ssl/s3_clnt.c:2530: error: NULL_DEREFERENCE
  pointer `pkey` last assigned on line 2528 could be null and is dereferenced by call to `EVP_PKEY_free()` at line 2530, column 2.
Showing all 79 steps of the trace


ssl/s3_clnt.c:2477:1: start of procedure ssl3_check_cert_and_algorithm()
2475.   #define has_bits(i,m)	(((i)&(m)) == (m))
2476.   
2477. > int ssl3_check_cert_and_algorithm(SSL *s)
2478.   	{
2479.   	int i,idx;

ssl/s3_clnt.c:2481:2: 
2479.   	int i,idx;
2480.   	long algs;
2481. > 	EVP_PKEY *pkey=NULL;
2482.   	SESS_CERT *sc;
2483.   #ifndef OPENSSL_NO_RSA

ssl/s3_clnt.c:2490:2: 
2488.   #endif
2489.   
2490. > 	sc=s->session->sess_cert;
2491.   	if (sc == NULL)
2492.   		{

ssl/s3_clnt.c:2491:6: Taking false branch
2489.   
2490.   	sc=s->session->sess_cert;
2491.   	if (sc == NULL)
             ^
2492.   		{
2493.   		SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,ERR_R_INTERNAL_ERROR);

ssl/s3_clnt.c:2497:2: 
2495.   		}
2496.   
2497. > 	algs=s->s3->tmp.new_cipher->algorithms;
2498.   
2499.   	/* we don't have a certificate */

ssl/s3_clnt.c:2500:6: Taking false branch
2498.   
2499.   	/* we don't have a certificate */
2500.   	if (algs & (SSL_aDH|SSL_aNULL|SSL_aKRB5|SSL_kPSK))
             ^
2501.   		return(1);
2502.   

ssl/s3_clnt.c:2504:2: 
2502.   
2503.   #ifndef OPENSSL_NO_RSA
2504. > 	rsa=s->session->sess_cert->peer_rsa_tmp;
2505.   #endif
2506.   #ifndef OPENSSL_NO_DH

ssl/s3_clnt.c:2507:2: 
2505.   #endif
2506.   #ifndef OPENSSL_NO_DH
2507. > 	dh=s->session->sess_cert->peer_dh_tmp;
2508.   #endif
2509.   

ssl/s3_clnt.c:2512:2: 
2510.   	/* This is the passed certificate */
2511.   
2512. > 	idx=sc->peer_cert_type;
2513.   #ifndef OPENSSL_NO_ECDH
2514.   	if (idx == SSL_PKEY_ECC)

ssl/s3_clnt.c:2514:6: Taking false branch
2512.   	idx=sc->peer_cert_type;
2513.   #ifndef OPENSSL_NO_ECDH
2514.   	if (idx == SSL_PKEY_ECC)
             ^
2515.   		{
2516.   		if (check_srvr_ecc_cert_and_alg(sc->peer_pkeys[idx].x509,

ssl/s3_clnt.c:2528:2: 
2526.   		}
2527.   #endif
2528. > 	pkey=X509_get_pubkey(sc->peer_pkeys[idx].x509);
2529.   	i=X509_certificate_type(sc->peer_pkeys[idx].x509,pkey);
2530.   	EVP_PKEY_free(pkey);

crypto/x509/x509_cmp.c:374:1: start of procedure X509_get_pubkey()
  372.   	}
  373.   
  374. > EVP_PKEY *X509_get_pubkey(X509 *x)
  375.   	{
  376.   	if ((x == NULL) || (x->cert_info == NULL))

crypto/x509/x509_cmp.c:376:7: Taking false branch
  374.   EVP_PKEY *X509_get_pubkey(X509 *x)
  375.   	{
  376.   	if ((x == NULL) || (x->cert_info == NULL))
               ^
  377.   		return(NULL);
  378.   	return(X509_PUBKEY_get(x->cert_info->key));

crypto/x509/x509_cmp.c:376:22: Taking false branch
  374.   EVP_PKEY *X509_get_pubkey(X509 *x)
  375.   	{
  376.   	if ((x == NULL) || (x->cert_info == NULL))
                              ^
  377.   		return(NULL);
  378.   	return(X509_PUBKEY_get(x->cert_info->key));

crypto/x509/x509_cmp.c:378:2: 
  376.   	if ((x == NULL) || (x->cert_info == NULL))
  377.   		return(NULL);
  378. > 	return(X509_PUBKEY_get(x->cert_info->key));
  379.   	}
  380.   

