test/bntest.c:1845: error: NULL_DEREFERENCE
  pointer `r` last assigned on line 1842 could be null and is dereferenced by call to `BN_num_bits()` at line 1845, column 9.
Showing all 28 steps of the trace


test/bntest.c:1836:1: start of procedure test_small_prime()
1834.   }
1835.   
1836. > int test_small_prime(BIO *bp, BN_CTX *ctx)
1837.   {
1838.       static const int bits = 10;

test/bntest.c:1838:5: 
1836.   int test_small_prime(BIO *bp, BN_CTX *ctx)
1837.   {
1838. >     static const int bits = 10;
1839.       int ret = 0;
1840.       BIGNUM *r;

test/bntest.c:1839:5: 
1837.   {
1838.       static const int bits = 10;
1839. >     int ret = 0;
1840.       BIGNUM *r;
1841.   

test/bntest.c:1842:5: 
1840.       BIGNUM *r;
1841.   
1842. >     r = BN_new();
1843.       if (!BN_generate_prime_ex(r, bits, 0, NULL, NULL, NULL))
1844.           goto err;

crypto/bn/bn_lib.c:276:1: start of procedure BN_new()
  274.   }
  275.   
  276. > BIGNUM *BN_new(void)
  277.   {
  278.       BIGNUM *ret;

crypto/bn/bn_lib.c:280:9: 
  278.       BIGNUM *ret;
  279.   
  280. >     if ((ret = OPENSSL_zalloc(sizeof(*ret))) == NULL) {
  281.           BNerr(BN_F_BN_NEW, ERR_R_MALLOC_FAILURE);
  282.           return (NULL);

crypto/mem.c:156:1: start of procedure CRYPTO_zalloc()
    154.   }
    155.   
    156. > void *CRYPTO_zalloc(size_t num, const char *file, int line)
    157.   {
    158.       void *ret = CRYPTO_malloc(num, file, line);

crypto/mem.c:158:5: 
    156.   void *CRYPTO_zalloc(size_t num, const char *file, int line)
    157.   {
    158. >     void *ret = CRYPTO_malloc(num, file, line);
    159.   
    160.       if (ret != NULL)

crypto/mem.c:119:1: start of procedure CRYPTO_malloc()
      117.   }
      118.   
      119. > void *CRYPTO_malloc(size_t num, const char *file, int line)
      120.   {
      121.       void *ret = NULL;

crypto/mem.c:121:5: 
      119.   void *CRYPTO_malloc(size_t num, const char *file, int line)
      120.   {
      121. >     void *ret = NULL;
      122.   
      123.       if (num <= 0)

crypto/mem.c:123:9: Taking false branch
      121.       void *ret = NULL;
      122.   
      123.       if (num <= 0)
                     ^
      124.           return NULL;
      125.   

crypto/mem.c:126:5: 
      124.           return NULL;
      125.   
      126. >     allow_customize = 0;
      127.   #ifndef OPENSSL_NO_CRYPTO_MDEBUG
      128.       if (call_malloc_debug) {

crypto/mem.c:136:5: 
      134.       }
      135.   #else
      136. >     (void)file;
      137.       (void)line;
      138.       ret = malloc(num);

crypto/mem.c:137:5: 
      135.   #else
      136.       (void)file;
      137. >     (void)line;
      138.       ret = malloc(num);
      139.   #endif

crypto/mem.c:138:5: 
      136.       (void)file;
      137.       (void)line;
      138. >     ret = malloc(num);
      139.   #endif
      140.   

crypto/mem.c:153:5: 
      151.   #endif
      152.   
      153. >     return ret;
      154.   }
      155.   

crypto/mem.c:154:1: return from a call to CRYPTO_malloc
      152.   
      153.       return ret;
      154. > }
      155.   
      156.   void *CRYPTO_zalloc(size_t num, const char *file, int line)

crypto/mem.c:160:9: Taking false branch
    158.       void *ret = CRYPTO_malloc(num, file, line);
    159.   
    160.       if (ret != NULL)
                   ^
    161.           memset(ret, 0, num);
    162.       return ret;

crypto/mem.c:162:5: 
    160.       if (ret != NULL)
    161.           memset(ret, 0, num);
    162. >     return ret;
    163.   }
    164.   

