apps/s_server.c:3174: error: NULL_DEREFERENCE
  pointer `rsa_tmp` last assigned on line 3172 could be null and is dereferenced by call to `RSA_free()` at line 3174, column 13.
Showing all 26 steps of the trace


apps/s_server.c:3159:1: start of procedure tmp_rsa_cb()
3157.   
3158.   #ifndef OPENSSL_NO_RSA
3159. > static RSA *tmp_rsa_cb(SSL *s, int is_export, int keylength)
3160.   {
3161.       BIGNUM *bn = NULL;

apps/s_server.c:3161:5: 
3159.   static RSA *tmp_rsa_cb(SSL *s, int is_export, int keylength)
3160.   {
3161. >     BIGNUM *bn = NULL;
3162.       static RSA *rsa_tmp = NULL;
3163.   

apps/s_server.c:3162:5: 
3160.   {
3161.       BIGNUM *bn = NULL;
3162. >     static RSA *rsa_tmp = NULL;
3163.   
3164.       if (!rsa_tmp && ((bn = BN_new()) == NULL))

apps/s_server.c:3164:10: Taking true branch
3162.       static RSA *rsa_tmp = NULL;
3163.   
3164.       if (!rsa_tmp && ((bn = BN_new()) == NULL))
                 ^
3165.           BIO_printf(bio_err, "Allocation error in generating RSA key\n");
3166.       if (!rsa_tmp && bn) {

apps/s_server.c:3164:22: Taking false branch
3162.       static RSA *rsa_tmp = NULL;
3163.   
3164.       if (!rsa_tmp && ((bn = BN_new()) == NULL))
                             ^
3165.           BIO_printf(bio_err, "Allocation error in generating RSA key\n");
3166.       if (!rsa_tmp && bn) {

apps/s_server.c:3166:10: Taking true branch
3164.       if (!rsa_tmp && ((bn = BN_new()) == NULL))
3165.           BIO_printf(bio_err, "Allocation error in generating RSA key\n");
3166.       if (!rsa_tmp && bn) {
                 ^
3167.           if (!s_quiet) {
3168.               BIO_printf(bio_err, "Generating temp (%d bit) RSA key...",

apps/s_server.c:3166:21: Taking true branch
3164.       if (!rsa_tmp && ((bn = BN_new()) == NULL))
3165.           BIO_printf(bio_err, "Allocation error in generating RSA key\n");
3166.       if (!rsa_tmp && bn) {
                            ^
3167.           if (!s_quiet) {
3168.               BIO_printf(bio_err, "Generating temp (%d bit) RSA key...",

apps/s_server.c:3167:14: Taking false branch
3165.           BIO_printf(bio_err, "Allocation error in generating RSA key\n");
3166.       if (!rsa_tmp && bn) {
3167.           if (!s_quiet) {
                     ^
3168.               BIO_printf(bio_err, "Generating temp (%d bit) RSA key...",
3169.                          keylength);

apps/s_server.c:3172:14: 
3170.               (void)BIO_flush(bio_err);
3171.           }
3172. >         if (!BN_set_word(bn, RSA_F4) || ((rsa_tmp = RSA_new()) == NULL) ||
3173.               !RSA_generate_key_ex(rsa_tmp, keylength, bn, NULL)) {
3174.               RSA_free(rsa_tmp);

crypto/bn/bn_lib.c:511:1: start of procedure BN_set_word()
  509.   }
  510.   
  511. > int BN_set_word(BIGNUM *a, BN_ULONG w)
  512.   {
  513.       bn_check_top(a);

crypto/bn/bn_lib.c:514:9: Condition is true
  512.   {
  513.       bn_check_top(a);
  514.       if (bn_expand(a, (int)sizeof(BN_ULONG) * 8) == NULL)
                 ^
  515.           return (0);
  516.       a->neg = 0;

crypto/bn/bn_lib.c:514:9: Taking false branch
  512.   {
  513.       bn_check_top(a);
  514.       if (bn_expand(a, (int)sizeof(BN_ULONG) * 8) == NULL)
                 ^
  515.           return (0);
  516.       a->neg = 0;

