ssl/t1_lib.c:4248: error: NULL_DEREFERENCE
  pointer `cpk` last assigned on line 4247 could be null and is dereferenced at line 4248, column 45.
Showing all 34 steps of the trace


ssl/t1_lib.c:4236:1: start of procedure ssl_get_auto_dh()
4234.   
4235.   #ifndef OPENSSL_NO_DH
4236. > DH *ssl_get_auto_dh(SSL *s)
4237.   {
4238.       int dh_secbits = 80;

ssl/t1_lib.c:4238:5: 
4236.   DH *ssl_get_auto_dh(SSL *s)
4237.   {
4238. >     int dh_secbits = 80;
4239.       if (s->cert->dh_tmp_auto == 2)
4240.           return DH_get_1024_160();

ssl/t1_lib.c:4239:9: Taking false branch
4237.   {
4238.       int dh_secbits = 80;
4239.       if (s->cert->dh_tmp_auto == 2)
                ^
4240.           return DH_get_1024_160();
4241.       if (s->s3->tmp.new_cipher->algorithm_auth & (SSL_aNULL | SSL_aPSK)) {

ssl/t1_lib.c:4241:9: Taking false branch
4239.       if (s->cert->dh_tmp_auto == 2)
4240.           return DH_get_1024_160();
4241.       if (s->s3->tmp.new_cipher->algorithm_auth & (SSL_aNULL | SSL_aPSK)) {
                ^
4242.           if (s->s3->tmp.new_cipher->strength_bits == 256)
4243.               dh_secbits = 128;

ssl/t1_lib.c:4247:9: 
4245.               dh_secbits = 80;
4246.       } else {
4247. >         CERT_PKEY *cpk = ssl_get_server_send_pkey(s);
4248.           dh_secbits = EVP_PKEY_security_bits(cpk->privatekey);
4249.       }

ssl/ssl_lib.c:2284:1: start of procedure ssl_get_server_send_pkey()
  2282.   }
  2283.   
  2284. > CERT_PKEY *ssl_get_server_send_pkey(SSL *s)
  2285.   {
  2286.       CERT *c;

ssl/ssl_lib.c:2289:5: 
  2287.       int i;
  2288.   
  2289. >     c = s->cert;
  2290.       if (!s->s3 || !s->s3->tmp.new_cipher)
  2291.           return NULL;

ssl/ssl_lib.c:2290:10: Taking false branch
  2288.   
  2289.       c = s->cert;
  2290.       if (!s->s3 || !s->s3->tmp.new_cipher)
                   ^
  2291.           return NULL;
  2292.       ssl_set_masks(s, s->s3->tmp.new_cipher);

ssl/ssl_lib.c:2290:20: Taking false branch
  2288.   
  2289.       c = s->cert;
  2290.       if (!s->s3 || !s->s3->tmp.new_cipher)
                             ^
  2291.           return NULL;
  2292.       ssl_set_masks(s, s->s3->tmp.new_cipher);

ssl/ssl_lib.c:2292:5: Skipping ssl_set_masks(): empty list of specs
  2290.       if (!s->s3 || !s->s3->tmp.new_cipher)
  2291.           return NULL;
  2292.       ssl_set_masks(s, s->s3->tmp.new_cipher);
              ^
  2293.   
  2294.   #ifdef OPENSSL_SSL_DEBUG_BROKEN_PROTOCOL

ssl/ssl_lib.c:2303:5: 
  2301.   #endif
  2302.   
  2303. >     i = ssl_get_server_cert_index(s);
  2304.   
  2305.       /* This may or may not be an error. */

ssl/ssl_lib.c:2263:1: start of procedure ssl_get_server_cert_index()
    2261.   #endif
    2262.   
    2263. > static int ssl_get_server_cert_index(const SSL *s)
    2264.   {
    2265.       int idx;

ssl/ssl_lib.c:2266:5: 
    2264.   {
    2265.       int idx;
    2266. >     idx = ssl_cipher_get_cert_index(s->s3->tmp.new_cipher);
    2267.       if (idx == SSL_PKEY_RSA_ENC && !s->cert->pkeys[SSL_PKEY_RSA_ENC].x509)
    2268.           idx = SSL_PKEY_RSA_SIGN;

ssl/ssl_ciph.c:2006:1: start of procedure ssl_cipher_get_cert_index()
      2004.   
      2005.   /* For a cipher return the index corresponding to the certificate type */
      2006. > int ssl_cipher_get_cert_index(const SSL_CIPHER *c)
      2007.   {
      2008.       uint32_t alg_k, alg_a;

ssl/ssl_ciph.c:2010:5: 
      2008.       uint32_t alg_k, alg_a;
      2009.   
      2010. >     alg_k = c->algorithm_mkey;
      2011.       alg_a = c->algorithm_auth;
      2012.   

ssl/ssl_ciph.c:2011:5: 
      2009.   
      2010.       alg_k = c->algorithm_mkey;
      2011. >     alg_a = c->algorithm_auth;
      2012.   
      2013.       if (alg_k & (SSL_kECDHr | SSL_kECDHe)) {

ssl/ssl_ciph.c:2013:9: Taking false branch
      2011.       alg_a = c->algorithm_auth;
      2012.   
      2013.       if (alg_k & (SSL_kECDHr | SSL_kECDHe)) {
                      ^
      2014.           /*
      2015.            * we don't need to look at SSL_kECDHE since no certificate is needed

ssl/ssl_ciph.c:2023:16: Taking false branch
      2021.            */
      2022.           return SSL_PKEY_ECC;
      2023.       } else if (alg_a & SSL_aECDSA)
                             ^
      2024.           return SSL_PKEY_ECC;
      2025.       else if (alg_k & SSL_kDHr)

