ssl/s2_clnt.c:941: error: NULL_DEREFERENCE
  pointer `pkey` last assigned on line 882 could be null and is dereferenced by call to `EVP_PKEY_free()` at line 941, column 2.
Showing all 62 steps of the trace


ssl/s2_clnt.c:879:1: start of procedure ssl2_set_certificate()
877.   
878.   /* loads in the certificate from the server */
879. > int ssl2_set_certificate(SSL *s, int type, int len, unsigned char *data)
880.   	{
881.   	STACK_OF(X509) *sk=NULL;

ssl/s2_clnt.c:881:2: 
879.   int ssl2_set_certificate(SSL *s, int type, int len, unsigned char *data)
880.   	{
881. > 	STACK_OF(X509) *sk=NULL;
882.   	EVP_PKEY *pkey=NULL;
883.   	SESS_CERT *sc=NULL;

ssl/s2_clnt.c:882:2: 
880.   	{
881.   	STACK_OF(X509) *sk=NULL;
882. > 	EVP_PKEY *pkey=NULL;
883.   	SESS_CERT *sc=NULL;
884.   	int i;

ssl/s2_clnt.c:883:2: 
881.   	STACK_OF(X509) *sk=NULL;
882.   	EVP_PKEY *pkey=NULL;
883. > 	SESS_CERT *sc=NULL;
884.   	int i;
885.   	X509 *x509=NULL;

ssl/s2_clnt.c:885:2: 
883.   	SESS_CERT *sc=NULL;
884.   	int i;
885. > 	X509 *x509=NULL;
886.   	int ret=0;
887.   	

ssl/s2_clnt.c:886:2: 
884.   	int i;
885.   	X509 *x509=NULL;
886. > 	int ret=0;
887.   	
888.   	x509=d2i_X509(NULL,&data,(long)len);

ssl/s2_clnt.c:888:2: Skipping d2i_X509(): empty list of specs
886.   	int ret=0;
887.   	
888.   	x509=d2i_X509(NULL,&data,(long)len);
        ^
889.   	if (x509 == NULL)
890.   		{

ssl/s2_clnt.c:889:6: Taking false branch
887.   	
888.   	x509=d2i_X509(NULL,&data,(long)len);
889.   	if (x509 == NULL)
            ^
890.   		{
891.   		SSLerr(SSL_F_SSL2_SET_CERTIFICATE,ERR_R_X509_LIB);

ssl/s2_clnt.c:895:6: 
893.   		}
894.   
895. > 	if ((sk=sk_X509_new_null()) == NULL || !sk_X509_push(sk,x509))
896.   		{
897.   		SSLerr(SSL_F_SSL2_SET_CERTIFICATE,ERR_R_MALLOC_FAILURE);

crypto/x509/x509_vfy.c:786:1: start of procedure sk_X509_new_null()
  784.   
  785.   
  786. > IMPLEMENT_STACK_OF(X509)
  787.   IMPLEMENT_ASN1_SET_OF(X509)
  788.   

crypto/x509/x509_vfy.c:786:1: return from a call to sk_X509_new_null
  784.   
  785.   
  786. > IMPLEMENT_STACK_OF(X509)
  787.   IMPLEMENT_ASN1_SET_OF(X509)
  788.   

ssl/s2_clnt.c:895:6: Taking true branch
893.   		}
894.   
895.   	if ((sk=sk_X509_new_null()) == NULL || !sk_X509_push(sk,x509))
            ^
896.   		{
897.   		SSLerr(SSL_F_SSL2_SET_CERTIFICATE,ERR_R_MALLOC_FAILURE);

ssl/s2_clnt.c:897:3: 
895.   	if ((sk=sk_X509_new_null()) == NULL || !sk_X509_push(sk,x509))
896.   		{
897. > 		SSLerr(SSL_F_SSL2_SET_CERTIFICATE,ERR_R_MALLOC_FAILURE);
898.   		goto err;
899.   		}

