crypto/x509/x509_req.c:136: error: NULL_DEREFERENCE
  pointer `xk` last assigned on line 135 could be null and is dereferenced by call to `EVP_PKEY_cmp()` at line 136, column 13.
Showing all 16 steps of the trace


crypto/x509/x509_req.c:130:1: start of procedure X509_REQ_check_private_key()
128.   }
129.   
130. > int X509_REQ_check_private_key(X509_REQ *x, EVP_PKEY *k)
131.   {
132.       EVP_PKEY *xk = NULL;

crypto/x509/x509_req.c:132:5: 
130.   int X509_REQ_check_private_key(X509_REQ *x, EVP_PKEY *k)
131.   {
132. >     EVP_PKEY *xk = NULL;
133.       int ok = 0;
134.   

crypto/x509/x509_req.c:133:5: 
131.   {
132.       EVP_PKEY *xk = NULL;
133. >     int ok = 0;
134.   
135.       xk = X509_REQ_get_pubkey(x);

crypto/x509/x509_req.c:135:5: 
133.       int ok = 0;
134.   
135. >     xk = X509_REQ_get_pubkey(x);
136.       switch (EVP_PKEY_cmp(xk, k)) {
137.       case 1:

crypto/x509/x509_req.c:111:1: start of procedure X509_REQ_get_pubkey()
  109.   }
  110.   
  111. > EVP_PKEY *X509_REQ_get_pubkey(X509_REQ *req)
  112.   {
  113.       if (req == NULL)

crypto/x509/x509_req.c:113:9: Taking false branch
  111.   EVP_PKEY *X509_REQ_get_pubkey(X509_REQ *req)
  112.   {
  113.       if (req == NULL)
                 ^
  114.           return (NULL);
  115.       return (X509_PUBKEY_get(req->req_info.pubkey));

crypto/x509/x509_req.c:115:5: 
  113.       if (req == NULL)
  114.           return (NULL);
  115. >     return (X509_PUBKEY_get(req->req_info.pubkey));
  116.   }
  117.   

crypto/x509/x_pubkey.c:216:1: start of procedure X509_PUBKEY_get()
    214.   }
    215.   
    216. > EVP_PKEY *X509_PUBKEY_get(X509_PUBKEY *key)
    217.   {
    218.       EVP_PKEY *ret = X509_PUBKEY_get0(key);

crypto/x509/x_pubkey.c:218:5: Skipping X509_PUBKEY_get0(): empty list of specs
    216.   EVP_PKEY *X509_PUBKEY_get(X509_PUBKEY *key)
    217.   {
    218.       EVP_PKEY *ret = X509_PUBKEY_get0(key);
               ^
    219.       if (ret != NULL)
    220.           EVP_PKEY_up_ref(ret);

crypto/x509/x_pubkey.c:219:9: Taking false branch
    217.   {
    218.       EVP_PKEY *ret = X509_PUBKEY_get0(key);
    219.       if (ret != NULL)
                   ^
    220.           EVP_PKEY_up_ref(ret);
    221.       return ret;

crypto/x509/x_pubkey.c:221:5: 
    219.       if (ret != NULL)
    220.           EVP_PKEY_up_ref(ret);
    221. >     return ret;
    222.   }
    223.   

crypto/x509/x_pubkey.c:222:1: return from a call to X509_PUBKEY_get
    220.           EVP_PKEY_up_ref(ret);
    221.       return ret;
    222. > }
    223.   
    224.   /*

crypto/x509/x509_req.c:116:1: return from a call to X509_REQ_get_pubkey
  114.           return (NULL);
  115.       return (X509_PUBKEY_get(req->req_info.pubkey));
  116. > }
  117.   
  118.   EVP_PKEY *X509_REQ_get0_pubkey(X509_REQ *req)

crypto/x509/x509_req.c:136:5: 
134.   
135.       xk = X509_REQ_get_pubkey(x);
136. >     switch (EVP_PKEY_cmp(xk, k)) {
137.       case 1:
138.           ok = 1;

crypto/evp/p_lib.c:157:1: start of procedure EVP_PKEY_cmp()
  155.   }
  156.   
  157. > int EVP_PKEY_cmp(const EVP_PKEY *a, const EVP_PKEY *b)
  158.   {
  159.       if (a->type != b->type)

crypto/evp/p_lib.c:159:9: 
  157.   int EVP_PKEY_cmp(const EVP_PKEY *a, const EVP_PKEY *b)
  158.   {
  159. >     if (a->type != b->type)
  160.           return -1;
  161.   
