crypto/ec/ec_pmeth.c:203: error: NULL_DEREFERENCE
  pointer `null` is dereferenced by call to `pkey_ec_derive()` at line 203, column 10.
Showing all 32 steps of the trace


crypto/ec/ec_pmeth.c:188:1: start of procedure pkey_ec_kdf_derive()
186.   }
187.   
188. > static int pkey_ec_kdf_derive(EVP_PKEY_CTX *ctx,
189.                                 unsigned char *key, size_t *keylen)
190.   {

crypto/ec/ec_pmeth.c:191:5: 
189.                                 unsigned char *key, size_t *keylen)
190.   {
191. >     EC_PKEY_CTX *dctx = ctx->data;
192.       unsigned char *ktmp = NULL;
193.       size_t ktmplen;

crypto/ec/ec_pmeth.c:192:5: 
190.   {
191.       EC_PKEY_CTX *dctx = ctx->data;
192. >     unsigned char *ktmp = NULL;
193.       size_t ktmplen;
194.       int rv = 0;

crypto/ec/ec_pmeth.c:194:5: 
192.       unsigned char *ktmp = NULL;
193.       size_t ktmplen;
194. >     int rv = 0;
195.       if (dctx->kdf_type == EVP_PKEY_ECDH_KDF_NONE)
196.           return pkey_ec_derive(ctx, key, keylen);

crypto/ec/ec_pmeth.c:195:9: Taking false branch
193.       size_t ktmplen;
194.       int rv = 0;
195.       if (dctx->kdf_type == EVP_PKEY_ECDH_KDF_NONE)
               ^
196.           return pkey_ec_derive(ctx, key, keylen);
197.       if (!key) {

crypto/ec/ec_pmeth.c:197:10: Taking false branch
195.       if (dctx->kdf_type == EVP_PKEY_ECDH_KDF_NONE)
196.           return pkey_ec_derive(ctx, key, keylen);
197.       if (!key) {
                ^
198.           *keylen = dctx->kdf_outlen;
199.           return 1;

crypto/ec/ec_pmeth.c:201:9: Taking false branch
199.           return 1;
200.       }
201.       if (*keylen != dctx->kdf_outlen)
               ^
202.           return 0;
203.       if (!pkey_ec_derive(ctx, NULL, &ktmplen))

crypto/ec/ec_pmeth.c:203:10: 
201.       if (*keylen != dctx->kdf_outlen)
202.           return 0;
203. >     if (!pkey_ec_derive(ctx, NULL, &ktmplen))
204.           return 0;
205.       if ((ktmp = OPENSSL_malloc(ktmplen)) == NULL) {

crypto/ec/ec_pmeth.c:152:1: start of procedure pkey_ec_derive()
  150.   
  151.   #ifndef OPENSSL_NO_EC
  152. > static int pkey_ec_derive(EVP_PKEY_CTX *ctx, unsigned char *key, size_t *keylen)
  153.   {
  154.       int ret;

crypto/ec/ec_pmeth.c:156:5: 
  154.       int ret;
  155.       size_t outlen;
  156. >     const EC_POINT *pubkey = NULL;
  157.       EC_KEY *eckey;
  158.       EC_PKEY_CTX *dctx = ctx->data;

crypto/ec/ec_pmeth.c:158:5: 
  156.       const EC_POINT *pubkey = NULL;
  157.       EC_KEY *eckey;
  158. >     EC_PKEY_CTX *dctx = ctx->data;
  159.       if (!ctx->pkey || !ctx->peerkey) {
  160.           ECerr(EC_F_PKEY_EC_DERIVE, EC_R_KEYS_NOT_SET);

crypto/ec/ec_pmeth.c:159:10: Taking false branch
  157.       EC_KEY *eckey;
  158.       EC_PKEY_CTX *dctx = ctx->data;
  159.       if (!ctx->pkey || !ctx->peerkey) {
                  ^
  160.           ECerr(EC_F_PKEY_EC_DERIVE, EC_R_KEYS_NOT_SET);
  161.           return 0;

crypto/ec/ec_pmeth.c:159:24: Taking false branch
  157.       EC_KEY *eckey;
  158.       EC_PKEY_CTX *dctx = ctx->data;
  159.       if (!ctx->pkey || !ctx->peerkey) {
                                ^
  160.           ECerr(EC_F_PKEY_EC_DERIVE, EC_R_KEYS_NOT_SET);
  161.           return 0;

crypto/ec/ec_pmeth.c:164:13: Condition is false
  162.       }
  163.   
  164.       eckey = dctx->co_key ? dctx->co_key : ctx->pkey->pkey.ec;
                     ^
  165.   
  166.       if (!key) {

crypto/ec/ec_pmeth.c:164:5: 
  162.       }
  163.   
  164. >     eckey = dctx->co_key ? dctx->co_key : ctx->pkey->pkey.ec;
  165.   
  166.       if (!key) {

