engines/ccgost/gost_ameth.c:622: error: NULL_DEREFERENCE
  pointer `databuf` last assigned on line 621 could be null and is dereferenced by call to `BN_bn2bin()` at line 622, column 2.
Showing all 67 steps of the trace


engines/ccgost/gost_ameth.c:603:1: start of procedure pub_encode_gost94()
601.   	}
602.   
603. > static int pub_encode_gost94(X509_PUBKEY *pub,const EVP_PKEY *pk)
604.   	{
605.   	ASN1_OBJECT *algobj = NULL;

engines/ccgost/gost_ameth.c:605:2: 
603.   static int pub_encode_gost94(X509_PUBKEY *pub,const EVP_PKEY *pk)
604.   	{
605. > 	ASN1_OBJECT *algobj = NULL;
606.   	ASN1_OCTET_STRING *octet = NULL;
607.   	void *pval = NULL;

engines/ccgost/gost_ameth.c:606:2: 
604.   	{
605.   	ASN1_OBJECT *algobj = NULL;
606. > 	ASN1_OCTET_STRING *octet = NULL;
607.   	void *pval = NULL;
608.   	unsigned char *buf=NULL,*databuf,*sptr;

engines/ccgost/gost_ameth.c:607:2: 
605.   	ASN1_OBJECT *algobj = NULL;
606.   	ASN1_OCTET_STRING *octet = NULL;
607. > 	void *pval = NULL;
608.   	unsigned char *buf=NULL,*databuf,*sptr;
609.   	int i,j,data_len,ret=0;

engines/ccgost/gost_ameth.c:608:2: 
606.   	ASN1_OCTET_STRING *octet = NULL;
607.   	void *pval = NULL;
608. > 	unsigned char *buf=NULL,*databuf,*sptr;
609.   	int i,j,data_len,ret=0;
610.   

engines/ccgost/gost_ameth.c:609:2: 
607.   	void *pval = NULL;
608.   	unsigned char *buf=NULL,*databuf,*sptr;
609. > 	int i,j,data_len,ret=0;
610.   
611.   	int ptype = V_ASN1_UNDEF;

engines/ccgost/gost_ameth.c:611:2: 
609.   	int i,j,data_len,ret=0;
610.   
611. > 	int ptype = V_ASN1_UNDEF;
612.   	DSA *dsa = EVP_PKEY_get0((EVP_PKEY *)pk);
613.   	algobj = OBJ_nid2obj(EVP_PKEY_base_id(pk));

engines/ccgost/gost_ameth.c:612:2: 
610.   
611.   	int ptype = V_ASN1_UNDEF;
612. > 	DSA *dsa = EVP_PKEY_get0((EVP_PKEY *)pk);
613.   	algobj = OBJ_nid2obj(EVP_PKEY_base_id(pk));
614.   	if (pk->save_parameters) 

crypto/evp/p_lib.c:268:1: start of procedure EVP_PKEY_get0()
  266.   	}
  267.   
  268. > void *EVP_PKEY_get0(EVP_PKEY *pkey)
  269.   	{
  270.   	return pkey->pkey.ptr;

crypto/evp/p_lib.c:270:2: 
  268.   void *EVP_PKEY_get0(EVP_PKEY *pkey)
  269.   	{
  270. > 	return pkey->pkey.ptr;
  271.   	}
  272.   

crypto/evp/p_lib.c:271:2: return from a call to EVP_PKEY_get0
  269.   	{
  270.   	return pkey->pkey.ptr;
  271.   	}
          ^
  272.   
  273.   #ifndef OPENSSL_NO_RSA

engines/ccgost/gost_ameth.c:613:2: 
611.   	int ptype = V_ASN1_UNDEF;
612.   	DSA *dsa = EVP_PKEY_get0((EVP_PKEY *)pk);
613. > 	algobj = OBJ_nid2obj(EVP_PKEY_base_id(pk));
614.   	if (pk->save_parameters) 
615.   		{

crypto/evp/p_lib.c:379:1: start of procedure EVP_PKEY_base_id()
  377.   	}
  378.   
  379. > int EVP_PKEY_base_id(const EVP_PKEY *pkey)
  380.   	{
  381.   	return EVP_PKEY_type(pkey->type);

crypto/evp/p_lib.c:381:2: Skipping EVP_PKEY_type(): empty list of specs
  379.   int EVP_PKEY_base_id(const EVP_PKEY *pkey)
  380.   	{
  381.   	return EVP_PKEY_type(pkey->type);
          ^
  382.   	}
  383.   

