ssl/s3_srvr.c:1535: error: NULL_DEREFERENCE
  pointer `pkey` last assigned on line 1422 could be null and is dereferenced by call to `EVP_PKEY_free()` at line 1535, column 2.
Showing all 61 steps of the trace


ssl/s3_srvr.c:1401:1: start of procedure ssl3_get_cert_verify()
1399.   	}
1400.   
1401. > static int ssl3_get_cert_verify(SSL *s)
1402.   	{
1403.   	EVP_PKEY *pkey=NULL;

ssl/s3_srvr.c:1403:2: 
1401.   static int ssl3_get_cert_verify(SSL *s)
1402.   	{
1403. > 	EVP_PKEY *pkey=NULL;
1404.   	unsigned char *p;
1405.   	int al,ok,ret=0;

ssl/s3_srvr.c:1405:2: 
1403.   	EVP_PKEY *pkey=NULL;
1404.   	unsigned char *p;
1405. > 	int al,ok,ret=0;
1406.   	long n;
1407.   	int type=0,i,j;

ssl/s3_srvr.c:1407:2: 
1405.   	int al,ok,ret=0;
1406.   	long n;
1407. > 	int type=0,i,j;
1408.   	X509 *peer;
1409.   

ssl/s3_srvr.c:1410:2: Skipping ssl3_get_message(): empty list of specs
1408.   	X509 *peer;
1409.   
1410.   	n=ssl3_get_message(s,
         ^
1411.   		SSL3_ST_SR_CERT_VRFY_A,
1412.   		SSL3_ST_SR_CERT_VRFY_B,

ssl/s3_srvr.c:1417:7: Taking false branch
1415.   		&ok);
1416.   
1417.   	if (!ok) return((int)n);
              ^
1418.   
1419.   	if (s->session->peer != NULL)

ssl/s3_srvr.c:1419:6: Taking true branch
1417.   	if (!ok) return((int)n);
1418.   
1419.   	if (s->session->peer != NULL)
             ^
1420.   		{
1421.   		peer=s->session->peer;

ssl/s3_srvr.c:1421:3: 
1419.   	if (s->session->peer != NULL)
1420.   		{
1421. > 		peer=s->session->peer;
1422.   		pkey=X509_get_pubkey(peer);
1423.   		type=X509_certificate_type(peer,pkey);

ssl/s3_srvr.c:1422:3: 
1420.   		{
1421.   		peer=s->session->peer;
1422. > 		pkey=X509_get_pubkey(peer);
1423.   		type=X509_certificate_type(peer,pkey);
1424.   		}

crypto/x509/x509_cmp.c:254:1: start of procedure X509_get_pubkey()
  252.   	}
  253.   
  254. > EVP_PKEY *X509_get_pubkey(X509 *x)
  255.   	{
  256.   	if ((x == NULL) || (x->cert_info == NULL))

crypto/x509/x509_cmp.c:256:7: Taking false branch
  254.   EVP_PKEY *X509_get_pubkey(X509 *x)
  255.   	{
  256.   	if ((x == NULL) || (x->cert_info == NULL))
               ^
  257.   		return(NULL);
  258.   	return(X509_PUBKEY_get(x->cert_info->key));

crypto/x509/x509_cmp.c:256:22: Taking true branch
  254.   EVP_PKEY *X509_get_pubkey(X509 *x)
  255.   	{
  256.   	if ((x == NULL) || (x->cert_info == NULL))
                              ^
  257.   		return(NULL);
  258.   	return(X509_PUBKEY_get(x->cert_info->key));

crypto/x509/x509_cmp.c:257:3: 
  255.   	{
  256.   	if ((x == NULL) || (x->cert_info == NULL))
  257. > 		return(NULL);
  258.   	return(X509_PUBKEY_get(x->cert_info->key));
  259.   	}

crypto/x509/x509_cmp.c:259:2: return from a call to X509_get_pubkey
  257.   		return(NULL);
  258.   	return(X509_PUBKEY_get(x->cert_info->key));
  259.   	}
          ^
  260.   
  261.   int X509_check_private_key(X509 *x, EVP_PKEY *k)

