ssl/s3_srvr.c:2102: error: NULL_DEREFERENCE
  pointer `clnt_pub_pkey` last assigned on line 1613 could be null and is dereferenced by call to `EVP_PKEY_free()` at line 2102, column 2.
Showing all 39 steps of the trace


ssl/s3_srvr.c:1593:1: start of procedure ssl3_get_client_key_exchange()
1591.   	}
1592.   
1593. > static int ssl3_get_client_key_exchange(SSL *s)
1594.   	{
1595.   	int i,al,ok;

ssl/s3_srvr.c:1600:2: 
1598.   	unsigned char *p;
1599.   #ifndef OPENSSL_NO_RSA
1600. > 	RSA *rsa=NULL;
1601.   	EVP_PKEY *pkey=NULL;
1602.   #endif

ssl/s3_srvr.c:1601:2: 
1599.   #ifndef OPENSSL_NO_RSA
1600.   	RSA *rsa=NULL;
1601. > 	EVP_PKEY *pkey=NULL;
1602.   #endif
1603.   #ifndef OPENSSL_NO_DH

ssl/s3_srvr.c:1604:2: 
1602.   #endif
1603.   #ifndef OPENSSL_NO_DH
1604. > 	BIGNUM *pub=NULL;
1605.   	DH *dh_srvr;
1606.   #endif

ssl/s3_srvr.c:1612:2: 
1610.   
1611.   #ifndef OPENSSL_NO_ECDH
1612. > 	EC_KEY *srvr_ecdh = NULL;
1613.   	EVP_PKEY *clnt_pub_pkey = NULL;
1614.   	EC_POINT *clnt_ecpoint = NULL;

ssl/s3_srvr.c:1613:2: 
1611.   #ifndef OPENSSL_NO_ECDH
1612.   	EC_KEY *srvr_ecdh = NULL;
1613. > 	EVP_PKEY *clnt_pub_pkey = NULL;
1614.   	EC_POINT *clnt_ecpoint = NULL;
1615.   	BN_CTX *bn_ctx = NULL; 

ssl/s3_srvr.c:1614:2: 
1612.   	EC_KEY *srvr_ecdh = NULL;
1613.   	EVP_PKEY *clnt_pub_pkey = NULL;
1614. > 	EC_POINT *clnt_ecpoint = NULL;
1615.   	BN_CTX *bn_ctx = NULL; 
1616.   #endif

ssl/s3_srvr.c:1615:2: 
1613.   	EVP_PKEY *clnt_pub_pkey = NULL;
1614.   	EC_POINT *clnt_ecpoint = NULL;
1615. > 	BN_CTX *bn_ctx = NULL; 
1616.   #endif
1617.   

ssl/s3_srvr.c:1618:2: Skipping ssl3_get_message(): empty list of specs
1616.   #endif
1617.   
1618.   	n=ssl3_get_message(s,
         ^
1619.   		SSL3_ST_SR_KEY_EXCH_A,
1620.   		SSL3_ST_SR_KEY_EXCH_B,

ssl/s3_srvr.c:1625:7: Taking false branch
1623.   		&ok);
1624.   
1625.   	if (!ok) return((int)n);
              ^
1626.   	p=(unsigned char *)s->init_msg;
1627.   

ssl/s3_srvr.c:1626:2: 
1624.   
1625.   	if (!ok) return((int)n);
1626. > 	p=(unsigned char *)s->init_msg;
1627.   
1628.   	l=s->s3->tmp.new_cipher->algorithms;

ssl/s3_srvr.c:1628:2: 
1626.   	p=(unsigned char *)s->init_msg;
1627.   
1628. > 	l=s->s3->tmp.new_cipher->algorithms;
1629.   
1630.   #ifndef OPENSSL_NO_RSA

ssl/s3_srvr.c:1631:6: Taking false branch
1629.   
1630.   #ifndef OPENSSL_NO_RSA
1631.   	if (l & SSL_kRSA)
             ^
1632.   		{
1633.   		/* FIX THIS UP EAY EAY EAY EAY */

ssl/s3_srvr.c:1736:7: Taking true branch
1734.   #endif
1735.   #ifndef OPENSSL_NO_DH
1736.   		if (l & (SSL_kEDH|SSL_kDHr|SSL_kDHd))
              ^
1737.   		{
1738.   		n2s(p,i);

ssl/s3_srvr.c:1738:3: 
1736.   		if (l & (SSL_kEDH|SSL_kDHr|SSL_kDHd))
1737.   		{
1738. > 		n2s(p,i);
1739.   		if (n != i+2)
1740.   			{

ssl/s3_srvr.c:1739:7: Taking false branch
1737.   		{
1738.   		n2s(p,i);
1739.   		if (n != i+2)
              ^
1740.   			{
1741.   			if (!(s->options & SSL_OP_SSLEAY_080_CLIENT_DH_BUG))

ssl/s3_srvr.c:1753:7: Taking false branch
1751.   			}
1752.   
1753.   		if (n == 0L) /* the parameters are in the cert */
              ^
1754.   			{
1755.   			al=SSL_AD_HANDSHAKE_FAILURE;

ssl/s3_srvr.c:1761:8: Taking false branch
1759.   		else
1760.   			{
1761.   			if (s->s3->tmp.dh == NULL)
               ^
1762.   				{
1763.   				al=SSL_AD_HANDSHAKE_FAILURE;

ssl/s3_srvr.c:1768:5: 
1766.   				}
1767.   			else
1768. > 				dh_srvr=s->s3->tmp.dh;
1769.   			}
1770.   

