
1471. > 		ret=1;
1472.   		goto end;
1473.   		}

ssl/s3_srvr.c:1565:1: 
1563.   		ssl3_send_alert(s,SSL3_AL_FATAL,al);
1564.   		}
1565. > end:
1566.   	EVP_PKEY_free(pkey);
1567.   	return(ret);

ssl/s3_srvr.c:1566:2: 
1564.   		}
1565.   end:
1566. > 	EVP_PKEY_free(pkey);
1567.   	return(ret);
1568.   	}
