ssl/s3_clnt.c:956: error: NULL_DEREFERENCE
  pointer `pkey` last assigned on line 787 could be null and is dereferenced by call to `EVP_PKEY_free()` at line 956, column 2.
Showing all 51 steps of the trace


ssl/s3_clnt.c:778:1: start of procedure ssl3_get_server_certificate()
776.   	}
777.   
778. > static int ssl3_get_server_certificate(SSL *s)
779.   	{
780.   	int al,i,ok,ret= -1;

ssl/s3_clnt.c:780:2: 
778.   static int ssl3_get_server_certificate(SSL *s)
779.   	{
780. > 	int al,i,ok,ret= -1;
781.   	unsigned long n,nc,llen,l;
782.   	X509 *x=NULL;

ssl/s3_clnt.c:782:2: 
780.   	int al,i,ok,ret= -1;
781.   	unsigned long n,nc,llen,l;
782. > 	X509 *x=NULL;
783.   	const unsigned char *q,*p;
784.   	unsigned char *d;

ssl/s3_clnt.c:785:2: 
783.   	const unsigned char *q,*p;
784.   	unsigned char *d;
785. > 	STACK_OF(X509) *sk=NULL;
786.   	SESS_CERT *sc;
787.   	EVP_PKEY *pkey=NULL;

ssl/s3_clnt.c:787:2: 
785.   	STACK_OF(X509) *sk=NULL;
786.   	SESS_CERT *sc;
787. > 	EVP_PKEY *pkey=NULL;
788.   	int need_cert = 1; /* VRS: 0=> will allow null cert if auth == KRB5 */
789.   

ssl/s3_clnt.c:788:2: 
786.   	SESS_CERT *sc;
787.   	EVP_PKEY *pkey=NULL;
788. > 	int need_cert = 1; /* VRS: 0=> will allow null cert if auth == KRB5 */
789.   
790.   	n=ssl3_get_message(s,

ssl/s3_clnt.c:790:2: Skipping ssl3_get_message(): empty list of specs
788.   	int need_cert = 1; /* VRS: 0=> will allow null cert if auth == KRB5 */
789.   
790.   	n=ssl3_get_message(s,
        ^
791.   		SSL3_ST_CR_CERT_A,
792.   		SSL3_ST_CR_CERT_B,

ssl/s3_clnt.c:797:7: Taking false branch
795.   		&ok);
796.   
797.   	if (!ok) return((int)n);
             ^
798.   
799.   	if (s->s3->tmp.message_type == SSL3_MT_SERVER_KEY_EXCHANGE)

ssl/s3_clnt.c:799:6: Taking false branch
797.   	if (!ok) return((int)n);
798.   
799.   	if (s->s3->tmp.message_type == SSL3_MT_SERVER_KEY_EXCHANGE)
            ^
800.   		{
801.   		s->s3->tmp.reuse_message=1;

ssl/s3_clnt.c:805:6: Taking false branch
803.   		}
804.   
805.   	if (s->s3->tmp.message_type != SSL3_MT_CERTIFICATE)
            ^
806.   		{
807.   		al=SSL_AD_UNEXPECTED_MESSAGE;

ssl/s3_clnt.c:811:2: 
809.   		goto f_err;
810.   		}
811. > 	p=d=(unsigned char *)s->init_msg;
812.   
813.   	if ((sk=sk_X509_new_null()) == NULL)

ssl/s3_clnt.c:813:6: 
811.   	p=d=(unsigned char *)s->init_msg;
812.   
813. > 	if ((sk=sk_X509_new_null()) == NULL)
814.   		{
815.   		SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,ERR_R_MALLOC_FAILURE);

crypto/stack/stack.c:115:1: start of procedure sk_new_null()
  113.   	}
  114.   
  115. > STACK *sk_new_null(void)
  116.   	{
  117.   	return sk_new((int (*)(const char * const *, const char * const *))0);

crypto/stack/stack.c:117:2: 
  115.   STACK *sk_new_null(void)
  116.   	{
  117. > 	return sk_new((int (*)(const char * const *, const char * const *))0);
  118.   	}
  119.   

