crypto/bn/bn_div.c:183: error: NULL_DEREFERENCE
  pointer `tmp` last assigned on line 182 could be null and is dereferenced at line 183, column 2.
Showing all 25 steps of the trace


crypto/bn/bn_div.c:155:1: start of procedure BN_div()
153.   #endif /* NO_ASM */
154.   
155. > int BN_div(BIGNUM *dv, BIGNUM *rm, const BIGNUM *num, const BIGNUM *divisor,
156.   	   BN_CTX *ctx)
157.   	{

crypto/bn/bn_div.c:167:6: Taking false branch
165.   	bn_check_top(divisor);
166.   
167.   	if (BN_is_zero(divisor))
            ^
168.   		{
169.   		BNerr(BN_F_BN_DIV,BN_R_DIV_BY_ZERO);

crypto/bn/bn_div.c:167:6: Taking true branch
165.   	bn_check_top(divisor);
166.   
167.   	if (BN_is_zero(divisor))
            ^
168.   		{
169.   		BNerr(BN_F_BN_DIV,BN_R_DIV_BY_ZERO);

crypto/bn/bn_div.c:167:6: Taking false branch
165.   	bn_check_top(divisor);
166.   
167.   	if (BN_is_zero(divisor))
            ^
168.   		{
169.   		BNerr(BN_F_BN_DIV,BN_R_DIV_BY_ZERO);

crypto/bn/bn_div.c:173:6: 
171.   		}
172.   
173. > 	if (BN_ucmp(num,divisor) < 0)
174.   		{
175.   		if (rm != NULL)

crypto/bn/bn_lib.c:616:1: start of procedure BN_ucmp()
  614.   	}
  615.   
  616. > int BN_ucmp(const BIGNUM *a, const BIGNUM *b)
  617.   	{
  618.   	int i;

crypto/bn/bn_lib.c:624:2: 
  622.   	bn_check_top(b);
  623.   
  624. > 	i=a->top-b->top;
  625.   	if (i != 0) return(i);
  626.   	ap=a->d;

crypto/bn/bn_lib.c:625:6: Taking true branch
  623.   
  624.   	i=a->top-b->top;
  625.   	if (i != 0) return(i);
              ^
  626.   	ap=a->d;
  627.   	bp=b->d;

crypto/bn/bn_lib.c:625:14: 
  623.   
  624.   	i=a->top-b->top;
  625. > 	if (i != 0) return(i);
  626.   	ap=a->d;
  627.   	bp=b->d;

crypto/bn/bn_lib.c:636:2: return from a call to BN_ucmp
  634.   		}
  635.   	return(0);
  636.   	}
          ^
  637.   
  638.   int BN_cmp(const BIGNUM *a, const BIGNUM *b)

crypto/bn/bn_div.c:173:6: Taking false branch
171.   		}
172.   
173.   	if (BN_ucmp(num,divisor) < 0)
            ^
174.   		{
175.   		if (rm != NULL)

crypto/bn/bn_div.c:181:2: 
179.   		}
180.   
181. > 	BN_CTX_start(ctx);
182.   	tmp=BN_CTX_get(ctx);
183.   	tmp->neg=0;

crypto/bn/bn_ctx.c:108:1: start of procedure BN_CTX_start()
  106.   	}
  107.   
  108. > void BN_CTX_start(BN_CTX *ctx)
  109.   	{
  110.   	if (ctx->depth < BN_CTX_NUM_POS)

crypto/bn/bn_ctx.c:110:6: Taking true branch
  108.   void BN_CTX_start(BN_CTX *ctx)
  109.   	{
  110.   	if (ctx->depth < BN_CTX_NUM_POS)
              ^
  111.   		ctx->pos[ctx->depth] = ctx->tos;
  112.   	ctx->depth++;

crypto/bn/bn_ctx.c:111:3: 
  109.   	{
  110.   	if (ctx->depth < BN_CTX_NUM_POS)
  111. > 		ctx->pos[ctx->depth] = ctx->tos;
  112.   	ctx->depth++;
  113.   	}

crypto/bn/bn_ctx.c:112:2: 
  110.   	if (ctx->depth < BN_CTX_NUM_POS)
  111.   		ctx->pos[ctx->depth] = ctx->tos;
  112. > 	ctx->depth++;
  113.   	}
  114.   

