test/testutil/tests.c:436: error: NULL_DEREFERENCE
  pointer `aa` last assigned on line 435 could be null and is dereferenced by call to `BN_set_negative()` at line 436, column 5.
Showing all 67 steps of the trace


test/testutil/tests.c:427:1: start of procedure test_BN_abs_eq_word()
425.   }
426.   
427. > int test_BN_abs_eq_word(const char *file, int line, const char *bns,
428.                           const char *ws, const BIGNUM *a, BN_ULONG w)
429.   {

test/testutil/tests.c:432:9: Taking true branch
430.       BIGNUM *bw, *aa;
431.   
432.       if (a != NULL && BN_abs_is_word(a, w))
               ^
433.           return 1;
434.       bw = BN_new();

test/testutil/tests.c:432:22: 
430.       BIGNUM *bw, *aa;
431.   
432. >     if (a != NULL && BN_abs_is_word(a, w))
433.           return 1;
434.       bw = BN_new();

crypto/bn/bn_lib.c:859:1: start of procedure BN_abs_is_word()
  857.   }
  858.   
  859. > int BN_abs_is_word(const BIGNUM *a, const BN_ULONG w)
  860.   {
  861.       return ((a->top == 1) && (a->d[0] == w)) || ((w == 0) && (a->top == 0));

crypto/bn/bn_lib.c:861:14: Condition is false
  859.   int BN_abs_is_word(const BIGNUM *a, const BN_ULONG w)
  860.   {
  861.       return ((a->top == 1) && (a->d[0] == w)) || ((w == 0) && (a->top == 0));
                      ^
  862.   }
  863.   

crypto/bn/bn_lib.c:861:51: Condition is false
  859.   int BN_abs_is_word(const BIGNUM *a, const BN_ULONG w)
  860.   {
  861.       return ((a->top == 1) && (a->d[0] == w)) || ((w == 0) && (a->top == 0));
                                                           ^
  862.   }
  863.   

crypto/bn/bn_lib.c:861:12: 
  859.   int BN_abs_is_word(const BIGNUM *a, const BN_ULONG w)
  860.   {
  861. >     return ((a->top == 1) && (a->d[0] == w)) || ((w == 0) && (a->top == 0));
  862.   }
  863.   

crypto/bn/bn_lib.c:861:5: 
  859.   int BN_abs_is_word(const BIGNUM *a, const BN_ULONG w)
  860.   {
  861. >     return ((a->top == 1) && (a->d[0] == w)) || ((w == 0) && (a->top == 0));
  862.   }
  863.   

crypto/bn/bn_lib.c:862:1: return from a call to BN_abs_is_word
  860.   {
  861.       return ((a->top == 1) && (a->d[0] == w)) || ((w == 0) && (a->top == 0));
  862. > }
  863.   
  864.   int BN_is_zero(const BIGNUM *a)

test/testutil/tests.c:432:22: Taking false branch
430.       BIGNUM *bw, *aa;
431.   
432.       if (a != NULL && BN_abs_is_word(a, w))
                            ^
433.           return 1;
434.       bw = BN_new();

test/testutil/tests.c:434:5: Skipping BN_new(): empty list of specs
432.       if (a != NULL && BN_abs_is_word(a, w))
433.           return 1;
434.       bw = BN_new();
           ^
435.       aa = BN_dup(a);
436.       BN_set_negative(aa, 0);

test/testutil/tests.c:435:5: 
433.           return 1;
434.       bw = BN_new();
435. >     aa = BN_dup(a);
436.       BN_set_negative(aa, 0);
437.       BN_set_word(bw, w);

crypto/bn/bn_lib.c:260:1: start of procedure BN_dup()
  258.   }
  259.   
  260. > BIGNUM *BN_dup(const BIGNUM *a)
  261.   {
  262.       BIGNUM *t;

crypto/bn/bn_lib.c:264:9: Taking false branch
  262.       BIGNUM *t;
  263.   
  264.       if (a == NULL)
                 ^
  265.           return NULL;
  266.       bn_check_top(a);

crypto/bn/bn_lib.c:268:9: 
  266.       bn_check_top(a);
  267.   
  268. >     t = BN_get_flags(a, BN_FLG_SECURE) ? BN_secure_new() : BN_new();
  269.       if (t == NULL)
  270.           return NULL;

crypto/bn/bn_lib.c:930:1: start of procedure BN_get_flags()
    928.   }
    929.   
    930. > int BN_get_flags(const BIGNUM *b, int n)
    931.   {
    932.       return b->flags & n;

crypto/bn/bn_lib.c:932:5: 
    930.   int BN_get_flags(const BIGNUM *b, int n)
    931.   {
    932. >     return b->flags & n;
    933.   }
    934.   

