crypto/asn1/a_int.c:544: error: NULL_DEREFERENCE
  pointer `null` is dereferenced by call to `ASN1_STRING_set()` at line 544, column 9.
Showing all 78 steps of the trace


crypto/asn1/a_int.c:518:1: start of procedure bn_to_asn1_string()
516.   }
517.   
518. > static ASN1_STRING *bn_to_asn1_string(const BIGNUM *bn, ASN1_STRING *ai,
519.                                         int atype)
520.   {

crypto/asn1/a_int.c:524:9: Taking true branch
522.       int len;
523.   
524.       if (ai == NULL) {
               ^
525.           ret = ASN1_STRING_type_new(atype);
526.       } else {

crypto/asn1/a_int.c:525:9: 
523.   
524.       if (ai == NULL) {
525. >         ret = ASN1_STRING_type_new(atype);
526.       } else {
527.           ret = ai;

crypto/asn1/asn1_lib.c:348:1: start of procedure ASN1_STRING_type_new()
  346.   }
  347.   
  348. > ASN1_STRING *ASN1_STRING_type_new(int type)
  349.   {
  350.       ASN1_STRING *ret;

crypto/asn1/asn1_lib.c:352:5: 
  350.       ASN1_STRING *ret;
  351.   
  352. >     ret = OPENSSL_zalloc(sizeof(*ret));
  353.       if (ret == NULL) {
  354.           ASN1err(ASN1_F_ASN1_STRING_TYPE_NEW, ERR_R_MALLOC_FAILURE);

crypto/mem.c:156:1: start of procedure CRYPTO_zalloc()
    154.   }
    155.   
    156. > void *CRYPTO_zalloc(size_t num, const char *file, int line)
    157.   {
    158.       void *ret = CRYPTO_malloc(num, file, line);

crypto/mem.c:158:5: 
    156.   void *CRYPTO_zalloc(size_t num, const char *file, int line)
    157.   {
    158. >     void *ret = CRYPTO_malloc(num, file, line);
    159.   
    160.       if (ret != NULL)

crypto/mem.c:119:1: start of procedure CRYPTO_malloc()
      117.   }
      118.   
      119. > void *CRYPTO_malloc(size_t num, const char *file, int line)
      120.   {
      121.       void *ret = NULL;

crypto/mem.c:121:5: 
      119.   void *CRYPTO_malloc(size_t num, const char *file, int line)
      120.   {
      121. >     void *ret = NULL;
      122.   
      123.       if (num <= 0)

crypto/mem.c:123:9: Taking false branch
      121.       void *ret = NULL;
      122.   
      123.       if (num <= 0)
                     ^
      124.           return NULL;
      125.   

crypto/mem.c:126:5: 
      124.           return NULL;
      125.   
      126. >     allow_customize = 0;
      127.   #ifndef OPENSSL_NO_CRYPTO_MDEBUG
      128.       if (call_malloc_debug) {

crypto/mem.c:136:5: 
      134.       }
      135.   #else
      136. >     (void)file;
      137.       (void)line;
      138.       ret = malloc(num);

crypto/mem.c:137:5: 
      135.   #else
      136.       (void)file;
      137. >     (void)line;
      138.       ret = malloc(num);
      139.   #endif

crypto/mem.c:138:5: 
      136.       (void)file;
      137.       (void)line;
      138. >     ret = malloc(num);
      139.   #endif
      140.   

crypto/mem.c:153:5: 
      151.   #endif
      152.   
      153. >     return ret;
      154.   }
      155.   

crypto/mem.c:154:1: return from a call to CRYPTO_malloc
      152.   
      153.       return ret;
      154. > }
      155.   
      156.   void *CRYPTO_zalloc(size_t num, const char *file, int line)

crypto/mem.c:160:9: Taking true branch
    158.       void *ret = CRYPTO_malloc(num, file, line);
    159.   
    160.       if (ret != NULL)
                   ^
    161.           memset(ret, 0, num);
    162.       return ret;

crypto/mem.c:161:9: 
    159.   
    160.       if (ret != NULL)
    161. >         memset(ret, 0, num);
    162.       return ret;
    163.   }

crypto/mem.c:162:5: 
    160.       if (ret != NULL)
    161.           memset(ret, 0, num);
    162. >     return ret;
    163.   }
    164.   

