ssl/s3_srvr.c:1566: error: NULL_DEREFERENCE
  pointer `pkey` last assigned on line 1453 could be null and is dereferenced by call to `EVP_PKEY_free()` at line 1566, column 2.
Showing all 29 steps of the trace


ssl/s3_srvr.c:1432:1: start of procedure ssl3_get_cert_verify()
1430.   	}
1431.   
1432. > static int ssl3_get_cert_verify(SSL *s)
1433.   	{
1434.   	EVP_PKEY *pkey=NULL;

ssl/s3_srvr.c:1434:2: 
1432.   static int ssl3_get_cert_verify(SSL *s)
1433.   	{
1434. > 	EVP_PKEY *pkey=NULL;
1435.   	unsigned char *p;
1436.   	int al,ok,ret=0;

ssl/s3_srvr.c:1436:2: 
1434.   	EVP_PKEY *pkey=NULL;
1435.   	unsigned char *p;
1436. > 	int al,ok,ret=0;
1437.   	long n;
1438.   	int type=0,i,j;

ssl/s3_srvr.c:1438:2: 
1436.   	int al,ok,ret=0;
1437.   	long n;
1438. > 	int type=0,i,j;
1439.   	X509 *peer;
1440.   

ssl/s3_srvr.c:1441:2: Skipping ssl3_get_message(): empty list of specs
1439.   	X509 *peer;
1440.   
1441.   	n=ssl3_get_message(s,
         ^
1442.   		SSL3_ST_SR_CERT_VRFY_A,
1443.   		SSL3_ST_SR_CERT_VRFY_B,

ssl/s3_srvr.c:1448:7: Taking false branch
1446.   		&ok);
1447.   
1448.   	if (!ok) return((int)n);
              ^
1449.   
1450.   	if (s->session->peer != NULL)

ssl/s3_srvr.c:1450:6: Taking true branch
1448.   	if (!ok) return((int)n);
1449.   
1450.   	if (s->session->peer != NULL)
             ^
1451.   		{
1452.   		peer=s->session->peer;

ssl/s3_srvr.c:1452:3: 
1450.   	if (s->session->peer != NULL)
1451.   		{
1452. > 		peer=s->session->peer;
1453.   		pkey=X509_get_pubkey(peer);
1454.   		type=X509_certificate_type(peer,pkey);

ssl/s3_srvr.c:1453:3: 
1451.   		{
1452.   		peer=s->session->peer;
1453. > 		pkey=X509_get_pubkey(peer);
1454.   		type=X509_certificate_type(peer,pkey);
1455.   		}

crypto/x509/x509_cmp.c:260:1: start of procedure X509_get_pubkey()
  258.   	}
  259.   
  260. > EVP_PKEY *X509_get_pubkey(X509 *x)
  261.   	{
  262.   	if ((x == NULL) || (x->cert_info == NULL))

crypto/x509/x509_cmp.c:262:7: Taking false branch
  260.   EVP_PKEY *X509_get_pubkey(X509 *x)
  261.   	{
  262.   	if ((x == NULL) || (x->cert_info == NULL))
               ^
  263.   		return(NULL);
  264.   	return(X509_PUBKEY_get(x->cert_info->key));

crypto/x509/x509_cmp.c:262:22: Taking true branch
  260.   EVP_PKEY *X509_get_pubkey(X509 *x)
  261.   	{
  262.   	if ((x == NULL) || (x->cert_info == NULL))
                              ^
  263.   		return(NULL);
  264.   	return(X509_PUBKEY_get(x->cert_info->key));

crypto/x509/x509_cmp.c:263:3: 
  261.   	{
  262.   	if ((x == NULL) || (x->cert_info == NULL))
  263. > 		return(NULL);
  264.   	return(X509_PUBKEY_get(x->cert_info->key));
  265.   	}

crypto/x509/x509_cmp.c:265:2: return from a call to X509_get_pubkey
  263.   		return(NULL);
  264.   	return(X509_PUBKEY_get(x->cert_info->key));
  265.   	}
          ^
  266.   
  267.   int X509_check_private_key(X509 *x, EVP_PKEY *k)

