engines/e_chil.c:818: error: NULL_DEREFERENCE
  pointer `rtmp->e` last assigned on line 815 could be null and is dereferenced at line 818, column 2.
Showing all 113 steps of the trace


engines/e_chil.c:759:1: start of procedure hwcrhk_load_privkey()
757.   	}
758.   
759. > static EVP_PKEY *hwcrhk_load_privkey(ENGINE *eng, const char *key_id,
760.   	UI_METHOD *ui_method, void *callback_data)
761.   	{

engines/e_chil.c:763:2: 
761.   	{
762.   #ifndef OPENSSL_NO_RSA
763. > 	RSA *rtmp = NULL;
764.   #endif
765.   	EVP_PKEY *res = NULL;

engines/e_chil.c:765:2: 
763.   	RSA *rtmp = NULL;
764.   #endif
765. > 	EVP_PKEY *res = NULL;
766.   #ifndef OPENSSL_NO_RSA
767.   	HWCryptoHook_MPI e, n;

engines/e_chil.c:777:2: 
775.   
776.   #if !defined(OPENSSL_NO_RSA)
777. > 	rmsg.buf = tempbuf;
778.   	rmsg.size = sizeof(tempbuf);
779.   #endif

engines/e_chil.c:778:2: 
776.   #if !defined(OPENSSL_NO_RSA)
777.   	rmsg.buf = tempbuf;
778. > 	rmsg.size = sizeof(tempbuf);
779.   #endif
780.   

engines/e_chil.c:781:6: Taking false branch
779.   #endif
780.   
781.   	if(!hwcrhk_context)
            ^
782.   		{
783.   		HWCRHKerr(HWCRHK_F_HWCRHK_LOAD_PRIVKEY,

engines/e_chil.c:788:2: 
786.   		}
787.   #ifndef OPENSSL_NO_RSA
788. > 	hptr = OPENSSL_malloc(sizeof(HWCryptoHook_RSAKeyHandle));
789.   	if (!hptr)
790.   		{

crypto/mem.c:294:1: start of procedure CRYPTO_malloc()
  292.   	}
  293.   
  294. > void *CRYPTO_malloc(int num, const char *file, int line)
  295.   	{
  296.   	void *ret = NULL;

crypto/mem.c:296:2: 
  294.   void *CRYPTO_malloc(int num, const char *file, int line)
  295.   	{
  296. > 	void *ret = NULL;
  297.   
  298.   	if (num <= 0) return NULL;

crypto/mem.c:298:6: Taking false branch
  296.   	void *ret = NULL;
  297.   
  298.   	if (num <= 0) return NULL;
              ^
  299.   
  300.   	allow_customize = 0;

crypto/mem.c:300:2: 
  298.   	if (num <= 0) return NULL;
  299.   
  300. > 	allow_customize = 0;
  301.   	if (malloc_debug_func != NULL)
  302.   		{

crypto/mem.c:301:6: Taking true branch
  299.   
  300.   	allow_customize = 0;
  301.   	if (malloc_debug_func != NULL)
              ^
  302.   		{
  303.   		allow_customize_debug = 0;

crypto/mem.c:303:3: 
  301.   	if (malloc_debug_func != NULL)
  302.   		{
  303. > 		allow_customize_debug = 0;
  304.   		malloc_debug_func(NULL, num, file, line, 0);
  305.   		}

crypto/mem.c:304:3: Skipping __function_pointer__(): unresolved function pointer
  302.   		{
  303.   		allow_customize_debug = 0;
  304.   		malloc_debug_func(NULL, num, file, line, 0);
           ^
  305.   		}
  306.   	ret = malloc_ex_func(num,file,line);

crypto/mem.c:306:2: Skipping __function_pointer__(): unresolved function pointer
  304.   		malloc_debug_func(NULL, num, file, line, 0);
  305.   		}
  306.   	ret = malloc_ex_func(num,file,line);
          ^
  307.   #ifdef LEVITTE_DEBUG_MEM
  308.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);

crypto/mem.c:310:6: Taking true branch
  308.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);
  309.   #endif
  310.   	if (malloc_debug_func != NULL)
              ^
  311.   		malloc_debug_func(ret, num, file, line, 1);
  312.   

crypto/mem.c:311:3: Skipping __function_pointer__(): unresolved function pointer
  309.   #endif
  310.   	if (malloc_debug_func != NULL)
  311.   		malloc_debug_func(ret, num, file, line, 1);
           ^
  312.   
  313.   #ifndef OPENSSL_CPUID_OBJ

crypto/mem.c:317:12: Taking true branch
  315.            * sanitisation function can't be optimised out. NB: We only do
  316.            * this for >2Kb so the overhead doesn't bother us. */
  317.           if(ret && (num > 2048))
                    ^
  318.   	{	extern unsigned char cleanse_ctr;
  319.                   ((unsigned char *)ret)[0] = cleanse_ctr;

crypto/mem.c:317:20: Taking false branch
  315.            * sanitisation function can't be optimised out. NB: We only do
  316.            * this for >2Kb so the overhead doesn't bother us. */
  317.           if(ret && (num > 2048))
                            ^
  318.   	{	extern unsigned char cleanse_ctr;
  319.                   ((unsigned char *)ret)[0] = cleanse_ctr;

crypto/mem.c:323:2: 
  321.   #endif
  322.   
  323. > 	return ret;
  324.   	}
  325.   