crypto/mem.c:163:1: return from a call to CRYPTO_zalloc
    161.           memset(ret, 0, num);
    162.       return ret;
    163. > }
    164.   
    165.   void *CRYPTO_realloc(void *str, size_t num, const char *file, int line)

crypto/asn1/asn1_lib.c:353:9: Taking false branch
  351.   
  352.       ret = OPENSSL_zalloc(sizeof(*ret));
  353.       if (ret == NULL) {
                 ^
  354.           ASN1err(ASN1_F_ASN1_STRING_TYPE_NEW, ERR_R_MALLOC_FAILURE);
  355.           return (NULL);

crypto/asn1/asn1_lib.c:357:5: 
  355.           return (NULL);
  356.       }
  357. >     ret->type = type;
  358.       return (ret);
  359.   }

crypto/asn1/asn1_lib.c:358:5: 
  356.       }
  357.       ret->type = type;
  358. >     return (ret);
  359.   }
  360.   

crypto/asn1/asn1_lib.c:359:1: return from a call to ASN1_STRING_type_new
  357.       ret->type = type;
  358.       return (ret);
  359. > }
  360.   
  361.   void ASN1_STRING_free(ASN1_STRING *a)

crypto/asn1/a_int.c:531:9: Taking false branch
529.       }
530.   
531.       if (ret == NULL) {
               ^
532.           ASN1err(ASN1_F_BN_TO_ASN1_STRING, ERR_R_NESTED_ASN1_ERROR);
533.           goto err;

crypto/asn1/a_int.c:536:9: 
534.       }
535.   
536. >     if (BN_is_negative(bn) && !BN_is_zero(bn))
537.           ret->type |= V_ASN1_NEG_INTEGER;
538.   

crypto/bn/bn_lib.c:918:1: start of procedure BN_is_negative()
  916.   }
  917.   
  918. > int BN_is_negative(const BIGNUM *a)
  919.   {
  920.       return (a->neg != 0);

crypto/bn/bn_lib.c:920:13: Condition is true
  918.   int BN_is_negative(const BIGNUM *a)
  919.   {
  920.       return (a->neg != 0);
                     ^
  921.   }
  922.   

crypto/bn/bn_lib.c:920:5: 
  918.   int BN_is_negative(const BIGNUM *a)
  919.   {
  920. >     return (a->neg != 0);
  921.   }
  922.   

crypto/bn/bn_lib.c:921:1: return from a call to BN_is_negative
  919.   {
  920.       return (a->neg != 0);
  921. > }
  922.   
  923.   int BN_to_montgomery(BIGNUM *r, const BIGNUM *a, BN_MONT_CTX *mont,

crypto/asn1/a_int.c:536:9: Taking true branch
534.       }
535.   
536.       if (BN_is_negative(bn) && !BN_is_zero(bn))
               ^
537.           ret->type |= V_ASN1_NEG_INTEGER;
538.   

crypto/asn1/a_int.c:536:32: 
534.       }
535.   
536. >     if (BN_is_negative(bn) && !BN_is_zero(bn))
537.           ret->type |= V_ASN1_NEG_INTEGER;
538.   

crypto/bn/bn_lib.c:898:1: start of procedure BN_is_zero()
  896.   }
  897.   
  898. > int BN_is_zero(const BIGNUM *a)
  899.   {
  900.       return a->top == 0;

crypto/bn/bn_lib.c:900:12: Condition is false
  898.   int BN_is_zero(const BIGNUM *a)
  899.   {
  900.       return a->top == 0;
                    ^
  901.   }
  902.   

crypto/bn/bn_lib.c:900:5: 
  898.   int BN_is_zero(const BIGNUM *a)
  899.   {
  900. >     return a->top == 0;
  901.   }
  902.   

