ssl/s3_srvr.c:2091: error: NULL_DEREFERENCE
  pointer `clnt_pub_pkey` last assigned on line 1600 could be null and is dereferenced by call to `EVP_PKEY_free()` at line 2091, column 2.
Showing all 36 steps of the trace


ssl/s3_srvr.c:1580:1: start of procedure ssl3_get_client_key_exchange()
1578.   	}
1579.   
1580. > static int ssl3_get_client_key_exchange(SSL *s)
1581.   	{
1582.   	int i,al,ok;

ssl/s3_srvr.c:1587:2: 
1585.   	unsigned char *p;
1586.   #ifndef OPENSSL_NO_RSA
1587. > 	RSA *rsa=NULL;
1588.   	EVP_PKEY *pkey=NULL;
1589.   #endif

ssl/s3_srvr.c:1588:2: 
1586.   #ifndef OPENSSL_NO_RSA
1587.   	RSA *rsa=NULL;
1588. > 	EVP_PKEY *pkey=NULL;
1589.   #endif
1590.   #ifndef OPENSSL_NO_DH

ssl/s3_srvr.c:1591:2: 
1589.   #endif
1590.   #ifndef OPENSSL_NO_DH
1591. > 	BIGNUM *pub=NULL;
1592.   	DH *dh_srvr;
1593.   #endif

ssl/s3_srvr.c:1599:2: 
1597.   
1598.   #ifndef OPENSSL_NO_ECDH
1599. > 	EC_KEY *srvr_ecdh = NULL;
1600.   	EVP_PKEY *clnt_pub_pkey = NULL;
1601.   	EC_POINT *clnt_ecpoint = NULL;

ssl/s3_srvr.c:1600:2: 
1598.   #ifndef OPENSSL_NO_ECDH
1599.   	EC_KEY *srvr_ecdh = NULL;
1600. > 	EVP_PKEY *clnt_pub_pkey = NULL;
1601.   	EC_POINT *clnt_ecpoint = NULL;
1602.   	BN_CTX *bn_ctx = NULL; 

ssl/s3_srvr.c:1601:2: 
1599.   	EC_KEY *srvr_ecdh = NULL;
1600.   	EVP_PKEY *clnt_pub_pkey = NULL;
1601. > 	EC_POINT *clnt_ecpoint = NULL;
1602.   	BN_CTX *bn_ctx = NULL; 
1603.   #endif

ssl/s3_srvr.c:1602:2: 
1600.   	EVP_PKEY *clnt_pub_pkey = NULL;
1601.   	EC_POINT *clnt_ecpoint = NULL;
1602. > 	BN_CTX *bn_ctx = NULL; 
1603.   #endif
1604.   

ssl/s3_srvr.c:1605:2: Skipping ssl3_get_message(): empty list of specs
1603.   #endif
1604.   
1605.   	n=ssl3_get_message(s,
         ^
1606.   		SSL3_ST_SR_KEY_EXCH_A,
1607.   		SSL3_ST_SR_KEY_EXCH_B,

ssl/s3_srvr.c:1612:7: Taking false branch
1610.   		&ok);
1611.   
1612.   	if (!ok) return((int)n);
              ^
1613.   	p=(unsigned char *)s->init_msg;
1614.   

ssl/s3_srvr.c:1613:2: 
1611.   
1612.   	if (!ok) return((int)n);
1613. > 	p=(unsigned char *)s->init_msg;
1614.   
1615.   	l=s->s3->tmp.new_cipher->algorithms;

ssl/s3_srvr.c:1615:2: 
1613.   	p=(unsigned char *)s->init_msg;
1614.   
1615. > 	l=s->s3->tmp.new_cipher->algorithms;
1616.   
1617.   #ifndef OPENSSL_NO_RSA

ssl/s3_srvr.c:1618:6: Taking true branch
1616.   
1617.   #ifndef OPENSSL_NO_RSA
1618.   	if (l & SSL_kRSA)
             ^
1619.   		{
1620.   		/* FIX THIS UP EAY EAY EAY EAY */

ssl/s3_srvr.c:1621:7: Taking false branch
1619.   		{
1620.   		/* FIX THIS UP EAY EAY EAY EAY */
1621.   		if (s->s3->tmp.use_rsa_tmp)
              ^
1622.   			{
1623.   			if ((s->cert != NULL) && (s->cert->rsa_tmp != NULL))

ssl/s3_srvr.c:1637:4: 
1635.   		else
1636.   			{
1637. > 			pkey=s->cert->pkeys[SSL_PKEY_RSA_ENC].privatekey;
1638.   			if (	(pkey == NULL) ||
1639.   				(pkey->type != EVP_PKEY_RSA) ||

ssl/s3_srvr.c:1638:10: Taking false branch
1636.   			{
1637.   			pkey=s->cert->pkeys[SSL_PKEY_RSA_ENC].privatekey;
1638.   			if (	(pkey == NULL) ||
                 ^
1639.   				(pkey->type != EVP_PKEY_RSA) ||
1640.   				(pkey->pkey.rsa == NULL))

