ssl/statem/statem_clnt.c:2474: error: NULL_DEREFERENCE
  pointer `pkey` last assigned on line 2473 could be null and is dereferenced by call to `EVP_PKEY_get0_RSA()` at line 2474, column 9.
Showing all 30 steps of the trace


ssl/statem/statem_clnt.c:2455:1: start of procedure tls_construct_cke_rsa()
2453.   }
2454.   
2455. > static int tls_construct_cke_rsa(SSL *s, WPACKET *pkt, int *al)
2456.   {
2457.   #ifndef OPENSSL_NO_RSA

ssl/statem/statem_clnt.c:2458:5: 
2456.   {
2457.   #ifndef OPENSSL_NO_RSA
2458. >     unsigned char *encdata = NULL;
2459.       EVP_PKEY *pkey = NULL;
2460.       EVP_PKEY_CTX *pctx = NULL;

ssl/statem/statem_clnt.c:2459:5: 
2457.   #ifndef OPENSSL_NO_RSA
2458.       unsigned char *encdata = NULL;
2459. >     EVP_PKEY *pkey = NULL;
2460.       EVP_PKEY_CTX *pctx = NULL;
2461.       size_t enclen;

ssl/statem/statem_clnt.c:2460:5: 
2458.       unsigned char *encdata = NULL;
2459.       EVP_PKEY *pkey = NULL;
2460. >     EVP_PKEY_CTX *pctx = NULL;
2461.       size_t enclen;
2462.       unsigned char *pms = NULL;

ssl/statem/statem_clnt.c:2462:5: 
2460.       EVP_PKEY_CTX *pctx = NULL;
2461.       size_t enclen;
2462. >     unsigned char *pms = NULL;
2463.       size_t pmslen = 0;
2464.   

ssl/statem/statem_clnt.c:2463:5: 
2461.       size_t enclen;
2462.       unsigned char *pms = NULL;
2463. >     size_t pmslen = 0;
2464.   
2465.       if (s->session->peer == NULL) {

ssl/statem/statem_clnt.c:2465:9: Taking false branch
2463.       size_t pmslen = 0;
2464.   
2465.       if (s->session->peer == NULL) {
                ^
2466.           /*
2467.            * We should always have a server certificate with SSL_kRSA.

ssl/statem/statem_clnt.c:2473:5: 
2471.       }
2472.   
2473. >     pkey = X509_get0_pubkey(s->session->peer);
2474.       if (EVP_PKEY_get0_RSA(pkey) == NULL) {
2475.           SSLerr(SSL_F_TLS_CONSTRUCT_CKE_RSA, ERR_R_INTERNAL_ERROR);

crypto/x509/x509_cmp.c:265:1: start of procedure X509_get0_pubkey()
  263.   }
  264.   
  265. > EVP_PKEY *X509_get0_pubkey(const X509 *x)
  266.   {
  267.       if (x == NULL)

crypto/x509/x509_cmp.c:267:9: Taking false branch
  265.   EVP_PKEY *X509_get0_pubkey(const X509 *x)
  266.   {
  267.       if (x == NULL)
                 ^
  268.           return NULL;
  269.       return X509_PUBKEY_get0(x->cert_info.key);

crypto/x509/x509_cmp.c:269:5: 
  267.       if (x == NULL)
  268.           return NULL;
  269. >     return X509_PUBKEY_get0(x->cert_info.key);
  270.   }
  271.   

crypto/x509/x_pubkey.c:140:1: start of procedure X509_PUBKEY_get0()
    138.   }
    139.   
    140. > EVP_PKEY *X509_PUBKEY_get0(X509_PUBKEY *key)
    141.   {
    142.       EVP_PKEY *ret = NULL;

crypto/x509/x_pubkey.c:142:5: 
    140.   EVP_PKEY *X509_PUBKEY_get0(X509_PUBKEY *key)
    141.   {
    142. >     EVP_PKEY *ret = NULL;
    143.   
    144.       if (key == NULL || key->public_key == NULL)

crypto/x509/x_pubkey.c:144:9: Taking false branch
    142.       EVP_PKEY *ret = NULL;
    143.   
    144.       if (key == NULL || key->public_key == NULL)
                   ^
    145.           return NULL;
    146.   

crypto/x509/x_pubkey.c:144:24: Taking false branch
    142.       EVP_PKEY *ret = NULL;
    143.   
    144.       if (key == NULL || key->public_key == NULL)
                                  ^
    145.           return NULL;
    146.   