crypto/stack/stack.c:120:1: start of procedure sk_new()
    118.   	}
    119.   
    120. > STACK *sk_new(int (*c)(const char * const *, const char * const *))
    121.   	{
    122.   	STACK *ret;

crypto/stack/stack.c:125:6: 
    123.   	int i;
    124.   
    125. > 	if ((ret=(STACK *)OPENSSL_malloc(sizeof(STACK))) == NULL)
    126.   		goto err;
    127.   	if ((ret->data=(char **)OPENSSL_malloc(sizeof(char *)*MIN_NODES)) == NULL)

crypto/mem.c:291:1: start of procedure CRYPTO_malloc()
      289.   	}
      290.   
      291. > void *CRYPTO_malloc(int num, const char *file, int line)
      292.   	{
      293.   	void *ret = NULL;

crypto/mem.c:293:2: 
      291.   void *CRYPTO_malloc(int num, const char *file, int line)
      292.   	{
      293. > 	void *ret = NULL;
      294.   	extern unsigned char cleanse_ctr;
      295.   

crypto/mem.c:296:6: Taking false branch
      294.   	extern unsigned char cleanse_ctr;
      295.   
      296.   	if (num <= 0) return NULL;
                  ^
      297.   
      298.   	allow_customize = 0;

crypto/mem.c:298:2: 
      296.   	if (num <= 0) return NULL;
      297.   
      298. > 	allow_customize = 0;
      299.   	if (malloc_debug_func != NULL)
      300.   		{

crypto/mem.c:299:6: Taking true branch
      297.   
      298.   	allow_customize = 0;
      299.   	if (malloc_debug_func != NULL)
                  ^
      300.   		{
      301.   		allow_customize_debug = 0;

crypto/mem.c:301:3: 
      299.   	if (malloc_debug_func != NULL)
      300.   		{
      301. > 		allow_customize_debug = 0;
      302.   		malloc_debug_func(NULL, num, file, line, 0);
      303.   		}

crypto/mem.c:302:3: Skipping __function_pointer__(): unresolved function pointer
      300.   		{
      301.   		allow_customize_debug = 0;
      302.   		malloc_debug_func(NULL, num, file, line, 0);
               ^
      303.   		}
      304.   	ret = malloc_ex_func(num,file,line);

crypto/mem.c:304:2: Skipping __function_pointer__(): unresolved function pointer
      302.   		malloc_debug_func(NULL, num, file, line, 0);
      303.   		}
      304.   	ret = malloc_ex_func(num,file,line);
              ^
      305.   #ifdef LEVITTE_DEBUG_MEM
      306.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);

crypto/mem.c:308:6: Taking true branch
      306.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);
      307.   #endif
      308.   	if (malloc_debug_func != NULL)
                  ^
      309.   		malloc_debug_func(ret, num, file, line, 1);
      310.   

crypto/mem.c:309:3: Skipping __function_pointer__(): unresolved function pointer
      307.   #endif
      308.   	if (malloc_debug_func != NULL)
      309.   		malloc_debug_func(ret, num, file, line, 1);
               ^
      310.   
      311.           /* Create a dependency on the value of 'cleanse_ctr' so our memory

crypto/mem.c:314:12: Taking false branch
      312.            * sanitisation function can't be optimised out. NB: We only do
      313.            * this for >2Kb so the overhead doesn't bother us. */
      314.           if(ret && (num > 2048))
                        ^
      315.                   ((unsigned char *)ret)[0] = cleanse_ctr;
      316.   

crypto/mem.c:317:2: 
      315.                   ((unsigned char *)ret)[0] = cleanse_ctr;
      316.   
      317. > 	return ret;
      318.   	}
      319.   

crypto/mem.c:318:2: return from a call to CRYPTO_malloc
      316.   
      317.   	return ret;
      318.   	}
              ^
      319.   
      320.   void *CRYPTO_realloc(void *str, int num, const char *file, int line)

crypto/stack/stack.c:125:6: Taking true branch
    123.   	int i;
    124.   
    125.   	if ((ret=(STACK *)OPENSSL_malloc(sizeof(STACK))) == NULL)
                ^
    126.   		goto err;
    127.   	if ((ret->data=(char **)OPENSSL_malloc(sizeof(char *)*MIN_NODES)) == NULL)

crypto/stack/stack.c:136:1: 
    134.   	ret->sorted=0;
    135.   	return(ret);
    136. > err:
    137.   	if(ret)
    138.   		OPENSSL_free(ret);

crypto/stack/stack.c:137:5: Taking false branch
    135.   	return(ret);
    136.   err:
    137.   	if(ret)
               ^
    138.   		OPENSSL_free(ret);
    139.   	return(NULL);

crypto/stack/stack.c:139:2: 
    137.   	if(ret)
    138.   		OPENSSL_free(ret);
    139. > 	return(NULL);
    140.   	}
    141.   

