ssl/s3_srvr.c:2123: error: NULL_DEREFERENCE
  pointer `clnt_pub_pkey` last assigned on line 1619 could be null and is dereferenced by call to `EVP_PKEY_free()` at line 2123, column 2.
Showing all 41 steps of the trace


ssl/s3_srvr.c:1599:1: start of procedure ssl3_get_client_key_exchange()
1597.   	}
1598.   
1599. > static int ssl3_get_client_key_exchange(SSL *s)
1600.   	{
1601.   	int i,al,ok;

ssl/s3_srvr.c:1606:2: 
1604.   	unsigned char *p;
1605.   #ifndef OPENSSL_NO_RSA
1606. > 	RSA *rsa=NULL;
1607.   	EVP_PKEY *pkey=NULL;
1608.   #endif

ssl/s3_srvr.c:1607:2: 
1605.   #ifndef OPENSSL_NO_RSA
1606.   	RSA *rsa=NULL;
1607. > 	EVP_PKEY *pkey=NULL;
1608.   #endif
1609.   #ifndef OPENSSL_NO_DH

ssl/s3_srvr.c:1610:2: 
1608.   #endif
1609.   #ifndef OPENSSL_NO_DH
1610. > 	BIGNUM *pub=NULL;
1611.   	DH *dh_srvr;
1612.   #endif

ssl/s3_srvr.c:1618:2: 
1616.   
1617.   #ifndef OPENSSL_NO_ECDH
1618. > 	EC_KEY *srvr_ecdh = NULL;
1619.   	EVP_PKEY *clnt_pub_pkey = NULL;
1620.   	EC_POINT *clnt_ecpoint = NULL;

ssl/s3_srvr.c:1619:2: 
1617.   #ifndef OPENSSL_NO_ECDH
1618.   	EC_KEY *srvr_ecdh = NULL;
1619. > 	EVP_PKEY *clnt_pub_pkey = NULL;
1620.   	EC_POINT *clnt_ecpoint = NULL;
1621.   	BN_CTX *bn_ctx = NULL; 

ssl/s3_srvr.c:1620:2: 
1618.   	EC_KEY *srvr_ecdh = NULL;
1619.   	EVP_PKEY *clnt_pub_pkey = NULL;
1620. > 	EC_POINT *clnt_ecpoint = NULL;
1621.   	BN_CTX *bn_ctx = NULL; 
1622.   #endif

ssl/s3_srvr.c:1621:2: 
1619.   	EVP_PKEY *clnt_pub_pkey = NULL;
1620.   	EC_POINT *clnt_ecpoint = NULL;
1621. > 	BN_CTX *bn_ctx = NULL; 
1622.   #endif
1623.   

ssl/s3_srvr.c:1624:2: Skipping ssl3_get_message(): empty list of specs
1622.   #endif
1623.   
1624.   	n=ssl3_get_message(s,
         ^
1625.   		SSL3_ST_SR_KEY_EXCH_A,
1626.   		SSL3_ST_SR_KEY_EXCH_B,

ssl/s3_srvr.c:1631:7: Taking false branch
1629.   		&ok);
1630.   
1631.   	if (!ok) return((int)n);
              ^
1632.   	p=(unsigned char *)s->init_msg;
1633.   

ssl/s3_srvr.c:1632:2: 
1630.   
1631.   	if (!ok) return((int)n);
1632. > 	p=(unsigned char *)s->init_msg;
1633.   
1634.   	l=s->s3->tmp.new_cipher->algorithms;

ssl/s3_srvr.c:1634:2: 
1632.   	p=(unsigned char *)s->init_msg;
1633.   
1634. > 	l=s->s3->tmp.new_cipher->algorithms;
1635.   
1636.   #ifndef OPENSSL_NO_RSA

ssl/s3_srvr.c:1637:6: Taking false branch
1635.   
1636.   #ifndef OPENSSL_NO_RSA
1637.   	if (l & SSL_kRSA)
             ^
1638.   		{
1639.   		/* FIX THIS UP EAY EAY EAY EAY */

ssl/s3_srvr.c:1742:7: Taking true branch
1740.   #endif
1741.   #ifndef OPENSSL_NO_DH
1742.   		if (l & (SSL_kEDH|SSL_kDHr|SSL_kDHd))
              ^
1743.   		{
1744.   		n2s(p,i);

ssl/s3_srvr.c:1744:3: 
1742.   		if (l & (SSL_kEDH|SSL_kDHr|SSL_kDHd))
1743.   		{
1744. > 		n2s(p,i);
1745.   		if (n != i+2)
1746.   			{

ssl/s3_srvr.c:1745:7: Taking false branch
1743.   		{
1744.   		n2s(p,i);
1745.   		if (n != i+2)
              ^
1746.   			{
1747.   			if (!(s->options & SSL_OP_SSLEAY_080_CLIENT_DH_BUG))

ssl/s3_srvr.c:1759:7: Taking false branch
1757.   			}
1758.   
1759.   		if (n == 0L) /* the parameters are in the cert */
              ^
1760.   			{
1761.   			al=SSL_AD_HANDSHAKE_FAILURE;

ssl/s3_srvr.c:1767:8: Taking false branch
1765.   		else
1766.   			{
1767.   			if (s->s3->tmp.dh == NULL)
               ^
1768.   				{
1769.   				al=SSL_AD_HANDSHAKE_FAILURE;

ssl/s3_srvr.c:1774:5: 
1772.   				}
1773.   			else
1774. > 				dh_srvr=s->s3->tmp.dh;
1775.   			}
1776.   