crypto/mem.c:163:1: return from a call to CRYPTO_zalloc
    161.           memset(ret, 0, num);
    162.       return ret;
    163. > }
    164.   
    165.   void *CRYPTO_realloc(void *str, size_t num, const char *file, int line)

crypto/bn/bn_lib.c:280:9: Taking true branch
  278.       BIGNUM *ret;
  279.   
  280.       if ((ret = OPENSSL_zalloc(sizeof(*ret))) == NULL) {
                 ^
  281.           BNerr(BN_F_BN_NEW, ERR_R_MALLOC_FAILURE);
  282.           return (NULL);

crypto/bn/bn_lib.c:281:9: Skipping ERR_put_error(): empty list of specs
  279.   
  280.       if ((ret = OPENSSL_zalloc(sizeof(*ret))) == NULL) {
  281.           BNerr(BN_F_BN_NEW, ERR_R_MALLOC_FAILURE);
                 ^
  282.           return (NULL);
  283.       }

crypto/bn/bn_lib.c:282:9: 
  280.       if ((ret = OPENSSL_zalloc(sizeof(*ret))) == NULL) {
  281.           BNerr(BN_F_BN_NEW, ERR_R_MALLOC_FAILURE);
  282. >         return (NULL);
  283.       }
  284.       ret->flags = BN_FLG_MALLOCED;

crypto/bn/bn_lib.c:287:1: return from a call to BN_new
  285.       bn_check_top(ret);
  286.       return (ret);
  287. > }
  288.   
  289.    BIGNUM *BN_secure_new(void)

test/bntest.c:1843:10: Taking false branch
1841.   
1842.       r = BN_new();
1843.       if (!BN_generate_prime_ex(r, bits, 0, NULL, NULL, NULL))
                 ^
1844.           goto err;
1845.       if (BN_num_bits(r) != bits) {

test/bntest.c:1845:9: 
1843.       if (!BN_generate_prime_ex(r, bits, 0, NULL, NULL, NULL))
1844.           goto err;
1845. >     if (BN_num_bits(r) != bits) {
1846.           BIO_printf(bp, "Expected %d bit prime, got %d bit number\n", bits,
1847.                      BN_num_bits(r));

crypto/bn/bn_lib.c:214:1: start of procedure BN_num_bits()
  212.   }
  213.   
  214. > int BN_num_bits(const BIGNUM *a)
  215.   {
  216.       int i = a->top - 1;

crypto/bn/bn_lib.c:216:5: 
  214.   int BN_num_bits(const BIGNUM *a)
  215.   {
  216. >     int i = a->top - 1;
  217.       bn_check_top(a);
  218.   

int test_small_prime(BIO *bp, BN_CTX *ctx)
{
    static const int bits = 10;
    int ret = 0;
    BIGNUM *r;
    r = BN_new();
    if (!BN_generate_prime_ex(r, bits, 0, NULL, NULL, NULL))
        goto err;
    if (BN_num_bits(r) != bits) {
        BIO_printf(bp, "Expected %d bit prime, got %d bit number\n", bits,
                   BN_num_bits(r));
        goto err;
    }
    ret = 1;
 err:
    BN_clear_free(r);
    return ret;
}
['int test_small_prime(BIO *bp, BN_CTX *ctx)\n{\n    static const int bits = 10;\n    int ret = 0;\n    BIGNUM *r;\n    r = BN_new();\n    if (!BN_generate_prime_ex(r, bits, 0, NULL, NULL, NULL))\n        goto err;\n    if (BN_num_bits(r) != bits) {\n        BIO_printf(bp, "Expected %d bit prime, got %d bit number\\n", bits,\n                   BN_num_bits(r));\n        goto err;\n    }\n    ret = 1;\n err:\n    BN_clear_free(r);\n    return ret;\n}', 'BIGNUM *BN_new(void)\n{\n    BIGNUM *ret;\n    if ((ret = OPENSSL_zalloc(sizeof(*ret))) == NULL) {\n        BNerr(BN_F_BN_NEW, ERR_R_MALLOC_FAILURE);\n        return (NULL);\n    }\n    ret->flags = BN_FLG_MALLOCED;\n    bn_check_top(ret);\n    return (ret);\n}', 'void *CRYPTO_zalloc(size_t num, const char *file, int line)\n{\n    void *ret = CRYPTO_malloc(num, file, line);\n    if (ret != NULL)\n        memset(ret, 0, num);\n    return ret;\n}', 'void *CRYPTO_malloc(size_t num, const char *file, int line)\n{\n    void *ret = NULL;\n    if (num <= 0)\n        return NULL;\n    allow_customize = 0;\n#ifndef OPENSSL_NO_CRYPTO_MDEBUG\n    if (call_malloc_debug) {\n        CRYPTO_mem_debug_malloc(NULL, num, 0, file, line);\n        ret = malloc(num);\n        CRYPTO_mem_debug_malloc(ret, num, 1, file, line);\n    } else {\n        ret = malloc(num);\n    }\n#else\n    (void)file;\n    (void)line;\n    ret = malloc(num);\n#endif\n#ifndef OPENSSL_CPUID_OBJ\n    if (ret && (num > 2048)) {\n        extern unsigned char cleanse_ctr;\n        ((unsigned char *)ret)[0] = cleanse_ctr;\n    }\n#endif\n    return ret;\n}', 'int BN_num_bits(const BIGNUM *a)\n{\n    int i = a->top - 1;\n    bn_check_top(a);\n    if (BN_is_zero(a))\n        return 0;\n    return ((i * BN_BITS2) + BN_num_bits_word(a->d[i]));\n}']