crypto/bn/bn_mul.c:1035: error: NULL_DEREFERENCE
  pointer `t` last assigned on line 1025 could be null and is dereferenced at line 1035, column 5.
Showing all 43 steps of the trace


crypto/bn/bn_mul.c:941:1: start of procedure BN_mul()
939.   #endif /* BN_RECURSION */
940.   
941. > int BN_mul(BIGNUM *r, const BIGNUM *a, const BIGNUM *b, BN_CTX *ctx)
942.   	{
943.   	int ret=0;

crypto/bn/bn_mul.c:943:2: 
941.   int BN_mul(BIGNUM *r, const BIGNUM *a, const BIGNUM *b, BN_CTX *ctx)
942.   	{
943. > 	int ret=0;
944.   	int top,al,bl;
945.   	BIGNUM *rr;

crypto/bn/bn_mul.c:950:2: 
948.   #endif
949.   #ifdef BN_RECURSION
950. > 	BIGNUM *t=NULL;
951.   	int j=0,k;
952.   #endif

crypto/bn/bn_mul.c:951:2: 
949.   #ifdef BN_RECURSION
950.   	BIGNUM *t=NULL;
951. > 	int j=0,k;
952.   #endif
953.   

crypto/bn/bn_mul.c:962:2: 
960.   	bn_check_top(r);
961.   
962. > 	al=a->top;
963.   	bl=b->top;
964.   

crypto/bn/bn_mul.c:963:2: 
961.   
962.   	al=a->top;
963. > 	bl=b->top;
964.   
965.   	if ((al == 0) || (bl == 0))

crypto/bn/bn_mul.c:965:7: Taking false branch
963.   	bl=b->top;
964.   
965.   	if ((al == 0) || (bl == 0))
             ^
966.   		{
967.   		if (!BN_zero(r)) goto err;

crypto/bn/bn_mul.c:965:20: Taking false branch
963.   	bl=b->top;
964.   
965.   	if ((al == 0) || (bl == 0))
                          ^
966.   		{
967.   		if (!BN_zero(r)) goto err;

crypto/bn/bn_mul.c:970:2: 
968.   		return(1);
969.   		}
970. > 	top=al+bl;
971.   
972.   	BN_CTX_start(ctx);

crypto/bn/bn_mul.c:972:2: 
970.   	top=al+bl;
971.   
972. > 	BN_CTX_start(ctx);
973.   	if ((r == a) || (r == b))
974.   		{

crypto/bn/bn_ctx.c:130:1: start of procedure BN_CTX_start()
  128.   	}
  129.   
  130. > void BN_CTX_start(BN_CTX *ctx)
  131.   	{
  132.   	if (ctx->depth < BN_CTX_NUM_POS)

crypto/bn/bn_ctx.c:132:6: Taking true branch
  130.   void BN_CTX_start(BN_CTX *ctx)
  131.   	{
  132.   	if (ctx->depth < BN_CTX_NUM_POS)
              ^
  133.   		ctx->pos[ctx->depth] = ctx->tos;
  134.   	ctx->depth++;

crypto/bn/bn_ctx.c:133:3: 
  131.   	{
  132.   	if (ctx->depth < BN_CTX_NUM_POS)
  133. > 		ctx->pos[ctx->depth] = ctx->tos;
  134.   	ctx->depth++;
  135.   	}

crypto/bn/bn_ctx.c:134:2: 
  132.   	if (ctx->depth < BN_CTX_NUM_POS)
  133.   		ctx->pos[ctx->depth] = ctx->tos;
  134. > 	ctx->depth++;
  135.   	}
  136.   

crypto/bn/bn_ctx.c:135:2: return from a call to BN_CTX_start
  133.   		ctx->pos[ctx->depth] = ctx->tos;
  134.   	ctx->depth++;
  135.   	}
          ^
  136.   
  137.   

