crypto/x509/x509_cmp.c:272: error: NULL_DEREFERENCE
  pointer `xk` last assigned on line 271 could be null and is dereferenced at line 272, column 6.
Showing all 69 steps of the trace


crypto/x509/x509_cmp.c:266:1: start of procedure X509_check_private_key()
264.   	}
265.   
266. > int X509_check_private_key(X509 *x, EVP_PKEY *k)
267.   	{
268.   	EVP_PKEY *xk=NULL;

crypto/x509/x509_cmp.c:268:2: 
266.   int X509_check_private_key(X509 *x, EVP_PKEY *k)
267.   	{
268. > 	EVP_PKEY *xk=NULL;
269.   	int ok=0;
270.   

crypto/x509/x509_cmp.c:269:2: 
267.   	{
268.   	EVP_PKEY *xk=NULL;
269. > 	int ok=0;
270.   
271.   	xk=X509_get_pubkey(x);

crypto/x509/x509_cmp.c:271:2: 
269.   	int ok=0;
270.   
271. > 	xk=X509_get_pubkey(x);
272.   	if (xk->type != k->type)
273.   	    {

crypto/x509/x509_cmp.c:253:1: start of procedure X509_get_pubkey()
  251.   	}
  252.   
  253. > EVP_PKEY *X509_get_pubkey(X509 *x)
  254.   	{
  255.   	if ((x == NULL) || (x->cert_info == NULL))

crypto/x509/x509_cmp.c:255:7: Taking false branch
  253.   EVP_PKEY *X509_get_pubkey(X509 *x)
  254.   	{
  255.   	if ((x == NULL) || (x->cert_info == NULL))
               ^
  256.   		return(NULL);
  257.   	return(X509_PUBKEY_get(x->cert_info->key));

crypto/x509/x509_cmp.c:255:22: Taking false branch
  253.   EVP_PKEY *X509_get_pubkey(X509 *x)
  254.   	{
  255.   	if ((x == NULL) || (x->cert_info == NULL))
                              ^
  256.   		return(NULL);
  257.   	return(X509_PUBKEY_get(x->cert_info->key));

crypto/x509/x509_cmp.c:257:2: 
  255.   	if ((x == NULL) || (x->cert_info == NULL))
  256.   		return(NULL);
  257. > 	return(X509_PUBKEY_get(x->cert_info->key));
  258.   	}
  259.   

crypto/asn1/x_pubkey.c:166:1: start of procedure X509_PUBKEY_get()
    164.   	}
    165.   
    166. > EVP_PKEY *X509_PUBKEY_get(X509_PUBKEY *key)
    167.   	{
    168.   	EVP_PKEY *ret=NULL;

crypto/asn1/x_pubkey.c:168:2: 
    166.   EVP_PKEY *X509_PUBKEY_get(X509_PUBKEY *key)
    167.   	{
    168. > 	EVP_PKEY *ret=NULL;
    169.   	long j;
    170.   	int type;

crypto/asn1/x_pubkey.c:177:6: Taking false branch
    175.   #endif
    176.   
    177.   	if (key == NULL) goto err;
                ^
    178.   
    179.   	if (key->pkey != NULL)

crypto/asn1/x_pubkey.c:179:6: Taking false branch
    177.   	if (key == NULL) goto err;
    178.   
    179.   	if (key->pkey != NULL)
                ^
    180.   	    {
    181.   	    CRYPTO_add(&key->pkey->references,1,CRYPTO_LOCK_EVP_PKEY);

crypto/asn1/x_pubkey.c:185:6: Taking false branch
    183.   	    }
    184.   
    185.   	if (key->public_key == NULL) goto err;
                ^
    186.   
    187.   	type=OBJ_obj2nid(key->algor->algorithm);

crypto/asn1/x_pubkey.c:187:2: 
    185.   	if (key->public_key == NULL) goto err;
    186.   
    187. > 	type=OBJ_obj2nid(key->algor->algorithm);
    188.   	p=key->public_key->data;
    189.           j=key->public_key->length;

crypto/objects/obj_dat.c:367:1: start of procedure OBJ_obj2nid()
      365.   	}
      366.   
      367. > int OBJ_obj2nid(const ASN1_OBJECT *a)
      368.   	{
      369.   	ASN1_OBJECT **op;

crypto/objects/obj_dat.c:372:6: Taking false branch
      370.   	ADDED_OBJ ad,*adp;
      371.   
      372.   	if (a == NULL)
                  ^
      373.   		return(NID_undef);
      374.   	if (a->nid != 0)

crypto/objects/obj_dat.c:374:6: Taking false branch
      372.   	if (a == NULL)
      373.   		return(NID_undef);
      374.   	if (a->nid != 0)
                  ^
      375.   		return(a->nid);
      376.   