crypto/asn1/x_pubkey.c:259:1: start of procedure X509_PUBKEY_get()
    257.   	}
    258.   
    259. > EVP_PKEY *X509_PUBKEY_get(X509_PUBKEY *key)
    260.   	{
    261.   	EVP_PKEY *ret=NULL;

crypto/asn1/x_pubkey.c:261:2: 
    259.   EVP_PKEY *X509_PUBKEY_get(X509_PUBKEY *key)
    260.   	{
    261. > 	EVP_PKEY *ret=NULL;
    262.   	long j;
    263.   	int type;

crypto/asn1/x_pubkey.c:270:6: Taking false branch
    268.   #endif
    269.   
    270.   	if (key == NULL) goto err;
                ^
    271.   
    272.   	if (key->pkey != NULL)

crypto/asn1/x_pubkey.c:272:6: Taking false branch
    270.   	if (key == NULL) goto err;
    271.   
    272.   	if (key->pkey != NULL)
                ^
    273.   		{
    274.   		CRYPTO_add(&key->pkey->references, 1, CRYPTO_LOCK_EVP_PKEY);

crypto/asn1/x_pubkey.c:278:6: Taking false branch
    276.   		}
    277.   
    278.   	if (key->public_key == NULL) goto err;
                ^
    279.   
    280.   	type=OBJ_obj2nid(key->algor->algorithm);

crypto/asn1/x_pubkey.c:280:2: 
    278.   	if (key->public_key == NULL) goto err;
    279.   
    280. > 	type=OBJ_obj2nid(key->algor->algorithm);
    281.   	if ((ret = EVP_PKEY_new()) == NULL)
    282.   		{

crypto/objects/obj_dat.c:369:1: start of procedure OBJ_obj2nid()
      367.   	}
      368.   
      369. > int OBJ_obj2nid(const ASN1_OBJECT *a)
      370.   	{
      371.   	ASN1_OBJECT **op;

crypto/objects/obj_dat.c:374:6: Taking false branch
      372.   	ADDED_OBJ ad,*adp;
      373.   
      374.   	if (a == NULL)
                  ^
      375.   		return(NID_undef);
      376.   	if (a->nid != 0)

crypto/objects/obj_dat.c:376:6: Taking true branch
      374.   	if (a == NULL)
      375.   		return(NID_undef);
      376.   	if (a->nid != 0)
                  ^
      377.   		return(a->nid);
      378.   

crypto/objects/obj_dat.c:377:3: 
      375.   		return(NID_undef);
      376.   	if (a->nid != 0)
      377. > 		return(a->nid);
      378.   
      379.   	if (added != NULL)

crypto/objects/obj_dat.c:391:2: return from a call to OBJ_obj2nid
      389.   		return(NID_undef);
      390.   	return((*op)->nid);
      391.   	}
              ^
      392.   
      393.   /* Convert an object name into an ASN1_OBJECT

crypto/asn1/x_pubkey.c:281:6: 
    279.   
    280.   	type=OBJ_obj2nid(key->algor->algorithm);
    281. > 	if ((ret = EVP_PKEY_new()) == NULL)
    282.   		{
    283.   		X509err(X509_F_X509_PUBKEY_GET, ERR_R_MALLOC_FAILURE);

crypto/evp/p_lib.c:313:1: start of procedure EVP_PKEY_new()
      311.   	}
      312.   
      313. > EVP_PKEY *EVP_PKEY_new(void)
      314.   	{
      315.   	EVP_PKEY *ret;

crypto/evp/p_lib.c:317:2: 
      315.   	EVP_PKEY *ret;
      316.   
      317. > 	ret=(EVP_PKEY *)OPENSSL_malloc(sizeof(EVP_PKEY));
      318.   	if (ret == NULL)
      319.   		{

crypto/mem.c:291:1: start of procedure CRYPTO_malloc()
        289.   	}
        290.   
        291. > void *CRYPTO_malloc(int num, const char *file, int line)
        292.   	{
        293.   	void *ret = NULL;

crypto/mem.c:293:2: 
        291.   void *CRYPTO_malloc(int num, const char *file, int line)
        292.   	{
        293. > 	void *ret = NULL;
        294.   	extern unsigned char cleanse_ctr;
        295.   

