apps/x509.c:1108: error: NULL_DEREFERENCE
  pointer `upkey` last assigned on line 1107 could be null and is dereferenced by call to `EVP_PKEY_copy_parameters()` at line 1108, column 2.
Showing all 67 steps of the trace


apps/x509.c:1098:1: start of procedure x509_certify()
1096.   	}
1097.   
1098. > static int x509_certify(X509_STORE *ctx, char *CAfile, const EVP_MD *digest,
1099.   	     X509 *x, X509 *xca, EVP_PKEY *pkey, char *serialfile, int create,
1100.   	     int days, int clrext, CONF *conf, char *section, ASN1_INTEGER *sno)

apps/x509.c:1102:2: 
1100.   	     int days, int clrext, CONF *conf, char *section, ASN1_INTEGER *sno)
1101.   	{
1102. > 	int ret=0;
1103.   	ASN1_INTEGER *bs=NULL;
1104.   	X509_STORE_CTX xsc;

apps/x509.c:1103:2: 
1101.   	{
1102.   	int ret=0;
1103. > 	ASN1_INTEGER *bs=NULL;
1104.   	X509_STORE_CTX xsc;
1105.   	EVP_PKEY *upkey;

apps/x509.c:1107:2: 
1105.   	EVP_PKEY *upkey;
1106.   
1107. > 	upkey = X509_get_pubkey(xca);
1108.   	EVP_PKEY_copy_parameters(upkey,pkey);
1109.   	EVP_PKEY_free(upkey);

crypto/x509/x509_cmp.c:374:1: start of procedure X509_get_pubkey()
  372.   	}
  373.   
  374. > EVP_PKEY *X509_get_pubkey(X509 *x)
  375.   	{
  376.   	if ((x == NULL) || (x->cert_info == NULL))

crypto/x509/x509_cmp.c:376:7: Taking false branch
  374.   EVP_PKEY *X509_get_pubkey(X509 *x)
  375.   	{
  376.   	if ((x == NULL) || (x->cert_info == NULL))
               ^
  377.   		return(NULL);
  378.   	return(X509_PUBKEY_get(x->cert_info->key));

crypto/x509/x509_cmp.c:376:22: Taking false branch
  374.   EVP_PKEY *X509_get_pubkey(X509 *x)
  375.   	{
  376.   	if ((x == NULL) || (x->cert_info == NULL))
                              ^
  377.   		return(NULL);
  378.   	return(X509_PUBKEY_get(x->cert_info->key));

crypto/x509/x509_cmp.c:378:2: 
  376.   	if ((x == NULL) || (x->cert_info == NULL))
  377.   		return(NULL);
  378. > 	return(X509_PUBKEY_get(x->cert_info->key));
  379.   	}
  380.   

crypto/asn1/x_pubkey.c:133:1: start of procedure X509_PUBKEY_get()
    131.   	}
    132.   
    133. > EVP_PKEY *X509_PUBKEY_get(X509_PUBKEY *key)
    134.   	{
    135.   	EVP_PKEY *ret=NULL;

crypto/asn1/x_pubkey.c:135:2: 
    133.   EVP_PKEY *X509_PUBKEY_get(X509_PUBKEY *key)
    134.   	{
    135. > 	EVP_PKEY *ret=NULL;
    136.   
    137.   	if (key == NULL) goto error;

crypto/asn1/x_pubkey.c:137:6: Taking false branch
    135.   	EVP_PKEY *ret=NULL;
    136.   
    137.   	if (key == NULL) goto error;
                ^
    138.   
    139.   	if (key->pkey != NULL)

crypto/asn1/x_pubkey.c:139:6: Taking false branch
    137.   	if (key == NULL) goto error;
    138.   
    139.   	if (key->pkey != NULL)
                ^
    140.   		{
    141.   		CRYPTO_add(&key->pkey->references, 1, CRYPTO_LOCK_EVP_PKEY);

crypto/asn1/x_pubkey.c:145:6: Taking false branch
    143.   		}
    144.   
    145.   	if (key->public_key == NULL) goto error;
                ^
    146.   
    147.   	if ((ret = EVP_PKEY_new()) == NULL)

crypto/asn1/x_pubkey.c:147:6: 
    145.   	if (key->public_key == NULL) goto error;
    146.   
    147. > 	if ((ret = EVP_PKEY_new()) == NULL)
    148.   		{
    149.   		X509err(X509_F_X509_PUBKEY_GET, ERR_R_MALLOC_FAILURE);

