ssl/s3_srvr.c:1561: error: NULL_DEREFERENCE
  pointer `pkey` last assigned on line 1448 could be null and is dereferenced by call to `EVP_PKEY_free()` at line 1561, column 2.
Showing all 61 steps of the trace


ssl/s3_srvr.c:1427:1: start of procedure ssl3_get_cert_verify()
1425.   	}
1426.   
1427. > static int ssl3_get_cert_verify(SSL *s)
1428.   	{
1429.   	EVP_PKEY *pkey=NULL;

ssl/s3_srvr.c:1429:2: 
1427.   static int ssl3_get_cert_verify(SSL *s)
1428.   	{
1429. > 	EVP_PKEY *pkey=NULL;
1430.   	unsigned char *p;
1431.   	int al,ok,ret=0;

ssl/s3_srvr.c:1431:2: 
1429.   	EVP_PKEY *pkey=NULL;
1430.   	unsigned char *p;
1431. > 	int al,ok,ret=0;
1432.   	long n;
1433.   	int type=0,i,j;

ssl/s3_srvr.c:1433:2: 
1431.   	int al,ok,ret=0;
1432.   	long n;
1433. > 	int type=0,i,j;
1434.   	X509 *peer;
1435.   

ssl/s3_srvr.c:1436:2: Skipping ssl3_get_message(): empty list of specs
1434.   	X509 *peer;
1435.   
1436.   	n=ssl3_get_message(s,
         ^
1437.   		SSL3_ST_SR_CERT_VRFY_A,
1438.   		SSL3_ST_SR_CERT_VRFY_B,

ssl/s3_srvr.c:1443:7: Taking false branch
1441.   		&ok);
1442.   
1443.   	if (!ok) return((int)n);
              ^
1444.   
1445.   	if (s->session->peer != NULL)

ssl/s3_srvr.c:1445:6: Taking true branch
1443.   	if (!ok) return((int)n);
1444.   
1445.   	if (s->session->peer != NULL)
             ^
1446.   		{
1447.   		peer=s->session->peer;

ssl/s3_srvr.c:1447:3: 
1445.   	if (s->session->peer != NULL)
1446.   		{
1447. > 		peer=s->session->peer;
1448.   		pkey=X509_get_pubkey(peer);
1449.   		type=X509_certificate_type(peer,pkey);

ssl/s3_srvr.c:1448:3: 
1446.   		{
1447.   		peer=s->session->peer;
1448. > 		pkey=X509_get_pubkey(peer);
1449.   		type=X509_certificate_type(peer,pkey);
1450.   		}

crypto/x509/x509_cmp.c:254:1: start of procedure X509_get_pubkey()
  252.   	}
  253.   
  254. > EVP_PKEY *X509_get_pubkey(X509 *x)
  255.   	{
  256.   	if ((x == NULL) || (x->cert_info == NULL))

crypto/x509/x509_cmp.c:256:7: Taking false branch
  254.   EVP_PKEY *X509_get_pubkey(X509 *x)
  255.   	{
  256.   	if ((x == NULL) || (x->cert_info == NULL))
               ^
  257.   		return(NULL);
  258.   	return(X509_PUBKEY_get(x->cert_info->key));

crypto/x509/x509_cmp.c:256:22: Taking true branch
  254.   EVP_PKEY *X509_get_pubkey(X509 *x)
  255.   	{
  256.   	if ((x == NULL) || (x->cert_info == NULL))
                              ^
  257.   		return(NULL);
  258.   	return(X509_PUBKEY_get(x->cert_info->key));

crypto/x509/x509_cmp.c:257:3: 
  255.   	{
  256.   	if ((x == NULL) || (x->cert_info == NULL))
  257. > 		return(NULL);
  258.   	return(X509_PUBKEY_get(x->cert_info->key));
  259.   	}

crypto/x509/x509_cmp.c:259:2: return from a call to X509_get_pubkey
  257.   		return(NULL);
  258.   	return(X509_PUBKEY_get(x->cert_info->key));
  259.   	}
          ^
  260.   
  261.   int X509_check_private_key(X509 *x, EVP_PKEY *k)

