apps/x509.c:1115: error: NULL_DEREFERENCE
  pointer `upkey` last assigned on line 1114 could be null and is dereferenced by call to `EVP_PKEY_copy_parameters()` at line 1115, column 2.
Showing all 67 steps of the trace


apps/x509.c:1105:1: start of procedure x509_certify()
1103.   	}
1104.   
1105. > static int x509_certify(X509_STORE *ctx, char *CAfile, const EVP_MD *digest,
1106.   	     X509 *x, X509 *xca, EVP_PKEY *pkey, char *serialfile, int create,
1107.   	     int days, int clrext, CONF *conf, char *section, ASN1_INTEGER *sno)

apps/x509.c:1109:2: 
1107.   	     int days, int clrext, CONF *conf, char *section, ASN1_INTEGER *sno)
1108.   	{
1109. > 	int ret=0;
1110.   	ASN1_INTEGER *bs=NULL;
1111.   	X509_STORE_CTX xsc;

apps/x509.c:1110:2: 
1108.   	{
1109.   	int ret=0;
1110. > 	ASN1_INTEGER *bs=NULL;
1111.   	X509_STORE_CTX xsc;
1112.   	EVP_PKEY *upkey;

apps/x509.c:1114:2: 
1112.   	EVP_PKEY *upkey;
1113.   
1114. > 	upkey = X509_get_pubkey(xca);
1115.   	EVP_PKEY_copy_parameters(upkey,pkey);
1116.   	EVP_PKEY_free(upkey);

crypto/x509/x509_cmp.c:258:1: start of procedure X509_get_pubkey()
  256.   	}
  257.   
  258. > EVP_PKEY *X509_get_pubkey(X509 *x)
  259.   	{
  260.   	if ((x == NULL) || (x->cert_info == NULL))

crypto/x509/x509_cmp.c:260:7: Taking false branch
  258.   EVP_PKEY *X509_get_pubkey(X509 *x)
  259.   	{
  260.   	if ((x == NULL) || (x->cert_info == NULL))
               ^
  261.   		return(NULL);
  262.   	return(X509_PUBKEY_get(x->cert_info->key));

crypto/x509/x509_cmp.c:260:22: Taking false branch
  258.   EVP_PKEY *X509_get_pubkey(X509 *x)
  259.   	{
  260.   	if ((x == NULL) || (x->cert_info == NULL))
                              ^
  261.   		return(NULL);
  262.   	return(X509_PUBKEY_get(x->cert_info->key));

crypto/x509/x509_cmp.c:262:2: 
  260.   	if ((x == NULL) || (x->cert_info == NULL))
  261.   		return(NULL);
  262. > 	return(X509_PUBKEY_get(x->cert_info->key));
  263.   	}
  264.   

crypto/asn1/x_pubkey.c:133:1: start of procedure X509_PUBKEY_get()
    131.   	}
    132.   
    133. > EVP_PKEY *X509_PUBKEY_get(X509_PUBKEY *key)
    134.   	{
    135.   	EVP_PKEY *ret=NULL;

crypto/asn1/x_pubkey.c:135:2: 
    133.   EVP_PKEY *X509_PUBKEY_get(X509_PUBKEY *key)
    134.   	{
    135. > 	EVP_PKEY *ret=NULL;
    136.   
    137.   	if (key == NULL) goto error;

crypto/asn1/x_pubkey.c:137:6: Taking false branch
    135.   	EVP_PKEY *ret=NULL;
    136.   
    137.   	if (key == NULL) goto error;
                ^
    138.   
    139.   	if (key->pkey != NULL)

crypto/asn1/x_pubkey.c:139:6: Taking false branch
    137.   	if (key == NULL) goto error;
    138.   
    139.   	if (key->pkey != NULL)
                ^
    140.   		{
    141.   		CRYPTO_add(&key->pkey->references, 1, CRYPTO_LOCK_EVP_PKEY);

crypto/asn1/x_pubkey.c:145:6: Taking false branch
    143.   		}
    144.   
    145.   	if (key->public_key == NULL) goto error;
                ^
    146.   
    147.   	if ((ret = EVP_PKEY_new()) == NULL)

crypto/asn1/x_pubkey.c:147:6: 
    145.   	if (key->public_key == NULL) goto error;
    146.   
    147. > 	if ((ret = EVP_PKEY_new()) == NULL)
    148.   		{
    149.   		X509err(X509_F_X509_PUBKEY_GET, ERR_R_MALLOC_FAILURE);