crypto/mem.c:324:2: return from a call to CRYPTO_malloc
  322.   
  323.   	return ret;
  324.   	}
          ^
  325.   
  326.   void *CRYPTO_realloc(void *str, int num, const char *file, int line)

engines/e_chil.c:789:7: Taking false branch
787.   #ifndef OPENSSL_NO_RSA
788.   	hptr = OPENSSL_malloc(sizeof(HWCryptoHook_RSAKeyHandle));
789.   	if (!hptr)
             ^
790.   		{
791.   		HWCRHKerr(HWCRHK_F_HWCRHK_LOAD_PRIVKEY,

engines/e_chil.c:795:9: 
793.   		goto err;
794.   		}
795. >         ppctx.ui_method = ui_method;
796.   	ppctx.callback_data = callback_data;
797.   	if (p_hwcrhk_RSALoadKey(hwcrhk_context, key_id, hptr,

engines/e_chil.c:796:2: 
794.   		}
795.           ppctx.ui_method = ui_method;
796. > 	ppctx.callback_data = callback_data;
797.   	if (p_hwcrhk_RSALoadKey(hwcrhk_context, key_id, hptr,
798.   		&rmsg, &ppctx))

engines/e_chil.c:797:6: Taking false branch
795.           ppctx.ui_method = ui_method;
796.   	ppctx.callback_data = callback_data;
797.   	if (p_hwcrhk_RSALoadKey(hwcrhk_context, key_id, hptr,
            ^
798.   		&rmsg, &ppctx))
799.   		{

engines/e_chil.c:805:7: Taking false branch
803.   		goto err;
804.   		}
805.   	if (!*hptr)
             ^
806.   		{
807.   		HWCRHKerr(HWCRHK_F_HWCRHK_LOAD_PRIVKEY,

engines/e_chil.c:813:2: Skipping RSA_new_method(): empty list of specs
811.   #endif
812.   #ifndef OPENSSL_NO_RSA
813.   	rtmp = RSA_new_method(eng);
        ^
814.   	RSA_set_ex_data(rtmp, hndidx_rsa, (char *)hptr);
815.   	rtmp->e = BN_new();

engines/e_chil.c:814:2: 
812.   #ifndef OPENSSL_NO_RSA
813.   	rtmp = RSA_new_method(eng);
814. > 	RSA_set_ex_data(rtmp, hndidx_rsa, (char *)hptr);
815.   	rtmp->e = BN_new();
816.   	rtmp->n = BN_new();

crypto/rsa/rsa_lib.c:264:1: start of procedure RSA_set_ex_data()
  262.           }
  263.   
  264. > int RSA_set_ex_data(RSA *r, int idx, void *arg)
  265.   	{
  266.   	return(CRYPTO_set_ex_data(&r->ex_data,idx,arg));

crypto/rsa/rsa_lib.c:266:2: 
  264.   int RSA_set_ex_data(RSA *r, int idx, void *arg)
  265.   	{
  266. > 	return(CRYPTO_set_ex_data(&r->ex_data,idx,arg));
  267.   	}
  268.   

crypto/ex_data.c:593:1: start of procedure CRYPTO_set_ex_data()
    591.   /* For a given CRYPTO_EX_DATA variable, set the value corresponding to a
    592.    * particular index in the class used by this variable */
    593. > int CRYPTO_set_ex_data(CRYPTO_EX_DATA *ad, int idx, void *val)
    594.   	{
    595.   	int i;

crypto/ex_data.c:597:6: Taking false branch
    595.   	int i;
    596.   
    597.   	if (ad->sk == NULL)
                ^
    598.   		{
    599.   		if ((ad->sk=sk_new_null()) == NULL)

crypto/ex_data.c:605:2: 
    603.   			}
    604.   		}
    605. > 	i=sk_num(ad->sk);
    606.   
    607.   	while (i <= idx)

crypto/stack/stack.c:301:1: start of procedure sk_num()
      299.   	}
      300.   
      301. > int sk_num(const STACK *st)
      302.   {
      303.   	if(st == NULL) return -1;

crypto/stack/stack.c:303:5: Taking false branch
      301.   int sk_num(const STACK *st)
      302.   {
      303.   	if(st == NULL) return -1;
                 ^
      304.   	return st->num;
      305.   }

crypto/stack/stack.c:304:2: 
      302.   {
      303.   	if(st == NULL) return -1;
      304. > 	return st->num;
      305.   }
      306.   

crypto/stack/stack.c:305:1: return from a call to sk_num
      303.   	if(st == NULL) return -1;
      304.   	return st->num;
      305. > }
      306.   
      307.   char *sk_value(const STACK *st, int i)

crypto/ex_data.c:607:9: Loop condition is false. Leaving loop
    605.   	i=sk_num(ad->sk);
    606.   
    607.   	while (i <= idx)
                   ^
    608.   		{
    609.   		if (!sk_push(ad->sk,NULL))

crypto/ex_data.c:616:2: 
    614.   		i++;
    615.   		}
    616. > 	sk_set(ad->sk,idx,val);
    617.   	return(1);
    618.   	}

crypto/stack/stack.c:313:1: start of procedure sk_set()
      311.   }
      312.   
      313. > char *sk_set(STACK *st, int i, char *value)
      314.   {
      315.   	if(!st || (i < 0) || (i >= st->num)) return NULL;

