crypto/ec/ec2_smpl.c:269: error: NULL_DEREFERENCE
  pointer `new_ctx` last assigned on line 239 could be null and is dereferenced by call to `BN_CTX_free()` at line 269, column 5.
Showing all 40 steps of the trace


crypto/ec/ec2_smpl.c:234:1: start of procedure ec_GF2m_simple_group_check_discriminant()
232.    * elliptic curve <=> b != 0 (mod p)
233.    */
234. > int ec_GF2m_simple_group_check_discriminant(const EC_GROUP *group,
235.                                               BN_CTX *ctx)
236.   {

crypto/ec/ec2_smpl.c:237:5: 
235.                                               BN_CTX *ctx)
236.   {
237. >     int ret = 0;
238.       BIGNUM *b;
239.       BN_CTX *new_ctx = NULL;

crypto/ec/ec2_smpl.c:239:5: 
237.       int ret = 0;
238.       BIGNUM *b;
239. >     BN_CTX *new_ctx = NULL;
240.   
241.       if (ctx == NULL) {

crypto/ec/ec2_smpl.c:241:9: Taking false branch
239.       BN_CTX *new_ctx = NULL;
240.   
241.       if (ctx == NULL) {
               ^
242.           ctx = new_ctx = BN_CTX_new();
243.           if (ctx == NULL) {

crypto/ec/ec2_smpl.c:249:5: 
247.           }
248.       }
249. >     BN_CTX_start(ctx);
250.       b = BN_CTX_get(ctx);
251.       if (b == NULL)

crypto/bn/bn_ctx.c:179:1: start of procedure BN_CTX_start()
  177.   }
  178.   
  179. > void BN_CTX_start(BN_CTX *ctx)
  180.   {
  181.       CTXDBG_ENTRY("BN_CTX_start", ctx);

crypto/bn/bn_ctx.c:183:9: Taking true branch
  181.       CTXDBG_ENTRY("BN_CTX_start", ctx);
  182.       /* If we're already overflowing ... */
  183.       if (ctx->err_stack || ctx->too_many)
                 ^
  184.           ctx->err_stack++;
  185.       /* (Try to) get a new frame pointer */

crypto/bn/bn_ctx.c:184:9: 
  182.       /* If we're already overflowing ... */
  183.       if (ctx->err_stack || ctx->too_many)
  184. >         ctx->err_stack++;
  185.       /* (Try to) get a new frame pointer */
  186.       else if (!BN_STACK_push(&ctx->stack, ctx->used)) {

crypto/bn/bn_ctx.c:183:5: 
  181.       CTXDBG_ENTRY("BN_CTX_start", ctx);
  182.       /* If we're already overflowing ... */
  183. >     if (ctx->err_stack || ctx->too_many)
  184.           ctx->err_stack++;
  185.       /* (Try to) get a new frame pointer */

crypto/bn/bn_ctx.c:191:1: return from a call to BN_CTX_start
  189.       }
  190.       CTXDBG_EXIT(ctx);
  191. > }
  192.   
  193.   void BN_CTX_end(BN_CTX *ctx)

crypto/ec/ec2_smpl.c:250:5: 
248.       }
249.       BN_CTX_start(ctx);
250. >     b = BN_CTX_get(ctx);
251.       if (b == NULL)
252.           goto err;

crypto/bn/bn_ctx.c:210:1: start of procedure BN_CTX_get()
  208.   }
  209.   
  210. > BIGNUM *BN_CTX_get(BN_CTX *ctx)
  211.   {
  212.       BIGNUM *ret;

crypto/bn/bn_ctx.c:215:9: Taking true branch
  213.   
  214.       CTXDBG_ENTRY("BN_CTX_get", ctx);
  215.       if (ctx->err_stack || ctx->too_many)
                 ^
  216.           return NULL;
  217.       if ((ret = BN_POOL_get(&ctx->pool, ctx->flags)) == NULL) {

crypto/bn/bn_ctx.c:216:9: 
  214.       CTXDBG_ENTRY("BN_CTX_get", ctx);
  215.       if (ctx->err_stack || ctx->too_many)
  216. >         return NULL;
  217.       if ((ret = BN_POOL_get(&ctx->pool, ctx->flags)) == NULL) {
  218.           /*

crypto/bn/bn_ctx.c:231:1: return from a call to BN_CTX_get
  229.       CTXDBG_RET(ctx, ret);
  230.       return ret;
  231. > }
  232.   
  233.   /************/

crypto/ec/ec2_smpl.c:251:9: Taking true branch
249.       BN_CTX_start(ctx);
250.       b = BN_CTX_get(ctx);
251.       if (b == NULL)
               ^
252.           goto err;
253.   