crypto/stack/stack.c:140:2: return from a call to sk_new
    138.   		OPENSSL_free(ret);
    139.   	return(NULL);
    140.   	}
            ^
    141.   
    142.   int sk_insert(STACK *st, char *data, int loc)

crypto/stack/stack.c:118:2: return from a call to sk_new_null
  116.   	{
  117.   	return sk_new((int (*)(const char * const *, const char * const *))0);
  118.   	}
          ^
  119.   
  120.   STACK *sk_new(int (*c)(const char * const *, const char * const *))

ssl/s3_clnt.c:813:6: Taking true branch
811.   	p=d=(unsigned char *)s->init_msg;
812.   
813.   	if ((sk=sk_X509_new_null()) == NULL)
            ^
814.   		{
815.   		SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,ERR_R_MALLOC_FAILURE);

ssl/s3_clnt.c:815:3: 
813.   	if ((sk=sk_X509_new_null()) == NULL)
814.   		{
815. > 		SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,ERR_R_MALLOC_FAILURE);
816.   		goto err;
817.   		}

crypto/err/err.c:664:1: start of procedure ERR_put_error()
  662.   /********************************************************/
  663.   
  664. > void ERR_put_error(int lib, int func, int reason, const char *file,
  665.   	     int line)
  666.   	{

crypto/err/err.c:688:2: Skipping ERR_get_state(): empty list of specs
  686.   	}
  687.   #endif
  688.   	es=ERR_get_state();
          ^
  689.   
  690.   	es->top=(es->top+1)%ERR_NUM_ERRORS;

crypto/err/err.c:690:2: 
  688.   	es=ERR_get_state();
  689.   
  690. > 	es->top=(es->top+1)%ERR_NUM_ERRORS;
  691.   	if (es->top == es->bottom)
  692.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;

crypto/err/err.c:691:6: Taking false branch
  689.   
  690.   	es->top=(es->top+1)%ERR_NUM_ERRORS;
  691.   	if (es->top == es->bottom)
              ^
  692.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
  693.   	es->err_flags[es->top]=0;

crypto/err/err.c:693:2: 
  691.   	if (es->top == es->bottom)
  692.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
  693. > 	es->err_flags[es->top]=0;
  694.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
  695.   	es->err_file[es->top]=file;

crypto/err/err.c:694:2: 
  692.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
  693.   	es->err_flags[es->top]=0;
  694. > 	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
  695.   	es->err_file[es->top]=file;
  696.   	es->err_line[es->top]=line;

crypto/err/err.c:695:2: 
  693.   	es->err_flags[es->top]=0;
  694.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
  695. > 	es->err_file[es->top]=file;
  696.   	es->err_line[es->top]=line;
  697.   	err_clear_data(es,es->top);

crypto/err/err.c:696:2: 
  694.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
  695.   	es->err_file[es->top]=file;
  696. > 	es->err_line[es->top]=line;
  697.   	err_clear_data(es,es->top);
  698.   	}

crypto/err/err.c:697:2: Taking true branch
  695.   	es->err_file[es->top]=file;
  696.   	es->err_line[es->top]=line;
  697.   	err_clear_data(es,es->top);
          ^
  698.   	}
  699.   

crypto/err/err.c:697:2: Taking false branch
  695.   	es->err_file[es->top]=file;
  696.   	es->err_line[es->top]=line;
  697.   	err_clear_data(es,es->top);
          ^
  698.   	}
  699.   

crypto/err/err.c:697:2: Loop condition is false. Leaving loop
  695.   	es->err_file[es->top]=file;
  696.   	es->err_line[es->top]=line;
  697.   	err_clear_data(es,es->top);
          ^
  698.   	}
  699.   

crypto/err/err.c:698:2: return from a call to ERR_put_error
  696.   	es->err_line[es->top]=line;
  697.   	err_clear_data(es,es->top);
  698.   	}
          ^
  699.   
  700.   void ERR_clear_error(void)

ssl/s3_clnt.c:955:1: 
953.   		ssl3_send_alert(s,SSL3_AL_FATAL,al);
954.   		}
955. > err:
956.   	EVP_PKEY_free(pkey);
957.   	X509_free(x);

ssl/s3_clnt.c:956:2: 
954.   		}
955.   err:
956. > 	EVP_PKEY_free(pkey);
957.   	X509_free(x);
958.   	sk_X509_pop_free(sk,X509_free);
