ssl/s3_clnt.c:1645: error: NULL_DEREFERENCE
  pointer `pkey` last assigned on line 1643 could be null and is dereferenced by call to `EVP_PKEY_free()` at line 1645, column 2.
Showing all 28 steps of the trace


ssl/s3_clnt.c:1606:1: start of procedure ssl3_check_cert_and_algorithm()
1604.   #define has_bits(i,m)	(((i)&(m)) == (m))
1605.   
1606. > static int ssl3_check_cert_and_algorithm(SSL *s)
1607.   	{
1608.   	int i,idx;

ssl/s3_clnt.c:1610:2: 
1608.   	int i,idx;
1609.   	long algs;
1610. > 	EVP_PKEY *pkey=NULL;
1611.   	SESS_CERT *sc;
1612.   #ifndef NO_RSA

ssl/s3_clnt.c:1619:2: 
1617.   #endif
1618.   
1619. > 	sc=s->session->sess_cert;
1620.   
1621.   	if (sc == NULL)

ssl/s3_clnt.c:1621:6: Taking false branch
1619.   	sc=s->session->sess_cert;
1620.   
1621.   	if (sc == NULL)
             ^
1622.   		{
1623.   		SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_INTERNAL_ERROR);

ssl/s3_clnt.c:1627:2: 
1625.   		}
1626.   
1627. > 	algs=s->s3->tmp.new_cipher->algorithms;
1628.   
1629.   	/* we don't have a certificate */

ssl/s3_clnt.c:1630:6: Taking false branch
1628.   
1629.   	/* we don't have a certificate */
1630.   	if (algs & (SSL_aDH|SSL_aNULL))
             ^
1631.   		return(1);
1632.   

ssl/s3_clnt.c:1634:2: 
1632.   
1633.   #ifndef NO_RSA
1634. > 	rsa=s->session->sess_cert->peer_rsa_tmp;
1635.   #endif
1636.   #ifndef NO_DH

ssl/s3_clnt.c:1637:2: 
1635.   #endif
1636.   #ifndef NO_DH
1637. > 	dh=s->session->sess_cert->peer_dh_tmp;
1638.   #endif
1639.   

ssl/s3_clnt.c:1642:2: 
1640.   	/* This is the passed certificate */
1641.   
1642. > 	idx=sc->peer_cert_type;
1643.   	pkey=X509_get_pubkey(sc->peer_pkeys[idx].x509);
1644.   	i=X509_certificate_type(sc->peer_pkeys[idx].x509,pkey);

ssl/s3_clnt.c:1643:2: 
1641.   
1642.   	idx=sc->peer_cert_type;
1643. > 	pkey=X509_get_pubkey(sc->peer_pkeys[idx].x509);
1644.   	i=X509_certificate_type(sc->peer_pkeys[idx].x509,pkey);
1645.   	EVP_PKEY_free(pkey);

crypto/x509/x509_cmp.c:237:1: start of procedure X509_get_pubkey()
  235.   	}
  236.   
  237. > EVP_PKEY *X509_get_pubkey(X509 *x)
  238.   	{
  239.   	if ((x == NULL) || (x->cert_info == NULL))

crypto/x509/x509_cmp.c:239:7: Taking false branch
  237.   EVP_PKEY *X509_get_pubkey(X509 *x)
  238.   	{
  239.   	if ((x == NULL) || (x->cert_info == NULL))
               ^
  240.   		return(NULL);
  241.   	return(X509_PUBKEY_get(x->cert_info->key));

crypto/x509/x509_cmp.c:239:22: Taking true branch
  237.   EVP_PKEY *X509_get_pubkey(X509 *x)
  238.   	{
  239.   	if ((x == NULL) || (x->cert_info == NULL))
                              ^
  240.   		return(NULL);
  241.   	return(X509_PUBKEY_get(x->cert_info->key));

crypto/x509/x509_cmp.c:240:3: 
  238.   	{
  239.   	if ((x == NULL) || (x->cert_info == NULL))
  240. > 		return(NULL);
  241.   	return(X509_PUBKEY_get(x->cert_info->key));
  242.   	}