crypto/ec/ec2_smpl.c:266:2: 
264.       ret = 1;
265.   
266. >  err:
267.       if (ctx != NULL)
268.           BN_CTX_end(ctx);

crypto/ec/ec2_smpl.c:267:9: Taking true branch
265.   
266.    err:
267.       if (ctx != NULL)
               ^
268.           BN_CTX_end(ctx);
269.       BN_CTX_free(new_ctx);

crypto/ec/ec2_smpl.c:268:9: 
266.    err:
267.       if (ctx != NULL)
268. >         BN_CTX_end(ctx);
269.       BN_CTX_free(new_ctx);
270.       return ret;

crypto/bn/bn_ctx.c:193:1: start of procedure BN_CTX_end()
  191.   }
  192.   
  193. > void BN_CTX_end(BN_CTX *ctx)
  194.   {
  195.       CTXDBG_ENTRY("BN_CTX_end", ctx);

crypto/bn/bn_ctx.c:196:9: Taking true branch
  194.   {
  195.       CTXDBG_ENTRY("BN_CTX_end", ctx);
  196.       if (ctx->err_stack)
                 ^
  197.           ctx->err_stack--;
  198.       else {

crypto/bn/bn_ctx.c:197:9: 
  195.       CTXDBG_ENTRY("BN_CTX_end", ctx);
  196.       if (ctx->err_stack)
  197. >         ctx->err_stack--;
  198.       else {
  199.           unsigned int fp = BN_STACK_pop(&ctx->stack);

crypto/bn/bn_ctx.c:196:5: 
  194.   {
  195.       CTXDBG_ENTRY("BN_CTX_end", ctx);
  196. >     if (ctx->err_stack)
  197.           ctx->err_stack--;
  198.       else {

crypto/bn/bn_ctx.c:208:1: return from a call to BN_CTX_end
  206.       }
  207.       CTXDBG_EXIT(ctx);
  208. > }
  209.   
  210.   BIGNUM *BN_CTX_get(BN_CTX *ctx)

crypto/ec/ec2_smpl.c:269:5: 
267.       if (ctx != NULL)
268.           BN_CTX_end(ctx);
269. >     BN_CTX_free(new_ctx);
270.       return ret;
271.   }

crypto/bn/bn_ctx.c:157:1: start of procedure BN_CTX_free()
  155.   }
  156.   
  157. > void BN_CTX_free(BN_CTX *ctx)
  158.   {
  159.   #ifdef BN_CTX_DEBUG

crypto/bn/bn_ctx.c:174:5: 
  172.       }
  173.   #endif
  174. >     BN_STACK_finish(&ctx->stack);
  175.       BN_POOL_finish(&ctx->pool);
  176.       OPENSSL_free(ctx);

crypto/bn/bn_ctx.c:243:1: start of procedure BN_STACK_finish()
    241.   }
    242.   
    243. > static void BN_STACK_finish(BN_STACK *st)
    244.   {
    245.       OPENSSL_free(st->indexes);

crypto/bn/bn_ctx.c:245:5: 
    243.   static void BN_STACK_finish(BN_STACK *st)
    244.   {
    245. >     OPENSSL_free(st->indexes);
    246.       st->indexes = NULL;
    247.   }

crypto/mem.c:295:1: start of procedure CRYPTO_free()
      293.   }
      294.   
      295. > void CRYPTO_free(void *str, const char *file, int line)
      296.   {
      297.       INCREMENT(free_count);

crypto/mem.c:298:9: Taking true branch
      296.   {
      297.       INCREMENT(free_count);
      298.       if (free_impl != NULL && free_impl != &CRYPTO_free) {
                     ^
      299.           free_impl(str, file, line);
      300.           return;

crypto/mem.c:298:30: Taking true branch
      296.   {
      297.       INCREMENT(free_count);
      298.       if (free_impl != NULL && free_impl != &CRYPTO_free) {
                                          ^
      299.           free_impl(str, file, line);
      300.           return;

crypto/mem.c:299:9: Skipping __function_pointer__(): unresolved function pointer
      297.       INCREMENT(free_count);
      298.       if (free_impl != NULL && free_impl != &CRYPTO_free) {
      299.           free_impl(str, file, line);
                     ^
      300.           return;
      301.       }

crypto/mem.c:300:9: 
      298.       if (free_impl != NULL && free_impl != &CRYPTO_free) {
      299.           free_impl(str, file, line);
      300. >         return;
      301.       }
      302.   

crypto/mem.c:314:1: return from a call to CRYPTO_free
      312.       free(str);
      313.   #endif
      314. > }
      315.   
      316.   void CRYPTO_clear_free(void *str, size_t num, const char *file, int line)

crypto/bn/bn_ctx.c:246:5: 
    244.   {
    245.       OPENSSL_free(st->indexes);
    246. >     st->indexes = NULL;
    247.   }
    248.   

crypto/bn/bn_ctx.c:247:1: return from a call to BN_STACK_finish
    245.       OPENSSL_free(st->indexes);
    246.       st->indexes = NULL;
    247. > }
    248.   
    249.   

crypto/bn/bn_ctx.c:175:5: 
  173.   #endif
  174.       BN_STACK_finish(&ctx->stack);
  175. >     BN_POOL_finish(&ctx->pool);
  176.       OPENSSL_free(ctx);
  177.   }

crypto/bn/bn_ctx.c:284:1: start of procedure BN_POOL_finish()
    282.   }
    283.   
    284. > static void BN_POOL_finish(BN_POOL *p)
    285.   {
    286.       unsigned int loop;

crypto/bn/bn_ctx.c:289:12: Loop condition is false. Leaving loop
    287.       BIGNUM *bn;
    288.   
    289.       while (p->head) {
                      ^
    290.           for (loop = 0, bn = p->head->vals; loop++ < BN_CTX_POOL_SIZE; bn++)
    291.               if (bn->d)