crypto/bn/bn_ctx.c:113:2: return from a call to BN_CTX_start
  111.   		ctx->pos[ctx->depth] = ctx->tos;
  112.   	ctx->depth++;
  113.   	}
          ^
  114.   
  115.   BIGNUM *BN_CTX_get(BN_CTX *ctx)

crypto/bn/bn_div.c:182:2: 
180.   
181.   	BN_CTX_start(ctx);
182. > 	tmp=BN_CTX_get(ctx);
183.   	tmp->neg=0;
184.   	snum=BN_CTX_get(ctx);

crypto/bn/bn_ctx.c:115:1: start of procedure BN_CTX_get()
  113.   	}
  114.   
  115. > BIGNUM *BN_CTX_get(BN_CTX *ctx)
  116.   	{
  117.   	if (ctx->depth > BN_CTX_NUM_POS || ctx->tos >= BN_CTX_NUM)

crypto/bn/bn_ctx.c:117:6: Taking false branch
  115.   BIGNUM *BN_CTX_get(BN_CTX *ctx)
  116.   	{
  117.   	if (ctx->depth > BN_CTX_NUM_POS || ctx->tos >= BN_CTX_NUM)
              ^
  118.   		{
  119.   		if (!ctx->too_many)

crypto/bn/bn_ctx.c:117:37: Taking true branch
  115.   BIGNUM *BN_CTX_get(BN_CTX *ctx)
  116.   	{
  117.   	if (ctx->depth > BN_CTX_NUM_POS || ctx->tos >= BN_CTX_NUM)
                                             ^
  118.   		{
  119.   		if (!ctx->too_many)

crypto/bn/bn_ctx.c:119:8: Taking false branch
  117.   	if (ctx->depth > BN_CTX_NUM_POS || ctx->tos >= BN_CTX_NUM)
  118.   		{
  119.   		if (!ctx->too_many)
                ^
  120.   			{
  121.   			BNerr(BN_F_BN_CTX_GET,BN_R_TOO_MANY_TEMPORARY_VARIABLES);

crypto/bn/bn_ctx.c:125:3: 
  123.   			ctx->too_many = 1;
  124.   			}
  125. > 		return NULL;
  126.   		}
  127.   	return (&(ctx->bn[ctx->tos++]));

crypto/bn/bn_ctx.c:128:2: return from a call to BN_CTX_get
  126.   		}
  127.   	return (&(ctx->bn[ctx->tos++]));
  128.   	}
          ^
  129.   
  130.   void BN_CTX_end(BN_CTX *ctx)

crypto/bn/bn_div.c:183:2: 
181.   	BN_CTX_start(ctx);
182.   	tmp=BN_CTX_get(ctx);
183. > 	tmp->neg=0;
184.   	snum=BN_CTX_get(ctx);
185.   	sdiv=BN_CTX_get(ctx);

