ssl/s3_srvr.c:2191: error: NULL_DEREFERENCE
  pointer `clnt_pub_pkey` last assigned on line 1665 could be null and is dereferenced by call to `EVP_PKEY_free()` at line 2191, column 2.
Showing all 38 steps of the trace


ssl/s3_srvr.c:1645:1: start of procedure ssl3_get_client_key_exchange()
1643.   #endif	/* OPENSSL_NO_ECDH */
1644.   
1645. > int ssl3_get_client_key_exchange(SSL *s)
1646.   	{
1647.   	int i,al,ok;

ssl/s3_srvr.c:1652:2: 
1650.   	unsigned char *p;
1651.   #ifndef OPENSSL_NO_RSA
1652. > 	RSA *rsa=NULL;
1653.   	EVP_PKEY *pkey=NULL;
1654.   #endif

ssl/s3_srvr.c:1653:2: 
1651.   #ifndef OPENSSL_NO_RSA
1652.   	RSA *rsa=NULL;
1653. > 	EVP_PKEY *pkey=NULL;
1654.   #endif
1655.   #ifndef OPENSSL_NO_DH

ssl/s3_srvr.c:1656:2: 
1654.   #endif
1655.   #ifndef OPENSSL_NO_DH
1656. > 	BIGNUM *pub=NULL;
1657.   	DH *dh_srvr;
1658.   #endif

ssl/s3_srvr.c:1664:2: 
1662.   
1663.   #ifndef OPENSSL_NO_ECDH
1664. > 	EC_KEY *srvr_ecdh = NULL;
1665.   	EVP_PKEY *clnt_pub_pkey = NULL;
1666.   	EC_POINT *clnt_ecpoint = NULL;

ssl/s3_srvr.c:1665:2: 
1663.   #ifndef OPENSSL_NO_ECDH
1664.   	EC_KEY *srvr_ecdh = NULL;
1665. > 	EVP_PKEY *clnt_pub_pkey = NULL;
1666.   	EC_POINT *clnt_ecpoint = NULL;
1667.   	BN_CTX *bn_ctx = NULL; 

ssl/s3_srvr.c:1666:2: 
1664.   	EC_KEY *srvr_ecdh = NULL;
1665.   	EVP_PKEY *clnt_pub_pkey = NULL;
1666. > 	EC_POINT *clnt_ecpoint = NULL;
1667.   	BN_CTX *bn_ctx = NULL; 
1668.   #endif

ssl/s3_srvr.c:1667:2: 
1665.   	EVP_PKEY *clnt_pub_pkey = NULL;
1666.   	EC_POINT *clnt_ecpoint = NULL;
1667. > 	BN_CTX *bn_ctx = NULL; 
1668.   #endif
1669.   

ssl/s3_srvr.c:1670:2: Skipping __function_pointer__(): unresolved function pointer
1668.   #endif
1669.   
1670.   	n=s->method->ssl_get_message(s,
         ^
1671.   		SSL3_ST_SR_KEY_EXCH_A,
1672.   		SSL3_ST_SR_KEY_EXCH_B,

ssl/s3_srvr.c:1677:7: Taking false branch
1675.   		&ok);
1676.   
1677.   	if (!ok) return((int)n);
              ^
1678.   	p=(unsigned char *)s->init_msg;
1679.   

ssl/s3_srvr.c:1678:2: 
1676.   
1677.   	if (!ok) return((int)n);
1678. > 	p=(unsigned char *)s->init_msg;
1679.   
1680.   	l=s->s3->tmp.new_cipher->algorithms;

ssl/s3_srvr.c:1680:2: 
1678.   	p=(unsigned char *)s->init_msg;
1679.   
1680. > 	l=s->s3->tmp.new_cipher->algorithms;
1681.   
1682.   #ifndef OPENSSL_NO_RSA

ssl/s3_srvr.c:1683:6: Taking true branch
1681.   
1682.   #ifndef OPENSSL_NO_RSA
1683.   	if (l & SSL_kRSA)
             ^
1684.   		{
1685.   		/* FIX THIS UP EAY EAY EAY EAY */

ssl/s3_srvr.c:1686:7: Taking false branch
1684.   		{
1685.   		/* FIX THIS UP EAY EAY EAY EAY */
1686.   		if (s->s3->tmp.use_rsa_tmp)
              ^
1687.   			{
1688.   			if ((s->cert != NULL) && (s->cert->rsa_tmp != NULL))

ssl/s3_srvr.c:1702:4: 
1700.   		else
1701.   			{
1702. > 			pkey=s->cert->pkeys[SSL_PKEY_RSA_ENC].privatekey;
1703.   			if (	(pkey == NULL) ||
1704.   				(pkey->type != EVP_PKEY_RSA) ||

ssl/s3_srvr.c:1703:10: Taking false branch
1701.   			{
1702.   			pkey=s->cert->pkeys[SSL_PKEY_RSA_ENC].privatekey;
1703.   			if (	(pkey == NULL) ||
                 ^
1704.   				(pkey->type != EVP_PKEY_RSA) ||
1705.   				(pkey->pkey.rsa == NULL))

ssl/s3_srvr.c:1704:6: Taking false branch
1702.   			pkey=s->cert->pkeys[SSL_PKEY_RSA_ENC].privatekey;
1703.   			if (	(pkey == NULL) ||
1704.   				(pkey->type != EVP_PKEY_RSA) ||
             ^
1705.   				(pkey->pkey.rsa == NULL))
1706.   				{

ssl/s3_srvr.c:1705:6: Taking false branch
1703.   			if (	(pkey == NULL) ||
1704.   				(pkey->type != EVP_PKEY_RSA) ||
1705.   				(pkey->pkey.rsa == NULL))
             ^
1706.   				{
1707.   				al=SSL_AD_HANDSHAKE_FAILURE;

ssl/s3_srvr.c:1711:4: 
1709.   				goto f_err;
1710.   				}
1711. > 			rsa=pkey->pkey.rsa;
1712.   			}
1713.   