crypto/mem.c:296:6: Taking false branch
        294.   	extern unsigned char cleanse_ctr;
        295.   
        296.   	if (num <= 0) return NULL;
                    ^
        297.   
        298.   	allow_customize = 0;

crypto/mem.c:298:2: 
        296.   	if (num <= 0) return NULL;
        297.   
        298. > 	allow_customize = 0;
        299.   	if (malloc_debug_func != NULL)
        300.   		{

crypto/mem.c:299:6: Taking true branch
        297.   
        298.   	allow_customize = 0;
        299.   	if (malloc_debug_func != NULL)
                    ^
        300.   		{
        301.   		allow_customize_debug = 0;

crypto/mem.c:301:3: 
        299.   	if (malloc_debug_func != NULL)
        300.   		{
        301. > 		allow_customize_debug = 0;
        302.   		malloc_debug_func(NULL, num, file, line, 0);
        303.   		}

crypto/mem.c:302:3: Skipping __function_pointer__(): unresolved function pointer
        300.   		{
        301.   		allow_customize_debug = 0;
        302.   		malloc_debug_func(NULL, num, file, line, 0);
                 ^
        303.   		}
        304.   	ret = malloc_ex_func(num,file,line);

crypto/mem.c:304:2: Skipping __function_pointer__(): unresolved function pointer
        302.   		malloc_debug_func(NULL, num, file, line, 0);
        303.   		}
        304.   	ret = malloc_ex_func(num,file,line);
                ^
        305.   #ifdef LEVITTE_DEBUG_MEM
        306.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);

crypto/mem.c:308:6: Taking true branch
        306.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);
        307.   #endif
        308.   	if (malloc_debug_func != NULL)
                    ^
        309.   		malloc_debug_func(ret, num, file, line, 1);
        310.   

crypto/mem.c:309:3: Skipping __function_pointer__(): unresolved function pointer
        307.   #endif
        308.   	if (malloc_debug_func != NULL)
        309.   		malloc_debug_func(ret, num, file, line, 1);
                 ^
        310.   
        311.           /* Create a dependency on the value of 'cleanse_ctr' so our memory

crypto/mem.c:314:12: Taking false branch
        312.            * sanitisation function can't be optimised out. NB: We only do
        313.            * this for >2Kb so the overhead doesn't bother us. */
        314.           if(ret && (num > 2048))
                          ^
        315.                   ((unsigned char *)ret)[0] = cleanse_ctr;
        316.   

crypto/mem.c:317:2: 
        315.                   ((unsigned char *)ret)[0] = cleanse_ctr;
        316.   
        317. > 	return ret;
        318.   	}
        319.   

crypto/mem.c:318:2: return from a call to CRYPTO_malloc
        316.   
        317.   	return ret;
        318.   	}
                ^
        319.   
        320.   void *CRYPTO_realloc(void *str, int num, const char *file, int line)

crypto/evp/p_lib.c:318:6: Taking true branch
      316.   
      317.   	ret=(EVP_PKEY *)OPENSSL_malloc(sizeof(EVP_PKEY));
      318.   	if (ret == NULL)
                  ^
      319.   		{
      320.   		EVPerr(EVP_F_EVP_PKEY_NEW,ERR_R_MALLOC_FAILURE);

crypto/evp/p_lib.c:320:3: 
      318.   	if (ret == NULL)
      319.   		{
      320. > 		EVPerr(EVP_F_EVP_PKEY_NEW,ERR_R_MALLOC_FAILURE);
      321.   		return(NULL);
      322.   		}

crypto/err/err.c:668:1: start of procedure ERR_put_error()
        666.   /********************************************************/
        667.   
        668. > void ERR_put_error(int lib, int func, int reason, const char *file,
        669.   	     int line)
        670.   	{

crypto/err/err.c:692:2: Skipping ERR_get_state(): empty list of specs
        690.   	}
        691.   #endif
        692.   	es=ERR_get_state();
                ^
        693.   
        694.   	es->top=(es->top+1)%ERR_NUM_ERRORS;

