crypto/rsa/rsa_eay.c:518: error: NULL_DEREFERENCE
  pointer `meth` last assigned on line 460 could be null and is dereferenced at line 518, column 7.
Showing all 36 steps of the trace


crypto/rsa/rsa_eay.c:453:1: start of procedure RSA_eay_mod_exp()
451.   	}
452.   
453. > static int RSA_eay_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa)
454.   	{
455.   	const RSA_METHOD *meth;

crypto/rsa/rsa_eay.c:457:2: 
455.   	const RSA_METHOD *meth;
456.   	BIGNUM r1,m1,vrfy;
457. > 	int ret=0;
458.   	BN_CTX *ctx;
459.   

crypto/rsa/rsa_eay.c:460:2: 
458.   	BN_CTX *ctx;
459.   
460. > 	meth = ENGINE_get_RSA(rsa->engine);
461.   	if ((ctx=BN_CTX_new()) == NULL) goto err;
462.   	BN_init(&m1);

crypto/engine/engine_list.c:563:1: start of procedure ENGINE_get_RSA()
  561.   	}
  562.   
  563. > const RSA_METHOD *ENGINE_get_RSA(ENGINE *e)
  564.   	{
  565.   	if(e == NULL)

crypto/engine/engine_list.c:565:5: Taking true branch
  563.   const RSA_METHOD *ENGINE_get_RSA(ENGINE *e)
  564.   	{
  565.   	if(e == NULL)
             ^
  566.   		{
  567.   		ENGINEerr(ENGINE_F_ENGINE_GET_RSA,

crypto/engine/engine_list.c:567:3: 
  565.   	if(e == NULL)
  566.   		{
  567. > 		ENGINEerr(ENGINE_F_ENGINE_GET_RSA,
  568.   			ERR_R_PASSED_NULL_PARAMETER);
  569.   		return NULL;

crypto/err/err.c:357:1: start of procedure ERR_put_error()
    355.   /********************************************************/
    356.   
    357. > void ERR_put_error(int lib, int func, int reason, const char *file,
    358.   	     int line)
    359.   	{

crypto/err/err.c:381:2: Skipping ERR_get_state(): empty list of specs
    379.   	}
    380.   #endif
    381.   	es=ERR_get_state();
            ^
    382.   
    383.   	es->top=(es->top+1)%ERR_NUM_ERRORS;

crypto/err/err.c:383:2: 
    381.   	es=ERR_get_state();
    382.   
    383. > 	es->top=(es->top+1)%ERR_NUM_ERRORS;
    384.   	if (es->top == es->bottom)
    385.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;

crypto/err/err.c:384:6: Taking false branch
    382.   
    383.   	es->top=(es->top+1)%ERR_NUM_ERRORS;
    384.   	if (es->top == es->bottom)
                ^
    385.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
    386.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);

crypto/err/err.c:386:2: 
    384.   	if (es->top == es->bottom)
    385.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
    386. > 	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
    387.   	es->err_file[es->top]=file;
    388.   	es->err_line[es->top]=line;

crypto/err/err.c:387:2: 
    385.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
    386.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
    387. > 	es->err_file[es->top]=file;
    388.   	es->err_line[es->top]=line;
    389.   	err_clear_data(es,es->top);

crypto/err/err.c:388:2: 
    386.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
    387.   	es->err_file[es->top]=file;
    388. > 	es->err_line[es->top]=line;
    389.   	err_clear_data(es,es->top);
    390.   	}

crypto/err/err.c:389:2: Taking true branch
    387.   	es->err_file[es->top]=file;
    388.   	es->err_line[es->top]=line;
    389.   	err_clear_data(es,es->top);
            ^
    390.   	}
    391.   

crypto/err/err.c:389:2: Taking false branch
    387.   	es->err_file[es->top]=file;
    388.   	es->err_line[es->top]=line;
    389.   	err_clear_data(es,es->top);
            ^
    390.   	}
    391.   