crypto/bn/bn_mul.c:973:7: Taking false branch
971.   
972.   	BN_CTX_start(ctx);
973.   	if ((r == a) || (r == b))
             ^
974.   		{
975.   		if ((rr = BN_CTX_get(ctx)) == NULL) goto err;

crypto/bn/bn_mul.c:973:19: Taking false branch
971.   
972.   	BN_CTX_start(ctx);
973.   	if ((r == a) || (r == b))
                         ^
974.   		{
975.   		if ((rr = BN_CTX_get(ctx)) == NULL) goto err;

crypto/bn/bn_mul.c:978:3: 
976.   		}
977.   	else
978. > 		rr = r;
979.   	rr->neg=a->neg^b->neg;
980.   

crypto/bn/bn_mul.c:979:2: 
977.   	else
978.   		rr = r;
979. > 	rr->neg=a->neg^b->neg;
980.   
981.   #if defined(BN_MUL_COMBA) || defined(BN_RECURSION)

crypto/bn/bn_mul.c:982:2: 
980.   
981.   #if defined(BN_MUL_COMBA) || defined(BN_RECURSION)
982. > 	i = al-bl;
983.   #endif
984.   #ifdef BN_MUL_COMBA

crypto/bn/bn_mul.c:985:6: Taking false branch
983.   #endif
984.   #ifdef BN_MUL_COMBA
985.   	if (i == 0)
            ^
986.   		{
987.   # if 0

crypto/bn/bn_mul.c:1006:7: Taking true branch
1004.   #endif /* BN_MUL_COMBA */
1005.   #ifdef BN_RECURSION
1006.   	if ((al >= BN_MULL_SIZE_NORMAL) && (bl >= BN_MULL_SIZE_NORMAL))
              ^
1007.   		{
1008.   		if (i >= -1 && i <= 1)

crypto/bn/bn_mul.c:1006:38: Taking true branch
1004.   #endif /* BN_MUL_COMBA */
1005.   #ifdef BN_RECURSION
1006.   	if ((al >= BN_MULL_SIZE_NORMAL) && (bl >= BN_MULL_SIZE_NORMAL))
                                             ^
1007.   		{
1008.   		if (i >= -1 && i <= 1)

crypto/bn/bn_mul.c:1008:7: Taking true branch
1006.   	if ((al >= BN_MULL_SIZE_NORMAL) && (bl >= BN_MULL_SIZE_NORMAL))
1007.   		{
1008.   		if (i >= -1 && i <= 1)
              ^
1009.   			{
1010.   			int sav_j =0;

crypto/bn/bn_mul.c:1008:18: Taking true branch
1006.   	if ((al >= BN_MULL_SIZE_NORMAL) && (bl >= BN_MULL_SIZE_NORMAL))
1007.   		{
1008.   		if (i >= -1 && i <= 1)
                         ^
1009.   			{
1010.   			int sav_j =0;

crypto/bn/bn_mul.c:1010:4: 
1008.   		if (i >= -1 && i <= 1)
1009.   			{
1010. > 			int sav_j =0;
1011.   			/* Find out the power of two lower or equal
1012.   			   to the longest of the two numbers */

crypto/bn/bn_mul.c:1013:8: Taking true branch
1011.   			/* Find out the power of two lower or equal
1012.   			   to the longest of the two numbers */
1013.   			if (i >= 0)
               ^
1014.   				{
1015.   				j = BN_num_bits_word((BN_ULONG)al);

crypto/bn/bn_mul.c:1015:5: Skipping BN_num_bits_word(): empty list of specs
1013.   			if (i >= 0)
1014.   				{
1015.   				j = BN_num_bits_word((BN_ULONG)al);
            ^
1016.   				}
1017.   			if (i == -1)

crypto/bn/bn_mul.c:1017:8: Taking false branch
1015.   				j = BN_num_bits_word((BN_ULONG)al);
1016.   				}
1017.   			if (i == -1)
               ^
1018.   				{
1019.   				j = BN_num_bits_word((BN_ULONG)bl);