crypto/bn/bn_lib.c:901:1: return from a call to BN_is_zero
  899.   {
  900.       return a->top == 0;
  901. > }
  902.   
  903.   int BN_is_one(const BIGNUM *a)

crypto/asn1/a_int.c:536:32: Taking true branch
534.       }
535.   
536.       if (BN_is_negative(bn) && !BN_is_zero(bn))
                                      ^
537.           ret->type |= V_ASN1_NEG_INTEGER;
538.   

crypto/asn1/a_int.c:537:9: 
535.   
536.       if (BN_is_negative(bn) && !BN_is_zero(bn))
537. >         ret->type |= V_ASN1_NEG_INTEGER;
538.   
539.       len = BN_num_bytes(bn);

crypto/asn1/a_int.c:539:5: 
537.           ret->type |= V_ASN1_NEG_INTEGER;
538.   
539. >     len = BN_num_bytes(bn);
540.   
541.       if (len == 0)

crypto/bn/bn_lib.c:214:1: start of procedure BN_num_bits()
  212.   }
  213.   
  214. > int BN_num_bits(const BIGNUM *a)
  215.   {
  216.       int i = a->top - 1;

crypto/bn/bn_lib.c:216:5: 
  214.   int BN_num_bits(const BIGNUM *a)
  215.   {
  216. >     int i = a->top - 1;
  217.       bn_check_top(a);
  218.   

crypto/bn/bn_lib.c:219:9: 
  217.       bn_check_top(a);
  218.   
  219. >     if (BN_is_zero(a))
  220.           return 0;
  221.       return ((i * BN_BITS2) + BN_num_bits_word(a->d[i]));

crypto/bn/bn_lib.c:898:1: start of procedure BN_is_zero()
    896.   }
    897.   
    898. > int BN_is_zero(const BIGNUM *a)
    899.   {
    900.       return a->top == 0;

crypto/bn/bn_lib.c:900:12: Condition is false
    898.   int BN_is_zero(const BIGNUM *a)
    899.   {
    900.       return a->top == 0;
                      ^
    901.   }
    902.   

crypto/bn/bn_lib.c:900:5: 
    898.   int BN_is_zero(const BIGNUM *a)
    899.   {
    900. >     return a->top == 0;
    901.   }
    902.   

crypto/bn/bn_lib.c:901:1: return from a call to BN_is_zero
    899.   {
    900.       return a->top == 0;
    901. > }
    902.   
    903.   int BN_is_one(const BIGNUM *a)

crypto/bn/bn_lib.c:219:9: Taking false branch
  217.       bn_check_top(a);
  218.   
  219.       if (BN_is_zero(a))
                 ^
  220.           return 0;
  221.       return ((i * BN_BITS2) + BN_num_bits_word(a->d[i]));

crypto/bn/bn_lib.c:221:5: Skipping BN_num_bits_word(): empty list of specs
  219.       if (BN_is_zero(a))
  220.           return 0;
  221.       return ((i * BN_BITS2) + BN_num_bits_word(a->d[i]));
             ^
  222.   }
  223.   

crypto/bn/bn_lib.c:222:1: return from a call to BN_num_bits
  220.           return 0;
  221.       return ((i * BN_BITS2) + BN_num_bits_word(a->d[i]));
  222. > }
  223.   
  224.   static void bn_free_d(BIGNUM *a)

crypto/asn1/a_int.c:541:9: Taking false branch
539.       len = BN_num_bytes(bn);
540.   
541.       if (len == 0)
               ^
542.           len = 1;
543.   