crypto/stack/stack.c:315:6: Taking false branch
      313.   char *sk_set(STACK *st, int i, char *value)
      314.   {
      315.   	if(!st || (i < 0) || (i >= st->num)) return NULL;
                  ^
      316.   	return (st->data[i] = value);
      317.   }

crypto/stack/stack.c:315:13: Taking true branch
      313.   char *sk_set(STACK *st, int i, char *value)
      314.   {
      315.   	if(!st || (i < 0) || (i >= st->num)) return NULL;
                         ^
      316.   	return (st->data[i] = value);
      317.   }

crypto/stack/stack.c:315:39: 
      313.   char *sk_set(STACK *st, int i, char *value)
      314.   {
      315. > 	if(!st || (i < 0) || (i >= st->num)) return NULL;
      316.   	return (st->data[i] = value);
      317.   }

crypto/stack/stack.c:317:1: return from a call to sk_set
      315.   	if(!st || (i < 0) || (i >= st->num)) return NULL;
      316.   	return (st->data[i] = value);
      317. > }
      318.   
      319.   void sk_sort(STACK *st)

crypto/ex_data.c:617:2: 
    615.   		}
    616.   	sk_set(ad->sk,idx,val);
    617. > 	return(1);
    618.   	}
    619.   

crypto/ex_data.c:618:2: return from a call to CRYPTO_set_ex_data
    616.   	sk_set(ad->sk,idx,val);
    617.   	return(1);
    618.   	}
            ^
    619.   
    620.   /* For a given CRYPTO_EX_DATA_ variable, get the value corresponding to a

crypto/rsa/rsa_lib.c:267:2: return from a call to RSA_set_ex_data
  265.   	{
  266.   	return(CRYPTO_set_ex_data(&r->ex_data,idx,arg));
  267.   	}
          ^
  268.   
  269.   void *RSA_get_ex_data(const RSA *r, int idx)

engines/e_chil.c:815:2: 
813.   	rtmp = RSA_new_method(eng);
814.   	RSA_set_ex_data(rtmp, hndidx_rsa, (char *)hptr);
815. > 	rtmp->e = BN_new();
816.   	rtmp->n = BN_new();
817.   	rtmp->flags |= RSA_FLAG_EXT_PKEY;

crypto/bn/bn_lib.c:298:1: start of procedure BN_new()
  296.   	}
  297.   
  298. > BIGNUM *BN_new(void)
  299.   	{
  300.   	BIGNUM *ret;

crypto/bn/bn_lib.c:302:6: 
  300.   	BIGNUM *ret;
  301.   
  302. > 	if ((ret=(BIGNUM *)OPENSSL_malloc(sizeof(BIGNUM))) == NULL)
  303.   		{
  304.   		BNerr(BN_F_BN_NEW,ERR_R_MALLOC_FAILURE);

crypto/mem.c:294:1: start of procedure CRYPTO_malloc()
    292.   	}
    293.   
    294. > void *CRYPTO_malloc(int num, const char *file, int line)
    295.   	{
    296.   	void *ret = NULL;

crypto/mem.c:296:2: 
    294.   void *CRYPTO_malloc(int num, const char *file, int line)
    295.   	{
    296. > 	void *ret = NULL;
    297.   
    298.   	if (num <= 0) return NULL;

crypto/mem.c:298:6: Taking false branch
    296.   	void *ret = NULL;
    297.   
    298.   	if (num <= 0) return NULL;
                ^
    299.   
    300.   	allow_customize = 0;

crypto/mem.c:300:2: 
    298.   	if (num <= 0) return NULL;
    299.   
    300. > 	allow_customize = 0;
    301.   	if (malloc_debug_func != NULL)
    302.   		{

crypto/mem.c:301:6: Taking true branch
    299.   
    300.   	allow_customize = 0;
    301.   	if (malloc_debug_func != NULL)
                ^
    302.   		{
    303.   		allow_customize_debug = 0;

crypto/mem.c:303:3: 
    301.   	if (malloc_debug_func != NULL)
    302.   		{
    303. > 		allow_customize_debug = 0;
    304.   		malloc_debug_func(NULL, num, file, line, 0);
    305.   		}

crypto/mem.c:304:3: Skipping __function_pointer__(): unresolved function pointer
    302.   		{
    303.   		allow_customize_debug = 0;
    304.   		malloc_debug_func(NULL, num, file, line, 0);
             ^
    305.   		}
    306.   	ret = malloc_ex_func(num,file,line);

crypto/mem.c:306:2: Skipping __function_pointer__(): unresolved function pointer
    304.   		malloc_debug_func(NULL, num, file, line, 0);
    305.   		}
    306.   	ret = malloc_ex_func(num,file,line);
            ^
    307.   #ifdef LEVITTE_DEBUG_MEM
    308.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);

crypto/mem.c:310:6: Taking true branch
    308.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);
    309.   #endif
    310.   	if (malloc_debug_func != NULL)
                ^
    311.   		malloc_debug_func(ret, num, file, line, 1);
    312.   

crypto/mem.c:311:3: Skipping __function_pointer__(): unresolved function pointer
    309.   #endif
    310.   	if (malloc_debug_func != NULL)
    311.   		malloc_debug_func(ret, num, file, line, 1);
             ^
    312.   
    313.   #ifndef OPENSSL_CPUID_OBJ

crypto/mem.c:317:12: Taking false branch
    315.            * sanitisation function can't be optimised out. NB: We only do
    316.            * this for >2Kb so the overhead doesn't bother us. */
    317.           if(ret && (num > 2048))
                      ^
    318.   	{	extern unsigned char cleanse_ctr;
    319.                   ((unsigned char *)ret)[0] = cleanse_ctr;

crypto/mem.c:323:2: 
    321.   #endif
    322.   
    323. > 	return ret;
    324.   	}
    325.   

