ssl/s3_clnt.c:2481: error: NULL_DEREFERENCE
  pointer `pub_key` last assigned on line 2481 could be null and is dereferenced by call to `EVP_PKEY_CTX_new()` at line 2481, column 13.
Showing all 27 steps of the trace


ssl/s3_clnt.c:1988:1: start of procedure ssl3_send_client_key_exchange()
1986.   
1987.   
1988. > int ssl3_send_client_key_exchange(SSL *s)
1989.   	{
1990.   	unsigned char *p,*d;

ssl/s3_clnt.c:1995:2: 
1993.   #ifndef OPENSSL_NO_RSA
1994.   	unsigned char *q;
1995. > 	EVP_PKEY *pkey=NULL;
1996.   #endif
1997.   #ifndef OPENSSL_NO_KRB5

ssl/s3_clnt.c:2001:2: 
1999.   #endif /* OPENSSL_NO_KRB5 */
2000.   #ifndef OPENSSL_NO_ECDH
2001. > 	EC_KEY *clnt_ecdh = NULL;
2002.   	const EC_POINT *srvr_ecpoint = NULL;
2003.   	EVP_PKEY *srvr_pub_pkey = NULL;

ssl/s3_clnt.c:2002:2: 
2000.   #ifndef OPENSSL_NO_ECDH
2001.   	EC_KEY *clnt_ecdh = NULL;
2002. > 	const EC_POINT *srvr_ecpoint = NULL;
2003.   	EVP_PKEY *srvr_pub_pkey = NULL;
2004.   	unsigned char *encodedPoint = NULL;

ssl/s3_clnt.c:2003:2: 
2001.   	EC_KEY *clnt_ecdh = NULL;
2002.   	const EC_POINT *srvr_ecpoint = NULL;
2003. > 	EVP_PKEY *srvr_pub_pkey = NULL;
2004.   	unsigned char *encodedPoint = NULL;
2005.   	int encoded_pt_len = 0;

ssl/s3_clnt.c:2004:2: 
2002.   	const EC_POINT *srvr_ecpoint = NULL;
2003.   	EVP_PKEY *srvr_pub_pkey = NULL;
2004. > 	unsigned char *encodedPoint = NULL;
2005.   	int encoded_pt_len = 0;
2006.   	BN_CTX * bn_ctx = NULL;

ssl/s3_clnt.c:2005:2: 
2003.   	EVP_PKEY *srvr_pub_pkey = NULL;
2004.   	unsigned char *encodedPoint = NULL;
2005. > 	int encoded_pt_len = 0;
2006.   	BN_CTX * bn_ctx = NULL;
2007.   #endif

ssl/s3_clnt.c:2006:2: 
2004.   	unsigned char *encodedPoint = NULL;
2005.   	int encoded_pt_len = 0;
2006. > 	BN_CTX * bn_ctx = NULL;
2007.   #endif
2008.   

ssl/s3_clnt.c:2009:6: Taking true branch
2007.   #endif
2008.   
2009.   	if (s->state == SSL3_ST_CW_KEY_EXCH_A)
             ^
2010.   		{
2011.   		d=(unsigned char *)s->init_buf->data;

ssl/s3_clnt.c:2011:3: 
2009.   	if (s->state == SSL3_ST_CW_KEY_EXCH_A)
2010.   		{
2011. > 		d=(unsigned char *)s->init_buf->data;
2012.   		p= &(d[4]);
2013.   

ssl/s3_clnt.c:2012:3: 
2010.   		{
2011.   		d=(unsigned char *)s->init_buf->data;
2012. > 		p= &(d[4]);
2013.   
2014.   		alg_k=s->s3->tmp.new_cipher->algorithm_mkey;

ssl/s3_clnt.c:2014:3: 
2012.   		p= &(d[4]);
2013.   
2014. > 		alg_k=s->s3->tmp.new_cipher->algorithm_mkey;
2015.   
2016.   		/* Fool emacs indentation */

ssl/s3_clnt.c:2017:7: Taking false branch
2015.   
2016.   		/* Fool emacs indentation */
2017.   		if (0) {}
              ^
2018.   #ifndef OPENSSL_NO_RSA
2019.   		else if (alg_k & SSL_kRSA)

ssl/s3_clnt.c:2019:12: Taking false branch
2017.   		if (0) {}
2018.   #ifndef OPENSSL_NO_RSA
2019.   		else if (alg_k & SSL_kRSA)
                   ^
2020.   			{
2021.   			RSA *rsa;

