crypto/rsa/rsa_mp.c:94: error: NULL_DEREFERENCE
  pointer `ctx` last assigned on line 63 could be null and is dereferenced by call to `BN_CTX_free()` at line 94, column 5.
Showing all 29 steps of the trace


crypto/rsa/rsa_mp.c:59:1: start of procedure rsa_multip_calc_product()
57.   
58.   /* Refill products of primes */
59. > int rsa_multip_calc_product(RSA *rsa)
60.   {
61.       RSA_PRIME_INFO *pinfo;

crypto/rsa/rsa_mp.c:62:5: 
60.   {
61.       RSA_PRIME_INFO *pinfo;
62. >     BIGNUM *p1 = NULL, *p2 = NULL;
63.       BN_CTX *ctx = NULL;
64.       int i, rv = 0, ex_primes;

crypto/rsa/rsa_mp.c:63:5: 
61.       RSA_PRIME_INFO *pinfo;
62.       BIGNUM *p1 = NULL, *p2 = NULL;
63. >     BN_CTX *ctx = NULL;
64.       int i, rv = 0, ex_primes;
65.   

crypto/rsa/rsa_mp.c:64:5: 
62.       BIGNUM *p1 = NULL, *p2 = NULL;
63.       BN_CTX *ctx = NULL;
64. >     int i, rv = 0, ex_primes;
65.   
66.       if ((ex_primes = sk_RSA_PRIME_INFO_num(rsa->prime_infos)) <= 0) {

crypto/rsa/rsa_mp.c:66:9: 
64.       int i, rv = 0, ex_primes;
65.   
66. >     if ((ex_primes = sk_RSA_PRIME_INFO_num(rsa->prime_infos)) <= 0) {
67.           /* invalid */
68.           goto err;

crypto/rsa/rsa_locl.h:26:1: start of procedure sk_RSA_PRIME_INFO_num()
  24.   
  25.   DECLARE_ASN1_ITEM(RSA_PRIME_INFO)
  26. > DEFINE_STACK_OF(RSA_PRIME_INFO)
  27.   
  28.   struct rsa_st {

crypto/stack/stack.c:375:1: start of procedure OPENSSL_sk_num()
    373.   }
    374.   
    375. > int OPENSSL_sk_num(const OPENSSL_STACK *st)
    376.   {
    377.       return st == NULL ? -1 : st->num;

crypto/stack/stack.c:377:12: Condition is true
    375.   int OPENSSL_sk_num(const OPENSSL_STACK *st)
    376.   {
    377.       return st == NULL ? -1 : st->num;
                      ^
    378.   }
    379.   

crypto/stack/stack.c:377:5: 
    375.   int OPENSSL_sk_num(const OPENSSL_STACK *st)
    376.   {
    377. >     return st == NULL ? -1 : st->num;
    378.   }
    379.   

crypto/stack/stack.c:378:1: return from a call to OPENSSL_sk_num
    376.   {
    377.       return st == NULL ? -1 : st->num;
    378. > }
    379.   
    380.   void *OPENSSL_sk_value(const OPENSSL_STACK *st, int i)

crypto/rsa/rsa_locl.h:26:1: return from a call to sk_RSA_PRIME_INFO_num
  24.   
  25.   DECLARE_ASN1_ITEM(RSA_PRIME_INFO)
  26. > DEFINE_STACK_OF(RSA_PRIME_INFO)
  27.   
  28.   struct rsa_st {

crypto/rsa/rsa_mp.c:66:9: Taking true branch
64.       int i, rv = 0, ex_primes;
65.   
66.       if ((ex_primes = sk_RSA_PRIME_INFO_num(rsa->prime_infos)) <= 0) {
              ^
67.           /* invalid */
68.           goto err;

crypto/rsa/rsa_mp.c:93:2: 
91.   
92.       rv = 1;
93. >  err:
94.       BN_CTX_free(ctx);
95.       return rv;

crypto/rsa/rsa_mp.c:94:5: 
92.       rv = 1;
93.    err:
94. >     BN_CTX_free(ctx);
95.       return rv;
96.   }

