test/testutil/tests.c:413: error: NULL_DEREFERENCE
  pointer `aa` last assigned on line 412 could be null and is dereferenced by call to `BN_set_negative()` at line 413, column 5.
Showing all 47 steps of the trace


test/testutil/tests.c:404:1: start of procedure test_BN_abs_eq_word()
402.   }
403.   
404. > int test_BN_abs_eq_word(const char *file, int line, const char *bns,
405.                           const char *ws, const BIGNUM *a, BN_ULONG w)
406.   {

test/testutil/tests.c:409:9: Taking true branch
407.       BIGNUM *bw, *aa;
408.   
409.       if (a != NULL && BN_abs_is_word(a, w))
               ^
410.           return 1;
411.       bw = BN_new();

test/testutil/tests.c:409:22: 
407.       BIGNUM *bw, *aa;
408.   
409. >     if (a != NULL && BN_abs_is_word(a, w))
410.           return 1;
411.       bw = BN_new();

crypto/bn/bn_lib.c:859:1: start of procedure BN_abs_is_word()
  857.   }
  858.   
  859. > int BN_abs_is_word(const BIGNUM *a, const BN_ULONG w)
  860.   {
  861.       return ((a->top == 1) && (a->d[0] == w)) || ((w == 0) && (a->top == 0));

crypto/bn/bn_lib.c:861:14: Condition is false
  859.   int BN_abs_is_word(const BIGNUM *a, const BN_ULONG w)
  860.   {
  861.       return ((a->top == 1) && (a->d[0] == w)) || ((w == 0) && (a->top == 0));
                      ^
  862.   }
  863.   

crypto/bn/bn_lib.c:861:51: Condition is false
  859.   int BN_abs_is_word(const BIGNUM *a, const BN_ULONG w)
  860.   {
  861.       return ((a->top == 1) && (a->d[0] == w)) || ((w == 0) && (a->top == 0));
                                                           ^
  862.   }
  863.   

crypto/bn/bn_lib.c:861:12: 
  859.   int BN_abs_is_word(const BIGNUM *a, const BN_ULONG w)
  860.   {
  861. >     return ((a->top == 1) && (a->d[0] == w)) || ((w == 0) && (a->top == 0));
  862.   }
  863.   

crypto/bn/bn_lib.c:861:5: 
  859.   int BN_abs_is_word(const BIGNUM *a, const BN_ULONG w)
  860.   {
  861. >     return ((a->top == 1) && (a->d[0] == w)) || ((w == 0) && (a->top == 0));
  862.   }
  863.   

crypto/bn/bn_lib.c:862:1: return from a call to BN_abs_is_word
  860.   {
  861.       return ((a->top == 1) && (a->d[0] == w)) || ((w == 0) && (a->top == 0));
  862. > }
  863.   
  864.   int BN_is_zero(const BIGNUM *a)

test/testutil/tests.c:409:22: Taking false branch
407.       BIGNUM *bw, *aa;
408.   
409.       if (a != NULL && BN_abs_is_word(a, w))
                            ^
410.           return 1;
411.       bw = BN_new();

test/testutil/tests.c:411:5: Skipping BN_new(): empty list of specs
409.       if (a != NULL && BN_abs_is_word(a, w))
410.           return 1;
411.       bw = BN_new();
           ^
412.       aa = BN_dup(a);
413.       BN_set_negative(aa, 0);

test/testutil/tests.c:412:5: 
410.           return 1;
411.       bw = BN_new();
412. >     aa = BN_dup(a);
413.       BN_set_negative(aa, 0);
414.       BN_set_word(bw, w);

crypto/bn/bn_lib.c:262:1: start of procedure BN_dup()
  260.   }
  261.   
  262. > BIGNUM *BN_dup(const BIGNUM *a)
  263.   {
  264.       BIGNUM *t;

