crypto/asn1/a_int.c:600: error: NULL_DEREFERENCE
  pointer `null` is dereferenced by call to `c2i_ibuf()` at line 600, column 14.
Showing all 22 steps of the trace


crypto/asn1/a_int.c:595:1: start of procedure c2i_uint64_int()
593.   
594.   /* Internal functions used by x_int64.c */
595. > int c2i_uint64_int(uint64_t *ret, int *neg, const unsigned char **pp, long len)
596.   {
597.       unsigned char buf[sizeof(uint64_t)];

crypto/asn1/a_int.c:600:5: 
598.       size_t buflen;
599.   
600. >     buflen = c2i_ibuf(NULL, NULL, *pp, len);
601.       if (buflen == 0)
602.           return 0;

crypto/asn1/a_int.c:148:1: start of procedure c2i_ibuf()
  146.    */
  147.   
  148. > static size_t c2i_ibuf(unsigned char *b, int *pneg,
  149.                          const unsigned char *p, size_t plen)
  150.   {

crypto/asn1/a_int.c:153:9: Taking false branch
  151.       int neg, pad;
  152.       /* Zero content length is illegal */
  153.       if (plen == 0) {
                 ^
  154.           ASN1err(ASN1_F_C2I_IBUF, ASN1_R_ILLEGAL_ZERO_CONTENT);
  155.           return 0;

crypto/asn1/a_int.c:157:5: 
  155.           return 0;
  156.       }
  157. >     neg = p[0] & 0x80;
  158.       if (pneg)
  159.           *pneg = neg;

crypto/asn1/a_int.c:158:9: Taking false branch
  156.       }
  157.       neg = p[0] & 0x80;
  158.       if (pneg)
                 ^
  159.           *pneg = neg;
  160.       /* Handle common case where length is 1 octet separately */

crypto/asn1/a_int.c:161:9: Taking false branch
  159.           *pneg = neg;
  160.       /* Handle common case where length is 1 octet separately */
  161.       if (plen == 1) {
                 ^
  162.           if (b != NULL) {
  163.               if (neg)

crypto/asn1/a_int.c:170:9: Taking false branch
  168.           return 1;
  169.       }
  170.       if (p[0] == 0 || p[0] == 0xFF)
                 ^
  171.           pad = 1;
  172.       else

crypto/asn1/a_int.c:170:22: Taking false branch
  168.           return 1;
  169.       }
  170.       if (p[0] == 0 || p[0] == 0xFF)
                              ^
  171.           pad = 1;
  172.       else

crypto/asn1/a_int.c:173:9: 
  171.           pad = 1;
  172.       else
  173. >         pad = 0;
  174.       /* reject illegal padding: first two octets MSB can't match */
  175.       if (pad && (neg == (p[1] & 0x80))) {

crypto/asn1/a_int.c:175:9: Taking false branch
  173.           pad = 0;
  174.       /* reject illegal padding: first two octets MSB can't match */
  175.       if (pad && (neg == (p[1] & 0x80))) {
                 ^
  176.           ASN1err(ASN1_F_C2I_IBUF, ASN1_R_ILLEGAL_PADDING);
  177.           return 0;

crypto/asn1/a_int.c:181:5: 
  179.   
  180.       /* skip over pad */
  181. >     p += pad;
  182.       plen -= pad;
  183.   

crypto/asn1/a_int.c:182:5: 
  180.       /* skip over pad */
  181.       p += pad;
  182. >     plen -= pad;
  183.   
  184.       if (b != NULL)

crypto/asn1/a_int.c:184:9: Taking true branch
  182.       plen -= pad;
  183.   
  184.       if (b != NULL)
                 ^
  185.           twos_complement(b, p, plen, neg ? 0xffU : 0);
  186.   