crypto/bn/bn_mul.c:1021:4: 
1019.   				j = BN_num_bits_word((BN_ULONG)bl);
1020.   				}
1021. > 			sav_j = j;
1022.   			j = 1<<(j-1);
1023.   			assert(j <= al || j <= bl);

crypto/bn/bn_mul.c:1022:4: 
1020.   				}
1021.   			sav_j = j;
1022. > 			j = 1<<(j-1);
1023.   			assert(j <= al || j <= bl);
1024.   			k = j+j;

crypto/bn/bn_mul.c:1023:4: 
1021.   			sav_j = j;
1022.   			j = 1<<(j-1);
1023. > 			assert(j <= al || j <= bl);
1024.   			k = j+j;
1025.   			t = BN_CTX_get(ctx);

crypto/bn/bn_mul.c:1024:4: 
1022.   			j = 1<<(j-1);
1023.   			assert(j <= al || j <= bl);
1024. > 			k = j+j;
1025.   			t = BN_CTX_get(ctx);
1026.   			if (al > j || bl > j)

crypto/bn/bn_mul.c:1025:4: 
1023.   			assert(j <= al || j <= bl);
1024.   			k = j+j;
1025. > 			t = BN_CTX_get(ctx);
1026.   			if (al > j || bl > j)
1027.   				{

crypto/bn/bn_ctx.c:138:1: start of procedure BN_CTX_get()
  136.   
  137.   
  138. > BIGNUM *BN_CTX_get(BN_CTX *ctx)
  139.   	{
  140.   	/* Note: If BN_CTX_get is ever changed to allocate BIGNUMs dynamically,

crypto/bn/bn_ctx.c:145:6: Taking false branch
  143.   	 * only the last return value.)
  144.   	 */
  145.   	if (ctx->depth > BN_CTX_NUM_POS || ctx->tos >= BN_CTX_NUM)
              ^
  146.   		{
  147.   		if (!ctx->too_many)

crypto/bn/bn_ctx.c:145:37: Taking true branch
  143.   	 * only the last return value.)
  144.   	 */
  145.   	if (ctx->depth > BN_CTX_NUM_POS || ctx->tos >= BN_CTX_NUM)
                                             ^
  146.   		{
  147.   		if (!ctx->too_many)

crypto/bn/bn_ctx.c:147:8: Taking false branch
  145.   	if (ctx->depth > BN_CTX_NUM_POS || ctx->tos >= BN_CTX_NUM)
  146.   		{
  147.   		if (!ctx->too_many)
                ^
  148.   			{
  149.   			BNerr(BN_F_BN_CTX_GET,BN_R_TOO_MANY_TEMPORARY_VARIABLES);

crypto/bn/bn_ctx.c:153:3: 
  151.   			ctx->too_many = 1;
  152.   			}
  153. > 		return NULL;
  154.   		}
  155.   	return (&(ctx->bn[ctx->tos++]));

crypto/bn/bn_ctx.c:156:2: return from a call to BN_CTX_get
  154.   		}
  155.   	return (&(ctx->bn[ctx->tos++]));
  156.   	}
          ^
  157.   
  158.   void BN_CTX_end(BN_CTX *ctx)

crypto/bn/bn_mul.c:1026:8: Taking false branch
1024.   			k = j+j;
1025.   			t = BN_CTX_get(ctx);
1026.   			if (al > j || bl > j)
               ^
1027.   				{
1028.   				bn_wexpand(t,k*4);

crypto/bn/bn_mul.c:1026:18: Taking false branch
1024.   			k = j+j;
1025.   			t = BN_CTX_get(ctx);
1026.   			if (al > j || bl > j)
                         ^
1027.   				{
1028.   				bn_wexpand(t,k*4);

crypto/bn/bn_mul.c:1035:5: 
1033.   			else	/* al <= j || bl <= j */
1034.   				{
1035. > 				bn_wexpand(t,k*2);
1036.   				bn_wexpand(rr,k*2);
1037.   				bn_mul_recursive(rr->d,a->d,b->d,

