ssl/statem/statem_srvr.c:2689: error: NULL_DEREFERENCE
  pointer `pkey` last assigned on line 2672 could be null and is dereferenced by call to `EVP_PKEY_id()` at line 2689, column 12.
Showing all 44 steps of the trace


ssl/statem/statem_srvr.c:2650:1: start of procedure tls_process_cert_verify()
2648.   }
2649.   
2650. > MSG_PROCESS_RETURN tls_process_cert_verify(SSL *s, PACKET *pkt)
2651.   {
2652.       EVP_PKEY *pkey = NULL;

ssl/statem/statem_srvr.c:2652:5: 
2650.   MSG_PROCESS_RETURN tls_process_cert_verify(SSL *s, PACKET *pkt)
2651.   {
2652. >     EVP_PKEY *pkey = NULL;
2653.       const unsigned char *sig, *data;
2654.       unsigned char *gost_data = NULL;

ssl/statem/statem_srvr.c:2654:5: 
2652.       EVP_PKEY *pkey = NULL;
2653.       const unsigned char *sig, *data;
2654. >     unsigned char *gost_data = NULL;
2655.       int al, ret = MSG_PROCESS_ERROR;
2656.       int type = 0, j;

ssl/statem/statem_srvr.c:2655:5: 
2653.       const unsigned char *sig, *data;
2654.       unsigned char *gost_data = NULL;
2655. >     int al, ret = MSG_PROCESS_ERROR;
2656.       int type = 0, j;
2657.       unsigned int len;

ssl/statem/statem_srvr.c:2656:5: 
2654.       unsigned char *gost_data = NULL;
2655.       int al, ret = MSG_PROCESS_ERROR;
2656. >     int type = 0, j;
2657.       unsigned int len;
2658.       X509 *peer;

ssl/statem/statem_srvr.c:2659:5: 
2657.       unsigned int len;
2658.       X509 *peer;
2659. >     const EVP_MD *md = NULL;
2660.       long hdatalen = 0;
2661.       void *hdata;

ssl/statem/statem_srvr.c:2660:5: 
2658.       X509 *peer;
2659.       const EVP_MD *md = NULL;
2660. >     long hdatalen = 0;
2661.       void *hdata;
2662.   

ssl/statem/statem_srvr.c:2663:5: 
2661.       void *hdata;
2662.   
2663. >     EVP_MD_CTX *mctx = EVP_MD_CTX_new();
2664.   
2665.       if (mctx == NULL) {

crypto/evp/digest.c:152:1: start of procedure EVP_MD_CTX_new()
  150.   }
  151.   
  152. > EVP_MD_CTX *EVP_MD_CTX_new(void)
  153.   {
  154.       return OPENSSL_zalloc(sizeof(EVP_MD_CTX));

crypto/evp/digest.c:154:5: 
  152.   EVP_MD_CTX *EVP_MD_CTX_new(void)
  153.   {
  154. >     return OPENSSL_zalloc(sizeof(EVP_MD_CTX));
  155.   }
  156.   

crypto/mem.c:158:1: start of procedure CRYPTO_zalloc()
    156.   }
    157.   
    158. > void *CRYPTO_zalloc(size_t num, const char *file, int line)
    159.   {
    160.       void *ret = CRYPTO_malloc(num, file, line);

crypto/mem.c:160:5: 
    158.   void *CRYPTO_zalloc(size_t num, const char *file, int line)
    159.   {
    160. >     void *ret = CRYPTO_malloc(num, file, line);
    161.   
    162.       if (ret != NULL)

crypto/mem.c:119:1: start of procedure CRYPTO_malloc()
      117.   }
      118.   
      119. > void *CRYPTO_malloc(size_t num, const char *file, int line)
      120.   {
      121.       void *ret = NULL;

crypto/mem.c:121:5: 
      119.   void *CRYPTO_malloc(size_t num, const char *file, int line)
      120.   {
      121. >     void *ret = NULL;
      122.   
      123.       if (malloc_impl != NULL && malloc_impl != CRYPTO_malloc)

crypto/mem.c:123:9: Taking false branch
      121.       void *ret = NULL;
      122.   
      123.       if (malloc_impl != NULL && malloc_impl != CRYPTO_malloc)
                     ^
      124.           return malloc_impl(num, file, line);
      125.   

crypto/mem.c:126:9: Taking false branch
      124.           return malloc_impl(num, file, line);
      125.   
      126.       if (num <= 0)
                     ^
      127.           return NULL;
      128.   

crypto/mem.c:129:5: 
      127.           return NULL;
      128.   
      129. >     allow_customize = 0;
      130.   #ifndef OPENSSL_NO_CRYPTO_MDEBUG
      131.       if (call_malloc_debug) {

crypto/mem.c:139:5: 
      137.       }
      138.   #else
      139. >     osslargused(file); osslargused(line);
      140.       ret = malloc(num);
      141.   #endif

crypto/mem.c:139:24: 
      137.       }
      138.   #else
      139. >     osslargused(file); osslargused(line);
      140.       ret = malloc(num);
      141.   #endif

crypto/mem.c:140:5: 
      138.   #else
      139.       osslargused(file); osslargused(line);
      140. >     ret = malloc(num);
      141.   #endif
      142.   

crypto/mem.c:155:5: 
      153.   #endif
      154.   
      155. >     return ret;
      156.   }
      157.   