crypto/err/err.c:245:1: start of procedure ERR_put_error()
  243.   /********************************************************/
  244.   
  245. > void ERR_put_error(int lib, int func, int reason, const char *file,
  246.   	     int line)
  247.   	{

crypto/err/err.c:269:2: Skipping ERR_get_state(): empty list of specs
  267.   	}
  268.   #endif
  269.   	es=ERR_get_state();
          ^
  270.   
  271.   	es->top=(es->top+1)%ERR_NUM_ERRORS;

crypto/err/err.c:271:2: 
  269.   	es=ERR_get_state();
  270.   
  271. > 	es->top=(es->top+1)%ERR_NUM_ERRORS;
  272.   	if (es->top == es->bottom)
  273.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;

crypto/err/err.c:272:6: Taking false branch
  270.   
  271.   	es->top=(es->top+1)%ERR_NUM_ERRORS;
  272.   	if (es->top == es->bottom)
              ^
  273.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
  274.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);

crypto/err/err.c:274:2: 
  272.   	if (es->top == es->bottom)
  273.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
  274. > 	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
  275.   	es->err_file[es->top]=file;
  276.   	es->err_line[es->top]=line;

crypto/err/err.c:275:2: 
  273.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
  274.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
  275. > 	es->err_file[es->top]=file;
  276.   	es->err_line[es->top]=line;
  277.   	err_clear_data(es,es->top);

crypto/err/err.c:276:2: 
  274.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
  275.   	es->err_file[es->top]=file;
  276. > 	es->err_line[es->top]=line;
  277.   	err_clear_data(es,es->top);
  278.   	}

crypto/err/err.c:277:2: Taking true branch
  275.   	es->err_file[es->top]=file;
  276.   	es->err_line[es->top]=line;
  277.   	err_clear_data(es,es->top);
          ^
  278.   	}
  279.   

crypto/err/err.c:277:2: Taking false branch
  275.   	es->err_file[es->top]=file;
  276.   	es->err_line[es->top]=line;
  277.   	err_clear_data(es,es->top);
          ^
  278.   	}
  279.   

crypto/err/err.c:278:2: return from a call to ERR_put_error
  276.   	es->err_line[es->top]=line;
  277.   	err_clear_data(es,es->top);
  278.   	}
          ^
  279.   
  280.   void ERR_clear_error(void)

ssl/s2_clnt.c:938:1: 
936.   		goto err;
937.   	ret=1;
938. > err:
939.   	sk_X509_free(sk);
940.   	X509_free(x509);

ssl/s2_clnt.c:939:2: 
937.   	ret=1;
938.   err:
939. > 	sk_X509_free(sk);
940.   	X509_free(x509);
941.   	EVP_PKEY_free(pkey);

crypto/x509/x509_vfy.c:786:1: start of procedure sk_X509_free()
  784.   
  785.   
  786. > IMPLEMENT_STACK_OF(X509)
  787.   IMPLEMENT_ASN1_SET_OF(X509)
  788.   

crypto/stack/stack.c:276:1: start of procedure sk_free()
    274.   	}
    275.   
    276. > void sk_free(STACK *st)
    277.   	{
    278.   	if (st == NULL) return;

crypto/stack/stack.c:278:6: Taking true branch
    276.   void sk_free(STACK *st)
    277.   	{
    278.   	if (st == NULL) return;
                ^
    279.   	if (st->data != NULL) Free((char *)st->data);
    280.   	Free((char *)st);

crypto/stack/stack.c:278:18: 
    276.   void sk_free(STACK *st)
    277.   	{
    278. > 	if (st == NULL) return;
    279.   	if (st->data != NULL) Free((char *)st->data);
    280.   	Free((char *)st);

crypto/stack/stack.c:281:2: return from a call to sk_free
    279.   	if (st->data != NULL) Free((char *)st->data);
    280.   	Free((char *)st);
    281.   	}
            ^
    282.   
    283.   int sk_num(STACK *st)

crypto/x509/x509_vfy.c:786:1: return from a call to sk_X509_free
  784.   
  785.   
  786. > IMPLEMENT_STACK_OF(X509)
  787.   IMPLEMENT_ASN1_SET_OF(X509)
  788.   

