ssl/s3_srvr.c:2124: error: NULL_DEREFERENCE
  pointer `clnt_pub_pkey` last assigned on line 1620 could be null and is dereferenced by call to `EVP_PKEY_free()` at line 2124, column 2.
Showing all 41 steps of the trace


ssl/s3_srvr.c:1600:1: start of procedure ssl3_get_client_key_exchange()
1598.   	}
1599.   
1600. > static int ssl3_get_client_key_exchange(SSL *s)
1601.   	{
1602.   	int i,al,ok;

ssl/s3_srvr.c:1607:2: 
1605.   	unsigned char *p;
1606.   #ifndef OPENSSL_NO_RSA
1607. > 	RSA *rsa=NULL;
1608.   	EVP_PKEY *pkey=NULL;
1609.   #endif

ssl/s3_srvr.c:1608:2: 
1606.   #ifndef OPENSSL_NO_RSA
1607.   	RSA *rsa=NULL;
1608. > 	EVP_PKEY *pkey=NULL;
1609.   #endif
1610.   #ifndef OPENSSL_NO_DH

ssl/s3_srvr.c:1611:2: 
1609.   #endif
1610.   #ifndef OPENSSL_NO_DH
1611. > 	BIGNUM *pub=NULL;
1612.   	DH *dh_srvr;
1613.   #endif

ssl/s3_srvr.c:1619:2: 
1617.   
1618.   #ifndef OPENSSL_NO_ECDH
1619. > 	EC_KEY *srvr_ecdh = NULL;
1620.   	EVP_PKEY *clnt_pub_pkey = NULL;
1621.   	EC_POINT *clnt_ecpoint = NULL;

ssl/s3_srvr.c:1620:2: 
1618.   #ifndef OPENSSL_NO_ECDH
1619.   	EC_KEY *srvr_ecdh = NULL;
1620. > 	EVP_PKEY *clnt_pub_pkey = NULL;
1621.   	EC_POINT *clnt_ecpoint = NULL;
1622.   	BN_CTX *bn_ctx = NULL; 

ssl/s3_srvr.c:1621:2: 
1619.   	EC_KEY *srvr_ecdh = NULL;
1620.   	EVP_PKEY *clnt_pub_pkey = NULL;
1621. > 	EC_POINT *clnt_ecpoint = NULL;
1622.   	BN_CTX *bn_ctx = NULL; 
1623.   #endif

ssl/s3_srvr.c:1622:2: 
1620.   	EVP_PKEY *clnt_pub_pkey = NULL;
1621.   	EC_POINT *clnt_ecpoint = NULL;
1622. > 	BN_CTX *bn_ctx = NULL; 
1623.   #endif
1624.   

ssl/s3_srvr.c:1625:2: Skipping ssl3_get_message(): empty list of specs
1623.   #endif
1624.   
1625.   	n=ssl3_get_message(s,
         ^
1626.   		SSL3_ST_SR_KEY_EXCH_A,
1627.   		SSL3_ST_SR_KEY_EXCH_B,

ssl/s3_srvr.c:1632:7: Taking false branch
1630.   		&ok);
1631.   
1632.   	if (!ok) return((int)n);
              ^
1633.   	p=(unsigned char *)s->init_msg;
1634.   

ssl/s3_srvr.c:1633:2: 
1631.   
1632.   	if (!ok) return((int)n);
1633. > 	p=(unsigned char *)s->init_msg;
1634.   
1635.   	l=s->s3->tmp.new_cipher->algorithms;

ssl/s3_srvr.c:1635:2: 
1633.   	p=(unsigned char *)s->init_msg;
1634.   
1635. > 	l=s->s3->tmp.new_cipher->algorithms;
1636.   
1637.   #ifndef OPENSSL_NO_RSA

ssl/s3_srvr.c:1638:6: Taking false branch
1636.   
1637.   #ifndef OPENSSL_NO_RSA
1638.   	if (l & SSL_kRSA)
             ^
1639.   		{
1640.   		/* FIX THIS UP EAY EAY EAY EAY */

ssl/s3_srvr.c:1743:7: Taking true branch
1741.   #endif
1742.   #ifndef OPENSSL_NO_DH
1743.   		if (l & (SSL_kEDH|SSL_kDHr|SSL_kDHd))
              ^
1744.   		{
1745.   		n2s(p,i);

ssl/s3_srvr.c:1745:3: 
1743.   		if (l & (SSL_kEDH|SSL_kDHr|SSL_kDHd))
1744.   		{
1745. > 		n2s(p,i);
1746.   		if (n != i+2)
1747.   			{

ssl/s3_srvr.c:1746:7: Taking false branch
1744.   		{
1745.   		n2s(p,i);
1746.   		if (n != i+2)
              ^
1747.   			{
1748.   			if (!(s->options & SSL_OP_SSLEAY_080_CLIENT_DH_BUG))

ssl/s3_srvr.c:1760:7: Taking false branch
1758.   			}
1759.   
1760.   		if (n == 0L) /* the parameters are in the cert */
              ^
1761.   			{
1762.   			al=SSL_AD_HANDSHAKE_FAILURE;

ssl/s3_srvr.c:1768:8: Taking false branch
1766.   		else
1767.   			{
1768.   			if (s->s3->tmp.dh == NULL)
               ^
1769.   				{
1770.   				al=SSL_AD_HANDSHAKE_FAILURE;

ssl/s3_srvr.c:1775:5: 
1773.   				}
1774.   			else
1775. > 				dh_srvr=s->s3->tmp.dh;
1776.   			}
1777.   

