crypto/sm2/sm2_sign.c:222: error: NULL_DEREFERENCE
  pointer `ctx` last assigned on line 165 could be null and is dereferenced by call to `BN_CTX_free()` at line 222, column 5.
Showing all 40 steps of the trace


crypto/sm2/sm2_sign.c:151:1: start of procedure SM2_sig_verify()
149.   }
150.   
151. > static
152.   int SM2_sig_verify(const EC_KEY *key, const ECDSA_SIG *sig, const BIGNUM *e)
153.   {

crypto/sm2/sm2_sign.c:154:5: 
152.   int SM2_sig_verify(const EC_KEY *key, const ECDSA_SIG *sig, const BIGNUM *e)
153.   {
154. >     int ret = 0;
155.       const EC_GROUP *group = EC_KEY_get0_group(key);
156.       const BIGNUM *order = EC_GROUP_get0_order(group);

crypto/sm2/sm2_sign.c:155:5: 
153.   {
154.       int ret = 0;
155. >     const EC_GROUP *group = EC_KEY_get0_group(key);
156.       const BIGNUM *order = EC_GROUP_get0_order(group);
157.       BN_CTX *ctx = NULL;

crypto/ec/ec_key.c:419:1: start of procedure EC_KEY_get0_group()
  417.   }
  418.   
  419. > const EC_GROUP *EC_KEY_get0_group(const EC_KEY *key)
  420.   {
  421.       return key->group;

crypto/ec/ec_key.c:421:5: 
  419.   const EC_GROUP *EC_KEY_get0_group(const EC_KEY *key)
  420.   {
  421. >     return key->group;
  422.   }
  423.   

crypto/ec/ec_key.c:422:1: return from a call to EC_KEY_get0_group
  420.   {
  421.       return key->group;
  422. > }
  423.   
  424.   int EC_KEY_set_group(EC_KEY *key, const EC_GROUP *group)

crypto/sm2/sm2_sign.c:156:5: 
154.       int ret = 0;
155.       const EC_GROUP *group = EC_KEY_get0_group(key);
156. >     const BIGNUM *order = EC_GROUP_get0_order(group);
157.       BN_CTX *ctx = NULL;
158.       EC_POINT *pt = NULL;

crypto/ec/ec_lib.c:328:1: start of procedure EC_GROUP_get0_order()
  326.   }
  327.   
  328. > const BIGNUM *EC_GROUP_get0_order(const EC_GROUP *group)
  329.   {
  330.       return group->order;

crypto/ec/ec_lib.c:330:5: 
  328.   const BIGNUM *EC_GROUP_get0_order(const EC_GROUP *group)
  329.   {
  330. >     return group->order;
  331.   }
  332.   

crypto/ec/ec_lib.c:331:1: return from a call to EC_GROUP_get0_order
  329.   {
  330.       return group->order;
  331. > }
  332.   
  333.   int EC_GROUP_order_bits(const EC_GROUP *group)

crypto/sm2/sm2_sign.c:157:5: 
155.       const EC_GROUP *group = EC_KEY_get0_group(key);
156.       const BIGNUM *order = EC_GROUP_get0_order(group);
157. >     BN_CTX *ctx = NULL;
158.       EC_POINT *pt = NULL;
159.   

crypto/sm2/sm2_sign.c:158:5: 
156.       const BIGNUM *order = EC_GROUP_get0_order(group);
157.       BN_CTX *ctx = NULL;
158. >     EC_POINT *pt = NULL;
159.   
160.       BIGNUM *t = NULL;

crypto/sm2/sm2_sign.c:160:5: 
158.       EC_POINT *pt = NULL;
159.   
160. >     BIGNUM *t = NULL;
161.       BIGNUM *x1 = NULL;
162.       const BIGNUM *r = NULL;

crypto/sm2/sm2_sign.c:161:5: 
159.   
160.       BIGNUM *t = NULL;
161. >     BIGNUM *x1 = NULL;
162.       const BIGNUM *r = NULL;
163.       const BIGNUM *s = NULL;

crypto/sm2/sm2_sign.c:162:5: 
160.       BIGNUM *t = NULL;
161.       BIGNUM *x1 = NULL;
162. >     const BIGNUM *r = NULL;
163.       const BIGNUM *s = NULL;
164.   

crypto/sm2/sm2_sign.c:163:5: 
161.       BIGNUM *x1 = NULL;
162.       const BIGNUM *r = NULL;
163. >     const BIGNUM *s = NULL;
164.   
165.       ctx = BN_CTX_new();

crypto/sm2/sm2_sign.c:165:5: Skipping BN_CTX_new(): empty list of specs
163.       const BIGNUM *s = NULL;
164.   
165.       ctx = BN_CTX_new();
           ^
166.       if (ctx == NULL)
167.           goto done;

crypto/sm2/sm2_sign.c:166:9: Taking true branch
164.   
165.       ctx = BN_CTX_new();
166.       if (ctx == NULL)
               ^
167.           goto done;
168.       pt = EC_POINT_new(group);

crypto/sm2/sm2_sign.c:220:2: 
218.           ret = 1;
219.   
220. >  done:
221.       EC_POINT_free(pt);
222.       BN_CTX_free(ctx);

crypto/sm2/sm2_sign.c:221:5: 
219.   
220.    done:
221. >     EC_POINT_free(pt);
222.       BN_CTX_free(ctx);
223.       return ret;

crypto/ec/ec_lib.c:581:1: start of procedure EC_POINT_free()
  579.   }
  580.   
  581. > void EC_POINT_free(EC_POINT *point)
  582.   {
  583.       if (!point)

crypto/ec/ec_lib.c:583:10: Taking true branch
  581.   void EC_POINT_free(EC_POINT *point)
  582.   {
  583.       if (!point)
                  ^
  584.           return;
  585.   