crypto/bn/bn_ctx.c:157:1: start of procedure BN_CTX_free()
  155.   }
  156.   
  157. > void BN_CTX_free(BN_CTX *ctx)
  158.   {
  159.   #ifdef BN_CTX_DEBUG

crypto/bn/bn_ctx.c:174:5: 
  172.       }
  173.   #endif
  174. >     BN_STACK_finish(&ctx->stack);
  175.       BN_POOL_finish(&ctx->pool);
  176.       OPENSSL_free(ctx);

crypto/bn/bn_ctx.c:243:1: start of procedure BN_STACK_finish()
    241.   }
    242.   
    243. > static void BN_STACK_finish(BN_STACK *st)
    244.   {
    245.       OPENSSL_free(st->indexes);

crypto/bn/bn_ctx.c:245:5: 
    243.   static void BN_STACK_finish(BN_STACK *st)
    244.   {
    245. >     OPENSSL_free(st->indexes);
    246.       st->indexes = NULL;
    247.   }

crypto/mem.c:295:1: start of procedure CRYPTO_free()
      293.   }
      294.   
      295. > void CRYPTO_free(void *str, const char *file, int line)
      296.   {
      297.       INCREMENT(free_count);

crypto/mem.c:298:9: Taking true branch
      296.   {
      297.       INCREMENT(free_count);
      298.       if (free_impl != NULL && free_impl != &CRYPTO_free) {
                     ^
      299.           free_impl(str, file, line);
      300.           return;

crypto/mem.c:298:30: Taking true branch
      296.   {
      297.       INCREMENT(free_count);
      298.       if (free_impl != NULL && free_impl != &CRYPTO_free) {
                                          ^
      299.           free_impl(str, file, line);
      300.           return;

crypto/mem.c:299:9: Skipping __function_pointer__(): unresolved function pointer
      297.       INCREMENT(free_count);
      298.       if (free_impl != NULL && free_impl != &CRYPTO_free) {
      299.           free_impl(str, file, line);
                     ^
      300.           return;
      301.       }

crypto/mem.c:300:9: 
      298.       if (free_impl != NULL && free_impl != &CRYPTO_free) {
      299.           free_impl(str, file, line);
      300. >         return;
      301.       }
      302.   

crypto/mem.c:314:1: return from a call to CRYPTO_free
      312.       free(str);
      313.   #endif
      314. > }
      315.   
      316.   void CRYPTO_clear_free(void *str, size_t num, const char *file, int line)

crypto/bn/bn_ctx.c:246:5: 
    244.   {
    245.       OPENSSL_free(st->indexes);
    246. >     st->indexes = NULL;
    247.   }
    248.   

crypto/bn/bn_ctx.c:247:1: return from a call to BN_STACK_finish
    245.       OPENSSL_free(st->indexes);
    246.       st->indexes = NULL;
    247. > }
    248.   
    249.   

crypto/bn/bn_ctx.c:175:5: 
  173.   #endif
  174.       BN_STACK_finish(&ctx->stack);
  175. >     BN_POOL_finish(&ctx->pool);
  176.       OPENSSL_free(ctx);
  177.   }

crypto/bn/bn_ctx.c:284:1: start of procedure BN_POOL_finish()
    282.   }
    283.   
    284. > static void BN_POOL_finish(BN_POOL *p)
    285.   {
    286.       unsigned int loop;

crypto/bn/bn_ctx.c:289:12: Loop condition is false. Leaving loop
    287.       BIGNUM *bn;
    288.   
    289.       while (p->head) {
                      ^
    290.           for (loop = 0, bn = p->head->vals; loop++ < BN_CTX_POOL_SIZE; bn++)
    291.               if (bn->d)