crypto/err/err.c:390:2: return from a call to ERR_put_error
    388.   	es->err_line[es->top]=line;
    389.   	err_clear_data(es,es->top);
    390.   	}
            ^
    391.   
    392.   void ERR_clear_error(void)

crypto/engine/engine_list.c:569:3: 
  567.   		ENGINEerr(ENGINE_F_ENGINE_GET_RSA,
  568.   			ERR_R_PASSED_NULL_PARAMETER);
  569. > 		return NULL;
  570.   		}
  571.   	return e->rsa_meth;

crypto/engine/engine_list.c:572:2: return from a call to ENGINE_get_RSA
  570.   		}
  571.   	return e->rsa_meth;
  572.   	}
          ^
  573.   
  574.   const DSA_METHOD *ENGINE_get_DSA(ENGINE *e)

crypto/rsa/rsa_eay.c:461:6: Taking false branch
459.   
460.   	meth = ENGINE_get_RSA(rsa->engine);
461.   	if ((ctx=BN_CTX_new()) == NULL) goto err;
            ^
462.   	BN_init(&m1);
463.   	BN_init(&r1);

crypto/rsa/rsa_eay.c:462:2: 
460.   	meth = ENGINE_get_RSA(rsa->engine);
461.   	if ((ctx=BN_CTX_new()) == NULL) goto err;
462. > 	BN_init(&m1);
463.   	BN_init(&r1);
464.   	BN_init(&vrfy);

crypto/bn/bn_lib.c:286:1: start of procedure BN_init()
  284.   	}
  285.   
  286. > void BN_init(BIGNUM *a)
  287.   	{
  288.   	memset(a,0,sizeof(BIGNUM));

crypto/bn/bn_lib.c:288:2: 
  286.   void BN_init(BIGNUM *a)
  287.   	{
  288. > 	memset(a,0,sizeof(BIGNUM));
  289.   	}
  290.   

crypto/bn/bn_lib.c:289:2: return from a call to BN_init
  287.   	{
  288.   	memset(a,0,sizeof(BIGNUM));
  289.   	}
          ^
  290.   
  291.   BIGNUM *BN_new(void)

crypto/rsa/rsa_eay.c:463:2: 
461.   	if ((ctx=BN_CTX_new()) == NULL) goto err;
462.   	BN_init(&m1);
463. > 	BN_init(&r1);
464.   	BN_init(&vrfy);
465.   

crypto/bn/bn_lib.c:286:1: start of procedure BN_init()
  284.   	}
  285.   
  286. > void BN_init(BIGNUM *a)
  287.   	{
  288.   	memset(a,0,sizeof(BIGNUM));

crypto/bn/bn_lib.c:288:2: 
  286.   void BN_init(BIGNUM *a)
  287.   	{
  288. > 	memset(a,0,sizeof(BIGNUM));
  289.   	}
  290.   

crypto/bn/bn_lib.c:289:2: return from a call to BN_init
  287.   	{
  288.   	memset(a,0,sizeof(BIGNUM));
  289.   	}
          ^
  290.   
  291.   BIGNUM *BN_new(void)

crypto/rsa/rsa_eay.c:464:2: 
462.   	BN_init(&m1);
463.   	BN_init(&r1);
464. > 	BN_init(&vrfy);
465.   
466.   	if (rsa->flags & RSA_FLAG_CACHE_PRIVATE)

crypto/bn/bn_lib.c:286:1: start of procedure BN_init()
  284.   	}
  285.   
  286. > void BN_init(BIGNUM *a)
  287.   	{
  288.   	memset(a,0,sizeof(BIGNUM));

crypto/bn/bn_lib.c:288:2: 
  286.   void BN_init(BIGNUM *a)
  287.   	{
  288. > 	memset(a,0,sizeof(BIGNUM));
  289.   	}
  290.   

