crypto/ec/ec_ameth.c:705: error: NULL_DEREFERENCE
  pointer `ecpeer` last assigned on line 681 could be null and is dereferenced by call to `EC_KEY_free()` at line 705, column 5.
Showing all 55 steps of the trace


crypto/ec/ec_ameth.c:659:1: start of procedure ecdh_cms_set_peerkey()
657.   #ifndef OPENSSL_NO_CMS
658.   
659. > static int ecdh_cms_set_peerkey(EVP_PKEY_CTX *pctx,
660.                                   X509_ALGOR *alg, ASN1_BIT_STRING *pubkey)
661.   {

crypto/ec/ec_ameth.c:665:5: 
663.       int atype;
664.       void *aval;
665. >     int rv = 0;
666.       EVP_PKEY *pkpeer = NULL;
667.       EC_KEY *ecpeer = NULL;

crypto/ec/ec_ameth.c:666:5: 
664.       void *aval;
665.       int rv = 0;
666. >     EVP_PKEY *pkpeer = NULL;
667.       EC_KEY *ecpeer = NULL;
668.       const unsigned char *p;

crypto/ec/ec_ameth.c:667:5: 
665.       int rv = 0;
666.       EVP_PKEY *pkpeer = NULL;
667. >     EC_KEY *ecpeer = NULL;
668.       const unsigned char *p;
669.       int plen;

crypto/ec/ec_ameth.c:670:5: 
668.       const unsigned char *p;
669.       int plen;
670. >     X509_ALGOR_get0(&aoid, &atype, &aval, alg);
671.       if (OBJ_obj2nid(aoid) != NID_X9_62_id_ecPublicKey)
672.           goto err;

crypto/asn1/x_algor.c:103:1: start of procedure X509_ALGOR_get0()
  101.   }
  102.   
  103. > void X509_ALGOR_get0(ASN1_OBJECT **paobj, int *pptype, void **ppval,
  104.                        X509_ALGOR *algor)
  105.   {

crypto/asn1/x_algor.c:106:9: Taking true branch
  104.                        X509_ALGOR *algor)
  105.   {
  106.       if (paobj)
                 ^
  107.           *paobj = algor->algorithm;
  108.       if (pptype) {

crypto/asn1/x_algor.c:107:9: 
  105.   {
  106.       if (paobj)
  107. >         *paobj = algor->algorithm;
  108.       if (pptype) {
  109.           if (algor->parameter == NULL) {

crypto/asn1/x_algor.c:108:9: Taking true branch
  106.       if (paobj)
  107.           *paobj = algor->algorithm;
  108.       if (pptype) {
                 ^
  109.           if (algor->parameter == NULL) {
  110.               *pptype = V_ASN1_UNDEF;

crypto/asn1/x_algor.c:109:13: Taking false branch
  107.           *paobj = algor->algorithm;
  108.       if (pptype) {
  109.           if (algor->parameter == NULL) {
                     ^
  110.               *pptype = V_ASN1_UNDEF;
  111.               return;

crypto/asn1/x_algor.c:113:13: 
  111.               return;
  112.           } else
  113. >             *pptype = algor->parameter->type;
  114.           if (ppval)
  115.               *ppval = algor->parameter->value.ptr;

crypto/asn1/x_algor.c:114:13: Taking true branch
  112.           } else
  113.               *pptype = algor->parameter->type;
  114.           if (ppval)
                     ^
  115.               *ppval = algor->parameter->value.ptr;
  116.       }

crypto/asn1/x_algor.c:115:13: 
  113.               *pptype = algor->parameter->type;
  114.           if (ppval)
  115. >             *ppval = algor->parameter->value.ptr;
  116.       }
  117.   }

crypto/asn1/x_algor.c:108:5: 
  106.       if (paobj)
  107.           *paobj = algor->algorithm;
  108. >     if (pptype) {
  109.           if (algor->parameter == NULL) {
  110.               *pptype = V_ASN1_UNDEF;

crypto/asn1/x_algor.c:117:1: return from a call to X509_ALGOR_get0
  115.               *ppval = algor->parameter->value.ptr;
  116.       }
  117. > }
  118.   
  119.   /* Set up an X509_ALGOR DigestAlgorithmIdentifier from an EVP_MD */

crypto/ec/ec_ameth.c:671:9: 
669.       int plen;
670.       X509_ALGOR_get0(&aoid, &atype, &aval, alg);
671. >     if (OBJ_obj2nid(aoid) != NID_X9_62_id_ecPublicKey)
672.           goto err;
673.       /* If absent parameters get group from main key */

crypto/objects/obj_dat.c:390:1: start of procedure OBJ_obj2nid()
  388.   IMPLEMENT_OBJ_BSEARCH_CMP_FN(const ASN1_OBJECT *, unsigned int, obj);
  389.   
  390. > int OBJ_obj2nid(const ASN1_OBJECT *a)
  391.   {
  392.       const unsigned int *op;

crypto/objects/obj_dat.c:395:9: Taking false branch
  393.       ADDED_OBJ ad, *adp;
  394.   
  395.       if (a == NULL)
                 ^
  396.           return (NID_undef);
  397.       if (a->nid != 0)

crypto/objects/obj_dat.c:397:9: Taking false branch
  395.       if (a == NULL)
  396.           return (NID_undef);
  397.       if (a->nid != 0)
                 ^
  398.           return (a->nid);
  399.   