crypto/objects/obj_dat.c:377:6: Taking true branch
      375.   		return(a->nid);
      376.   
      377.   	if (added != NULL)
                  ^
      378.   		{
      379.   		ad.type=ADDED_DATA;

crypto/objects/obj_dat.c:379:3: 
      377.   	if (added != NULL)
      378.   		{
      379. > 		ad.type=ADDED_DATA;
      380.   		ad.obj=(ASN1_OBJECT *)a; /* XXX: ugly but harmless */
      381.   		adp=(ADDED_OBJ *)lh_retrieve(added,&ad);

crypto/objects/obj_dat.c:380:3: 
      378.   		{
      379.   		ad.type=ADDED_DATA;
      380. > 		ad.obj=(ASN1_OBJECT *)a; /* XXX: ugly but harmless */
      381.   		adp=(ADDED_OBJ *)lh_retrieve(added,&ad);
      382.   		if (adp != NULL) return (adp->obj->nid);

crypto/objects/obj_dat.c:381:3: 
      379.   		ad.type=ADDED_DATA;
      380.   		ad.obj=(ASN1_OBJECT *)a; /* XXX: ugly but harmless */
      381. > 		adp=(ADDED_OBJ *)lh_retrieve(added,&ad);
      382.   		if (adp != NULL) return (adp->obj->nid);
      383.   		}

crypto/lhash/lhash.c:248:1: start of procedure lh_retrieve()
        246.   	}
        247.   
        248. > void *lh_retrieve(LHASH *lh, const void *data)
        249.   	{
        250.   	unsigned long hash;

crypto/lhash/lhash.c:254:2: 
        252.   	const void *ret;
        253.   
        254. > 	lh->error=0;
        255.   	rn=getrn(lh,data,&hash);
        256.   

crypto/lhash/lhash.c:255:2: Skipping getrn(): empty list of specs
        253.   
        254.   	lh->error=0;
        255.   	rn=getrn(lh,data,&hash);
                ^
        256.   
        257.   	if (*rn == NULL)

crypto/lhash/lhash.c:257:6: Taking false branch
        255.   	rn=getrn(lh,data,&hash);
        256.   
        257.   	if (*rn == NULL)
                    ^
        258.   		{
        259.   		lh->num_retrieve_miss++;

crypto/lhash/lhash.c:264:3: 
        262.   	else
        263.   		{
        264. > 		ret= (*rn)->data;
        265.   		lh->num_retrieve++;
        266.   		}

crypto/lhash/lhash.c:265:3: 
        263.   		{
        264.   		ret= (*rn)->data;
        265. > 		lh->num_retrieve++;
        266.   		}
        267.   	return((void *)ret);

crypto/lhash/lhash.c:267:2: 
        265.   		lh->num_retrieve++;
        266.   		}
        267. > 	return((void *)ret);
        268.   	}
        269.   

crypto/lhash/lhash.c:268:2: return from a call to lh_retrieve
        266.   		}
        267.   	return((void *)ret);
        268.   	}
                ^
        269.   
        270.   static void doall_util_fn(LHASH *lh, int use_arg, LHASH_DOALL_FN_TYPE func,

crypto/objects/obj_dat.c:382:7: Taking true branch
      380.   		ad.obj=(ASN1_OBJECT *)a; /* XXX: ugly but harmless */
      381.   		adp=(ADDED_OBJ *)lh_retrieve(added,&ad);
      382.   		if (adp != NULL) return (adp->obj->nid);
                   ^
      383.   		}
      384.   	op=(ASN1_OBJECT **)OBJ_bsearch((char *)&a,(char *)obj_objs,NUM_OBJ,

crypto/objects/obj_dat.c:382:20: 
      380.   		ad.obj=(ASN1_OBJECT *)a; /* XXX: ugly but harmless */
      381.   		adp=(ADDED_OBJ *)lh_retrieve(added,&ad);
      382. > 		if (adp != NULL) return (adp->obj->nid);
      383.   		}
      384.   	op=(ASN1_OBJECT **)OBJ_bsearch((char *)&a,(char *)obj_objs,NUM_OBJ,

crypto/objects/obj_dat.c:389:2: return from a call to OBJ_obj2nid
      387.   		return(NID_undef);
      388.   	return((*op)->nid);
      389.   	}
              ^
      390.   
      391.   /* Convert an object name into an ASN1_OBJECT

crypto/asn1/x_pubkey.c:188:2: 
    186.   
    187.   	type=OBJ_obj2nid(key->algor->algorithm);
    188. > 	p=key->public_key->data;
    189.           j=key->public_key->length;
    190.           if ((ret=d2i_PublicKey(type,NULL,&p,(long)j)) == NULL)

