ssl/s3_srvr.c:2877: error: NULL_DEREFERENCE
  pointer `pkey` last assigned on line 2856 could be null and is dereferenced at line 2877, column 21.
Showing all 34 steps of the trace


ssl/s3_srvr.c:2819:1: start of procedure ssl3_get_cert_verify()
2817.   }
2818.   
2819. > int ssl3_get_cert_verify(SSL *s)
2820.   {
2821.       EVP_PKEY *pkey = NULL;

ssl/s3_srvr.c:2821:5: 
2819.   int ssl3_get_cert_verify(SSL *s)
2820.   {
2821. >     EVP_PKEY *pkey = NULL;
2822.       unsigned char *sig, *data;
2823.       int al, ok, ret = 0;

ssl/s3_srvr.c:2823:5: 
2821.       EVP_PKEY *pkey = NULL;
2822.       unsigned char *sig, *data;
2823. >     int al, ok, ret = 0;
2824.       long n;
2825.       int type = 0, i, j;

ssl/s3_srvr.c:2825:5: 
2823.       int al, ok, ret = 0;
2824.       long n;
2825. >     int type = 0, i, j;
2826.       unsigned int len;
2827.       X509 *peer;

ssl/s3_srvr.c:2828:5: 
2826.       unsigned int len;
2827.       X509 *peer;
2828. >     const EVP_MD *md = NULL;
2829.       EVP_MD_CTX mctx;
2830.       PACKET pkt;

ssl/s3_srvr.c:2831:5: 
2829.       EVP_MD_CTX mctx;
2830.       PACKET pkt;
2831. >     EVP_MD_CTX_init(&mctx);
2832.   
2833.       /*

crypto/evp/digest.c:120:1: start of procedure EVP_MD_CTX_init()
  118.   #endif
  119.   
  120. > void EVP_MD_CTX_init(EVP_MD_CTX *ctx)
  121.   {
  122.       memset(ctx, 0, sizeof(*ctx));

crypto/evp/digest.c:122:5: 
  120.   void EVP_MD_CTX_init(EVP_MD_CTX *ctx)
  121.   {
  122. >     memset(ctx, 0, sizeof(*ctx));
  123.   }
  124.   

crypto/evp/digest.c:123:1: return from a call to EVP_MD_CTX_init
  121.   {
  122.       memset(ctx, 0, sizeof(*ctx));
  123. > }
  124.   
  125.   EVP_MD_CTX *EVP_MD_CTX_create(void)

ssl/s3_srvr.c:2841:9: Taking false branch
2839.        * CertificateVerify state so we should not arrive here.
2840.        */
2841.       if (s->session->peer == NULL) {
                ^
2842.           ret = 1;
2843.           goto end;

ssl/s3_srvr.c:2846:5: Skipping __function_pointer__(): unresolved function pointer
2844.       }
2845.   
2846.       n = s->method->ssl_get_message(s,
            ^
2847.                                      SSL3_ST_SR_CERT_VRFY_A,
2848.                                      SSL3_ST_SR_CERT_VRFY_B,

ssl/s3_srvr.c:2852:10: Taking false branch
2850.                                      SSL3_RT_MAX_PLAIN_LENGTH, &ok);
2851.   
2852.       if (!ok)
                 ^
2853.           return ((int)n);
2854.   

ssl/s3_srvr.c:2855:5: 
2853.           return ((int)n);
2854.   
2855. >     peer = s->session->peer;
2856.       pkey = X509_get_pubkey(peer);
2857.       type = X509_certificate_type(peer, pkey);

ssl/s3_srvr.c:2856:5: 
2854.   
2855.       peer = s->session->peer;
2856. >     pkey = X509_get_pubkey(peer);
2857.       type = X509_certificate_type(peer, pkey);
2858.   

crypto/x509/x509_cmp.c:307:1: start of procedure X509_get_pubkey()
  305.   }
  306.   
  307. > EVP_PKEY *X509_get_pubkey(X509 *x)
  308.   {
  309.       if ((x == NULL) || (x->cert_info == NULL))

crypto/x509/x509_cmp.c:309:10: Taking false branch
  307.   EVP_PKEY *X509_get_pubkey(X509 *x)
  308.   {
  309.       if ((x == NULL) || (x->cert_info == NULL))
                  ^
  310.           return (NULL);
  311.       return (X509_PUBKEY_get(x->cert_info->key));

crypto/x509/x509_cmp.c:309:25: Taking true branch
  307.   EVP_PKEY *X509_get_pubkey(X509 *x)
  308.   {
  309.       if ((x == NULL) || (x->cert_info == NULL))
                                 ^
  310.           return (NULL);
  311.       return (X509_PUBKEY_get(x->cert_info->key));

