ssl/s3_both.c:383: error: NULL_DEREFERENCE
  pointer `pk` last assigned on line 343 could be null and is dereferenced by call to `EVP_PKEY_free()` at line 383, column 12.
Showing all 24 steps of the trace


ssl/s3_both.c:337:1: start of procedure ssl_cert_type()
335.   	}
336.   
337. > int ssl_cert_type(X509 *x, EVP_PKEY *pkey)
338.   	{
339.   	EVP_PKEY *pk;

ssl/s3_both.c:340:2: 
338.   	{
339.   	EVP_PKEY *pk;
340. > 	int ret= -1,i,j;
341.   
342.   	if (pkey == NULL)

ssl/s3_both.c:342:6: Taking true branch
340.   	int ret= -1,i,j;
341.   
342.   	if (pkey == NULL)
            ^
343.   		pk=X509_get_pubkey(x);
344.   	else

ssl/s3_both.c:343:3: 
341.   
342.   	if (pkey == NULL)
343. > 		pk=X509_get_pubkey(x);
344.   	else
345.   		pk=pkey;

crypto/x509/x509_cmp.c:239:1: start of procedure X509_get_pubkey()
  237.   	}
  238.   
  239. > EVP_PKEY *X509_get_pubkey(X509 *x)
  240.   	{
  241.   	if ((x == NULL) || (x->cert_info == NULL))

crypto/x509/x509_cmp.c:241:7: Taking false branch
  239.   EVP_PKEY *X509_get_pubkey(X509 *x)
  240.   	{
  241.   	if ((x == NULL) || (x->cert_info == NULL))
               ^
  242.   		return(NULL);
  243.   	return(X509_PUBKEY_get(x->cert_info->key));

crypto/x509/x509_cmp.c:241:22: Taking true branch
  239.   EVP_PKEY *X509_get_pubkey(X509 *x)
  240.   	{
  241.   	if ((x == NULL) || (x->cert_info == NULL))
                              ^
  242.   		return(NULL);
  243.   	return(X509_PUBKEY_get(x->cert_info->key));

crypto/x509/x509_cmp.c:242:3: 
  240.   	{
  241.   	if ((x == NULL) || (x->cert_info == NULL))
  242. > 		return(NULL);
  243.   	return(X509_PUBKEY_get(x->cert_info->key));
  244.   	}

crypto/x509/x509_cmp.c:244:2: return from a call to X509_get_pubkey
  242.   		return(NULL);
  243.   	return(X509_PUBKEY_get(x->cert_info->key));
  244.   	}
          ^
  245.   
  246.   int X509_check_private_key(X509 *x, EVP_PKEY *k)

ssl/s3_both.c:346:6: Taking true branch
344.   	else
345.   		pk=pkey;
346.   	if (pk == NULL) goto err;
            ^
347.   
348.   	i=pk->type;

ssl/s3_both.c:382:1: 
380.   		ret= -1;
381.   
382. > err:
383.   	if(!pkey) EVP_PKEY_free(pk);
384.   	return(ret);

ssl/s3_both.c:383:6: Taking true branch
381.   
382.   err:
383.   	if(!pkey) EVP_PKEY_free(pk);
            ^
384.   	return(ret);
385.   	}

ssl/s3_both.c:383:12: 
381.   
382.   err:
383. > 	if(!pkey) EVP_PKEY_free(pk);
384.   	return(ret);
385.   	}

crypto/evp/p_lib.c:228:1: start of procedure EVP_PKEY_free()
  226.   	}
  227.   
  228. > void EVP_PKEY_free(EVP_PKEY *x)
  229.   	{
  230.   	int i;

crypto/evp/p_lib.c:232:6: Taking false branch
  230.   	int i;
  231.   
  232.   	if (x == NULL) return;
              ^
  233.   
  234.   	i=CRYPTO_add(&x->references,-1,CRYPTO_LOCK_EVP_PKEY);

crypto/evp/p_lib.c:234:2: 
  232.   	if (x == NULL) return;
  233.   
  234. > 	i=CRYPTO_add(&x->references,-1,CRYPTO_LOCK_EVP_PKEY);
  235.   #ifdef REF_PRINT
  236.   	REF_PRINT("EVP_PKEY",x);

crypto/cryptlib.c:225:1: start of procedure CRYPTO_add_lock()
    223.   	}
    224.   
    225. > int CRYPTO_add_lock(int *pointer, int amount, int type, const char *file,
    226.   	     int line)
    227.   	{

crypto/cryptlib.c:230:6: Taking false branch
    228.   	int ret;
    229.   
    230.   	if (add_lock_callback != NULL)
                ^
    231.   		{
    232.   #ifdef LOCK_DEBUG

crypto/cryptlib.c:248:3: 
    246.   	else
    247.   		{
    248. > 		CRYPTO_lock(CRYPTO_LOCK|CRYPTO_WRITE,type,file,line);
    249.   
    250.   		ret= *pointer+amount;

crypto/cryptlib.c:196:1: start of procedure CRYPTO_lock()
      194.   	}
      195.   
      196. > void CRYPTO_lock(int mode, int type, const char *file, int line)
      197.   	{
      198.   #ifdef LOCK_DEBUG

crypto/cryptlib.c:221:6: Taking false branch
      219.   		}
      220.   #endif
      221.   	if (locking_callback != NULL)
                  ^
      222.   		locking_callback(mode,type,file,line);
      223.   	}

crypto/cryptlib.c:221:2: 
      219.   		}
      220.   #endif
      221. > 	if (locking_callback != NULL)
      222.   		locking_callback(mode,type,file,line);
      223.   	}

crypto/cryptlib.c:223:2: return from a call to CRYPTO_lock
      221.   	if (locking_callback != NULL)
      222.   		locking_callback(mode,type,file,line);
      223.   	}
              ^
      224.   
      225.   int CRYPTO_add_lock(int *pointer, int amount, int type, const char *file,

crypto/cryptlib.c:250:3: 
    248.   		CRYPTO_lock(CRYPTO_LOCK|CRYPTO_WRITE,type,file,line);
    249.   
    250. > 		ret= *pointer+amount;
    251.   #ifdef LOCK_DEBUG
    252.   		fprintf(stderr,"ladd:%08lx:%2d+%2d->%2d %-18s %s:%d\n",
