crypto/bn/bn_x931p.c:184: error: NULL_DEREFERENCE
  pointer `t` last assigned on line 177 could be null and is dereferenced by call to `BN_num_bits()` at line 184, column 13.
Showing all 32 steps of the trace


crypto/bn/bn_x931p.c:157:1: start of procedure BN_X931_generate_Xpq()
155.    */
156.   
157. > int BN_X931_generate_Xpq(BIGNUM *Xp, BIGNUM *Xq, int nbits, BN_CTX *ctx)
158.   {
159.       BIGNUM *t;

crypto/bn/bn_x931p.c:165:10: Taking false branch
163.        * ...
164.        */
165.       if ((nbits < 1024) || (nbits & 0xff))
                ^
166.           return 0;
167.       nbits >>= 1;

crypto/bn/bn_x931p.c:165:28: Taking false branch
163.        * ...
164.        */
165.       if ((nbits < 1024) || (nbits & 0xff))
                                  ^
166.           return 0;
167.       nbits >>= 1;

crypto/bn/bn_x931p.c:167:5: 
165.       if ((nbits < 1024) || (nbits & 0xff))
166.           return 0;
167. >     nbits >>= 1;
168.       /*
169.        * The random value Xp must be between sqrt(2) * 2^(nbits-1) and 2^nbits

crypto/bn/bn_x931p.c:173:10: 
171.        * exceeded.
172.        */
173. >     if (!BN_rand(Xp, nbits, BN_RAND_TOP_TWO, BN_RAND_BOTTOM_ANY))
174.           goto err;
175.   

crypto/bn/bn_rand.c:93:1: start of procedure BN_rand()
  91.   }
  92.   
  93. > int BN_rand(BIGNUM *rnd, int bits, int top, int bottom)
  94.   {
  95.       return bnrand(0, rnd, bits, top, bottom);

crypto/bn/bn_rand.c:95:5: Skipping bnrand(): empty list of specs
  93.   int BN_rand(BIGNUM *rnd, int bits, int top, int bottom)
  94.   {
  95.       return bnrand(0, rnd, bits, top, bottom);
            ^
  96.   }
  97.   

crypto/bn/bn_rand.c:96:1: return from a call to BN_rand
  94.   {
  95.       return bnrand(0, rnd, bits, top, bottom);
  96. > }
  97.   
  98.   int BN_pseudo_rand(BIGNUM *rnd, int bits, int top, int bottom)

crypto/bn/bn_x931p.c:173:10: Taking false branch
171.        * exceeded.
172.        */
173.       if (!BN_rand(Xp, nbits, BN_RAND_TOP_TWO, BN_RAND_BOTTOM_ANY))
                ^
174.           goto err;
175.   

crypto/bn/bn_x931p.c:176:5: 
174.           goto err;
175.   
176. >     BN_CTX_start(ctx);
177.       t = BN_CTX_get(ctx);
178.   

crypto/bn/bn_ctx.c:181:1: start of procedure BN_CTX_start()
  179.   }
  180.   
  181. > void BN_CTX_start(BN_CTX *ctx)
  182.   {
  183.       CTXDBG_ENTRY("BN_CTX_start", ctx);

crypto/bn/bn_ctx.c:185:9: Taking false branch
  183.       CTXDBG_ENTRY("BN_CTX_start", ctx);
  184.       /* If we're already overflowing ... */
  185.       if (ctx->err_stack || ctx->too_many)
                 ^
  186.           ctx->err_stack++;
  187.       /* (Try to) get a new frame pointer */

crypto/bn/bn_ctx.c:185:27: Taking true branch
  183.       CTXDBG_ENTRY("BN_CTX_start", ctx);
  184.       /* If we're already overflowing ... */
  185.       if (ctx->err_stack || ctx->too_many)
                                   ^
  186.           ctx->err_stack++;
  187.       /* (Try to) get a new frame pointer */

crypto/bn/bn_ctx.c:186:9: 
  184.       /* If we're already overflowing ... */
  185.       if (ctx->err_stack || ctx->too_many)
  186. >         ctx->err_stack++;
  187.       /* (Try to) get a new frame pointer */
  188.       else if (!BN_STACK_push(&ctx->stack, ctx->used)) {

crypto/bn/bn_ctx.c:185:5: 
  183.       CTXDBG_ENTRY("BN_CTX_start", ctx);
  184.       /* If we're already overflowing ... */
  185. >     if (ctx->err_stack || ctx->too_many)
  186.           ctx->err_stack++;
  187.       /* (Try to) get a new frame pointer */