crypto/evp/p_lib.c:182:1: start of procedure EVP_PKEY_new()
      180.   	}
      181.   
      182. > EVP_PKEY *EVP_PKEY_new(void)
      183.   	{
      184.   	EVP_PKEY *ret;

crypto/evp/p_lib.c:186:2: 
      184.   	EVP_PKEY *ret;
      185.   
      186. > 	ret=(EVP_PKEY *)OPENSSL_malloc(sizeof(EVP_PKEY));
      187.   	if (ret == NULL)
      188.   		{

crypto/mem.c:294:1: start of procedure CRYPTO_malloc()
        292.   	}
        293.   
        294. > void *CRYPTO_malloc(int num, const char *file, int line)
        295.   	{
        296.   	void *ret = NULL;

crypto/mem.c:296:2: 
        294.   void *CRYPTO_malloc(int num, const char *file, int line)
        295.   	{
        296. > 	void *ret = NULL;
        297.   
        298.   	if (num <= 0) return NULL;

crypto/mem.c:298:6: Taking false branch
        296.   	void *ret = NULL;
        297.   
        298.   	if (num <= 0) return NULL;
                    ^
        299.   
        300.   	allow_customize = 0;

crypto/mem.c:300:2: 
        298.   	if (num <= 0) return NULL;
        299.   
        300. > 	allow_customize = 0;
        301.   	if (malloc_debug_func != NULL)
        302.   		{

crypto/mem.c:301:6: Taking true branch
        299.   
        300.   	allow_customize = 0;
        301.   	if (malloc_debug_func != NULL)
                    ^
        302.   		{
        303.   		allow_customize_debug = 0;

crypto/mem.c:303:3: 
        301.   	if (malloc_debug_func != NULL)
        302.   		{
        303. > 		allow_customize_debug = 0;
        304.   		malloc_debug_func(NULL, num, file, line, 0);
        305.   		}

crypto/mem.c:304:3: Skipping __function_pointer__(): unresolved function pointer
        302.   		{
        303.   		allow_customize_debug = 0;
        304.   		malloc_debug_func(NULL, num, file, line, 0);
                 ^
        305.   		}
        306.   	ret = malloc_ex_func(num,file,line);

crypto/mem.c:306:2: Skipping __function_pointer__(): unresolved function pointer
        304.   		malloc_debug_func(NULL, num, file, line, 0);
        305.   		}
        306.   	ret = malloc_ex_func(num,file,line);
                ^
        307.   #ifdef LEVITTE_DEBUG_MEM
        308.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);

crypto/mem.c:310:6: Taking true branch
        308.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);
        309.   #endif
        310.   	if (malloc_debug_func != NULL)
                    ^
        311.   		malloc_debug_func(ret, num, file, line, 1);
        312.   

crypto/mem.c:311:3: Skipping __function_pointer__(): unresolved function pointer
        309.   #endif
        310.   	if (malloc_debug_func != NULL)
        311.   		malloc_debug_func(ret, num, file, line, 1);
                 ^
        312.   
        313.   #ifndef OPENSSL_CPUID_OBJ

crypto/mem.c:317:12: Taking false branch
        315.            * sanitisation function can't be optimised out. NB: We only do
        316.            * this for >2Kb so the overhead doesn't bother us. */
        317.           if(ret && (num > 2048))
                          ^
        318.   	{	extern unsigned char cleanse_ctr;
        319.                   ((unsigned char *)ret)[0] = cleanse_ctr;

crypto/mem.c:323:2: 
        321.   #endif
        322.   
        323. > 	return ret;
        324.   	}
        325.   

crypto/mem.c:324:2: return from a call to CRYPTO_malloc
        322.   
        323.   	return ret;
        324.   	}
                ^
        325.   
        326.   void *CRYPTO_realloc(void *str, int num, const char *file, int line)

crypto/evp/p_lib.c:187:6: Taking true branch
      185.   
      186.   	ret=(EVP_PKEY *)OPENSSL_malloc(sizeof(EVP_PKEY));
      187.   	if (ret == NULL)
                  ^
      188.   		{
      189.   		EVPerr(EVP_F_EVP_PKEY_NEW,ERR_R_MALLOC_FAILURE);

crypto/evp/p_lib.c:189:3: 
      187.   	if (ret == NULL)
      188.   		{
      189. > 		EVPerr(EVP_F_EVP_PKEY_NEW,ERR_R_MALLOC_FAILURE);
      190.   		return(NULL);
      191.   		}

crypto/err/err.c:680:1: start of procedure ERR_put_error()
        678.   /********************************************************/
        679.   
        680. > void ERR_put_error(int lib, int func, int reason, const char *file,
        681.   	     int line)
        682.   	{