crypto/bn/bn_lib.c:266:9: Taking false branch
  264.       BIGNUM *t;
  265.   
  266.       if (a == NULL)
                 ^
  267.           return NULL;
  268.       bn_check_top(a);

crypto/bn/bn_lib.c:270:9: 
  268.       bn_check_top(a);
  269.   
  270. >     t = BN_get_flags(a, BN_FLG_SECURE) ? BN_secure_new() : BN_new();
  271.       if (t == NULL)
  272.           return NULL;

crypto/bn/bn_lib.c:930:1: start of procedure BN_get_flags()
    928.   }
    929.   
    930. > int BN_get_flags(const BIGNUM *b, int n)
    931.   {
    932.       return b->flags & n;

crypto/bn/bn_lib.c:932:5: 
    930.   int BN_get_flags(const BIGNUM *b, int n)
    931.   {
    932. >     return b->flags & n;
    933.   }
    934.   

crypto/bn/bn_lib.c:933:1: return from a call to BN_get_flags
    931.   {
    932.       return b->flags & n;
    933. > }
    934.   
    935.   /* Populate a BN_GENCB structure with an "old"-style callback */

crypto/bn/bn_lib.c:270:9: Condition is false
  268.       bn_check_top(a);
  269.   
  270.       t = BN_get_flags(a, BN_FLG_SECURE) ? BN_secure_new() : BN_new();
                 ^
  271.       if (t == NULL)
  272.           return NULL;

crypto/bn/bn_lib.c:270:5: 
  268.       bn_check_top(a);
  269.   
  270. >     t = BN_get_flags(a, BN_FLG_SECURE) ? BN_secure_new() : BN_new();
  271.       if (t == NULL)
  272.           return NULL;

crypto/bn/bn_lib.c:271:9: Taking false branch
  269.   
  270.       t = BN_get_flags(a, BN_FLG_SECURE) ? BN_secure_new() : BN_new();
  271.       if (t == NULL)
                 ^
  272.           return NULL;
  273.       if (!BN_copy(t, a)) {

crypto/bn/bn_lib.c:273:10: 
  271.       if (t == NULL)
  272.           return NULL;
  273. >     if (!BN_copy(t, a)) {
  274.           BN_free(t);
  275.           return NULL;

crypto/bn/bn_lib.c:281:1: start of procedure BN_copy()
    279.   }
    280.   
    281. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
    282.   {
    283.       bn_check_top(b);

crypto/bn/bn_lib.c:285:9: Taking false branch
    283.       bn_check_top(b);
    284.   
    285.       if (a == b)
                   ^
    286.           return a;
    287.       if (bn_wexpand(a, b->top) == NULL)

crypto/bn/bn_lib.c:287:9: 
    285.       if (a == b)
    286.           return a;
    287. >     if (bn_wexpand(a, b->top) == NULL)
    288.           return NULL;
    289.   

crypto/bn/bn_lib.c:960:1: start of procedure bn_wexpand()
      958.   }
      959.   
      960. > BIGNUM *bn_wexpand(BIGNUM *a, int words)
      961.   {
      962.       return (words <= a->dmax) ? a : bn_expand2(a, words);

crypto/bn/bn_lib.c:962:13: Condition is false
      960.   BIGNUM *bn_wexpand(BIGNUM *a, int words)
      961.   {
      962.       return (words <= a->dmax) ? a : bn_expand2(a, words);
                         ^
      963.   }
      964.   

crypto/bn/bn_lib.c:962:12: 
      960.   BIGNUM *bn_wexpand(BIGNUM *a, int words)
      961.   {
      962. >     return (words <= a->dmax) ? a : bn_expand2(a, words);
      963.   }
      964.   

