ssl/s3_srvr.c:2967: error: NULL_DEREFERENCE
  pointer `pkey` last assigned on line 2923 could be null and is dereferenced at line 2967, column 21.
Showing all 27 steps of the trace


ssl/s3_srvr.c:2901:1: start of procedure ssl3_get_cert_verify()
2899.   }
2900.   
2901. > int ssl3_get_cert_verify(SSL *s)
2902.   {
2903.       EVP_PKEY *pkey = NULL;

ssl/s3_srvr.c:2903:5: 
2901.   int ssl3_get_cert_verify(SSL *s)
2902.   {
2903. >     EVP_PKEY *pkey = NULL;
2904.       unsigned char *p;
2905.       int al, ok, ret = 0;

ssl/s3_srvr.c:2905:5: 
2903.       EVP_PKEY *pkey = NULL;
2904.       unsigned char *p;
2905. >     int al, ok, ret = 0;
2906.       long n;
2907.       int type = 0, i, j;

ssl/s3_srvr.c:2907:5: 
2905.       int al, ok, ret = 0;
2906.       long n;
2907. >     int type = 0, i, j;
2908.       X509 *peer;
2909.       const EVP_MD *md = NULL;

ssl/s3_srvr.c:2909:5: 
2907.       int type = 0, i, j;
2908.       X509 *peer;
2909. >     const EVP_MD *md = NULL;
2910.       EVP_MD_CTX mctx;
2911.       EVP_MD_CTX_init(&mctx);

ssl/s3_srvr.c:2911:5: 
2909.       const EVP_MD *md = NULL;
2910.       EVP_MD_CTX mctx;
2911. >     EVP_MD_CTX_init(&mctx);
2912.   
2913.       n = s->method->ssl_get_message(s,

crypto/evp/digest.c:120:1: start of procedure EVP_MD_CTX_init()
  118.   #endif
  119.   
  120. > void EVP_MD_CTX_init(EVP_MD_CTX *ctx)
  121.   {
  122.       memset(ctx, '\0', sizeof *ctx);

crypto/evp/digest.c:122:5: 
  120.   void EVP_MD_CTX_init(EVP_MD_CTX *ctx)
  121.   {
  122. >     memset(ctx, '\0', sizeof *ctx);
  123.   }
  124.   

crypto/evp/digest.c:123:1: return from a call to EVP_MD_CTX_init
  121.   {
  122.       memset(ctx, '\0', sizeof *ctx);
  123. > }
  124.   
  125.   EVP_MD_CTX *EVP_MD_CTX_create(void)

ssl/s3_srvr.c:2913:5: Skipping __function_pointer__(): unresolved function pointer
2911.       EVP_MD_CTX_init(&mctx);
2912.   
2913.       n = s->method->ssl_get_message(s,
            ^
2914.                                      SSL3_ST_SR_CERT_VRFY_A,
2915.                                      SSL3_ST_SR_CERT_VRFY_B,

ssl/s3_srvr.c:2918:10: Taking false branch
2916.                                      -1, SSL3_RT_MAX_PLAIN_LENGTH, &ok);
2917.   
2918.       if (!ok)
                 ^
2919.           return ((int)n);
2920.   

ssl/s3_srvr.c:2921:9: Taking true branch
2919.           return ((int)n);
2920.   
2921.       if (s->session->peer != NULL) {
                ^
2922.           peer = s->session->peer;
2923.           pkey = X509_get_pubkey(peer);

ssl/s3_srvr.c:2922:9: 
2920.   
2921.       if (s->session->peer != NULL) {
2922. >         peer = s->session->peer;
2923.           pkey = X509_get_pubkey(peer);
2924.           type = X509_certificate_type(peer, pkey);

ssl/s3_srvr.c:2923:9: 
2921.       if (s->session->peer != NULL) {
2922.           peer = s->session->peer;
2923. >         pkey = X509_get_pubkey(peer);
2924.           type = X509_certificate_type(peer, pkey);
2925.       } else {