ssl/s2_clnt.c:940:2: 
938.   err:
939.   	sk_X509_free(sk);
940. > 	X509_free(x509);
941.   	EVP_PKEY_free(pkey);
942.   	return(ret);

crypto/asn1/x_x509.c:130:1: start of procedure X509_free()
  128.   	}
  129.   
  130. > void X509_free(X509 *a)
  131.   	{
  132.   	int i;

crypto/asn1/x_x509.c:134:6: Taking false branch
  132.   	int i;
  133.   
  134.   	if (a == NULL) return;
              ^
  135.   
  136.   	i=CRYPTO_add(&a->references,-1,CRYPTO_LOCK_X509);

crypto/asn1/x_x509.c:136:2: 
  134.   	if (a == NULL) return;
  135.   
  136. > 	i=CRYPTO_add(&a->references,-1,CRYPTO_LOCK_X509);
  137.   #ifdef REF_PRINT
  138.   	REF_PRINT("X509",a);

crypto/cryptlib.c:226:1: start of procedure CRYPTO_add_lock()
    224.   	}
    225.   
    226. > int CRYPTO_add_lock(int *pointer, int amount, int type, const char *file,
    227.   	     int line)
    228.   	{

crypto/cryptlib.c:231:6: Taking false branch
    229.   	int ret;
    230.   
    231.   	if (add_lock_callback != NULL)
                ^
    232.   		{
    233.   #ifdef LOCK_DEBUG

crypto/cryptlib.c:249:3: 
    247.   	else
    248.   		{
    249. > 		CRYPTO_lock(CRYPTO_LOCK|CRYPTO_WRITE,type,file,line);
    250.   
    251.   		ret= *pointer+amount;

crypto/cryptlib.c:197:1: start of procedure CRYPTO_lock()
      195.   	}
      196.   
      197. > void CRYPTO_lock(int mode, int type, const char *file, int line)
      198.   	{
      199.   #ifdef LOCK_DEBUG

crypto/cryptlib.c:222:6: Taking false branch
      220.   		}
      221.   #endif
      222.   	if (locking_callback != NULL)
                  ^
      223.   		locking_callback(mode,type,file,line);
      224.   	}

crypto/cryptlib.c:222:2: 
      220.   		}
      221.   #endif
      222. > 	if (locking_callback != NULL)
      223.   		locking_callback(mode,type,file,line);
      224.   	}

crypto/cryptlib.c:224:2: return from a call to CRYPTO_lock
      222.   	if (locking_callback != NULL)
      223.   		locking_callback(mode,type,file,line);
      224.   	}
              ^
      225.   
      226.   int CRYPTO_add_lock(int *pointer, int amount, int type, const char *file,

crypto/cryptlib.c:251:3: 
    249.   		CRYPTO_lock(CRYPTO_LOCK|CRYPTO_WRITE,type,file,line);
    250.   
    251. > 		ret= *pointer+amount;
    252.   #ifdef LOCK_DEBUG
    253.   		fprintf(stderr,"ladd:%08lx:%2d+%2d->%2d %-18s %s:%d\n",

crypto/cryptlib.c:259:3: 
    257.   			file,line);
    258.   #endif
    259. > 		*pointer=ret;
    260.   		CRYPTO_lock(CRYPTO_UNLOCK|CRYPTO_WRITE,type,file,line);
    261.   		}

crypto/cryptlib.c:260:3: 
    258.   #endif
    259.   		*pointer=ret;
    260. > 		CRYPTO_lock(CRYPTO_UNLOCK|CRYPTO_WRITE,type,file,line);
    261.   		}
    262.   	return(ret);

crypto/cryptlib.c:197:1: start of procedure CRYPTO_lock()
      195.   	}
      196.   
      197. > void CRYPTO_lock(int mode, int type, const char *file, int line)
      198.   	{
      199.   #ifdef LOCK_DEBUG