crypto/mem.c:156:1: return from a call to CRYPTO_malloc
      154.   
      155.       return ret;
      156. > }
      157.   
      158.   void *CRYPTO_zalloc(size_t num, const char *file, int line)

crypto/mem.c:162:9: Taking true branch
    160.       void *ret = CRYPTO_malloc(num, file, line);
    161.   
    162.       if (ret != NULL)
                   ^
    163.           memset(ret, 0, num);
    164.       return ret;

crypto/mem.c:163:9: 
    161.   
    162.       if (ret != NULL)
    163. >         memset(ret, 0, num);
    164.       return ret;
    165.   }

crypto/mem.c:164:5: 
    162.       if (ret != NULL)
    163.           memset(ret, 0, num);
    164. >     return ret;
    165.   }
    166.   

crypto/mem.c:165:1: return from a call to CRYPTO_zalloc
    163.           memset(ret, 0, num);
    164.       return ret;
    165. > }
    166.   
    167.   void *CRYPTO_realloc(void *str, size_t num, const char *file, int line)

crypto/evp/digest.c:155:1: return from a call to EVP_MD_CTX_new
  153.   {
  154.       return OPENSSL_zalloc(sizeof(EVP_MD_CTX));
  155. > }
  156.   
  157.   void EVP_MD_CTX_free(EVP_MD_CTX *ctx)

ssl/statem/statem_srvr.c:2665:9: Taking false branch
2663.       EVP_MD_CTX *mctx = EVP_MD_CTX_new();
2664.   
2665.       if (mctx == NULL) {
                ^
2666.           SSLerr(SSL_F_TLS_PROCESS_CERT_VERIFY, ERR_R_MALLOC_FAILURE);
2667.           al = SSL_AD_INTERNAL_ERROR;

ssl/statem/statem_srvr.c:2671:5: 
2669.       }
2670.   
2671. >     peer = s->session->peer;
2672.       pkey = X509_get0_pubkey(peer);
2673.       type = X509_certificate_type(peer, pkey);

ssl/statem/statem_srvr.c:2672:5: 
2670.   
2671.       peer = s->session->peer;
2672. >     pkey = X509_get0_pubkey(peer);
2673.       type = X509_certificate_type(peer, pkey);
2674.   

crypto/x509/x509_cmp.c:307:1: start of procedure X509_get0_pubkey()
  305.   }
  306.   
  307. > EVP_PKEY *X509_get0_pubkey(X509 *x)
  308.   {
  309.       if (x == NULL)

crypto/x509/x509_cmp.c:309:9: Taking true branch
  307.   EVP_PKEY *X509_get0_pubkey(X509 *x)
  308.   {
  309.       if (x == NULL)
                 ^
  310.           return NULL;
  311.       return X509_PUBKEY_get0(x->cert_info.key);

crypto/x509/x509_cmp.c:310:9: 
  308.   {
  309.       if (x == NULL)
  310. >         return NULL;
  311.       return X509_PUBKEY_get0(x->cert_info.key);
  312.   }

crypto/x509/x509_cmp.c:312:1: return from a call to X509_get0_pubkey
  310.           return NULL;
  311.       return X509_PUBKEY_get0(x->cert_info.key);
  312. > }
  313.   
  314.   EVP_PKEY *X509_get_pubkey(X509 *x)

ssl/statem/statem_srvr.c:2673:5: Skipping X509_certificate_type(): empty list of specs
2671.       peer = s->session->peer;
2672.       pkey = X509_get0_pubkey(peer);
2673.       type = X509_certificate_type(peer, pkey);
            ^
2674.   
2675.       if (!(type & EVP_PKT_SIGN)) {

ssl/statem/statem_srvr.c:2675:11: Taking false branch
2673.       type = X509_certificate_type(peer, pkey);
2674.   
2675.       if (!(type & EVP_PKT_SIGN)) {
                  ^
2676.           SSLerr(SSL_F_TLS_PROCESS_CERT_VERIFY,
2677.                  SSL_R_SIGNATURE_FOR_NON_SIGNING_CERTIFICATE);

ssl/statem/statem_srvr.c:2688:9: 
2686.        */
2687.   #ifndef OPENSSL_NO_GOST
2688. >     if (PACKET_remaining(pkt) == 64
2689.           && EVP_PKEY_id(pkey) == NID_id_GostR3410_2001) {
2690.           len = 64;

ssl/packet_locl.h:90:1: start of procedure PACKET_remaining()
  88.    * Returns the number of bytes remaining to be read in the PACKET
  89.    */
  90. > static ossl_inline size_t PACKET_remaining(const PACKET *pkt)
  91.   {
  92.       return pkt->remaining;

ssl/packet_locl.h:92:5: 
  90.   static ossl_inline size_t PACKET_remaining(const PACKET *pkt)
  91.   {
  92. >     return pkt->remaining;
  93.   }
  94.   

ssl/packet_locl.h:93:1: return from a call to PACKET_remaining
  91.   {
  92.       return pkt->remaining;
  93. > }
  94.   
  95.   /*

ssl/statem/statem_srvr.c:2688:9: Taking true branch
2686.        */
2687.   #ifndef OPENSSL_NO_GOST
2688.       if (PACKET_remaining(pkt) == 64
                ^
2689.           && EVP_PKEY_id(pkey) == NID_id_GostR3410_2001) {
2690.           len = 64;

ssl/statem/statem_srvr.c:2689:12: 
2687.   #ifndef OPENSSL_NO_GOST
2688.       if (PACKET_remaining(pkt) == 64
2689. >         && EVP_PKEY_id(pkey) == NID_id_GostR3410_2001) {
2690.           len = 64;
2691.       } else

crypto/evp/p_lib.c:405:1: start of procedure EVP_PKEY_id()
  403.   }
  404.   
  405. > int EVP_PKEY_id(const EVP_PKEY *pkey)
  406.   {
  407.       return pkey->type;

crypto/evp/p_lib.c:407:5: 
  405.   int EVP_PKEY_id(const EVP_PKEY *pkey)
  406.   {
  407. >     return pkey->type;
  408.   }
  409.   
