ssl/statem/statem_clnt.c:2983: error: NULL_DEREFERENCE
  pointer `pkey` last assigned on line 2982 could be null and is dereferenced by call to `EVP_PKEY_get0_RSA()` at line 2983, column 9.
Showing all 30 steps of the trace


ssl/statem/statem_clnt.c:2963:1: start of procedure tls_construct_cke_rsa()
2961.   }
2962.   
2963. > static int tls_construct_cke_rsa(SSL *s, WPACKET *pkt)
2964.   {
2965.   #ifndef OPENSSL_NO_RSA

ssl/statem/statem_clnt.c:2966:5: 
2964.   {
2965.   #ifndef OPENSSL_NO_RSA
2966. >     unsigned char *encdata = NULL;
2967.       EVP_PKEY *pkey = NULL;
2968.       EVP_PKEY_CTX *pctx = NULL;

ssl/statem/statem_clnt.c:2967:5: 
2965.   #ifndef OPENSSL_NO_RSA
2966.       unsigned char *encdata = NULL;
2967. >     EVP_PKEY *pkey = NULL;
2968.       EVP_PKEY_CTX *pctx = NULL;
2969.       size_t enclen;

ssl/statem/statem_clnt.c:2968:5: 
2966.       unsigned char *encdata = NULL;
2967.       EVP_PKEY *pkey = NULL;
2968. >     EVP_PKEY_CTX *pctx = NULL;
2969.       size_t enclen;
2970.       unsigned char *pms = NULL;

ssl/statem/statem_clnt.c:2970:5: 
2968.       EVP_PKEY_CTX *pctx = NULL;
2969.       size_t enclen;
2970. >     unsigned char *pms = NULL;
2971.       size_t pmslen = 0;
2972.   

ssl/statem/statem_clnt.c:2971:5: 
2969.       size_t enclen;
2970.       unsigned char *pms = NULL;
2971. >     size_t pmslen = 0;
2972.   
2973.       if (s->session->peer == NULL) {

ssl/statem/statem_clnt.c:2973:9: Taking false branch
2971.       size_t pmslen = 0;
2972.   
2973.       if (s->session->peer == NULL) {
                ^
2974.           /*
2975.            * We should always have a server certificate with SSL_kRSA.

ssl/statem/statem_clnt.c:2982:5: 
2980.       }
2981.   
2982. >     pkey = X509_get0_pubkey(s->session->peer);
2983.       if (EVP_PKEY_get0_RSA(pkey) == NULL) {
2984.           SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CKE_RSA,

crypto/x509/x509_cmp.c:264:1: start of procedure X509_get0_pubkey()
  262.   }
  263.   
  264. > EVP_PKEY *X509_get0_pubkey(const X509 *x)
  265.   {
  266.       if (x == NULL)

crypto/x509/x509_cmp.c:266:9: Taking false branch
  264.   EVP_PKEY *X509_get0_pubkey(const X509 *x)
  265.   {
  266.       if (x == NULL)
                 ^
  267.           return NULL;
  268.       return X509_PUBKEY_get0(x->cert_info.key);

crypto/x509/x509_cmp.c:268:5: 
  266.       if (x == NULL)
  267.           return NULL;
  268. >     return X509_PUBKEY_get0(x->cert_info.key);
  269.   }
  270.   

crypto/x509/x_pubkey.c:140:1: start of procedure X509_PUBKEY_get0()
    138.   }
    139.   
    140. > EVP_PKEY *X509_PUBKEY_get0(X509_PUBKEY *key)
    141.   {
    142.       EVP_PKEY *ret = NULL;

crypto/x509/x_pubkey.c:142:5: 
    140.   EVP_PKEY *X509_PUBKEY_get0(X509_PUBKEY *key)
    141.   {
    142. >     EVP_PKEY *ret = NULL;
    143.   
    144.       if (key == NULL || key->public_key == NULL)

crypto/x509/x_pubkey.c:144:9: Taking false branch
    142.       EVP_PKEY *ret = NULL;
    143.   
    144.       if (key == NULL || key->public_key == NULL)
                   ^
    145.           return NULL;
    146.   

crypto/x509/x_pubkey.c:144:24: Taking false branch
    142.       EVP_PKEY *ret = NULL;
    143.   
    144.       if (key == NULL || key->public_key == NULL)
                                  ^
    145.           return NULL;
    146.   