ssl/s3_srvr.c:1449:3: Skipping X509_certificate_type(): empty list of specs
1447.   		peer=s->session->peer;
1448.   		pkey=X509_get_pubkey(peer);
1449.   		type=X509_certificate_type(peer,pkey);
          ^
1450.   		}
1451.   	else

ssl/s3_srvr.c:1457:6: Taking false branch
1455.   		}
1456.   
1457.   	if (s->s3->tmp.message_type != SSL3_MT_CERTIFICATE_VERIFY)
             ^
1458.   		{
1459.   		s->s3->tmp.reuse_message=1;

ssl/s3_srvr.c:1470:6: Taking false branch
1468.   		}
1469.   
1470.   	if (peer == NULL)
             ^
1471.   		{
1472.   		SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_NO_CLIENT_CERT_RECEIVED);

ssl/s3_srvr.c:1477:8: Taking false branch
1475.   		}
1476.   
1477.   	if (!(type & EVP_PKT_SIGN))
               ^
1478.   		{
1479.   		SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_SIGNATURE_FOR_NON_SIGNING_CERTIFICATE);

ssl/s3_srvr.c:1484:6: Taking false branch
1482.   		}
1483.   
1484.   	if (s->s3->change_cipher_spec)
             ^
1485.   		{
1486.   		SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_CCS_RECEIVED_EARLY);

ssl/s3_srvr.c:1492:2: 
1490.   
1491.   	/* we now have a signature that we need to verify */
1492. > 	p=(unsigned char *)s->init_buf->data;
1493.   	n2s(p,i);
1494.   	n-=2;

ssl/s3_srvr.c:1493:2: 
1491.   	/* we now have a signature that we need to verify */
1492.   	p=(unsigned char *)s->init_buf->data;
1493. > 	n2s(p,i);
1494.   	n-=2;
1495.   	if (i > n)

ssl/s3_srvr.c:1494:2: 
1492.   	p=(unsigned char *)s->init_buf->data;
1493.   	n2s(p,i);
1494. > 	n-=2;
1495.   	if (i > n)
1496.   		{

ssl/s3_srvr.c:1495:6: Taking true branch
1493.   	n2s(p,i);
1494.   	n-=2;
1495.   	if (i > n)
             ^
1496.   		{
1497.   		SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_LENGTH_MISMATCH);

ssl/s3_srvr.c:1497:3: 
1495.   	if (i > n)
1496.   		{
1497. > 		SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_LENGTH_MISMATCH);
1498.   		al=SSL_AD_DECODE_ERROR;
1499.   		goto f_err;

crypto/err/err.c:246:1: start of procedure ERR_put_error()
  244.   /********************************************************/
  245.   
  246. > void ERR_put_error(int lib, int func, int reason, const char *file,
  247.   	     int line)
  248.   	{

crypto/err/err.c:270:2: Skipping ERR_get_state(): empty list of specs
  268.   	}
  269.   #endif
  270.   	es=ERR_get_state();
          ^
  271.   
  272.   	es->top=(es->top+1)%ERR_NUM_ERRORS;

crypto/err/err.c:272:2: 
  270.   	es=ERR_get_state();
  271.   
  272. > 	es->top=(es->top+1)%ERR_NUM_ERRORS;
  273.   	if (es->top == es->bottom)
  274.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;

crypto/err/err.c:273:6: Taking false branch
  271.   
  272.   	es->top=(es->top+1)%ERR_NUM_ERRORS;
  273.   	if (es->top == es->bottom)
              ^
  274.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
  275.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);

crypto/err/err.c:275:2: 
  273.   	if (es->top == es->bottom)
  274.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
  275. > 	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
  276.   	es->err_file[es->top]=file;
  277.   	es->err_line[es->top]=line;

crypto/err/err.c:276:2: 
  274.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
  275.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
  276. > 	es->err_file[es->top]=file;
  277.   	es->err_line[es->top]=line;
  278.   	err_clear_data(es,es->top);

crypto/err/err.c:277:2: 
  275.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
  276.   	es->err_file[es->top]=file;
  277. > 	es->err_line[es->top]=line;
  278.   	err_clear_data(es,es->top);
  279.   	}

crypto/err/err.c:278:2: Taking true branch
  276.   	es->err_file[es->top]=file;
  277.   	es->err_line[es->top]=line;
  278.   	err_clear_data(es,es->top);
          ^
  279.   	}
  280.   

