test/testutil/tests.c:403: error: NULL_DEREFERENCE
  pointer `aa` last assigned on line 402 could be null and is dereferenced by call to `BN_set_negative()` at line 403, column 5.
Showing all 28 steps of the trace


test/testutil/tests.c:394:1: start of procedure test_BN_abs_eq_word()
392.   }
393.   
394. > int test_BN_abs_eq_word(const char *file, int line, const char *bns,
395.                           const char *ws, const BIGNUM *a, BN_ULONG w)
396.   {

test/testutil/tests.c:399:9: Taking true branch
397.       BIGNUM *bw, *aa;
398.   
399.       if (a != NULL && BN_abs_is_word(a, w))
               ^
400.           return 1;
401.       bw = BN_new();

test/testutil/tests.c:399:22: 
397.       BIGNUM *bw, *aa;
398.   
399. >     if (a != NULL && BN_abs_is_word(a, w))
400.           return 1;
401.       bw = BN_new();

crypto/bn/bn_lib.c:847:1: start of procedure BN_abs_is_word()
  845.   }
  846.   
  847. > int BN_abs_is_word(const BIGNUM *a, const BN_ULONG w)
  848.   {
  849.       return ((a->top == 1) && (a->d[0] == w)) || ((w == 0) && (a->top == 0));

crypto/bn/bn_lib.c:849:14: Condition is true
  847.   int BN_abs_is_word(const BIGNUM *a, const BN_ULONG w)
  848.   {
  849.       return ((a->top == 1) && (a->d[0] == w)) || ((w == 0) && (a->top == 0));
                      ^
  850.   }
  851.   

crypto/bn/bn_lib.c:849:31: Condition is false
  847.   int BN_abs_is_word(const BIGNUM *a, const BN_ULONG w)
  848.   {
  849.       return ((a->top == 1) && (a->d[0] == w)) || ((w == 0) && (a->top == 0));
                                       ^
  850.   }
  851.   

crypto/bn/bn_lib.c:849:51: Condition is false
  847.   int BN_abs_is_word(const BIGNUM *a, const BN_ULONG w)
  848.   {
  849.       return ((a->top == 1) && (a->d[0] == w)) || ((w == 0) && (a->top == 0));
                                                           ^
  850.   }
  851.   

crypto/bn/bn_lib.c:849:12: 
  847.   int BN_abs_is_word(const BIGNUM *a, const BN_ULONG w)
  848.   {
  849. >     return ((a->top == 1) && (a->d[0] == w)) || ((w == 0) && (a->top == 0));
  850.   }
  851.   

crypto/bn/bn_lib.c:849:5: 
  847.   int BN_abs_is_word(const BIGNUM *a, const BN_ULONG w)
  848.   {
  849. >     return ((a->top == 1) && (a->d[0] == w)) || ((w == 0) && (a->top == 0));
  850.   }
  851.   

crypto/bn/bn_lib.c:850:1: return from a call to BN_abs_is_word
  848.   {
  849.       return ((a->top == 1) && (a->d[0] == w)) || ((w == 0) && (a->top == 0));
  850. > }
  851.   
  852.   int BN_is_zero(const BIGNUM *a)

test/testutil/tests.c:399:22: Taking false branch
397.       BIGNUM *bw, *aa;
398.   
399.       if (a != NULL && BN_abs_is_word(a, w))
                            ^
400.           return 1;
401.       bw = BN_new();

test/testutil/tests.c:401:5: Skipping BN_new(): empty list of specs
399.       if (a != NULL && BN_abs_is_word(a, w))
400.           return 1;
401.       bw = BN_new();
           ^
402.       aa = BN_dup(a);
403.       BN_set_negative(aa, 0);

test/testutil/tests.c:402:5: 
400.           return 1;
401.       bw = BN_new();
402. >     aa = BN_dup(a);
403.       BN_set_negative(aa, 0);
404.       BN_set_word(bw, w);

crypto/bn/bn_lib.c:304:1: start of procedure BN_dup()
  302.   }
  303.   
  304. > BIGNUM *BN_dup(const BIGNUM *a)
  305.   {
  306.       BIGNUM *t;

crypto/bn/bn_lib.c:308:9: Taking false branch
  306.       BIGNUM *t;
  307.   
  308.       if (a == NULL)
                 ^
  309.           return NULL;
  310.       bn_check_top(a);

crypto/bn/bn_lib.c:312:9: 
  310.       bn_check_top(a);
  311.   
  312. >     t = BN_get_flags(a, BN_FLG_SECURE) ? BN_secure_new() : BN_new();
  313.       if (t == NULL)
  314.           return NULL;

crypto/bn/bn_lib.c:918:1: start of procedure BN_get_flags()
    916.   }
    917.   
    918. > int BN_get_flags(const BIGNUM *b, int n)
    919.   {
    920.       return b->flags & n;

crypto/bn/bn_lib.c:920:5: 
    918.   int BN_get_flags(const BIGNUM *b, int n)
    919.   {
    920. >     return b->flags & n;
    921.   }
    922.   