ssl/s3_srvr.c:1423:3: Skipping X509_certificate_type(): empty list of specs
1421.   		peer=s->session->peer;
1422.   		pkey=X509_get_pubkey(peer);
1423.   		type=X509_certificate_type(peer,pkey);
          ^
1424.   		}
1425.   	else

ssl/s3_srvr.c:1431:6: Taking false branch
1429.   		}
1430.   
1431.   	if (s->s3->tmp.message_type != SSL3_MT_CERTIFICATE_VERIFY)
             ^
1432.   		{
1433.   		s->s3->tmp.reuse_message=1;

ssl/s3_srvr.c:1444:6: Taking false branch
1442.   		}
1443.   
1444.   	if (peer == NULL)
             ^
1445.   		{
1446.   		SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_NO_CLIENT_CERT_RECEIVED);

ssl/s3_srvr.c:1451:8: Taking false branch
1449.   		}
1450.   
1451.   	if (!(type & EVP_PKT_SIGN))
               ^
1452.   		{
1453.   		SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_SIGNATURE_FOR_NON_SIGNING_CERTIFICATE);

ssl/s3_srvr.c:1458:6: Taking false branch
1456.   		}
1457.   
1458.   	if (s->s3->change_cipher_spec)
             ^
1459.   		{
1460.   		SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_CCS_RECEIVED_EARLY);

ssl/s3_srvr.c:1466:2: 
1464.   
1465.   	/* we now have a signature that we need to verify */
1466. > 	p=(unsigned char *)s->init_buf->data;
1467.   	n2s(p,i);
1468.   	n-=2;

ssl/s3_srvr.c:1467:2: 
1465.   	/* we now have a signature that we need to verify */
1466.   	p=(unsigned char *)s->init_buf->data;
1467. > 	n2s(p,i);
1468.   	n-=2;
1469.   	if (i > n)

ssl/s3_srvr.c:1468:2: 
1466.   	p=(unsigned char *)s->init_buf->data;
1467.   	n2s(p,i);
1468. > 	n-=2;
1469.   	if (i > n)
1470.   		{

ssl/s3_srvr.c:1469:6: Taking true branch
1467.   	n2s(p,i);
1468.   	n-=2;
1469.   	if (i > n)
             ^
1470.   		{
1471.   		SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_LENGTH_MISMATCH);

ssl/s3_srvr.c:1471:3: 
1469.   	if (i > n)
1470.   		{
1471. > 		SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_LENGTH_MISMATCH);
1472.   		al=SSL_AD_DECODE_ERROR;
1473.   		goto f_err;

crypto/err/err.c:246:1: start of procedure ERR_put_error()
  244.   /********************************************************/
  245.   
  246. > void ERR_put_error(int lib, int func, int reason, const char *file,
  247.   	     int line)
  248.   	{

crypto/err/err.c:270:2: Skipping ERR_get_state(): empty list of specs
  268.   	}
  269.   #endif
  270.   	es=ERR_get_state();
          ^
  271.   
  272.   	es->top=(es->top+1)%ERR_NUM_ERRORS;

crypto/err/err.c:272:2: 
  270.   	es=ERR_get_state();
  271.   
  272. > 	es->top=(es->top+1)%ERR_NUM_ERRORS;
  273.   	if (es->top == es->bottom)
  274.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;

crypto/err/err.c:273:6: Taking false branch
  271.   
  272.   	es->top=(es->top+1)%ERR_NUM_ERRORS;
  273.   	if (es->top == es->bottom)
              ^
  274.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
  275.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);

crypto/err/err.c:275:2: 
  273.   	if (es->top == es->bottom)
  274.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
  275. > 	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
  276.   	es->err_file[es->top]=file;
  277.   	es->err_line[es->top]=line;

crypto/err/err.c:276:2: 
  274.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
  275.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
  276. > 	es->err_file[es->top]=file;
  277.   	es->err_line[es->top]=line;
  278.   	err_clear_data(es,es->top);

crypto/err/err.c:277:2: 
  275.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
  276.   	es->err_file[es->top]=file;
  277. > 	es->err_line[es->top]=line;
  278.   	err_clear_data(es,es->top);
  279.   	}

crypto/err/err.c:278:2: Taking true branch
  276.   	es->err_file[es->top]=file;
  277.   	es->err_line[es->top]=line;
  278.   	err_clear_data(es,es->top);
          ^
  279.   	}
  280.   

