crypto/ec/ec_curve.c:94: error: NULL_DEREFERENCE
  pointer `group` last assigned on line 66 could be null and is dereferenced by call to `EC_GROUP_free()` at line 94, column 3.
Showing all 29 steps of the trace


crypto/ec/ec_curve.c:62:1: start of procedure ec_group_new_GFp_from_hex()
60.   #include <openssl/asn1t.h>
61.   
62. > static EC_GROUP *ec_group_new_GFp_from_hex(const char *prime_in,
63.   	    const char *a_in, const char *b_in,
64.   	    const char *x_in, const int y_bit, const char *order_in)

crypto/ec/ec_curve.c:66:2: 
64.   	    const char *x_in, const int y_bit, const char *order_in)
65.   	{
66. > 	EC_GROUP *group=NULL;
67.   	EC_POINT *P=NULL;
68.   	BN_CTX	 *ctx=NULL;

crypto/ec/ec_curve.c:67:2: 
65.   	{
66.   	EC_GROUP *group=NULL;
67. > 	EC_POINT *P=NULL;
68.   	BN_CTX	 *ctx=NULL;
69.   	BIGNUM 	 *prime=NULL,*a=NULL,*b=NULL,*x=NULL,*order=NULL;

crypto/ec/ec_curve.c:68:2: 
66.   	EC_GROUP *group=NULL;
67.   	EC_POINT *P=NULL;
68. > 	BN_CTX	 *ctx=NULL;
69.   	BIGNUM 	 *prime=NULL,*a=NULL,*b=NULL,*x=NULL,*order=NULL;
70.   	int	 ok=0;

crypto/ec/ec_curve.c:69:2: 
67.   	EC_POINT *P=NULL;
68.   	BN_CTX	 *ctx=NULL;
69. > 	BIGNUM 	 *prime=NULL,*a=NULL,*b=NULL,*x=NULL,*order=NULL;
70.   	int	 ok=0;
71.   

crypto/ec/ec_curve.c:70:2: 
68.   	BN_CTX	 *ctx=NULL;
69.   	BIGNUM 	 *prime=NULL,*a=NULL,*b=NULL,*x=NULL,*order=NULL;
70. > 	int	 ok=0;
71.   
72.   	if ((ctx = BN_CTX_new()) == NULL) goto bn_err;

crypto/ec/ec_curve.c:72:6: Taking false branch
70.   	int	 ok=0;
71.   
72.   	if ((ctx = BN_CTX_new()) == NULL) goto bn_err;
           ^
73.   	if ((prime = BN_new()) == NULL || (a = BN_new()) == NULL || (b = BN_new()) == NULL ||
74.   		(x = BN_new()) == NULL || (order = BN_new()) == NULL) goto bn_err;

crypto/ec/ec_curve.c:73:6: Taking false branch
71.   
72.   	if ((ctx = BN_CTX_new()) == NULL) goto bn_err;
73.   	if ((prime = BN_new()) == NULL || (a = BN_new()) == NULL || (b = BN_new()) == NULL ||
           ^
74.   		(x = BN_new()) == NULL || (order = BN_new()) == NULL) goto bn_err;
75.   	

crypto/ec/ec_curve.c:73:36: Taking false branch
71.   
72.   	if ((ctx = BN_CTX_new()) == NULL) goto bn_err;
73.   	if ((prime = BN_new()) == NULL || (a = BN_new()) == NULL || (b = BN_new()) == NULL ||
                                         ^
74.   		(x = BN_new()) == NULL || (order = BN_new()) == NULL) goto bn_err;
75.   	

crypto/ec/ec_curve.c:73:62: Taking false branch
71.   
72.   	if ((ctx = BN_CTX_new()) == NULL) goto bn_err;
73.   	if ((prime = BN_new()) == NULL || (a = BN_new()) == NULL || (b = BN_new()) == NULL ||
                                                                   ^
74.   		(x = BN_new()) == NULL || (order = BN_new()) == NULL) goto bn_err;
75.   	

crypto/ec/ec_curve.c:74:3: Taking false branch
72.   	if ((ctx = BN_CTX_new()) == NULL) goto bn_err;
73.   	if ((prime = BN_new()) == NULL || (a = BN_new()) == NULL || (b = BN_new()) == NULL ||
74.   		(x = BN_new()) == NULL || (order = BN_new()) == NULL) goto bn_err;
        ^
75.   	
76.   	if (!BN_hex2bn(&prime, prime_in)) goto bn_err;

crypto/ec/ec_curve.c:74:29: Taking false branch
72.   	if ((ctx = BN_CTX_new()) == NULL) goto bn_err;
73.   	if ((prime = BN_new()) == NULL || (a = BN_new()) == NULL || (b = BN_new()) == NULL ||
74.   		(x = BN_new()) == NULL || (order = BN_new()) == NULL) goto bn_err;
                                  ^
75.   	
76.   	if (!BN_hex2bn(&prime, prime_in)) goto bn_err;

