crypto/ec/ec_check.c:69: error: NULL_DEREFERENCE
  pointer `new_ctx` last assigned on line 17 could be null and is dereferenced by call to `BN_CTX_free()` at line 69, column 5.
Showing all 39 steps of the trace


crypto/ec/ec_check.c:13:1: start of procedure EC_GROUP_check()
11.   #include <openssl/err.h>
12.   
13. > int EC_GROUP_check(const EC_GROUP *group, BN_CTX *ctx)
14.   {
15.       int ret = 0;

crypto/ec/ec_check.c:15:5: 
13.   int EC_GROUP_check(const EC_GROUP *group, BN_CTX *ctx)
14.   {
15. >     int ret = 0;
16.       const BIGNUM *order;
17.       BN_CTX *new_ctx = NULL;

crypto/ec/ec_check.c:17:5: 
15.       int ret = 0;
16.       const BIGNUM *order;
17. >     BN_CTX *new_ctx = NULL;
18.       EC_POINT *point = NULL;
19.   

crypto/ec/ec_check.c:18:5: 
16.       const BIGNUM *order;
17.       BN_CTX *new_ctx = NULL;
18. >     EC_POINT *point = NULL;
19.   
20.       /* Custom curves assumed to be correct */

crypto/ec/ec_check.c:21:9: Taking false branch
19.   
20.       /* Custom curves assumed to be correct */
21.       if ((group->meth->flags & EC_FLAGS_CUSTOM_CURVE) != 0)
              ^
22.           return 1;
23.   

crypto/ec/ec_check.c:24:9: Taking false branch
22.           return 1;
23.   
24.       if (ctx == NULL) {
              ^
25.           ctx = new_ctx = BN_CTX_new();
26.           if (ctx == NULL) {

crypto/ec/ec_check.c:33:10: 
31.   
32.       /* check the discriminant */
33. >     if (!EC_GROUP_check_discriminant(group, ctx)) {
34.           ECerr(EC_F_EC_GROUP_CHECK, EC_R_DISCRIMINANT_IS_ZERO);
35.           goto err;

crypto/ec/ec_lib.c:467:1: start of procedure EC_GROUP_check_discriminant()
  465.   }
  466.   
  467. > int EC_GROUP_check_discriminant(const EC_GROUP *group, BN_CTX *ctx)
  468.   {
  469.       if (group->meth->group_check_discriminant == 0) {

crypto/ec/ec_lib.c:469:9: Taking false branch
  467.   int EC_GROUP_check_discriminant(const EC_GROUP *group, BN_CTX *ctx)
  468.   {
  469.       if (group->meth->group_check_discriminant == 0) {
                 ^
  470.           ECerr(EC_F_EC_GROUP_CHECK_DISCRIMINANT,
  471.                 ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);

crypto/ec/ec_lib.c:474:5: Skipping __function_pointer__(): unresolved function pointer
  472.           return 0;
  473.       }
  474.       return group->meth->group_check_discriminant(group, ctx);
             ^
  475.   }
  476.   

crypto/ec/ec_lib.c:475:1: return from a call to EC_GROUP_check_discriminant
  473.       }
  474.       return group->meth->group_check_discriminant(group, ctx);
  475. > }
  476.   
  477.   int EC_GROUP_cmp(const EC_GROUP *a, const EC_GROUP *b, BN_CTX *ctx)

crypto/ec/ec_check.c:33:10: Taking false branch
31.   
32.       /* check the discriminant */
33.       if (!EC_GROUP_check_discriminant(group, ctx)) {
               ^
34.           ECerr(EC_F_EC_GROUP_CHECK, EC_R_DISCRIMINANT_IS_ZERO);
35.           goto err;

crypto/ec/ec_check.c:39:9: Taking false branch
37.   
38.       /* check the generator */
39.       if (group->generator == NULL) {
              ^
40.           ECerr(EC_F_EC_GROUP_CHECK, EC_R_UNDEFINED_GENERATOR);
41.           goto err;

crypto/ec/ec_check.c:43:9: 
41.           goto err;
42.       }
43. >     if (EC_POINT_is_on_curve(group, group->generator, ctx) <= 0) {
44.           ECerr(EC_F_EC_GROUP_CHECK, EC_R_POINT_IS_NOT_ON_CURVE);
45.           goto err;

crypto/ec/ec_lib.c:845:1: start of procedure EC_POINT_is_on_curve()
  843.    * -1: An error occurred
  844.    */
  845. > int EC_POINT_is_on_curve(const EC_GROUP *group, const EC_POINT *point,
  846.                            BN_CTX *ctx)
  847.   {

crypto/ec/ec_lib.c:848:9: Taking false branch
  846.                            BN_CTX *ctx)
  847.   {
  848.       if (group->meth->is_on_curve == 0) {
                 ^
  849.           ECerr(EC_F_EC_POINT_IS_ON_CURVE, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
  850.           return 0;

crypto/ec/ec_lib.c:852:9: Taking true branch
  850.           return 0;
  851.       }
  852.       if (group->meth != point->meth) {
                 ^
  853.           ECerr(EC_F_EC_POINT_IS_ON_CURVE, EC_R_INCOMPATIBLE_OBJECTS);
  854.           return 0;

crypto/ec/ec_lib.c:853:9: Skipping ERR_put_error(): empty list of specs
  851.       }
  852.       if (group->meth != point->meth) {
  853.           ECerr(EC_F_EC_POINT_IS_ON_CURVE, EC_R_INCOMPATIBLE_OBJECTS);
                 ^
  854.           return 0;
  855.       }