crypto/x509/x509_cmp.c:310:1: start of procedure X509_get_pubkey()
  308.   }
  309.   
  310. > EVP_PKEY *X509_get_pubkey(X509 *x)
  311.   {
  312.       if ((x == NULL) || (x->cert_info == NULL))

crypto/x509/x509_cmp.c:312:10: Taking false branch
  310.   EVP_PKEY *X509_get_pubkey(X509 *x)
  311.   {
  312.       if ((x == NULL) || (x->cert_info == NULL))
                  ^
  313.           return (NULL);
  314.       return (X509_PUBKEY_get(x->cert_info->key));

crypto/x509/x509_cmp.c:312:25: Taking true branch
  310.   EVP_PKEY *X509_get_pubkey(X509 *x)
  311.   {
  312.       if ((x == NULL) || (x->cert_info == NULL))
                                 ^
  313.           return (NULL);
  314.       return (X509_PUBKEY_get(x->cert_info->key));

crypto/x509/x509_cmp.c:313:9: 
  311.   {
  312.       if ((x == NULL) || (x->cert_info == NULL))
  313. >         return (NULL);
  314.       return (X509_PUBKEY_get(x->cert_info->key));
  315.   }

crypto/x509/x509_cmp.c:315:1: return from a call to X509_get_pubkey
  313.           return (NULL);
  314.       return (X509_PUBKEY_get(x->cert_info->key));
  315. > }
  316.   
  317.   ASN1_BIT_STRING *X509_get0_pubkey_bitstr(const X509 *x)

ssl/s3_srvr.c:2924:9: Skipping X509_certificate_type(): empty list of specs
2922.           peer = s->session->peer;
2923.           pkey = X509_get_pubkey(peer);
2924.           type = X509_certificate_type(peer, pkey);
                ^
2925.       } else {
2926.           peer = NULL;

ssl/s3_srvr.c:2930:9: Taking false branch
2928.       }
2929.   
2930.       if (s->s3->tmp.message_type != SSL3_MT_CERTIFICATE_VERIFY) {
                ^
2931.           s->s3->tmp.reuse_message = 1;
2932.           if (peer != NULL) {

ssl/s3_srvr.c:2941:9: Taking false branch
2939.       }
2940.   
2941.       if (peer == NULL) {
                ^
2942.           SSLerr(SSL_F_SSL3_GET_CERT_VERIFY, SSL_R_NO_CLIENT_CERT_RECEIVED);
2943.           al = SSL_AD_UNEXPECTED_MESSAGE;

ssl/s3_srvr.c:2947:11: Taking false branch
2945.       }
2946.   
2947.       if (!(type & EVP_PKT_SIGN)) {
                  ^
2948.           SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,
2949.                  SSL_R_SIGNATURE_FOR_NON_SIGNING_CERTIFICATE);

ssl/s3_srvr.c:2954:9: Taking false branch
2952.       }
2953.   
2954.       if (s->s3->change_cipher_spec) {
                ^
2955.           SSLerr(SSL_F_SSL3_GET_CERT_VERIFY, SSL_R_CCS_RECEIVED_EARLY);
2956.           al = SSL_AD_UNEXPECTED_MESSAGE;

ssl/s3_srvr.c:2961:5: 
2959.   
2960.       /* we now have a signature that we need to verify */
2961. >     p = (unsigned char *)s->init_msg;
2962.       /* Check for broken implementations of GOST ciphersuites */
2963.       /*

ssl/s3_srvr.c:2967:9: Taking true branch
2965.        * length field
2966.        */
2967.       if (n == 64 && (pkey->type == NID_id_GostR3410_94 ||
                ^
2968.                       pkey->type == NID_id_GostR3410_2001)) {
2969.           i = 64;

ssl/s3_srvr.c:2967:21: 
2965.        * length field
2966.        */
2967. >     if (n == 64 && (pkey->type == NID_id_GostR3410_94 ||
2968.                       pkey->type == NID_id_GostR3410_2001)) {
2969.           i = 64;