crypto/ec/ec_curve.c:76:7: Taking true branch
74.   		(x = BN_new()) == NULL || (order = BN_new()) == NULL) goto bn_err;
75.   	
76.   	if (!BN_hex2bn(&prime, prime_in)) goto bn_err;
            ^
77.   	if (!BN_hex2bn(&a, a_in)) goto bn_err;
78.   	if (!BN_hex2bn(&b, b_in)) goto bn_err;

crypto/ec/ec_curve.c:88:1: 
86.   	if (!EC_GROUP_set_generator(group, P, order, BN_value_one())) goto err;
87.   	ok=1;
88. > bn_err:
89.   	if (!ok)
90.   		ECerr(EC_F_EC_GROUP_NEW_GFP_FROM_HEX, ERR_R_BN_LIB);

crypto/ec/ec_curve.c:89:7: Taking true branch
87.   	ok=1;
88.   bn_err:
89.   	if (!ok)
            ^
90.   		ECerr(EC_F_EC_GROUP_NEW_GFP_FROM_HEX, ERR_R_BN_LIB);
91.   err:

crypto/ec/ec_curve.c:90:3: 
88.   bn_err:
89.   	if (!ok)
90. > 		ECerr(EC_F_EC_GROUP_NEW_GFP_FROM_HEX, ERR_R_BN_LIB);
91.   err:
92.   	if (!ok)

crypto/err/err.c:615:1: start of procedure ERR_put_error()
  613.   /********************************************************/
  614.   
  615. > void ERR_put_error(int lib, int func, int reason, const char *file,
  616.   	     int line)
  617.   	{

crypto/err/err.c:639:2: Skipping ERR_get_state(): empty list of specs
  637.   	}
  638.   #endif
  639.   	es=ERR_get_state();
          ^
  640.   
  641.   	es->top=(es->top+1)%ERR_NUM_ERRORS;

crypto/err/err.c:641:2: 
  639.   	es=ERR_get_state();
  640.   
  641. > 	es->top=(es->top+1)%ERR_NUM_ERRORS;
  642.   	if (es->top == es->bottom)
  643.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;

crypto/err/err.c:642:6: Taking false branch
  640.   
  641.   	es->top=(es->top+1)%ERR_NUM_ERRORS;
  642.   	if (es->top == es->bottom)
              ^
  643.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
  644.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);

crypto/err/err.c:644:2: 
  642.   	if (es->top == es->bottom)
  643.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
  644. > 	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
  645.   	es->err_file[es->top]=file;
  646.   	es->err_line[es->top]=line;

crypto/err/err.c:645:2: 
  643.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
  644.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
  645. > 	es->err_file[es->top]=file;
  646.   	es->err_line[es->top]=line;
  647.   	err_clear_data(es,es->top);

crypto/err/err.c:646:2: 
  644.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
  645.   	es->err_file[es->top]=file;
  646. > 	es->err_line[es->top]=line;
  647.   	err_clear_data(es,es->top);
  648.   	}

crypto/err/err.c:647:2: Taking true branch
  645.   	es->err_file[es->top]=file;
  646.   	es->err_line[es->top]=line;
  647.   	err_clear_data(es,es->top);
          ^
  648.   	}
  649.   

crypto/err/err.c:647:2: Taking false branch
  645.   	es->err_file[es->top]=file;
  646.   	es->err_line[es->top]=line;
  647.   	err_clear_data(es,es->top);
          ^
  648.   	}
  649.   

crypto/err/err.c:648:2: return from a call to ERR_put_error
  646.   	es->err_line[es->top]=line;
  647.   	err_clear_data(es,es->top);
  648.   	}
          ^
  649.   
  650.   void ERR_clear_error(void)

crypto/ec/ec_curve.c:91:1: 
89.   	if (!ok)
90.   		ECerr(EC_F_EC_GROUP_NEW_GFP_FROM_HEX, ERR_R_BN_LIB);
91. > err:
92.   	if (!ok)
93.   		{

crypto/ec/ec_curve.c:92:7: Taking true branch
90.   		ECerr(EC_F_EC_GROUP_NEW_GFP_FROM_HEX, ERR_R_BN_LIB);
91.   err:
92.   	if (!ok)
            ^
93.   		{
94.   		EC_GROUP_free(group);

crypto/ec/ec_curve.c:94:3: 
92.   	if (!ok)
93.   		{
94. > 		EC_GROUP_free(group);
95.   		group = NULL;
96.   		}