crypto/err/err.c:278:2: Taking false branch
  276.   	es->err_file[es->top]=file;
  277.   	es->err_line[es->top]=line;
  278.   	err_clear_data(es,es->top);
          ^
  279.   	}
  280.   

crypto/err/err.c:279:2: return from a call to ERR_put_error
  277.   	es->err_line[es->top]=line;
  278.   	err_clear_data(es,es->top);
  279.   	}
          ^
  280.   
  281.   void ERR_clear_error(void)

ssl/s3_srvr.c:1472:3: 
1470.   		{
1471.   		SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_LENGTH_MISMATCH);
1472. > 		al=SSL_AD_DECODE_ERROR;
1473.   		goto f_err;
1474.   		}

ssl/s3_srvr.c:1531:1: 
1529.   	if (0)
1530.   		{
1531. > f_err:
1532.   		ssl3_send_alert(s,SSL3_AL_FATAL,al);
1533.   		}

ssl/s3_srvr.c:1532:3: 
1530.   		{
1531.   f_err:
1532. > 		ssl3_send_alert(s,SSL3_AL_FATAL,al);
1533.   		}
1534.   end:

ssl/s3_pkt.c:1037:1: start of procedure ssl3_send_alert()
  1035.   	}
  1036.   
  1037. > void ssl3_send_alert(SSL *s, int level, int desc)
  1038.   	{
  1039.   	/* Map tls/ssl alert value to correct one */

ssl/s3_pkt.c:1040:2: Skipping __function_pointer__(): unresolved function pointer
  1038.   	{
  1039.   	/* Map tls/ssl alert value to correct one */
  1040.   	desc=s->method->ssl3_enc->alert_value(desc);
           ^
  1041.   	if (desc < 0) return;
  1042.   	/* If a fatal one, remove from cache */

ssl/s3_pkt.c:1041:6: Taking false branch
  1039.   	/* Map tls/ssl alert value to correct one */
  1040.   	desc=s->method->ssl3_enc->alert_value(desc);
  1041.   	if (desc < 0) return;
               ^
  1042.   	/* If a fatal one, remove from cache */
  1043.   	if ((level == 2) && (s->session != NULL))

ssl/s3_pkt.c:1043:7: Taking true branch
  1041.   	if (desc < 0) return;
  1042.   	/* If a fatal one, remove from cache */
  1043.   	if ((level == 2) && (s->session != NULL))
                ^
  1044.   		SSL_CTX_remove_session(s->ctx,s->session);
  1045.   

ssl/s3_pkt.c:1043:23: Taking true branch
  1041.   	if (desc < 0) return;
  1042.   	/* If a fatal one, remove from cache */
  1043.   	if ((level == 2) && (s->session != NULL))
                                ^
  1044.   		SSL_CTX_remove_session(s->ctx,s->session);
  1045.   

ssl/s3_pkt.c:1044:3: 
  1042.   	/* If a fatal one, remove from cache */
  1043.   	if ((level == 2) && (s->session != NULL))
  1044. > 		SSL_CTX_remove_session(s->ctx,s->session);
  1045.   
  1046.   	s->s3->alert_dispatch=1;

ssl/ssl_sess.c:414:1: start of procedure SSL_CTX_remove_session()
    412.   	}
    413.   
    414. > int SSL_CTX_remove_session(SSL_CTX *ctx, SSL_SESSION *c)
    415.   {
    416.   	return remove_session_lock(ctx, c, 1);

ssl/ssl_sess.c:416:2: 
    414.   int SSL_CTX_remove_session(SSL_CTX *ctx, SSL_SESSION *c)
    415.   {
    416. > 	return remove_session_lock(ctx, c, 1);
    417.   }
    418.   