crypto/objects/obj_dat.c:400:9: Taking false branch
  398.           return (a->nid);
  399.   
  400.       if (a->length == 0)
                 ^
  401.           return NID_undef;
  402.   

crypto/objects/obj_dat.c:403:9: Taking true branch
  401.           return NID_undef;
  402.   
  403.       if (added != NULL) {
                 ^
  404.           ad.type = ADDED_DATA;
  405.           ad.obj = (ASN1_OBJECT *)a; /* XXX: ugly but harmless */

crypto/objects/obj_dat.c:404:9: 
  402.   
  403.       if (added != NULL) {
  404. >         ad.type = ADDED_DATA;
  405.           ad.obj = (ASN1_OBJECT *)a; /* XXX: ugly but harmless */
  406.           adp = lh_ADDED_OBJ_retrieve(added, &ad);

crypto/objects/obj_dat.c:405:9: 
  403.       if (added != NULL) {
  404.           ad.type = ADDED_DATA;
  405. >         ad.obj = (ASN1_OBJECT *)a; /* XXX: ugly but harmless */
  406.           adp = lh_ADDED_OBJ_retrieve(added, &ad);
  407.           if (adp != NULL)

crypto/objects/obj_dat.c:406:15: Condition is true
  404.           ad.type = ADDED_DATA;
  405.           ad.obj = (ASN1_OBJECT *)a; /* XXX: ugly but harmless */
  406.           adp = lh_ADDED_OBJ_retrieve(added, &ad);
                       ^
  407.           if (adp != NULL)
  408.               return (adp->obj->nid);

crypto/objects/obj_dat.c:406:15: Condition is true
  404.           ad.type = ADDED_DATA;
  405.           ad.obj = (ASN1_OBJECT *)a; /* XXX: ugly but harmless */
  406.           adp = lh_ADDED_OBJ_retrieve(added, &ad);
                       ^
  407.           if (adp != NULL)
  408.               return (adp->obj->nid);

crypto/objects/obj_dat.c:406:9: 
  404.           ad.type = ADDED_DATA;
  405.           ad.obj = (ASN1_OBJECT *)a; /* XXX: ugly but harmless */
  406. >         adp = lh_ADDED_OBJ_retrieve(added, &ad);
  407.           if (adp != NULL)
  408.               return (adp->obj->nid);

crypto/lhash/lhash.c:217:1: start of procedure lh_retrieve()
    215.   }
    216.   
    217. > void *lh_retrieve(_LHASH *lh, const void *data)
    218.   {
    219.       unsigned long hash;

crypto/lhash/lhash.c:223:5: 
    221.       void *ret;
    222.   
    223. >     lh->error = 0;
    224.       rn = getrn(lh, data, &hash);
    225.   

crypto/lhash/lhash.c:224:5: Skipping getrn(): empty list of specs
    222.   
    223.       lh->error = 0;
    224.       rn = getrn(lh, data, &hash);
               ^
    225.   
    226.       if (*rn == NULL) {

crypto/lhash/lhash.c:226:9: Taking false branch
    224.       rn = getrn(lh, data, &hash);
    225.   
    226.       if (*rn == NULL) {
                   ^
    227.           lh->num_retrieve_miss++;
    228.           return (NULL);

crypto/lhash/lhash.c:230:9: 
    228.           return (NULL);
    229.       } else {
    230. >         ret = (*rn)->data;
    231.           lh->num_retrieve++;
    232.       }

crypto/lhash/lhash.c:231:9: 
    229.       } else {
    230.           ret = (*rn)->data;
    231. >         lh->num_retrieve++;
    232.       }
    233.       return (ret);

crypto/lhash/lhash.c:233:5: 
    231.           lh->num_retrieve++;
    232.       }
    233. >     return (ret);
    234.   }
    235.   

crypto/lhash/lhash.c:234:1: return from a call to lh_retrieve
    232.       }
    233.       return (ret);
    234. > }
    235.   
    236.   static void doall_util_fn(_LHASH *lh, int use_arg, LHASH_DOALL_FN_TYPE func,

crypto/objects/obj_dat.c:407:13: Taking true branch
  405.           ad.obj = (ASN1_OBJECT *)a; /* XXX: ugly but harmless */
  406.           adp = lh_ADDED_OBJ_retrieve(added, &ad);
  407.           if (adp != NULL)
                     ^
  408.               return (adp->obj->nid);
  409.       }

crypto/objects/obj_dat.c:408:13: 
  406.           adp = lh_ADDED_OBJ_retrieve(added, &ad);
  407.           if (adp != NULL)
  408. >             return (adp->obj->nid);
  409.       }
  410.       op = OBJ_bsearch_obj(&a, obj_objs, NUM_OBJ);