crypto/ec/ec_lib.c:584:9: 
  582.   {
  583.       if (!point)
  584. >         return;
  585.   
  586.       if (point->meth->point_finish != 0)

crypto/ec/ec_lib.c:589:1: return from a call to EC_POINT_free
  587.           point->meth->point_finish(point);
  588.       OPENSSL_free(point);
  589. > }
  590.   
  591.   void EC_POINT_clear_free(EC_POINT *point)

crypto/sm2/sm2_sign.c:222:5: 
220.    done:
221.       EC_POINT_free(pt);
222. >     BN_CTX_free(ctx);
223.       return ret;
224.   }

crypto/bn/bn_ctx.c:157:1: start of procedure BN_CTX_free()
  155.   }
  156.   
  157. > void BN_CTX_free(BN_CTX *ctx)
  158.   {
  159.   #ifdef BN_CTX_DEBUG

crypto/bn/bn_ctx.c:174:5: 
  172.       }
  173.   #endif
  174. >     BN_STACK_finish(&ctx->stack);
  175.       BN_POOL_finish(&ctx->pool);
  176.       OPENSSL_free(ctx);

crypto/bn/bn_ctx.c:243:1: start of procedure BN_STACK_finish()
    241.   }
    242.   
    243. > static void BN_STACK_finish(BN_STACK *st)
    244.   {
    245.       OPENSSL_free(st->indexes);

crypto/bn/bn_ctx.c:245:5: 
    243.   static void BN_STACK_finish(BN_STACK *st)
    244.   {
    245. >     OPENSSL_free(st->indexes);
    246.       st->indexes = NULL;
    247.   }

crypto/mem.c:295:1: start of procedure CRYPTO_free()
      293.   }
      294.   
      295. > void CRYPTO_free(void *str, const char *file, int line)
      296.   {
      297.       INCREMENT(free_count);

crypto/mem.c:298:9: Taking true branch
      296.   {
      297.       INCREMENT(free_count);
      298.       if (free_impl != NULL && free_impl != &CRYPTO_free) {
                     ^
      299.           free_impl(str, file, line);
      300.           return;

crypto/mem.c:298:30: Taking true branch
      296.   {
      297.       INCREMENT(free_count);
      298.       if (free_impl != NULL && free_impl != &CRYPTO_free) {
                                          ^
      299.           free_impl(str, file, line);
      300.           return;

crypto/mem.c:299:9: Skipping __function_pointer__(): unresolved function pointer
      297.       INCREMENT(free_count);
      298.       if (free_impl != NULL && free_impl != &CRYPTO_free) {
      299.           free_impl(str, file, line);
                     ^
      300.           return;
      301.       }

crypto/mem.c:300:9: 
      298.       if (free_impl != NULL && free_impl != &CRYPTO_free) {
      299.           free_impl(str, file, line);
      300. >         return;
      301.       }
      302.   

crypto/mem.c:314:1: return from a call to CRYPTO_free
      312.       free(str);
      313.   #endif
      314. > }
      315.   
      316.   void CRYPTO_clear_free(void *str, size_t num, const char *file, int line)

crypto/bn/bn_ctx.c:246:5: 
    244.   {
    245.       OPENSSL_free(st->indexes);
    246. >     st->indexes = NULL;
    247.   }
    248.   

crypto/bn/bn_ctx.c:247:1: return from a call to BN_STACK_finish
    245.       OPENSSL_free(st->indexes);
    246.       st->indexes = NULL;
    247. > }
    248.   
    249.   

crypto/bn/bn_ctx.c:175:5: 
  173.   #endif
  174.       BN_STACK_finish(&ctx->stack);
  175. >     BN_POOL_finish(&ctx->pool);
  176.       OPENSSL_free(ctx);
  177.   }

crypto/bn/bn_ctx.c:284:1: start of procedure BN_POOL_finish()
    282.   }
    283.   
    284. > static void BN_POOL_finish(BN_POOL *p)
    285.   {
    286.       unsigned int loop;

crypto/bn/bn_ctx.c:289:12: Loop condition is false. Leaving loop
    287.       BIGNUM *bn;
    288.   
    289.       while (p->head) {
                      ^
    290.           for (loop = 0, bn = p->head->vals; loop++ < BN_CTX_POOL_SIZE; bn++)
    291.               if (bn->d)