crypto/ec/ec_lib.c:854:9: 
  852.       if (group->meth != point->meth) {
  853.           ECerr(EC_F_EC_POINT_IS_ON_CURVE, EC_R_INCOMPATIBLE_OBJECTS);
  854. >         return 0;
  855.       }
  856.       return group->meth->is_on_curve(group, point, ctx);

crypto/ec/ec_lib.c:857:1: return from a call to EC_POINT_is_on_curve
  855.       }
  856.       return group->meth->is_on_curve(group, point, ctx);
  857. > }
  858.   
  859.   int EC_POINT_cmp(const EC_GROUP *group, const EC_POINT *a, const EC_POINT *b,

crypto/ec/ec_check.c:43:9: Taking true branch
41.           goto err;
42.       }
43.       if (EC_POINT_is_on_curve(group, group->generator, ctx) <= 0) {
              ^
44.           ECerr(EC_F_EC_GROUP_CHECK, EC_R_POINT_IS_NOT_ON_CURVE);
45.           goto err;

crypto/ec/ec_check.c:44:9: Skipping ERR_put_error(): empty list of specs
42.       }
43.       if (EC_POINT_is_on_curve(group, group->generator, ctx) <= 0) {
44.           ECerr(EC_F_EC_GROUP_CHECK, EC_R_POINT_IS_NOT_ON_CURVE);
              ^
45.           goto err;
46.       }

crypto/ec/ec_check.c:68:2: 
66.       ret = 1;
67.   
68. >  err:
69.       BN_CTX_free(new_ctx);
70.       EC_POINT_free(point);

crypto/ec/ec_check.c:69:5: 
67.   
68.    err:
69. >     BN_CTX_free(new_ctx);
70.       EC_POINT_free(point);
71.       return ret;

crypto/bn/bn_ctx.c:157:1: start of procedure BN_CTX_free()
  155.   }
  156.   
  157. > void BN_CTX_free(BN_CTX *ctx)
  158.   {
  159.   #ifdef BN_CTX_DEBUG

crypto/bn/bn_ctx.c:174:5: 
  172.       }
  173.   #endif
  174. >     BN_STACK_finish(&ctx->stack);
  175.       BN_POOL_finish(&ctx->pool);
  176.       OPENSSL_free(ctx);

crypto/bn/bn_ctx.c:243:1: start of procedure BN_STACK_finish()
    241.   }
    242.   
    243. > static void BN_STACK_finish(BN_STACK *st)
    244.   {
    245.       OPENSSL_free(st->indexes);

crypto/bn/bn_ctx.c:245:5: 
    243.   static void BN_STACK_finish(BN_STACK *st)
    244.   {
    245. >     OPENSSL_free(st->indexes);
    246.       st->indexes = NULL;
    247.   }

crypto/mem.c:295:1: start of procedure CRYPTO_free()
      293.   }
      294.   
      295. > void CRYPTO_free(void *str, const char *file, int line)
      296.   {
      297.       INCREMENT(free_count);

crypto/mem.c:298:9: Taking true branch
      296.   {
      297.       INCREMENT(free_count);
      298.       if (free_impl != NULL && free_impl != &CRYPTO_free) {
                     ^
      299.           free_impl(str, file, line);
      300.           return;

crypto/mem.c:298:30: Taking true branch
      296.   {
      297.       INCREMENT(free_count);
      298.       if (free_impl != NULL && free_impl != &CRYPTO_free) {
                                          ^
      299.           free_impl(str, file, line);
      300.           return;

crypto/mem.c:299:9: Skipping __function_pointer__(): unresolved function pointer
      297.       INCREMENT(free_count);
      298.       if (free_impl != NULL && free_impl != &CRYPTO_free) {
      299.           free_impl(str, file, line);
                     ^
      300.           return;
      301.       }

crypto/mem.c:300:9: 
      298.       if (free_impl != NULL && free_impl != &CRYPTO_free) {
      299.           free_impl(str, file, line);
      300. >         return;
      301.       }
      302.   

crypto/mem.c:314:1: return from a call to CRYPTO_free
      312.       free(str);
      313.   #endif
      314. > }
      315.   
      316.   void CRYPTO_clear_free(void *str, size_t num, const char *file, int line)

crypto/bn/bn_ctx.c:246:5: 
    244.   {
    245.       OPENSSL_free(st->indexes);
    246. >     st->indexes = NULL;
    247.   }
    248.   

crypto/bn/bn_ctx.c:247:1: return from a call to BN_STACK_finish
    245.       OPENSSL_free(st->indexes);
    246.       st->indexes = NULL;
    247. > }
    248.   
    249.   

crypto/bn/bn_ctx.c:175:5: 
  173.   #endif
  174.       BN_STACK_finish(&ctx->stack);
  175. >     BN_POOL_finish(&ctx->pool);
  176.       OPENSSL_free(ctx);
  177.   }

crypto/bn/bn_ctx.c:284:1: start of procedure BN_POOL_finish()
    282.   }
    283.   
    284. > static void BN_POOL_finish(BN_POOL *p)
    285.   {
    286.       unsigned int loop;

crypto/bn/bn_ctx.c:289:12: Loop condition is false. Leaving loop
    287.       BIGNUM *bn;
    288.   
    289.       while (p->head) {
                      ^
    290.           for (loop = 0, bn = p->head->vals; loop++ < BN_CTX_POOL_SIZE; bn++)
    291.               if (bn->d)