crypto/asn1/x_pubkey.c:189:9: 
    187.   	type=OBJ_obj2nid(key->algor->algorithm);
    188.   	p=key->public_key->data;
    189. >         j=key->public_key->length;
    190.           if ((ret=d2i_PublicKey(type,NULL,&p,(long)j)) == NULL)
    191.   		{

crypto/asn1/x_pubkey.c:190:13: 
    188.   	p=key->public_key->data;
    189.           j=key->public_key->length;
    190. >         if ((ret=d2i_PublicKey(type,NULL,&p,(long)j)) == NULL)
    191.   		{
    192.   		X509err(X509_F_X509_PUBKEY_GET,X509_R_ERR_ASN1_LIB);

crypto/asn1/d2i_pu.c:68:1: start of procedure d2i_PublicKey()
      66.   #include <openssl/dsa.h>
      67.   
      68. > EVP_PKEY *d2i_PublicKey(int type, EVP_PKEY **a, unsigned char **pp,
      69.   	     long length)
      70.   	{

crypto/asn1/d2i_pu.c:73:7: Taking true branch
      71.   	EVP_PKEY *ret;
      72.   
      73.   	if ((a == NULL) || (*a == NULL))
                  ^
      74.   		{
      75.   		if ((ret=EVP_PKEY_new()) == NULL)

crypto/asn1/d2i_pu.c:75:7: Taking true branch
      73.   	if ((a == NULL) || (*a == NULL))
      74.   		{
      75.   		if ((ret=EVP_PKEY_new()) == NULL)
                  ^
      76.   			{
      77.   			ASN1err(ASN1_F_D2I_PUBLICKEY,ERR_R_EVP_LIB);

crypto/asn1/d2i_pu.c:77:4: 
      75.   		if ((ret=EVP_PKEY_new()) == NULL)
      76.   			{
      77. > 			ASN1err(ASN1_F_D2I_PUBLICKEY,ERR_R_EVP_LIB);
      78.   			return(NULL);
      79.   			}

crypto/err/err.c:357:1: start of procedure ERR_put_error()
        355.   /********************************************************/
        356.   
        357. > void ERR_put_error(int lib, int func, int reason, const char *file,
        358.   	     int line)
        359.   	{

crypto/err/err.c:381:2: Skipping ERR_get_state(): empty list of specs
        379.   	}
        380.   #endif
        381.   	es=ERR_get_state();
                ^
        382.   
        383.   	es->top=(es->top+1)%ERR_NUM_ERRORS;

crypto/err/err.c:383:2: 
        381.   	es=ERR_get_state();
        382.   
        383. > 	es->top=(es->top+1)%ERR_NUM_ERRORS;
        384.   	if (es->top == es->bottom)
        385.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;

crypto/err/err.c:384:6: Taking false branch
        382.   
        383.   	es->top=(es->top+1)%ERR_NUM_ERRORS;
        384.   	if (es->top == es->bottom)
                    ^
        385.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
        386.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);

crypto/err/err.c:386:2: 
        384.   	if (es->top == es->bottom)
        385.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
        386. > 	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
        387.   	es->err_file[es->top]=file;
        388.   	es->err_line[es->top]=line;

crypto/err/err.c:387:2: 
        385.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
        386.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
        387. > 	es->err_file[es->top]=file;
        388.   	es->err_line[es->top]=line;
        389.   	err_clear_data(es,es->top);

crypto/err/err.c:388:2: 
        386.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
        387.   	es->err_file[es->top]=file;
        388. > 	es->err_line[es->top]=line;
        389.   	err_clear_data(es,es->top);
        390.   	}

crypto/err/err.c:389:2: Taking true branch
        387.   	es->err_file[es->top]=file;
        388.   	es->err_line[es->top]=line;
        389.   	err_clear_data(es,es->top);
                ^
        390.   	}
        391.   

crypto/err/err.c:389:2: Taking false branch
        387.   	es->err_file[es->top]=file;
        388.   	es->err_line[es->top]=line;
        389.   	err_clear_data(es,es->top);
                ^
        390.   	}
        391.   

crypto/err/err.c:390:2: return from a call to ERR_put_error
        388.   	es->err_line[es->top]=line;
        389.   	err_clear_data(es,es->top);
        390.   	}
                ^
        391.   
        392.   void ERR_clear_error(void)

crypto/asn1/d2i_pu.c:78:4: 
      76.   			{
      77.   			ASN1err(ASN1_F_D2I_PUBLICKEY,ERR_R_EVP_LIB);
      78. > 			return(NULL);
      79.   			}
      80.   		}

crypto/asn1/d2i_pu.c:117:2: return from a call to d2i_PublicKey
      115.   	if ((ret != NULL) && ((a == NULL) || (*a != ret))) EVP_PKEY_free(ret);
      116.   	return(NULL);
      117.   	}
              ^
      118.   