crypto/evp/p_lib.c:173:1: start of procedure EVP_PKEY_new()
      171.   	}
      172.   
      173. > EVP_PKEY *EVP_PKEY_new(void)
      174.   	{
      175.   	EVP_PKEY *ret;

crypto/evp/p_lib.c:177:2: 
      175.   	EVP_PKEY *ret;
      176.   
      177. > 	ret=(EVP_PKEY *)OPENSSL_malloc(sizeof(EVP_PKEY));
      178.   	if (ret == NULL)
      179.   		{

crypto/mem.c:291:1: start of procedure CRYPTO_malloc()
        289.   	}
        290.   
        291. > void *CRYPTO_malloc(int num, const char *file, int line)
        292.   	{
        293.   	void *ret = NULL;

crypto/mem.c:293:2: 
        291.   void *CRYPTO_malloc(int num, const char *file, int line)
        292.   	{
        293. > 	void *ret = NULL;
        294.   	extern unsigned char cleanse_ctr;
        295.   

crypto/mem.c:296:6: Taking false branch
        294.   	extern unsigned char cleanse_ctr;
        295.   
        296.   	if (num <= 0) return NULL;
                    ^
        297.   
        298.   	allow_customize = 0;

crypto/mem.c:298:2: 
        296.   	if (num <= 0) return NULL;
        297.   
        298. > 	allow_customize = 0;
        299.   	if (malloc_debug_func != NULL)
        300.   		{

crypto/mem.c:299:6: Taking true branch
        297.   
        298.   	allow_customize = 0;
        299.   	if (malloc_debug_func != NULL)
                    ^
        300.   		{
        301.   		allow_customize_debug = 0;

crypto/mem.c:301:3: 
        299.   	if (malloc_debug_func != NULL)
        300.   		{
        301. > 		allow_customize_debug = 0;
        302.   		malloc_debug_func(NULL, num, file, line, 0);
        303.   		}

crypto/mem.c:302:3: Skipping __function_pointer__(): unresolved function pointer
        300.   		{
        301.   		allow_customize_debug = 0;
        302.   		malloc_debug_func(NULL, num, file, line, 0);
                 ^
        303.   		}
        304.   	ret = malloc_ex_func(num,file,line);

crypto/mem.c:304:2: Skipping __function_pointer__(): unresolved function pointer
        302.   		malloc_debug_func(NULL, num, file, line, 0);
        303.   		}
        304.   	ret = malloc_ex_func(num,file,line);
                ^
        305.   #ifdef LEVITTE_DEBUG_MEM
        306.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);

crypto/mem.c:308:6: Taking true branch
        306.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);
        307.   #endif
        308.   	if (malloc_debug_func != NULL)
                    ^
        309.   		malloc_debug_func(ret, num, file, line, 1);
        310.   

crypto/mem.c:309:3: Skipping __function_pointer__(): unresolved function pointer
        307.   #endif
        308.   	if (malloc_debug_func != NULL)
        309.   		malloc_debug_func(ret, num, file, line, 1);
                 ^
        310.   
        311.           /* Create a dependency on the value of 'cleanse_ctr' so our memory

crypto/mem.c:314:12: Taking false branch
        312.            * sanitisation function can't be optimised out. NB: We only do
        313.            * this for >2Kb so the overhead doesn't bother us. */
        314.           if(ret && (num > 2048))
                          ^
        315.                   ((unsigned char *)ret)[0] = cleanse_ctr;
        316.   

crypto/mem.c:317:2: 
        315.                   ((unsigned char *)ret)[0] = cleanse_ctr;
        316.   
        317. > 	return ret;
        318.   	}
        319.   

crypto/mem.c:318:2: return from a call to CRYPTO_malloc
        316.   
        317.   	return ret;
        318.   	}
                ^
        319.   
        320.   void *CRYPTO_realloc(void *str, int num, const char *file, int line)

crypto/evp/p_lib.c:178:6: Taking true branch
      176.   
      177.   	ret=(EVP_PKEY *)OPENSSL_malloc(sizeof(EVP_PKEY));
      178.   	if (ret == NULL)
                  ^
      179.   		{
      180.   		EVPerr(EVP_F_EVP_PKEY_NEW,ERR_R_MALLOC_FAILURE);

crypto/evp/p_lib.c:180:3: 
      178.   	if (ret == NULL)
      179.   		{
      180. > 		EVPerr(EVP_F_EVP_PKEY_NEW,ERR_R_MALLOC_FAILURE);
      181.   		return(NULL);
      182.   		}