crypto/asn1/a_int.c:544:9: 
542.           len = 1;
543.   
544. >     if (ASN1_STRING_set(ret, NULL, len) == 0) {
545.           ASN1err(ASN1_F_BN_TO_ASN1_STRING, ERR_R_MALLOC_FAILURE);
546.           goto err;

crypto/asn1/asn1_lib.c:307:1: start of procedure ASN1_STRING_set()
  305.   }
  306.   
  307. > int ASN1_STRING_set(ASN1_STRING *str, const void *_data, int len)
  308.   {
  309.       unsigned char *c;

crypto/asn1/asn1_lib.c:310:5: 
  308.   {
  309.       unsigned char *c;
  310. >     const char *data = _data;
  311.   
  312.       if (len < 0) {

crypto/asn1/asn1_lib.c:312:9: Taking false branch
  310.       const char *data = _data;
  311.   
  312.       if (len < 0) {
                 ^
  313.           if (data == NULL)
  314.               return (0);

crypto/asn1/asn1_lib.c:318:10: Taking false branch
  316.               len = strlen(data);
  317.       }
  318.       if ((str->length < len) || (str->data == NULL)) {
                  ^
  319.           c = str->data;
  320.           str->data = OPENSSL_realloc(c, len + 1);

crypto/asn1/asn1_lib.c:318:33: Taking true branch
  316.               len = strlen(data);
  317.       }
  318.       if ((str->length < len) || (str->data == NULL)) {
                                         ^
  319.           c = str->data;
  320.           str->data = OPENSSL_realloc(c, len + 1);

crypto/asn1/asn1_lib.c:319:9: 
  317.       }
  318.       if ((str->length < len) || (str->data == NULL)) {
  319. >         c = str->data;
  320.           str->data = OPENSSL_realloc(c, len + 1);
  321.           if (str->data == NULL) {

crypto/asn1/asn1_lib.c:320:9: 
  318.       if ((str->length < len) || (str->data == NULL)) {
  319.           c = str->data;
  320. >         str->data = OPENSSL_realloc(c, len + 1);
  321.           if (str->data == NULL) {
  322.               ASN1err(ASN1_F_ASN1_STRING_SET, ERR_R_MALLOC_FAILURE);

crypto/mem.c:165:1: start of procedure CRYPTO_realloc()
    163.   }
    164.   
    165. > void *CRYPTO_realloc(void *str, size_t num, const char *file, int line)
    166.   {
    167.       if (str == NULL)

crypto/mem.c:167:9: Taking true branch
    165.   void *CRYPTO_realloc(void *str, size_t num, const char *file, int line)
    166.   {
    167.       if (str == NULL)
                   ^
    168.           return CRYPTO_malloc(num, file, line);
    169.   

crypto/mem.c:168:9: 
    166.   {
    167.       if (str == NULL)
    168. >         return CRYPTO_malloc(num, file, line);
    169.   
    170.       if (num == 0) {

crypto/mem.c:119:1: start of procedure CRYPTO_malloc()
      117.   }
      118.   
      119. > void *CRYPTO_malloc(size_t num, const char *file, int line)
      120.   {
      121.       void *ret = NULL;

crypto/mem.c:121:5: 
      119.   void *CRYPTO_malloc(size_t num, const char *file, int line)
      120.   {
      121. >     void *ret = NULL;
      122.   
      123.       if (num <= 0)

crypto/mem.c:123:9: Taking false branch
      121.       void *ret = NULL;
      122.   
      123.       if (num <= 0)
                     ^
      124.           return NULL;
      125.   

crypto/mem.c:126:5: 
      124.           return NULL;
      125.   
      126. >     allow_customize = 0;
      127.   #ifndef OPENSSL_NO_CRYPTO_MDEBUG
      128.       if (call_malloc_debug) {

crypto/mem.c:136:5: 
      134.       }
      135.   #else
      136. >     (void)file;
      137.       (void)line;
      138.       ret = malloc(num);

crypto/mem.c:137:5: 
      135.   #else
      136.       (void)file;
      137. >     (void)line;
      138.       ret = malloc(num);
      139.   #endif

crypto/mem.c:138:5: 
      136.       (void)file;
      137.       (void)line;
      138. >     ret = malloc(num);
      139.   #endif
      140.   

crypto/mem.c:153:5: 
      151.   #endif
      152.   
      153. >     return ret;
      154.   }
      155.   