crypto/x509/x509_cmp.c:242:2: return from a call to X509_get_pubkey
  240.   		return(NULL);
  241.   	return(X509_PUBKEY_get(x->cert_info->key));
  242.   	}
          ^
  243.   
  244.   int X509_check_private_key(X509 *x, EVP_PKEY *k)

ssl/s3_clnt.c:1644:2: Skipping X509_certificate_type(): empty list of specs
1642.   	idx=sc->peer_cert_type;
1643.   	pkey=X509_get_pubkey(sc->peer_pkeys[idx].x509);
1644.   	i=X509_certificate_type(sc->peer_pkeys[idx].x509,pkey);
         ^
1645.   	EVP_PKEY_free(pkey);
1646.   

ssl/s3_clnt.c:1645:2: 
1643.   	pkey=X509_get_pubkey(sc->peer_pkeys[idx].x509);
1644.   	i=X509_certificate_type(sc->peer_pkeys[idx].x509,pkey);
1645. > 	EVP_PKEY_free(pkey);
1646.   
1647.   	

crypto/evp/p_lib.c:228:1: start of procedure EVP_PKEY_free()
  226.   	}
  227.   
  228. > void EVP_PKEY_free(EVP_PKEY *x)
  229.   	{
  230.   	int i;

crypto/evp/p_lib.c:232:6: Taking false branch
  230.   	int i;
  231.   
  232.   	if (x == NULL) return;
              ^
  233.   
  234.   	i=CRYPTO_add(&x->references,-1,CRYPTO_LOCK_EVP_PKEY);

crypto/evp/p_lib.c:234:2: 
  232.   	if (x == NULL) return;
  233.   
  234. > 	i=CRYPTO_add(&x->references,-1,CRYPTO_LOCK_EVP_PKEY);
  235.   #ifdef REF_PRINT
  236.   	REF_PRINT("EVP_PKEY",x);

crypto/cryptlib.c:225:1: start of procedure CRYPTO_add_lock()
    223.   	}
    224.   
    225. > int CRYPTO_add_lock(int *pointer, int amount, int type, const char *file,
    226.   	     int line)
    227.   	{

crypto/cryptlib.c:230:6: Taking false branch
    228.   	int ret;
    229.   
    230.   	if (add_lock_callback != NULL)
                ^
    231.   		{
    232.   #ifdef LOCK_DEBUG

crypto/cryptlib.c:248:3: 
    246.   	else
    247.   		{
    248. > 		CRYPTO_lock(CRYPTO_LOCK|CRYPTO_WRITE,type,file,line);
    249.   
    250.   		ret= *pointer+amount;

crypto/cryptlib.c:196:1: start of procedure CRYPTO_lock()
      194.   	}
      195.   
      196. > void CRYPTO_lock(int mode, int type, const char *file, int line)
      197.   	{
      198.   #ifdef LOCK_DEBUG

crypto/cryptlib.c:221:6: Taking false branch
      219.   		}
      220.   #endif
      221.   	if (locking_callback != NULL)
                  ^
      222.   		locking_callback(mode,type,file,line);
      223.   	}

crypto/cryptlib.c:221:2: 
      219.   		}
      220.   #endif
      221. > 	if (locking_callback != NULL)
      222.   		locking_callback(mode,type,file,line);
      223.   	}

crypto/cryptlib.c:223:2: return from a call to CRYPTO_lock
      221.   	if (locking_callback != NULL)
      222.   		locking_callback(mode,type,file,line);
      223.   	}
              ^
      224.   
      225.   int CRYPTO_add_lock(int *pointer, int amount, int type, const char *file,

crypto/cryptlib.c:250:3: 
    248.   		CRYPTO_lock(CRYPTO_LOCK|CRYPTO_WRITE,type,file,line);
    249.   
    250. > 		ret= *pointer+amount;
    251.   #ifdef LOCK_DEBUG
    252.   		fprintf(stderr,"ladd:%08lx:%2d+%2d->%2d %-18s %s:%d\n",
