ssl/ssl_rsa.c:195: error: NULL_DEREFERENCE
  pointer `pktmp` last assigned on line 194 could be null and is dereferenced by call to `EVP_PKEY_copy_parameters()` at line 195, column 9.
Showing all 12 steps of the trace


ssl/ssl_rsa.c:168:1: start of procedure ssl_set_pkey()
166.   #endif
167.   
168. > static int ssl_set_pkey(CERT *c, EVP_PKEY *pkey)
169.   {
170.       int i;

ssl/ssl_rsa.c:175:9: Taking false branch
173.        * means for DH certificates we must set the certificate first.
174.        */
175.       if (pkey->type == EVP_PKEY_DH) {
               ^
176.           X509 *x;
177.           i = -1;

ssl/ssl_rsa.c:186:9: Skipping ssl_cert_type(): empty list of specs
184.           ERR_clear_error();
185.       } else
186.           i = ssl_cert_type(NULL, pkey);
               ^
187.       if (i < 0) {
188.           SSLerr(SSL_F_SSL_SET_PKEY, SSL_R_UNKNOWN_CERTIFICATE_TYPE);

ssl/ssl_rsa.c:187:9: Taking false branch
185.       } else
186.           i = ssl_cert_type(NULL, pkey);
187.       if (i < 0) {
               ^
188.           SSLerr(SSL_F_SSL_SET_PKEY, SSL_R_UNKNOWN_CERTIFICATE_TYPE);
189.           return (0);

ssl/ssl_rsa.c:192:9: Taking true branch
190.       }
191.   
192.       if (c->pkeys[i].x509 != NULL) {
               ^
193.           EVP_PKEY *pktmp;
194.           pktmp = X509_get_pubkey(c->pkeys[i].x509);

ssl/ssl_rsa.c:194:9: 
192.       if (c->pkeys[i].x509 != NULL) {
193.           EVP_PKEY *pktmp;
194. >         pktmp = X509_get_pubkey(c->pkeys[i].x509);
195.           EVP_PKEY_copy_parameters(pktmp, pkey);
196.           EVP_PKEY_free(pktmp);

crypto/x509/x509_cmp.c:307:1: start of procedure X509_get_pubkey()
  305.   }
  306.   
  307. > EVP_PKEY *X509_get_pubkey(X509 *x)
  308.   {
  309.       if ((x == NULL) || (x->cert_info == NULL))

crypto/x509/x509_cmp.c:309:10: Taking false branch
  307.   EVP_PKEY *X509_get_pubkey(X509 *x)
  308.   {
  309.       if ((x == NULL) || (x->cert_info == NULL))
                  ^
  310.           return (NULL);
  311.       return (X509_PUBKEY_get(x->cert_info->key));

crypto/x509/x509_cmp.c:309:25: Taking true branch
  307.   EVP_PKEY *X509_get_pubkey(X509 *x)
  308.   {
  309.       if ((x == NULL) || (x->cert_info == NULL))
                                 ^
  310.           return (NULL);
  311.       return (X509_PUBKEY_get(x->cert_info->key));

crypto/x509/x509_cmp.c:310:9: 
  308.   {
  309.       if ((x == NULL) || (x->cert_info == NULL))
  310. >         return (NULL);
  311.       return (X509_PUBKEY_get(x->cert_info->key));
  312.   }

crypto/x509/x509_cmp.c:312:1: return from a call to X509_get_pubkey
  310.           return (NULL);
  311.       return (X509_PUBKEY_get(x->cert_info->key));
  312. > }
  313.   
  314.   ASN1_BIT_STRING *X509_get0_pubkey_bitstr(const X509 *x)

ssl/ssl_rsa.c:195:9: 
193.           EVP_PKEY *pktmp;
194.           pktmp = X509_get_pubkey(c->pkeys[i].x509);
195. >         EVP_PKEY_copy_parameters(pktmp, pkey);
196.           EVP_PKEY_free(pktmp);
197.           ERR_clear_error();