crypto/err/err.c:679:1: start of procedure ERR_put_error()
        677.   /********************************************************/
        678.   
        679. > void ERR_put_error(int lib, int func, int reason, const char *file,
        680.   	     int line)
        681.   	{

crypto/err/err.c:703:2: Skipping ERR_get_state(): empty list of specs
        701.   	}
        702.   #endif
        703.   	es=ERR_get_state();
                ^
        704.   
        705.   	es->top=(es->top+1)%ERR_NUM_ERRORS;

crypto/err/err.c:705:2: 
        703.   	es=ERR_get_state();
        704.   
        705. > 	es->top=(es->top+1)%ERR_NUM_ERRORS;
        706.   	if (es->top == es->bottom)
        707.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;

crypto/err/err.c:706:6: Taking false branch
        704.   
        705.   	es->top=(es->top+1)%ERR_NUM_ERRORS;
        706.   	if (es->top == es->bottom)
                    ^
        707.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
        708.   	es->err_flags[es->top]=0;

crypto/err/err.c:708:2: 
        706.   	if (es->top == es->bottom)
        707.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
        708. > 	es->err_flags[es->top]=0;
        709.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
        710.   	es->err_file[es->top]=file;

crypto/err/err.c:709:2: 
        707.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
        708.   	es->err_flags[es->top]=0;
        709. > 	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
        710.   	es->err_file[es->top]=file;
        711.   	es->err_line[es->top]=line;

crypto/err/err.c:710:2: 
        708.   	es->err_flags[es->top]=0;
        709.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
        710. > 	es->err_file[es->top]=file;
        711.   	es->err_line[es->top]=line;
        712.   	err_clear_data(es,es->top);

crypto/err/err.c:711:2: 
        709.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
        710.   	es->err_file[es->top]=file;
        711. > 	es->err_line[es->top]=line;
        712.   	err_clear_data(es,es->top);
        713.   	}

crypto/err/err.c:712:2: Taking true branch
        710.   	es->err_file[es->top]=file;
        711.   	es->err_line[es->top]=line;
        712.   	err_clear_data(es,es->top);
                ^
        713.   	}
        714.   

crypto/err/err.c:712:2: Taking false branch
        710.   	es->err_file[es->top]=file;
        711.   	es->err_line[es->top]=line;
        712.   	err_clear_data(es,es->top);
                ^
        713.   	}
        714.   

crypto/err/err.c:712:2: Loop condition is false. Leaving loop
        710.   	es->err_file[es->top]=file;
        711.   	es->err_line[es->top]=line;
        712.   	err_clear_data(es,es->top);
                ^
        713.   	}
        714.   

crypto/err/err.c:713:2: return from a call to ERR_put_error
        711.   	es->err_line[es->top]=line;
        712.   	err_clear_data(es,es->top);
        713.   	}
                ^
        714.   
        715.   void ERR_clear_error(void)

crypto/evp/p_lib.c:181:3: 
      179.   		{
      180.   		EVPerr(EVP_F_EVP_PKEY_NEW,ERR_R_MALLOC_FAILURE);
      181. > 		return(NULL);
      182.   		}
      183.   	ret->type=EVP_PKEY_NONE;

crypto/evp/p_lib.c:192:2: return from a call to EVP_PKEY_new
      190.   	ret->save_parameters=1;
      191.   	return(ret);
      192.   	}
              ^
      193.   
      194.   /* Setup a public key ASN1 method and ENGINE from a NID or a string.

crypto/asn1/x_pubkey.c:147:6: Taking true branch
    145.   	if (key->public_key == NULL) goto error;
    146.   
    147.   	if ((ret = EVP_PKEY_new()) == NULL)
                ^
    148.   		{
    149.   		X509err(X509_F_X509_PUBKEY_GET, ERR_R_MALLOC_FAILURE);

crypto/asn1/x_pubkey.c:149:3: 
    147.   	if ((ret = EVP_PKEY_new()) == NULL)
    148.   		{
    149. > 		X509err(X509_F_X509_PUBKEY_GET, ERR_R_MALLOC_FAILURE);
    150.   		goto error;
    151.   		}

crypto/err/err.c:679:1: start of procedure ERR_put_error()
      677.   /********************************************************/
      678.   
      679. > void ERR_put_error(int lib, int func, int reason, const char *file,
      680.   	     int line)
      681.   	{

crypto/err/err.c:703:2: Skipping ERR_get_state(): empty list of specs
      701.   	}
      702.   #endif
      703.   	es=ERR_get_state();
              ^
      704.   
      705.   	es->top=(es->top+1)%ERR_NUM_ERRORS;