int BN_div(BIGNUM *dv, BIGNUM *rm, const BIGNUM *num, const BIGNUM *divisor,
	   BN_CTX *ctx)
	{
	int norm_shift,i,j,loop;
	BIGNUM *tmp,wnum,*snum,*sdiv,*res;
	BN_ULONG *resp,*wnump;
	BN_ULONG d0,d1;
	int num_n,div_n;
	bn_check_top(num);
	bn_check_top(divisor);
	if (BN_is_zero(divisor))
		{
		BNerr(BN_F_BN_DIV,BN_R_DIV_BY_ZERO);
		return(0);
		}
	if (BN_ucmp(num,divisor) < 0)
		{
		if (rm != NULL)
			{ if (BN_copy(rm,num) == NULL) return(0); }
		if (dv != NULL) BN_zero(dv);
		return(1);
		}
	BN_CTX_start(ctx);
	tmp=BN_CTX_get(ctx);
	tmp->neg=0;
	snum=BN_CTX_get(ctx);
	sdiv=BN_CTX_get(ctx);
	if (dv == NULL)
		res=BN_CTX_get(ctx);
	else	res=dv;
	if (res == NULL) goto err;
	norm_shift=BN_BITS2-((BN_num_bits(divisor))%BN_BITS2);
	BN_lshift(sdiv,divisor,norm_shift);
	sdiv->neg=0;
	norm_shift+=BN_BITS2;
	BN_lshift(snum,num,norm_shift);
	snum->neg=0;
	div_n=sdiv->top;
	num_n=snum->top;
	loop=num_n-div_n;
	BN_init(&wnum);
	wnum.d=	 &(snum->d[loop]);
	wnum.top= div_n;
	wnum.max= snum->max+1;
	d0=sdiv->d[div_n-1];
	d1=(div_n == 1)?0:sdiv->d[div_n-2];
	wnump= &(snum->d[num_n-1]);
	res->neg= (num->neg^divisor->neg);
	if (!bn_wexpand(res,(loop+1))) goto err;
	res->top=loop;
	resp= &(res->d[loop-1]);
	if (!bn_wexpand(tmp,(div_n+1))) goto err;
	if (BN_ucmp(&wnum,sdiv) >= 0)
		{
		if (!BN_usub(&wnum,&wnum,sdiv)) goto err;
		*resp=1;
		res->d[res->top-1]=1;
		}
	else
		res->top--;
	resp--;
	for (i=0; i<loop-1; i++)
		{
		BN_ULONG q,l0;
#ifdef BN_DIV3W
		q=bn_div_3_words(wnump,d1,d0);
#else
		BN_ULONG n0,n1,rem=0;
		n0=wnump[0];
		n1=wnump[-1];
		if (n0 == d0)
			q=BN_MASK2;
		else
			{
#ifdef BN_LLONG
			BN_ULLONG t2;
#if defined(BN_LLONG) && defined(BN_DIV2W) && !defined(bn_div_words)
			q=(BN_ULONG)(((((BN_ULLONG)n0)<<BN_BITS2)|n1)/d0);
#else
			q=bn_div_words(n0,n1,d0);
#endif
#ifndef REMAINDER_IS_ALREADY_CALCULATED
			rem=(n1-q*d0)&BN_MASK2;
#endif
			t2=(BN_ULLONG)d1*q;
			for (;;)
				{
				if (t2 <= ((((BN_ULLONG)rem)<<BN_BITS2)|wnump[-2]))
					break;
				q--;
				rem += d0;
				if (rem < d0) break;
				t2 -= d1;
				}
#else
			BN_ULONG t2l,t2h,ql,qh;
			q=bn_div_words(n0,n1,d0);
#ifndef REMAINDER_IS_ALREADY_CALCULATED
			rem=(n1-q*d0)&BN_MASK2;
#endif
#ifdef BN_UMULT_HIGH
			t2l = d1 * q;
			t2h = BN_UMULT_HIGH(d1,q);
#else
			t2l=LBITS(d1); t2h=HBITS(d1);
			ql =LBITS(q);  qh =HBITS(q);
			mul64(t2l,t2h,ql,qh);
#endif
			for (;;)
				{
				if ((t2h < rem) ||
					((t2h == rem) && (t2l <= wnump[-2])))
					break;
				q--;