crypto/mem.c:324:2: return from a call to CRYPTO_malloc
    322.   
    323.   	return ret;
    324.   	}
            ^
    325.   
    326.   void *CRYPTO_realloc(void *str, int num, const char *file, int line)

crypto/bn/bn_lib.c:302:6: Taking true branch
  300.   	BIGNUM *ret;
  301.   
  302.   	if ((ret=(BIGNUM *)OPENSSL_malloc(sizeof(BIGNUM))) == NULL)
              ^
  303.   		{
  304.   		BNerr(BN_F_BN_NEW,ERR_R_MALLOC_FAILURE);

crypto/bn/bn_lib.c:304:3: 
  302.   	if ((ret=(BIGNUM *)OPENSSL_malloc(sizeof(BIGNUM))) == NULL)
  303.   		{
  304. > 		BNerr(BN_F_BN_NEW,ERR_R_MALLOC_FAILURE);
  305.   		return(NULL);
  306.   		}

crypto/err/err.c:680:1: start of procedure ERR_put_error()
    678.   /********************************************************/
    679.   
    680. > void ERR_put_error(int lib, int func, int reason, const char *file,
    681.   	     int line)
    682.   	{

crypto/err/err.c:704:2: Skipping ERR_get_state(): empty list of specs
    702.   	}
    703.   #endif
    704.   	es=ERR_get_state();
            ^
    705.   
    706.   	es->top=(es->top+1)%ERR_NUM_ERRORS;

crypto/err/err.c:706:2: 
    704.   	es=ERR_get_state();
    705.   
    706. > 	es->top=(es->top+1)%ERR_NUM_ERRORS;
    707.   	if (es->top == es->bottom)
    708.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;

crypto/err/err.c:707:6: Taking false branch
    705.   
    706.   	es->top=(es->top+1)%ERR_NUM_ERRORS;
    707.   	if (es->top == es->bottom)
                ^
    708.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
    709.   	es->err_flags[es->top]=0;

crypto/err/err.c:709:2: 
    707.   	if (es->top == es->bottom)
    708.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
    709. > 	es->err_flags[es->top]=0;
    710.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
    711.   	es->err_file[es->top]=file;

crypto/err/err.c:710:2: 
    708.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
    709.   	es->err_flags[es->top]=0;
    710. > 	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
    711.   	es->err_file[es->top]=file;
    712.   	es->err_line[es->top]=line;

crypto/err/err.c:711:2: 
    709.   	es->err_flags[es->top]=0;
    710.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
    711. > 	es->err_file[es->top]=file;
    712.   	es->err_line[es->top]=line;
    713.   	err_clear_data(es,es->top);

crypto/err/err.c:712:2: 
    710.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
    711.   	es->err_file[es->top]=file;
    712. > 	es->err_line[es->top]=line;
    713.   	err_clear_data(es,es->top);
    714.   	}

crypto/err/err.c:713:2: Taking true branch
    711.   	es->err_file[es->top]=file;
    712.   	es->err_line[es->top]=line;
    713.   	err_clear_data(es,es->top);
            ^
    714.   	}
    715.   

crypto/err/err.c:713:2: Taking false branch
    711.   	es->err_file[es->top]=file;
    712.   	es->err_line[es->top]=line;
    713.   	err_clear_data(es,es->top);
            ^
    714.   	}
    715.   

crypto/err/err.c:713:2: Loop condition is false. Leaving loop
    711.   	es->err_file[es->top]=file;
    712.   	es->err_line[es->top]=line;
    713.   	err_clear_data(es,es->top);
            ^
    714.   	}
    715.   

crypto/err/err.c:714:2: return from a call to ERR_put_error
    712.   	es->err_line[es->top]=line;
    713.   	err_clear_data(es,es->top);
    714.   	}
            ^
    715.   
    716.   void ERR_clear_error(void)

crypto/bn/bn_lib.c:305:3: 
  303.   		{
  304.   		BNerr(BN_F_BN_NEW,ERR_R_MALLOC_FAILURE);
  305. > 		return(NULL);
  306.   		}
  307.   	ret->flags=BN_FLG_MALLOCED;

crypto/bn/bn_lib.c:314:2: return from a call to BN_new
  312.   	bn_check_top(ret);
  313.   	return(ret);
  314.   	}
          ^
  315.   
  316.   /* This is used both by bn_expand2() and bn_dup_expand() */

engines/e_chil.c:816:2: 
814.   	RSA_set_ex_data(rtmp, hndidx_rsa, (char *)hptr);
815.   	rtmp->e = BN_new();
816. > 	rtmp->n = BN_new();
817.   	rtmp->flags |= RSA_FLAG_EXT_PKEY;
818.   	MPI2BN(rtmp->e, e);

crypto/bn/bn_lib.c:298:1: start of procedure BN_new()
  296.   	}
  297.   
  298. > BIGNUM *BN_new(void)
  299.   	{
  300.   	BIGNUM *ret;