crypto/bn/bn_lib.c:516:5: 
  514.       if (bn_expand(a, (int)sizeof(BN_ULONG) * 8) == NULL)
  515.           return (0);
  516. >     a->neg = 0;
  517.       a->d[0] = w;
  518.       a->top = (w ? 1 : 0);

crypto/bn/bn_lib.c:517:5: 
  515.           return (0);
  516.       a->neg = 0;
  517. >     a->d[0] = w;
  518.       a->top = (w ? 1 : 0);
  519.       bn_check_top(a);

crypto/bn/bn_lib.c:518:15: Condition is true
  516.       a->neg = 0;
  517.       a->d[0] = w;
  518.       a->top = (w ? 1 : 0);
                       ^
  519.       bn_check_top(a);
  520.       return (1);

crypto/bn/bn_lib.c:518:5: 
  516.       a->neg = 0;
  517.       a->d[0] = w;
  518. >     a->top = (w ? 1 : 0);
  519.       bn_check_top(a);
  520.       return (1);

crypto/bn/bn_lib.c:520:5: 
  518.       a->top = (w ? 1 : 0);
  519.       bn_check_top(a);
  520. >     return (1);
  521.   }
  522.   

crypto/bn/bn_lib.c:521:1: return from a call to BN_set_word
  519.       bn_check_top(a);
  520.       return (1);
  521. > }
  522.   
  523.   BIGNUM *BN_bin2bn(const unsigned char *s, int len, BIGNUM *ret)

apps/s_server.c:3172:14: Taking false branch
3170.               (void)BIO_flush(bio_err);
3171.           }
3172.           if (!BN_set_word(bn, RSA_F4) || ((rsa_tmp = RSA_new()) == NULL) ||
                     ^
3173.               !RSA_generate_key_ex(rsa_tmp, keylength, bn, NULL)) {
3174.               RSA_free(rsa_tmp);

apps/s_server.c:3172:42: 
3170.               (void)BIO_flush(bio_err);
3171.           }
3172. >         if (!BN_set_word(bn, RSA_F4) || ((rsa_tmp = RSA_new()) == NULL) ||
3173.               !RSA_generate_key_ex(rsa_tmp, keylength, bn, NULL)) {
3174.               RSA_free(rsa_tmp);

crypto/rsa/rsa_lib.c:74:1: start of procedure RSA_new()
  72.   static const RSA_METHOD *default_RSA_meth = NULL;
  73.   
  74. > RSA *RSA_new(void)
  75.   {
  76.       RSA *r = RSA_new_method(NULL);

crypto/rsa/rsa_lib.c:76:5: Skipping RSA_new_method(): empty list of specs
  74.   RSA *RSA_new(void)
  75.   {
  76.       RSA *r = RSA_new_method(NULL);
            ^
  77.   
  78.       return r;

crypto/rsa/rsa_lib.c:78:5: 
  76.       RSA *r = RSA_new_method(NULL);
  77.   
  78. >     return r;
  79.   }
  80.   

crypto/rsa/rsa_lib.c:79:1: return from a call to RSA_new
  77.   
  78.       return r;
  79. > }
  80.   
  81.   void RSA_set_default_method(const RSA_METHOD *meth)

apps/s_server.c:3172:42: Taking true branch
3170.               (void)BIO_flush(bio_err);
3171.           }
3172.           if (!BN_set_word(bn, RSA_F4) || ((rsa_tmp = RSA_new()) == NULL) ||
                                                 ^
3173.               !RSA_generate_key_ex(rsa_tmp, keylength, bn, NULL)) {
3174.               RSA_free(rsa_tmp);

apps/s_server.c:3174:13: 
3172.           if (!BN_set_word(bn, RSA_F4) || ((rsa_tmp = RSA_new()) == NULL) ||
3173.               !RSA_generate_key_ex(rsa_tmp, keylength, bn, NULL)) {
3174. >             RSA_free(rsa_tmp);
3175.               rsa_tmp = NULL;
3176.           }