crypto/bn/bn_lib.c:289:2: return from a call to BN_init
  287.   	{
  288.   	memset(a,0,sizeof(BIGNUM));
  289.   	}
          ^
  290.   
  291.   BIGNUM *BN_new(void)

crypto/rsa/rsa_eay.c:466:6: Taking true branch
464.   	BN_init(&vrfy);
465.   
466.   	if (rsa->flags & RSA_FLAG_CACHE_PRIVATE)
            ^
467.   		{
468.   		if (rsa->_method_mod_p == NULL)

crypto/rsa/rsa_eay.c:468:7: Taking false branch
466.   	if (rsa->flags & RSA_FLAG_CACHE_PRIVATE)
467.   		{
468.   		if (rsa->_method_mod_p == NULL)
             ^
469.   			{
470.   			BN_MONT_CTX* bn_mont_ctx;

crypto/rsa/rsa_eay.c:492:7: Taking false branch
490.   			}
491.   
492.   		if (rsa->_method_mod_q == NULL)
             ^
493.   			{
494.   			BN_MONT_CTX* bn_mont_ctx;

crypto/rsa/rsa_eay.c:517:7: Taking false branch
515.   		}
516.   		
517.   	if (!BN_mod(&r1,I,rsa->q,ctx)) goto err;
             ^
518.   	if (!meth->bn_mod_exp(&m1,&r1,rsa->dmq1,rsa->q,ctx,
519.   		rsa->_method_mod_q)) goto err;

crypto/rsa/rsa_eay.c:518:7: 
516.   		
517.   	if (!BN_mod(&r1,I,rsa->q,ctx)) goto err;
518. > 	if (!meth->bn_mod_exp(&m1,&r1,rsa->dmq1,rsa->q,ctx,
519.   		rsa->_method_mod_q)) goto err;
520.   