crypto/err/err.c:278:2: Taking false branch
  276.   	es->err_file[es->top]=file;
  277.   	es->err_line[es->top]=line;
  278.   	err_clear_data(es,es->top);
          ^
  279.   	}
  280.   

crypto/err/err.c:279:2: return from a call to ERR_put_error
  277.   	es->err_line[es->top]=line;
  278.   	err_clear_data(es,es->top);
  279.   	}
          ^
  280.   
  281.   void ERR_clear_error(void)

ssl/s3_srvr.c:1498:3: 
1496.   		{
1497.   		SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_LENGTH_MISMATCH);
1498. > 		al=SSL_AD_DECODE_ERROR;
1499.   		goto f_err;
1500.   		}

ssl/s3_srvr.c:1557:1: 
1555.   	if (0)
1556.   		{
1557. > f_err:
1558.   		ssl3_send_alert(s,SSL3_AL_FATAL,al);
1559.   		}

ssl/s3_srvr.c:1558:3: 
1556.   		{
1557.   f_err:
1558. > 		ssl3_send_alert(s,SSL3_AL_FATAL,al);
1559.   		}
1560.   end:

ssl/s3_pkt.c:1037:1: start of procedure ssl3_send_alert()
  1035.   	}
  1036.   
  1037. > void ssl3_send_alert(SSL *s, int level, int desc)
  1038.   	{
  1039.   	/* Map tls/ssl alert value to correct one */

ssl/s3_pkt.c:1040:2: Skipping __function_pointer__(): unresolved function pointer
  1038.   	{
  1039.   	/* Map tls/ssl alert value to correct one */
  1040.   	desc=s->method->ssl3_enc->alert_value(desc);
           ^
  1041.   	if (desc < 0) return;
  1042.   	/* If a fatal one, remove from cache */

ssl/s3_pkt.c:1041:6: Taking false branch
  1039.   	/* Map tls/ssl alert value to correct one */
  1040.   	desc=s->method->ssl3_enc->alert_value(desc);
  1041.   	if (desc < 0) return;
               ^
  1042.   	/* If a fatal one, remove from cache */
  1043.   	if ((level == 2) && (s->session != NULL))

ssl/s3_pkt.c:1043:7: Taking true branch
  1041.   	if (desc < 0) return;
  1042.   	/* If a fatal one, remove from cache */
  1043.   	if ((level == 2) && (s->session != NULL))
                ^
  1044.   		SSL_CTX_remove_session(s->ctx,s->session);
  1045.   

ssl/s3_pkt.c:1043:23: Taking true branch
  1041.   	if (desc < 0) return;
  1042.   	/* If a fatal one, remove from cache */
  1043.   	if ((level == 2) && (s->session != NULL))
                                ^
  1044.   		SSL_CTX_remove_session(s->ctx,s->session);
  1045.   

ssl/s3_pkt.c:1044:3: 
  1042.   	/* If a fatal one, remove from cache */
  1043.   	if ((level == 2) && (s->session != NULL))
  1044. > 		SSL_CTX_remove_session(s->ctx,s->session);
  1045.   
  1046.   	s->s3->alert_dispatch=1;

ssl/ssl_sess.c:413:1: start of procedure SSL_CTX_remove_session()
    411.   	}
    412.   
    413. > int SSL_CTX_remove_session(SSL_CTX *ctx, SSL_SESSION *c)
    414.   {
    415.   	return remove_session_lock(ctx, c, 1);

ssl/ssl_sess.c:415:2: 
    413.   int SSL_CTX_remove_session(SSL_CTX *ctx, SSL_SESSION *c)
    414.   {
    415. > 	return remove_session_lock(ctx, c, 1);
    416.   }
    417.   

