ssl/d1_srvr.c:845: error: NULL_DEREFERENCE
  pointer `dh` last assigned on line 775 could be null and is dereferenced by call to `DH_free()` at line 845, column 5.
Showing all 22 steps of the trace


ssl/d1_srvr.c:765:1: start of procedure dtls1_send_server_key_exchange()
763.   	}
764.   
765. > int dtls1_send_server_key_exchange(SSL *s)
766.   	{
767.   #ifndef OPENSSL_NO_RSA

ssl/d1_srvr.c:775:2: 
773.   #endif
774.   #ifndef OPENSSL_NO_DH
775. > 	DH *dh=NULL,*dhp;
776.   #endif
777.   	EVP_PKEY *pkey;

ssl/d1_srvr.c:788:2: 
786.   	EVP_MD_CTX md_ctx;
787.   
788. > 	EVP_MD_CTX_init(&md_ctx);
789.   	if (s->state == SSL3_ST_SW_KEY_EXCH_A)
790.   		{

crypto/evp/digest.c:120:1: start of procedure EVP_MD_CTX_init()
  118.   #endif
  119.   
  120. > void EVP_MD_CTX_init(EVP_MD_CTX *ctx)
  121.   	{
  122.   	memset(ctx,'\0',sizeof *ctx);

crypto/evp/digest.c:122:2: 
  120.   void EVP_MD_CTX_init(EVP_MD_CTX *ctx)
  121.   	{
  122. > 	memset(ctx,'\0',sizeof *ctx);
  123.   	}
  124.   

crypto/evp/digest.c:123:2: return from a call to EVP_MD_CTX_init
  121.   	{
  122.   	memset(ctx,'\0',sizeof *ctx);
  123.   	}
          ^
  124.   
  125.   EVP_MD_CTX *EVP_MD_CTX_create(void)

ssl/d1_srvr.c:789:6: Taking true branch
787.   
788.   	EVP_MD_CTX_init(&md_ctx);
789.   	if (s->state == SSL3_ST_SW_KEY_EXCH_A)
            ^
790.   		{
791.   		type=s->s3->tmp.new_cipher->algorithm_mkey;

ssl/d1_srvr.c:791:3: 
789.   	if (s->state == SSL3_ST_SW_KEY_EXCH_A)
790.   		{
791. > 		type=s->s3->tmp.new_cipher->algorithm_mkey;
792.   		cert=s->cert;
793.   

ssl/d1_srvr.c:792:3: 
790.   		{
791.   		type=s->s3->tmp.new_cipher->algorithm_mkey;
792. > 		cert=s->cert;
793.   
794.   		buf=s->init_buf;

ssl/d1_srvr.c:794:3: 
792.   		cert=s->cert;
793.   
794. > 		buf=s->init_buf;
795.   
796.   		r[0]=r[1]=r[2]=r[3]=NULL;

ssl/d1_srvr.c:796:3: 
794.   		buf=s->init_buf;
795.   
796. > 		r[0]=r[1]=r[2]=r[3]=NULL;
797.   		n=0;
798.   #ifndef OPENSSL_NO_RSA

ssl/d1_srvr.c:797:3: 
795.   
796.   		r[0]=r[1]=r[2]=r[3]=NULL;
797. > 		n=0;
798.   #ifndef OPENSSL_NO_RSA
799.   		if (type & SSL_kRSA)

ssl/d1_srvr.c:799:7: Taking false branch
797.   		n=0;
798.   #ifndef OPENSSL_NO_RSA
799.   		if (type & SSL_kRSA)
             ^
800.   			{
801.   			rsa=cert->rsa_tmp;

ssl/d1_srvr.c:829:8: Taking true branch
827.   #endif
828.   #ifndef OPENSSL_NO_DH
829.   			if (type & SSL_kEDH)
              ^
830.   			{
831.   			dhp=cert->dh_tmp;

ssl/d1_srvr.c:831:4: 
829.   			if (type & SSL_kEDH)
830.   			{
831. > 			dhp=cert->dh_tmp;
832.   			if ((dhp == NULL) && (s->cert->dh_tmp_cb != NULL))
833.   				dhp=s->cert->dh_tmp_cb(s,

ssl/d1_srvr.c:832:9: Taking true branch
830.   			{
831.   			dhp=cert->dh_tmp;
832.   			if ((dhp == NULL) && (s->cert->dh_tmp_cb != NULL))
               ^
833.   				dhp=s->cert->dh_tmp_cb(s,
834.   				      SSL_C_IS_EXPORT(s->s3->tmp.new_cipher),

ssl/d1_srvr.c:832:26: Taking true branch
830.   			{
831.   			dhp=cert->dh_tmp;
832.   			if ((dhp == NULL) && (s->cert->dh_tmp_cb != NULL))
                                ^
833.   				dhp=s->cert->dh_tmp_cb(s,
834.   				      SSL_C_IS_EXPORT(s->s3->tmp.new_cipher),

ssl/d1_srvr.c:835:11: Condition is false
833.   				dhp=s->cert->dh_tmp_cb(s,
834.   				      SSL_C_IS_EXPORT(s->s3->tmp.new_cipher),
835.   				      SSL_C_EXPORT_PKEYLENGTH(s->s3->tmp.new_cipher));
                 ^
836.   			if (dhp == NULL)
837.   				{

ssl/d1_srvr.c:833:5: Skipping __function_pointer__(): unresolved function pointer
831.   			dhp=cert->dh_tmp;
832.   			if ((dhp == NULL) && (s->cert->dh_tmp_cb != NULL))
833.   				dhp=s->cert->dh_tmp_cb(s,
           ^
834.   				      SSL_C_IS_EXPORT(s->s3->tmp.new_cipher),
835.   				      SSL_C_EXPORT_PKEYLENGTH(s->s3->tmp.new_cipher));

ssl/d1_srvr.c:836:8: Taking false branch
834.   				      SSL_C_IS_EXPORT(s->s3->tmp.new_cipher),
835.   				      SSL_C_EXPORT_PKEYLENGTH(s->s3->tmp.new_cipher));
836.   			if (dhp == NULL)
              ^
837.   				{
838.   				al=SSL_AD_HANDSHAKE_FAILURE;

ssl/d1_srvr.c:843:8: Taking true branch
841.   				}
842.   
843.   			if (s->s3->tmp.dh != NULL)
              ^
844.   				{
845.   				DH_free(dh);

ssl/d1_srvr.c:845:5: 
843.   			if (s->s3->tmp.dh != NULL)
844.   				{
845. > 				DH_free(dh);
846.   				SSLerr(SSL_F_DTLS1_SEND_SERVER_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR);
847.   				goto err;