ssl/s3_clnt.c:2212:12: Taking false branch
2210.   #endif
2211.   #ifndef OPENSSL_NO_DH
2212.   		else if (alg_k & (SSL_kEDH|SSL_kDHr|SSL_kDHd))
                   ^
2213.   			{
2214.   			DH *dh_srvr,*dh_clnt;

ssl/s3_clnt.c:2276:12: Taking false branch
2274.   
2275.   #ifndef OPENSSL_NO_ECDH 
2276.   		else if (alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe))
                   ^
2277.   			{
2278.   			const EC_GROUP *srvr_group = NULL;

ssl/s3_clnt.c:2460:12: Taking true branch
2458.   			}
2459.   #endif /* !OPENSSL_NO_ECDH */
2460.   		else if (alg_k & SSL_kGOST) 
                   ^
2461.   			{
2462.   			/* GOST key exchange message creation */

ssl/s3_clnt.c:2473:4: 
2471.   
2472.   			/* Get server sertificate PKEY and create ctx from it */
2473. > 			peer_cert=s->session->sess_cert->peer_pkeys[(keytype=SSL_PKEY_GOST01)].x509;
2474.   			if (!peer_cert) 
2475.   				peer_cert=s->session->sess_cert->peer_pkeys[(keytype=SSL_PKEY_GOST94)].x509;

ssl/s3_clnt.c:2474:9: Taking true branch
2472.   			/* Get server sertificate PKEY and create ctx from it */
2473.   			peer_cert=s->session->sess_cert->peer_pkeys[(keytype=SSL_PKEY_GOST01)].x509;
2474.   			if (!peer_cert) 
                ^
2475.   				peer_cert=s->session->sess_cert->peer_pkeys[(keytype=SSL_PKEY_GOST94)].x509;
2476.   			if (!peer_cert)		{

ssl/s3_clnt.c:2475:5: 
2473.   			peer_cert=s->session->sess_cert->peer_pkeys[(keytype=SSL_PKEY_GOST01)].x509;
2474.   			if (!peer_cert) 
2475. > 				peer_cert=s->session->sess_cert->peer_pkeys[(keytype=SSL_PKEY_GOST94)].x509;
2476.   			if (!peer_cert)		{
2477.   					SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,SSL_R_NO_GOST_CERTIFICATE_SENT_BY_PEER);

ssl/s3_clnt.c:2476:9: Taking false branch
2474.   			if (!peer_cert) 
2475.   				peer_cert=s->session->sess_cert->peer_pkeys[(keytype=SSL_PKEY_GOST94)].x509;
2476.   			if (!peer_cert)		{
                ^
2477.   					SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,SSL_R_NO_GOST_CERTIFICATE_SENT_BY_PEER);
2478.   					goto err;

ssl/s3_clnt.c:2481:4: 
2479.   				}	
2480.   				
2481. > 			pkey_ctx=EVP_PKEY_CTX_new(pub_key=X509_get_pubkey(peer_cert),NULL);
2482.   			/* If we have send a certificate, and certificate key
2483.   

crypto/x509/x509_cmp.c:296:1: start of procedure X509_get_pubkey()
  294.   	}
  295.   
  296. > EVP_PKEY *X509_get_pubkey(X509 *x)
  297.   	{
  298.   	if ((x == NULL) || (x->cert_info == NULL))

crypto/x509/x509_cmp.c:298:7: Taking false branch
  296.   EVP_PKEY *X509_get_pubkey(X509 *x)
  297.   	{
  298.   	if ((x == NULL) || (x->cert_info == NULL))
               ^
  299.   		return(NULL);
  300.   	return(X509_PUBKEY_get(x->cert_info->key));

crypto/x509/x509_cmp.c:298:22: Taking true branch
  296.   EVP_PKEY *X509_get_pubkey(X509 *x)
  297.   	{
  298.   	if ((x == NULL) || (x->cert_info == NULL))
                              ^
  299.   		return(NULL);
  300.   	return(X509_PUBKEY_get(x->cert_info->key));

crypto/x509/x509_cmp.c:299:3: 
  297.   	{
  298.   	if ((x == NULL) || (x->cert_info == NULL))
  299. > 		return(NULL);
  300.   	return(X509_PUBKEY_get(x->cert_info->key));
  301.   	}

crypto/x509/x509_cmp.c:301:2: return from a call to X509_get_pubkey
  299.   		return(NULL);
  300.   	return(X509_PUBKEY_get(x->cert_info->key));
  301.   	}
          ^
  302.   
  303.   ASN1_BIT_STRING *X509_get0_pubkey_bitstr(const X509 *x)