int rsa_multip_calc_product(RSA *rsa)
{
    RSA_PRIME_INFO *pinfo;
    BIGNUM *p1 = NULL, *p2 = NULL;
    BN_CTX *ctx = NULL;
    int i, rv = 0, ex_primes;
    if ((ex_primes = sk_RSA_PRIME_INFO_num(rsa->prime_infos)) <= 0) {
        goto err;
    }
    if ((ctx = BN_CTX_new()) == NULL)
        goto err;
    p1 = rsa->p;
    p2 = rsa->q;
    for (i = 0; i < ex_primes; i++) {
        pinfo = sk_RSA_PRIME_INFO_value(rsa->prime_infos, i);
        if (pinfo->pp == NULL) {
            pinfo->pp = BN_secure_new();
            if (pinfo->pp == NULL)
                goto err;
        }
        if (!BN_mul(pinfo->pp, p1, p2, ctx))
            goto err;
        p1 = pinfo->pp;
        p2 = pinfo->r;
    }
    rv = 1;
 err:
    BN_CTX_free(ctx);
    return rv;
}
['int rsa_multip_calc_product(RSA *rsa)\n{\n    RSA_PRIME_INFO *pinfo;\n    BIGNUM *p1 = NULL, *p2 = NULL;\n    BN_CTX *ctx = NULL;\n    int i, rv = 0, ex_primes;\n    if ((ex_primes = sk_RSA_PRIME_INFO_num(rsa->prime_infos)) <= 0) {\n        goto err;\n    }\n    if ((ctx = BN_CTX_new()) == NULL)\n        goto err;\n    p1 = rsa->p;\n    p2 = rsa->q;\n    for (i = 0; i < ex_primes; i++) {\n        pinfo = sk_RSA_PRIME_INFO_value(rsa->prime_infos, i);\n        if (pinfo->pp == NULL) {\n            pinfo->pp = BN_secure_new();\n            if (pinfo->pp == NULL)\n                goto err;\n        }\n        if (!BN_mul(pinfo->pp, p1, p2, ctx))\n            goto err;\n        p1 = pinfo->pp;\n        p2 = pinfo->r;\n    }\n    rv = 1;\n err:\n    BN_CTX_free(ctx);\n    return rv;\n}', 'DEFINE_STACK_OF(RSA_PRIME_INFO)', 'int OPENSSL_sk_num(const OPENSSL_STACK *st)\n{\n    return st == NULL ? -1 : st->num;\n}', 'void BN_CTX_free(BN_CTX *ctx)\n{\n#ifdef BN_CTX_DEBUG\n    {\n        BN_POOL_ITEM *pool = ctx->pool.head;\n        fprintf(stderr, "BN_CTX_free, stack-size=%d, pool-bignums=%d\\n",\n                ctx->stack.size, ctx->pool.size);\n        fprintf(stderr, "dmaxs: ");\n        while (pool) {\n            unsigned loop = 0;\n            while (loop < BN_CTX_POOL_SIZE)\n                fprintf(stderr, "%02x ", pool->vals[loop++].dmax);\n            pool = pool->next;\n        }\n        fprintf(stderr, "\\n");\n    }\n#endif\n    BN_STACK_finish(&ctx->stack);\n    BN_POOL_finish(&ctx->pool);\n    OPENSSL_free(ctx);\n}', 'static void BN_STACK_finish(BN_STACK *st)\n{\n    OPENSSL_free(st->indexes);\n    st->indexes = NULL;\n}', 'void CRYPTO_free(void *str, const char *file, int line)\n{\n    INCREMENT(free_count);\n    if (free_impl != NULL && free_impl != &CRYPTO_free) {\n        free_impl(str, file, line);\n        return;\n    }\n#ifndef OPENSSL_NO_CRYPTO_MDEBUG\n    if (call_malloc_debug) {\n        CRYPTO_mem_debug_free(str, 0, file, line);\n        free(str);\n        CRYPTO_mem_debug_free(str, 1, file, line);\n    } else {\n        free(str);\n    }\n#else\n    free(str);\n#endif\n}', 'static void BN_POOL_finish(BN_POOL *p)\n{\n    unsigned int loop;\n    BIGNUM *bn;\n    while (p->head) {\n        for (loop = 0, bn = p->head->vals; loop++ < BN_CTX_POOL_SIZE; bn++)\n            if (bn->d)\n                BN_clear_free(bn);\n        p->current = p->head->next;\n        OPENSSL_free(p->head);\n        p->head = p->current;\n    }\n}']