crypto/cryptlib.c:222:6: Taking false branch
      220.   		}
      221.   #endif
      222.   	if (locking_callback != NULL)
                  ^
      223.   		locking_callback(mode,type,file,line);
      224.   	}

crypto/cryptlib.c:222:2: 
      220.   		}
      221.   #endif
      222. > 	if (locking_callback != NULL)
      223.   		locking_callback(mode,type,file,line);
      224.   	}

crypto/cryptlib.c:224:2: return from a call to CRYPTO_lock
      222.   	if (locking_callback != NULL)
      223.   		locking_callback(mode,type,file,line);
      224.   	}
              ^
      225.   
      226.   int CRYPTO_add_lock(int *pointer, int amount, int type, const char *file,

crypto/cryptlib.c:262:2: 
    260.   		CRYPTO_lock(CRYPTO_UNLOCK|CRYPTO_WRITE,type,file,line);
    261.   		}
    262. > 	return(ret);
    263.   	}
    264.   

crypto/cryptlib.c:263:2: return from a call to CRYPTO_add_lock
    261.   		}
    262.   	return(ret);
    263.   	}
            ^
    264.   
    265.   const char *CRYPTO_get_lock_name(int type)

crypto/asn1/x_x509.c:140:6: Taking true branch
  138.   	REF_PRINT("X509",a);
  139.   #endif
  140.   	if (i > 0) return;
              ^
  141.   #ifdef REF_CHECK
  142.   	if (i < 0)

crypto/asn1/x_x509.c:140:13: 
  138.   	REF_PRINT("X509",a);
  139.   #endif
  140. > 	if (i > 0) return;
  141.   #ifdef REF_CHECK
  142.   	if (i < 0)

crypto/asn1/x_x509.c:157:2: return from a call to X509_free
  155.   	if (a->name != NULL) Free(a->name);
  156.   	Free((char *)a);
  157.   	}
          ^
  158.   
  159.   int X509_get_ex_new_index(long argl, char *argp, int (*new_func)(),

ssl/s2_clnt.c:941:2: 
939.   	sk_X509_free(sk);
940.   	X509_free(x509);
941. > 	EVP_PKEY_free(pkey);
942.   	return(ret);
943.   	}

crypto/evp/p_lib.c:286:1: start of procedure EVP_PKEY_free()
  284.   	}
  285.   
  286. > void EVP_PKEY_free(EVP_PKEY *x)
  287.   	{
  288.   	int i;

crypto/evp/p_lib.c:290:6: Taking false branch
  288.   	int i;
  289.   
  290.   	if (x == NULL) return;
              ^
  291.   
  292.   	i=CRYPTO_add(&x->references,-1,CRYPTO_LOCK_EVP_PKEY);

crypto/evp/p_lib.c:292:2: 
  290.   	if (x == NULL) return;
  291.   
  292. > 	i=CRYPTO_add(&x->references,-1,CRYPTO_LOCK_EVP_PKEY);
  293.   #ifdef REF_PRINT
  294.   	REF_PRINT("EVP_PKEY",x);

crypto/cryptlib.c:226:1: start of procedure CRYPTO_add_lock()
    224.   	}
    225.   
    226. > int CRYPTO_add_lock(int *pointer, int amount, int type, const char *file,
    227.   	     int line)
    228.   	{

crypto/cryptlib.c:231:6: Taking true branch
    229.   	int ret;
    230.   
    231.   	if (add_lock_callback != NULL)
                ^
    232.   		{
    233.   #ifdef LOCK_DEBUG

crypto/cryptlib.c:237:3: Skipping __function_pointer__(): unresolved function pointer
    235.   #endif
    236.   
    237.   		ret=add_lock_callback(pointer,amount,type,file,line);
             ^
    238.   #ifdef LOCK_DEBUG
    239.   		fprintf(stderr,"ladd:%08lx:%2d+%2d->%2d %-18s %s:%d\n",

crypto/cryptlib.c:245:3: 
    243.   			file,line);
    244.   #endif
    245. > 		*pointer=ret;
    246.   		}
    247.   	else