crypto/evp/p_lib.c:382:2: return from a call to EVP_PKEY_base_id
  380.   	{
  381.   	return EVP_PKEY_type(pkey->type);
  382.   	}
          ^
  383.   
  384.   void EVP_PKEY_free(EVP_PKEY *x)

crypto/objects/obj_dat.c:292:1: start of procedure OBJ_nid2obj()
  290.   	}
  291.   
  292. > ASN1_OBJECT *OBJ_nid2obj(int n)
  293.   	{
  294.   	ADDED_OBJ ad,*adp;

crypto/objects/obj_dat.c:297:7: Taking false branch
  295.   	ASN1_OBJECT ob;
  296.   
  297.   	if ((n >= 0) && (n < NUM_NID))
               ^
  298.   		{
  299.   		if ((n != NID_undef) && (nid_objs[n].nid == NID_undef))

crypto/objects/obj_dat.c:306:11: Taking false branch
  304.   		return((ASN1_OBJECT *)&(nid_objs[n]));
  305.   		}
  306.   	else if (added == NULL)
                   ^
  307.   		return(NULL);
  308.   	else

crypto/objects/obj_dat.c:310:3: 
  308.   	else
  309.   		{
  310. > 		ad.type=ADDED_NID;
  311.   		ad.obj= &ob;
  312.   		ob.nid=n;

crypto/objects/obj_dat.c:311:3: 
  309.   		{
  310.   		ad.type=ADDED_NID;
  311. > 		ad.obj= &ob;
  312.   		ob.nid=n;
  313.   		adp=lh_ADDED_OBJ_retrieve(added,&ad);

crypto/objects/obj_dat.c:312:3: 
  310.   		ad.type=ADDED_NID;
  311.   		ad.obj= &ob;
  312. > 		ob.nid=n;
  313.   		adp=lh_ADDED_OBJ_retrieve(added,&ad);
  314.   		if (adp != NULL)

crypto/objects/obj_dat.c:313:7: Condition is true
  311.   		ad.obj= &ob;
  312.   		ob.nid=n;
  313.   		adp=lh_ADDED_OBJ_retrieve(added,&ad);
               ^
  314.   		if (adp != NULL)
  315.   			return(adp->obj);

crypto/objects/obj_dat.c:313:7: Condition is true
  311.   		ad.obj= &ob;
  312.   		ob.nid=n;
  313.   		adp=lh_ADDED_OBJ_retrieve(added,&ad);
               ^
  314.   		if (adp != NULL)
  315.   			return(adp->obj);

crypto/objects/obj_dat.c:313:3: 
  311.   		ad.obj= &ob;
  312.   		ob.nid=n;
  313. > 		adp=lh_ADDED_OBJ_retrieve(added,&ad);
  314.   		if (adp != NULL)
  315.   			return(adp->obj);

crypto/lhash/lhash.c:248:1: start of procedure lh_retrieve()
    246.   	}
    247.   
    248. > void *lh_retrieve(_LHASH *lh, const void *data)
    249.   	{
    250.   	unsigned long hash;

crypto/lhash/lhash.c:254:2: 
    252.   	void *ret;
    253.   
    254. > 	lh->error=0;
    255.   	rn=getrn(lh,data,&hash);
    256.   