crypto/bn/bn_lib.c:302:6: 
  300.   	BIGNUM *ret;
  301.   
  302. > 	if ((ret=(BIGNUM *)OPENSSL_malloc(sizeof(BIGNUM))) == NULL)
  303.   		{
  304.   		BNerr(BN_F_BN_NEW,ERR_R_MALLOC_FAILURE);

crypto/mem.c:294:1: start of procedure CRYPTO_malloc()
    292.   	}
    293.   
    294. > void *CRYPTO_malloc(int num, const char *file, int line)
    295.   	{
    296.   	void *ret = NULL;

crypto/mem.c:296:2: 
    294.   void *CRYPTO_malloc(int num, const char *file, int line)
    295.   	{
    296. > 	void *ret = NULL;
    297.   
    298.   	if (num <= 0) return NULL;

crypto/mem.c:298:6: Taking false branch
    296.   	void *ret = NULL;
    297.   
    298.   	if (num <= 0) return NULL;
                ^
    299.   
    300.   	allow_customize = 0;

crypto/mem.c:300:2: 
    298.   	if (num <= 0) return NULL;
    299.   
    300. > 	allow_customize = 0;
    301.   	if (malloc_debug_func != NULL)
    302.   		{

crypto/mem.c:301:6: Taking true branch
    299.   
    300.   	allow_customize = 0;
    301.   	if (malloc_debug_func != NULL)
                ^
    302.   		{
    303.   		allow_customize_debug = 0;

crypto/mem.c:303:3: 
    301.   	if (malloc_debug_func != NULL)
    302.   		{
    303. > 		allow_customize_debug = 0;
    304.   		malloc_debug_func(NULL, num, file, line, 0);
    305.   		}

crypto/mem.c:304:3: Skipping __function_pointer__(): unresolved function pointer
    302.   		{
    303.   		allow_customize_debug = 0;
    304.   		malloc_debug_func(NULL, num, file, line, 0);
             ^
    305.   		}
    306.   	ret = malloc_ex_func(num,file,line);

crypto/mem.c:306:2: Skipping __function_pointer__(): unresolved function pointer
    304.   		malloc_debug_func(NULL, num, file, line, 0);
    305.   		}
    306.   	ret = malloc_ex_func(num,file,line);
            ^
    307.   #ifdef LEVITTE_DEBUG_MEM
    308.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);

crypto/mem.c:310:6: Taking true branch
    308.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);
    309.   #endif
    310.   	if (malloc_debug_func != NULL)
                ^
    311.   		malloc_debug_func(ret, num, file, line, 1);
    312.   

crypto/mem.c:311:3: Skipping __function_pointer__(): unresolved function pointer
    309.   #endif
    310.   	if (malloc_debug_func != NULL)
    311.   		malloc_debug_func(ret, num, file, line, 1);
             ^
    312.   
    313.   #ifndef OPENSSL_CPUID_OBJ

crypto/mem.c:317:12: Taking false branch
    315.            * sanitisation function can't be optimised out. NB: We only do
    316.            * this for >2Kb so the overhead doesn't bother us. */
    317.           if(ret && (num > 2048))
                      ^
    318.   	{	extern unsigned char cleanse_ctr;
    319.                   ((unsigned char *)ret)[0] = cleanse_ctr;

crypto/mem.c:323:2: 
    321.   #endif
    322.   
    323. > 	return ret;
    324.   	}
    325.   

crypto/mem.c:324:2: return from a call to CRYPTO_malloc
    322.   
    323.   	return ret;
    324.   	}
            ^
    325.   
    326.   void *CRYPTO_realloc(void *str, int num, const char *file, int line)

crypto/bn/bn_lib.c:302:6: Taking true branch
  300.   	BIGNUM *ret;
  301.   
  302.   	if ((ret=(BIGNUM *)OPENSSL_malloc(sizeof(BIGNUM))) == NULL)
              ^
  303.   		{
  304.   		BNerr(BN_F_BN_NEW,ERR_R_MALLOC_FAILURE);

crypto/bn/bn_lib.c:304:3: 
  302.   	if ((ret=(BIGNUM *)OPENSSL_malloc(sizeof(BIGNUM))) == NULL)
  303.   		{
  304. > 		BNerr(BN_F_BN_NEW,ERR_R_MALLOC_FAILURE);
  305.   		return(NULL);
  306.   		}

crypto/err/err.c:680:1: start of procedure ERR_put_error()
    678.   /********************************************************/
    679.   
    680. > void ERR_put_error(int lib, int func, int reason, const char *file,
    681.   	     int line)
    682.   	{

crypto/err/err.c:704:2: Skipping ERR_get_state(): empty list of specs
    702.   	}
    703.   #endif
    704.   	es=ERR_get_state();
            ^
    705.   
    706.   	es->top=(es->top+1)%ERR_NUM_ERRORS;

crypto/err/err.c:706:2: 
    704.   	es=ERR_get_state();
    705.   
    706. > 	es->top=(es->top+1)%ERR_NUM_ERRORS;
    707.   	if (es->top == es->bottom)
    708.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;

crypto/err/err.c:707:6: Taking false branch
    705.   
    706.   	es->top=(es->top+1)%ERR_NUM_ERRORS;
    707.   	if (es->top == es->bottom)
                ^
    708.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
    709.   	es->err_flags[es->top]=0;

crypto/err/err.c:709:2: 
    707.   	if (es->top == es->bottom)
    708.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
    709. > 	es->err_flags[es->top]=0;
    710.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
    711.   	es->err_file[es->top]=file;