crypto/bn/bn_lib.c:921:1: return from a call to BN_get_flags
    919.   {
    920.       return b->flags & n;
    921. > }
    922.   
    923.   /* Populate a BN_GENCB structure with an "old"-style callback */

crypto/bn/bn_lib.c:312:9: Condition is false
  310.       bn_check_top(a);
  311.   
  312.       t = BN_get_flags(a, BN_FLG_SECURE) ? BN_secure_new() : BN_new();
                 ^
  313.       if (t == NULL)
  314.           return NULL;

crypto/bn/bn_lib.c:312:5: 
  310.       bn_check_top(a);
  311.   
  312. >     t = BN_get_flags(a, BN_FLG_SECURE) ? BN_secure_new() : BN_new();
  313.       if (t == NULL)
  314.           return NULL;

crypto/bn/bn_lib.c:313:9: Taking true branch
  311.   
  312.       t = BN_get_flags(a, BN_FLG_SECURE) ? BN_secure_new() : BN_new();
  313.       if (t == NULL)
                 ^
  314.           return NULL;
  315.       if (!BN_copy(t, a)) {

crypto/bn/bn_lib.c:314:9: 
  312.       t = BN_get_flags(a, BN_FLG_SECURE) ? BN_secure_new() : BN_new();
  313.       if (t == NULL)
  314. >         return NULL;
  315.       if (!BN_copy(t, a)) {
  316.           BN_free(t);

crypto/bn/bn_lib.c:321:1: return from a call to BN_dup
  319.       bn_check_top(t);
  320.       return t;
  321. > }
  322.   
  323.   BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)

test/testutil/tests.c:403:5: 
401.       bw = BN_new();
402.       aa = BN_dup(a);
403. >     BN_set_negative(aa, 0);
404.       BN_set_word(bw, w);
405.       test_fail_bignum_message(NULL, file, line, "BIGNUM", bns, ws, "abs==",

crypto/bn/bn_lib.c:700:1: start of procedure BN_set_negative()
  698.   }
  699.   
  700. > void BN_set_negative(BIGNUM *a, int b)
  701.   {
  702.       if (b && !BN_is_zero(a))

crypto/bn/bn_lib.c:702:9: Taking false branch
  700.   void BN_set_negative(BIGNUM *a, int b)
  701.   {
  702.       if (b && !BN_is_zero(a))
                 ^
  703.           a->neg = 1;
  704.       else

crypto/bn/bn_lib.c:705:9: 
  703.           a->neg = 1;
  704.       else
  705. >         a->neg = 0;
  706.   }
  707.   

int test_BN_abs_eq_word(const char *file, int line, const char *bns,
                        const char *ws, const BIGNUM *a, BN_ULONG w)
{
    BIGNUM *bw, *aa;
    if (a != NULL && BN_abs_is_word(a, w))
        return 1;
    bw = BN_new();
    aa = BN_dup(a);
    BN_set_negative(aa, 0);
    BN_set_word(bw, w);
    test_fail_bignum_message(NULL, file, line, "BIGNUM", bns, ws, "abs==",
                             aa, bw);
    BN_free(bw);
    BN_free(aa);
    return 0;
}
['int test_BN_abs_eq_word(const char *file, int line, const char *bns,\n                        const char *ws, const BIGNUM *a, BN_ULONG w)\n{\n    BIGNUM *bw, *aa;\n    if (a != NULL && BN_abs_is_word(a, w))\n        return 1;\n    bw = BN_new();\n    aa = BN_dup(a);\n    BN_set_negative(aa, 0);\n    BN_set_word(bw, w);\n    test_fail_bignum_message(NULL, file, line, "BIGNUM", bns, ws, "abs==",\n                             aa, bw);\n    BN_free(bw);\n    BN_free(aa);\n    return 0;\n}', 'int BN_abs_is_word(const BIGNUM *a, const BN_ULONG w)\n{\n    return ((a->top == 1) && (a->d[0] == w)) || ((w == 0) && (a->top == 0));\n}', 'BIGNUM *BN_dup(const BIGNUM *a)\n{\n    BIGNUM *t;\n    if (a == NULL)\n        return NULL;\n    bn_check_top(a);\n    t = BN_get_flags(a, BN_FLG_SECURE) ? BN_secure_new() : BN_new();\n    if (t == NULL)\n        return NULL;\n    if (!BN_copy(t, a)) {\n        BN_free(t);\n        return NULL;\n    }\n    bn_check_top(t);\n    return t;\n}', 'int BN_get_flags(const BIGNUM *b, int n)\n{\n    return b->flags & n;\n}', 'void BN_set_negative(BIGNUM *a, int b)\n{\n    if (b && !BN_is_zero(a))\n        a->neg = 1;\n    else\n        a->neg = 0;\n}']