crypto/lhash/lhash.c:255:2: Skipping getrn(): empty list of specs
    253.   
    254.   	lh->error=0;
    255.   	rn=getrn(lh,data,&hash);
            ^
    256.   
    257.   	if (*rn == NULL)

crypto/lhash/lhash.c:257:6: Taking false branch
    255.   	rn=getrn(lh,data,&hash);
    256.   
    257.   	if (*rn == NULL)
                ^
    258.   		{
    259.   		lh->num_retrieve_miss++;

crypto/lhash/lhash.c:264:3: 
    262.   	else
    263.   		{
    264. > 		ret= (*rn)->data;
    265.   		lh->num_retrieve++;
    266.   		}

crypto/lhash/lhash.c:265:3: 
    263.   		{
    264.   		ret= (*rn)->data;
    265. > 		lh->num_retrieve++;
    266.   		}
    267.   	return(ret);

crypto/lhash/lhash.c:267:2: 
    265.   		lh->num_retrieve++;
    266.   		}
    267. > 	return(ret);
    268.   	}
    269.   

crypto/lhash/lhash.c:268:2: return from a call to lh_retrieve
    266.   		}
    267.   	return(ret);
    268.   	}
            ^
    269.   
    270.   static void doall_util_fn(_LHASH *lh, int use_arg, LHASH_DOALL_FN_TYPE func,

crypto/objects/obj_dat.c:314:7: Taking true branch
  312.   		ob.nid=n;
  313.   		adp=lh_ADDED_OBJ_retrieve(added,&ad);
  314.   		if (adp != NULL)
               ^
  315.   			return(adp->obj);
  316.   		else

crypto/objects/obj_dat.c:315:4: 
  313.   		adp=lh_ADDED_OBJ_retrieve(added,&ad);
  314.   		if (adp != NULL)
  315. > 			return(adp->obj);
  316.   		else
  317.   			{

crypto/objects/obj_dat.c:322:2: return from a call to OBJ_nid2obj
  320.   			}
  321.   		}
  322.   	}
          ^
  323.   
  324.   const char *OBJ_nid2sn(int n)

engines/ccgost/gost_ameth.c:614:6: Taking false branch
612.   	DSA *dsa = EVP_PKEY_get0((EVP_PKEY *)pk);
613.   	algobj = OBJ_nid2obj(EVP_PKEY_base_id(pk));
614.   	if (pk->save_parameters) 
            ^
615.   		{
616.   		ASN1_STRING *params = encode_gost_algor_params(pk);

engines/ccgost/gost_ameth.c:620:2: 
618.   		ptype = V_ASN1_SEQUENCE;
619.   		}	
620. > 	data_len = BN_num_bytes(dsa->pub_key);
621.   	databuf = OPENSSL_malloc(data_len);
622.   	BN_bn2bin(dsa->pub_key,databuf);

crypto/bn/bn_lib.c:248:1: start of procedure BN_num_bits()
  246.   	}
  247.   
  248. > int BN_num_bits(const BIGNUM *a)
  249.   	{
  250.   	int i = a->top - 1;

crypto/bn/bn_lib.c:250:2: 
  248.   int BN_num_bits(const BIGNUM *a)
  249.   	{
  250. > 	int i = a->top - 1;
  251.   	bn_check_top(a);
  252.   

crypto/bn/bn_lib.c:253:6: Taking false branch
  251.   	bn_check_top(a);
  252.   
  253.   	if (BN_is_zero(a)) return 0;
              ^
  254.   	return ((i*BN_BITS2) + BN_num_bits_word(a->d[i]));
  255.   	}

crypto/bn/bn_lib.c:254:2: Skipping BN_num_bits_word(): empty list of specs
  252.   
  253.   	if (BN_is_zero(a)) return 0;
  254.   	return ((i*BN_BITS2) + BN_num_bits_word(a->d[i]));
          ^
  255.   	}
  256.   

