apps/x509.c:951: error: NULL_DEREFERENCE
  pointer `upkey` last assigned on line 949 could be null and is dereferenced by call to `EVP_PKEY_free()` at line 951, column 2.
Showing all 21 steps of the trace


apps/x509.c:936:1: start of procedure x509_certify()
934.   	}
935.   
936. > static int x509_certify(X509_STORE *ctx, char *CAfile, const EVP_MD *digest,
937.   	     X509 *x, X509 *xca, EVP_PKEY *pkey, char *serialfile, int create,
938.   	     int days, int clrext, LHASH *conf, char *section)

apps/x509.c:940:2: 
938.   	     int days, int clrext, LHASH *conf, char *section)
939.   	{
940. > 	int ret=0;
941.   	BIO *io=NULL;
942.   	MS_STATIC char buf2[1024];

apps/x509.c:941:2: 
939.   	{
940.   	int ret=0;
941. > 	BIO *io=NULL;
942.   	MS_STATIC char buf2[1024];
943.   	char *buf=NULL,*p;

apps/x509.c:943:2: 
941.   	BIO *io=NULL;
942.   	MS_STATIC char buf2[1024];
943. > 	char *buf=NULL,*p;
944.   	BIGNUM *serial=NULL;
945.   	ASN1_INTEGER *bs=NULL,bs2;

apps/x509.c:944:2: 
942.   	MS_STATIC char buf2[1024];
943.   	char *buf=NULL,*p;
944. > 	BIGNUM *serial=NULL;
945.   	ASN1_INTEGER *bs=NULL,bs2;
946.   	X509_STORE_CTX xsc;

apps/x509.c:945:2: 
943.   	char *buf=NULL,*p;
944.   	BIGNUM *serial=NULL;
945. > 	ASN1_INTEGER *bs=NULL,bs2;
946.   	X509_STORE_CTX xsc;
947.   	EVP_PKEY *upkey;

apps/x509.c:949:2: 
947.   	EVP_PKEY *upkey;
948.   
949. > 	upkey = X509_get_pubkey(xca);
950.   	EVP_PKEY_copy_parameters(upkey,pkey);
951.   	EVP_PKEY_free(upkey);

crypto/x509/x509_cmp.c:260:1: start of procedure X509_get_pubkey()
  258.   	}
  259.   
  260. > EVP_PKEY *X509_get_pubkey(X509 *x)
  261.   	{
  262.   	if ((x == NULL) || (x->cert_info == NULL))

crypto/x509/x509_cmp.c:262:7: Taking false branch
  260.   EVP_PKEY *X509_get_pubkey(X509 *x)
  261.   	{
  262.   	if ((x == NULL) || (x->cert_info == NULL))
               ^
  263.   		return(NULL);
  264.   	return(X509_PUBKEY_get(x->cert_info->key));

crypto/x509/x509_cmp.c:262:22: Taking true branch
  260.   EVP_PKEY *X509_get_pubkey(X509 *x)
  261.   	{
  262.   	if ((x == NULL) || (x->cert_info == NULL))
                              ^
  263.   		return(NULL);
  264.   	return(X509_PUBKEY_get(x->cert_info->key));

crypto/x509/x509_cmp.c:263:3: 
  261.   	{
  262.   	if ((x == NULL) || (x->cert_info == NULL))
  263. > 		return(NULL);
  264.   	return(X509_PUBKEY_get(x->cert_info->key));
  265.   	}

crypto/x509/x509_cmp.c:265:2: return from a call to X509_get_pubkey
  263.   		return(NULL);
  264.   	return(X509_PUBKEY_get(x->cert_info->key));
  265.   	}
          ^
  266.   
  267.   int X509_check_private_key(X509 *x, EVP_PKEY *k)

apps/x509.c:950:2: Skipping EVP_PKEY_copy_parameters(): empty list of specs
948.   
949.   	upkey = X509_get_pubkey(xca);
950.   	EVP_PKEY_copy_parameters(upkey,pkey);
        ^
951.   	EVP_PKEY_free(upkey);
952.   

apps/x509.c:951:2: 
949.   	upkey = X509_get_pubkey(xca);
950.   	EVP_PKEY_copy_parameters(upkey,pkey);
951. > 	EVP_PKEY_free(upkey);
952.   
953.   	X509_STORE_CTX_init(&xsc,ctx,x,NULL);

crypto/evp/p_lib.c:286:1: start of procedure EVP_PKEY_free()
  284.   	}
  285.   
  286. > void EVP_PKEY_free(EVP_PKEY *x)
  287.   	{
  288.   	int i;

crypto/evp/p_lib.c:290:6: Taking false branch
  288.   	int i;
  289.   
  290.   	if (x == NULL) return;
              ^
  291.   
  292.   	i=CRYPTO_add(&x->references,-1,CRYPTO_LOCK_EVP_PKEY);

crypto/evp/p_lib.c:292:2: 
  290.   	if (x == NULL) return;
  291.   
  292. > 	i=CRYPTO_add(&x->references,-1,CRYPTO_LOCK_EVP_PKEY);
  293.   #ifdef REF_PRINT
  294.   	REF_PRINT("EVP_PKEY",x);

crypto/cryptlib.c:227:1: start of procedure CRYPTO_add_lock()
    225.   	}
    226.   
    227. > int CRYPTO_add_lock(int *pointer, int amount, int type, const char *file,
    228.   	     int line)
    229.   	{

crypto/cryptlib.c:232:6: Taking true branch
    230.   	int ret;
    231.   
    232.   	if (add_lock_callback != NULL)
                ^
    233.   		{
    234.   #ifdef LOCK_DEBUG

crypto/cryptlib.c:238:3: Skipping __function_pointer__(): unresolved function pointer
    236.   #endif
    237.   
    238.   		ret=add_lock_callback(pointer,amount,type,file,line);
             ^
    239.   #ifdef LOCK_DEBUG
    240.   		fprintf(stderr,"ladd:%08lx:%2d+%2d->%2d %-18s %s:%d\n",

crypto/cryptlib.c:246:3: 
    244.   			file,line);
    245.   #endif
    246. > 		*pointer=ret;
    247.   		}
    248.   	else
