ssl/t1_lib.c:2156: error: NULL_DEREFERENCE
  pointer `cpk` last assigned on line 2155 could be null and is dereferenced at line 2156, column 45.
Showing all 15 steps of the trace


ssl/t1_lib.c:2144:1: start of procedure ssl_get_auto_dh()
2142.   
2143.   #ifndef OPENSSL_NO_DH
2144. > DH *ssl_get_auto_dh(SSL *s)
2145.   {
2146.       int dh_secbits = 80;

ssl/t1_lib.c:2146:5: 
2144.   DH *ssl_get_auto_dh(SSL *s)
2145.   {
2146. >     int dh_secbits = 80;
2147.       if (s->cert->dh_tmp_auto == 2)
2148.           return DH_get_1024_160();

ssl/t1_lib.c:2147:9: Taking false branch
2145.   {
2146.       int dh_secbits = 80;
2147.       if (s->cert->dh_tmp_auto == 2)
                ^
2148.           return DH_get_1024_160();
2149.       if (s->s3->tmp.new_cipher->algorithm_auth & (SSL_aNULL | SSL_aPSK)) {

ssl/t1_lib.c:2149:9: Taking false branch
2147.       if (s->cert->dh_tmp_auto == 2)
2148.           return DH_get_1024_160();
2149.       if (s->s3->tmp.new_cipher->algorithm_auth & (SSL_aNULL | SSL_aPSK)) {
                ^
2150.           if (s->s3->tmp.new_cipher->strength_bits == 256)
2151.               dh_secbits = 128;

ssl/t1_lib.c:2155:9: 
2153.               dh_secbits = 80;
2154.       } else {
2155. >         CERT_PKEY *cpk = ssl_get_server_send_pkey(s);
2156.           dh_secbits = EVP_PKEY_security_bits(cpk->privatekey);
2157.       }

ssl/ssl_lib.c:2873:1: start of procedure ssl_get_server_send_pkey()
  2871.   }
  2872.   
  2873. > CERT_PKEY *ssl_get_server_send_pkey(SSL *s)
  2874.   {
  2875.       CERT *c;

ssl/ssl_lib.c:2878:5: 
  2876.       int i;
  2877.   
  2878. >     c = s->cert;
  2879.       if (!s->s3 || !s->s3->tmp.new_cipher)
  2880.           return NULL;

ssl/ssl_lib.c:2879:10: Taking false branch
  2877.   
  2878.       c = s->cert;
  2879.       if (!s->s3 || !s->s3->tmp.new_cipher)
                   ^
  2880.           return NULL;
  2881.       ssl_set_masks(s);

ssl/ssl_lib.c:2879:20: Taking false branch
  2877.   
  2878.       c = s->cert;
  2879.       if (!s->s3 || !s->s3->tmp.new_cipher)
                             ^
  2880.           return NULL;
  2881.       ssl_set_masks(s);

ssl/ssl_lib.c:2881:5: Skipping ssl_set_masks(): empty list of specs
  2879.       if (!s->s3 || !s->s3->tmp.new_cipher)
  2880.           return NULL;
  2881.       ssl_set_masks(s);
              ^
  2882.   
  2883.       i = ssl_get_server_cert_index(s);

ssl/ssl_lib.c:2883:5: Skipping ssl_get_server_cert_index(): empty list of specs
  2881.       ssl_set_masks(s);
  2882.   
  2883.       i = ssl_get_server_cert_index(s);
              ^
  2884.   
  2885.       /* This may or may not be an error. */

ssl/ssl_lib.c:2886:9: Taking true branch
  2884.   
  2885.       /* This may or may not be an error. */
  2886.       if (i < 0)
                  ^
  2887.           return NULL;
  2888.   

ssl/ssl_lib.c:2887:9: 
  2885.       /* This may or may not be an error. */
  2886.       if (i < 0)
  2887. >         return NULL;
  2888.   
  2889.       /* May be NULL. */

ssl/ssl_lib.c:2891:1: return from a call to ssl_get_server_send_pkey
  2889.       /* May be NULL. */
  2890.       return &c->pkeys[i];
  2891. > }
  2892.   
  2893.   EVP_PKEY *ssl_get_sign_pkey(SSL *s, const SSL_CIPHER *cipher,

ssl/t1_lib.c:2156:9: 
2154.       } else {
2155.           CERT_PKEY *cpk = ssl_get_server_send_pkey(s);
2156. >         dh_secbits = EVP_PKEY_security_bits(cpk->privatekey);
2157.       }
2158.   
