ssl/t1_lib.c:4260: error: NULL_DEREFERENCE
  pointer `cpk` last assigned on line 4259 could be null and is dereferenced at line 4260, column 45.
Showing all 34 steps of the trace


ssl/t1_lib.c:4248:1: start of procedure ssl_get_auto_dh()
4246.   
4247.   #ifndef OPENSSL_NO_DH
4248. > DH *ssl_get_auto_dh(SSL *s)
4249.   {
4250.       int dh_secbits = 80;

ssl/t1_lib.c:4250:5: 
4248.   DH *ssl_get_auto_dh(SSL *s)
4249.   {
4250. >     int dh_secbits = 80;
4251.       if (s->cert->dh_tmp_auto == 2)
4252.           return DH_get_1024_160();

ssl/t1_lib.c:4251:9: Taking false branch
4249.   {
4250.       int dh_secbits = 80;
4251.       if (s->cert->dh_tmp_auto == 2)
                ^
4252.           return DH_get_1024_160();
4253.       if (s->s3->tmp.new_cipher->algorithm_auth & (SSL_aNULL | SSL_aPSK)) {

ssl/t1_lib.c:4253:9: Taking false branch
4251.       if (s->cert->dh_tmp_auto == 2)
4252.           return DH_get_1024_160();
4253.       if (s->s3->tmp.new_cipher->algorithm_auth & (SSL_aNULL | SSL_aPSK)) {
                ^
4254.           if (s->s3->tmp.new_cipher->strength_bits == 256)
4255.               dh_secbits = 128;

ssl/t1_lib.c:4259:9: 
4257.               dh_secbits = 80;
4258.       } else {
4259. >         CERT_PKEY *cpk = ssl_get_server_send_pkey(s);
4260.           dh_secbits = EVP_PKEY_security_bits(cpk->privatekey);
4261.       }

ssl/ssl_lib.c:2212:1: start of procedure ssl_get_server_send_pkey()
  2210.   }
  2211.   
  2212. > CERT_PKEY *ssl_get_server_send_pkey(SSL *s)
  2213.   {
  2214.       CERT *c;

ssl/ssl_lib.c:2217:5: 
  2215.       int i;
  2216.   
  2217. >     c = s->cert;
  2218.       if (!s->s3 || !s->s3->tmp.new_cipher)
  2219.           return NULL;

ssl/ssl_lib.c:2218:10: Taking false branch
  2216.   
  2217.       c = s->cert;
  2218.       if (!s->s3 || !s->s3->tmp.new_cipher)
                   ^
  2219.           return NULL;
  2220.       ssl_set_masks(s, s->s3->tmp.new_cipher);

ssl/ssl_lib.c:2218:20: Taking false branch
  2216.   
  2217.       c = s->cert;
  2218.       if (!s->s3 || !s->s3->tmp.new_cipher)
                             ^
  2219.           return NULL;
  2220.       ssl_set_masks(s, s->s3->tmp.new_cipher);

ssl/ssl_lib.c:2220:5: Skipping ssl_set_masks(): empty list of specs
  2218.       if (!s->s3 || !s->s3->tmp.new_cipher)
  2219.           return NULL;
  2220.       ssl_set_masks(s, s->s3->tmp.new_cipher);
              ^
  2221.   
  2222.   #ifdef OPENSSL_SSL_DEBUG_BROKEN_PROTOCOL

ssl/ssl_lib.c:2231:5: 
  2229.   #endif
  2230.   
  2231. >     i = ssl_get_server_cert_index(s);
  2232.   
  2233.       /* This may or may not be an error. */

ssl/ssl_lib.c:2191:1: start of procedure ssl_get_server_cert_index()
    2189.   #endif
    2190.   
    2191. > static int ssl_get_server_cert_index(const SSL *s)
    2192.   {
    2193.       int idx;

ssl/ssl_lib.c:2194:5: 
    2192.   {
    2193.       int idx;
    2194. >     idx = ssl_cipher_get_cert_index(s->s3->tmp.new_cipher);
    2195.       if (idx == SSL_PKEY_RSA_ENC && !s->cert->pkeys[SSL_PKEY_RSA_ENC].x509)
    2196.           idx = SSL_PKEY_RSA_SIGN;

ssl/ssl_ciph.c:1959:1: start of procedure ssl_cipher_get_cert_index()
      1957.   
      1958.   /* For a cipher return the index corresponding to the certificate type */
      1959. > int ssl_cipher_get_cert_index(const SSL_CIPHER *c)
      1960.   {
      1961.       uint32_t alg_k, alg_a;

ssl/ssl_ciph.c:1963:5: 
      1961.       uint32_t alg_k, alg_a;
      1962.   
      1963. >     alg_k = c->algorithm_mkey;
      1964.       alg_a = c->algorithm_auth;
      1965.   

ssl/ssl_ciph.c:1964:5: 
      1962.   
      1963.       alg_k = c->algorithm_mkey;
      1964. >     alg_a = c->algorithm_auth;
      1965.   
      1966.       if (alg_k & (SSL_kECDHr | SSL_kECDHe)) {

ssl/ssl_ciph.c:1966:9: Taking false branch
      1964.       alg_a = c->algorithm_auth;
      1965.   
      1966.       if (alg_k & (SSL_kECDHr | SSL_kECDHe)) {
                      ^
      1967.           /*
      1968.            * we don't need to look at SSL_kECDHE since no certificate is needed

ssl/ssl_ciph.c:1976:16: Taking false branch
      1974.            */
      1975.           return SSL_PKEY_ECC;
      1976.       } else if (alg_a & SSL_aECDSA)
                             ^
      1977.           return SSL_PKEY_ECC;
      1978.       else if (alg_k & SSL_kDHr)

