Sorry for the delay in looking at this. It appears that the function has
evolved quite a bit, and I cannot find a code path where cpk is not set. If i'm
wrong, please re-open the ticket with some more info. Thanks.
--
Ticket here: http://rt.openssl.org/Ticket/Display.html?id=3680
Please log in as
Hello,
Our UC-KLEE tool found a NULL pointer dereference bug in tls1_check_chain
(ssl/t1_lib.c) affecting OpenSSL 1.0.2. The bug appears to have been introduced
in commit 6660baee66e474058229911950e26e56f31fb0bf (12/26/2012).
The bug is triggered if either of the “goto end” statements are taken
