crypto/jpake/jpake.c:156: error: NULL_DEREFERENCE
  pointer `bin` last assigned on line 153 could be null and is dereferenced by call to `BN_bn2bin()` at line 156, column 5.
Showing all 39 steps of the trace


crypto/jpake/jpake.c:150:1: start of procedure hashbn()
148.       }
149.   
150. > static void hashbn(SHA_CTX *sha, const BIGNUM *bn)
151.       {
152.       size_t l = BN_num_bytes(bn);

crypto/jpake/jpake.c:152:5: 
150.   static void hashbn(SHA_CTX *sha, const BIGNUM *bn)
151.       {
152. >     size_t l = BN_num_bytes(bn);
153.       unsigned char *bin = OPENSSL_malloc(l);
154.   

crypto/bn/bn_lib.c:248:1: start of procedure BN_num_bits()
  246.   	}
  247.   
  248. > int BN_num_bits(const BIGNUM *a)
  249.   	{
  250.   	int i = a->top - 1;

crypto/bn/bn_lib.c:250:2: 
  248.   int BN_num_bits(const BIGNUM *a)
  249.   	{
  250. > 	int i = a->top - 1;
  251.   	bn_check_top(a);
  252.   

crypto/bn/bn_lib.c:253:6: Taking false branch
  251.   	bn_check_top(a);
  252.   
  253.   	if (BN_is_zero(a)) return 0;
              ^
  254.   	return ((i*BN_BITS2) + BN_num_bits_word(a->d[i]));
  255.   	}

crypto/bn/bn_lib.c:254:2: Skipping BN_num_bits_word(): empty list of specs
  252.   
  253.   	if (BN_is_zero(a)) return 0;
  254.   	return ((i*BN_BITS2) + BN_num_bits_word(a->d[i]));
          ^
  255.   	}
  256.   

crypto/bn/bn_lib.c:255:2: return from a call to BN_num_bits
  253.   	if (BN_is_zero(a)) return 0;
  254.   	return ((i*BN_BITS2) + BN_num_bits_word(a->d[i]));
  255.   	}
          ^
  256.   
  257.   void BN_clear_free(BIGNUM *a)

crypto/jpake/jpake.c:153:5: 
151.       {
152.       size_t l = BN_num_bytes(bn);
153. >     unsigned char *bin = OPENSSL_malloc(l);
154.   
155.       hashlength(sha, l);

crypto/mem.c:294:1: start of procedure CRYPTO_malloc()
  292.   	}
  293.   
  294. > void *CRYPTO_malloc(int num, const char *file, int line)
  295.   	{
  296.   	void *ret = NULL;

crypto/mem.c:296:2: 
  294.   void *CRYPTO_malloc(int num, const char *file, int line)
  295.   	{
  296. > 	void *ret = NULL;
  297.   
  298.   	if (num <= 0) return NULL;

crypto/mem.c:298:6: Taking false branch
  296.   	void *ret = NULL;
  297.   
  298.   	if (num <= 0) return NULL;
              ^
  299.   
  300.   	allow_customize = 0;

crypto/mem.c:300:2: 
  298.   	if (num <= 0) return NULL;
  299.   
  300. > 	allow_customize = 0;
  301.   	if (malloc_debug_func != NULL)
  302.   		{

crypto/mem.c:301:6: Taking true branch
  299.   
  300.   	allow_customize = 0;
  301.   	if (malloc_debug_func != NULL)
              ^
  302.   		{
  303.   		allow_customize_debug = 0;

crypto/mem.c:303:3: 
  301.   	if (malloc_debug_func != NULL)
  302.   		{
  303. > 		allow_customize_debug = 0;
  304.   		malloc_debug_func(NULL, num, file, line, 0);
  305.   		}

crypto/mem.c:304:3: Skipping __function_pointer__(): unresolved function pointer
  302.   		{
  303.   		allow_customize_debug = 0;
  304.   		malloc_debug_func(NULL, num, file, line, 0);
           ^
  305.   		}
  306.   	ret = malloc_ex_func(num,file,line);

crypto/mem.c:306:2: Skipping __function_pointer__(): unresolved function pointer
  304.   		malloc_debug_func(NULL, num, file, line, 0);
  305.   		}
  306.   	ret = malloc_ex_func(num,file,line);
          ^
  307.   #ifdef LEVITTE_DEBUG_MEM
  308.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);

crypto/mem.c:310:6: Taking true branch
  308.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);
  309.   #endif
  310.   	if (malloc_debug_func != NULL)
              ^
  311.   		malloc_debug_func(ret, num, file, line, 1);
  312.   