crypto/bn/bn_lib.c:933:1: return from a call to BN_get_flags
    931.   {
    932.       return b->flags & n;
    933. > }
    934.   
    935.   /* Populate a BN_GENCB structure with an "old"-style callback */

crypto/bn/bn_lib.c:268:9: Condition is false
  266.       bn_check_top(a);
  267.   
  268.       t = BN_get_flags(a, BN_FLG_SECURE) ? BN_secure_new() : BN_new();
                 ^
  269.       if (t == NULL)
  270.           return NULL;

crypto/bn/bn_lib.c:268:5: 
  266.       bn_check_top(a);
  267.   
  268. >     t = BN_get_flags(a, BN_FLG_SECURE) ? BN_secure_new() : BN_new();
  269.       if (t == NULL)
  270.           return NULL;

crypto/bn/bn_lib.c:269:9: Taking false branch
  267.   
  268.       t = BN_get_flags(a, BN_FLG_SECURE) ? BN_secure_new() : BN_new();
  269.       if (t == NULL)
                 ^
  270.           return NULL;
  271.       if (!BN_copy(t, a)) {

crypto/bn/bn_lib.c:271:10: 
  269.       if (t == NULL)
  270.           return NULL;
  271. >     if (!BN_copy(t, a)) {
  272.           BN_free(t);
  273.           return NULL;

crypto/bn/bn_lib.c:279:1: start of procedure BN_copy()
    277.   }
    278.   
    279. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
    280.   {
    281.       bn_check_top(b);

crypto/bn/bn_lib.c:283:9: Taking false branch
    281.       bn_check_top(b);
    282.   
    283.       if (a == b)
                   ^
    284.           return a;
    285.       if (bn_wexpand(a, b->top) == NULL)

crypto/bn/bn_lib.c:285:9: 
    283.       if (a == b)
    284.           return a;
    285. >     if (bn_wexpand(a, b->top) == NULL)
    286.           return NULL;
    287.   

crypto/bn/bn_lib.c:960:1: start of procedure bn_wexpand()
      958.   }
      959.   
      960. > BIGNUM *bn_wexpand(BIGNUM *a, int words)
      961.   {
      962.       return (words <= a->dmax) ? a : bn_expand2(a, words);

crypto/bn/bn_lib.c:962:13: Condition is false
      960.   BIGNUM *bn_wexpand(BIGNUM *a, int words)
      961.   {
      962.       return (words <= a->dmax) ? a : bn_expand2(a, words);
                         ^
      963.   }
      964.   

crypto/bn/bn_lib.c:962:12: 
      960.   BIGNUM *bn_wexpand(BIGNUM *a, int words)
      961.   {
      962. >     return (words <= a->dmax) ? a : bn_expand2(a, words);
      963.   }
      964.   

crypto/bn/bn_lib.c:245:1: start of procedure bn_expand2()
        243.    */
        244.   
        245. > BIGNUM *bn_expand2(BIGNUM *b, int words)
        246.   {
        247.       if (words > b->dmax) {

crypto/bn/bn_lib.c:247:9: Taking true branch
        245.   BIGNUM *bn_expand2(BIGNUM *b, int words)
        246.   {
        247.       if (words > b->dmax) {
                       ^
        248.           BN_ULONG *a = bn_expand_internal(b, words);
        249.           if (!a)

crypto/bn/bn_lib.c:248:9: 
        246.   {
        247.       if (words > b->dmax) {
        248. >         BN_ULONG *a = bn_expand_internal(b, words);
        249.           if (!a)
        250.               return NULL;

crypto/bn/bn_lib.c:209:1: start of procedure bn_expand_internal()
          207.   /* This is used by bn_expand2() */
          208.   /* The caller MUST check that words > b->dmax before calling this */
          209. > static BN_ULONG *bn_expand_internal(const BIGNUM *b, int words)
          210.   {
          211.       BN_ULONG *a = NULL;

crypto/bn/bn_lib.c:211:5: 
          209.   static BN_ULONG *bn_expand_internal(const BIGNUM *b, int words)
          210.   {
          211. >     BN_ULONG *a = NULL;
          212.   
          213.       if (words > (INT_MAX / (4 * BN_BITS2))) {

