ssl/statem/statem_srvr.c:2995: error: NULL_DEREFERENCE
  pointer `pkey` last assigned on line 2979 could be null and is dereferenced at line 2995, column 40.
Showing all 24 steps of the trace


ssl/statem/statem_srvr.c:2963:1: start of procedure tls_process_cert_verify()
2961.   }
2962.   
2963. > MSG_PROCESS_RETURN tls_process_cert_verify(SSL *s, PACKET *pkt)
2964.   {
2965.       EVP_PKEY *pkey = NULL;

ssl/statem/statem_srvr.c:2965:5: 
2963.   MSG_PROCESS_RETURN tls_process_cert_verify(SSL *s, PACKET *pkt)
2964.   {
2965. >     EVP_PKEY *pkey = NULL;
2966.       unsigned char *sig, *data;
2967.       int al, ret = MSG_PROCESS_ERROR;

ssl/statem/statem_srvr.c:2967:5: 
2965.       EVP_PKEY *pkey = NULL;
2966.       unsigned char *sig, *data;
2967. >     int al, ret = MSG_PROCESS_ERROR;
2968.       int type = 0, j;
2969.       unsigned int len;

ssl/statem/statem_srvr.c:2968:5: 
2966.       unsigned char *sig, *data;
2967.       int al, ret = MSG_PROCESS_ERROR;
2968. >     int type = 0, j;
2969.       unsigned int len;
2970.       X509 *peer;

ssl/statem/statem_srvr.c:2971:5: 
2969.       unsigned int len;
2970.       X509 *peer;
2971. >     const EVP_MD *md = NULL;
2972.       long hdatalen = 0;
2973.       void *hdata;

ssl/statem/statem_srvr.c:2972:5: 
2970.       X509 *peer;
2971.       const EVP_MD *md = NULL;
2972. >     long hdatalen = 0;
2973.       void *hdata;
2974.   

ssl/statem/statem_srvr.c:2976:5: 
2974.   
2975.       EVP_MD_CTX mctx;
2976. >     EVP_MD_CTX_init(&mctx);
2977.   
2978.       peer = s->session->peer;

crypto/evp/digest.c:120:1: start of procedure EVP_MD_CTX_init()
  118.   #endif
  119.   
  120. > void EVP_MD_CTX_init(EVP_MD_CTX *ctx)
  121.   {
  122.       memset(ctx, 0, sizeof(*ctx));

crypto/evp/digest.c:122:5: 
  120.   void EVP_MD_CTX_init(EVP_MD_CTX *ctx)
  121.   {
  122. >     memset(ctx, 0, sizeof(*ctx));
  123.   }
  124.   

crypto/evp/digest.c:123:1: return from a call to EVP_MD_CTX_init
  121.   {
  122.       memset(ctx, 0, sizeof(*ctx));
  123. > }
  124.   
  125.   EVP_MD_CTX *EVP_MD_CTX_create(void)

ssl/statem/statem_srvr.c:2978:5: 
2976.       EVP_MD_CTX_init(&mctx);
2977.   
2978. >     peer = s->session->peer;
2979.       pkey = X509_get_pubkey(peer);
2980.       type = X509_certificate_type(peer, pkey);

ssl/statem/statem_srvr.c:2979:5: 
2977.   
2978.       peer = s->session->peer;
2979. >     pkey = X509_get_pubkey(peer);
2980.       type = X509_certificate_type(peer, pkey);
2981.   

crypto/x509/x509_cmp.c:305:1: start of procedure X509_get_pubkey()
  303.   }
  304.   
  305. > EVP_PKEY *X509_get_pubkey(X509 *x)
  306.   {
  307.       if (x == NULL)

crypto/x509/x509_cmp.c:307:9: Taking true branch
  305.   EVP_PKEY *X509_get_pubkey(X509 *x)
  306.   {
  307.       if (x == NULL)
                 ^
  308.           return (NULL);
  309.       return (X509_PUBKEY_get(x->cert_info.key));

crypto/x509/x509_cmp.c:308:9: 
  306.   {
  307.       if (x == NULL)
  308. >         return (NULL);
  309.       return (X509_PUBKEY_get(x->cert_info.key));
  310.   }

crypto/x509/x509_cmp.c:310:1: return from a call to X509_get_pubkey
  308.           return (NULL);
  309.       return (X509_PUBKEY_get(x->cert_info.key));
  310. > }
  311.   
  312.   ASN1_BIT_STRING *X509_get0_pubkey_bitstr(const X509 *x)

ssl/statem/statem_srvr.c:2980:5: Skipping X509_certificate_type(): empty list of specs
2978.       peer = s->session->peer;
2979.       pkey = X509_get_pubkey(peer);
2980.       type = X509_certificate_type(peer, pkey);
            ^
2981.   
2982.       if (!(type & EVP_PKT_SIGN)) {

ssl/statem/statem_srvr.c:2982:11: Taking false branch
2980.       type = X509_certificate_type(peer, pkey);
2981.   
2982.       if (!(type & EVP_PKT_SIGN)) {
                  ^
2983.           SSLerr(SSL_F_TLS_PROCESS_CERT_VERIFY,
2984.                  SSL_R_SIGNATURE_FOR_NON_SIGNING_CERTIFICATE);

ssl/statem/statem_srvr.c:2995:9: 
2993.        */
2994.   #ifndef OPENSSL_NO_GOST
2995. >     if (PACKET_remaining(pkt) == 64 && pkey->type == NID_id_GostR3410_2001) {
2996.           len = 64;
2997.       } else

ssl/packet_locl.h:89:1: start of procedure PACKET_remaining()
  87.    * Returns the number of bytes remaining to be read in the PACKET
  88.    */
  89. > static inline size_t PACKET_remaining(const PACKET *pkt)
  90.   {
  91.       return pkt->remaining;

ssl/packet_locl.h:91:5: 
  89.   static inline size_t PACKET_remaining(const PACKET *pkt)
  90.   {
  91. >     return pkt->remaining;
  92.   }
  93.   

ssl/packet_locl.h:92:1: return from a call to PACKET_remaining
  90.   {
  91.       return pkt->remaining;
  92. > }
  93.   
  94.   /*

ssl/statem/statem_srvr.c:2995:9: Taking true branch
2993.        */
2994.   #ifndef OPENSSL_NO_GOST
2995.       if (PACKET_remaining(pkt) == 64 && pkey->type == NID_id_GostR3410_2001) {
                ^
2996.           len = 64;
2997.       } else

ssl/statem/statem_srvr.c:2995:40: 
2993.        */
2994.   #ifndef OPENSSL_NO_GOST
2995. >     if (PACKET_remaining(pkt) == 64 && pkey->type == NID_id_GostR3410_2001) {
2996.           len = 64;
2997.       } else