crypto/bn/bn_lib.c:245:1: start of procedure bn_expand2()
        243.    */
        244.   
        245. > BIGNUM *bn_expand2(BIGNUM *b, int words)
        246.   {
        247.       if (words > b->dmax) {

crypto/bn/bn_lib.c:247:9: Taking true branch
        245.   BIGNUM *bn_expand2(BIGNUM *b, int words)
        246.   {
        247.       if (words > b->dmax) {
                       ^
        248.           BN_ULONG *a = bn_expand_internal(b, words);
        249.           if (!a)

crypto/bn/bn_lib.c:248:9: Skipping bn_expand_internal(): empty list of specs
        246.   {
        247.       if (words > b->dmax) {
        248.           BN_ULONG *a = bn_expand_internal(b, words);
                       ^
        249.           if (!a)
        250.               return NULL;

crypto/bn/bn_lib.c:249:14: Taking true branch
        247.       if (words > b->dmax) {
        248.           BN_ULONG *a = bn_expand_internal(b, words);
        249.           if (!a)
                            ^
        250.               return NULL;
        251.           if (b->d) {

crypto/bn/bn_lib.c:250:13: 
        248.           BN_ULONG *a = bn_expand_internal(b, words);
        249.           if (!a)
        250. >             return NULL;
        251.           if (b->d) {
        252.               OPENSSL_cleanse(b->d, b->dmax * sizeof(b->d[0]));

crypto/bn/bn_lib.c:260:1: return from a call to bn_expand2
        258.   
        259.       return b;
        260. > }
        261.   
        262.   BIGNUM *BN_dup(const BIGNUM *a)

crypto/bn/bn_lib.c:962:5: 
      960.   BIGNUM *bn_wexpand(BIGNUM *a, int words)
      961.   {
      962. >     return (words <= a->dmax) ? a : bn_expand2(a, words);
      963.   }
      964.   

crypto/bn/bn_lib.c:963:1: return from a call to bn_wexpand
      961.   {
      962.       return (words <= a->dmax) ? a : bn_expand2(a, words);
      963. > }
      964.   
      965.   void bn_correct_top(BIGNUM *a)

crypto/bn/bn_lib.c:287:9: Taking true branch
    285.       if (a == b)
    286.           return a;
    287.       if (bn_wexpand(a, b->top) == NULL)
                   ^
    288.           return NULL;
    289.   

crypto/bn/bn_lib.c:288:9: 
    286.           return a;
    287.       if (bn_wexpand(a, b->top) == NULL)
    288. >         return NULL;
    289.   
    290.       if (b->top > 0)

crypto/bn/bn_lib.c:298:1: return from a call to BN_copy
    296.       bn_check_top(a);
    297.       return a;
    298. > }
    299.   
    300.   #define FLAGS_DATA(flags) ((flags) & (BN_FLG_STATIC_DATA \

crypto/bn/bn_lib.c:273:10: Taking true branch
  271.       if (t == NULL)
  272.           return NULL;
  273.       if (!BN_copy(t, a)) {
                  ^
  274.           BN_free(t);
  275.           return NULL;

crypto/bn/bn_lib.c:274:9: Skipping BN_free(): empty list of specs
  272.           return NULL;
  273.       if (!BN_copy(t, a)) {
  274.           BN_free(t);
                 ^
  275.           return NULL;
  276.       }

crypto/bn/bn_lib.c:275:9: 
  273.       if (!BN_copy(t, a)) {
  274.           BN_free(t);
  275. >         return NULL;
  276.       }
  277.       bn_check_top(t);

crypto/bn/bn_lib.c:279:1: return from a call to BN_dup
  277.       bn_check_top(t);
  278.       return t;
  279. > }
  280.   
  281.   BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)

test/testutil/tests.c:413:5: 
411.       bw = BN_new();
412.       aa = BN_dup(a);
413. >     BN_set_negative(aa, 0);
414.       BN_set_word(bw, w);
415.       test_fail_bignum_message(NULL, file, line, "BIGNUM", bns, ws, "abs==",

crypto/bn/bn_lib.c:703:1: start of procedure BN_set_negative()
  701.   }
  702.   
  703. > void BN_set_negative(BIGNUM *a, int b)
  704.   {
  705.       if (b && !BN_is_zero(a))

crypto/bn/bn_lib.c:705:9: Taking false branch
  703.   void BN_set_negative(BIGNUM *a, int b)
  704.   {
  705.       if (b && !BN_is_zero(a))
                 ^
  706.           a->neg = 1;
  707.       else

crypto/bn/bn_lib.c:708:9: 
  706.           a->neg = 1;
  707.       else
  708. >         a->neg = 0;
  709.   }
  710.   