crypto/bn/bn_lib.c:213:9: Taking true branch
          211.       BN_ULONG *a = NULL;
          212.   
          213.       if (words > (INT_MAX / (4 * BN_BITS2))) {
                         ^
          214.           BNerr(BN_F_BN_EXPAND_INTERNAL, BN_R_BIGNUM_TOO_LONG);
          215.           return NULL;

crypto/bn/bn_lib.c:214:9: 
          212.   
          213.       if (words > (INT_MAX / (4 * BN_BITS2))) {
          214. >         BNerr(BN_F_BN_EXPAND_INTERNAL, BN_R_BIGNUM_TOO_LONG);
          215.           return NULL;
          216.       }

providers/fips/fipsprov.c:435:1: start of procedure ERR_put_error()
            433.   }
            434.   
            435. > void ERR_put_error(int lib, int func, int reason, const char *file, int line)
            436.   {
            437.       /*

providers/fips/fipsprov.c:442:5: Skipping __function_pointer__(): unresolved function pointer
            440.        * a OPENSSL_CTX pointer.
            441.        */
            442.       c_put_error(NULL, ERR_PACK(lib, func, reason), file, line);
                       ^
            443.       ERR_add_error_data(1, "(in the FIPS module)");
            444.   }

providers/fips/fipsprov.c:443:5: Skipping ERR_add_error_data(): empty list of specs
            441.        */
            442.       c_put_error(NULL, ERR_PACK(lib, func, reason), file, line);
            443.       ERR_add_error_data(1, "(in the FIPS module)");
                       ^
            444.   }
            445.   

providers/fips/fipsprov.c:444:1: return from a call to ERR_put_error
            442.       c_put_error(NULL, ERR_PACK(lib, func, reason), file, line);
            443.       ERR_add_error_data(1, "(in the FIPS module)");
            444. > }
            445.   
            446.   void ERR_add_error_data(int num, ...)

crypto/bn/bn_lib.c:215:9: 
          213.       if (words > (INT_MAX / (4 * BN_BITS2))) {
          214.           BNerr(BN_F_BN_EXPAND_INTERNAL, BN_R_BIGNUM_TOO_LONG);
          215. >         return NULL;
          216.       }
          217.       if (BN_get_flags(b, BN_FLG_STATIC_DATA)) {

crypto/bn/bn_lib.c:235:1: return from a call to bn_expand_internal
          233.   
          234.       return a;
          235. > }
          236.   
          237.   /*

crypto/bn/bn_lib.c:249:14: Taking true branch
        247.       if (words > b->dmax) {
        248.           BN_ULONG *a = bn_expand_internal(b, words);
        249.           if (!a)
                            ^
        250.               return NULL;
        251.           if (b->d != NULL)

crypto/bn/bn_lib.c:250:13: 
        248.           BN_ULONG *a = bn_expand_internal(b, words);
        249.           if (!a)
        250. >             return NULL;
        251.           if (b->d != NULL)
        252.               bn_free_d(b, 1);

crypto/bn/bn_lib.c:258:1: return from a call to bn_expand2
        256.   
        257.       return b;
        258. > }
        259.   
        260.   BIGNUM *BN_dup(const BIGNUM *a)

crypto/bn/bn_lib.c:962:5: 
      960.   BIGNUM *bn_wexpand(BIGNUM *a, int words)
      961.   {
      962. >     return (words <= a->dmax) ? a : bn_expand2(a, words);
      963.   }
      964.   

crypto/bn/bn_lib.c:963:1: return from a call to bn_wexpand
      961.   {
      962.       return (words <= a->dmax) ? a : bn_expand2(a, words);
      963. > }
      964.   
      965.   void bn_correct_top(BIGNUM *a)

crypto/bn/bn_lib.c:285:9: Taking true branch
    283.       if (a == b)
    284.           return a;
    285.       if (bn_wexpand(a, b->top) == NULL)
                   ^
    286.           return NULL;
    287.   