crypto/ec/ec_pmeth.c:166:10: Taking false branch
  164.       eckey = dctx->co_key ? dctx->co_key : ctx->pkey->pkey.ec;
  165.   
  166.       if (!key) {
                  ^
  167.           const EC_GROUP *group;
  168.           group = EC_KEY_get0_group(eckey);

crypto/ec/ec_pmeth.c:172:5: 
  170.           return 1;
  171.       }
  172. >     pubkey = EC_KEY_get0_public_key(ctx->peerkey->pkey.ec);
  173.   
  174.       /*

crypto/ec/ec_key.c:432:1: start of procedure EC_KEY_get0_public_key()
    430.   }
    431.   
    432. > const EC_POINT *EC_KEY_get0_public_key(const EC_KEY *key)
    433.   {
    434.       return key->pub_key;

crypto/ec/ec_key.c:434:5: 
    432.   const EC_POINT *EC_KEY_get0_public_key(const EC_KEY *key)
    433.   {
    434. >     return key->pub_key;
    435.   }
    436.   

crypto/ec/ec_key.c:435:1: return from a call to EC_KEY_get0_public_key
    433.   {
    434.       return key->pub_key;
    435. > }
    436.   
    437.   int EC_KEY_set_public_key(EC_KEY *key, const EC_POINT *pub_key)

crypto/ec/ec_pmeth.c:179:5: 
  177.        */
  178.   
  179. >     outlen = *keylen;
  180.   
  181.       ret = ECDH_compute_key(key, outlen, pubkey, eckey, 0);

crypto/ec/ec_pmeth.c:181:5: 
  179.       outlen = *keylen;
  180.   
  181. >     ret = ECDH_compute_key(key, outlen, pubkey, eckey, 0);
  182.       if (ret <= 0)
  183.           return 0;

crypto/ec/ec_kmeth.c:127:1: start of procedure ECDH_compute_key()
    125.   }
    126.   
    127. > int ECDH_compute_key(void *out, size_t outlen, const EC_POINT *pub_key,
    128.                        const EC_KEY *eckey,
    129.                        void *(*KDF) (const void *in, size_t inlen, void *out,

crypto/ec/ec_kmeth.c:132:5: 
    130.                                      size_t *outlen))
    131.   {
    132. >     unsigned char *sec = NULL;
    133.       size_t seclen;
    134.       if (eckey->meth->compute_key == NULL) {

crypto/ec/ec_kmeth.c:134:9: Taking false branch
    132.       unsigned char *sec = NULL;
    133.       size_t seclen;
    134.       if (eckey->meth->compute_key == NULL) {
                   ^
    135.           ECerr(EC_F_ECDH_COMPUTE_KEY, EC_R_OPERATION_NOT_SUPPORTED);
    136.           return 0;

crypto/ec/ec_kmeth.c:138:9: Taking false branch
    136.           return 0;
    137.       }
    138.       if (outlen > INT_MAX) {
                   ^
    139.           ECerr(EC_F_ECDH_COMPUTE_KEY, EC_R_INVALID_OUTPUT_LENGTH);
    140.           return 0;

crypto/ec/ec_kmeth.c:142:10: Taking true branch
    140.           return 0;
    141.       }
    142.       if (!eckey->meth->compute_key(&sec, &seclen, pub_key, eckey))
                    ^
    143.           return 0;
    144.       if (KDF != NULL) {

crypto/ec/ec_kmeth.c:143:9: 
    141.       }
    142.       if (!eckey->meth->compute_key(&sec, &seclen, pub_key, eckey))
    143. >         return 0;
    144.       if (KDF != NULL) {
    145.           KDF(sec, seclen, out, &outlen);

crypto/ec/ec_kmeth.c:153:1: return from a call to ECDH_compute_key
    151.       OPENSSL_clear_free(sec, seclen);
    152.       return outlen;
    153. > }
    154.   
    155.   EC_KEY_METHOD *EC_KEY_METHOD_new(const EC_KEY_METHOD *meth)

crypto/ec/ec_pmeth.c:182:9: Taking true branch
  180.   
  181.       ret = ECDH_compute_key(key, outlen, pubkey, eckey, 0);
  182.       if (ret <= 0)
                 ^
  183.           return 0;
  184.       *keylen = ret;

crypto/ec/ec_pmeth.c:183:9: 
  181.       ret = ECDH_compute_key(key, outlen, pubkey, eckey, 0);
  182.       if (ret <= 0)
  183. >         return 0;
  184.       *keylen = ret;
  185.       return 1;

crypto/ec/ec_pmeth.c:186:1: return from a call to pkey_ec_derive
  184.       *keylen = ret;
  185.       return 1;
  186. > }
  187.   
  188.   static int pkey_ec_kdf_derive(EVP_PKEY_CTX *ctx,