int test_BN_abs_eq_word(const char *file, int line, const char *bns,
                        const char *ws, const BIGNUM *a, BN_ULONG w)
{
    BIGNUM *bw, *aa;
    if (a != NULL && BN_abs_is_word(a, w))
        return 1;
    bw = BN_new();
    aa = BN_dup(a);
    BN_set_negative(aa, 0);
    BN_set_word(bw, w);
    test_fail_bignum_message(NULL, file, line, "BIGNUM", bns, ws, "abs==",
                             aa, bw);
    BN_free(bw);
    BN_free(aa);
    return 0;
}
['int test_BN_abs_eq_word(const char *file, int line, const char *bns,\n                        const char *ws, const BIGNUM *a, BN_ULONG w)\n{\n    BIGNUM *bw, *aa;\n    if (a != NULL && BN_abs_is_word(a, w))\n        return 1;\n    bw = BN_new();\n    aa = BN_dup(a);\n    BN_set_negative(aa, 0);\n    BN_set_word(bw, w);\n    test_fail_bignum_message(NULL, file, line, "BIGNUM", bns, ws, "abs==",\n                             aa, bw);\n    BN_free(bw);\n    BN_free(aa);\n    return 0;\n}', 'int BN_abs_is_word(const BIGNUM *a, const BN_ULONG w)\n{\n    return ((a->top == 1) && (a->d[0] == w)) || ((w == 0) && (a->top == 0));\n}', 'BIGNUM *BN_dup(const BIGNUM *a)\n{\n    BIGNUM *t;\n    if (a == NULL)\n        return NULL;\n    bn_check_top(a);\n    t = BN_get_flags(a, BN_FLG_SECURE) ? BN_secure_new() : BN_new();\n    if (t == NULL)\n        return NULL;\n    if (!BN_copy(t, a)) {\n        BN_free(t);\n        return NULL;\n    }\n    bn_check_top(t);\n    return t;\n}', 'int BN_get_flags(const BIGNUM *b, int n)\n{\n    return b->flags & n;\n}', 'BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)\n{\n    bn_check_top(b);\n    if (a == b)\n        return a;\n    if (bn_wexpand(a, b->top) == NULL)\n        return NULL;\n    if (b->top > 0)\n        memcpy(a->d, b->d, sizeof(b->d[0]) * b->top);\n    a->neg = b->neg;\n    a->top = b->top;\n    a->flags |= b->flags & BN_FLG_FIXED_TOP;\n    bn_check_top(a);\n    return a;\n}', 'BIGNUM *bn_wexpand(BIGNUM *a, int words)\n{\n    return (words <= a->dmax) ? a : bn_expand2(a, words);\n}', 'BIGNUM *bn_expand2(BIGNUM *b, int words)\n{\n    if (words > b->dmax) {\n        BN_ULONG *a = bn_expand_internal(b, words);\n        if (!a)\n            return NULL;\n        if (b->d) {\n            OPENSSL_cleanse(b->d, b->dmax * sizeof(b->d[0]));\n            bn_free_d(b);\n        }\n        b->d = a;\n        b->dmax = words;\n    }\n    return b;\n}', 'void BN_set_negative(BIGNUM *a, int b)\n{\n    if (b && !BN_is_zero(a))\n        a->neg = 1;\n    else\n        a->neg = 0;\n}']