ssl/s3_srvr.c:2969: error: NULL_DEREFERENCE
  pointer `pkey` last assigned on line 2912 could be null and is dereferenced by call to `tls12_get_sigid()` at line 2969, column 17.
Showing all 39 steps of the trace


ssl/s3_srvr.c:2888:1: start of procedure ssl3_get_cert_verify()
2886.   	}
2887.   
2888. > int ssl3_get_cert_verify(SSL *s)
2889.   	{
2890.   	EVP_PKEY *pkey=NULL;

ssl/s3_srvr.c:2890:2: 
2888.   int ssl3_get_cert_verify(SSL *s)
2889.   	{
2890. > 	EVP_PKEY *pkey=NULL;
2891.   	unsigned char *p;
2892.   	int al,ok,ret=0;

ssl/s3_srvr.c:2892:2: 
2890.   	EVP_PKEY *pkey=NULL;
2891.   	unsigned char *p;
2892. > 	int al,ok,ret=0;
2893.   	long n;
2894.   	int type=0,i,j;

ssl/s3_srvr.c:2894:2: 
2892.   	int al,ok,ret=0;
2893.   	long n;
2894. > 	int type=0,i,j;
2895.   	X509 *peer;
2896.   	const EVP_MD *md = NULL;

ssl/s3_srvr.c:2896:2: 
2894.   	int type=0,i,j;
2895.   	X509 *peer;
2896. > 	const EVP_MD *md = NULL;
2897.   	EVP_MD_CTX mctx;
2898.   	EVP_MD_CTX_init(&mctx);

ssl/s3_srvr.c:2898:2: 
2896.   	const EVP_MD *md = NULL;
2897.   	EVP_MD_CTX mctx;
2898. > 	EVP_MD_CTX_init(&mctx);
2899.   
2900.   	n=s->method->ssl_get_message(s,

crypto/evp/digest.c:120:1: start of procedure EVP_MD_CTX_init()
  118.   #endif
  119.   
  120. > void EVP_MD_CTX_init(EVP_MD_CTX *ctx)
  121.   	{
  122.   	memset(ctx,'\0',sizeof *ctx);

crypto/evp/digest.c:122:2: 
  120.   void EVP_MD_CTX_init(EVP_MD_CTX *ctx)
  121.   	{
  122. > 	memset(ctx,'\0',sizeof *ctx);
  123.   	}
  124.   

crypto/evp/digest.c:123:2: return from a call to EVP_MD_CTX_init
  121.   	{
  122.   	memset(ctx,'\0',sizeof *ctx);
  123.   	}
          ^
  124.   
  125.   EVP_MD_CTX *EVP_MD_CTX_create(void)

ssl/s3_srvr.c:2900:2: Skipping __function_pointer__(): unresolved function pointer
2898.   	EVP_MD_CTX_init(&mctx);
2899.   
2900.   	n=s->method->ssl_get_message(s,
         ^
2901.   		SSL3_ST_SR_CERT_VRFY_A,
2902.   		SSL3_ST_SR_CERT_VRFY_B,

ssl/s3_srvr.c:2907:7: Taking false branch
2905.   		&ok);
2906.   
2907.   	if (!ok) return((int)n);
              ^
2908.   
2909.   	if (s->session->peer != NULL)

ssl/s3_srvr.c:2909:6: Taking true branch
2907.   	if (!ok) return((int)n);
2908.   
2909.   	if (s->session->peer != NULL)
             ^
2910.   		{
2911.   		peer=s->session->peer;

ssl/s3_srvr.c:2911:3: 
2909.   	if (s->session->peer != NULL)
2910.   		{
2911. > 		peer=s->session->peer;
2912.   		pkey=X509_get_pubkey(peer);
2913.   		type=X509_certificate_type(peer,pkey);

ssl/s3_srvr.c:2912:3: 
2910.   		{
2911.   		peer=s->session->peer;
2912. > 		pkey=X509_get_pubkey(peer);
2913.   		type=X509_certificate_type(peer,pkey);
2914.   		}

crypto/x509/x509_cmp.c:295:1: start of procedure X509_get_pubkey()
  293.   	}
  294.   
  295. > EVP_PKEY *X509_get_pubkey(X509 *x)
  296.   	{
  297.   	if ((x == NULL) || (x->cert_info == NULL))

crypto/x509/x509_cmp.c:297:7: Taking false branch
  295.   EVP_PKEY *X509_get_pubkey(X509 *x)
  296.   	{
  297.   	if ((x == NULL) || (x->cert_info == NULL))
               ^
  298.   		return(NULL);
  299.   	return(X509_PUBKEY_get(x->cert_info->key));

crypto/x509/x509_cmp.c:297:22: Taking false branch
  295.   EVP_PKEY *X509_get_pubkey(X509 *x)
  296.   	{
  297.   	if ((x == NULL) || (x->cert_info == NULL))
                              ^
  298.   		return(NULL);
  299.   	return(X509_PUBKEY_get(x->cert_info->key));

crypto/x509/x509_cmp.c:299:2: 
  297.   	if ((x == NULL) || (x->cert_info == NULL))
  298.   		return(NULL);
  299. > 	return(X509_PUBKEY_get(x->cert_info->key));
  300.   	}
  301.   

