ssl/t1_lib.c:4043: error: NULL_DEREFERENCE
  pointer `cpk` last assigned on line 4042 could be null and is dereferenced at line 4043, column 45.
Showing all 30 steps of the trace


ssl/t1_lib.c:4031:1: start of procedure ssl_get_auto_dh()
4029.   
4030.   #ifndef OPENSSL_NO_DH
4031. > DH *ssl_get_auto_dh(SSL *s)
4032.   {
4033.       int dh_secbits = 80;

ssl/t1_lib.c:4033:5: 
4031.   DH *ssl_get_auto_dh(SSL *s)
4032.   {
4033. >     int dh_secbits = 80;
4034.       if (s->cert->dh_tmp_auto == 2)
4035.           return DH_get_1024_160();

ssl/t1_lib.c:4034:9: Taking false branch
4032.   {
4033.       int dh_secbits = 80;
4034.       if (s->cert->dh_tmp_auto == 2)
                ^
4035.           return DH_get_1024_160();
4036.       if (s->s3->tmp.new_cipher->algorithm_auth & (SSL_aNULL | SSL_aPSK)) {

ssl/t1_lib.c:4036:9: Taking false branch
4034.       if (s->cert->dh_tmp_auto == 2)
4035.           return DH_get_1024_160();
4036.       if (s->s3->tmp.new_cipher->algorithm_auth & (SSL_aNULL | SSL_aPSK)) {
                ^
4037.           if (s->s3->tmp.new_cipher->strength_bits == 256)
4038.               dh_secbits = 128;

ssl/t1_lib.c:4042:9: 
4040.               dh_secbits = 80;
4041.       } else {
4042. >         CERT_PKEY *cpk = ssl_get_server_send_pkey(s);
4043.           dh_secbits = EVP_PKEY_security_bits(cpk->privatekey);
4044.       }

ssl/ssl_lib.c:2703:1: start of procedure ssl_get_server_send_pkey()
  2701.   }
  2702.   
  2703. > CERT_PKEY *ssl_get_server_send_pkey(SSL *s)
  2704.   {
  2705.       CERT *c;

ssl/ssl_lib.c:2708:5: 
  2706.       int i;
  2707.   
  2708. >     c = s->cert;
  2709.       if (!s->s3 || !s->s3->tmp.new_cipher)
  2710.           return NULL;

ssl/ssl_lib.c:2709:10: Taking false branch
  2707.   
  2708.       c = s->cert;
  2709.       if (!s->s3 || !s->s3->tmp.new_cipher)
                   ^
  2710.           return NULL;
  2711.       ssl_set_masks(s);

ssl/ssl_lib.c:2709:20: Taking false branch
  2707.   
  2708.       c = s->cert;
  2709.       if (!s->s3 || !s->s3->tmp.new_cipher)
                             ^
  2710.           return NULL;
  2711.       ssl_set_masks(s);

ssl/ssl_lib.c:2711:5: Skipping ssl_set_masks(): empty list of specs
  2709.       if (!s->s3 || !s->s3->tmp.new_cipher)
  2710.           return NULL;
  2711.       ssl_set_masks(s);
              ^
  2712.   
  2713.       i = ssl_get_server_cert_index(s);

ssl/ssl_lib.c:2713:5: 
  2711.       ssl_set_masks(s);
  2712.   
  2713. >     i = ssl_get_server_cert_index(s);
  2714.   
  2715.       /* This may or may not be an error. */

ssl/ssl_lib.c:2682:1: start of procedure ssl_get_server_cert_index()
    2680.   #endif
    2681.   
    2682. > static int ssl_get_server_cert_index(const SSL *s)
    2683.   {
    2684.       int idx;

ssl/ssl_lib.c:2685:5: 
    2683.   {
    2684.       int idx;
    2685. >     idx = ssl_cipher_get_cert_index(s->s3->tmp.new_cipher);
    2686.       if (idx == SSL_PKEY_RSA_ENC && !s->cert->pkeys[SSL_PKEY_RSA_ENC].x509)
    2687.           idx = SSL_PKEY_RSA_SIGN;

ssl/ssl_ciph.c:1919:1: start of procedure ssl_cipher_get_cert_index()
      1917.   
      1918.   /* For a cipher return the index corresponding to the certificate type */
      1919. > int ssl_cipher_get_cert_index(const SSL_CIPHER *c)
      1920.   {
      1921.       uint32_t alg_a;

ssl/ssl_ciph.c:1923:5: 
      1921.       uint32_t alg_a;
      1922.   
      1923. >     alg_a = c->algorithm_auth;
      1924.   
      1925.       if (alg_a & SSL_aECDSA)

ssl/ssl_ciph.c:1925:9: Taking false branch
      1923.       alg_a = c->algorithm_auth;
      1924.   
      1925.       if (alg_a & SSL_aECDSA)
                      ^
      1926.           return SSL_PKEY_ECC;
      1927.       else if (alg_a & SSL_aDSS)