ssl/ssl_sess.c:418:1: start of procedure remove_session_lock()
      416.   }
      417.   
      418. > static int remove_session_lock(SSL_CTX *ctx, SSL_SESSION *c, int lck)
      419.   	{
      420.   	SSL_SESSION *r;

ssl/ssl_sess.c:421:2: 
      419.   	{
      420.   	SSL_SESSION *r;
      421. > 	int ret=0;
      422.   
      423.   	if ((c != NULL) && (c->session_id_length != 0))

ssl/ssl_sess.c:423:7: Taking true branch
      421.   	int ret=0;
      422.   
      423.   	if ((c != NULL) && (c->session_id_length != 0))
                   ^
      424.   		{
      425.   		if(lck) CRYPTO_w_lock(CRYPTO_LOCK_SSL_CTX);

ssl/ssl_sess.c:423:22: Taking false branch
      421.   	int ret=0;
      422.   
      423.   	if ((c != NULL) && (c->session_id_length != 0))
                                  ^
      424.   		{
      425.   		if(lck) CRYPTO_w_lock(CRYPTO_LOCK_SSL_CTX);

ssl/ssl_sess.c:444:3: 
      442.   		}
      443.   	else
      444. > 		ret=0;
      445.   	return(ret);
      446.   	}

ssl/ssl_sess.c:445:2: 
      443.   	else
      444.   		ret=0;
      445. > 	return(ret);
      446.   	}
      447.   

ssl/ssl_sess.c:446:2: return from a call to remove_session_lock
      444.   		ret=0;
      445.   	return(ret);
      446.   	}
              ^
      447.   
      448.   void SSL_SESSION_free(SSL_SESSION *ss)

ssl/ssl_sess.c:416:1: return from a call to SSL_CTX_remove_session
    414.   {
    415.   	return remove_session_lock(ctx, c, 1);
    416. > }
    417.   
    418.   static int remove_session_lock(SSL_CTX *ctx, SSL_SESSION *c, int lck)

ssl/s3_pkt.c:1046:2: 
  1044.   		SSL_CTX_remove_session(s->ctx,s->session);
  1045.   
  1046. > 	s->s3->alert_dispatch=1;
  1047.   	s->s3->send_alert[0]=level;
  1048.   	s->s3->send_alert[1]=desc;

ssl/s3_pkt.c:1047:2: 
  1045.   
  1046.   	s->s3->alert_dispatch=1;
  1047. > 	s->s3->send_alert[0]=level;
  1048.   	s->s3->send_alert[1]=desc;
  1049.   	if (s->s3->wbuf.left == 0) /* data still being written out */

ssl/s3_pkt.c:1048:2: 
  1046.   	s->s3->alert_dispatch=1;
  1047.   	s->s3->send_alert[0]=level;
  1048. > 	s->s3->send_alert[1]=desc;
  1049.   	if (s->s3->wbuf.left == 0) /* data still being written out */
  1050.   		ssl3_dispatch_alert(s);

ssl/s3_pkt.c:1049:6: Taking false branch
  1047.   	s->s3->send_alert[0]=level;
  1048.   	s->s3->send_alert[1]=desc;
  1049.   	if (s->s3->wbuf.left == 0) /* data still being written out */
               ^
  1050.   		ssl3_dispatch_alert(s);
  1051.   	/* else data is still being written out, we will get written

ssl/s3_pkt.c:1049:2: 
  1047.   	s->s3->send_alert[0]=level;
  1048.   	s->s3->send_alert[1]=desc;
  1049. > 	if (s->s3->wbuf.left == 0) /* data still being written out */
  1050.   		ssl3_dispatch_alert(s);
  1051.   	/* else data is still being written out, we will get written

ssl/s3_pkt.c:1053:2: return from a call to ssl3_send_alert
  1051.   	/* else data is still being written out, we will get written
  1052.   	 * some time in the future */
  1053.   	}
           ^
  1054.   
  1055.   int ssl3_dispatch_alert(SSL *s)

ssl/s3_srvr.c:1560:1: 
1558.   		ssl3_send_alert(s,SSL3_AL_FATAL,al);
1559.   		}
1560. > end:
1561.   	EVP_PKEY_free(pkey);
1562.   	return(ret);

ssl/s3_srvr.c:1561:2: 
1559.   		}
1560.   end:
1561. > 	EVP_PKEY_free(pkey);
1562.   	return(ret);
1563.   	}