ssl/s3_srvr.c:1778:3: Skipping BN_bin2bn(): empty list of specs
1776.   			}
1777.   
1778.   		pub=BN_bin2bn(p,i,NULL);
          ^
1779.   		if (pub == NULL)
1780.   			{

ssl/s3_srvr.c:1779:7: Taking false branch
1777.   
1778.   		pub=BN_bin2bn(p,i,NULL);
1779.   		if (pub == NULL)
              ^
1780.   			{
1781.   			SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,SSL_R_BN_LIB);

ssl/s3_srvr.c:1785:3: 
1783.   			}
1784.   
1785. > 		i=DH_compute_key(p,pub,dh_srvr);
1786.   
1787.   		if (i <= 0)

crypto/dh/dh_key.c:79:1: start of procedure DH_compute_key()
  77.   	}
  78.   
  79. > int DH_compute_key(unsigned char *key, const BIGNUM *pub_key, DH *dh)
  80.   	{
  81.   	return dh->meth->compute_key(key, pub_key, dh);

crypto/dh/dh_key.c:81:2: Skipping __function_pointer__(): unresolved function pointer
  79.   int DH_compute_key(unsigned char *key, const BIGNUM *pub_key, DH *dh)
  80.   	{
  81.   	return dh->meth->compute_key(key, pub_key, dh);
         ^
  82.   	}
  83.   

crypto/dh/dh_key.c:82:2: return from a call to DH_compute_key
  80.   	{
  81.   	return dh->meth->compute_key(key, pub_key, dh);
  82.   	}
         ^
  83.   
  84.   static DH_METHOD dh_ossl = {

ssl/s3_srvr.c:1787:7: Taking true branch
1785.   		i=DH_compute_key(p,pub,dh_srvr);
1786.   
1787.   		if (i <= 0)
              ^
1788.   			{
1789.   			SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,ERR_R_DH_LIB);

ssl/s3_srvr.c:1789:4: 
1787.   		if (i <= 0)
1788.   			{
1789. > 			SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,ERR_R_DH_LIB);
1790.   			goto err;
1791.   			}

crypto/err/err.c:664:1: start of procedure ERR_put_error()
  662.   /********************************************************/
  663.   
  664. > void ERR_put_error(int lib, int func, int reason, const char *file,
  665.   	     int line)
  666.   	{

crypto/err/err.c:688:2: Skipping ERR_get_state(): empty list of specs
  686.   	}
  687.   #endif
  688.   	es=ERR_get_state();
          ^
  689.   
  690.   	es->top=(es->top+1)%ERR_NUM_ERRORS;

crypto/err/err.c:690:2: 
  688.   	es=ERR_get_state();
  689.   
  690. > 	es->top=(es->top+1)%ERR_NUM_ERRORS;
  691.   	if (es->top == es->bottom)
  692.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;

crypto/err/err.c:691:6: Taking false branch
  689.   
  690.   	es->top=(es->top+1)%ERR_NUM_ERRORS;
  691.   	if (es->top == es->bottom)
              ^
  692.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
  693.   	es->err_flags[es->top]=0;

crypto/err/err.c:693:2: 
  691.   	if (es->top == es->bottom)
  692.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
  693. > 	es->err_flags[es->top]=0;
  694.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
  695.   	es->err_file[es->top]=file;

crypto/err/err.c:694:2: 
  692.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
  693.   	es->err_flags[es->top]=0;
  694. > 	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
  695.   	es->err_file[es->top]=file;
  696.   	es->err_line[es->top]=line;

crypto/err/err.c:695:2: 
  693.   	es->err_flags[es->top]=0;
  694.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
  695. > 	es->err_file[es->top]=file;
  696.   	es->err_line[es->top]=line;
  697.   	err_clear_data(es,es->top);

crypto/err/err.c:696:2: 
  694.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
  695.   	es->err_file[es->top]=file;
  696. > 	es->err_line[es->top]=line;
  697.   	err_clear_data(es,es->top);
  698.   	}

crypto/err/err.c:697:2: Taking true branch
  695.   	es->err_file[es->top]=file;
  696.   	es->err_line[es->top]=line;
  697.   	err_clear_data(es,es->top);
          ^
  698.   	}
  699.   

crypto/err/err.c:697:2: Taking false branch
  695.   	es->err_file[es->top]=file;
  696.   	es->err_line[es->top]=line;
  697.   	err_clear_data(es,es->top);
          ^
  698.   	}
  699.   

crypto/err/err.c:697:2: Loop condition is false. Leaving loop
  695.   	es->err_file[es->top]=file;
  696.   	es->err_line[es->top]=line;
  697.   	err_clear_data(es,es->top);
          ^
  698.   	}
  699.   

crypto/err/err.c:698:2: return from a call to ERR_put_error
  696.   	es->err_line[es->top]=line;
  697.   	err_clear_data(es,es->top);
  698.   	}
          ^
  699.   
  700.   void ERR_clear_error(void)

ssl/s3_srvr.c:2121:1: 
2119.   	ssl3_send_alert(s,SSL3_AL_FATAL,al);
2120.   #if !defined(OPENSSL_NO_DH) || !defined(OPENSSL_NO_RSA) || !defined(OPENSSL_NO_ECDH)
2121. > err:
2122.   #endif
2123.   #ifndef OPENSSL_NO_ECDH

ssl/s3_srvr.c:2124:2: 
2122.   #endif
2123.   #ifndef OPENSSL_NO_ECDH
2124. > 	EVP_PKEY_free(clnt_pub_pkey);
2125.   	EC_POINT_free(clnt_ecpoint);
2126.   	if (srvr_ecdh != NULL) 