crypto/err/err.c:705:2: 
      703.   	es=ERR_get_state();
      704.   
      705. > 	es->top=(es->top+1)%ERR_NUM_ERRORS;
      706.   	if (es->top == es->bottom)
      707.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;

crypto/err/err.c:706:6: Taking false branch
      704.   
      705.   	es->top=(es->top+1)%ERR_NUM_ERRORS;
      706.   	if (es->top == es->bottom)
                  ^
      707.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
      708.   	es->err_flags[es->top]=0;

crypto/err/err.c:708:2: 
      706.   	if (es->top == es->bottom)
      707.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
      708. > 	es->err_flags[es->top]=0;
      709.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
      710.   	es->err_file[es->top]=file;

crypto/err/err.c:709:2: 
      707.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
      708.   	es->err_flags[es->top]=0;
      709. > 	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
      710.   	es->err_file[es->top]=file;
      711.   	es->err_line[es->top]=line;

crypto/err/err.c:710:2: 
      708.   	es->err_flags[es->top]=0;
      709.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
      710. > 	es->err_file[es->top]=file;
      711.   	es->err_line[es->top]=line;
      712.   	err_clear_data(es,es->top);

crypto/err/err.c:711:2: 
      709.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
      710.   	es->err_file[es->top]=file;
      711. > 	es->err_line[es->top]=line;
      712.   	err_clear_data(es,es->top);
      713.   	}

crypto/err/err.c:712:2: Taking true branch
      710.   	es->err_file[es->top]=file;
      711.   	es->err_line[es->top]=line;
      712.   	err_clear_data(es,es->top);
              ^
      713.   	}
      714.   

crypto/err/err.c:712:2: Taking false branch
      710.   	es->err_file[es->top]=file;
      711.   	es->err_line[es->top]=line;
      712.   	err_clear_data(es,es->top);
              ^
      713.   	}
      714.   

crypto/err/err.c:712:2: Loop condition is false. Leaving loop
      710.   	es->err_file[es->top]=file;
      711.   	es->err_line[es->top]=line;
      712.   	err_clear_data(es,es->top);
              ^
      713.   	}
      714.   

crypto/err/err.c:713:2: return from a call to ERR_put_error
      711.   	es->err_line[es->top]=line;
      712.   	err_clear_data(es,es->top);
      713.   	}
              ^
      714.   
      715.   void ERR_clear_error(void)

crypto/asn1/x_pubkey.c:179:2: 
    177.   	return ret;
    178.   
    179. > 	error:
    180.   	if (ret != NULL)
    181.   		EVP_PKEY_free(ret);

crypto/asn1/x_pubkey.c:180:6: Taking false branch
    178.   
    179.   	error:
    180.   	if (ret != NULL)
                ^
    181.   		EVP_PKEY_free(ret);
    182.   	return(NULL);

crypto/asn1/x_pubkey.c:182:2: 
    180.   	if (ret != NULL)
    181.   		EVP_PKEY_free(ret);
    182. > 	return(NULL);
    183.   	}
    184.   

crypto/asn1/x_pubkey.c:183:2: return from a call to X509_PUBKEY_get
    181.   		EVP_PKEY_free(ret);
    182.   	return(NULL);
    183.   	}
            ^
    184.   
    185.   /* Now two pseudo ASN1 routines that take an EVP_PKEY structure

crypto/x509/x509_cmp.c:379:2: return from a call to X509_get_pubkey
  377.   		return(NULL);
  378.   	return(X509_PUBKEY_get(x->cert_info->key));
  379.   	}
          ^
  380.   
  381.   ASN1_BIT_STRING *X509_get0_pubkey_bitstr(const X509 *x)

apps/x509.c:1108:2: 
1106.   
1107.   	upkey = X509_get_pubkey(xca);
1108. > 	EVP_PKEY_copy_parameters(upkey,pkey);
1109.   	EVP_PKEY_free(upkey);
1110.   

crypto/evp/p_lib.c:124:1: start of procedure EVP_PKEY_copy_parameters()
  122.   	}
  123.   
  124. > int EVP_PKEY_copy_parameters(EVP_PKEY *to, const EVP_PKEY *from)
  125.   	{
  126.   	if (to->type != from->type)

crypto/evp/p_lib.c:126:6: 
  124.   int EVP_PKEY_copy_parameters(EVP_PKEY *to, const EVP_PKEY *from)
  125.   	{
  126. > 	if (to->type != from->type)
  127.   		{
  128.   		EVPerr(EVP_F_EVP_PKEY_COPY_PARAMETERS,EVP_R_DIFFERENT_KEY_TYPES);