ssl/s3_srvr.c:1777:3: Skipping BN_bin2bn(): empty list of specs
1775.   			}
1776.   
1777.   		pub=BN_bin2bn(p,i,NULL);
          ^
1778.   		if (pub == NULL)
1779.   			{

ssl/s3_srvr.c:1778:7: Taking false branch
1776.   
1777.   		pub=BN_bin2bn(p,i,NULL);
1778.   		if (pub == NULL)
              ^
1779.   			{
1780.   			SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,SSL_R_BN_LIB);

ssl/s3_srvr.c:1784:3: 
1782.   			}
1783.   
1784. > 		i=DH_compute_key(p,pub,dh_srvr);
1785.   
1786.   		if (i <= 0)

crypto/dh/dh_key.c:79:1: start of procedure DH_compute_key()
  77.   	}
  78.   
  79. > int DH_compute_key(unsigned char *key, const BIGNUM *pub_key, DH *dh)
  80.   	{
  81.   	return dh->meth->compute_key(key, pub_key, dh);

crypto/dh/dh_key.c:81:2: Skipping __function_pointer__(): unresolved function pointer
  79.   int DH_compute_key(unsigned char *key, const BIGNUM *pub_key, DH *dh)
  80.   	{
  81.   	return dh->meth->compute_key(key, pub_key, dh);
         ^
  82.   	}
  83.   

crypto/dh/dh_key.c:82:2: return from a call to DH_compute_key
  80.   	{
  81.   	return dh->meth->compute_key(key, pub_key, dh);
  82.   	}
         ^
  83.   
  84.   static DH_METHOD dh_ossl = {

ssl/s3_srvr.c:1786:7: Taking true branch
1784.   		i=DH_compute_key(p,pub,dh_srvr);
1785.   
1786.   		if (i <= 0)
              ^
1787.   			{
1788.   			SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,ERR_R_DH_LIB);

ssl/s3_srvr.c:1788:4: 
1786.   		if (i <= 0)
1787.   			{
1788. > 			SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,ERR_R_DH_LIB);
1789.   			goto err;
1790.   			}

crypto/err/err.c:664:1: start of procedure ERR_put_error()
  662.   /********************************************************/
  663.   
  664. > void ERR_put_error(int lib, int func, int reason, const char *file,
  665.   	     int line)
  666.   	{

crypto/err/err.c:688:2: Skipping ERR_get_state(): empty list of specs
  686.   	}
  687.   #endif
  688.   	es=ERR_get_state();
          ^
  689.   
  690.   	es->top=(es->top+1)%ERR_NUM_ERRORS;

crypto/err/err.c:690:2: 
  688.   	es=ERR_get_state();
  689.   
  690. > 	es->top=(es->top+1)%ERR_NUM_ERRORS;
  691.   	if (es->top == es->bottom)
  692.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;

crypto/err/err.c:691:6: Taking false branch
  689.   
  690.   	es->top=(es->top+1)%ERR_NUM_ERRORS;
  691.   	if (es->top == es->bottom)
              ^
  692.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
  693.   	es->err_flags[es->top]=0;

crypto/err/err.c:693:2: 
  691.   	if (es->top == es->bottom)
  692.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
  693. > 	es->err_flags[es->top]=0;
  694.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
  695.   	es->err_file[es->top]=file;

crypto/err/err.c:694:2: 
  692.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
  693.   	es->err_flags[es->top]=0;
  694. > 	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
  695.   	es->err_file[es->top]=file;
  696.   	es->err_line[es->top]=line;

crypto/err/err.c:695:2: 
  693.   	es->err_flags[es->top]=0;
  694.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
  695. > 	es->err_file[es->top]=file;
  696.   	es->err_line[es->top]=line;
  697.   	err_clear_data(es,es->top);

crypto/err/err.c:696:2: 
  694.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
  695.   	es->err_file[es->top]=file;
  696. > 	es->err_line[es->top]=line;
  697.   	err_clear_data(es,es->top);
  698.   	}

crypto/err/err.c:697:2: Taking true branch
  695.   	es->err_file[es->top]=file;
  696.   	es->err_line[es->top]=line;
  697.   	err_clear_data(es,es->top);
          ^
  698.   	}
  699.   

crypto/err/err.c:697:2: Taking false branch
  695.   	es->err_file[es->top]=file;
  696.   	es->err_line[es->top]=line;
  697.   	err_clear_data(es,es->top);
          ^
  698.   	}
  699.   

crypto/err/err.c:697:2: Loop condition is false. Leaving loop
  695.   	es->err_file[es->top]=file;
  696.   	es->err_line[es->top]=line;
  697.   	err_clear_data(es,es->top);
          ^
  698.   	}
  699.   

crypto/err/err.c:698:2: return from a call to ERR_put_error
  696.   	es->err_line[es->top]=line;
  697.   	err_clear_data(es,es->top);
  698.   	}
          ^
  699.   
  700.   void ERR_clear_error(void)

ssl/s3_srvr.c:2120:1: 
2118.   	ssl3_send_alert(s,SSL3_AL_FATAL,al);
2119.   #if !defined(OPENSSL_NO_DH) || !defined(OPENSSL_NO_RSA) || !defined(OPENSSL_NO_ECDH)
2120. > err:
2121.   #endif
2122.   #ifndef OPENSSL_NO_ECDH

ssl/s3_srvr.c:2123:2: 
2121.   #endif
2122.   #ifndef OPENSSL_NO_ECDH
2123. > 	EVP_PKEY_free(clnt_pub_pkey);
2124.   	EC_POINT_free(clnt_ecpoint);
2125.   	if (srvr_ecdh != NULL) 
