ssl/s3_srvr.c:1501: error: NULL_DEREFERENCE
  pointer `pkey` last assigned on line 1388 could be null and is dereferenced by call to `EVP_PKEY_free()` at line 1501, column 2.
Showing all 33 steps of the trace


ssl/s3_srvr.c:1367:1: start of procedure ssl3_get_cert_verify()
1365.   	}
1366.   
1367. > static int ssl3_get_cert_verify(SSL *s)
1368.   	{
1369.   	EVP_PKEY *pkey=NULL;

ssl/s3_srvr.c:1369:2: 
1367.   static int ssl3_get_cert_verify(SSL *s)
1368.   	{
1369. > 	EVP_PKEY *pkey=NULL;
1370.   	unsigned char *p;
1371.   	int al,ok,ret=0;

ssl/s3_srvr.c:1371:2: 
1369.   	EVP_PKEY *pkey=NULL;
1370.   	unsigned char *p;
1371. > 	int al,ok,ret=0;
1372.   	long n;
1373.   	int type=0,i,j;

ssl/s3_srvr.c:1373:2: 
1371.   	int al,ok,ret=0;
1372.   	long n;
1373. > 	int type=0,i,j;
1374.   	X509 *peer;
1375.   

ssl/s3_srvr.c:1376:2: Skipping ssl3_get_message(): empty list of specs
1374.   	X509 *peer;
1375.   
1376.   	n=ssl3_get_message(s,
         ^
1377.   		SSL3_ST_SR_CERT_VRFY_A,
1378.   		SSL3_ST_SR_CERT_VRFY_B,

ssl/s3_srvr.c:1383:7: Taking false branch
1381.   		&ok);
1382.   
1383.   	if (!ok) return((int)n);
              ^
1384.   
1385.   	if (s->session->peer != NULL)

ssl/s3_srvr.c:1385:6: Taking true branch
1383.   	if (!ok) return((int)n);
1384.   
1385.   	if (s->session->peer != NULL)
             ^
1386.   		{
1387.   		peer=s->session->peer;

ssl/s3_srvr.c:1387:3: 
1385.   	if (s->session->peer != NULL)
1386.   		{
1387. > 		peer=s->session->peer;
1388.   		pkey=X509_get_pubkey(peer);
1389.   		type=X509_certificate_type(peer,pkey);

ssl/s3_srvr.c:1388:3: 
1386.   		{
1387.   		peer=s->session->peer;
1388. > 		pkey=X509_get_pubkey(peer);
1389.   		type=X509_certificate_type(peer,pkey);
1390.   		}

crypto/x509/x509_cmp.c:239:1: start of procedure X509_get_pubkey()
  237.   	}
  238.   
  239. > EVP_PKEY *X509_get_pubkey(X509 *x)
  240.   	{
  241.   	if ((x == NULL) || (x->cert_info == NULL))

crypto/x509/x509_cmp.c:241:7: Taking false branch
  239.   EVP_PKEY *X509_get_pubkey(X509 *x)
  240.   	{
  241.   	if ((x == NULL) || (x->cert_info == NULL))
               ^
  242.   		return(NULL);
  243.   	return(X509_PUBKEY_get(x->cert_info->key));

crypto/x509/x509_cmp.c:241:22: Taking true branch
  239.   EVP_PKEY *X509_get_pubkey(X509 *x)
  240.   	{
  241.   	if ((x == NULL) || (x->cert_info == NULL))
                              ^
  242.   		return(NULL);
  243.   	return(X509_PUBKEY_get(x->cert_info->key));

crypto/x509/x509_cmp.c:242:3: 
  240.   	{
  241.   	if ((x == NULL) || (x->cert_info == NULL))
  242. > 		return(NULL);
  243.   	return(X509_PUBKEY_get(x->cert_info->key));
  244.   	}

crypto/x509/x509_cmp.c:244:2: return from a call to X509_get_pubkey
  242.   		return(NULL);
  243.   	return(X509_PUBKEY_get(x->cert_info->key));
  244.   	}
          ^
  245.   
  246.   int X509_check_private_key(X509 *x, EVP_PKEY *k)

ssl/s3_srvr.c:1389:3: Skipping X509_certificate_type(): empty list of specs
1387.   		peer=s->session->peer;
1388.   		pkey=X509_get_pubkey(peer);
1389.   		type=X509_certificate_type(peer,pkey);
          ^
1390.   		}
1391.   	else

ssl/s3_srvr.c:1397:6: Taking true branch
1395.   		}
1396.   
1397.   	if (s->s3->tmp.message_type != SSL3_MT_CERTIFICATE_VERIFY)
             ^
1398.   		{
1399.   		s->s3->tmp.reuse_message=1;