crypto/bn/bn_ctx.c:193:1: return from a call to BN_CTX_start
  191.       }
  192.       CTXDBG_EXIT(ctx);
  193. > }
  194.   
  195.   void BN_CTX_end(BN_CTX *ctx)

crypto/bn/bn_x931p.c:177:5: 
175.   
176.       BN_CTX_start(ctx);
177. >     t = BN_CTX_get(ctx);
178.   
179.       for (i = 0; i < 1000; i++) {

crypto/bn/bn_ctx.c:212:1: start of procedure BN_CTX_get()
  210.   }
  211.   
  212. > BIGNUM *BN_CTX_get(BN_CTX *ctx)
  213.   {
  214.       BIGNUM *ret;

crypto/bn/bn_ctx.c:217:9: Taking true branch
  215.   
  216.       CTXDBG_ENTRY("BN_CTX_get", ctx);
  217.       if (ctx->err_stack || ctx->too_many)
                 ^
  218.           return NULL;
  219.       if ((ret = BN_POOL_get(&ctx->pool, ctx->flags)) == NULL) {

crypto/bn/bn_ctx.c:218:9: 
  216.       CTXDBG_ENTRY("BN_CTX_get", ctx);
  217.       if (ctx->err_stack || ctx->too_many)
  218. >         return NULL;
  219.       if ((ret = BN_POOL_get(&ctx->pool, ctx->flags)) == NULL) {
  220.           /*

crypto/bn/bn_ctx.c:233:1: return from a call to BN_CTX_get
  231.       CTXDBG_RET(ctx, ret);
  232.       return ret;
  233. > }
  234.   
  235.   /************/

crypto/bn/bn_x931p.c:179:10: 
177.       t = BN_CTX_get(ctx);
178.   
179. >     for (i = 0; i < 1000; i++) {
180.           if (!BN_rand(Xq, nbits, BN_RAND_TOP_TWO, BN_RAND_BOTTOM_ANY))
181.               goto err;

crypto/bn/bn_x931p.c:179:17: Loop condition is true. Entering loop body
177.       t = BN_CTX_get(ctx);
178.   
179.       for (i = 0; i < 1000; i++) {
                       ^
180.           if (!BN_rand(Xq, nbits, BN_RAND_TOP_TWO, BN_RAND_BOTTOM_ANY))
181.               goto err;

crypto/bn/bn_x931p.c:180:14: 
178.   
179.       for (i = 0; i < 1000; i++) {
180. >         if (!BN_rand(Xq, nbits, BN_RAND_TOP_TWO, BN_RAND_BOTTOM_ANY))
181.               goto err;
182.           /* Check that |Xp - Xq| > 2^(nbits - 100) */

crypto/bn/bn_rand.c:93:1: start of procedure BN_rand()
  91.   }
  92.   
  93. > int BN_rand(BIGNUM *rnd, int bits, int top, int bottom)
  94.   {
  95.       return bnrand(0, rnd, bits, top, bottom);

crypto/bn/bn_rand.c:95:5: Skipping bnrand(): empty list of specs
  93.   int BN_rand(BIGNUM *rnd, int bits, int top, int bottom)
  94.   {
  95.       return bnrand(0, rnd, bits, top, bottom);
            ^
  96.   }
  97.   

crypto/bn/bn_rand.c:96:1: return from a call to BN_rand
  94.   {
  95.       return bnrand(0, rnd, bits, top, bottom);
  96. > }
  97.   
  98.   int BN_pseudo_rand(BIGNUM *rnd, int bits, int top, int bottom)

crypto/bn/bn_x931p.c:180:14: Taking false branch
178.   
179.       for (i = 0; i < 1000; i++) {
180.           if (!BN_rand(Xq, nbits, BN_RAND_TOP_TWO, BN_RAND_BOTTOM_ANY))
                    ^
181.               goto err;
182.           /* Check that |Xp - Xq| > 2^(nbits - 100) */

crypto/bn/bn_x931p.c:183:9: Skipping BN_sub(): empty list of specs
181.               goto err;
182.           /* Check that |Xp - Xq| > 2^(nbits - 100) */
183.           BN_sub(t, Xp, Xq);
               ^
184.           if (BN_num_bits(t) > (nbits - 100))
185.               break;