crypto/x509/x_pubkey.c:147:9: Taking false branch
    145.           return NULL;
    146.   
    147.       if (key->pkey != NULL)
                   ^
    148.           return key->pkey;
    149.   

crypto/x509/x_pubkey.c:158:5: 
    156.        * in the queue.
    157.        */
    158. >     x509_pubkey_decode(&ret, key);
    159.       /* If decode doesn't fail something bad happened */
    160.       if (ret != NULL) {

crypto/x509/x_pubkey.c:103:1: start of procedure x509_pubkey_decode()
      101.   
      102.   
      103. > static int x509_pubkey_decode(EVP_PKEY **ppkey, X509_PUBKEY *key)
      104.   {
      105.       EVP_PKEY *pkey = EVP_PKEY_new();

crypto/x509/x_pubkey.c:105:5: Skipping EVP_PKEY_new(): empty list of specs
      103.   static int x509_pubkey_decode(EVP_PKEY **ppkey, X509_PUBKEY *key)
      104.   {
      105.       EVP_PKEY *pkey = EVP_PKEY_new();
                 ^
      106.   
      107.       if (pkey == NULL) {

crypto/x509/x_pubkey.c:107:9: Taking true branch
      105.       EVP_PKEY *pkey = EVP_PKEY_new();
      106.   
      107.       if (pkey == NULL) {
                     ^
      108.           X509err(X509_F_X509_PUBKEY_DECODE, ERR_R_MALLOC_FAILURE);
      109.           return -1;

crypto/x509/x_pubkey.c:108:9: Skipping ERR_put_error(): empty list of specs
      106.   
      107.       if (pkey == NULL) {
      108.           X509err(X509_F_X509_PUBKEY_DECODE, ERR_R_MALLOC_FAILURE);
                     ^
      109.           return -1;
      110.       }

crypto/x509/x_pubkey.c:109:9: 
      107.       if (pkey == NULL) {
      108.           X509err(X509_F_X509_PUBKEY_DECODE, ERR_R_MALLOC_FAILURE);
      109. >         return -1;
      110.       }
      111.   

crypto/x509/x_pubkey.c:138:1: return from a call to x509_pubkey_decode
      136.       EVP_PKEY_free(pkey);
      137.       return 0;
      138. > }
      139.   
      140.   EVP_PKEY *X509_PUBKEY_get0(X509_PUBKEY *key)

crypto/x509/x_pubkey.c:160:9: Taking false branch
    158.       x509_pubkey_decode(&ret, key);
    159.       /* If decode doesn't fail something bad happened */
    160.       if (ret != NULL) {
                   ^
    161.           X509err(X509_F_X509_PUBKEY_GET0, ERR_R_INTERNAL_ERROR);
    162.           EVP_PKEY_free(ret);

crypto/x509/x_pubkey.c:165:5: 
    163.       }
    164.   
    165. >     return NULL;
    166.   }
    167.   

crypto/x509/x_pubkey.c:166:1: return from a call to X509_PUBKEY_get0
    164.   
    165.       return NULL;
    166. > }
    167.   
    168.   EVP_PKEY *X509_PUBKEY_get(X509_PUBKEY *key)

crypto/x509/x509_cmp.c:269:1: return from a call to X509_get0_pubkey
  267.           return NULL;
  268.       return X509_PUBKEY_get0(x->cert_info.key);
  269. > }
  270.   
  271.   EVP_PKEY *X509_get_pubkey(X509 *x)

ssl/statem/statem_clnt.c:2983:9: 
2981.   
2982.       pkey = X509_get0_pubkey(s->session->peer);
2983. >     if (EVP_PKEY_get0_RSA(pkey) == NULL) {
2984.           SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CKE_RSA,
2985.                    ERR_R_INTERNAL_ERROR);

crypto/evp/p_lib.c:463:1: start of procedure EVP_PKEY_get0_RSA()
  461.   }
  462.   
  463. > RSA *EVP_PKEY_get0_RSA(EVP_PKEY *pkey)
  464.   {
  465.       if (pkey->type != EVP_PKEY_RSA) {

crypto/evp/p_lib.c:465:9: 
  463.   RSA *EVP_PKEY_get0_RSA(EVP_PKEY *pkey)
  464.   {
  465. >     if (pkey->type != EVP_PKEY_RSA) {
  466.           EVPerr(EVP_F_EVP_PKEY_GET0_RSA, EVP_R_EXPECTING_AN_RSA_KEY);
  467.           return NULL;
