apps/x509.c:890: error: NULL_DEREFERENCE
  pointer `upkey` last assigned on line 888 could be null and is dereferenced by call to `EVP_PKEY_free()` at line 890, column 2.
Showing all 21 steps of the trace


apps/x509.c:875:1: start of procedure x509_certify()
873.   	}
874.   
875. > static int x509_certify(X509_STORE *ctx, char *CAfile, const EVP_MD *digest,
876.   	     X509 *x, X509 *xca, EVP_PKEY *pkey, char *serialfile, int create,
877.   	     int days, LHASH *conf, char *section)

apps/x509.c:879:2: 
877.   	     int days, LHASH *conf, char *section)
878.   	{
879. > 	int ret=0;
880.   	BIO *io=NULL;
881.   	MS_STATIC char buf2[1024];

apps/x509.c:880:2: 
878.   	{
879.   	int ret=0;
880. > 	BIO *io=NULL;
881.   	MS_STATIC char buf2[1024];
882.   	char *buf=NULL,*p;

apps/x509.c:882:2: 
880.   	BIO *io=NULL;
881.   	MS_STATIC char buf2[1024];
882. > 	char *buf=NULL,*p;
883.   	BIGNUM *serial=NULL;
884.   	ASN1_INTEGER *bs=NULL,bs2;

apps/x509.c:883:2: 
881.   	MS_STATIC char buf2[1024];
882.   	char *buf=NULL,*p;
883. > 	BIGNUM *serial=NULL;
884.   	ASN1_INTEGER *bs=NULL,bs2;
885.   	X509_STORE_CTX xsc;

apps/x509.c:884:2: 
882.   	char *buf=NULL,*p;
883.   	BIGNUM *serial=NULL;
884. > 	ASN1_INTEGER *bs=NULL,bs2;
885.   	X509_STORE_CTX xsc;
886.   	EVP_PKEY *upkey;

apps/x509.c:888:2: 
886.   	EVP_PKEY *upkey;
887.   
888. > 	upkey = X509_get_pubkey(xca);
889.   	EVP_PKEY_copy_parameters(upkey,pkey);
890.   	EVP_PKEY_free(upkey);

crypto/x509/x509_cmp.c:250:1: start of procedure X509_get_pubkey()
  248.   	}
  249.   
  250. > EVP_PKEY *X509_get_pubkey(X509 *x)
  251.   	{
  252.   	if ((x == NULL) || (x->cert_info == NULL))

crypto/x509/x509_cmp.c:252:7: Taking false branch
  250.   EVP_PKEY *X509_get_pubkey(X509 *x)
  251.   	{
  252.   	if ((x == NULL) || (x->cert_info == NULL))
               ^
  253.   		return(NULL);
  254.   	return(X509_PUBKEY_get(x->cert_info->key));

crypto/x509/x509_cmp.c:252:22: Taking true branch
  250.   EVP_PKEY *X509_get_pubkey(X509 *x)
  251.   	{
  252.   	if ((x == NULL) || (x->cert_info == NULL))
                              ^
  253.   		return(NULL);
  254.   	return(X509_PUBKEY_get(x->cert_info->key));

crypto/x509/x509_cmp.c:253:3: 
  251.   	{
  252.   	if ((x == NULL) || (x->cert_info == NULL))
  253. > 		return(NULL);
  254.   	return(X509_PUBKEY_get(x->cert_info->key));
  255.   	}

crypto/x509/x509_cmp.c:255:2: return from a call to X509_get_pubkey
  253.   		return(NULL);
  254.   	return(X509_PUBKEY_get(x->cert_info->key));
  255.   	}
          ^
  256.   
  257.   int X509_check_private_key(X509 *x, EVP_PKEY *k)

apps/x509.c:889:2: Skipping EVP_PKEY_copy_parameters(): empty list of specs
887.   
888.   	upkey = X509_get_pubkey(xca);
889.   	EVP_PKEY_copy_parameters(upkey,pkey);
        ^
890.   	EVP_PKEY_free(upkey);
891.   

apps/x509.c:890:2: 
888.   	upkey = X509_get_pubkey(xca);
889.   	EVP_PKEY_copy_parameters(upkey,pkey);
890. > 	EVP_PKEY_free(upkey);
891.   
892.   	X509_STORE_CTX_init(&xsc,ctx,x,NULL);

crypto/evp/p_lib.c:286:1: start of procedure EVP_PKEY_free()
  284.   	}
  285.   
  286. > void EVP_PKEY_free(EVP_PKEY *x)
  287.   	{
  288.   	int i;

crypto/evp/p_lib.c:290:6: Taking false branch
  288.   	int i;
  289.   
  290.   	if (x == NULL) return;
              ^
  291.   
  292.   	i=CRYPTO_add(&x->references,-1,CRYPTO_LOCK_EVP_PKEY);

crypto/evp/p_lib.c:292:2: 
  290.   	if (x == NULL) return;
  291.   
  292. > 	i=CRYPTO_add(&x->references,-1,CRYPTO_LOCK_EVP_PKEY);
  293.   #ifdef REF_PRINT
  294.   	REF_PRINT("EVP_PKEY",x);

crypto/cryptlib.c:226:1: start of procedure CRYPTO_add_lock()
    224.   	}
    225.   
    226. > int CRYPTO_add_lock(int *pointer, int amount, int type, const char *file,
    227.   	     int line)
    228.   	{

crypto/cryptlib.c:231:6: Taking true branch
    229.   	int ret;
    230.   
    231.   	if (add_lock_callback != NULL)
                ^
    232.   		{
    233.   #ifdef LOCK_DEBUG

crypto/cryptlib.c:237:3: Skipping __function_pointer__(): unresolved function pointer
    235.   #endif
    236.   
    237.   		ret=add_lock_callback(pointer,amount,type,file,line);
             ^
    238.   #ifdef LOCK_DEBUG
    239.   		fprintf(stderr,"ladd:%08lx:%2d+%2d->%2d %-18s %s:%d\n",

crypto/cryptlib.c:245:3: 
    243.   			file,line);
    244.   #endif
    245. > 		*pointer=ret;
    246.   		}
    247.   	else