ssl/s3_srvr.c:1715:7: Taking true branch
1713.   
1714.   		/* TLS */
1715.   		if (s->version > SSL3_VERSION)
              ^
1716.   			{
1717.   			n2s(p,i);

ssl/s3_srvr.c:1717:4: 
1715.   		if (s->version > SSL3_VERSION)
1716.   			{
1717. > 			n2s(p,i);
1718.   			if (n != i+2)
1719.   				{

ssl/s3_srvr.c:1718:8: Taking true branch
1716.   			{
1717.   			n2s(p,i);
1718.   			if (n != i+2)
               ^
1719.   				{
1720.   				if (!(s->options & SSL_OP_TLS_D5_BUG))

ssl/s3_srvr.c:1720:11: Taking true branch
1718.   			if (n != i+2)
1719.   				{
1720.   				if (!(s->options & SSL_OP_TLS_D5_BUG))
                  ^
1721.   					{
1722.   					SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,SSL_R_TLS_RSA_ENCRYPTED_VALUE_LENGTH_IS_WRONG);

ssl/s3_srvr.c:1722:6: 
1720.   				if (!(s->options & SSL_OP_TLS_D5_BUG))
1721.   					{
1722. > 					SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,SSL_R_TLS_RSA_ENCRYPTED_VALUE_LENGTH_IS_WRONG);
1723.   					goto err;
1724.   					}

crypto/err/err.c:666:1: start of procedure ERR_put_error()
  664.   /********************************************************/
  665.   
  666. > void ERR_put_error(int lib, int func, int reason, const char *file,
  667.   	     int line)
  668.   	{

crypto/err/err.c:690:2: Skipping ERR_get_state(): empty list of specs
  688.   	}
  689.   #endif
  690.   	es=ERR_get_state();
          ^
  691.   
  692.   	es->top=(es->top+1)%ERR_NUM_ERRORS;

crypto/err/err.c:692:2: 
  690.   	es=ERR_get_state();
  691.   
  692. > 	es->top=(es->top+1)%ERR_NUM_ERRORS;
  693.   	if (es->top == es->bottom)
  694.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;

crypto/err/err.c:693:6: Taking false branch
  691.   
  692.   	es->top=(es->top+1)%ERR_NUM_ERRORS;
  693.   	if (es->top == es->bottom)
              ^
  694.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
  695.   	es->err_flags[es->top]=0;

crypto/err/err.c:695:2: 
  693.   	if (es->top == es->bottom)
  694.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
  695. > 	es->err_flags[es->top]=0;
  696.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
  697.   	es->err_file[es->top]=file;

crypto/err/err.c:696:2: 
  694.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
  695.   	es->err_flags[es->top]=0;
  696. > 	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
  697.   	es->err_file[es->top]=file;
  698.   	es->err_line[es->top]=line;

crypto/err/err.c:697:2: 
  695.   	es->err_flags[es->top]=0;
  696.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
  697. > 	es->err_file[es->top]=file;
  698.   	es->err_line[es->top]=line;
  699.   	err_clear_data(es,es->top);

crypto/err/err.c:698:2: 
  696.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
  697.   	es->err_file[es->top]=file;
  698. > 	es->err_line[es->top]=line;
  699.   	err_clear_data(es,es->top);
  700.   	}

crypto/err/err.c:699:2: Taking true branch
  697.   	es->err_file[es->top]=file;
  698.   	es->err_line[es->top]=line;
  699.   	err_clear_data(es,es->top);
          ^
  700.   	}
  701.   

crypto/err/err.c:699:2: Taking false branch
  697.   	es->err_file[es->top]=file;
  698.   	es->err_line[es->top]=line;
  699.   	err_clear_data(es,es->top);
          ^
  700.   	}
  701.   

crypto/err/err.c:699:2: Loop condition is false. Leaving loop
  697.   	es->err_file[es->top]=file;
  698.   	es->err_line[es->top]=line;
  699.   	err_clear_data(es,es->top);
          ^
  700.   	}
  701.   

crypto/err/err.c:700:2: return from a call to ERR_put_error
  698.   	es->err_line[es->top]=line;
  699.   	err_clear_data(es,es->top);
  700.   	}
          ^
  701.   
  702.   void ERR_clear_error(void)

ssl/s3_srvr.c:2188:1: 
2186.   	ssl3_send_alert(s,SSL3_AL_FATAL,al);
2187.   #if !defined(OPENSSL_NO_DH) || !defined(OPENSSL_NO_RSA) || !defined(OPENSSL_NO_ECDH)
2188. > err:
2189.   #endif
2190.   #ifndef OPENSSL_NO_ECDH

ssl/s3_srvr.c:2191:2: 
2189.   #endif
2190.   #ifndef OPENSSL_NO_ECDH
2191. > 	EVP_PKEY_free(clnt_pub_pkey);
2192.   	EC_POINT_free(clnt_ecpoint);
2193.   	if (srvr_ecdh != NULL) 
