ssl/t1_lib.c:2314: error: NULL_DEREFERENCE
  pointer `ec` last assigned on line 2312 could be null and is dereferenced by call to `EC_KEY_get0_group()` at line 2314, column 53.
Showing all 32 steps of the trace


ssl/t1_lib.c:2278:1: start of procedure tls_choose_sigalg()
2276.    * Set current certificate and digest to match chosen algorithm.
2277.    */
2278. > int tls_choose_sigalg(SSL *s)
2279.   {
2280.       if (SSL_IS_TLS13(s)) {

ssl/t1_lib.c:2280:9: Taking true branch
2278.   int tls_choose_sigalg(SSL *s)
2279.   {
2280.       if (SSL_IS_TLS13(s)) {
                ^
2281.           size_t i;
2282.   #ifndef OPENSSL_NO_EC

ssl/t1_lib.c:2280:9: Taking true branch
2278.   int tls_choose_sigalg(SSL *s)
2279.   {
2280.       if (SSL_IS_TLS13(s)) {
                ^
2281.           size_t i;
2282.   #ifndef OPENSSL_NO_EC

ssl/t1_lib.c:2280:9: Taking true branch
2278.   int tls_choose_sigalg(SSL *s)
2279.   {
2280.       if (SSL_IS_TLS13(s)) {
                ^
2281.           size_t i;
2282.   #ifndef OPENSSL_NO_EC

ssl/t1_lib.c:2283:9: 
2281.           size_t i;
2282.   #ifndef OPENSSL_NO_EC
2283. >         int curve = -1;
2284.   #endif
2285.   

ssl/t1_lib.c:2287:14: 
2285.   
2286.           /* Look for a certificate matching shared sigaglgs */
2287. >         for (i = 0; i < s->cert->shared_sigalgslen; i++) {
2288.               const SIGALG_LOOKUP *lu = s->cert->shared_sigalgs[i];
2289.               int idx;

ssl/t1_lib.c:2287:21: Loop condition is true. Entering loop body
2285.   
2286.           /* Look for a certificate matching shared sigaglgs */
2287.           for (i = 0; i < s->cert->shared_sigalgslen; i++) {
                            ^
2288.               const SIGALG_LOOKUP *lu = s->cert->shared_sigalgs[i];
2289.               int idx;

ssl/t1_lib.c:2288:13: 
2286.           /* Look for a certificate matching shared sigaglgs */
2287.           for (i = 0; i < s->cert->shared_sigalgslen; i++) {
2288. >             const SIGALG_LOOKUP *lu = s->cert->shared_sigalgs[i];
2289.               int idx;
2290.               const EVP_MD *md;

ssl/t1_lib.c:2294:17: Taking false branch
2292.   
2293.               /* Skip RSA if not PSS */
2294.               if (lu->sig == EVP_PKEY_RSA)
                        ^
2295.                   continue;
2296.               md = ssl_md(lu->hash_idx);

ssl/t1_lib.c:2296:13: 
2294.               if (lu->sig == EVP_PKEY_RSA)
2295.                   continue;
2296. >             md = ssl_md(lu->hash_idx);
2297.               if (md == NULL)
2298.                   continue;

ssl/ssl_ciph.c:609:1: start of procedure ssl_md()
  607.   }
  608.   
  609. > const EVP_MD *ssl_md(int idx)
  610.   {
  611.       idx &= SSL_HANDSHAKE_MAC_MASK;

ssl/ssl_ciph.c:611:5: 
  609.   const EVP_MD *ssl_md(int idx)
  610.   {
  611. >     idx &= SSL_HANDSHAKE_MAC_MASK;
  612.       if (idx < 0 || idx >= SSL_MD_NUM_IDX)
  613.           return NULL;

ssl/ssl_ciph.c:612:9: Taking false branch
  610.   {
  611.       idx &= SSL_HANDSHAKE_MAC_MASK;
  612.       if (idx < 0 || idx >= SSL_MD_NUM_IDX)
                 ^
  613.           return NULL;
  614.       return ssl_digest_methods[idx];

ssl/ssl_ciph.c:612:20: Taking false branch
  610.   {
  611.       idx &= SSL_HANDSHAKE_MAC_MASK;
  612.       if (idx < 0 || idx >= SSL_MD_NUM_IDX)
                            ^
  613.           return NULL;
  614.       return ssl_digest_methods[idx];

ssl/ssl_ciph.c:614:5: 
  612.       if (idx < 0 || idx >= SSL_MD_NUM_IDX)
  613.           return NULL;
  614. >     return ssl_digest_methods[idx];
  615.   }
  616.   