crypto/err/err.c:704:2: Skipping ERR_get_state(): empty list of specs
        702.   	}
        703.   #endif
        704.   	es=ERR_get_state();
                ^
        705.   
        706.   	es->top=(es->top+1)%ERR_NUM_ERRORS;

crypto/err/err.c:706:2: 
        704.   	es=ERR_get_state();
        705.   
        706. > 	es->top=(es->top+1)%ERR_NUM_ERRORS;
        707.   	if (es->top == es->bottom)
        708.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;

crypto/err/err.c:707:6: Taking false branch
        705.   
        706.   	es->top=(es->top+1)%ERR_NUM_ERRORS;
        707.   	if (es->top == es->bottom)
                    ^
        708.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
        709.   	es->err_flags[es->top]=0;

crypto/err/err.c:709:2: 
        707.   	if (es->top == es->bottom)
        708.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
        709. > 	es->err_flags[es->top]=0;
        710.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
        711.   	es->err_file[es->top]=file;

crypto/err/err.c:710:2: 
        708.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
        709.   	es->err_flags[es->top]=0;
        710. > 	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
        711.   	es->err_file[es->top]=file;
        712.   	es->err_line[es->top]=line;

crypto/err/err.c:711:2: 
        709.   	es->err_flags[es->top]=0;
        710.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
        711. > 	es->err_file[es->top]=file;
        712.   	es->err_line[es->top]=line;
        713.   	err_clear_data(es,es->top);

crypto/err/err.c:712:2: 
        710.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
        711.   	es->err_file[es->top]=file;
        712. > 	es->err_line[es->top]=line;
        713.   	err_clear_data(es,es->top);
        714.   	}

crypto/err/err.c:713:2: Taking true branch
        711.   	es->err_file[es->top]=file;
        712.   	es->err_line[es->top]=line;
        713.   	err_clear_data(es,es->top);
                ^
        714.   	}
        715.   

crypto/err/err.c:713:2: Taking false branch
        711.   	es->err_file[es->top]=file;
        712.   	es->err_line[es->top]=line;
        713.   	err_clear_data(es,es->top);
                ^
        714.   	}
        715.   

crypto/err/err.c:713:2: Loop condition is false. Leaving loop
        711.   	es->err_file[es->top]=file;
        712.   	es->err_line[es->top]=line;
        713.   	err_clear_data(es,es->top);
                ^
        714.   	}
        715.   

crypto/err/err.c:714:2: return from a call to ERR_put_error
        712.   	es->err_line[es->top]=line;
        713.   	err_clear_data(es,es->top);
        714.   	}
                ^
        715.   
        716.   void ERR_clear_error(void)

crypto/evp/p_lib.c:190:3: 
      188.   		{
      189.   		EVPerr(EVP_F_EVP_PKEY_NEW,ERR_R_MALLOC_FAILURE);
      190. > 		return(NULL);
      191.   		}
      192.   	ret->type=EVP_PKEY_NONE;

crypto/evp/p_lib.c:201:2: return from a call to EVP_PKEY_new
      199.   	ret->save_parameters=1;
      200.   	return(ret);
      201.   	}
              ^
      202.   
      203.   /* Setup a public key ASN1 method and ENGINE from a NID or a string.

crypto/asn1/x_pubkey.c:147:6: Taking true branch
    145.   	if (key->public_key == NULL) goto error;
    146.   
    147.   	if ((ret = EVP_PKEY_new()) == NULL)
                ^
    148.   		{
    149.   		X509err(X509_F_X509_PUBKEY_GET, ERR_R_MALLOC_FAILURE);

crypto/asn1/x_pubkey.c:149:3: 
    147.   	if ((ret = EVP_PKEY_new()) == NULL)
    148.   		{
    149. > 		X509err(X509_F_X509_PUBKEY_GET, ERR_R_MALLOC_FAILURE);
    150.   		goto error;
    151.   		}

crypto/err/err.c:680:1: start of procedure ERR_put_error()
      678.   /********************************************************/
      679.   
      680. > void ERR_put_error(int lib, int func, int reason, const char *file,
      681.   	     int line)
      682.   	{

crypto/err/err.c:704:2: Skipping ERR_get_state(): empty list of specs
      702.   	}
      703.   #endif
      704.   	es=ERR_get_state();
              ^
      705.   
      706.   	es->top=(es->top+1)%ERR_NUM_ERRORS;