ssl/ssl_ciph.c:2025:14: Taking false branch
      2023.       } else if (alg_a & SSL_aECDSA)
      2024.           return SSL_PKEY_ECC;
      2025.       else if (alg_k & SSL_kDHr)
                           ^
      2026.           return SSL_PKEY_DH_RSA;
      2027.       else if (alg_k & SSL_kDHd)

ssl/ssl_ciph.c:2027:14: Taking false branch
      2025.       else if (alg_k & SSL_kDHr)
      2026.           return SSL_PKEY_DH_RSA;
      2027.       else if (alg_k & SSL_kDHd)
                           ^
      2028.           return SSL_PKEY_DH_DSA;
      2029.       else if (alg_a & SSL_aDSS)

ssl/ssl_ciph.c:2029:14: Taking false branch
      2027.       else if (alg_k & SSL_kDHd)
      2028.           return SSL_PKEY_DH_DSA;
      2029.       else if (alg_a & SSL_aDSS)
                           ^
      2030.           return SSL_PKEY_DSA_SIGN;
      2031.       else if (alg_a & SSL_aRSA)

ssl/ssl_ciph.c:2031:14: Taking true branch
      2029.       else if (alg_a & SSL_aDSS)
      2030.           return SSL_PKEY_DSA_SIGN;
      2031.       else if (alg_a & SSL_aRSA)
                           ^
      2032.           return SSL_PKEY_RSA_ENC;
      2033.       else if (alg_a & SSL_aGOST12)

ssl/ssl_ciph.c:2032:9: 
      2030.           return SSL_PKEY_DSA_SIGN;
      2031.       else if (alg_a & SSL_aRSA)
      2032. >         return SSL_PKEY_RSA_ENC;
      2033.       else if (alg_a & SSL_aGOST12)
      2034.           return SSL_PKEY_GOST_EC;

ssl/ssl_ciph.c:2039:1: return from a call to ssl_cipher_get_cert_index
      2037.   
      2038.       return -1;
      2039. > }
      2040.   
      2041.   const SSL_CIPHER *ssl_get_cipher_by_char(SSL *ssl, const unsigned char *ptr)

ssl/ssl_lib.c:2267:9: Taking true branch
    2265.       int idx;
    2266.       idx = ssl_cipher_get_cert_index(s->s3->tmp.new_cipher);
    2267.       if (idx == SSL_PKEY_RSA_ENC && !s->cert->pkeys[SSL_PKEY_RSA_ENC].x509)
                    ^
    2268.           idx = SSL_PKEY_RSA_SIGN;
    2269.       if (idx == SSL_PKEY_GOST_EC) {

ssl/ssl_lib.c:2267:37: Taking false branch
    2265.       int idx;
    2266.       idx = ssl_cipher_get_cert_index(s->s3->tmp.new_cipher);
    2267.       if (idx == SSL_PKEY_RSA_ENC && !s->cert->pkeys[SSL_PKEY_RSA_ENC].x509)
                                                ^
    2268.           idx = SSL_PKEY_RSA_SIGN;
    2269.       if (idx == SSL_PKEY_GOST_EC) {

ssl/ssl_lib.c:2269:9: Taking false branch
    2267.       if (idx == SSL_PKEY_RSA_ENC && !s->cert->pkeys[SSL_PKEY_RSA_ENC].x509)
    2268.           idx = SSL_PKEY_RSA_SIGN;
    2269.       if (idx == SSL_PKEY_GOST_EC) {
                    ^
    2270.           if (s->cert->pkeys[SSL_PKEY_GOST12_512].x509)
    2271.               idx = SSL_PKEY_GOST12_512;

ssl/ssl_lib.c:2279:9: Taking false branch
    2277.               idx = -1;
    2278.       }
    2279.       if (idx == -1)
                    ^
    2280.           SSLerr(SSL_F_SSL_GET_SERVER_CERT_INDEX, ERR_R_INTERNAL_ERROR);
    2281.       return idx;

ssl/ssl_lib.c:2281:5: 
    2279.       if (idx == -1)
    2280.           SSLerr(SSL_F_SSL_GET_SERVER_CERT_INDEX, ERR_R_INTERNAL_ERROR);
    2281. >     return idx;
    2282.   }
    2283.   

ssl/ssl_lib.c:2282:1: return from a call to ssl_get_server_cert_index
    2280.           SSLerr(SSL_F_SSL_GET_SERVER_CERT_INDEX, ERR_R_INTERNAL_ERROR);
    2281.       return idx;
    2282. > }
    2283.   
    2284.   CERT_PKEY *ssl_get_server_send_pkey(SSL *s)

ssl/ssl_lib.c:2306:9: Taking true branch
  2304.   
  2305.       /* This may or may not be an error. */
  2306.       if (i < 0)
                  ^
  2307.           return NULL;
  2308.   

ssl/ssl_lib.c:2307:9: 
  2305.       /* This may or may not be an error. */
  2306.       if (i < 0)
  2307. >         return NULL;
  2308.   
  2309.       /* May be NULL. */

ssl/ssl_lib.c:2311:1: return from a call to ssl_get_server_send_pkey
  2309.       /* May be NULL. */
  2310.       return &c->pkeys[i];
  2311. > }
  2312.   
  2313.   EVP_PKEY *ssl_get_sign_pkey(SSL *s, const SSL_CIPHER *cipher,

ssl/t1_lib.c:4248:9: 
4246.       } else {
4247.           CERT_PKEY *cpk = ssl_get_server_send_pkey(s);
4248. >         dh_secbits = EVP_PKEY_security_bits(cpk->privatekey);
4249.       }
4250.   
