test/testutil/tests.c:412: error: NULL_DEREFERENCE
  pointer `aa` last assigned on line 411 could be null and is dereferenced by call to `BN_set_negative()` at line 412, column 5.
Showing all 28 steps of the trace


test/testutil/tests.c:403:1: start of procedure test_BN_abs_eq_word()
401.   }
402.   
403. > int test_BN_abs_eq_word(const char *file, int line, const char *bns,
404.                           const char *ws, const BIGNUM *a, BN_ULONG w)
405.   {

test/testutil/tests.c:408:9: Taking true branch
406.       BIGNUM *bw, *aa;
407.   
408.       if (a != NULL && BN_abs_is_word(a, w))
               ^
409.           return 1;
410.       bw = BN_new();

test/testutil/tests.c:408:22: 
406.       BIGNUM *bw, *aa;
407.   
408. >     if (a != NULL && BN_abs_is_word(a, w))
409.           return 1;
410.       bw = BN_new();

crypto/bn/bn_lib.c:839:1: start of procedure BN_abs_is_word()
  837.   }
  838.   
  839. > int BN_abs_is_word(const BIGNUM *a, const BN_ULONG w)
  840.   {
  841.       return ((a->top == 1) && (a->d[0] == w)) || ((w == 0) && (a->top == 0));

crypto/bn/bn_lib.c:841:14: Condition is true
  839.   int BN_abs_is_word(const BIGNUM *a, const BN_ULONG w)
  840.   {
  841.       return ((a->top == 1) && (a->d[0] == w)) || ((w == 0) && (a->top == 0));
                      ^
  842.   }
  843.   

crypto/bn/bn_lib.c:841:31: Condition is false
  839.   int BN_abs_is_word(const BIGNUM *a, const BN_ULONG w)
  840.   {
  841.       return ((a->top == 1) && (a->d[0] == w)) || ((w == 0) && (a->top == 0));
                                       ^
  842.   }
  843.   

crypto/bn/bn_lib.c:841:51: Condition is false
  839.   int BN_abs_is_word(const BIGNUM *a, const BN_ULONG w)
  840.   {
  841.       return ((a->top == 1) && (a->d[0] == w)) || ((w == 0) && (a->top == 0));
                                                           ^
  842.   }
  843.   

crypto/bn/bn_lib.c:841:12: 
  839.   int BN_abs_is_word(const BIGNUM *a, const BN_ULONG w)
  840.   {
  841. >     return ((a->top == 1) && (a->d[0] == w)) || ((w == 0) && (a->top == 0));
  842.   }
  843.   

crypto/bn/bn_lib.c:841:5: 
  839.   int BN_abs_is_word(const BIGNUM *a, const BN_ULONG w)
  840.   {
  841. >     return ((a->top == 1) && (a->d[0] == w)) || ((w == 0) && (a->top == 0));
  842.   }
  843.   

crypto/bn/bn_lib.c:842:1: return from a call to BN_abs_is_word
  840.   {
  841.       return ((a->top == 1) && (a->d[0] == w)) || ((w == 0) && (a->top == 0));
  842. > }
  843.   
  844.   int BN_is_zero(const BIGNUM *a)

test/testutil/tests.c:408:22: Taking false branch
406.       BIGNUM *bw, *aa;
407.   
408.       if (a != NULL && BN_abs_is_word(a, w))
                            ^
409.           return 1;
410.       bw = BN_new();

test/testutil/tests.c:410:5: Skipping BN_new(): empty list of specs
408.       if (a != NULL && BN_abs_is_word(a, w))
409.           return 1;
410.       bw = BN_new();
           ^
411.       aa = BN_dup(a);
412.       BN_set_negative(aa, 0);

test/testutil/tests.c:411:5: 
409.           return 1;
410.       bw = BN_new();
411. >     aa = BN_dup(a);
412.       BN_set_negative(aa, 0);
413.       BN_set_word(bw, w);

crypto/bn/bn_lib.c:293:1: start of procedure BN_dup()
  291.   }
  292.   
  293. > BIGNUM *BN_dup(const BIGNUM *a)
  294.   {
  295.       BIGNUM *t;

crypto/bn/bn_lib.c:297:9: Taking false branch
  295.       BIGNUM *t;
  296.   
  297.       if (a == NULL)
                 ^
  298.           return NULL;
  299.       bn_check_top(a);

crypto/bn/bn_lib.c:301:9: 
  299.       bn_check_top(a);
  300.   
  301. >     t = BN_get_flags(a, BN_FLG_SECURE) ? BN_secure_new() : BN_new();
  302.       if (t == NULL)
  303.           return NULL;

crypto/bn/bn_lib.c:910:1: start of procedure BN_get_flags()
    908.   }
    909.   
    910. > int BN_get_flags(const BIGNUM *b, int n)
    911.   {
    912.       return b->flags & n;

crypto/bn/bn_lib.c:912:5: 
    910.   int BN_get_flags(const BIGNUM *b, int n)
    911.   {
    912. >     return b->flags & n;
    913.   }
    914.   

