crypto/asn1/a_int.c:270: error: NULL_DEREFERENCE
  pointer `null` is dereferenced by call to `c2i_ibuf()` at line 270, column 9.
Showing all 23 steps of the trace


crypto/asn1/a_int.c:263:1: start of procedure c2i_ASN1_INTEGER()
261.   
262.   /* Convert ASN1 INTEGER content octets to ASN1_INTEGER structure */
263. > ASN1_INTEGER *c2i_ASN1_INTEGER(ASN1_INTEGER **a, const unsigned char **pp,
264.                                  long len)
265.   {

crypto/asn1/a_int.c:266:5: 
264.                                  long len)
265.   {
266. >     ASN1_INTEGER *ret = NULL;
267.       size_t r;
268.       int neg;

crypto/asn1/a_int.c:270:5: 
268.       int neg;
269.   
270. >     r = c2i_ibuf(NULL, NULL, *pp, len);
271.   
272.       if (r == 0)

crypto/asn1/a_int.c:148:1: start of procedure c2i_ibuf()
  146.    */
  147.   
  148. > static size_t c2i_ibuf(unsigned char *b, int *pneg,
  149.                          const unsigned char *p, size_t plen)
  150.   {

crypto/asn1/a_int.c:153:9: Taking false branch
  151.       int neg, pad;
  152.       /* Zero content length is illegal */
  153.       if (plen == 0) {
                 ^
  154.           ASN1err(ASN1_F_C2I_IBUF, ASN1_R_ILLEGAL_ZERO_CONTENT);
  155.           return 0;

crypto/asn1/a_int.c:157:5: 
  155.           return 0;
  156.       }
  157. >     neg = p[0] & 0x80;
  158.       if (pneg)
  159.           *pneg = neg;

crypto/asn1/a_int.c:158:9: Taking false branch
  156.       }
  157.       neg = p[0] & 0x80;
  158.       if (pneg)
                 ^
  159.           *pneg = neg;
  160.       /* Handle common case where length is 1 octet separately */

crypto/asn1/a_int.c:161:9: Taking false branch
  159.           *pneg = neg;
  160.       /* Handle common case where length is 1 octet separately */
  161.       if (plen == 1) {
                 ^
  162.           if (b != NULL) {
  163.               if (neg)

crypto/asn1/a_int.c:170:9: Taking false branch
  168.           return 1;
  169.       }
  170.       if (p[0] == 0 || p[0] == 0xFF)
                 ^
  171.           pad = 1;
  172.       else

crypto/asn1/a_int.c:170:22: Taking false branch
  168.           return 1;
  169.       }
  170.       if (p[0] == 0 || p[0] == 0xFF)
                              ^
  171.           pad = 1;
  172.       else

crypto/asn1/a_int.c:173:9: 
  171.           pad = 1;
  172.       else
  173. >         pad = 0;
  174.       /* reject illegal padding: first two octets MSB can't match */
  175.       if (pad && (neg == (p[1] & 0x80))) {

crypto/asn1/a_int.c:175:9: Taking false branch
  173.           pad = 0;
  174.       /* reject illegal padding: first two octets MSB can't match */
  175.       if (pad && (neg == (p[1] & 0x80))) {
                 ^
  176.           ASN1err(ASN1_F_C2I_IBUF, ASN1_R_ILLEGAL_PADDING);
  177.           return 0;

crypto/asn1/a_int.c:181:5: 
  179.   
  180.       /* skip over pad */
  181. >     p += pad;
  182.       plen -= pad;
  183.   

crypto/asn1/a_int.c:182:5: 
  180.       /* skip over pad */
  181.       p += pad;
  182. >     plen -= pad;
  183.   
  184.       if (b != NULL)

crypto/asn1/a_int.c:184:9: Taking true branch
  182.       plen -= pad;
  183.   
  184.       if (b != NULL)
                 ^
  185.           twos_complement(b, p, plen, neg ? 0xffU : 0);
  186.   

crypto/asn1/a_int.c:185:37: Condition is true
  183.   
  184.       if (b != NULL)
  185.           twos_complement(b, p, plen, neg ? 0xffU : 0);
                                             ^
  186.   
  187.       return plen;

crypto/asn1/a_int.c:185:9: 
  183.   
  184.       if (b != NULL)
  185. >         twos_complement(b, p, plen, neg ? 0xffU : 0);
  186.   
  187.       return plen;

crypto/asn1/a_int.c:76:1: start of procedure twos_complement()
    74.    * used elsewhere below...
    75.    */
    76. > static void twos_complement(unsigned char *dst, const unsigned char *src,
    77.                               size_t len, unsigned char pad)
    78.   {

crypto/asn1/a_int.c:79:5: 
    77.                               size_t len, unsigned char pad)
    78.   {
    79. >     unsigned int carry = pad & 1;
    80.   
    81.       /* Begin at the end of the encoding */