ssl/s3_srvr.c:1454:3: Skipping X509_certificate_type(): empty list of specs
1452.   		peer=s->session->peer;
1453.   		pkey=X509_get_pubkey(peer);
1454.   		type=X509_certificate_type(peer,pkey);
          ^
1455.   		}
1456.   	else

ssl/s3_srvr.c:1462:6: Taking true branch
1460.   		}
1461.   
1462.   	if (s->s3->tmp.message_type != SSL3_MT_CERTIFICATE_VERIFY)
             ^
1463.   		{
1464.   		s->s3->tmp.reuse_message=1;

ssl/s3_srvr.c:1464:3: 
1462.   	if (s->s3->tmp.message_type != SSL3_MT_CERTIFICATE_VERIFY)
1463.   		{
1464. > 		s->s3->tmp.reuse_message=1;
1465.   		if ((peer != NULL) && (type | EVP_PKT_SIGN))
1466.   			{

ssl/s3_srvr.c:1465:8: Taking true branch
1463.   		{
1464.   		s->s3->tmp.reuse_message=1;
1465.   		if ((peer != NULL) && (type | EVP_PKT_SIGN))
               ^
1466.   			{
1467.   			al=SSL_AD_UNEXPECTED_MESSAGE;

ssl/s3_srvr.c:1465:26: Taking false branch
1463.   		{
1464.   		s->s3->tmp.reuse_message=1;
1465.   		if ((peer != NULL) && (type | EVP_PKT_SIGN))
                                 ^
1466.   			{
1467.   			al=SSL_AD_UNEXPECTED_MESSAGE;

ssl/s3_srvr.c:1471:3: 
1469.   			goto f_err;
1470.   			}
1471. > 		ret=1;
1472.   		goto end;
1473.   		}

ssl/s3_srvr.c:1565:1: 
1563.   		ssl3_send_alert(s,SSL3_AL_FATAL,al);
1564.   		}
1565. > end:
1566.   	EVP_PKEY_free(pkey);
1567.   	return(ret);

ssl/s3_srvr.c:1566:2: 
1564.   		}
1565.   end:
1566. > 	EVP_PKEY_free(pkey);
1567.   	return(ret);
1568.   	}

crypto/evp/p_lib.c:286:1: start of procedure EVP_PKEY_free()
  284.   	}
  285.   
  286. > void EVP_PKEY_free(EVP_PKEY *x)
  287.   	{
  288.   	int i;

crypto/evp/p_lib.c:290:6: Taking false branch
  288.   	int i;
  289.   
  290.   	if (x == NULL) return;
              ^
  291.   
  292.   	i=CRYPTO_add(&x->references,-1,CRYPTO_LOCK_EVP_PKEY);

crypto/evp/p_lib.c:292:2: 
  290.   	if (x == NULL) return;
  291.   
  292. > 	i=CRYPTO_add(&x->references,-1,CRYPTO_LOCK_EVP_PKEY);
  293.   #ifdef REF_PRINT
  294.   	REF_PRINT("EVP_PKEY",x);

crypto/cryptlib.c:227:1: start of procedure CRYPTO_add_lock()
    225.   	}
    226.   
    227. > int CRYPTO_add_lock(int *pointer, int amount, int type, const char *file,
    228.   	     int line)
    229.   	{

crypto/cryptlib.c:232:6: Taking true branch
    230.   	int ret;
    231.   
    232.   	if (add_lock_callback != NULL)
                ^
    233.   		{
    234.   #ifdef LOCK_DEBUG

crypto/cryptlib.c:238:3: Skipping __function_pointer__(): unresolved function pointer
    236.   #endif
    237.   
    238.   		ret=add_lock_callback(pointer,amount,type,file,line);
             ^
    239.   #ifdef LOCK_DEBUG
    240.   		fprintf(stderr,"ladd:%08lx:%2d+%2d->%2d %-18s %s:%d\n",

crypto/cryptlib.c:246:3: 
    244.   			file,line);
    245.   #endif
    246. > 		*pointer=ret;
    247.   		}
    248.   	else
