ssl/s3_clnt.c:1649: error: NULL_DEREFERENCE
  pointer `pkey` last assigned on line 1647 could be null and is dereferenced by call to `EVP_PKEY_free()` at line 1649, column 2.
Showing all 17 steps of the trace


ssl/s3_clnt.c:1610:1: start of procedure ssl3_check_cert_and_algorithm()
1608.   #define has_bits(i,m)	(((i)&(m)) == (m))
1609.   
1610. > static int ssl3_check_cert_and_algorithm(SSL *s)
1611.   	{
1612.   	int i,idx;

ssl/s3_clnt.c:1614:2: 
1612.   	int i,idx;
1613.   	long algs;
1614. > 	EVP_PKEY *pkey=NULL;
1615.   	SESS_CERT *sc;
1616.   #ifndef NO_RSA

ssl/s3_clnt.c:1623:2: 
1621.   #endif
1622.   
1623. > 	sc=s->session->sess_cert;
1624.   
1625.   	if (sc == NULL)

ssl/s3_clnt.c:1625:6: Taking false branch
1623.   	sc=s->session->sess_cert;
1624.   
1625.   	if (sc == NULL)
             ^
1626.   		{
1627.   		SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_INTERNAL_ERROR);

ssl/s3_clnt.c:1631:2: 
1629.   		}
1630.   
1631. > 	algs=s->s3->tmp.new_cipher->algorithms;
1632.   
1633.   	/* we don't have a certificate */

ssl/s3_clnt.c:1634:6: Taking false branch
1632.   
1633.   	/* we don't have a certificate */
1634.   	if (algs & (SSL_aDH|SSL_aNULL))
             ^
1635.   		return(1);
1636.   

ssl/s3_clnt.c:1638:2: 
1636.   
1637.   #ifndef NO_RSA
1638. > 	rsa=s->session->sess_cert->peer_rsa_tmp;
1639.   #endif
1640.   #ifndef NO_DH

ssl/s3_clnt.c:1641:2: 
1639.   #endif
1640.   #ifndef NO_DH
1641. > 	dh=s->session->sess_cert->peer_dh_tmp;
1642.   #endif
1643.   

ssl/s3_clnt.c:1646:2: 
1644.   	/* This is the passed certificate */
1645.   
1646. > 	idx=sc->peer_cert_type;
1647.   	pkey=X509_get_pubkey(sc->peer_pkeys[idx].x509);
1648.   	i=X509_certificate_type(sc->peer_pkeys[idx].x509,pkey);

ssl/s3_clnt.c:1647:2: 
1645.   
1646.   	idx=sc->peer_cert_type;
1647. > 	pkey=X509_get_pubkey(sc->peer_pkeys[idx].x509);
1648.   	i=X509_certificate_type(sc->peer_pkeys[idx].x509,pkey);
1649.   	EVP_PKEY_free(pkey);

crypto/x509/x509_cmp.c:254:1: start of procedure X509_get_pubkey()
  252.   	}
  253.   
  254. > EVP_PKEY *X509_get_pubkey(X509 *x)
  255.   	{
  256.   	if ((x == NULL) || (x->cert_info == NULL))

crypto/x509/x509_cmp.c:256:7: Taking false branch
  254.   EVP_PKEY *X509_get_pubkey(X509 *x)
  255.   	{
  256.   	if ((x == NULL) || (x->cert_info == NULL))
               ^
  257.   		return(NULL);
  258.   	return(X509_PUBKEY_get(x->cert_info->key));

crypto/x509/x509_cmp.c:256:22: Taking true branch
  254.   EVP_PKEY *X509_get_pubkey(X509 *x)
  255.   	{
  256.   	if ((x == NULL) || (x->cert_info == NULL))
                              ^
  257.   		return(NULL);
  258.   	return(X509_PUBKEY_get(x->cert_info->key));

crypto/x509/x509_cmp.c:257:3: 
  255.   	{
  256.   	if ((x == NULL) || (x->cert_info == NULL))
  257. > 		return(NULL);
  258.   	return(X509_PUBKEY_get(x->cert_info->key));
  259.   	}

crypto/x509/x509_cmp.c:259:2: return from a call to X509_get_pubkey
  257.   		return(NULL);
  258.   	return(X509_PUBKEY_get(x->cert_info->key));
  259.   	}
          ^
  260.   
  261.   int X509_check_private_key(X509 *x, EVP_PKEY *k)

ssl/s3_clnt.c:1648:2: Skipping X509_certificate_type(): empty list of specs
1646.   	idx=sc->peer_cert_type;
1647.   	pkey=X509_get_pubkey(sc->peer_pkeys[idx].x509);
1648.   	i=X509_certificate_type(sc->peer_pkeys[idx].x509,pkey);
         ^
1649.   	EVP_PKEY_free(pkey);
1650.   

ssl/s3_clnt.c:1649:2: 
1647.   	pkey=X509_get_pubkey(sc->peer_pkeys[idx].x509);
1648.   	i=X509_certificate_type(sc->peer_pkeys[idx].x509,pkey);
1649. > 	EVP_PKEY_free(pkey);
1650.   
1651.   	
