ssl/s3_both.c:503: error: NULL_DEREFERENCE
  pointer `pk` last assigned on line 463 could be null and is dereferenced by call to `EVP_PKEY_free()` at line 503, column 12.
Showing all 13 steps of the trace


ssl/s3_both.c:457:1: start of procedure ssl_cert_type()
455.   	}
456.   
457. > int ssl_cert_type(X509 *x, EVP_PKEY *pkey)
458.   	{
459.   	EVP_PKEY *pk;

ssl/s3_both.c:460:2: 
458.   	{
459.   	EVP_PKEY *pk;
460. > 	int ret= -1,i,j;
461.   
462.   	if (pkey == NULL)

ssl/s3_both.c:462:6: Taking true branch
460.   	int ret= -1,i,j;
461.   
462.   	if (pkey == NULL)
            ^
463.   		pk=X509_get_pubkey(x);
464.   	else

ssl/s3_both.c:463:3: 
461.   
462.   	if (pkey == NULL)
463. > 		pk=X509_get_pubkey(x);
464.   	else
465.   		pk=pkey;

crypto/x509/x509_cmp.c:254:1: start of procedure X509_get_pubkey()
  252.   	}
  253.   
  254. > EVP_PKEY *X509_get_pubkey(X509 *x)
  255.   	{
  256.   	if ((x == NULL) || (x->cert_info == NULL))

crypto/x509/x509_cmp.c:256:7: Taking false branch
  254.   EVP_PKEY *X509_get_pubkey(X509 *x)
  255.   	{
  256.   	if ((x == NULL) || (x->cert_info == NULL))
               ^
  257.   		return(NULL);
  258.   	return(X509_PUBKEY_get(x->cert_info->key));

crypto/x509/x509_cmp.c:256:22: Taking true branch
  254.   EVP_PKEY *X509_get_pubkey(X509 *x)
  255.   	{
  256.   	if ((x == NULL) || (x->cert_info == NULL))
                              ^
  257.   		return(NULL);
  258.   	return(X509_PUBKEY_get(x->cert_info->key));

crypto/x509/x509_cmp.c:257:3: 
  255.   	{
  256.   	if ((x == NULL) || (x->cert_info == NULL))
  257. > 		return(NULL);
  258.   	return(X509_PUBKEY_get(x->cert_info->key));
  259.   	}

crypto/x509/x509_cmp.c:259:2: return from a call to X509_get_pubkey
  257.   		return(NULL);
  258.   	return(X509_PUBKEY_get(x->cert_info->key));
  259.   	}
          ^
  260.   
  261.   int X509_check_private_key(X509 *x, EVP_PKEY *k)

ssl/s3_both.c:466:6: Taking true branch
464.   	else
465.   		pk=pkey;
466.   	if (pk == NULL) goto err;
            ^
467.   
468.   	i=pk->type;

ssl/s3_both.c:502:1: 
500.   		ret= -1;
501.   
502. > err:
503.   	if(!pkey) EVP_PKEY_free(pk);
504.   	return(ret);

ssl/s3_both.c:503:6: Taking true branch
501.   
502.   err:
503.   	if(!pkey) EVP_PKEY_free(pk);
            ^
504.   	return(ret);
505.   	}

ssl/s3_both.c:503:12: 
501.   
502.   err:
503. > 	if(!pkey) EVP_PKEY_free(pk);
504.   	return(ret);
505.   	}