crypto/mem.c:154:1: return from a call to CRYPTO_malloc
      152.   
      153.       return ret;
      154. > }
      155.   
      156.   void *CRYPTO_zalloc(size_t num, const char *file, int line)

crypto/mem.c:190:1: return from a call to CRYPTO_realloc
    188.       return realloc(str, num);
    189.   
    190. > }
    191.   
    192.   void *CRYPTO_clear_realloc(void *str, size_t old_len, size_t num,

crypto/asn1/asn1_lib.c:321:13: Taking false branch
  319.           c = str->data;
  320.           str->data = OPENSSL_realloc(c, len + 1);
  321.           if (str->data == NULL) {
                     ^
  322.               ASN1err(ASN1_F_ASN1_STRING_SET, ERR_R_MALLOC_FAILURE);
  323.               str->data = c;

crypto/asn1/asn1_lib.c:327:5: 
  325.           }
  326.       }
  327. >     str->length = len;
  328.       if (data != NULL) {
  329.           memcpy(str->data, data, len);

crypto/asn1/asn1_lib.c:328:9: Taking true branch
  326.       }
  327.       str->length = len;
  328.       if (data != NULL) {
                 ^
  329.           memcpy(str->data, data, len);
  330.           /* an allowance for strings :-) */

crypto/asn1/asn1_lib.c:329:9: 
  327.       str->length = len;
  328.       if (data != NULL) {
  329. >         memcpy(str->data, data, len);
  330.           /* an allowance for strings :-) */
  331.           str->data[len] = '\0';

crypto/asn1/asn1_lib.c:331:9: 
  329.           memcpy(str->data, data, len);
  330.           /* an allowance for strings :-) */
  331. >         str->data[len] = '\0';
  332.       }
  333.       return (1);

crypto/asn1/asn1_lib.c:333:5: 
  331.           str->data[len] = '\0';
  332.       }
  333. >     return (1);
  334.   }
  335.   

crypto/asn1/asn1_lib.c:334:1: return from a call to ASN1_STRING_set
  332.       }
  333.       return (1);
  334. > }
  335.   
  336.   void ASN1_STRING_set0(ASN1_STRING *str, void *data, int len)

