ssl/t1_lib.c:4092: error: NULL_DEREFERENCE
  pointer `cpk` last assigned on line 4091 could be null and is dereferenced at line 4092, column 45.
Showing all 30 steps of the trace


ssl/t1_lib.c:4080:1: start of procedure ssl_get_auto_dh()
4078.   
4079.   #ifndef OPENSSL_NO_DH
4080. > DH *ssl_get_auto_dh(SSL *s)
4081.   {
4082.       int dh_secbits = 80;

ssl/t1_lib.c:4082:5: 
4080.   DH *ssl_get_auto_dh(SSL *s)
4081.   {
4082. >     int dh_secbits = 80;
4083.       if (s->cert->dh_tmp_auto == 2)
4084.           return DH_get_1024_160();

ssl/t1_lib.c:4083:9: Taking false branch
4081.   {
4082.       int dh_secbits = 80;
4083.       if (s->cert->dh_tmp_auto == 2)
                ^
4084.           return DH_get_1024_160();
4085.       if (s->s3->tmp.new_cipher->algorithm_auth & (SSL_aNULL | SSL_aPSK)) {

ssl/t1_lib.c:4085:9: Taking false branch
4083.       if (s->cert->dh_tmp_auto == 2)
4084.           return DH_get_1024_160();
4085.       if (s->s3->tmp.new_cipher->algorithm_auth & (SSL_aNULL | SSL_aPSK)) {
                ^
4086.           if (s->s3->tmp.new_cipher->strength_bits == 256)
4087.               dh_secbits = 128;

ssl/t1_lib.c:4091:9: 
4089.               dh_secbits = 80;
4090.       } else {
4091. >         CERT_PKEY *cpk = ssl_get_server_send_pkey(s);
4092.           dh_secbits = EVP_PKEY_security_bits(cpk->privatekey);
4093.       }

ssl/ssl_lib.c:2787:1: start of procedure ssl_get_server_send_pkey()
  2785.   }
  2786.   
  2787. > CERT_PKEY *ssl_get_server_send_pkey(SSL *s)
  2788.   {
  2789.       CERT *c;

ssl/ssl_lib.c:2792:5: 
  2790.       int i;
  2791.   
  2792. >     c = s->cert;
  2793.       if (!s->s3 || !s->s3->tmp.new_cipher)
  2794.           return NULL;

ssl/ssl_lib.c:2793:10: Taking false branch
  2791.   
  2792.       c = s->cert;
  2793.       if (!s->s3 || !s->s3->tmp.new_cipher)
                   ^
  2794.           return NULL;
  2795.       ssl_set_masks(s);

ssl/ssl_lib.c:2793:20: Taking false branch
  2791.   
  2792.       c = s->cert;
  2793.       if (!s->s3 || !s->s3->tmp.new_cipher)
                             ^
  2794.           return NULL;
  2795.       ssl_set_masks(s);

ssl/ssl_lib.c:2795:5: Skipping ssl_set_masks(): empty list of specs
  2793.       if (!s->s3 || !s->s3->tmp.new_cipher)
  2794.           return NULL;
  2795.       ssl_set_masks(s);
              ^
  2796.   
  2797.       i = ssl_get_server_cert_index(s);

ssl/ssl_lib.c:2797:5: 
  2795.       ssl_set_masks(s);
  2796.   
  2797. >     i = ssl_get_server_cert_index(s);
  2798.   
  2799.       /* This may or may not be an error. */

ssl/ssl_lib.c:2766:1: start of procedure ssl_get_server_cert_index()
    2764.   #endif
    2765.   
    2766. > static int ssl_get_server_cert_index(const SSL *s)
    2767.   {
    2768.       int idx;

ssl/ssl_lib.c:2769:5: 
    2767.   {
    2768.       int idx;
    2769. >     idx = ssl_cipher_get_cert_index(s->s3->tmp.new_cipher);
    2770.       if (idx == SSL_PKEY_RSA_ENC && !s->cert->pkeys[SSL_PKEY_RSA_ENC].x509)
    2771.           idx = SSL_PKEY_RSA_SIGN;

ssl/ssl_ciph.c:1979:1: start of procedure ssl_cipher_get_cert_index()
      1977.   
      1978.   /* For a cipher return the index corresponding to the certificate type */
      1979. > int ssl_cipher_get_cert_index(const SSL_CIPHER *c)
      1980.   {
      1981.       uint32_t alg_a;

ssl/ssl_ciph.c:1983:5: 
      1981.       uint32_t alg_a;
      1982.   
      1983. >     alg_a = c->algorithm_auth;
      1984.   
      1985.       if (alg_a & SSL_aECDSA)

ssl/ssl_ciph.c:1985:9: Taking false branch
      1983.       alg_a = c->algorithm_auth;
      1984.   
      1985.       if (alg_a & SSL_aECDSA)
                      ^
      1986.           return SSL_PKEY_ECC;
      1987.       else if (alg_a & SSL_aDSS)