crypto/err/err.c:706:2: 
      704.   	es=ERR_get_state();
      705.   
      706. > 	es->top=(es->top+1)%ERR_NUM_ERRORS;
      707.   	if (es->top == es->bottom)
      708.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;

crypto/err/err.c:707:6: Taking false branch
      705.   
      706.   	es->top=(es->top+1)%ERR_NUM_ERRORS;
      707.   	if (es->top == es->bottom)
                  ^
      708.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
      709.   	es->err_flags[es->top]=0;

crypto/err/err.c:709:2: 
      707.   	if (es->top == es->bottom)
      708.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
      709. > 	es->err_flags[es->top]=0;
      710.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
      711.   	es->err_file[es->top]=file;

crypto/err/err.c:710:2: 
      708.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
      709.   	es->err_flags[es->top]=0;
      710. > 	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
      711.   	es->err_file[es->top]=file;
      712.   	es->err_line[es->top]=line;

crypto/err/err.c:711:2: 
      709.   	es->err_flags[es->top]=0;
      710.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
      711. > 	es->err_file[es->top]=file;
      712.   	es->err_line[es->top]=line;
      713.   	err_clear_data(es,es->top);

crypto/err/err.c:712:2: 
      710.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
      711.   	es->err_file[es->top]=file;
      712. > 	es->err_line[es->top]=line;
      713.   	err_clear_data(es,es->top);
      714.   	}

crypto/err/err.c:713:2: Taking true branch
      711.   	es->err_file[es->top]=file;
      712.   	es->err_line[es->top]=line;
      713.   	err_clear_data(es,es->top);
              ^
      714.   	}
      715.   

crypto/err/err.c:713:2: Taking false branch
      711.   	es->err_file[es->top]=file;
      712.   	es->err_line[es->top]=line;
      713.   	err_clear_data(es,es->top);
              ^
      714.   	}
      715.   

crypto/err/err.c:713:2: Loop condition is false. Leaving loop
      711.   	es->err_file[es->top]=file;
      712.   	es->err_line[es->top]=line;
      713.   	err_clear_data(es,es->top);
              ^
      714.   	}
      715.   

crypto/err/err.c:714:2: return from a call to ERR_put_error
      712.   	es->err_line[es->top]=line;
      713.   	err_clear_data(es,es->top);
      714.   	}
              ^
      715.   
      716.   void ERR_clear_error(void)

crypto/asn1/x_pubkey.c:179:2: 
    177.   	return ret;
    178.   
    179. > 	error:
    180.   	if (ret != NULL)
    181.   		EVP_PKEY_free(ret);

crypto/asn1/x_pubkey.c:180:6: Taking false branch
    178.   
    179.   	error:
    180.   	if (ret != NULL)
                ^
    181.   		EVP_PKEY_free(ret);
    182.   	return(NULL);

crypto/asn1/x_pubkey.c:182:2: 
    180.   	if (ret != NULL)
    181.   		EVP_PKEY_free(ret);
    182. > 	return(NULL);
    183.   	}
    184.   

crypto/asn1/x_pubkey.c:183:2: return from a call to X509_PUBKEY_get
    181.   		EVP_PKEY_free(ret);
    182.   	return(NULL);
    183.   	}
            ^
    184.   
    185.   /* Now two pseudo ASN1 routines that take an EVP_PKEY structure

crypto/x509/x509_cmp.c:263:2: return from a call to X509_get_pubkey
  261.   		return(NULL);
  262.   	return(X509_PUBKEY_get(x->cert_info->key));
  263.   	}
          ^
  264.   
  265.   ASN1_BIT_STRING *X509_get0_pubkey_bitstr(const X509 *x)

apps/x509.c:1115:2: 
1113.   
1114.   	upkey = X509_get_pubkey(xca);
1115. > 	EVP_PKEY_copy_parameters(upkey,pkey);
1116.   	EVP_PKEY_free(upkey);
1117.   

crypto/evp/p_lib.c:124:1: start of procedure EVP_PKEY_copy_parameters()
  122.   	}
  123.   
  124. > int EVP_PKEY_copy_parameters(EVP_PKEY *to, const EVP_PKEY *from)
  125.   	{
  126.   	if (to->type != from->type)

crypto/evp/p_lib.c:126:6: 
  124.   int EVP_PKEY_copy_parameters(EVP_PKEY *to, const EVP_PKEY *from)
  125.   	{
  126. > 	if (to->type != from->type)
  127.   		{
  128.   		EVPerr(EVP_F_EVP_PKEY_COPY_PARAMETERS,EVP_R_DIFFERENT_KEY_TYPES);