crypto/asn1/a_int.c:82:5: 
    80.   
    81.       /* Begin at the end of the encoding */
    82. >     dst += len;
    83.       src += len;
    84.       /* two's complement value: ~value + 1 */

crypto/asn1/a_int.c:83:5: 
    81.       /* Begin at the end of the encoding */
    82.       dst += len;
    83. >     src += len;
    84.       /* two's complement value: ~value + 1 */
    85.       while (len-- != 0) {

crypto/asn1/a_int.c:85:12: Loop condition is true. Entering loop body
    83.       src += len;
    84.       /* two's complement value: ~value + 1 */
    85.       while (len-- != 0) {
                     ^
    86.           *(--dst) = (unsigned char)(carry += *(--src) ^ pad);
    87.           carry >>= 8;

crypto/asn1/a_int.c:86:9: 
    84.       /* two's complement value: ~value + 1 */
    85.       while (len-- != 0) {
    86. >         *(--dst) = (unsigned char)(carry += *(--src) ^ pad);
    87.           carry >>= 8;
    88.       }

ASN1_INTEGER *c2i_ASN1_INTEGER(ASN1_INTEGER **a, const unsigned char **pp,
                               long len)
{
    ASN1_INTEGER *ret = NULL;
    size_t r;
    int neg;
    r = c2i_ibuf(NULL, NULL, *pp, len);
    if (r == 0)
        return NULL;
    if ((a == NULL) || ((*a) == NULL)) {
        ret = ASN1_INTEGER_new();
        if (ret == NULL)
            return NULL;
        ret->type = V_ASN1_INTEGER;
    } else
        ret = *a;
    if (ASN1_STRING_set(ret, NULL, r) == 0)
        goto err;
    c2i_ibuf(ret->data, &neg, *pp, len);
    if (neg)
        ret->type |= V_ASN1_NEG;
    *pp += len;
    if (a != NULL)
        (*a) = ret;
    return ret;
 err:
    ASN1err(ASN1_F_C2I_ASN1_INTEGER, ERR_R_MALLOC_FAILURE);
    if ((a == NULL) || (*a != ret))
        ASN1_INTEGER_free(ret);
    return NULL;
}
['ASN1_INTEGER *c2i_ASN1_INTEGER(ASN1_INTEGER **a, const unsigned char **pp,\n                               long len)\n{\n    ASN1_INTEGER *ret = NULL;\n    size_t r;\n    int neg;\n    r = c2i_ibuf(NULL, NULL, *pp, len);\n    if (r == 0)\n        return NULL;\n    if ((a == NULL) || ((*a) == NULL)) {\n        ret = ASN1_INTEGER_new();\n        if (ret == NULL)\n            return NULL;\n        ret->type = V_ASN1_INTEGER;\n    } else\n        ret = *a;\n    if (ASN1_STRING_set(ret, NULL, r) == 0)\n        goto err;\n    c2i_ibuf(ret->data, &neg, *pp, len);\n    if (neg)\n        ret->type |= V_ASN1_NEG;\n    *pp += len;\n    if (a != NULL)\n        (*a) = ret;\n    return ret;\n err:\n    ASN1err(ASN1_F_C2I_ASN1_INTEGER, ERR_R_MALLOC_FAILURE);\n    if ((a == NULL) || (*a != ret))\n        ASN1_INTEGER_free(ret);\n    return NULL;\n}', 'static size_t c2i_ibuf(unsigned char *b, int *pneg,\n                       const unsigned char *p, size_t plen)\n{\n    int neg, pad;\n    if (plen == 0) {\n        ASN1err(ASN1_F_C2I_IBUF, ASN1_R_ILLEGAL_ZERO_CONTENT);\n        return 0;\n    }\n    neg = p[0] & 0x80;\n    if (pneg)\n        *pneg = neg;\n    if (plen == 1) {\n        if (b != NULL) {\n            if (neg)\n                b[0] = (p[0] ^ 0xFF) + 1;\n            else\n                b[0] = p[0];\n        }\n        return 1;\n    }\n    if (p[0] == 0 || p[0] == 0xFF)\n        pad = 1;\n    else\n        pad = 0;\n    if (pad && (neg == (p[1] & 0x80))) {\n        ASN1err(ASN1_F_C2I_IBUF, ASN1_R_ILLEGAL_PADDING);\n        return 0;\n    }\n    p += pad;\n    plen -= pad;\n    if (b != NULL)\n        twos_complement(b, p, plen, neg ? 0xffU : 0);\n    return plen;\n}', 'static void twos_complement(unsigned char *dst, const unsigned char *src,\n                            size_t len, unsigned char pad)\n{\n    unsigned int carry = pad & 1;\n    dst += len;\n    src += len;\n    while (len-- != 0) {\n        *(--dst) = (unsigned char)(carry += *(--src) ^ pad);\n        carry >>= 8;\n    }\n}']