ssl/s3_clnt.c:2498: error: NULL_DEREFERENCE
  pointer `pub_key` last assigned on line 2498 could be null and is dereferenced by call to `EVP_PKEY_CTX_new()` at line 2498, column 13.
Showing all 27 steps of the trace


ssl/s3_clnt.c:2005:1: start of procedure ssl3_send_client_key_exchange()
2003.   
2004.   
2005. > int ssl3_send_client_key_exchange(SSL *s)
2006.   	{
2007.   	unsigned char *p,*d;

ssl/s3_clnt.c:2012:2: 
2010.   #ifndef OPENSSL_NO_RSA
2011.   	unsigned char *q;
2012. > 	EVP_PKEY *pkey=NULL;
2013.   #endif
2014.   #ifndef OPENSSL_NO_KRB5

ssl/s3_clnt.c:2018:2: 
2016.   #endif /* OPENSSL_NO_KRB5 */
2017.   #ifndef OPENSSL_NO_ECDH
2018. > 	EC_KEY *clnt_ecdh = NULL;
2019.   	const EC_POINT *srvr_ecpoint = NULL;
2020.   	EVP_PKEY *srvr_pub_pkey = NULL;

ssl/s3_clnt.c:2019:2: 
2017.   #ifndef OPENSSL_NO_ECDH
2018.   	EC_KEY *clnt_ecdh = NULL;
2019. > 	const EC_POINT *srvr_ecpoint = NULL;
2020.   	EVP_PKEY *srvr_pub_pkey = NULL;
2021.   	unsigned char *encodedPoint = NULL;

ssl/s3_clnt.c:2020:2: 
2018.   	EC_KEY *clnt_ecdh = NULL;
2019.   	const EC_POINT *srvr_ecpoint = NULL;
2020. > 	EVP_PKEY *srvr_pub_pkey = NULL;
2021.   	unsigned char *encodedPoint = NULL;
2022.   	int encoded_pt_len = 0;

ssl/s3_clnt.c:2021:2: 
2019.   	const EC_POINT *srvr_ecpoint = NULL;
2020.   	EVP_PKEY *srvr_pub_pkey = NULL;
2021. > 	unsigned char *encodedPoint = NULL;
2022.   	int encoded_pt_len = 0;
2023.   	BN_CTX * bn_ctx = NULL;

ssl/s3_clnt.c:2022:2: 
2020.   	EVP_PKEY *srvr_pub_pkey = NULL;
2021.   	unsigned char *encodedPoint = NULL;
2022. > 	int encoded_pt_len = 0;
2023.   	BN_CTX * bn_ctx = NULL;
2024.   #endif

ssl/s3_clnt.c:2023:2: 
2021.   	unsigned char *encodedPoint = NULL;
2022.   	int encoded_pt_len = 0;
2023. > 	BN_CTX * bn_ctx = NULL;
2024.   #endif
2025.   

ssl/s3_clnt.c:2026:6: Taking true branch
2024.   #endif
2025.   
2026.   	if (s->state == SSL3_ST_CW_KEY_EXCH_A)
             ^
2027.   		{
2028.   		d=(unsigned char *)s->init_buf->data;

ssl/s3_clnt.c:2028:3: 
2026.   	if (s->state == SSL3_ST_CW_KEY_EXCH_A)
2027.   		{
2028. > 		d=(unsigned char *)s->init_buf->data;
2029.   		p= &(d[4]);
2030.   

ssl/s3_clnt.c:2029:3: 
2027.   		{
2028.   		d=(unsigned char *)s->init_buf->data;
2029. > 		p= &(d[4]);
2030.   
2031.   		alg_k=s->s3->tmp.new_cipher->algorithm_mkey;

ssl/s3_clnt.c:2031:3: 
2029.   		p= &(d[4]);
2030.   
2031. > 		alg_k=s->s3->tmp.new_cipher->algorithm_mkey;
2032.   
2033.   		/* Fool emacs indentation */

ssl/s3_clnt.c:2034:7: Taking false branch
2032.   
2033.   		/* Fool emacs indentation */
2034.   		if (0) {}
              ^
2035.   #ifndef OPENSSL_NO_RSA
2036.   		else if (alg_k & SSL_kRSA)

ssl/s3_clnt.c:2036:12: Taking false branch
2034.   		if (0) {}
2035.   #ifndef OPENSSL_NO_RSA
2036.   		else if (alg_k & SSL_kRSA)
                   ^
2037.   			{
2038.   			RSA *rsa;