				rem += d0;
				if (rem < d0) break;
				if (t2l < d1) t2h--; t2l -= d1;
				}
#endif
			}
#endif
		l0=bn_mul_words(tmp->d,sdiv->d,div_n,q);
		wnum.d--; wnum.top++;
		tmp->d[div_n]=l0;
		for (j=div_n+1; j>0; j--)
			if (tmp->d[j-1]) break;
		tmp->top=j;
		j=wnum.top;
		BN_sub(&wnum,&wnum,tmp);
		snum->top=snum->top+wnum.top-j;
		if (wnum.neg)
			{
			q--;
			j=wnum.top;
			BN_add(&wnum,&wnum,sdiv);
			snum->top+=wnum.top-j;
			}
		*(resp--)=q;
		wnump--;
		}
	if (rm != NULL)
		{
		BN_rshift(rm,snum,norm_shift);
		rm->neg=num->neg;
		}
	BN_CTX_end(ctx);
	return(1);
err:
	BN_CTX_end(ctx);
	return(0);
	}
['int BN_div(BIGNUM *dv, BIGNUM *rm, const BIGNUM *num, const BIGNUM *divisor,\n\t   BN_CTX *ctx)\n\t{\n\tint norm_shift,i,j,loop;\n\tBIGNUM *tmp,wnum,*snum,*sdiv,*res;\n\tBN_ULONG *resp,*wnump;\n\tBN_ULONG d0,d1;\n\tint num_n,div_n;\n\tbn_check_top(num);\n\tbn_check_top(divisor);\n\tif (BN_is_zero(divisor))\n\t\t{\n\t\tBNerr(BN_F_BN_DIV,BN_R_DIV_BY_ZERO);\n\t\treturn(0);\n\t\t}\n\tif (BN_ucmp(num,divisor) < 0)\n\t\t{\n\t\tif (rm != NULL)\n\t\t\t{ if (BN_copy(rm,num) == NULL) return(0); }\n\t\tif (dv != NULL) BN_zero(dv);\n\t\treturn(1);\n\t\t}\n\tBN_CTX_start(ctx);\n\ttmp=BN_CTX_get(ctx);\n\ttmp->neg=0;\n\tsnum=BN_CTX_get(ctx);\n\tsdiv=BN_CTX_get(ctx);\n\tif (dv == NULL)\n\t\tres=BN_CTX_get(ctx);\n\telse\tres=dv;\n\tif (res == NULL) goto err;\n\tnorm_shift=BN_BITS2-((BN_num_bits(divisor))%BN_BITS2);\n\tBN_lshift(sdiv,divisor,norm_shift);\n\tsdiv->neg=0;\n\tnorm_shift+=BN_BITS2;\n\tBN_lshift(snum,num,norm_shift);\n\tsnum->neg=0;\n\tdiv_n=sdiv->top;\n\tnum_n=snum->top;\n\tloop=num_n-div_n;\n\tBN_init(&wnum);\n\twnum.d=\t &(snum->d[loop]);\n\twnum.top= div_n;\n\twnum.max= snum->max+1;\n\td0=sdiv->d[div_n-1];\n\td1=(div_n == 1)?0:sdiv->d[div_n-2];\n\twnump= &(snum->d[num_n-1]);\n\tres->neg= (num->neg^divisor->neg);\n\tif (!bn_wexpand(res,(loop+1))) goto err;\n\tres->top=loop;\n\tresp= &(res->d[loop-1]);\n\tif (!bn_wexpand(tmp,(div_n+1))) goto err;\n\tif (BN_ucmp(&wnum,sdiv) >= 0)\n\t\t{\n\t\tif (!BN_usub(&wnum,&wnum,sdiv)) goto err;\n\t\t*resp=1;\n\t\tres->d[res->top-1]=1;\n\t\t}\n\telse\n\t\tres->top--;\n\tresp--;\n\tfor (i=0; i<loop-1; i++)\n\t\t{\n\t\tBN_ULONG q,l0;\n#ifdef BN_DIV3W\n\t\tq=bn_div_3_words(wnump,d1,d0);\n#else\n\t\tBN_ULONG n0,n1,rem=0;\n\t\tn0=wnump[0];\n\t\tn1=wnump[-1];\n\t\tif (n0 == d0)\n\t\t\tq=BN_MASK2;\n\t\telse\n\t\t\t{\n#ifdef BN_LLONG\n\t\t\tBN_ULLONG t2;\n#if