ssl/s2_clnt.c:956: error: NULL_DEREFERENCE
  pointer `pkey` last assigned on line 897 could be null and is dereferenced by call to `EVP_PKEY_free()` at line 956, column 2.
Showing all 45 steps of the trace


ssl/s2_clnt.c:894:1: start of procedure ssl2_set_certificate()
892.   
893.   /* loads in the certificate from the server */
894. > int ssl2_set_certificate(SSL *s, int type, int len, unsigned char *data)
895.   	{
896.   	STACK_OF(X509) *sk=NULL;

ssl/s2_clnt.c:896:2: 
894.   int ssl2_set_certificate(SSL *s, int type, int len, unsigned char *data)
895.   	{
896. > 	STACK_OF(X509) *sk=NULL;
897.   	EVP_PKEY *pkey=NULL;
898.   	SESS_CERT *sc=NULL;

ssl/s2_clnt.c:897:2: 
895.   	{
896.   	STACK_OF(X509) *sk=NULL;
897. > 	EVP_PKEY *pkey=NULL;
898.   	SESS_CERT *sc=NULL;
899.   	int i;

ssl/s2_clnt.c:898:2: 
896.   	STACK_OF(X509) *sk=NULL;
897.   	EVP_PKEY *pkey=NULL;
898. > 	SESS_CERT *sc=NULL;
899.   	int i;
900.   	X509 *x509=NULL;

ssl/s2_clnt.c:900:2: 
898.   	SESS_CERT *sc=NULL;
899.   	int i;
900. > 	X509 *x509=NULL;
901.   	int ret=0;
902.   	

ssl/s2_clnt.c:901:2: 
899.   	int i;
900.   	X509 *x509=NULL;
901. > 	int ret=0;
902.   	
903.   	x509=d2i_X509(NULL,&data,(long)len);

ssl/s2_clnt.c:903:2: Skipping d2i_X509(): empty list of specs
901.   	int ret=0;
902.   	
903.   	x509=d2i_X509(NULL,&data,(long)len);
        ^
904.   	if (x509 == NULL)
905.   		{

ssl/s2_clnt.c:904:6: Taking false branch
902.   	
903.   	x509=d2i_X509(NULL,&data,(long)len);
904.   	if (x509 == NULL)
            ^
905.   		{
906.   		SSLerr(SSL_F_SSL2_SET_CERTIFICATE,ERR_R_X509_LIB);

ssl/s2_clnt.c:910:6: 
908.   		}
909.   
910. > 	if ((sk=sk_X509_new_null()) == NULL || !sk_X509_push(sk,x509))
911.   		{
912.   		SSLerr(SSL_F_SSL2_SET_CERTIFICATE,ERR_R_MALLOC_FAILURE);

crypto/x509/x509_vfy.c:799:1: start of procedure sk_X509_new_null()
  797.   
  798.   
  799. > IMPLEMENT_STACK_OF(X509)
  800.   IMPLEMENT_ASN1_SET_OF(X509)
  801.   

crypto/x509/x509_vfy.c:799:1: return from a call to sk_X509_new_null
  797.   
  798.   
  799. > IMPLEMENT_STACK_OF(X509)
  800.   IMPLEMENT_ASN1_SET_OF(X509)
  801.   

ssl/s2_clnt.c:910:6: Taking true branch
908.   		}
909.   
910.   	if ((sk=sk_X509_new_null()) == NULL || !sk_X509_push(sk,x509))
            ^
911.   		{
912.   		SSLerr(SSL_F_SSL2_SET_CERTIFICATE,ERR_R_MALLOC_FAILURE);

ssl/s2_clnt.c:912:3: 
910.   	if ((sk=sk_X509_new_null()) == NULL || !sk_X509_push(sk,x509))
911.   		{
912. > 		SSLerr(SSL_F_SSL2_SET_CERTIFICATE,ERR_R_MALLOC_FAILURE);
913.   		goto err;
914.   		}

crypto/err/err.c:246:1: start of procedure ERR_put_error()
  244.   /********************************************************/
  245.   
  246. > void ERR_put_error(int lib, int func, int reason, const char *file,
  247.   	     int line)
  248.   	{

crypto/err/err.c:270:2: Skipping ERR_get_state(): empty list of specs
  268.   	}
  269.   #endif
  270.   	es=ERR_get_state();
          ^
  271.   
  272.   	es->top=(es->top+1)%ERR_NUM_ERRORS;

crypto/err/err.c:272:2: 
  270.   	es=ERR_get_state();
  271.   
  272. > 	es->top=(es->top+1)%ERR_NUM_ERRORS;
  273.   	if (es->top == es->bottom)
  274.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;

crypto/err/err.c:273:6: Taking false branch
  271.   
  272.   	es->top=(es->top+1)%ERR_NUM_ERRORS;
  273.   	if (es->top == es->bottom)
              ^
  274.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
  275.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);

crypto/err/err.c:275:2: 
  273.   	if (es->top == es->bottom)
  274.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
  275. > 	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
  276.   	es->err_file[es->top]=file;
  277.   	es->err_line[es->top]=line;

crypto/err/err.c:276:2: 
  274.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
  275.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
  276. > 	es->err_file[es->top]=file;
  277.   	es->err_line[es->top]=line;
  278.   	err_clear_data(es,es->top);

crypto/err/err.c:277:2: 
  275.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
  276.   	es->err_file[es->top]=file;
  277. > 	es->err_line[es->top]=line;
  278.   	err_clear_data(es,es->top);
  279.   	}

crypto/err/err.c:278:2: Taking true branch
  276.   	es->err_file[es->top]=file;
  277.   	es->err_line[es->top]=line;
  278.   	err_clear_data(es,es->top);
          ^
  279.   	}
  280.   