int BN_mul(BIGNUM *r, const BIGNUM *a, const BIGNUM *b, BN_CTX *ctx)
	{
	int ret=0;
	int top,al,bl;
	BIGNUM *rr;
#if defined(BN_MUL_COMBA) || defined(BN_RECURSION)
	int i;
#endif
#ifdef BN_RECURSION
	BIGNUM *t=NULL;
	int j=0,k;
#endif
#ifdef BN_COUNT
	fprintf(stderr,"BN_mul %d * %d\n",a->top,b->top);
#endif
	bn_check_top(a);
	bn_check_top(b);
	bn_check_top(r);
	al=a->top;
	bl=b->top;
	if ((al == 0) || (bl == 0))
		{
		if (!BN_zero(r)) goto err;
		return(1);
		}
	top=al+bl;
	BN_CTX_start(ctx);
	if ((r == a) || (r == b))
		{
		if ((rr = BN_CTX_get(ctx)) == NULL) goto err;
		}
	else
		rr = r;
	rr->neg=a->neg^b->neg;
#if defined(BN_MUL_COMBA) || defined(BN_RECURSION)
	i = al-bl;
#endif
#ifdef BN_MUL_COMBA
	if (i == 0)
		{
# if 0
		if (al == 4)
			{
			if (bn_wexpand(rr,8) == NULL) goto err;
			rr->top=8;
			bn_mul_comba4(rr->d,a->d,b->d);
			goto end;
			}
# endif
		if (al == 8)
			{
			if (bn_wexpand(rr,16) == NULL) goto err;
			rr->top=16;
			bn_mul_comba8(rr->d,a->d,b->d);
			goto end;
			}
		}
#endif
#ifdef BN_RECURSION
	if ((al >= BN_MULL_SIZE_NORMAL) && (bl >= BN_MULL_SIZE_NORMAL))
		{
		if (i >= -1 && i <= 1)
			{
			int sav_j =0;
			if (i >= 0)
				{
				j = BN_num_bits_word((BN_ULONG)al);
				}
			if (i == -1)
				{
				j = BN_num_bits_word((BN_ULONG)bl);
				}
			sav_j = j;
			j = 1<<(j-1);
			assert(j <= al || j <= bl);
			k = j+j;
			t = BN_CTX_get(ctx);
			if (al > j || bl > j)
				{
				bn_wexpand(t,k*4);
				bn_wexpand(rr,k*4);
				bn_mul_part_recursive(rr->d,a->d,b->d,
					j,al-j,bl-j,t->d);
				}
			else
				{
				bn_wexpand(t,k*2);
				bn_wexpand(rr,k*2);
				bn_mul_recursive(rr->d,a->d,b->d,
					j,al-j,bl-j,t->d);
				}
			rr->top=top;
			goto end;
			}
#if 0
		if (i == 1 && !BN_get_flags(b,BN_FLG_STATIC_DATA))
			{
			BIGNUM *tmp_bn = (BIGNUM *)b;
			if (bn_wexpand(tmp_bn,al) == NULL) goto err;
			tmp_bn->d[bl]=0;
			bl++;
			i--;
			}
		else if (i == -1 && !BN_get_flags(a,BN_FLG_STATIC_DATA))
			{
			BIGNUM *tmp_bn = (BIGNUM *)a;
			if (bn_wexpand(tmp_bn,bl) == NULL) goto err;
			tmp_bn->d[al]=0;
			al++;
			i++;
			}
		if (i == 0)
			{
			j=BN_num_bits_word((BN_ULONG)al);
			j=1<<(j-1);
			k=j+j;
			t = BN_CTX_get(ctx);