crypto/err/err.c:694:2: 
        692.   	es=ERR_get_state();
        693.   
        694. > 	es->top=(es->top+1)%ERR_NUM_ERRORS;
        695.   	if (es->top == es->bottom)
        696.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;

crypto/err/err.c:695:6: Taking false branch
        693.   
        694.   	es->top=(es->top+1)%ERR_NUM_ERRORS;
        695.   	if (es->top == es->bottom)
                    ^
        696.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
        697.   	es->err_flags[es->top]=0;

crypto/err/err.c:697:2: 
        695.   	if (es->top == es->bottom)
        696.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
        697. > 	es->err_flags[es->top]=0;
        698.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
        699.   	es->err_file[es->top]=file;

crypto/err/err.c:698:2: 
        696.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
        697.   	es->err_flags[es->top]=0;
        698. > 	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
        699.   	es->err_file[es->top]=file;
        700.   	es->err_line[es->top]=line;

crypto/err/err.c:699:2: 
        697.   	es->err_flags[es->top]=0;
        698.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
        699. > 	es->err_file[es->top]=file;
        700.   	es->err_line[es->top]=line;
        701.   	err_clear_data(es,es->top);

crypto/err/err.c:700:2: 
        698.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
        699.   	es->err_file[es->top]=file;
        700. > 	es->err_line[es->top]=line;
        701.   	err_clear_data(es,es->top);
        702.   	}

crypto/err/err.c:701:2: Taking true branch
        699.   	es->err_file[es->top]=file;
        700.   	es->err_line[es->top]=line;
        701.   	err_clear_data(es,es->top);
                ^
        702.   	}
        703.   

crypto/err/err.c:701:2: Taking false branch
        699.   	es->err_file[es->top]=file;
        700.   	es->err_line[es->top]=line;
        701.   	err_clear_data(es,es->top);
                ^
        702.   	}
        703.   

crypto/err/err.c:701:2: Loop condition is false. Leaving loop
        699.   	es->err_file[es->top]=file;
        700.   	es->err_line[es->top]=line;
        701.   	err_clear_data(es,es->top);
                ^
        702.   	}
        703.   

crypto/err/err.c:702:2: return from a call to ERR_put_error
        700.   	es->err_line[es->top]=line;
        701.   	err_clear_data(es,es->top);
        702.   	}
                ^
        703.   
        704.   void ERR_clear_error(void)

crypto/evp/p_lib.c:321:3: 
      319.   		{
      320.   		EVPerr(EVP_F_EVP_PKEY_NEW,ERR_R_MALLOC_FAILURE);
      321. > 		return(NULL);
      322.   		}
      323.   	ret->type=EVP_PKEY_NONE;

crypto/evp/p_lib.c:329:2: return from a call to EVP_PKEY_new
      327.   	ret->save_parameters=1;
      328.   	return(ret);
      329.   	}
              ^
      330.   
      331.   int EVP_PKEY_assign(EVP_PKEY *pkey, int type, char *key)

crypto/asn1/x_pubkey.c:281:6: Taking true branch
    279.   
    280.   	type=OBJ_obj2nid(key->algor->algorithm);
    281.   	if ((ret = EVP_PKEY_new()) == NULL)
                ^
    282.   		{
    283.   		X509err(X509_F_X509_PUBKEY_GET, ERR_R_MALLOC_FAILURE);

crypto/asn1/x_pubkey.c:283:3: 
    281.   	if ((ret = EVP_PKEY_new()) == NULL)
    282.   		{
    283. > 		X509err(X509_F_X509_PUBKEY_GET, ERR_R_MALLOC_FAILURE);
    284.   		goto err;
    285.   		}

crypto/err/err.c:668:1: start of procedure ERR_put_error()
      666.   /********************************************************/
      667.   
      668. > void ERR_put_error(int lib, int func, int reason, const char *file,
      669.   	     int line)
      670.   	{

crypto/err/err.c:692:2: Skipping ERR_get_state(): empty list of specs
      690.   	}
      691.   #endif
      692.   	es=ERR_get_state();
              ^
      693.   
      694.   	es->top=(es->top+1)%ERR_NUM_ERRORS;

crypto/err/err.c:694:2: 
      692.   	es=ERR_get_state();
      693.   
      694. > 	es->top=(es->top+1)%ERR_NUM_ERRORS;
      695.   	if (es->top == es->bottom)
      696.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;