crypto/x509/x509_cmp.c:310:9: 
  308.   {
  309.       if ((x == NULL) || (x->cert_info == NULL))
  310. >         return (NULL);
  311.       return (X509_PUBKEY_get(x->cert_info->key));
  312.   }

crypto/x509/x509_cmp.c:312:1: return from a call to X509_get_pubkey
  310.           return (NULL);
  311.       return (X509_PUBKEY_get(x->cert_info->key));
  312. > }
  313.   
  314.   ASN1_BIT_STRING *X509_get0_pubkey_bitstr(const X509 *x)

ssl/s3_srvr.c:2857:5: Skipping X509_certificate_type(): empty list of specs
2855.       peer = s->session->peer;
2856.       pkey = X509_get_pubkey(peer);
2857.       type = X509_certificate_type(peer, pkey);
            ^
2858.   
2859.       if (!(type & EVP_PKT_SIGN)) {

ssl/s3_srvr.c:2859:11: Taking false branch
2857.       type = X509_certificate_type(peer, pkey);
2858.   
2859.       if (!(type & EVP_PKT_SIGN)) {
                  ^
2860.           SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,
2861.                  SSL_R_SIGNATURE_FOR_NON_SIGNING_CERTIFICATE);

ssl/s3_srvr.c:2867:10: 
2865.   
2866.       /* we now have a signature that we need to verify */
2867. >     if (!PACKET_buf_init(&pkt, s->init_msg, n)) {
2868.           SSLerr(SSL_F_SSL3_GET_CERT_VERIFY, ERR_R_INTERNAL_ERROR);
2869.           al = SSL_AD_INTERNAL_ERROR;

ssl/packet_locl.h:96:1: start of procedure PACKET_buf_init()
  94.    * is being used.
  95.    */
  96. > static inline int PACKET_buf_init(PACKET *pkt, unsigned char *buf, size_t len)
  97.   {
  98.       pkt->start = pkt->curr = buf;

ssl/packet_locl.h:98:5: 
  96.   static inline int PACKET_buf_init(PACKET *pkt, unsigned char *buf, size_t len)
  97.   {
  98. >     pkt->start = pkt->curr = buf;
  99.       pkt->end = pkt->start + len;
  100.   

ssl/packet_locl.h:99:5: 
  97.   {
  98.       pkt->start = pkt->curr = buf;
  99. >     pkt->end = pkt->start + len;
  100.   
  101.       /* Sanity checks */

ssl/packet_locl.h:102:9: Taking false branch
  100.   
  101.       /* Sanity checks */
  102.       if (pkt->start > pkt->end
                 ^
  103.               || pkt->curr < pkt->start
  104.               || pkt->curr > pkt->end

ssl/packet_locl.h:103:16: Taking false branch
  101.       /* Sanity checks */
  102.       if (pkt->start > pkt->end
  103.               || pkt->curr < pkt->start
                        ^
  104.               || pkt->curr > pkt->end
  105.               || len != (size_t)(pkt->end - pkt->start)) {

ssl/packet_locl.h:104:16: Taking false branch
  102.       if (pkt->start > pkt->end
  103.               || pkt->curr < pkt->start
  104.               || pkt->curr > pkt->end
                        ^
  105.               || len != (size_t)(pkt->end - pkt->start)) {
  106.           return 0;

ssl/packet_locl.h:105:16: Taking false branch
  103.               || pkt->curr < pkt->start
  104.               || pkt->curr > pkt->end
  105.               || len != (size_t)(pkt->end - pkt->start)) {
                        ^
  106.           return 0;
  107.       }

ssl/packet_locl.h:109:5: 
  107.       }
  108.   
  109. >     return 1;
  110.   }
  111.   

ssl/packet_locl.h:110:1: return from a call to PACKET_buf_init
  108.   
  109.       return 1;
  110. > }
  111.   
  112.   /*

ssl/s3_srvr.c:2867:10: Taking false branch
2865.   
2866.       /* we now have a signature that we need to verify */
2867.       if (!PACKET_buf_init(&pkt, s->init_msg, n)) {
                 ^
2868.           SSLerr(SSL_F_SSL3_GET_CERT_VERIFY, ERR_R_INTERNAL_ERROR);
2869.           al = SSL_AD_INTERNAL_ERROR;

ssl/s3_srvr.c:2877:9: Taking true branch
2875.        * length field
2876.        */
2877.       if (n == 64 && (pkey->type == NID_id_GostR3410_94 ||
                ^
2878.                       pkey->type == NID_id_GostR3410_2001)) {
2879.           len = 64;

ssl/s3_srvr.c:2877:21: 
2875.        * length field
2876.        */
2877. >     if (n == 64 && (pkey->type == NID_id_GostR3410_94 ||
2878.                       pkey->type == NID_id_GostR3410_2001)) {
2879.           len = 64;