crypto/bn/bn_lib.c:286:9: 
    284.           return a;
    285.       if (bn_wexpand(a, b->top) == NULL)
    286. >         return NULL;
    287.   
    288.       if (b->top > 0)

crypto/bn/bn_lib.c:296:1: return from a call to BN_copy
    294.       bn_check_top(a);
    295.       return a;
    296. > }
    297.   
    298.   #define FLAGS_DATA(flags) ((flags) & (BN_FLG_STATIC_DATA \

crypto/bn/bn_lib.c:271:10: Taking true branch
  269.       if (t == NULL)
  270.           return NULL;
  271.       if (!BN_copy(t, a)) {
                  ^
  272.           BN_free(t);
  273.           return NULL;

crypto/bn/bn_lib.c:272:9: 
  270.           return NULL;
  271.       if (!BN_copy(t, a)) {
  272. >         BN_free(t);
  273.           return NULL;
  274.       }

crypto/bn/bn_lib.c:168:1: start of procedure BN_free()
    166.   }
    167.   
    168. > void BN_free(BIGNUM *a)
    169.   {
    170.       if (a == NULL)

crypto/bn/bn_lib.c:170:9: Taking false branch
    168.   void BN_free(BIGNUM *a)
    169.   {
    170.       if (a == NULL)
                   ^
    171.           return;
    172.       if (!BN_get_flags(a, BN_FLG_STATIC_DATA))

crypto/bn/bn_lib.c:172:10: 
    170.       if (a == NULL)
    171.           return;
    172. >     if (!BN_get_flags(a, BN_FLG_STATIC_DATA))
    173.           bn_free_d(a, 0);
    174.       if (a->flags & BN_FLG_MALLOCED)

crypto/bn/bn_lib.c:930:1: start of procedure BN_get_flags()
      928.   }
      929.   
      930. > int BN_get_flags(const BIGNUM *b, int n)
      931.   {
      932.       return b->flags & n;

crypto/bn/bn_lib.c:932:5: 
      930.   int BN_get_flags(const BIGNUM *b, int n)
      931.   {
      932. >     return b->flags & n;
      933.   }
      934.   

crypto/bn/bn_lib.c:933:1: return from a call to BN_get_flags
      931.   {
      932.       return b->flags & n;
      933. > }
      934.   
      935.   /* Populate a BN_GENCB structure with an "old"-style callback */

crypto/bn/bn_lib.c:172:10: Taking false branch
    170.       if (a == NULL)
    171.           return;
    172.       if (!BN_get_flags(a, BN_FLG_STATIC_DATA))
                    ^
    173.           bn_free_d(a, 0);
    174.       if (a->flags & BN_FLG_MALLOCED)

crypto/bn/bn_lib.c:174:9: Taking false branch
    172.       if (!BN_get_flags(a, BN_FLG_STATIC_DATA))
    173.           bn_free_d(a, 0);
    174.       if (a->flags & BN_FLG_MALLOCED)
                   ^
    175.           OPENSSL_free(a);
    176.   }

crypto/bn/bn_lib.c:174:5: 
    172.       if (!BN_get_flags(a, BN_FLG_STATIC_DATA))
    173.           bn_free_d(a, 0);
    174. >     if (a->flags & BN_FLG_MALLOCED)
    175.           OPENSSL_free(a);
    176.   }

crypto/bn/bn_lib.c:176:1: return from a call to BN_free
    174.       if (a->flags & BN_FLG_MALLOCED)
    175.           OPENSSL_free(a);
    176. > }
    177.   
    178.   void bn_init(BIGNUM *a)

crypto/bn/bn_lib.c:273:9: 
  271.       if (!BN_copy(t, a)) {
  272.           BN_free(t);
  273. >         return NULL;
  274.       }
  275.       bn_check_top(t);

crypto/bn/bn_lib.c:277:1: return from a call to BN_dup
  275.       bn_check_top(t);
  276.       return t;
  277. > }
  278.   
  279.   BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)

test/testutil/tests.c:436:5: 
434.       bw = BN_new();
435.       aa = BN_dup(a);
436. >     BN_set_negative(aa, 0);
437.       BN_set_word(bw, w);
438.       test_fail_bignum_message(NULL, file, line, "BIGNUM", bns, ws, "abs==",

crypto/bn/bn_lib.c:703:1: start of procedure BN_set_negative()
  701.   }
  702.   
  703. > void BN_set_negative(BIGNUM *a, int b)
  704.   {
  705.       if (b && !BN_is_zero(a))

crypto/bn/bn_lib.c:705:9: Taking false branch
  703.   void BN_set_negative(BIGNUM *a, int b)
  704.   {
  705.       if (b && !BN_is_zero(a))
                 ^
  706.           a->neg = 1;
  707.       else

crypto/bn/bn_lib.c:708:9: 
  706.           a->neg = 1;
  707.       else
  708. >         a->neg = 0;
  709.   }
  710.   