crypto/asn1/a_int.c:185:37: Condition is true
  183.   
  184.       if (b != NULL)
  185.           twos_complement(b, p, plen, neg ? 0xffU : 0);
                                             ^
  186.   
  187.       return plen;

crypto/asn1/a_int.c:185:9: 
  183.   
  184.       if (b != NULL)
  185. >         twos_complement(b, p, plen, neg ? 0xffU : 0);
  186.   
  187.       return plen;

crypto/asn1/a_int.c:76:1: start of procedure twos_complement()
    74.    * used elsewhere below...
    75.    */
    76. > static void twos_complement(unsigned char *dst, const unsigned char *src,
    77.                               size_t len, unsigned char pad)
    78.   {

crypto/asn1/a_int.c:79:5: 
    77.                               size_t len, unsigned char pad)
    78.   {
    79. >     unsigned int carry = pad & 1;
    80.   
    81.       /* Begin at the end of the encoding */

crypto/asn1/a_int.c:82:5: 
    80.   
    81.       /* Begin at the end of the encoding */
    82. >     dst += len;
    83.       src += len;
    84.       /* two's complement value: ~value + 1 */

crypto/asn1/a_int.c:83:5: 
    81.       /* Begin at the end of the encoding */
    82.       dst += len;
    83. >     src += len;
    84.       /* two's complement value: ~value + 1 */
    85.       while (len-- != 0) {

crypto/asn1/a_int.c:85:12: Loop condition is true. Entering loop body
    83.       src += len;
    84.       /* two's complement value: ~value + 1 */
    85.       while (len-- != 0) {
                     ^
    86.           *(--dst) = (unsigned char)(carry += *(--src) ^ pad);
    87.           carry >>= 8;

crypto/asn1/a_int.c:86:9: 
    84.       /* two's complement value: ~value + 1 */
    85.       while (len-- != 0) {
    86. >         *(--dst) = (unsigned char)(carry += *(--src) ^ pad);
    87.           carry >>= 8;
    88.       }

int c2i_uint64_int(uint64_t *ret, int *neg, const unsigned char **pp, long len)
{
    unsigned char buf[sizeof(uint64_t)];
    size_t buflen;
    buflen = c2i_ibuf(NULL, NULL, *pp, len);
    if (buflen == 0)
        return 0;
    if (buflen > sizeof(uint64_t)) {
        ASN1err(ASN1_F_C2I_UINT64_INT, ASN1_R_TOO_LARGE);
        return 0;
    }
    (void)c2i_ibuf(buf, neg, *pp, len);
    return asn1_get_uint64(ret, buf, buflen);
}
['int c2i_uint64_int(uint64_t *ret, int *neg, const unsigned char **pp, long len)\n{\n    unsigned char buf[sizeof(uint64_t)];\n    size_t buflen;\n    buflen = c2i_ibuf(NULL, NULL, *pp, len);\n    if (buflen == 0)\n        return 0;\n    if (buflen > sizeof(uint64_t)) {\n        ASN1err(ASN1_F_C2I_UINT64_INT, ASN1_R_TOO_LARGE);\n        return 0;\n    }\n    (void)c2i_ibuf(buf, neg, *pp, len);\n    return asn1_get_uint64(ret, buf, buflen);\n}', 'static size_t c2i_ibuf(unsigned char *b, int *pneg,\n                       const unsigned char *p, size_t plen)\n{\n    int neg, pad;\n    if (plen == 0) {\n        ASN1err(ASN1_F_C2I_IBUF, ASN1_R_ILLEGAL_ZERO_CONTENT);\n        return 0;\n    }\n    neg = p[0] & 0x80;\n    if (pneg)\n        *pneg = neg;\n    if (plen == 1) {\n        if (b != NULL) {\n            if (neg)\n                b[0] = (p[0] ^ 0xFF) + 1;\n            else\n                b[0] = p[0];\n        }\n        return 1;\n    }\n    if (p[0] == 0 || p[0] == 0xFF)\n        pad = 1;\n    else\n        pad = 0;\n    if (pad && (neg == (p[1] & 0x80))) {\n        ASN1err(ASN1_F_C2I_IBUF, ASN1_R_ILLEGAL_PADDING);\n        return 0;\n    }\n    p += pad;\n    plen -= pad;\n    if (b != NULL)\n        twos_complement(b, p, plen, neg ? 0xffU : 0);\n    return plen;\n}', 'static void twos_complement(unsigned char *dst, const unsigned char *src,\n                            size_t len, unsigned char pad)\n{\n    unsigned int carry = pad & 1;\n    dst += len;\n    src += len;\n    while (len-- != 0) {\n        *(--dst) = (unsigned char)(carry += *(--src) ^ pad);\n        carry >>= 8;\n    }\n}']