ssl/ssl_ciph.c:1978:14: Taking false branch
      1976.       } else if (alg_a & SSL_aECDSA)
      1977.           return SSL_PKEY_ECC;
      1978.       else if (alg_k & SSL_kDHr)
                           ^
      1979.           return SSL_PKEY_DH_RSA;
      1980.       else if (alg_k & SSL_kDHd)

ssl/ssl_ciph.c:1980:14: Taking false branch
      1978.       else if (alg_k & SSL_kDHr)
      1979.           return SSL_PKEY_DH_RSA;
      1980.       else if (alg_k & SSL_kDHd)
                           ^
      1981.           return SSL_PKEY_DH_DSA;
      1982.       else if (alg_a & SSL_aDSS)

ssl/ssl_ciph.c:1982:14: Taking false branch
      1980.       else if (alg_k & SSL_kDHd)
      1981.           return SSL_PKEY_DH_DSA;
      1982.       else if (alg_a & SSL_aDSS)
                           ^
      1983.           return SSL_PKEY_DSA_SIGN;
      1984.       else if (alg_a & SSL_aRSA)

ssl/ssl_ciph.c:1984:14: Taking true branch
      1982.       else if (alg_a & SSL_aDSS)
      1983.           return SSL_PKEY_DSA_SIGN;
      1984.       else if (alg_a & SSL_aRSA)
                           ^
      1985.           return SSL_PKEY_RSA_ENC;
      1986.       else if (alg_a & SSL_aGOST12)

ssl/ssl_ciph.c:1985:9: 
      1983.           return SSL_PKEY_DSA_SIGN;
      1984.       else if (alg_a & SSL_aRSA)
      1985. >         return SSL_PKEY_RSA_ENC;
      1986.       else if (alg_a & SSL_aGOST12)
      1987.           return SSL_PKEY_GOST_EC;

ssl/ssl_ciph.c:1992:1: return from a call to ssl_cipher_get_cert_index
      1990.   
      1991.       return -1;
      1992. > }
      1993.   
      1994.   const SSL_CIPHER *ssl_get_cipher_by_char(SSL *ssl, const unsigned char *ptr)

ssl/ssl_lib.c:2195:9: Taking true branch
    2193.       int idx;
    2194.       idx = ssl_cipher_get_cert_index(s->s3->tmp.new_cipher);
    2195.       if (idx == SSL_PKEY_RSA_ENC && !s->cert->pkeys[SSL_PKEY_RSA_ENC].x509)
                    ^
    2196.           idx = SSL_PKEY_RSA_SIGN;
    2197.       if (idx == SSL_PKEY_GOST_EC) {

ssl/ssl_lib.c:2195:37: Taking false branch
    2193.       int idx;
    2194.       idx = ssl_cipher_get_cert_index(s->s3->tmp.new_cipher);
    2195.       if (idx == SSL_PKEY_RSA_ENC && !s->cert->pkeys[SSL_PKEY_RSA_ENC].x509)
                                                ^
    2196.           idx = SSL_PKEY_RSA_SIGN;
    2197.       if (idx == SSL_PKEY_GOST_EC) {

ssl/ssl_lib.c:2197:9: Taking false branch
    2195.       if (idx == SSL_PKEY_RSA_ENC && !s->cert->pkeys[SSL_PKEY_RSA_ENC].x509)
    2196.           idx = SSL_PKEY_RSA_SIGN;
    2197.       if (idx == SSL_PKEY_GOST_EC) {
                    ^
    2198.           if (s->cert->pkeys[SSL_PKEY_GOST12_512].x509)
    2199.               idx = SSL_PKEY_GOST12_512;

ssl/ssl_lib.c:2207:9: Taking false branch
    2205.               idx = -1;
    2206.       }
    2207.       if (idx == -1)
                    ^
    2208.           SSLerr(SSL_F_SSL_GET_SERVER_CERT_INDEX, ERR_R_INTERNAL_ERROR);
    2209.       return idx;

ssl/ssl_lib.c:2209:5: 
    2207.       if (idx == -1)
    2208.           SSLerr(SSL_F_SSL_GET_SERVER_CERT_INDEX, ERR_R_INTERNAL_ERROR);
    2209. >     return idx;
    2210.   }
    2211.   

ssl/ssl_lib.c:2210:1: return from a call to ssl_get_server_cert_index
    2208.           SSLerr(SSL_F_SSL_GET_SERVER_CERT_INDEX, ERR_R_INTERNAL_ERROR);
    2209.       return idx;
    2210. > }
    2211.   
    2212.   CERT_PKEY *ssl_get_server_send_pkey(SSL *s)

ssl/ssl_lib.c:2234:9: Taking true branch
  2232.   
  2233.       /* This may or may not be an error. */
  2234.       if (i < 0)
                  ^
  2235.           return NULL;
  2236.   

ssl/ssl_lib.c:2235:9: 
  2233.       /* This may or may not be an error. */
  2234.       if (i < 0)
  2235. >         return NULL;
  2236.   
  2237.       /* May be NULL. */

ssl/ssl_lib.c:2239:1: return from a call to ssl_get_server_send_pkey
  2237.       /* May be NULL. */
  2238.       return &c->pkeys[i];
  2239. > }
  2240.   
  2241.   EVP_PKEY *ssl_get_sign_pkey(SSL *s, const SSL_CIPHER *cipher,

ssl/t1_lib.c:4260:9: 
4258.       } else {
4259.           CERT_PKEY *cpk = ssl_get_server_send_pkey(s);
4260. >         dh_secbits = EVP_PKEY_security_bits(cpk->privatekey);
4261.       }
4262.   