crypto/x509/x_pubkey.c:147:9: Taking false branch
    145.           return NULL;
    146.   
    147.       if (key->pkey != NULL)
                   ^
    148.           return key->pkey;
    149.   

crypto/x509/x_pubkey.c:158:5: 
    156.        * in the queue.
    157.        */
    158. >     x509_pubkey_decode(&ret, key);
    159.       /* If decode doesn't fail something bad happened */
    160.       if (ret != NULL) {

crypto/x509/x_pubkey.c:103:1: start of procedure x509_pubkey_decode()
      101.   
      102.   
      103. > static int x509_pubkey_decode(EVP_PKEY **ppkey, X509_PUBKEY *key)
      104.       {
      105.       EVP_PKEY *pkey = EVP_PKEY_new();

crypto/x509/x_pubkey.c:105:5: Skipping EVP_PKEY_new(): empty list of specs
      103.   static int x509_pubkey_decode(EVP_PKEY **ppkey, X509_PUBKEY *key)
      104.       {
      105.       EVP_PKEY *pkey = EVP_PKEY_new();
                 ^
      106.   
      107.       if (pkey == NULL) {

crypto/x509/x_pubkey.c:107:9: Taking true branch
      105.       EVP_PKEY *pkey = EVP_PKEY_new();
      106.   
      107.       if (pkey == NULL) {
                     ^
      108.           X509err(X509_F_X509_PUBKEY_DECODE, ERR_R_MALLOC_FAILURE);
      109.           return -1;

crypto/x509/x_pubkey.c:108:9: Skipping ERR_put_error(): empty list of specs
      106.   
      107.       if (pkey == NULL) {
      108.           X509err(X509_F_X509_PUBKEY_DECODE, ERR_R_MALLOC_FAILURE);
                     ^
      109.           return -1;
      110.       }

crypto/x509/x_pubkey.c:109:9: 
      107.       if (pkey == NULL) {
      108.           X509err(X509_F_X509_PUBKEY_DECODE, ERR_R_MALLOC_FAILURE);
      109. >         return -1;
      110.       }
      111.   

crypto/x509/x_pubkey.c:138:1: return from a call to x509_pubkey_decode
      136.       EVP_PKEY_free(pkey);
      137.       return 0;
      138. > }
      139.   
      140.   EVP_PKEY *X509_PUBKEY_get0(X509_PUBKEY *key)

crypto/x509/x_pubkey.c:160:9: Taking false branch
    158.       x509_pubkey_decode(&ret, key);
    159.       /* If decode doesn't fail something bad happened */
    160.       if (ret != NULL) {
                   ^
    161.           X509err(X509_F_X509_PUBKEY_GET0, ERR_R_INTERNAL_ERROR);
    162.           EVP_PKEY_free(ret);

crypto/x509/x_pubkey.c:165:5: 
    163.       }
    164.   
    165. >     return NULL;
    166.   }
    167.   

crypto/x509/x_pubkey.c:166:1: return from a call to X509_PUBKEY_get0
    164.   
    165.       return NULL;
    166. > }
    167.   
    168.   EVP_PKEY *X509_PUBKEY_get(X509_PUBKEY *key)

crypto/x509/x509_cmp.c:270:1: return from a call to X509_get0_pubkey
  268.           return NULL;
  269.       return X509_PUBKEY_get0(x->cert_info.key);
  270. > }
  271.   
  272.   EVP_PKEY *X509_get_pubkey(X509 *x)

ssl/statem/statem_clnt.c:2474:9: 
2472.   
2473.       pkey = X509_get0_pubkey(s->session->peer);
2474. >     if (EVP_PKEY_get0_RSA(pkey) == NULL) {
2475.           SSLerr(SSL_F_TLS_CONSTRUCT_CKE_RSA, ERR_R_INTERNAL_ERROR);
2476.           return 0;

crypto/evp/p_lib.c:275:1: start of procedure EVP_PKEY_get0_RSA()
  273.   }
  274.   
  275. > RSA *EVP_PKEY_get0_RSA(EVP_PKEY *pkey)
  276.   {
  277.       if (pkey->type != EVP_PKEY_RSA) {

crypto/evp/p_lib.c:277:9: 
  275.   RSA *EVP_PKEY_get0_RSA(EVP_PKEY *pkey)
  276.   {
  277. >     if (pkey->type != EVP_PKEY_RSA) {
  278.           EVPerr(EVP_F_EVP_PKEY_GET0_RSA, EVP_R_EXPECTING_AN_RSA_KEY);
  279.           return NULL;