crypto/bn/bn_x931p.c:184:13: 
182.           /* Check that |Xp - Xq| > 2^(nbits - 100) */
183.           BN_sub(t, Xp, Xq);
184. >         if (BN_num_bits(t) > (nbits - 100))
185.               break;
186.       }

crypto/bn/bn_lib.c:161:1: start of procedure BN_num_bits()
  159.   }
  160.   
  161. > int BN_num_bits(const BIGNUM *a)
  162.   {
  163.       int i = a->top - 1;

crypto/bn/bn_lib.c:163:5: 
  161.   int BN_num_bits(const BIGNUM *a)
  162.   {
  163. >     int i = a->top - 1;
  164.       bn_check_top(a);
  165.   

int BN_X931_generate_Xpq(BIGNUM *Xp, BIGNUM *Xq, int nbits, BN_CTX *ctx)
{
    BIGNUM *t;
    int i;
    if ((nbits < 1024) || (nbits & 0xff))
        return 0;
    nbits >>= 1;
    if (!BN_rand(Xp, nbits, BN_RAND_TOP_TWO, BN_RAND_BOTTOM_ANY))
        goto err;
    BN_CTX_start(ctx);
    t = BN_CTX_get(ctx);
    for (i = 0; i < 1000; i++) {
        if (!BN_rand(Xq, nbits, BN_RAND_TOP_TWO, BN_RAND_BOTTOM_ANY))
            goto err;
        BN_sub(t, Xp, Xq);
        if (BN_num_bits(t) > (nbits - 100))
            break;
    }
    BN_CTX_end(ctx);
    if (i < 1000)
        return 1;
    return 0;
 err:
    BN_CTX_end(ctx);
    return 0;
}
['int BN_X931_generate_Xpq(BIGNUM *Xp, BIGNUM *Xq, int nbits, BN_CTX *ctx)\n{\n    BIGNUM *t;\n    int i;\n    if ((nbits < 1024) || (nbits & 0xff))\n        return 0;\n    nbits >>= 1;\n    if (!BN_rand(Xp, nbits, BN_RAND_TOP_TWO, BN_RAND_BOTTOM_ANY))\n        goto err;\n    BN_CTX_start(ctx);\n    t = BN_CTX_get(ctx);\n    for (i = 0; i < 1000; i++) {\n        if (!BN_rand(Xq, nbits, BN_RAND_TOP_TWO, BN_RAND_BOTTOM_ANY))\n            goto err;\n        BN_sub(t, Xp, Xq);\n        if (BN_num_bits(t) > (nbits - 100))\n            break;\n    }\n    BN_CTX_end(ctx);\n    if (i < 1000)\n        return 1;\n    return 0;\n err:\n    BN_CTX_end(ctx);\n    return 0;\n}', 'int BN_rand(BIGNUM *rnd, int bits, int top, int bottom)\n{\n    return bnrand(0, rnd, bits, top, bottom);\n}', 'void BN_CTX_start(BN_CTX *ctx)\n{\n    CTXDBG_ENTRY("BN_CTX_start", ctx);\n    if (ctx->err_stack || ctx->too_many)\n        ctx->err_stack++;\n    else if (!BN_STACK_push(&ctx->stack, ctx->used)) {\n        BNerr(BN_F_BN_CTX_START, BN_R_TOO_MANY_TEMPORARY_VARIABLES);\n        ctx->err_stack++;\n    }\n    CTXDBG_EXIT(ctx);\n}', 'BIGNUM *BN_CTX_get(BN_CTX *ctx)\n{\n    BIGNUM *ret;\n    CTXDBG_ENTRY("BN_CTX_get", ctx);\n    if (ctx->err_stack || ctx->too_many)\n        return NULL;\n    if ((ret = BN_POOL_get(&ctx->pool, ctx->flags)) == NULL) {\n        ctx->too_many = 1;\n        BNerr(BN_F_BN_CTX_GET, BN_R_TOO_MANY_TEMPORARY_VARIABLES);\n        return NULL;\n    }\n    BN_zero(ret);\n    ctx->used++;\n    CTXDBG_RET(ctx, ret);\n    return ret;\n}', 'int BN_num_bits(const BIGNUM *a)\n{\n    int i = a->top - 1;\n    bn_check_top(a);\n    if (BN_is_zero(a))\n        return 0;\n    return ((i * BN_BITS2) + BN_num_bits_word(a->d[i]));\n}']