crypto/err/err.c:710:2: 
    708.   		es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
    709.   	es->err_flags[es->top]=0;
    710. > 	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
    711.   	es->err_file[es->top]=file;
    712.   	es->err_line[es->top]=line;

crypto/err/err.c:711:2: 
    709.   	es->err_flags[es->top]=0;
    710.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
    711. > 	es->err_file[es->top]=file;
    712.   	es->err_line[es->top]=line;
    713.   	err_clear_data(es,es->top);

crypto/err/err.c:712:2: 
    710.   	es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
    711.   	es->err_file[es->top]=file;
    712. > 	es->err_line[es->top]=line;
    713.   	err_clear_data(es,es->top);
    714.   	}

crypto/err/err.c:713:2: Taking true branch
    711.   	es->err_file[es->top]=file;
    712.   	es->err_line[es->top]=line;
    713.   	err_clear_data(es,es->top);
            ^
    714.   	}
    715.   

crypto/err/err.c:713:2: Taking false branch
    711.   	es->err_file[es->top]=file;
    712.   	es->err_line[es->top]=line;
    713.   	err_clear_data(es,es->top);
            ^
    714.   	}
    715.   

crypto/err/err.c:713:2: Loop condition is false. Leaving loop
    711.   	es->err_file[es->top]=file;
    712.   	es->err_line[es->top]=line;
    713.   	err_clear_data(es,es->top);
            ^
    714.   	}
    715.   

crypto/err/err.c:714:2: return from a call to ERR_put_error
    712.   	es->err_line[es->top]=line;
    713.   	err_clear_data(es,es->top);
    714.   	}
            ^
    715.   
    716.   void ERR_clear_error(void)

crypto/bn/bn_lib.c:305:3: 
  303.   		{
  304.   		BNerr(BN_F_BN_NEW,ERR_R_MALLOC_FAILURE);
  305. > 		return(NULL);
  306.   		}
  307.   	ret->flags=BN_FLG_MALLOCED;

crypto/bn/bn_lib.c:314:2: return from a call to BN_new
  312.   	bn_check_top(ret);
  313.   	return(ret);
  314.   	}
          ^
  315.   
  316.   /* This is used both by bn_expand2() and bn_dup_expand() */

engines/e_chil.c:817:2: 
815.   	rtmp->e = BN_new();
816.   	rtmp->n = BN_new();
817. > 	rtmp->flags |= RSA_FLAG_EXT_PKEY;
818.   	MPI2BN(rtmp->e, e);
819.   	MPI2BN(rtmp->n, n);

engines/e_chil.c:818:2: 
816.   	rtmp->n = BN_new();
817.   	rtmp->flags |= RSA_FLAG_EXT_PKEY;
818. > 	MPI2BN(rtmp->e, e);
819.   	MPI2BN(rtmp->n, n);
820.   	if (p_hwcrhk_RSAGetPublicKey(*hptr, &n, &e, &rmsg)