ssl/s3_srvr.c:1399:3: 
1397.   	if (s->s3->tmp.message_type != SSL3_MT_CERTIFICATE_VERIFY)
1398.   		{
1399. > 		s->s3->tmp.reuse_message=1;
1400.   		if ((peer != NULL) && (type | EVP_PKT_SIGN))
1401.   			{

ssl/s3_srvr.c:1400:8: Taking true branch
1398.   		{
1399.   		s->s3->tmp.reuse_message=1;
1400.   		if ((peer != NULL) && (type | EVP_PKT_SIGN))
               ^
1401.   			{
1402.   			al=SSL_AD_UNEXPECTED_MESSAGE;

ssl/s3_srvr.c:1400:26: Taking false branch
1398.   		{
1399.   		s->s3->tmp.reuse_message=1;
1400.   		if ((peer != NULL) && (type | EVP_PKT_SIGN))
                                 ^
1401.   			{
1402.   			al=SSL_AD_UNEXPECTED_MESSAGE;

ssl/s3_srvr.c:1406:3: 
1404.   			goto f_err;
1405.   			}
1406. > 		ret=1;
1407.   		goto end;
1408.   		}

ssl/s3_srvr.c:1500:1: 
1498.   		ssl3_send_alert(s,SSL3_AL_FATAL,al);
1499.   		}
1500. > end:
1501.   	EVP_PKEY_free(pkey);
1502.   	return(ret);

ssl/s3_srvr.c:1501:2: 
1499.   		}
1500.   end:
1501. > 	EVP_PKEY_free(pkey);
1502.   	return(ret);
1503.   	}

crypto/evp/p_lib.c:228:1: start of procedure EVP_PKEY_free()
  226.   	}
  227.   
  228. > void EVP_PKEY_free(EVP_PKEY *x)
  229.   	{
  230.   	int i;

crypto/evp/p_lib.c:232:6: Taking false branch
  230.   	int i;
  231.   
  232.   	if (x == NULL) return;
              ^
  233.   
  234.   	i=CRYPTO_add(&x->references,-1,CRYPTO_LOCK_EVP_PKEY);

crypto/evp/p_lib.c:234:2: 
  232.   	if (x == NULL) return;
  233.   
  234. > 	i=CRYPTO_add(&x->references,-1,CRYPTO_LOCK_EVP_PKEY);
  235.   #ifdef REF_PRINT
  236.   	REF_PRINT("EVP_PKEY",x);

crypto/cryptlib.c:225:1: start of procedure CRYPTO_add_lock()
    223.   	}
    224.   
    225. > int CRYPTO_add_lock(int *pointer, int amount, int type, const char *file,
    226.   	     int line)
    227.   	{

crypto/cryptlib.c:230:6: Taking false branch
    228.   	int ret;
    229.   
    230.   	if (add_lock_callback != NULL)
                ^
    231.   		{
    232.   #ifdef LOCK_DEBUG

crypto/cryptlib.c:248:3: 
    246.   	else
    247.   		{
    248. > 		CRYPTO_lock(CRYPTO_LOCK|CRYPTO_WRITE,type,file,line);
    249.   
    250.   		ret= *pointer+amount;

crypto/cryptlib.c:196:1: start of procedure CRYPTO_lock()
      194.   	}
      195.   
      196. > void CRYPTO_lock(int mode, int type, const char *file, int line)
      197.   	{
      198.   #ifdef LOCK_DEBUG

crypto/cryptlib.c:221:6: Taking false branch
      219.   		}
      220.   #endif
      221.   	if (locking_callback != NULL)
                  ^
      222.   		locking_callback(mode,type,file,line);
      223.   	}

crypto/cryptlib.c:221:2: 
      219.   		}
      220.   #endif
      221. > 	if (locking_callback != NULL)
      222.   		locking_callback(mode,type,file,line);
      223.   	}

crypto/cryptlib.c:223:2: return from a call to CRYPTO_lock
      221.   	if (locking_callback != NULL)
      222.   		locking_callback(mode,type,file,line);
      223.   	}
              ^
      224.   
      225.   int CRYPTO_add_lock(int *pointer, int amount, int type, const char *file,

crypto/cryptlib.c:250:3: 
    248.   		CRYPTO_lock(CRYPTO_LOCK|CRYPTO_WRITE,type,file,line);
    249.   
    250. > 		ret= *pointer+amount;
    251.   #ifdef LOCK_DEBUG
    252.   		fprintf(stderr,"ladd:%08lx:%2d+%2d->%2d %-18s %s:%d\n",
