ssl/t1_lib.c:4180: error: NULL_DEREFERENCE
  pointer `cpk` last assigned on line 4179 could be null and is dereferenced at line 4180, column 45.
Showing all 15 steps of the trace


ssl/t1_lib.c:4168:1: start of procedure ssl_get_auto_dh()
4166.   
4167.   #ifndef OPENSSL_NO_DH
4168. > DH *ssl_get_auto_dh(SSL *s)
4169.   {
4170.       int dh_secbits = 80;

ssl/t1_lib.c:4170:5: 
4168.   DH *ssl_get_auto_dh(SSL *s)
4169.   {
4170. >     int dh_secbits = 80;
4171.       if (s->cert->dh_tmp_auto == 2)
4172.           return DH_get_1024_160();

ssl/t1_lib.c:4171:9: Taking false branch
4169.   {
4170.       int dh_secbits = 80;
4171.       if (s->cert->dh_tmp_auto == 2)
                ^
4172.           return DH_get_1024_160();
4173.       if (s->s3->tmp.new_cipher->algorithm_auth & (SSL_aNULL | SSL_aPSK)) {

ssl/t1_lib.c:4173:9: Taking false branch
4171.       if (s->cert->dh_tmp_auto == 2)
4172.           return DH_get_1024_160();
4173.       if (s->s3->tmp.new_cipher->algorithm_auth & (SSL_aNULL | SSL_aPSK)) {
                ^
4174.           if (s->s3->tmp.new_cipher->strength_bits == 256)
4175.               dh_secbits = 128;

ssl/t1_lib.c:4179:9: 
4177.               dh_secbits = 80;
4178.       } else {
4179. >         CERT_PKEY *cpk = ssl_get_server_send_pkey(s);
4180.           dh_secbits = EVP_PKEY_security_bits(cpk->privatekey);
4181.       }

ssl/ssl_lib.c:2153:1: start of procedure ssl_get_server_send_pkey()
  2151.   }
  2152.   
  2153. > CERT_PKEY *ssl_get_server_send_pkey(SSL *s)
  2154.   {
  2155.       CERT *c;

ssl/ssl_lib.c:2158:5: 
  2156.       int i;
  2157.   
  2158. >     c = s->cert;
  2159.       if (!s->s3 || !s->s3->tmp.new_cipher)
  2160.           return NULL;

ssl/ssl_lib.c:2159:10: Taking false branch
  2157.   
  2158.       c = s->cert;
  2159.       if (!s->s3 || !s->s3->tmp.new_cipher)
                   ^
  2160.           return NULL;
  2161.       ssl_set_masks(s, s->s3->tmp.new_cipher);

ssl/ssl_lib.c:2159:20: Taking false branch
  2157.   
  2158.       c = s->cert;
  2159.       if (!s->s3 || !s->s3->tmp.new_cipher)
                             ^
  2160.           return NULL;
  2161.       ssl_set_masks(s, s->s3->tmp.new_cipher);

ssl/ssl_lib.c:2161:5: Skipping ssl_set_masks(): empty list of specs
  2159.       if (!s->s3 || !s->s3->tmp.new_cipher)
  2160.           return NULL;
  2161.       ssl_set_masks(s, s->s3->tmp.new_cipher);
              ^
  2162.   
  2163.   #ifdef OPENSSL_SSL_DEBUG_BROKEN_PROTOCOL

ssl/ssl_lib.c:2172:5: Skipping ssl_get_server_cert_index(): empty list of specs
  2170.   #endif
  2171.   
  2172.       i = ssl_get_server_cert_index(s);
              ^
  2173.   
  2174.       /* This may or may not be an error. */

ssl/ssl_lib.c:2175:9: Taking true branch
  2173.   
  2174.       /* This may or may not be an error. */
  2175.       if (i < 0)
                  ^
  2176.           return NULL;
  2177.   

ssl/ssl_lib.c:2176:9: 
  2174.       /* This may or may not be an error. */
  2175.       if (i < 0)
  2176. >         return NULL;
  2177.   
  2178.       /* May be NULL. */

ssl/ssl_lib.c:2180:1: return from a call to ssl_get_server_send_pkey
  2178.       /* May be NULL. */
  2179.       return &c->pkeys[i];
  2180. > }
  2181.   
  2182.   EVP_PKEY *ssl_get_sign_pkey(SSL *s, const SSL_CIPHER *cipher,

ssl/t1_lib.c:4180:9: 
4178.       } else {
4179.           CERT_PKEY *cpk = ssl_get_server_send_pkey(s);
4180. >         dh_secbits = EVP_PKEY_security_bits(cpk->privatekey);
4181.       }
4182.   