static EVP_PKEY *hwcrhk_load_privkey(ENGINE *eng, const char *key_id,
	UI_METHOD *ui_method, void *callback_data)
	{
#ifndef OPENSSL_NO_RSA
	RSA *rtmp = NULL;
#endif
	EVP_PKEY *res = NULL;
#ifndef OPENSSL_NO_RSA
	HWCryptoHook_MPI e, n;
	HWCryptoHook_RSAKeyHandle *hptr;
#endif
#if !defined(OPENSSL_NO_RSA)
	char tempbuf[1024];
	HWCryptoHook_ErrMsgBuf rmsg;
	HWCryptoHook_PassphraseContext ppctx;
#endif
#if !defined(OPENSSL_NO_RSA)
	rmsg.buf = tempbuf;
	rmsg.size = sizeof(tempbuf);
#endif
	if(!hwcrhk_context)
		{
		HWCRHKerr(HWCRHK_F_HWCRHK_LOAD_PRIVKEY,
			HWCRHK_R_NOT_INITIALISED);
		goto err;
		}
#ifndef OPENSSL_NO_RSA
	hptr = OPENSSL_malloc(sizeof(HWCryptoHook_RSAKeyHandle));
	if (!hptr)
		{
		HWCRHKerr(HWCRHK_F_HWCRHK_LOAD_PRIVKEY,
			ERR_R_MALLOC_FAILURE);
		goto err;
		}
        ppctx.ui_method = ui_method;
	ppctx.callback_data = callback_data;
	if (p_hwcrhk_RSALoadKey(hwcrhk_context, key_id, hptr,
		&rmsg, &ppctx))
		{
		HWCRHKerr(HWCRHK_F_HWCRHK_LOAD_PRIVKEY,
			HWCRHK_R_CHIL_ERROR);
		ERR_add_error_data(1,rmsg.buf);
		goto err;
		}
	if (!*hptr)
		{
		HWCRHKerr(HWCRHK_F_HWCRHK_LOAD_PRIVKEY,
			HWCRHK_R_NO_KEY);
		goto err;
		}
#endif
#ifndef OPENSSL_NO_RSA
	rtmp = RSA_new_method(eng);
	RSA_set_ex_data(rtmp, hndidx_rsa, (char *)hptr);
	rtmp->e = BN_new();
	rtmp->n = BN_new();
	rtmp->flags |= RSA_FLAG_EXT_PKEY;
	MPI2BN(rtmp->e, e);
	MPI2BN(rtmp->n, n);
	if (p_hwcrhk_RSAGetPublicKey(*hptr, &n, &e, &rmsg)
		!= HWCRYPTOHOOK_ERROR_MPISIZE)
		{
		HWCRHKerr(HWCRHK_F_HWCRHK_LOAD_PRIVKEY,HWCRHK_R_CHIL_ERROR);
		ERR_add_error_data(1,rmsg.buf);
		goto err;
		}
	bn_expand2(rtmp->e, e.size/sizeof(BN_ULONG));
	bn_expand2(rtmp->n, n.size/sizeof(BN_ULONG));
	MPI2BN(rtmp->e, e);
	MPI2BN(rtmp->n, n);
	if (p_hwcrhk_RSAGetPublicKey(*hptr, &n, &e, &rmsg))
		{
		HWCRHKerr(HWCRHK_F_HWCRHK_LOAD_PRIVKEY,
			HWCRHK_R_CHIL_ERROR);
		ERR_add_error_data(1,rmsg.buf);
		goto err;
		}
	rtmp->e->top = e.size / sizeof(BN_ULONG);
	bn_fix_top(rtmp->e);
	rtmp->n->top = n.size / sizeof(BN_ULONG);
	bn_fix_top(rtmp->n);
	res = EVP_PKEY_new();
	EVP_PKEY_assign_RSA(res, rtmp);
#endif
        if (!res)
                HWCRHKerr(HWCRHK_F_HWCRHK_LOAD_PRIVKEY,
                        HWCRHK_R_PRIVATE_KEY_ALGORITHMS_DISABLED);
	return res;
 err:
#ifndef OPENSSL_NO_RSA
	if (rtmp)
		RSA_free(rtmp);
#endif
	return NULL;
	}
['static EVP_PKEY *hwcrhk_load_privkey(ENGINE *eng, const char *key_id,\n\tUI_METHOD *ui_method, void *callback_data)\n\t{\n#ifndef OPENSSL_NO_RSA\n\tRSA *rtmp = NULL;\n#endif\n\tEVP_PKEY *res = NULL;\n#ifndef OPENSSL_NO_RSA\n\tHWCryptoHook_MPI e, n;\n\tHWCryptoHook_RSAKeyHandle *hptr;\n#endif\n#if !defined(OPENSSL_NO_RSA)\n\tchar tempbuf[1024];\n\tHWCryptoHook_ErrMsgBuf rmsg;\n\tHWCryptoHook_PassphraseContext ppctx;\n#endif\n#if !defined(OPENSSL_NO_RSA)\n\trmsg.buf = tempbuf;\n\trmsg.size = sizeof(tempbuf);\n#endif\n\tif(!hwcrhk_context)\n\t\t{\n\t\tHWCRHKerr(HWCRHK_F_HWCRHK_LOAD_PRIVKEY,\n\t\t\tHWCRHK_R_NOT_INITIALISED);\n\t\tgoto err;\n\t\t}\n#ifndef OPENSSL_NO_RSA\n\thptr = OPENSSL_malloc(sizeof(HWCryptoHook_RSAKeyHandle));\n\tif (!hptr)\n\t\t{\n\t\tHWCRHKerr(HWCRHK_F_HWCRHK_LOAD_PRIVKEY,\n\t\t\tERR_R_MALLOC_FAILURE);\n\t\tgoto err;\n\t\t}\n        ppctx.ui_method = ui_method;\n\tppctx.callback_data = callback_data;\n\tif (p_hwcrhk_RSALoadKey(hwcrhk_context, key_id, hptr,\n\t\t&rmsg, &ppctx))\n\t\t{\n\t\tHWCRHKerr(HWCRHK_F_HWCRHK_LOAD_PRIVKEY,\n\t\t\tHWCRHK_R_CHIL_ERROR);\n\t\tERR_add_error_data(1,rmsg.buf);\n\t\tgoto err;\n\t\t}\n\tif (!*hptr)\n\t\t{\n\t\tHWCRHKerr(HWCRHK_F_HWCRHK_LOAD_PRIVKEY,\n\t\t\tHWCRHK_R_NO_KEY);\n\t\tgoto err;\n\t\t}\n#endif\n#ifndef OPENSSL_NO_RSA\n\trtmp = RSA_new_method(eng);\n\tRSA_set_ex_data(rtmp, hndidx_rsa, (char *)hptr);\n\trtmp->e = BN_new();\n\trtmp->n = BN_new();\n\trtmp->flags |= RSA_FLAG_EXT_PKEY;\n\tMPI2BN(rtmp->e, e);\n\tMPI2BN(rtmp->n, n);\n\tif (p_hwcrhk_RSAGetPublicKey(*hptr, &n, &e, &rmsg)\n\t\t!