crypto/asn1/x_pubkey.c:133:1: start of procedure X509_PUBKEY_get()
    131.   	}
    132.   
    133. > EVP_PKEY *X509_PUBKEY_get(X509_PUBKEY *key)
    134.   	{
    135.   	EVP_PKEY *ret=NULL;

crypto/asn1/x_pubkey.c:135:2: 
    133.   EVP_PKEY *X509_PUBKEY_get(X509_PUBKEY *key)
    134.   	{
    135. > 	EVP_PKEY *ret=NULL;
    136.   
    137.   	if (key == NULL) goto error;

crypto/asn1/x_pubkey.c:137:6: Taking false branch
    135.   	EVP_PKEY *ret=NULL;
    136.   
    137.   	if (key == NULL) goto error;
                ^
    138.   
    139.   	if (key->pkey != NULL)

crypto/asn1/x_pubkey.c:139:6: Taking false branch
    137.   	if (key == NULL) goto error;
    138.   
    139.   	if (key->pkey != NULL)
                ^
    140.   		{
    141.   		CRYPTO_add(&key->pkey->references, 1, CRYPTO_LOCK_EVP_PKEY);

crypto/asn1/x_pubkey.c:145:6: Taking true branch
    143.   		}
    144.   
    145.   	if (key->public_key == NULL) goto error;
                ^
    146.   
    147.   	if ((ret = EVP_PKEY_new()) == NULL)

crypto/asn1/x_pubkey.c:179:2: 
    177.   	return ret;
    178.   
    179. > 	error:
    180.   	if (ret != NULL)
    181.   		EVP_PKEY_free(ret);

crypto/asn1/x_pubkey.c:180:6: Taking false branch
    178.   
    179.   	error:
    180.   	if (ret != NULL)
                ^
    181.   		EVP_PKEY_free(ret);
    182.   	return(NULL);

crypto/asn1/x_pubkey.c:182:2: 
    180.   	if (ret != NULL)
    181.   		EVP_PKEY_free(ret);
    182. > 	return(NULL);
    183.   	}
    184.   

crypto/asn1/x_pubkey.c:183:2: return from a call to X509_PUBKEY_get
    181.   		EVP_PKEY_free(ret);
    182.   	return(NULL);
    183.   	}
            ^
    184.   
    185.   /* Now two pseudo ASN1 routines that take an EVP_PKEY structure

crypto/x509/x509_cmp.c:300:2: return from a call to X509_get_pubkey
  298.   		return(NULL);
  299.   	return(X509_PUBKEY_get(x->cert_info->key));
  300.   	}
          ^
  301.   
  302.   ASN1_BIT_STRING *X509_get0_pubkey_bitstr(const X509 *x)

ssl/s3_srvr.c:2913:3: Skipping X509_certificate_type(): empty list of specs
2911.   		peer=s->session->peer;
2912.   		pkey=X509_get_pubkey(peer);
2913.   		type=X509_certificate_type(peer,pkey);
          ^
2914.   		}
2915.   	else

ssl/s3_srvr.c:2921:6: Taking false branch
2919.   		}
2920.   
2921.   	if (s->s3->tmp.message_type != SSL3_MT_CERTIFICATE_VERIFY)
             ^
2922.   		{
2923.   		s->s3->tmp.reuse_message=1;

ssl/s3_srvr.c:2934:6: Taking false branch
2932.   		}
2933.   
2934.   	if (peer == NULL)
             ^
2935.   		{
2936.   		SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_NO_CLIENT_CERT_RECEIVED);

ssl/s3_srvr.c:2941:8: Taking false branch
2939.   		}
2940.   
2941.   	if (!(type & EVP_PKT_SIGN))
               ^
2942.   		{
2943.   		SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_SIGNATURE_FOR_NON_SIGNING_CERTIFICATE);

ssl/s3_srvr.c:2948:6: Taking false branch
2946.   		}
2947.   
2948.   	if (s->s3->change_cipher_spec)
             ^
2949.   		{
2950.   		SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_CCS_RECEIVED_EARLY);

ssl/s3_srvr.c:2956:2: 
2954.   
2955.   	/* we now have a signature that we need to verify */
2956. > 	p=(unsigned char *)s->init_msg;
2957.   	/* Check for broken implementations of GOST ciphersuites */
2958.   	/* If key is GOST and n is exactly 64, it is bare

ssl/s3_srvr.c:2960:6: Taking false branch
2958.   	/* If key is GOST and n is exactly 64, it is bare
2959.   	 * signature without length field */
2960.   	if (n==64 && (pkey->type==NID_id_GostR3410_94 ||
             ^
2961.   		pkey->type == NID_id_GostR3410_2001) )
2962.   		{

ssl/s3_srvr.c:2967:7: Taking true branch
2965.   	else 
2966.   		{	
2967.   		if (s->version >= TLS1_2_VERSION)
              ^
2968.   			{
2969.   			int sigalg = tls12_get_sigid(pkey);

ssl/s3_srvr.c:2969:4: 
2967.   		if (s->version >= TLS1_2_VERSION)
2968.   			{
2969. > 			int sigalg = tls12_get_sigid(pkey);
2970.   			/* Should never happen */
2971.   			if (sigalg == -1)

ssl/t1_lib.c:2057:1: start of procedure tls12_get_sigid()
  2055.   	}
  2056.   
  2057. > int tls12_get_sigid(const EVP_PKEY *pk)
  2058.   	{
  2059.   	return tls12_find_id(pk->type, tls12_sig,

ssl/t1_lib.c:2059:2: 
  2057.   int tls12_get_sigid(const EVP_PKEY *pk)
  2058.   	{
  2059. > 	return tls12_find_id(pk->type, tls12_sig,
  2060.   				sizeof(tls12_sig)/sizeof(tls12_lookup));
  2061.   	}