crypto/mem.c:311:3: Skipping __function_pointer__(): unresolved function pointer
  309.   #endif
  310.   	if (malloc_debug_func != NULL)
  311.   		malloc_debug_func(ret, num, file, line, 1);
           ^
  312.   
  313.   #ifndef OPENSSL_CPUID_OBJ

crypto/mem.c:317:12: Taking false branch
  315.            * sanitisation function can't be optimised out. NB: We only do
  316.            * this for >2Kb so the overhead doesn't bother us. */
  317.           if(ret && (num > 2048))
                    ^
  318.   	{	extern unsigned char cleanse_ctr;
  319.                   ((unsigned char *)ret)[0] = cleanse_ctr;

crypto/mem.c:323:2: 
  321.   #endif
  322.   
  323. > 	return ret;
  324.   	}
  325.   char *CRYPTO_strdup(const char *str, const char *file, int line)

crypto/mem.c:324:2: return from a call to CRYPTO_malloc
  322.   
  323.   	return ret;
  324.   	}
          ^
  325.   char *CRYPTO_strdup(const char *str, const char *file, int line)
  326.   	{

crypto/jpake/jpake.c:155:5: 
153.       unsigned char *bin = OPENSSL_malloc(l);
154.   
155. >     hashlength(sha, l);
156.       BN_bn2bin(bn, bin);
157.       SHA1_Update(sha, bin, l);

crypto/jpake/jpake.c:132:1: start of procedure hashlength()
  130.       }
  131.   
  132. > static void hashlength(SHA_CTX *sha, size_t l)
  133.       {
  134.       unsigned char b[2];

crypto/jpake/jpake.c:136:5: Condition is true
  134.       unsigned char b[2];
  135.   
  136.       OPENSSL_assert(l <= 0xffff);
             ^
  137.       b[0] = l >> 8;
  138.       b[1] = l&0xff;

crypto/jpake/jpake.c:137:5: 
  135.   
  136.       OPENSSL_assert(l <= 0xffff);
  137. >     b[0] = l >> 8;
  138.       b[1] = l&0xff;
  139.       SHA1_Update(sha, b, 2);

crypto/jpake/jpake.c:138:5: 
  136.       OPENSSL_assert(l <= 0xffff);
  137.       b[0] = l >> 8;
  138. >     b[1] = l&0xff;
  139.       SHA1_Update(sha, b, 2);
  140.       }

crypto/jpake/jpake.c:139:5: Skipping SHA1_Update(): method has no implementation
  137.       b[0] = l >> 8;
  138.       b[1] = l&0xff;
  139.       SHA1_Update(sha, b, 2);
             ^
  140.       }
  141.   

crypto/jpake/jpake.c:140:5: return from a call to hashlength
  138.       b[1] = l&0xff;
  139.       SHA1_Update(sha, b, 2);
  140.       }
             ^
  141.   
  142.   static void hashstring(SHA_CTX *sha, const char *string)

crypto/jpake/jpake.c:156:5: 
154.   
155.       hashlength(sha, l);
156. >     BN_bn2bin(bn, bin);
157.       SHA1_Update(sha, bin, l);
158.       OPENSSL_free(bin);

crypto/bn/bn_lib.c:641:1: start of procedure BN_bn2bin()
  639.   
  640.   /* ignore negative */
  641. > int BN_bn2bin(const BIGNUM *a, unsigned char *to)
  642.   	{
  643.   	int n,i;

crypto/bn/bn_lib.c:647:2: 
  645.   
  646.   	bn_check_top(a);
  647. > 	n=i=BN_num_bytes(a);
  648.   	while (i--)
  649.   		{

crypto/bn/bn_lib.c:248:1: start of procedure BN_num_bits()
    246.   	}
    247.   
    248. > int BN_num_bits(const BIGNUM *a)
    249.   	{
    250.   	int i = a->top - 1;

crypto/bn/bn_lib.c:250:2: 
    248.   int BN_num_bits(const BIGNUM *a)
    249.   	{
    250. > 	int i = a->top - 1;
    251.   	bn_check_top(a);
    252.   

crypto/bn/bn_lib.c:253:6: Taking false branch
    251.   	bn_check_top(a);
    252.   
    253.   	if (BN_is_zero(a)) return 0;
                ^
    254.   	return ((i*BN_BITS2) + BN_num_bits_word(a->d[i]));
    255.   	}

crypto/bn/bn_lib.c:254:2: Skipping BN_num_bits_word(): empty list of specs
    252.   
    253.   	if (BN_is_zero(a)) return 0;
    254.   	return ((i*BN_BITS2) + BN_num_bits_word(a->d[i]));
            ^
    255.   	}
    256.   

crypto/bn/bn_lib.c:255:2: return from a call to BN_num_bits
    253.   	if (BN_is_zero(a)) return 0;
    254.   	return ((i*BN_BITS2) + BN_num_bits_word(a->d[i]));
    255.   	}
            ^
    256.   
    257.   void BN_clear_free(BIGNUM *a)

crypto/bn/bn_lib.c:648:9: Loop condition is true. Entering loop body
  646.   	bn_check_top(a);
  647.   	n=i=BN_num_bytes(a);
  648.   	while (i--)
                 ^
  649.   		{
  650.   		l=a->d[i/BN_BYTES];

crypto/bn/bn_lib.c:650:3: 
  648.   	while (i--)
  649.   		{
  650. > 		l=a->d[i/BN_BYTES];
  651.   		*(to++)=(unsigned char)(l>>(8*(i%BN_BYTES)))&0xff;
  652.   		}

crypto/bn/bn_lib.c:651:3: 
  649.   		{
  650.   		l=a->d[i/BN_BYTES];
  651. > 		*(to++)=(unsigned char)(l>>(8*(i%BN_BYTES)))&0xff;
  652.   		}
  653.   	return(n);