static ASN1_STRING *bn_to_asn1_string(const BIGNUM *bn, ASN1_STRING *ai,
                                      int atype)
{
    ASN1_INTEGER *ret;
    int len;
    if (ai == NULL) {
        ret = ASN1_STRING_type_new(atype);
    } else {
        ret = ai;
        ret->type = atype;
    }
    if (ret == NULL) {
        ASN1err(ASN1_F_BN_TO_ASN1_STRING, ERR_R_NESTED_ASN1_ERROR);
        goto err;
    }
    if (BN_is_negative(bn) && !BN_is_zero(bn))
        ret->type |= V_ASN1_NEG_INTEGER;
    len = BN_num_bytes(bn);
    if (len == 0)
        len = 1;
    if (ASN1_STRING_set(ret, NULL, len) == 0) {
        ASN1err(ASN1_F_BN_TO_ASN1_STRING, ERR_R_MALLOC_FAILURE);
        goto err;
    }
    if (BN_is_zero(bn))
        ret->data[0] = 0;
    else
        len = BN_bn2bin(bn, ret->data);
    ret->length = len;
    return ret;
 err:
    if (ret != ai)
        ASN1_INTEGER_free(ret);
    return (NULL);
}
['static ASN1_STRING *bn_to_asn1_string(const BIGNUM *bn, ASN1_STRING *ai,\n                                      int atype)\n{\n    ASN1_INTEGER *ret;\n    int len;\n    if (ai == NULL) {\n        ret = ASN1_STRING_type_new(atype);\n    } else {\n        ret = ai;\n        ret->type = atype;\n    }\n    if (ret == NULL) {\n        ASN1err(ASN1_F_BN_TO_ASN1_STRING, ERR_R_NESTED_ASN1_ERROR);\n        goto err;\n    }\n    if (BN_is_negative(bn) && !BN_is_zero(bn))\n        ret->type |= V_ASN1_NEG_INTEGER;\n    len = BN_num_bytes(bn);\n    if (len == 0)\n        len = 1;\n    if (ASN1_STRING_set(ret, NULL, len) == 0) {\n        ASN1err(ASN1_F_BN_TO_ASN1_STRING, ERR_R_MALLOC_FAILURE);\n        goto err;\n    }\n    if (BN_is_zero(bn))\n        ret->data[0] = 0;\n    else\n        len = BN_bn2bin(bn, ret->data);\n    ret->length = len;\n    return ret;\n err:\n    if (ret != ai)\n        ASN1_INTEGER_free(ret);\n    return (NULL);\n}', 'ASN1_STRING *ASN1_STRING_type_new(int type)\n{\n    ASN1_STRING *ret;\n    ret = OPENSSL_zalloc(sizeof(*ret));\n    if (ret == NULL) {\n        ASN1err(ASN1_F_ASN1_STRING_TYPE_NEW, ERR_R_MALLOC_FAILURE);\n        return (NULL);\n    }\n    ret->type = type;\n    return (ret);\n}', 'void *CRYPTO_zalloc(size_t num, const char *file, int line)\n{\n    void *ret = CRYPTO_malloc(num, file, line);\n    if (ret != NULL)\n        memset(ret, 0, num);\n    return ret;\n}', 'void *CRYPTO_malloc(size_t num, const char *file, int line)\n{\n    void *ret = NULL;\n    if (num <= 0)\n        return NULL;\n    allow_customize = 0;\n#ifndef OPENSSL_NO_CRYPTO_MDEBUG\n    if (call_malloc_debug) {\n        CRYPTO_mem_debug_malloc(NULL, num, 0, file, line);\n        ret = malloc(num);\n        CRYPTO_mem_debug_malloc(ret, num, 1, file, line);\n    } else {\n        ret = malloc(num);\n    }\n#else\n    (void)file;\n    (void)line;\n    ret = malloc(num);\n#endif\n#ifndef OPENSSL_CPUID_OBJ\n    if (ret && (num > 2048)) {\n        extern unsigned char cleanse_ctr;\n        ((unsigned char *)ret)[0] = cleanse_ctr;\n    }\n#endif\n    return ret;\n}', 'int BN_is_negative(const BIGNUM *a)\n{\n    return (a->neg != 0);\n}', 'int BN_is_zero(const BIGNUM *a)\n{\n    return a->top == 0;\n}', 'int BN_num_bits(const BIGNUM *a)\n{\n    int i = a->top - 1;\n    bn_check_top(a);\n    if (BN_is_zero(a))\n        return 0;\n    return ((i * BN_BITS2) + BN_num_bits_word(a->d[i]));\n}', "int ASN1_STRING_set(ASN1_STRING *str, const void *_data, int len)\n{\n    unsigned char *c;\n    const char *data = _data;\n    if (len < 0) {\n        if (data == NULL)\n            return (0);\n        else\n            len = strlen(data);\n    }\n    if ((str->length < len) || (str->data == NULL)) {\n        c = str->data;\n        str->data = OPENSSL_realloc(c, len + 1);\n        if (str->data == NULL) {\n            ASN1err(ASN1_F_ASN1_STRING_SET, ERR_R_MALLOC_FAILURE);\n            str->data = c;\n            return (0);\n        }\n    }\n    str->length = len;\n    if (data != NULL) {\n        memcpy(str->data, data, len);\n        str->data[len] = '\\0';\n    }\n    return (1);\n}", 'void *CRYPTO_realloc(void *str, size_t num, const char *file, int line)\n{\n    if (str == NULL)\n        return CRYPTO_malloc(num, file, line);\n    if (num == 0) {\n        CRYPTO_free(str);\n        return NULL;\n    }\n    allow_customize = 0;\n#ifndef OPENSSL_NO_CRYPTO_MDEBUG\n    if (call_malloc_debug) {\n        void *ret;\n        CRYPTO_mem_debug_realloc(str, NULL, num, 0, file, line);\n        ret = realloc(str, num);\n        CRYPTO_mem_debug_realloc(str, ret, num, 1, file, line);\n        return ret;\n    }\n#else\n    (void)file;\n    (void)line;\n#endif\n    return realloc(str, num);\n}']