crypto/objects/obj_dat.c:414:1: return from a call to OBJ_obj2nid
  412.           return (NID_undef);
  413.       return (nid_objs[*op].nid);
  414. > }
  415.   
  416.   /*

crypto/ec/ec_ameth.c:671:9: Taking false branch
669.       int plen;
670.       X509_ALGOR_get0(&aoid, &atype, &aval, alg);
671.       if (OBJ_obj2nid(aoid) != NID_X9_62_id_ecPublicKey)
               ^
672.           goto err;
673.       /* If absent parameters get group from main key */

crypto/ec/ec_ameth.c:674:9: Taking true branch
672.           goto err;
673.       /* If absent parameters get group from main key */
674.       if (atype == V_ASN1_UNDEF || atype == V_ASN1_NULL) {
               ^
675.           const EC_GROUP *grp;
676.           EVP_PKEY *pk;

crypto/ec/ec_ameth.c:677:9: 
675.           const EC_GROUP *grp;
676.           EVP_PKEY *pk;
677. >         pk = EVP_PKEY_CTX_get0_pkey(pctx);
678.           if (!pk)
679.               goto err;

crypto/evp/pmeth_lib.c:411:1: start of procedure EVP_PKEY_CTX_get0_pkey()
  409.   }
  410.   
  411. > EVP_PKEY *EVP_PKEY_CTX_get0_pkey(EVP_PKEY_CTX *ctx)
  412.   {
  413.       return ctx->pkey;

crypto/evp/pmeth_lib.c:413:5: 
  411.   EVP_PKEY *EVP_PKEY_CTX_get0_pkey(EVP_PKEY_CTX *ctx)
  412.   {
  413. >     return ctx->pkey;
  414.   }
  415.   

crypto/evp/pmeth_lib.c:414:1: return from a call to EVP_PKEY_CTX_get0_pkey
  412.   {
  413.       return ctx->pkey;
  414. > }
  415.   
  416.   EVP_PKEY *EVP_PKEY_CTX_get0_peerkey(EVP_PKEY_CTX *ctx)

crypto/ec/ec_ameth.c:678:14: Taking false branch
676.           EVP_PKEY *pk;
677.           pk = EVP_PKEY_CTX_get0_pkey(pctx);
678.           if (!pk)
                    ^
679.               goto err;
680.           grp = EC_KEY_get0_group(pk->pkey.ec);

crypto/ec/ec_ameth.c:680:9: 
678.           if (!pk)
679.               goto err;
680. >         grp = EC_KEY_get0_group(pk->pkey.ec);
681.           ecpeer = EC_KEY_new();
682.           if (ecpeer == NULL)

crypto/ec/ec_key.c:450:1: start of procedure EC_KEY_get0_group()
  448.   }
  449.   
  450. > const EC_GROUP *EC_KEY_get0_group(const EC_KEY *key)
  451.   {
  452.       return key->group;

crypto/ec/ec_key.c:452:5: 
  450.   const EC_GROUP *EC_KEY_get0_group(const EC_KEY *key)
  451.   {
  452. >     return key->group;
  453.   }
  454.   

crypto/ec/ec_key.c:453:1: return from a call to EC_KEY_get0_group
  451.   {
  452.       return key->group;
  453. > }
  454.   
  455.   int EC_KEY_set_group(EC_KEY *key, const EC_GROUP *group)

crypto/ec/ec_ameth.c:681:9: 
679.               goto err;
680.           grp = EC_KEY_get0_group(pk->pkey.ec);
681. >         ecpeer = EC_KEY_new();
682.           if (ecpeer == NULL)
683.               goto err;

crypto/ec/ec_key.c:72:1: start of procedure EC_KEY_new()
  70.   #endif
  71.   
  72. > EC_KEY *EC_KEY_new(void)
  73.   {
  74.       return EC_KEY_new_method(NULL);

crypto/ec/ec_key.c:74:5: Skipping EC_KEY_new_method(): empty list of specs
  72.   EC_KEY *EC_KEY_new(void)
  73.   {
  74.       return EC_KEY_new_method(NULL);
            ^
  75.   }
  76.   

crypto/ec/ec_key.c:75:1: return from a call to EC_KEY_new
  73.   {
  74.       return EC_KEY_new_method(NULL);
  75. > }
  76.   
  77.   EC_KEY *EC_KEY_new_by_curve_name(int nid)

crypto/ec/ec_ameth.c:682:13: Taking true branch
680.           grp = EC_KEY_get0_group(pk->pkey.ec);
681.           ecpeer = EC_KEY_new();
682.           if (ecpeer == NULL)
                   ^
683.               goto err;
684.           if (!EC_KEY_set_group(ecpeer, grp))

crypto/ec/ec_ameth.c:704:2: 
702.       if (EVP_PKEY_derive_set_peer(pctx, pkpeer) > 0)
703.           rv = 1;
704. >  err:
705.       EC_KEY_free(ecpeer);
706.       EVP_PKEY_free(pkpeer);

crypto/ec/ec_ameth.c:705:5: 
703.           rv = 1;
704.    err:
705. >     EC_KEY_free(ecpeer);
706.       EVP_PKEY_free(pkpeer);
707.       return rv;