static int RSA_eay_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa)
	{
	const RSA_METHOD *meth;
	BIGNUM r1,m1,vrfy;
	int ret=0;
	BN_CTX *ctx;
	meth = ENGINE_get_RSA(rsa->engine);
	if ((ctx=BN_CTX_new()) == NULL) goto err;
	BN_init(&m1);
	BN_init(&r1);
	BN_init(&vrfy);
	if (rsa->flags & RSA_FLAG_CACHE_PRIVATE)
		{
		if (rsa->_method_mod_p == NULL)
			{
			BN_MONT_CTX* bn_mont_ctx;
			if ((bn_mont_ctx=BN_MONT_CTX_new()) == NULL)
				goto err;
			if (!BN_MONT_CTX_set(bn_mont_ctx,rsa->p,ctx))
				{
				BN_MONT_CTX_free(bn_mont_ctx);
				goto err;
				}
			if (rsa->_method_mod_p == NULL)
				{
				CRYPTO_w_lock(CRYPTO_LOCK_RSA);
				if (rsa->_method_mod_p == NULL)
					{
					rsa->_method_mod_p = bn_mont_ctx;
					bn_mont_ctx = NULL;
					}
				CRYPTO_w_unlock(CRYPTO_LOCK_RSA);
				}
			if (bn_mont_ctx)
				BN_MONT_CTX_free(bn_mont_ctx);
			}
		if (rsa->_method_mod_q == NULL)
			{
			BN_MONT_CTX* bn_mont_ctx;
			if ((bn_mont_ctx=BN_MONT_CTX_new()) == NULL)
				goto err;
			if (!BN_MONT_CTX_set(bn_mont_ctx,rsa->q,ctx))
				{
				BN_MONT_CTX_free(bn_mont_ctx);
				goto err;
				}
			if (rsa->_method_mod_q == NULL)
				{
				CRYPTO_w_lock(CRYPTO_LOCK_RSA);
				if (rsa->_method_mod_q == NULL)
					{
					rsa->_method_mod_q = bn_mont_ctx;
					bn_mont_ctx = NULL;
					}
				CRYPTO_w_unlock(CRYPTO_LOCK_RSA);
				}
			if (bn_mont_ctx)
				BN_MONT_CTX_free(bn_mont_ctx);
			}
		}
	if (!BN_mod(&r1,I,rsa->q,ctx)) goto err;
	if (!meth->bn_mod_exp(&m1,&r1,rsa->dmq1,rsa->q,ctx,
		rsa->_method_mod_q)) goto err;
	if (!BN_mod(&r1,I,rsa->p,ctx)) goto err;
	if (!meth->bn_mod_exp(r0,&r1,rsa->dmp1,rsa->p,ctx,
		rsa->_method_mod_p)) goto err;
	if (!BN_sub(r0,r0,&m1)) goto err;
	if (r0->neg)
		if (!BN_add(r0,r0,rsa->p)) goto err;
	if (!BN_mul(&r1,r0,rsa->iqmp,ctx)) goto err;
	if (!BN_mod(r0,&r1,rsa->p,ctx)) goto err;
	if (r0->neg)
		if (!BN_add(r0,r0,rsa->p)) goto err;
	if (!BN_mul(&r1,r0,rsa->q,ctx)) goto err;
	if (!BN_add(r0,&r1,&m1)) goto err;
	if (rsa->e && rsa->n)
		{
		if (!meth->bn_mod_exp(&vrfy,r0,rsa->e,rsa->n,ctx,NULL)) goto err;
		if (BN_cmp(I, &vrfy) != 0)
			{
			if (!meth->bn_mod_exp(r0,I,rsa->d,rsa->n,ctx,NULL)) goto err;
			}
		}
	ret=1;
err:
	BN_clear_free(&m1);
	BN_clear_free(&r1);
	BN_clear_free(&vrfy);
	BN_CTX_free(ctx);
	return(ret);
	}
['static int RSA_eay_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa)\n\t{\n\tconst RSA_METHOD *meth;\n\tBIGNUM r1,m1,vrfy;\n\tint ret=0;\n\tBN_CTX *ctx;\n\tmeth = ENGINE_get_RSA(rsa->engine);\n\tif ((ctx=BN_CTX_new()) == NULL) goto err;\n\tBN_init(&m1);\n\tBN_init(&r1);\n\tBN_init(&vrfy);\n\tif (rsa->flags & RSA_FLAG_CACHE_PRIVATE)\n\t\t{\n\t\tif (rsa->_method_mod_p == NULL)\n\t\t\t{\n\t\t\tBN_MONT_CTX* bn_mont_ctx;\n\t\t\tif ((bn_mont_ctx=BN_MONT_CTX_new()) == NULL)\n\t\t\t\tgoto err;\n\t\t\tif (!BN_MONT_CTX_set(bn_mont_ctx,rsa->p,ctx))\n\t\t\t\t{\n\t\t\t\tBN_MONT_CTX_free(bn_mont_ctx);\n\t\t\t\tgoto err;\n\t\t\t\t}\n\t\t\tif (rsa->_method_mod_p == NULL)\n\t\t\t\t{\n\t\t\t\tCRYPTO_w_lock(CRYPTO_LOCK_RSA);\n\t\t\t\tif (rsa->_method_mod_p == NULL)\n\t\t\t\t\t{\n\t\t\t\t\trsa->_method_mod_p = bn_mont_ctx;\n\t\t\t\t\tbn_mont_ctx = NULL;\n\t\t\t\t\t}\n\t\t\t\tCRYPTO_w_unlock(CRYPTO_LOCK_RSA);\n\t\t\t\t}\n\t\t\tif (bn_mont_ctx)\n\t\t\t\tBN_MONT_CTX_free(bn_mont_ctx);\n\t\t\t}\n\t\tif (rsa->_method_mod_q == NULL)\n\t\t\t{\n\t\t\tBN_MONT_CTX* bn_mont_ctx;\n\t\t\tif ((bn_mont_ctx=BN_MONT_CTX_new()) == NULL)\n\t\t\t\tgoto err;\n\t\t\tif (!BN_MONT_CTX_set(bn_mont_ctx,rsa->q,ctx))\n\t\t\t\t{\n\t\t\t\tBN_MONT_CTX_free(bn_mont_ctx);\n\t\t\t\tgoto err;\n\t\t\t\t}\n\t\t\tif (rsa->_method_mod_q == NULL)\n\t\t\t\t{\n\t\t\t\tCRYPTO_w_lock(CRYPTO_LOCK_RSA);\n\t\t\t\tif (rsa->_method_mod_q == NULL)\n\t\t\t\t\t{\n\t\t\t\t\trsa->_method_mod_q = bn_mont_ctx;\n\t\t\t\t\tbn_mont_ctx = NULL;\n\t\t\t\t\t}\n\t\t\t\tCRYPTO_w_unlock(CRYPTO_LOCK_RSA);\n\t\t\t\t}\n\t\t\tif (bn_mont_ctx)\n\t\t\t\tBN_MONT_CTX_free(bn_mont_ctx);\n\t\t\t}\n\t\t}\n\tif (!BN_mod(&r1,I,rsa->q,ctx)) goto err;\n\tif (!meth->bn_mod_exp(&m1,&r1,rsa->dmq1,rsa->q,ctx,\n\t\trsa->_method_mod_q)) goto err;\n\tif (!BN_mod(&r1,I,rsa->p,ctx)) goto err;\n\tif (!meth->bn_mod_exp(r0,&r1,rsa->dmp1,rsa->p,ctx,\n\t\trsa->_method_mod_p)) goto err;\n\tif (!BN_sub(r0,r0,&m1)) goto err;\n\tif (r0->neg)\n\t\tif (!BN_add(r0,r0,rsa->p)) goto err;\n\tif (!BN_mul(&r1,r0,rsa->iqmp,ctx)) goto err;\n\tif (!BN_mod(r0,&r1,rsa->p,ctx)) goto err;\n\tif (r0->neg)\n\t\tif (!BN_add(r0,r0,rsa->p)) goto err;\n\tif (!BN_mul(&r1,r0,rsa->q,ctx)) goto err;\n\tif (!BN_add(r0,&r1,&m1)) goto err;\n\tif (rsa->e && rsa->n)\n\t\t{\n\t\tif (!meth->bn_mod_exp(&vrfy,r0,rsa->e,rsa->n,ctx,NULL)) goto err;\n\t\tif (BN_cmp(I, &vrfy) != 0)\n\t\t\t{\n\t\t\tif (!meth->bn_mod_exp(r0,I,rsa->d,rsa->n,ctx,NULL)) goto err;\n\t\t\t}\n\t\t}\n\tret=1;\nerr:\n\tBN_clear_free(&m1);\n\tBN_clear_free(&r1);\n\tBN_clear_free(&vrfy);\n\tBN_CTX_free(ctx);\n\treturn(ret);\n\t}', 'const RSA_METHOD *ENGINE_get_RSA(ENGINE *e)\n\t{\n\tif(e == NULL)\n\t\t{\n\t\tENGINEerr(ENGINE_F_ENGINE_GET_RSA,\n\t\t\tERR_R_PASSED_NULL_PARAMETER);\n\t\treturn NULL;\n\t\t}\n\treturn e->rsa_meth;\n\t}', 'void ERR_put_error(int lib, int func, int reason, const char *file,\n\t     int line)\n\t{\n\tERR_STATE *es;\n#ifdef _OSD_POSIX\n\tif (strncmp(file,"*POSIX(", sizeof("*POSIX(")-1) == 0) {\n\t\tchar *end;\n\t\tfile += sizeof("*POSIX(")-1;\n\t\tend = &file[strlen(file)-1];\n\t\tif (*end == \')\')\n\t\t\t*end = \'\\0\';\n\t\tif ((end = strrchr(file, \'/\')) != NULL)\n\t\t\tfile = &end[1];\n\t}\n#endif\n\tes=ERR_get_state();\n\tes->top=(es->top+1)%ERR_NUM_ERRORS;\n\tif (es->top == es->bottom)\n\t\tes->bottom=(es->bottom+1)%ERR_NUM_ERRORS;\n\tes->err_buffer[es->top]=ERR_PACK(lib,func,reason);\n\tes->err_file[es->top]=file;\n\tes->err_line[es->top]=line;\n\terr_clear_data(es,es->top);\n\t}', 'void BN_init(BIGNUM *a)\n\t{\n\tmemset(a,0,sizeof(BIGNUM));\n\t}']