ssl/ssl_ciph.c:1927:14: Taking false branch
      1925.       if (alg_a & SSL_aECDSA)
      1926.           return SSL_PKEY_ECC;
      1927.       else if (alg_a & SSL_aDSS)
                           ^
      1928.           return SSL_PKEY_DSA_SIGN;
      1929.       else if (alg_a & SSL_aRSA)

ssl/ssl_ciph.c:1929:14: Taking true branch
      1927.       else if (alg_a & SSL_aDSS)
      1928.           return SSL_PKEY_DSA_SIGN;
      1929.       else if (alg_a & SSL_aRSA)
                           ^
      1930.           return SSL_PKEY_RSA_ENC;
      1931.       else if (alg_a & SSL_aGOST12)

ssl/ssl_ciph.c:1930:9: 
      1928.           return SSL_PKEY_DSA_SIGN;
      1929.       else if (alg_a & SSL_aRSA)
      1930. >         return SSL_PKEY_RSA_ENC;
      1931.       else if (alg_a & SSL_aGOST12)
      1932.           return SSL_PKEY_GOST_EC;

ssl/ssl_ciph.c:1937:1: return from a call to ssl_cipher_get_cert_index
      1935.   
      1936.       return -1;
      1937. > }
      1938.   
      1939.   const SSL_CIPHER *ssl_get_cipher_by_char(SSL *ssl, const unsigned char *ptr)

ssl/ssl_lib.c:2686:9: Taking true branch
    2684.       int idx;
    2685.       idx = ssl_cipher_get_cert_index(s->s3->tmp.new_cipher);
    2686.       if (idx == SSL_PKEY_RSA_ENC && !s->cert->pkeys[SSL_PKEY_RSA_ENC].x509)
                    ^
    2687.           idx = SSL_PKEY_RSA_SIGN;
    2688.       if (idx == SSL_PKEY_GOST_EC) {

ssl/ssl_lib.c:2686:37: Taking false branch
    2684.       int idx;
    2685.       idx = ssl_cipher_get_cert_index(s->s3->tmp.new_cipher);
    2686.       if (idx == SSL_PKEY_RSA_ENC && !s->cert->pkeys[SSL_PKEY_RSA_ENC].x509)
                                                ^
    2687.           idx = SSL_PKEY_RSA_SIGN;
    2688.       if (idx == SSL_PKEY_GOST_EC) {

ssl/ssl_lib.c:2688:9: Taking false branch
    2686.       if (idx == SSL_PKEY_RSA_ENC && !s->cert->pkeys[SSL_PKEY_RSA_ENC].x509)
    2687.           idx = SSL_PKEY_RSA_SIGN;
    2688.       if (idx == SSL_PKEY_GOST_EC) {
                    ^
    2689.           if (s->cert->pkeys[SSL_PKEY_GOST12_512].x509)
    2690.               idx = SSL_PKEY_GOST12_512;

ssl/ssl_lib.c:2698:9: Taking false branch
    2696.               idx = -1;
    2697.       }
    2698.       if (idx == -1)
                    ^
    2699.           SSLerr(SSL_F_SSL_GET_SERVER_CERT_INDEX, ERR_R_INTERNAL_ERROR);
    2700.       return idx;

ssl/ssl_lib.c:2700:5: 
    2698.       if (idx == -1)
    2699.           SSLerr(SSL_F_SSL_GET_SERVER_CERT_INDEX, ERR_R_INTERNAL_ERROR);
    2700. >     return idx;
    2701.   }
    2702.   

ssl/ssl_lib.c:2701:1: return from a call to ssl_get_server_cert_index
    2699.           SSLerr(SSL_F_SSL_GET_SERVER_CERT_INDEX, ERR_R_INTERNAL_ERROR);
    2700.       return idx;
    2701. > }
    2702.   
    2703.   CERT_PKEY *ssl_get_server_send_pkey(SSL *s)

ssl/ssl_lib.c:2716:9: Taking true branch
  2714.   
  2715.       /* This may or may not be an error. */
  2716.       if (i < 0)
                  ^
  2717.           return NULL;
  2718.   

ssl/ssl_lib.c:2717:9: 
  2715.       /* This may or may not be an error. */
  2716.       if (i < 0)
  2717. >         return NULL;
  2718.   
  2719.       /* May be NULL. */

ssl/ssl_lib.c:2721:1: return from a call to ssl_get_server_send_pkey
  2719.       /* May be NULL. */
  2720.       return &c->pkeys[i];
  2721. > }
  2722.   
  2723.   EVP_PKEY *ssl_get_sign_pkey(SSL *s, const SSL_CIPHER *cipher,

ssl/t1_lib.c:4043:9: 
4041.       } else {
4042.           CERT_PKEY *cpk = ssl_get_server_send_pkey(s);
4043. >         dh_secbits = EVP_PKEY_security_bits(cpk->privatekey);
4044.       }
4045.   