ssl/s3_srvr.c:1771:3: Skipping BN_bin2bn(): empty list of specs
1769.   			}
1770.   
1771.   		pub=BN_bin2bn(p,i,NULL);
          ^
1772.   		if (pub == NULL)
1773.   			{

ssl/s3_srvr.c:1772:7: Taking false branch
1770.   
1771.   		pub=BN_bin2bn(p,i,NULL);
1772.   		if (pub == NULL)
              ^
1773.   			{
1774.   			SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,SSL_R_BN_LIB);

ssl/s3_srvr.c:1778:3: 
1776.   			}
1777.   
1778. > 		i=DH_compute_key(p,pub,dh_srvr);
1779.   
1780.   		if (i <= 0)

crypto/dh/dh_key.c:82:1: start of procedure DH_compute_key()
  80.   	}
  81.   
  82. > int DH_compute_key(unsigned char *key, const BIGNUM *pub_key, DH *dh)
  83.   	{
  84.   	return dh->meth->compute_key(key, pub_key, dh);

crypto/dh/dh_key.c:84:2: Skipping __function_pointer__(): unresolved function pointer
  82.   int DH_compute_key(unsigned char *key, const BIGNUM *pub_key, DH *dh)
  83.   	{
  84.   	return dh->meth->compute_key(key, pub_key, dh);
         ^
  85.   	}
  86.   

crypto/dh/dh_key.c:85:2: return from a call to DH_compute_key
  83.   	{
  84.   	return dh->meth->compute_key(key, pub_key, dh);
  85.   	}
         ^
  86.   
  87.   static DH_METHOD dh_ossl = {

ssl/s3_srvr.c:1780:7: Taking true branch
1778.   		i=DH_compute_key(p,pub,dh_srvr);
1779.   
1780.   		if (i <= 0)
              ^
1781.   			{
1782.   			SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,ERR_R_DH_LIB);

ssl/s3_srvr.c:1782:4: 
1780.   		if (i <= 0)
1781.   			{
1782. > 			SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,ERR_R_DH_LIB);
1783.   			goto err;
1784.   			}

crypto/err/err.c:619:1: start of procedure ERR_put_error()
  617.   /********************************************************/
  618.   
  619. > void ERR_put_error(int lib, int func, int reason, const char *file,
  620.   	     int line)
  621.   	{

crypto/err/err.c:643:2: Skipping ERR_get_state(): empty list of specs
  641.   	}
  642.   #endif
  643.   	es=ERR_get_state();
          ^
  644.   
  645.   	es->top=(es->top+1)%ERR_NUM_ERRORS;

crypto/err/err.c:645:2: 
  643.   	es=ERR_get_state();
  644.   
  645. > 	es->top=(es->top+1)%ERR_NUM_ERRORS;
  646.   	if (es->top == es->bottom)
  647.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;

crypto/err/err.c:646:6: Taking false branch
  644.   
  645.   	es->top=(es->top+1)%ERR_NUM_ERRORS;
  646.   	if (es->top == es->bottom)
              ^
  647.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
  648.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);

crypto/err/err.c:648:2: 
  646.   	if (es->top == es->bottom)
  647.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
  648. > 	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
  649.   	es->err_file[es->top]=file;
  650.   	es->err_line[es->top]=line;

crypto/err/err.c:649:2: 
  647.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
  648.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
  649. > 	es->err_file[es->top]=file;
  650.   	es->err_line[es->top]=line;
  651.   	err_clear_data(es,es->top);

crypto/err/err.c:650:2: 
  648.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
  649.   	es->err_file[es->top]=file;
  650. > 	es->err_line[es->top]=line;
  651.   	err_clear_data(es,es->top);
  652.   	}

crypto/err/err.c:651:2: Taking true branch
  649.   	es->err_file[es->top]=file;
  650.   	es->err_line[es->top]=line;
  651.   	err_clear_data(es,es->top);
          ^
  652.   	}
  653.   

crypto/err/err.c:651:2: Taking false branch
  649.   	es->err_file[es->top]=file;
  650.   	es->err_line[es->top]=line;
  651.   	err_clear_data(es,es->top);
          ^
  652.   	}
  653.   

crypto/err/err.c:652:2: return from a call to ERR_put_error
  650.   	es->err_line[es->top]=line;
  651.   	err_clear_data(es,es->top);
  652.   	}
          ^
  653.   
  654.   void ERR_clear_error(void)

ssl/s3_srvr.c:2099:1: 
2097.   	ssl3_send_alert(s,SSL3_AL_FATAL,al);
2098.   #if !defined(OPENSSL_NO_DH) || !defined(OPENSSL_NO_RSA) || !defined(OPENSSL_NO_ECDH)
2099. > err:
2100.   #endif
2101.   #ifndef OPENSSL_NO_ECDH

ssl/s3_srvr.c:2102:2: 
2100.   #endif
2101.   #ifndef OPENSSL_NO_ECDH
2102. > 	EVP_PKEY_free(clnt_pub_pkey);
2103.   	EC_POINT_free(clnt_ecpoint);
2104.   	if (srvr_ecdh != NULL) 
