ssl/statem/statem_srvr.c:3047: error: NULL_DEREFERENCE
  pointer `pkey` last assigned on line 3032 could be null and is dereferenced at line 3047, column 40.
Showing all 23 steps of the trace


ssl/statem/statem_srvr.c:3019:1: start of procedure tls_process_cert_verify()
3017.   }
3018.   
3019. > MSG_PROCESS_RETURN tls_process_cert_verify(SSL *s, PACKET *pkt)
3020.   {
3021.       EVP_PKEY *pkey = NULL;

ssl/statem/statem_srvr.c:3021:5: 
3019.   MSG_PROCESS_RETURN tls_process_cert_verify(SSL *s, PACKET *pkt)
3020.   {
3021. >     EVP_PKEY *pkey = NULL;
3022.       unsigned char *sig, *data;
3023.       int al, ret = MSG_PROCESS_ERROR;

ssl/statem/statem_srvr.c:3023:5: 
3021.       EVP_PKEY *pkey = NULL;
3022.       unsigned char *sig, *data;
3023. >     int al, ret = MSG_PROCESS_ERROR;
3024.       int type = 0, i, j;
3025.       unsigned int len;

ssl/statem/statem_srvr.c:3024:5: 
3022.       unsigned char *sig, *data;
3023.       int al, ret = MSG_PROCESS_ERROR;
3024. >     int type = 0, i, j;
3025.       unsigned int len;
3026.       X509 *peer;

ssl/statem/statem_srvr.c:3027:5: 
3025.       unsigned int len;
3026.       X509 *peer;
3027. >     const EVP_MD *md = NULL;
3028.       EVP_MD_CTX mctx;
3029.       EVP_MD_CTX_init(&mctx);

ssl/statem/statem_srvr.c:3029:5: 
3027.       const EVP_MD *md = NULL;
3028.       EVP_MD_CTX mctx;
3029. >     EVP_MD_CTX_init(&mctx);
3030.   
3031.       peer = s->session->peer;

crypto/evp/digest.c:120:1: start of procedure EVP_MD_CTX_init()
  118.   #endif
  119.   
  120. > void EVP_MD_CTX_init(EVP_MD_CTX *ctx)
  121.   {
  122.       memset(ctx, 0, sizeof(*ctx));

crypto/evp/digest.c:122:5: 
  120.   void EVP_MD_CTX_init(EVP_MD_CTX *ctx)
  121.   {
  122. >     memset(ctx, 0, sizeof(*ctx));
  123.   }
  124.   

crypto/evp/digest.c:123:1: return from a call to EVP_MD_CTX_init
  121.   {
  122.       memset(ctx, 0, sizeof(*ctx));
  123. > }
  124.   
  125.   EVP_MD_CTX *EVP_MD_CTX_create(void)

ssl/statem/statem_srvr.c:3031:5: 
3029.       EVP_MD_CTX_init(&mctx);
3030.   
3031. >     peer = s->session->peer;
3032.       pkey = X509_get_pubkey(peer);
3033.       type = X509_certificate_type(peer, pkey);

ssl/statem/statem_srvr.c:3032:5: 
3030.   
3031.       peer = s->session->peer;
3032. >     pkey = X509_get_pubkey(peer);
3033.       type = X509_certificate_type(peer, pkey);
3034.   

crypto/x509/x509_cmp.c:305:1: start of procedure X509_get_pubkey()
  303.   }
  304.   
  305. > EVP_PKEY *X509_get_pubkey(X509 *x)
  306.   {
  307.       if (x == NULL)

crypto/x509/x509_cmp.c:307:9: Taking true branch
  305.   EVP_PKEY *X509_get_pubkey(X509 *x)
  306.   {
  307.       if (x == NULL)
                 ^
  308.           return (NULL);
  309.       return (X509_PUBKEY_get(x->cert_info.key));

crypto/x509/x509_cmp.c:308:9: 
  306.   {
  307.       if (x == NULL)
  308. >         return (NULL);
  309.       return (X509_PUBKEY_get(x->cert_info.key));
  310.   }

crypto/x509/x509_cmp.c:310:1: return from a call to X509_get_pubkey
  308.           return (NULL);
  309.       return (X509_PUBKEY_get(x->cert_info.key));
  310. > }
  311.   
  312.   ASN1_BIT_STRING *X509_get0_pubkey_bitstr(const X509 *x)

ssl/statem/statem_srvr.c:3033:5: Skipping X509_certificate_type(): empty list of specs
3031.       peer = s->session->peer;
3032.       pkey = X509_get_pubkey(peer);
3033.       type = X509_certificate_type(peer, pkey);
            ^
3034.   
3035.       if (!(type & EVP_PKT_SIGN)) {

ssl/statem/statem_srvr.c:3035:11: Taking false branch
3033.       type = X509_certificate_type(peer, pkey);
3034.   
3035.       if (!(type & EVP_PKT_SIGN)) {
                  ^
3036.           SSLerr(SSL_F_TLS_PROCESS_CERT_VERIFY,
3037.                  SSL_R_SIGNATURE_FOR_NON_SIGNING_CERTIFICATE);

ssl/statem/statem_srvr.c:3047:9: 
3045.        * length field
3046.        */
3047. >     if (PACKET_remaining(pkt) == 64 && pkey->type == NID_id_GostR3410_2001) {
3048.           len = 64;
3049.       } else {

ssl/packet_locl.h:89:1: start of procedure PACKET_remaining()
  87.    * Returns the number of bytes remaining to be read in the PACKET
  88.    */
  89. > static inline size_t PACKET_remaining(const PACKET *pkt)
  90.   {
  91.       return pkt->remaining;

ssl/packet_locl.h:91:5: 
  89.   static inline size_t PACKET_remaining(const PACKET *pkt)
  90.   {
  91. >     return pkt->remaining;
  92.   }
  93.   

ssl/packet_locl.h:92:1: return from a call to PACKET_remaining
  90.   {
  91.       return pkt->remaining;
  92. > }
  93.   
  94.   /*

ssl/statem/statem_srvr.c:3047:9: Taking true branch
3045.        * length field
3046.        */
3047.       if (PACKET_remaining(pkt) == 64 && pkey->type == NID_id_GostR3410_2001) {
                ^
3048.           len = 64;
3049.       } else {

ssl/statem/statem_srvr.c:3047:40: 
3045.        * length field
3046.        */
3047. >     if (PACKET_remaining(pkt) == 64 && pkey->type == NID_id_GostR3410_2001) {
3048.           len = 64;
3049.       } else {