ssl/ssl_ciph.c:1987:14: Taking false branch
      1985.       if (alg_a & SSL_aECDSA)
      1986.           return SSL_PKEY_ECC;
      1987.       else if (alg_a & SSL_aDSS)
                           ^
      1988.           return SSL_PKEY_DSA_SIGN;
      1989.       else if (alg_a & SSL_aRSA)

ssl/ssl_ciph.c:1989:14: Taking true branch
      1987.       else if (alg_a & SSL_aDSS)
      1988.           return SSL_PKEY_DSA_SIGN;
      1989.       else if (alg_a & SSL_aRSA)
                           ^
      1990.           return SSL_PKEY_RSA_ENC;
      1991.       else if (alg_a & SSL_aGOST12)

ssl/ssl_ciph.c:1990:9: 
      1988.           return SSL_PKEY_DSA_SIGN;
      1989.       else if (alg_a & SSL_aRSA)
      1990. >         return SSL_PKEY_RSA_ENC;
      1991.       else if (alg_a & SSL_aGOST12)
      1992.           return SSL_PKEY_GOST_EC;

ssl/ssl_ciph.c:1997:1: return from a call to ssl_cipher_get_cert_index
      1995.   
      1996.       return -1;
      1997. > }
      1998.   
      1999.   const SSL_CIPHER *ssl_get_cipher_by_char(SSL *ssl, const unsigned char *ptr)

ssl/ssl_lib.c:2770:9: Taking true branch
    2768.       int idx;
    2769.       idx = ssl_cipher_get_cert_index(s->s3->tmp.new_cipher);
    2770.       if (idx == SSL_PKEY_RSA_ENC && !s->cert->pkeys[SSL_PKEY_RSA_ENC].x509)
                    ^
    2771.           idx = SSL_PKEY_RSA_SIGN;
    2772.       if (idx == SSL_PKEY_GOST_EC) {

ssl/ssl_lib.c:2770:37: Taking false branch
    2768.       int idx;
    2769.       idx = ssl_cipher_get_cert_index(s->s3->tmp.new_cipher);
    2770.       if (idx == SSL_PKEY_RSA_ENC && !s->cert->pkeys[SSL_PKEY_RSA_ENC].x509)
                                                ^
    2771.           idx = SSL_PKEY_RSA_SIGN;
    2772.       if (idx == SSL_PKEY_GOST_EC) {

ssl/ssl_lib.c:2772:9: Taking false branch
    2770.       if (idx == SSL_PKEY_RSA_ENC && !s->cert->pkeys[SSL_PKEY_RSA_ENC].x509)
    2771.           idx = SSL_PKEY_RSA_SIGN;
    2772.       if (idx == SSL_PKEY_GOST_EC) {
                    ^
    2773.           if (s->cert->pkeys[SSL_PKEY_GOST12_512].x509)
    2774.               idx = SSL_PKEY_GOST12_512;

ssl/ssl_lib.c:2782:9: Taking false branch
    2780.               idx = -1;
    2781.       }
    2782.       if (idx == -1)
                    ^
    2783.           SSLerr(SSL_F_SSL_GET_SERVER_CERT_INDEX, ERR_R_INTERNAL_ERROR);
    2784.       return idx;

ssl/ssl_lib.c:2784:5: 
    2782.       if (idx == -1)
    2783.           SSLerr(SSL_F_SSL_GET_SERVER_CERT_INDEX, ERR_R_INTERNAL_ERROR);
    2784. >     return idx;
    2785.   }
    2786.   

ssl/ssl_lib.c:2785:1: return from a call to ssl_get_server_cert_index
    2783.           SSLerr(SSL_F_SSL_GET_SERVER_CERT_INDEX, ERR_R_INTERNAL_ERROR);
    2784.       return idx;
    2785. > }
    2786.   
    2787.   CERT_PKEY *ssl_get_server_send_pkey(SSL *s)

ssl/ssl_lib.c:2800:9: Taking true branch
  2798.   
  2799.       /* This may or may not be an error. */
  2800.       if (i < 0)
                  ^
  2801.           return NULL;
  2802.   

ssl/ssl_lib.c:2801:9: 
  2799.       /* This may or may not be an error. */
  2800.       if (i < 0)
  2801. >         return NULL;
  2802.   
  2803.       /* May be NULL. */

ssl/ssl_lib.c:2805:1: return from a call to ssl_get_server_send_pkey
  2803.       /* May be NULL. */
  2804.       return &c->pkeys[i];
  2805. > }
  2806.   
  2807.   EVP_PKEY *ssl_get_sign_pkey(SSL *s, const SSL_CIPHER *cipher,

ssl/t1_lib.c:4092:9: 
4090.       } else {
4091.           CERT_PKEY *cpk = ssl_get_server_send_pkey(s);
4092. >         dh_secbits = EVP_PKEY_security_bits(cpk->privatekey);
4093.       }
4094.   