ssl/ssl_sess.c:419:1: start of procedure remove_session_lock()
      417.   }
      418.   
      419. > static int remove_session_lock(SSL_CTX *ctx, SSL_SESSION *c, int lck)
      420.   	{
      421.   	SSL_SESSION *r;

ssl/ssl_sess.c:422:2: 
      420.   	{
      421.   	SSL_SESSION *r;
      422. > 	int ret=0;
      423.   
      424.   	if ((c != NULL) && (c->session_id_length != 0))

ssl/ssl_sess.c:424:7: Taking true branch
      422.   	int ret=0;
      423.   
      424.   	if ((c != NULL) && (c->session_id_length != 0))
                   ^
      425.   		{
      426.   		if(lck) CRYPTO_w_lock(CRYPTO_LOCK_SSL_CTX);

ssl/ssl_sess.c:424:22: Taking false branch
      422.   	int ret=0;
      423.   
      424.   	if ((c != NULL) && (c->session_id_length != 0))
                                  ^
      425.   		{
      426.   		if(lck) CRYPTO_w_lock(CRYPTO_LOCK_SSL_CTX);

ssl/ssl_sess.c:445:3: 
      443.   		}
      444.   	else
      445. > 		ret=0;
      446.   	return(ret);
      447.   	}

ssl/ssl_sess.c:446:2: 
      444.   	else
      445.   		ret=0;
      446. > 	return(ret);
      447.   	}
      448.   

ssl/ssl_sess.c:447:2: return from a call to remove_session_lock
      445.   		ret=0;
      446.   	return(ret);
      447.   	}
              ^
      448.   
      449.   void SSL_SESSION_free(SSL_SESSION *ss)

ssl/ssl_sess.c:417:1: return from a call to SSL_CTX_remove_session
    415.   {
    416.   	return remove_session_lock(ctx, c, 1);
    417. > }
    418.   
    419.   static int remove_session_lock(SSL_CTX *ctx, SSL_SESSION *c, int lck)

ssl/s3_pkt.c:1046:2: 
  1044.   		SSL_CTX_remove_session(s->ctx,s->session);
  1045.   
  1046. > 	s->s3->alert_dispatch=1;
  1047.   	s->s3->send_alert[0]=level;
  1048.   	s->s3->send_alert[1]=desc;

ssl/s3_pkt.c:1047:2: 
  1045.   
  1046.   	s->s3->alert_dispatch=1;
  1047. > 	s->s3->send_alert[0]=level;
  1048.   	s->s3->send_alert[1]=desc;
  1049.   	if (s->s3->wbuf.left == 0) /* data still being written out */

ssl/s3_pkt.c:1048:2: 
  1046.   	s->s3->alert_dispatch=1;
  1047.   	s->s3->send_alert[0]=level;
  1048. > 	s->s3->send_alert[1]=desc;
  1049.   	if (s->s3->wbuf.left == 0) /* data still being written out */
  1050.   		ssl3_dispatch_alert(s);

ssl/s3_pkt.c:1049:6: Taking false branch
  1047.   	s->s3->send_alert[0]=level;
  1048.   	s->s3->send_alert[1]=desc;
  1049.   	if (s->s3->wbuf.left == 0) /* data still being written out */
               ^
  1050.   		ssl3_dispatch_alert(s);
  1051.   	/* else data is still being written out, we will get written

ssl/s3_pkt.c:1049:2: 
  1047.   	s->s3->send_alert[0]=level;
  1048.   	s->s3->send_alert[1]=desc;
  1049. > 	if (s->s3->wbuf.left == 0) /* data still being written out */
  1050.   		ssl3_dispatch_alert(s);
  1051.   	/* else data is still being written out, we will get written

ssl/s3_pkt.c:1053:2: return from a call to ssl3_send_alert
  1051.   	/* else data is still being written out, we will get written
  1052.   	 * some time in the future */
  1053.   	}
           ^
  1054.   
  1055.   int ssl3_dispatch_alert(SSL *s)

ssl/s3_srvr.c:1534:1: 
1532.   		ssl3_send_alert(s,SSL3_AL_FATAL,al);
1533.   		}
1534. > end:
1535.   	EVP_PKEY_free(pkey);
1536.   	return(ret);

ssl/s3_srvr.c:1535:2: 
1533.   		}
1534.   end:
1535. > 	EVP_PKEY_free(pkey);
1536.   	return(ret);
1537.   	}