defined(BN_LLONG) && defined(BN_DIV2W) && !defined(bn_div_words)\n\t\t\tq=(BN_ULONG)(((((BN_ULLONG)n0)<<BN_BITS2)|n1)/d0);\n#else\n\t\t\tq=bn_div_words(n0,n1,d0);\n#endif\n#ifndef REMAINDER_IS_ALREADY_CALCULATED\n\t\t\trem=(n1-q*d0)&BN_MASK2;\n#endif\n\t\t\tt2=(BN_ULLONG)d1*q;\n\t\t\tfor (;;)\n\t\t\t\t{\n\t\t\t\tif (t2 <= ((((BN_ULLONG)rem)<<BN_BITS2)|wnump[-2]))\n\t\t\t\t\tbreak;\n\t\t\t\tq--;\n\t\t\t\trem += d0;\n\t\t\t\tif (rem < d0) break;\n\t\t\t\tt2 -= d1;\n\t\t\t\t}\n#else\n\t\t\tBN_ULONG t2l,t2h,ql,qh;\n\t\t\tq=bn_div_words(n0,n1,d0);\n#ifndef REMAINDER_IS_ALREADY_CALCULATED\n\t\t\trem=(n1-q*d0)&BN_MASK2;\n#endif\n#ifdef BN_UMULT_HIGH\n\t\t\tt2l = d1 * q;\n\t\t\tt2h = BN_UMULT_HIGH(d1,q);\n#else\n\t\t\tt2l=LBITS(d1); t2h=HBITS(d1);\n\t\t\tql =LBITS(q);  qh =HBITS(q);\n\t\t\tmul64(t2l,t2h,ql,qh);\n#endif\n\t\t\tfor (;;)\n\t\t\t\t{\n\t\t\t\tif ((t2h < rem) ||\n\t\t\t\t\t((t2h == rem) && (t2l <= wnump[-2])))\n\t\t\t\t\tbreak;\n\t\t\t\tq--;\n\t\t\t\trem += d0;\n\t\t\t\tif (rem < d0) break;\n\t\t\t\tif (t2l < d1) t2h--; t2l -= d1;\n\t\t\t\t}\n#endif\n\t\t\t}\n#endif\n\t\tl0=bn_mul_words(tmp->d,sdiv->d,div_n,q);\n\t\twnum.d--; wnum.top++;\n\t\ttmp->d[div_n]=l0;\n\t\tfor (j=div_n+1; j>0; j--)\n\t\t\tif (tmp->d[j-1]) break;\n\t\ttmp->top=j;\n\t\tj=wnum.top;\n\t\tBN_sub(&wnum,&wnum,tmp);\n\t\tsnum->top=snum->top+wnum.top-j;\n\t\tif (wnum.neg)\n\t\t\t{\n\t\t\tq--;\n\t\t\tj=wnum.top;\n\t\t\tBN_add(&wnum,&wnum,sdiv);\n\t\t\tsnum->top+=wnum.top-j;\n\t\t\t}\n\t\t*(resp--)=q;\n\t\twnump--;\n\t\t}\n\tif (rm != NULL)\n\t\t{\n\t\tBN_rshift(rm,snum,norm_shift);\n\t\trm->neg=num->neg;\n\t\t}\n\tBN_CTX_end(ctx);\n\treturn(1);\nerr:\n\tBN_CTX_end(ctx);\n\treturn(0);\n\t}', 'int BN_ucmp(const BIGNUM *a, const BIGNUM *b)\n\t{\n\tint i;\n\tBN_ULONG t1,t2,*ap,*bp;\n\tbn_check_top(a);\n\tbn_check_top(b);\n\ti=a->top-b->top;\n\tif (i != 0) return(i);\n\tap=a->d;\n\tbp=b->d;\n\tfor (i=a->top-1; i>=0; i--)\n\t\t{\n\t\tt1= ap[i];\n\t\tt2= bp[i];\n\t\tif (t1 != t2)\n\t\t\treturn(t1 > t2?1:-1);\n\t\t}\n\treturn(0);\n\t}', 'void BN_CTX_start(BN_CTX *ctx)\n\t{\n\tif (ctx->depth < BN_CTX_NUM_POS)\n\t\tctx->pos[ctx->depth] = ctx->tos;\n\tctx->depth++;\n\t}', 'BIGNUM *BN_CTX_get(BN_CTX *ctx)\n\t{\n\tif (ctx->depth > BN_CTX_NUM_POS || ctx->tos >= BN_CTX_NUM)\n\t\t{\n\t\tif (!ctx->too_many)\n\t\t\t{\n\t\t\tBNerr(BN_F_BN_CTX_GET,BN_R_TOO_MANY_TEMPORARY_VARIABLES);\n\t\t\tctx->too_many = 1;\n\t\t\t}\n\t\treturn NULL;\n\t\t}\n\treturn (&(ctx->bn[ctx->tos++]));\n\t}']