ssl/s3_clnt.c:2229:12: Taking false branch
2227.   #endif
2228.   #ifndef OPENSSL_NO_DH
2229.   		else if (alg_k & (SSL_kEDH|SSL_kDHr|SSL_kDHd))
                   ^
2230.   			{
2231.   			DH *dh_srvr,*dh_clnt;

ssl/s3_clnt.c:2293:12: Taking false branch
2291.   
2292.   #ifndef OPENSSL_NO_ECDH 
2293.   		else if (alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe))
                   ^
2294.   			{
2295.   			const EC_GROUP *srvr_group = NULL;

ssl/s3_clnt.c:2477:12: Taking true branch
2475.   			}
2476.   #endif /* !OPENSSL_NO_ECDH */
2477.   		else if (alg_k & SSL_kGOST) 
                   ^
2478.   			{
2479.   			/* GOST key exchange message creation */

ssl/s3_clnt.c:2490:4: 
2488.   
2489.   			/* Get server sertificate PKEY and create ctx from it */
2490. > 			peer_cert=s->session->sess_cert->peer_pkeys[(keytype=SSL_PKEY_GOST01)].x509;
2491.   			if (!peer_cert) 
2492.   				peer_cert=s->session->sess_cert->peer_pkeys[(keytype=SSL_PKEY_GOST94)].x509;

ssl/s3_clnt.c:2491:9: Taking true branch
2489.   			/* Get server sertificate PKEY and create ctx from it */
2490.   			peer_cert=s->session->sess_cert->peer_pkeys[(keytype=SSL_PKEY_GOST01)].x509;
2491.   			if (!peer_cert) 
                ^
2492.   				peer_cert=s->session->sess_cert->peer_pkeys[(keytype=SSL_PKEY_GOST94)].x509;
2493.   			if (!peer_cert)		{

ssl/s3_clnt.c:2492:5: 
2490.   			peer_cert=s->session->sess_cert->peer_pkeys[(keytype=SSL_PKEY_GOST01)].x509;
2491.   			if (!peer_cert) 
2492. > 				peer_cert=s->session->sess_cert->peer_pkeys[(keytype=SSL_PKEY_GOST94)].x509;
2493.   			if (!peer_cert)		{
2494.   					SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,SSL_R_NO_GOST_CERTIFICATE_SENT_BY_PEER);

ssl/s3_clnt.c:2493:9: Taking false branch
2491.   			if (!peer_cert) 
2492.   				peer_cert=s->session->sess_cert->peer_pkeys[(keytype=SSL_PKEY_GOST94)].x509;
2493.   			if (!peer_cert)		{
                ^
2494.   					SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,SSL_R_NO_GOST_CERTIFICATE_SENT_BY_PEER);
2495.   					goto err;

ssl/s3_clnt.c:2498:4: 
2496.   				}	
2497.   				
2498. > 			pkey_ctx=EVP_PKEY_CTX_new(pub_key=X509_get_pubkey(peer_cert),NULL);
2499.   			/* If we have send a certificate, and certificate key
2500.   

crypto/x509/x509_cmp.c:295:1: start of procedure X509_get_pubkey()
  293.   	}
  294.   
  295. > EVP_PKEY *X509_get_pubkey(X509 *x)
  296.   	{
  297.   	if ((x == NULL) || (x->cert_info == NULL))

crypto/x509/x509_cmp.c:297:7: Taking false branch
  295.   EVP_PKEY *X509_get_pubkey(X509 *x)
  296.   	{
  297.   	if ((x == NULL) || (x->cert_info == NULL))
               ^
  298.   		return(NULL);
  299.   	return(X509_PUBKEY_get(x->cert_info->key));

crypto/x509/x509_cmp.c:297:22: Taking true branch
  295.   EVP_PKEY *X509_get_pubkey(X509 *x)
  296.   	{
  297.   	if ((x == NULL) || (x->cert_info == NULL))
                              ^
  298.   		return(NULL);
  299.   	return(X509_PUBKEY_get(x->cert_info->key));

crypto/x509/x509_cmp.c:298:3: 
  296.   	{
  297.   	if ((x == NULL) || (x->cert_info == NULL))
  298. > 		return(NULL);
  299.   	return(X509_PUBKEY_get(x->cert_info->key));
  300.   	}

crypto/x509/x509_cmp.c:300:2: return from a call to X509_get_pubkey
  298.   		return(NULL);
  299.   	return(X509_PUBKEY_get(x->cert_info->key));
  300.   	}
          ^
  301.   
  302.   ASN1_BIT_STRING *X509_get0_pubkey_bitstr(const X509 *x)