crypto/err/err.c:695:6: Taking false branch
      693.   
      694.   	es->top=(es->top+1)%ERR_NUM_ERRORS;
      695.   	if (es->top == es->bottom)
                  ^
      696.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
      697.   	es->err_flags[es->top]=0;

crypto/err/err.c:697:2: 
      695.   	if (es->top == es->bottom)
      696.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
      697. > 	es->err_flags[es->top]=0;
      698.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
      699.   	es->err_file[es->top]=file;

crypto/err/err.c:698:2: 
      696.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
      697.   	es->err_flags[es->top]=0;
      698. > 	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
      699.   	es->err_file[es->top]=file;
      700.   	es->err_line[es->top]=line;

crypto/err/err.c:699:2: 
      697.   	es->err_flags[es->top]=0;
      698.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
      699. > 	es->err_file[es->top]=file;
      700.   	es->err_line[es->top]=line;
      701.   	err_clear_data(es,es->top);

crypto/err/err.c:700:2: 
      698.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
      699.   	es->err_file[es->top]=file;
      700. > 	es->err_line[es->top]=line;
      701.   	err_clear_data(es,es->top);
      702.   	}

crypto/err/err.c:701:2: Taking true branch
      699.   	es->err_file[es->top]=file;
      700.   	es->err_line[es->top]=line;
      701.   	err_clear_data(es,es->top);
              ^
      702.   	}
      703.   

crypto/err/err.c:701:2: Taking false branch
      699.   	es->err_file[es->top]=file;
      700.   	es->err_line[es->top]=line;
      701.   	err_clear_data(es,es->top);
              ^
      702.   	}
      703.   

crypto/err/err.c:701:2: Loop condition is false. Leaving loop
      699.   	es->err_file[es->top]=file;
      700.   	es->err_line[es->top]=line;
      701.   	err_clear_data(es,es->top);
              ^
      702.   	}
      703.   

crypto/err/err.c:702:2: return from a call to ERR_put_error
      700.   	es->err_line[es->top]=line;
      701.   	err_clear_data(es,es->top);
      702.   	}
              ^
      703.   
      704.   void ERR_clear_error(void)

crypto/asn1/x_pubkey.c:374:1: 
    372.   	CRYPTO_add(&ret->references, 1, CRYPTO_LOCK_EVP_PKEY);
    373.   	return(ret);
    374. > err:
    375.   	if (ret != NULL)
    376.   		EVP_PKEY_free(ret);

crypto/asn1/x_pubkey.c:375:6: Taking false branch
    373.   	return(ret);
    374.   err:
    375.   	if (ret != NULL)
                ^
    376.   		EVP_PKEY_free(ret);
    377.   	return(NULL);

crypto/asn1/x_pubkey.c:377:2: 
    375.   	if (ret != NULL)
    376.   		EVP_PKEY_free(ret);
    377. > 	return(NULL);
    378.   	}
    379.   

crypto/asn1/x_pubkey.c:378:2: return from a call to X509_PUBKEY_get
    376.   		EVP_PKEY_free(ret);
    377.   	return(NULL);
    378.   	}
            ^
    379.   
    380.   /* Now two pseudo ASN1 routines that take an EVP_PKEY structure

crypto/x509/x509_cmp.c:379:2: return from a call to X509_get_pubkey
  377.   		return(NULL);
  378.   	return(X509_PUBKEY_get(x->cert_info->key));
  379.   	}
          ^
  380.   
  381.   ASN1_BIT_STRING *X509_get0_pubkey_bitstr(const X509 *x)

ssl/s3_clnt.c:2529:2: Skipping X509_certificate_type(): empty list of specs
2527.   #endif
2528.   	pkey=X509_get_pubkey(sc->peer_pkeys[idx].x509);
2529.   	i=X509_certificate_type(sc->peer_pkeys[idx].x509,pkey);
         ^
2530.   	EVP_PKEY_free(pkey);
2531.   

ssl/s3_clnt.c:2530:2: 
2528.   	pkey=X509_get_pubkey(sc->peer_pkeys[idx].x509);
2529.   	i=X509_certificate_type(sc->peer_pkeys[idx].x509,pkey);
2530. > 	EVP_PKEY_free(pkey);
2531.   
2532.   	