ssl/ssl_ciph.c:615:1: return from a call to ssl_md
  613.           return NULL;
  614.       return ssl_digest_methods[idx];
  615. > }
  616.   
  617.   const EVP_MD *ssl_handshake_md(SSL *s)

ssl/t1_lib.c:2297:17: Taking false branch
2295.                   continue;
2296.               md = ssl_md(lu->hash_idx);
2297.               if (md == NULL)
                        ^
2298.                   continue;
2299.               idx = lu->sig_idx;

ssl/t1_lib.c:2299:13: 
2297.               if (md == NULL)
2298.                   continue;
2299. >             idx = lu->sig_idx;
2300.               c = &s->cert->pkeys[idx];
2301.               if (c->x509 == NULL || c->privatekey == NULL) {

ssl/t1_lib.c:2300:13: 
2298.                   continue;
2299.               idx = lu->sig_idx;
2300. >             c = &s->cert->pkeys[idx];
2301.               if (c->x509 == NULL || c->privatekey == NULL) {
2302.                   if (idx != SSL_PKEY_RSA_SIGN)

ssl/t1_lib.c:2301:17: Taking false branch
2299.               idx = lu->sig_idx;
2300.               c = &s->cert->pkeys[idx];
2301.               if (c->x509 == NULL || c->privatekey == NULL) {
                        ^
2302.                   if (idx != SSL_PKEY_RSA_SIGN)
2303.                       continue;

ssl/t1_lib.c:2301:36: Taking false branch
2299.               idx = lu->sig_idx;
2300.               c = &s->cert->pkeys[idx];
2301.               if (c->x509 == NULL || c->privatekey == NULL) {
                                           ^
2302.                   if (idx != SSL_PKEY_RSA_SIGN)
2303.                       continue;

ssl/t1_lib.c:2309:17: Taking true branch
2307.                       continue;
2308.               }
2309.               if (lu->sig == EVP_PKEY_EC) {
                        ^
2310.   #ifndef OPENSSL_NO_EC
2311.                   if (curve == -1) {

ssl/t1_lib.c:2311:21: Taking true branch
2309.               if (lu->sig == EVP_PKEY_EC) {
2310.   #ifndef OPENSSL_NO_EC
2311.                   if (curve == -1) {
                            ^
2312.                       EC_KEY *ec = EVP_PKEY_get0_EC_KEY(c->privatekey);
2313.   

ssl/t1_lib.c:2312:21: 
2310.   #ifndef OPENSSL_NO_EC
2311.                   if (curve == -1) {
2312. >                     EC_KEY *ec = EVP_PKEY_get0_EC_KEY(c->privatekey);
2313.   
2314.                       curve = EC_GROUP_get_curve_name(EC_KEY_get0_group(ec));

crypto/evp/p_lib.c:345:1: start of procedure EVP_PKEY_get0_EC_KEY()
  343.   }
  344.   
  345. > EC_KEY *EVP_PKEY_get0_EC_KEY(EVP_PKEY *pkey)
  346.   {
  347.       if (pkey->type != EVP_PKEY_EC) {

crypto/evp/p_lib.c:347:9: Taking true branch
  345.   EC_KEY *EVP_PKEY_get0_EC_KEY(EVP_PKEY *pkey)
  346.   {
  347.       if (pkey->type != EVP_PKEY_EC) {
                 ^
  348.           EVPerr(EVP_F_EVP_PKEY_GET0_EC_KEY, EVP_R_EXPECTING_A_EC_KEY);
  349.           return NULL;

crypto/evp/p_lib.c:348:9: Skipping ERR_put_error(): empty list of specs
  346.   {
  347.       if (pkey->type != EVP_PKEY_EC) {
  348.           EVPerr(EVP_F_EVP_PKEY_GET0_EC_KEY, EVP_R_EXPECTING_A_EC_KEY);
                 ^
  349.           return NULL;
  350.       }

crypto/evp/p_lib.c:349:9: 
  347.       if (pkey->type != EVP_PKEY_EC) {
  348.           EVPerr(EVP_F_EVP_PKEY_GET0_EC_KEY, EVP_R_EXPECTING_A_EC_KEY);
  349. >         return NULL;
  350.       }
  351.       return pkey->pkey.ec;

crypto/evp/p_lib.c:352:1: return from a call to EVP_PKEY_get0_EC_KEY
  350.       }
  351.       return pkey->pkey.ec;
  352. > }
  353.   
  354.   EC_KEY *EVP_PKEY_get1_EC_KEY(EVP_PKEY *pkey)

ssl/t1_lib.c:2314:21: 
2312.                       EC_KEY *ec = EVP_PKEY_get0_EC_KEY(c->privatekey);
2313.   
2314. >                     curve = EC_GROUP_get_curve_name(EC_KEY_get0_group(ec));
2315.                   }
2316.                   if (curve != lu->curve)

crypto/ec/ec_key.c:419:1: start of procedure EC_KEY_get0_group()
  417.   }
  418.   
  419. > const EC_GROUP *EC_KEY_get0_group(const EC_KEY *key)
  420.   {
  421.       return key->group;

crypto/ec/ec_key.c:421:5: 
  419.   const EC_GROUP *EC_KEY_get0_group(const EC_KEY *key)
  420.   {
  421. >     return key->group;
  422.   }
  423.   