static EC_GROUP *ec_group_new_GFp_from_hex(const char *prime_in,
	    const char *a_in, const char *b_in,
	    const char *x_in, const int y_bit, const char *order_in)
	{
	EC_GROUP *group=NULL;
	EC_POINT *P=NULL;
	BN_CTX	 *ctx=NULL;
	BIGNUM 	 *prime=NULL,*a=NULL,*b=NULL,*x=NULL,*order=NULL;
	int	 ok=0;
	if ((ctx = BN_CTX_new()) == NULL) goto bn_err;
	if ((prime = BN_new()) == NULL || (a = BN_new()) == NULL || (b = BN_new()) == NULL ||
		(x = BN_new()) == NULL || (order = BN_new()) == NULL) goto bn_err;
	if (!BN_hex2bn(&prime, prime_in)) goto bn_err;
	if (!BN_hex2bn(&a, a_in)) goto bn_err;
	if (!BN_hex2bn(&b, b_in)) goto bn_err;
	if ((group = EC_GROUP_new_curve_GFp(prime, a, b, ctx)) == NULL) goto err;
	if ((P = EC_POINT_new(group)) == NULL) goto err;
	if (!BN_hex2bn(&x, x_in)) goto bn_err;
	if (!EC_POINT_set_compressed_coordinates_GFp(group, P, x, y_bit, ctx)) goto err;
	if (!BN_hex2bn(&order, order_in)) goto bn_err;
	if (!EC_GROUP_set_generator(group, P, order, BN_value_one())) goto err;
	ok=1;
bn_err:
	if (!ok)
		ECerr(EC_F_EC_GROUP_NEW_GFP_FROM_HEX, ERR_R_BN_LIB);
err:
	if (!ok)
		{
		EC_GROUP_free(group);
		group = NULL;
		}
	if (P) 	   EC_POINT_free(P);
	if (ctx)   BN_CTX_free(ctx);
	if (prime) BN_free(prime);
	if (a)     BN_free(a);
	if (b)     BN_free(b);
	if (order) BN_free(order);
	if (x)     BN_free(x);
	return(group);
	}
['static EC_GROUP *ec_group_new_GFp_from_hex(const char *prime_in,\n\t    const char *a_in, const char *b_in,\n\t    const char *x_in, const int y_bit, const char *order_in)\n\t{\n\tEC_GROUP *group=NULL;\n\tEC_POINT *P=NULL;\n\tBN_CTX\t *ctx=NULL;\n\tBIGNUM \t *prime=NULL,*a=NULL,*b=NULL,*x=NULL,*order=NULL;\n\tint\t ok=0;\n\tif ((ctx = BN_CTX_new()) == NULL) goto bn_err;\n\tif ((prime = BN_new()) == NULL || (a = BN_new()) == NULL || (b = BN_new()) == NULL ||\n\t\t(x = BN_new()) == NULL || (order = BN_new()) == NULL) goto bn_err;\n\tif (!BN_hex2bn(&prime, prime_in)) goto bn_err;\n\tif (!BN_hex2bn(&a, a_in)) goto bn_err;\n\tif (!BN_hex2bn(&b, b_in)) goto bn_err;\n\tif ((group = EC_GROUP_new_curve_GFp(prime, a, b, ctx)) == NULL) goto err;\n\tif ((P = EC_POINT_new(group)) == NULL) goto err;\n\tif (!BN_hex2bn(&x, x_in)) goto bn_err;\n\tif (!EC_POINT_set_compressed_coordinates_GFp(group, P, x, y_bit, ctx)) goto err;\n\tif (!BN_hex2bn(&order, order_in)) goto bn_err;\n\tif (!EC_GROUP_set_generator(group, P, order, BN_value_one())) goto err;\n\tok=1;\nbn_err:\n\tif (!ok)\n\t\tECerr(EC_F_EC_GROUP_NEW_GFP_FROM_HEX, ERR_R_BN_LIB);\nerr:\n\tif (!ok)\n\t\t{\n\t\tEC_GROUP_free(group);\n\t\tgroup = NULL;\n\t\t}\n\tif (P) \t   EC_POINT_free(P);\n\tif (ctx)   BN_CTX_free(ctx);\n\tif (prime) BN_free(prime);\n\tif (a)     BN_free(a);\n\tif (b)     BN_free(b);\n\tif (order) BN_free(order);\n\tif (x)     BN_free(x);\n\treturn(group);\n\t}', 'void ERR_put_error(int lib, int func, int reason, const char *file,\n\t     int line)\n\t{\n\tERR_STATE *es;\n#ifdef _OSD_POSIX\n\tif (strncmp(file,"*POSIX(", sizeof("*POSIX(")-1) == 0) {\n\t\tchar *end;\n\t\tfile += sizeof("*POSIX(")-1;\n\t\tend = &file[strlen(file)-1];\n\t\tif (*end == \')\')\n\t\t\t*end = \'\\0\';\n\t\tif ((end = strrchr(file, \'/\')) != NULL)\n\t\t\tfile = &end[1];\n\t}\n#endif\n\tes=ERR_get_state();\n\tes->top=(es->top+1)%ERR_NUM_ERRORS;\n\tif (es->top == es->bottom)\n\t\tes->bottom=(es->bottom+1)%ERR_NUM_ERRORS;\n\tes->err_buffer[es->top]=ERR_PACK(lib,func,reason);\n\tes->err_file[es->top]=file;\n\tes->err_line[es->top]=line;\n\terr_clear_data(es,es->top);\n\t}']