crypto/asn1/x_pubkey.c:190:13: Taking true branch
    188.   	p=key->public_key->data;
    189.           j=key->public_key->length;
    190.           if ((ret=d2i_PublicKey(type,NULL,&p,(long)j)) == NULL)
                       ^
    191.   		{
    192.   		X509err(X509_F_X509_PUBKEY_GET,X509_R_ERR_ASN1_LIB);

crypto/asn1/x_pubkey.c:192:3: 
    190.           if ((ret=d2i_PublicKey(type,NULL,&p,(long)j)) == NULL)
    191.   		{
    192. > 		X509err(X509_F_X509_PUBKEY_GET,X509_R_ERR_ASN1_LIB);
    193.   		goto err;
    194.   		}

crypto/err/err.c:357:1: start of procedure ERR_put_error()
      355.   /********************************************************/
      356.   
      357. > void ERR_put_error(int lib, int func, int reason, const char *file,
      358.   	     int line)
      359.   	{

crypto/err/err.c:381:2: Skipping ERR_get_state(): empty list of specs
      379.   	}
      380.   #endif
      381.   	es=ERR_get_state();
              ^
      382.   
      383.   	es->top=(es->top+1)%ERR_NUM_ERRORS;

crypto/err/err.c:383:2: 
      381.   	es=ERR_get_state();
      382.   
      383. > 	es->top=(es->top+1)%ERR_NUM_ERRORS;
      384.   	if (es->top == es->bottom)
      385.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;

crypto/err/err.c:384:6: Taking false branch
      382.   
      383.   	es->top=(es->top+1)%ERR_NUM_ERRORS;
      384.   	if (es->top == es->bottom)
                  ^
      385.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
      386.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);

crypto/err/err.c:386:2: 
      384.   	if (es->top == es->bottom)
      385.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
      386. > 	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
      387.   	es->err_file[es->top]=file;
      388.   	es->err_line[es->top]=line;

crypto/err/err.c:387:2: 
      385.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
      386.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
      387. > 	es->err_file[es->top]=file;
      388.   	es->err_line[es->top]=line;
      389.   	err_clear_data(es,es->top);

crypto/err/err.c:388:2: 
      386.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
      387.   	es->err_file[es->top]=file;
      388. > 	es->err_line[es->top]=line;
      389.   	err_clear_data(es,es->top);
      390.   	}

crypto/err/err.c:389:2: Taking true branch
      387.   	es->err_file[es->top]=file;
      388.   	es->err_line[es->top]=line;
      389.   	err_clear_data(es,es->top);
              ^
      390.   	}
      391.   

crypto/err/err.c:389:2: Taking false branch
      387.   	es->err_file[es->top]=file;
      388.   	es->err_line[es->top]=line;
      389.   	err_clear_data(es,es->top);
              ^
      390.   	}
      391.   

crypto/err/err.c:390:2: return from a call to ERR_put_error
      388.   	es->err_line[es->top]=line;
      389.   	err_clear_data(es,es->top);
      390.   	}
              ^
      391.   
      392.   void ERR_clear_error(void)

crypto/asn1/x_pubkey.c:215:1: 
    213.   	CRYPTO_add(&ret->references,1,CRYPTO_LOCK_EVP_PKEY);
    214.   	return(ret);
    215. > err:
    216.   	if (ret != NULL)
    217.   		EVP_PKEY_free(ret);

crypto/asn1/x_pubkey.c:216:6: Taking false branch
    214.   	return(ret);
    215.   err:
    216.   	if (ret != NULL)
                ^
    217.   		EVP_PKEY_free(ret);
    218.   	return(NULL);

crypto/asn1/x_pubkey.c:218:2: 
    216.   	if (ret != NULL)
    217.   		EVP_PKEY_free(ret);
    218. > 	return(NULL);
    219.   	}
    220.   

crypto/asn1/x_pubkey.c:219:2: return from a call to X509_PUBKEY_get
    217.   		EVP_PKEY_free(ret);
    218.   	return(NULL);
    219.   	}
            ^
    220.   
    221.   /* Now two pseudo ASN1 routines that take an EVP_PKEY structure

crypto/x509/x509_cmp.c:258:2: return from a call to X509_get_pubkey
  256.   		return(NULL);
  257.   	return(X509_PUBKEY_get(x->cert_info->key));
  258.   	}
          ^
  259.   
  260.   ASN1_BIT_STRING *X509_get0_pubkey_bitstr(const X509 *x)

crypto/x509/x509_cmp.c:272:6: 
270.   
271.   	xk=X509_get_pubkey(x);
272. > 	if (xk->type != k->type)
273.   	    {
274.   	    X509err(X509_F_X509_CHECK_PRIVATE_KEY,X509_R_KEY_TYPE_MISMATCH);