= HWCRYPTOHOOK_ERROR_MPISIZE)\n\t\t{\n\t\tHWCRHKerr(HWCRHK_F_HWCRHK_LOAD_PRIVKEY,HWCRHK_R_CHIL_ERROR);\n\t\tERR_add_error_data(1,rmsg.buf);\n\t\tgoto err;\n\t\t}\n\tbn_expand2(rtmp->e, e.size/sizeof(BN_ULONG));\n\tbn_expand2(rtmp->n, n.size/sizeof(BN_ULONG));\n\tMPI2BN(rtmp->e, e);\n\tMPI2BN(rtmp->n, n);\n\tif (p_hwcrhk_RSAGetPublicKey(*hptr, &n, &e, &rmsg))\n\t\t{\n\t\tHWCRHKerr(HWCRHK_F_HWCRHK_LOAD_PRIVKEY,\n\t\t\tHWCRHK_R_CHIL_ERROR);\n\t\tERR_add_error_data(1,rmsg.buf);\n\t\tgoto err;\n\t\t}\n\trtmp->e->top = e.size / sizeof(BN_ULONG);\n\tbn_fix_top(rtmp->e);\n\trtmp->n->top = n.size / sizeof(BN_ULONG);\n\tbn_fix_top(rtmp->n);\n\tres = EVP_PKEY_new();\n\tEVP_PKEY_assign_RSA(res, rtmp);\n#endif\n        if (!res)\n                HWCRHKerr(HWCRHK_F_HWCRHK_LOAD_PRIVKEY,\n                        HWCRHK_R_PRIVATE_KEY_ALGORITHMS_DISABLED);\n\treturn res;\n err:\n#ifndef OPENSSL_NO_RSA\n\tif (rtmp)\n\t\tRSA_free(rtmp);\n#endif\n\treturn NULL;\n\t}', 'void *CRYPTO_malloc(int num, const char *file, int line)\n\t{\n\tvoid *ret = NULL;\n\tif (num <= 0) return NULL;\n\tallow_customize = 0;\n\tif (malloc_debug_func != NULL)\n\t\t{\n\t\tallow_customize_debug = 0;\n\t\tmalloc_debug_func(NULL, num, file, line, 0);\n\t\t}\n\tret = malloc_ex_func(num,file,line);\n#ifdef LEVITTE_DEBUG_MEM\n\tfprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\\n", ret, num);\n#endif\n\tif (malloc_debug_func != NULL)\n\t\tmalloc_debug_func(ret, num, file, line, 1);\n#ifndef OPENSSL_CPUID_OBJ\n        if(ret && (num > 2048))\n\t{\textern unsigned char cleanse_ctr;\n                ((unsigned char *)ret)[0] = cleanse_ctr;\n\t}\n#endif\n\treturn ret;\n\t}', 'int RSA_set_ex_data(RSA *r, int idx, void *arg)\n\t{\n\treturn(CRYPTO_set_ex_data(&r->ex_data,idx,arg));\n\t}', 'int CRYPTO_set_ex_data(CRYPTO_EX_DATA *ad, int idx, void *val)\n\t{\n\tint i;\n\tif (ad->sk == NULL)\n\t\t{\n\t\tif ((ad->sk=sk_new_null()) == NULL)\n\t\t\t{\n\t\t\tCRYPTOerr(CRYPTO_F_CRYPTO_SET_EX_DATA,ERR_R_MALLOC_FAILURE);\n\t\t\treturn(0);\n\t\t\t}\n\t\t}\n\ti=sk_num(ad->sk);\n\twhile (i <= idx)\n\t\t{\n\t\tif (!sk_push(ad->sk,NULL))\n\t\t\t{\n\t\t\tCRYPTOerr(CRYPTO_F_CRYPTO_SET_EX_DATA,ERR_R_MALLOC_FAILURE);\n\t\t\treturn(0);\n\t\t\t}\n\t\ti++;\n\t\t}\n\tsk_set(ad->sk,idx,val);\n\treturn(1);\n\t}', 'int sk_num(const STACK *st)\n{\n\tif(st == NULL) return -1;\n\treturn st->num;\n}', 'char *sk_set(STACK *st, int i, char *value)\n{\n\tif(!st || (i < 0) || (i >= st->num)) return NULL;\n\treturn (st->data[i] = value);\n}', 'BIGNUM *BN_new(void)\n\t{\n\tBIGNUM *ret;\n\tif ((ret=(BIGNUM *)OPENSSL_malloc(sizeof(BIGNUM))) == NULL)\n\t\t{\n\t\tBNerr(BN_F_BN_NEW,ERR_R_MALLOC_FAILURE);\n\t\treturn(NULL);\n\t\t}\n\tret->flags=BN_FLG_MALLOCED;\n\tret->top=0;\n\tret->neg=0;\n\tret->dmax=0;\n\tret->d=NULL;\n\tbn_check_top(ret);\n\treturn(ret);\n\t}', 'void ERR_put_error(int lib, int func, int reason, const char *file,\n\t     int line)\n\t{\n\tERR_STATE *es;\n#ifdef _OSD_POSIX\n\tif (strncmp(file,"*POSIX(", sizeof("*POSIX(")-1) == 0) {\n\t\tchar *end;\n\t\tfile += sizeof("*POSIX(")-1;\n\t\tend = &file[strlen(file)-1];\n\t\tif (*end == \')\')\n\t\t\t*end = \'\\0\';\n\t\tif ((end = strrchr(file, \'/\')) != NULL)\n\t\t\tfile = &end[1];\n\t}\n#endif\n\tes=ERR_get_state();\n\tes->top=(es->top+1)%ERR_NUM_ERRORS;\n\tif (es->top == es->bottom)\n\t\tes->bottom=(es->bottom+1)%ERR_NUM_ERRORS;\n\tes->err_flags[es->top]=0;\n\tes->err_buffer[es->top]=ERR_PACK(lib,func,reason);\n\tes->err_file[es->top]=file;\n\tes->err_line[es->top]=line;\n\terr_clear_data(es,es->top);\n\t}']