crypto/err/err.c:278:2: Taking false branch
  276.   	es->err_file[es->top]=file;
  277.   	es->err_line[es->top]=line;
  278.   	err_clear_data(es,es->top);
          ^
  279.   	}
  280.   

crypto/err/err.c:279:2: return from a call to ERR_put_error
  277.   	es->err_line[es->top]=line;
  278.   	err_clear_data(es,es->top);
  279.   	}
          ^
  280.   
  281.   void ERR_clear_error(void)

ssl/s2_clnt.c:953:1: 
951.   		goto err;
952.   	ret=1;
953. > err:
954.   	sk_X509_free(sk);
955.   	X509_free(x509);

ssl/s2_clnt.c:954:2: 
952.   	ret=1;
953.   err:
954. > 	sk_X509_free(sk);
955.   	X509_free(x509);
956.   	EVP_PKEY_free(pkey);

crypto/x509/x509_vfy.c:799:1: start of procedure sk_X509_free()
  797.   
  798.   
  799. > IMPLEMENT_STACK_OF(X509)
  800.   IMPLEMENT_ASN1_SET_OF(X509)
  801.   

crypto/stack/stack.c:276:1: start of procedure sk_free()
    274.   	}
    275.   
    276. > void sk_free(STACK *st)
    277.   	{
    278.   	if (st == NULL) return;

crypto/stack/stack.c:278:6: Taking true branch
    276.   void sk_free(STACK *st)
    277.   	{
    278.   	if (st == NULL) return;
                ^
    279.   	if (st->data != NULL) Free(st->data);
    280.   	Free(st);

crypto/stack/stack.c:278:18: 
    276.   void sk_free(STACK *st)
    277.   	{
    278. > 	if (st == NULL) return;
    279.   	if (st->data != NULL) Free(st->data);
    280.   	Free(st);

crypto/stack/stack.c:281:2: return from a call to sk_free
    279.   	if (st->data != NULL) Free(st->data);
    280.   	Free(st);
    281.   	}
            ^
    282.   
    283.   int sk_num(STACK *st)

crypto/x509/x509_vfy.c:799:1: return from a call to sk_X509_free
  797.   
  798.   
  799. > IMPLEMENT_STACK_OF(X509)
  800.   IMPLEMENT_ASN1_SET_OF(X509)
  801.   

ssl/s2_clnt.c:955:2: 
953.   err:
954.   	sk_X509_free(sk);
955. > 	X509_free(x509);
956.   	EVP_PKEY_free(pkey);
957.   	return(ret);

crypto/asn1/x_x509.c:130:1: start of procedure X509_free()
  128.   	}
  129.   
  130. > void X509_free(X509 *a)
  131.   	{
  132.   	int i;

crypto/asn1/x_x509.c:134:6: Taking false branch
  132.   	int i;
  133.   
  134.   	if (a == NULL) return;
              ^
  135.   
  136.   	i=CRYPTO_add(&a->references,-1,CRYPTO_LOCK_X509);

crypto/asn1/x_x509.c:136:2: 
  134.   	if (a == NULL) return;
  135.   
  136. > 	i=CRYPTO_add(&a->references,-1,CRYPTO_LOCK_X509);
  137.   #ifdef REF_PRINT
  138.   	REF_PRINT("X509",a);

crypto/cryptlib.c:226:1: start of procedure CRYPTO_add_lock()
    224.   	}
    225.   
    226. > int CRYPTO_add_lock(int *pointer, int amount, int type, const char *file,
    227.   	     int line)
    228.   	{

crypto/cryptlib.c:231:6: Taking true branch
    229.   	int ret;
    230.   
    231.   	if (add_lock_callback != NULL)
                ^
    232.   		{
    233.   #ifdef LOCK_DEBUG

crypto/cryptlib.c:237:3: Skipping __function_pointer__(): unresolved function pointer
    235.   #endif
    236.   
    237.   		ret=add_lock_callback(pointer,amount,type,file,line);
             ^
    238.   #ifdef LOCK_DEBUG
    239.   		fprintf(stderr,"ladd:%08lx:%2d+%2d->%2d %-18s %s:%d\n",

crypto/cryptlib.c:245:3: 
    243.   			file,line);
    244.   #endif
    245. > 		*pointer=ret;
    246.   		}
    247.   	else

crypto/cryptlib.c:262:2: 
    260.   		CRYPTO_lock(CRYPTO_UNLOCK|CRYPTO_WRITE,type,file,line);
    261.   		}
    262. > 	return(ret);
    263.   	}
    264.   

crypto/cryptlib.c:263:2: return from a call to CRYPTO_add_lock
    261.   		}
    262.   	return(ret);
    263.   	}
            ^
    264.   
    265.   const char *CRYPTO_get_lock_name(int type)

crypto/asn1/x_x509.c:140:6: Taking true branch
  138.   	REF_PRINT("X509",a);
  139.   #endif
  140.   	if (i > 0) return;
              ^
  141.   #ifdef REF_CHECK
  142.   	if (i < 0)

crypto/asn1/x_x509.c:140:13: 
  138.   	REF_PRINT("X509",a);
  139.   #endif
  140. > 	if (i > 0) return;
  141.   #ifdef REF_CHECK
  142.   	if (i < 0)

crypto/asn1/x_x509.c:157:2: return from a call to X509_free
  155.   	if (a->name != NULL) Free(a->name);
  156.   	Free(a);
  157.   	}
          ^
  158.   
  159.   int X509_get_ex_new_index(long argl, void *argp, CRYPTO_EX_new *new_func,

ssl/s2_clnt.c:956:2: 
954.   	sk_X509_free(sk);
955.   	X509_free(x509);
956. > 	EVP_PKEY_free(pkey);
957.   	return(ret);
958.   	}
