ssl/s2_clnt.c:955: error: NULL_DEREFERENCE
  pointer `x509` last assigned on line 903 could be null and is dereferenced by call to `X509_free()` at line 955, column 2.
Showing all 28 steps of the trace


ssl/s2_clnt.c:894:1: start of procedure ssl2_set_certificate()
892.   
893.   /* loads in the certificate from the server */
894. > int ssl2_set_certificate(SSL *s, int type, int len, unsigned char *data)
895.   	{
896.   	STACK_OF(X509) *sk=NULL;

ssl/s2_clnt.c:896:2: 
894.   int ssl2_set_certificate(SSL *s, int type, int len, unsigned char *data)
895.   	{
896. > 	STACK_OF(X509) *sk=NULL;
897.   	EVP_PKEY *pkey=NULL;
898.   	SESS_CERT *sc=NULL;

ssl/s2_clnt.c:897:2: 
895.   	{
896.   	STACK_OF(X509) *sk=NULL;
897. > 	EVP_PKEY *pkey=NULL;
898.   	SESS_CERT *sc=NULL;
899.   	int i;

ssl/s2_clnt.c:898:2: 
896.   	STACK_OF(X509) *sk=NULL;
897.   	EVP_PKEY *pkey=NULL;
898. > 	SESS_CERT *sc=NULL;
899.   	int i;
900.   	X509 *x509=NULL;

ssl/s2_clnt.c:900:2: 
898.   	SESS_CERT *sc=NULL;
899.   	int i;
900. > 	X509 *x509=NULL;
901.   	int ret=0;
902.   	

ssl/s2_clnt.c:901:2: 
899.   	int i;
900.   	X509 *x509=NULL;
901. > 	int ret=0;
902.   	
903.   	x509=d2i_X509(NULL,&data,(long)len);

ssl/s2_clnt.c:903:2: Skipping d2i_X509(): empty list of specs
901.   	int ret=0;
902.   	
903.   	x509=d2i_X509(NULL,&data,(long)len);
        ^
904.   	if (x509 == NULL)
905.   		{

ssl/s2_clnt.c:904:6: Taking true branch
902.   	
903.   	x509=d2i_X509(NULL,&data,(long)len);
904.   	if (x509 == NULL)
            ^
905.   		{
906.   		SSLerr(SSL_F_SSL2_SET_CERTIFICATE,ERR_R_X509_LIB);

ssl/s2_clnt.c:906:3: 
904.   	if (x509 == NULL)
905.   		{
906. > 		SSLerr(SSL_F_SSL2_SET_CERTIFICATE,ERR_R_X509_LIB);
907.   		goto err;
908.   		}

crypto/err/err.c:246:1: start of procedure ERR_put_error()
  244.   /********************************************************/
  245.   
  246. > void ERR_put_error(int lib, int func, int reason, const char *file,
  247.   	     int line)
  248.   	{

crypto/err/err.c:270:2: Skipping ERR_get_state(): empty list of specs
  268.   	}
  269.   #endif
  270.   	es=ERR_get_state();
          ^
  271.   
  272.   	es->top=(es->top+1)%ERR_NUM_ERRORS;

crypto/err/err.c:272:2: 
  270.   	es=ERR_get_state();
  271.   
  272. > 	es->top=(es->top+1)%ERR_NUM_ERRORS;
  273.   	if (es->top == es->bottom)
  274.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;

crypto/err/err.c:273:6: Taking false branch
  271.   
  272.   	es->top=(es->top+1)%ERR_NUM_ERRORS;
  273.   	if (es->top == es->bottom)
              ^
  274.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
  275.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);

crypto/err/err.c:275:2: 
  273.   	if (es->top == es->bottom)
  274.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
  275. > 	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
  276.   	es->err_file[es->top]=file;
  277.   	es->err_line[es->top]=line;

crypto/err/err.c:276:2: 
  274.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
  275.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
  276. > 	es->err_file[es->top]=file;
  277.   	es->err_line[es->top]=line;
  278.   	err_clear_data(es,es->top);

crypto/err/err.c:277:2: 
  275.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
  276.   	es->err_file[es->top]=file;
  277. > 	es->err_line[es->top]=line;
  278.   	err_clear_data(es,es->top);
  279.   	}

crypto/err/err.c:278:2: Taking true branch
  276.   	es->err_file[es->top]=file;
  277.   	es->err_line[es->top]=line;
  278.   	err_clear_data(es,es->top);
          ^
  279.   	}
  280.   

crypto/err/err.c:278:2: Taking false branch
  276.   	es->err_file[es->top]=file;
  277.   	es->err_line[es->top]=line;
  278.   	err_clear_data(es,es->top);
          ^
  279.   	}
  280.   

crypto/err/err.c:279:2: return from a call to ERR_put_error
  277.   	es->err_line[es->top]=line;
  278.   	err_clear_data(es,es->top);
  279.   	}
          ^
  280.   
  281.   void ERR_clear_error(void)

ssl/s2_clnt.c:953:1: 
951.   		goto err;
952.   	ret=1;
953. > err:
954.   	sk_X509_free(sk);
955.   	X509_free(x509);

ssl/s2_clnt.c:954:2: 
952.   	ret=1;
953.   err:
954. > 	sk_X509_free(sk);
955.   	X509_free(x509);
956.   	EVP_PKEY_free(pkey);

crypto/x509/x509_vfy.c:799:1: start of procedure sk_X509_free()
  797.   
  798.   
  799. > IMPLEMENT_STACK_OF(X509)
  800.   IMPLEMENT_ASN1_SET_OF(X509)
  801.   

crypto/stack/stack.c:276:1: start of procedure sk_free()
    274.   	}
    275.   
    276. > void sk_free(STACK *st)
    277.   	{
    278.   	if (st == NULL) return;

crypto/stack/stack.c:278:6: Taking true branch
    276.   void sk_free(STACK *st)
    277.   	{
    278.   	if (st == NULL) return;
                ^
    279.   	if (st->data != NULL) Free(st->data);
    280.   	Free(st);

crypto/stack/stack.c:278:18: 
    276.   void sk_free(STACK *st)
    277.   	{
    278. > 	if (st == NULL) return;
    279.   	if (st->data != NULL) Free(st->data);
    280.   	Free(st);

crypto/stack/stack.c:281:2: return from a call to sk_free
    279.   	if (st->data != NULL) Free(st->data);
    280.   	Free(st);
    281.   	}
            ^
    282.   
    283.   int sk_num(STACK *st)

crypto/x509/x509_vfy.c:799:1: return from a call to sk_X509_free
  797.   
  798.   
  799. > IMPLEMENT_STACK_OF(X509)
  800.   IMPLEMENT_ASN1_SET_OF(X509)
  801.   

ssl/s2_clnt.c:955:2: 
953.   err:
954.   	sk_X509_free(sk);
955. > 	X509_free(x509);
956.   	EVP_PKEY_free(pkey);
957.   	return(ret);