ssl/s3_srvr.c:1639:6: Taking false branch
1637.   			pkey=s->cert->pkeys[SSL_PKEY_RSA_ENC].privatekey;
1638.   			if (	(pkey == NULL) ||
1639.   				(pkey->type != EVP_PKEY_RSA) ||
             ^
1640.   				(pkey->pkey.rsa == NULL))
1641.   				{

ssl/s3_srvr.c:1640:6: Taking false branch
1638.   			if (	(pkey == NULL) ||
1639.   				(pkey->type != EVP_PKEY_RSA) ||
1640.   				(pkey->pkey.rsa == NULL))
             ^
1641.   				{
1642.   				al=SSL_AD_HANDSHAKE_FAILURE;

ssl/s3_srvr.c:1646:4: 
1644.   				goto f_err;
1645.   				}
1646. > 			rsa=pkey->pkey.rsa;
1647.   			}
1648.   

ssl/s3_srvr.c:1650:7: Taking true branch
1648.   
1649.   		/* TLS */
1650.   		if (s->version > SSL3_VERSION)
              ^
1651.   			{
1652.   			n2s(p,i);

ssl/s3_srvr.c:1652:4: 
1650.   		if (s->version > SSL3_VERSION)
1651.   			{
1652. > 			n2s(p,i);
1653.   			if (n != i+2)
1654.   				{

ssl/s3_srvr.c:1653:8: Taking true branch
1651.   			{
1652.   			n2s(p,i);
1653.   			if (n != i+2)
               ^
1654.   				{
1655.   				if (!(s->options & SSL_OP_TLS_D5_BUG))

ssl/s3_srvr.c:1655:11: Taking true branch
1653.   			if (n != i+2)
1654.   				{
1655.   				if (!(s->options & SSL_OP_TLS_D5_BUG))
                  ^
1656.   					{
1657.   					SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,SSL_R_TLS_RSA_ENCRYPTED_VALUE_LENGTH_IS_WRONG);

ssl/s3_srvr.c:1657:6: 
1655.   				if (!(s->options & SSL_OP_TLS_D5_BUG))
1656.   					{
1657. > 					SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,SSL_R_TLS_RSA_ENCRYPTED_VALUE_LENGTH_IS_WRONG);
1658.   					goto err;
1659.   					}

crypto/err/err.c:617:1: start of procedure ERR_put_error()
  615.   /********************************************************/
  616.   
  617. > void ERR_put_error(int lib, int func, int reason, const char *file,
  618.   	     int line)
  619.   	{

crypto/err/err.c:641:2: Skipping ERR_get_state(): empty list of specs
  639.   	}
  640.   #endif
  641.   	es=ERR_get_state();
          ^
  642.   
  643.   	es->top=(es->top+1)%ERR_NUM_ERRORS;

crypto/err/err.c:643:2: 
  641.   	es=ERR_get_state();
  642.   
  643. > 	es->top=(es->top+1)%ERR_NUM_ERRORS;
  644.   	if (es->top == es->bottom)
  645.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;

crypto/err/err.c:644:6: Taking false branch
  642.   
  643.   	es->top=(es->top+1)%ERR_NUM_ERRORS;
  644.   	if (es->top == es->bottom)
              ^
  645.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
  646.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);

crypto/err/err.c:646:2: 
  644.   	if (es->top == es->bottom)
  645.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
  646. > 	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
  647.   	es->err_file[es->top]=file;
  648.   	es->err_line[es->top]=line;

crypto/err/err.c:647:2: 
  645.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
  646.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
  647. > 	es->err_file[es->top]=file;
  648.   	es->err_line[es->top]=line;
  649.   	err_clear_data(es,es->top);

crypto/err/err.c:648:2: 
  646.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
  647.   	es->err_file[es->top]=file;
  648. > 	es->err_line[es->top]=line;
  649.   	err_clear_data(es,es->top);
  650.   	}

crypto/err/err.c:649:2: Taking true branch
  647.   	es->err_file[es->top]=file;
  648.   	es->err_line[es->top]=line;
  649.   	err_clear_data(es,es->top);
          ^
  650.   	}
  651.   

crypto/err/err.c:649:2: Taking false branch
  647.   	es->err_file[es->top]=file;
  648.   	es->err_line[es->top]=line;
  649.   	err_clear_data(es,es->top);
          ^
  650.   	}
  651.   

crypto/err/err.c:650:2: return from a call to ERR_put_error
  648.   	es->err_line[es->top]=line;
  649.   	err_clear_data(es,es->top);
  650.   	}
          ^
  651.   
  652.   void ERR_clear_error(void)

ssl/s3_srvr.c:2088:1: 
2086.   	ssl3_send_alert(s,SSL3_AL_FATAL,al);
2087.   #if !defined(OPENSSL_NO_DH) || !defined(OPENSSL_NO_RSA) || !defined(OPENSSL_NO_ECDH)
2088. > err:
2089.   #endif
2090.   #ifndef OPENSSL_NO_ECDH

ssl/s3_srvr.c:2091:2: 
2089.   #endif
2090.   #ifndef OPENSSL_NO_ECDH
2091. > 	EVP_PKEY_free(clnt_pub_pkey);
2092.   	EC_POINT_free(clnt_ecpoint);
2093.   	if (srvr_ecdh != NULL) 