crypto/bn/bn_lib.c:913:1: return from a call to BN_get_flags
    911.   {
    912.       return b->flags & n;
    913. > }
    914.   
    915.   /* Populate a BN_GENCB structure with an "old"-style callback */

crypto/bn/bn_lib.c:301:9: Condition is false
  299.       bn_check_top(a);
  300.   
  301.       t = BN_get_flags(a, BN_FLG_SECURE) ? BN_secure_new() : BN_new();
                 ^
  302.       if (t == NULL)
  303.           return NULL;

crypto/bn/bn_lib.c:301:5: 
  299.       bn_check_top(a);
  300.   
  301. >     t = BN_get_flags(a, BN_FLG_SECURE) ? BN_secure_new() : BN_new();
  302.       if (t == NULL)
  303.           return NULL;

crypto/bn/bn_lib.c:302:9: Taking true branch
  300.   
  301.       t = BN_get_flags(a, BN_FLG_SECURE) ? BN_secure_new() : BN_new();
  302.       if (t == NULL)
                 ^
  303.           return NULL;
  304.       if (!BN_copy(t, a)) {

crypto/bn/bn_lib.c:303:9: 
  301.       t = BN_get_flags(a, BN_FLG_SECURE) ? BN_secure_new() : BN_new();
  302.       if (t == NULL)
  303. >         return NULL;
  304.       if (!BN_copy(t, a)) {
  305.           BN_free(t);

crypto/bn/bn_lib.c:310:1: return from a call to BN_dup
  308.       bn_check_top(t);
  309.       return t;
  310. > }
  311.   
  312.   BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)

test/testutil/tests.c:412:5: 
410.       bw = BN_new();
411.       aa = BN_dup(a);
412. >     BN_set_negative(aa, 0);
413.       BN_set_word(bw, w);
414.       test_fail_bignum_message(NULL, file, line, "BIGNUM", bns, ws, "abs==",

crypto/bn/bn_lib.c:692:1: start of procedure BN_set_negative()
  690.   }
  691.   
  692. > void BN_set_negative(BIGNUM *a, int b)
  693.   {
  694.       if (b && !BN_is_zero(a))

crypto/bn/bn_lib.c:694:9: Taking false branch
  692.   void BN_set_negative(BIGNUM *a, int b)
  693.   {
  694.       if (b && !BN_is_zero(a))
                 ^
  695.           a->neg = 1;
  696.       else

crypto/bn/bn_lib.c:697:9: 
  695.           a->neg = 1;
  696.       else
  697. >         a->neg = 0;
  698.   }
  699.   

int test_BN_abs_eq_word(const char *file, int line, const char *bns,
                        const char *ws, const BIGNUM *a, BN_ULONG w)
{
    BIGNUM *bw, *aa;
    if (a != NULL && BN_abs_is_word(a, w))
        return 1;
    bw = BN_new();
    aa = BN_dup(a);
    BN_set_negative(aa, 0);
    BN_set_word(bw, w);
    test_fail_bignum_message(NULL, file, line, "BIGNUM", bns, ws, "abs==",
                             aa, bw);
    BN_free(bw);
    BN_free(aa);
    return 0;
}
['int test_BN_abs_eq_word(const char *file, int line, const char *bns,\n                        const char *ws, const BIGNUM *a, BN_ULONG w)\n{\n    BIGNUM *bw, *aa;\n    if (a != NULL && BN_abs_is_word(a, w))\n        return 1;\n    bw = BN_new();\n    aa = BN_dup(a);\n    BN_set_negative(aa, 0);\n    BN_set_word(bw, w);\n    test_fail_bignum_message(NULL, file, line, "BIGNUM", bns, ws, "abs==",\n                             aa, bw);\n    BN_free(bw);\n    BN_free(aa);\n    return 0;\n}', 'int BN_abs_is_word(const BIGNUM *a, const BN_ULONG w)\n{\n    return ((a->top == 1) && (a->d[0] == w)) || ((w == 0) && (a->top == 0));\n}', 'BIGNUM *BN_dup(const BIGNUM *a)\n{\n    BIGNUM *t;\n    if (a == NULL)\n        return NULL;\n    bn_check_top(a);\n    t = BN_get_flags(a, BN_FLG_SECURE) ? BN_secure_new() : BN_new();\n    if (t == NULL)\n        return NULL;\n    if (!BN_copy(t, a)) {\n        BN_free(t);\n        return NULL;\n    }\n    bn_check_top(t);\n    return t;\n}', 'int BN_get_flags(const BIGNUM *b, int n)\n{\n    return b->flags & n;\n}', 'void BN_set_negative(BIGNUM *a, int b)\n{\n    if (b && !BN_is_zero(a))\n        a->neg = 1;\n    else\n        a->neg = 0;\n}']