			if (al == j)
				{
				if (bn_wexpand(t,k*2) == NULL) goto err;
				if (bn_wexpand(rr,k*2) == NULL) goto err;
				bn_mul_recursive(rr->d,a->d,b->d,al,t->d);
				}
			else
				{
				if (bn_wexpand(t,k*4) == NULL) goto err;
				if (bn_wexpand(rr,k*4) == NULL) goto err;
				bn_mul_part_recursive(rr->d,a->d,b->d,al-j,j,t->d);
				}
			rr->top=top;
			goto end;
			}
#endif
		}
#endif
	if (bn_wexpand(rr,top) == NULL) goto err;
	rr->top=top;
	bn_mul_normal(rr->d,a->d,al,b->d,bl);
#if defined(BN_MUL_COMBA) || defined(BN_RECURSION)
end:
#endif
	bn_fix_top(rr);
	if (r != rr) BN_copy(r,rr);
	ret=1;
err:
	BN_CTX_end(ctx);
	return(ret);
	}
['int BN_mul(BIGNUM *r, const BIGNUM *a, const BIGNUM *b, BN_CTX *ctx)\n\t{\n\tint ret=0;\n\tint top,al,bl;\n\tBIGNUM *rr;\n#if defined(BN_MUL_COMBA) || defined(BN_RECURSION)\n\tint i;\n#endif\n#ifdef BN_RECURSION\n\tBIGNUM *t=NULL;\n\tint j=0,k;\n#endif\n#ifdef BN_COUNT\n\tfprintf(stderr,"BN_mul %d * %d\\n",a->top,b->top);\n#endif\n\tbn_check_top(a);\n\tbn_check_top(b);\n\tbn_check_top(r);\n\tal=a->top;\n\tbl=b->top;\n\tif ((al == 0) || (bl == 0))\n\t\t{\n\t\tif (!BN_zero(r)) goto err;\n\t\treturn(1);\n\t\t}\n\ttop=al+bl;\n\tBN_CTX_start(ctx);\n\tif ((r == a) || (r == b))\n\t\t{\n\t\tif ((rr = BN_CTX_get(ctx)) == NULL) goto err;\n\t\t}\n\telse\n\t\trr = r;\n\trr->neg=a->neg^b->neg;\n#if defined(BN_MUL_COMBA) || defined(BN_RECURSION)\n\ti = al-bl;\n#endif\n#ifdef BN_MUL_COMBA\n\tif (i == 0)\n\t\t{\n# if 0\n\t\tif (al == 4)\n\t\t\t{\n\t\t\tif (bn_wexpand(rr,8) == NULL) goto err;\n\t\t\trr->top=8;\n\t\t\tbn_mul_comba4(rr->d,a->d,b->d);\n\t\t\tgoto end;\n\t\t\t}\n# endif\n\t\tif (al == 8)\n\t\t\t{\n\t\t\tif (bn_wexpand(rr,16) == NULL) goto err;\n\t\t\trr->top=16;\n\t\t\tbn_mul_comba8(rr->d,a->d,b->d);\n\t\t\tgoto end;\n\t\t\t}\n\t\t}\n#endif\n#ifdef BN_RECURSION\n\tif ((al >= BN_MULL_SIZE_NORMAL) && (bl >= BN_MULL_SIZE_NORMAL))\n\t\t{\n\t\tif (i >= -1 && i <= 1)\n\t\t\t{\n\t\t\tint sav_j =0;\n\t\t\tif (i >= 0)\n\t\t\t\t{\n\t\t\t\tj = BN_num_bits_word((BN_ULONG)al);\n\t\t\t\t}\n\t\t\tif (i == -1)\n\t\t\t\t{\n\t\t\t\tj = BN_num_bits_word((BN_ULONG)bl);\n\t\t\t\t}\n\t\t\tsav_j = j;\n\t\t\tj = 1<<(j-1);\n\t\t\tassert(j <= al || j <= bl);\n\t\t\tk = j+j;\n\t\t\tt = BN_CTX_get(ctx);\n\t\t\tif (al > j || bl > j)\n\t\t\t\t{\n\t\t\t\tbn_wexpand(t,k*4);\n\t\t\t\tbn_wexpand(rr,k*4);\n\t\t\t\tbn_mul_part_recursive(rr->d,a->d,b->d,\n\t\t\t\t\tj,al-j,bl-j,t->d);\n\t\t\t\t}\n\t\t\telse\n\t\t\t\t{\n\t\t\t\tbn_wexpand(t,k*2);\n\t\t\t\tbn_wexpand(rr,k*2);\n\t\t\t\tbn_mul_recursive(rr->d,a->d,b->d,\n\t\t\t\t\tj,al-j,bl-j,t->d);\n\t\t\t\t}\n\t\t\trr->top=top;\n\t\t\tgoto end;\n\t\t\t}\n#if 0\n\t\tif (i == 1 && !BN_get_flags(b,BN_FLG_STATIC_DATA))\n\t\t\t{\n\t\t\tBIGNUM *tmp_bn = (BIGNUM *)b;\n\t\t\tif (bn_wexpand(tmp_bn,al) == NULL) goto err;\n\t\t\ttmp_bn->d[bl]=0;\n\t\t\tbl++;\n\t\t\ti--;\n\t\t\t}\n\t\telse if (i == -1 && !BN_get_flags(a,BN_FLG_STATIC_DATA))\n\t\t\t{\n\t\t\tBIGNUM *tmp_bn = (BIGNUM *)a;\n\t\t\tif (bn_wexpand(tmp_bn,bl) == NULL) goto err;\n\t\t\ttmp_bn->d[al]=0;\n\t\t\tal++;\n\t\t\ti++;\n\t\t\t}\n\t\tif (i == 0)\n\t\t\t{\n\t\t\tj=BN_num_bits_word((BN_ULONG)al);\n\t\t\tj=1<<(j-1);\n\t\t\tk=j+j;\n\t\t\tt = BN_CTX_get(ctx);\n\t\t\tif (al == j)\n\t\t\t\t{\n\t\t\t\tif (bn_wexpand(t,k*2) == NULL) goto err;\n\t\t\t\tif (bn_wexpand(rr,k*2) == NULL) goto err;\n\t\t\t\tbn_mul_recursive(rr->d,a->d,b->d,al,t->d);\n\t\t\t\t}\n\t\t\telse\n\t\t\t\t{\n\t\t\t\tif (bn_wexpand(t,k*4) == NULL) goto err;\n\t\t\t\tif (bn_wexpand(rr,k*4) == NULL) goto err;\n\t\t\t\tbn_mul_part_recursive(rr->d,a->d,b->d,al-j,j,t->d);\n\t\t\t\t}\n\t\t\trr->top=top;\n\t\t\tgoto end;\n\t\t\t}\n#endif\n\t\t}\n#endif\n\tif (bn_wexpand(rr,top) == NULL) goto err;\n\trr->top=top;\n\tbn_mul_normal(rr->d,a->d,al,b->d,bl);\n#if defined(BN_MUL_COMBA) || defined(BN_RECURSION)\nend:\n#endif\n\tbn_fix_top(rr);\n\tif (r != rr) BN_copy(r,rr);\n\tret=1;\nerr:\n\tBN_CTX_end(ctx);\n\treturn(ret);\n\t}', 'void BN_CTX_start(BN_CTX *ctx)\n\t{\n\tif (ctx->depth < BN_CTX_NUM_POS)\n\t\tctx->pos[ctx->depth] = ctx->tos;\n\tctx->depth++;\n\t}', 'BIGNUM *BN_CTX_get(BN_CTX *ctx)\n\t{\n\tif (ctx->depth > BN_CTX_NUM_POS || ctx->tos >= BN_CTX_NUM)\n\t\t{\n\t\tif (!ctx->too_many)\n\t\t\t{\n\t\t\tBNerr(BN_F_BN_CTX_GET,BN_R_TOO_MANY_TEMPORARY_VARIABLES);\n\t\t\tctx->too_many = 1;\n\t\t\t}\n\t\treturn NULL;\n\t\t}\n\treturn (&(ctx->bn[ctx->tos++]));\n\t}']