crypto/bn/bn_lib.c:255:2: return from a call to BN_num_bits
  253.   	if (BN_is_zero(a)) return 0;
  254.   	return ((i*BN_BITS2) + BN_num_bits_word(a->d[i]));
  255.   	}
          ^
  256.   
  257.   void BN_clear_free(BIGNUM *a)

engines/ccgost/gost_ameth.c:621:2: 
619.   		}	
620.   	data_len = BN_num_bytes(dsa->pub_key);
621. > 	databuf = OPENSSL_malloc(data_len);
622.   	BN_bn2bin(dsa->pub_key,databuf);
623.   	octet = ASN1_OCTET_STRING_new();

crypto/mem.c:294:1: start of procedure CRYPTO_malloc()
  292.   	}
  293.   
  294. > void *CRYPTO_malloc(int num, const char *file, int line)
  295.   	{
  296.   	void *ret = NULL;

crypto/mem.c:296:2: 
  294.   void *CRYPTO_malloc(int num, const char *file, int line)
  295.   	{
  296. > 	void *ret = NULL;
  297.   
  298.   	if (num <= 0) return NULL;

crypto/mem.c:298:6: Taking false branch
  296.   	void *ret = NULL;
  297.   
  298.   	if (num <= 0) return NULL;
              ^
  299.   
  300.   	allow_customize = 0;

crypto/mem.c:300:2: 
  298.   	if (num <= 0) return NULL;
  299.   
  300. > 	allow_customize = 0;
  301.   	if (malloc_debug_func != NULL)
  302.   		{

crypto/mem.c:301:6: Taking true branch
  299.   
  300.   	allow_customize = 0;
  301.   	if (malloc_debug_func != NULL)
              ^
  302.   		{
  303.   		allow_customize_debug = 0;

crypto/mem.c:303:3: 
  301.   	if (malloc_debug_func != NULL)
  302.   		{
  303. > 		allow_customize_debug = 0;
  304.   		malloc_debug_func(NULL, num, file, line, 0);
  305.   		}

crypto/mem.c:304:3: Skipping __function_pointer__(): unresolved function pointer
  302.   		{
  303.   		allow_customize_debug = 0;
  304.   		malloc_debug_func(NULL, num, file, line, 0);
           ^
  305.   		}
  306.   	ret = malloc_ex_func(num,file,line);

crypto/mem.c:306:2: Skipping __function_pointer__(): unresolved function pointer
  304.   		malloc_debug_func(NULL, num, file, line, 0);
  305.   		}
  306.   	ret = malloc_ex_func(num,file,line);
          ^
  307.   #ifdef LEVITTE_DEBUG_MEM
  308.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);

crypto/mem.c:310:6: Taking true branch
  308.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);
  309.   #endif
  310.   	if (malloc_debug_func != NULL)
              ^
  311.   		malloc_debug_func(ret, num, file, line, 1);
  312.   

crypto/mem.c:311:3: Skipping __function_pointer__(): unresolved function pointer
  309.   #endif
  310.   	if (malloc_debug_func != NULL)
  311.   		malloc_debug_func(ret, num, file, line, 1);
           ^
  312.   
  313.   #ifndef OPENSSL_CPUID_OBJ

crypto/mem.c:317:12: Taking false branch
  315.            * sanitisation function can't be optimised out. NB: We only do
  316.            * this for >2Kb so the overhead doesn't bother us. */
  317.           if(ret && (num > 2048))
                    ^
  318.   	{	extern unsigned char cleanse_ctr;
  319.                   ((unsigned char *)ret)[0] = cleanse_ctr;

crypto/mem.c:323:2: 
  321.   #endif
  322.   
  323. > 	return ret;
  324.   	}
  325.   

crypto/mem.c:324:2: return from a call to CRYPTO_malloc
  322.   
  323.   	return ret;
  324.   	}
          ^
  325.   
  326.   void *CRYPTO_realloc(void *str, int num, const char *file, int line)

engines/ccgost/gost_ameth.c:622:2: 
620.   	data_len = BN_num_bytes(dsa->pub_key);
621.   	databuf = OPENSSL_malloc(data_len);
622. > 	BN_bn2bin(dsa->pub_key,databuf);
623.   	octet = ASN1_OCTET_STRING_new();
624.   	ASN1_STRING_set(octet,NULL,data_len);

crypto/bn/bn_lib.c:641:1: start of procedure BN_bn2bin()
  639.   
  640.   /* ignore negative */
  641. > int BN_bn2bin(const BIGNUM *a, unsigned char *to)
  642.   	{
  643.   	int n,i;

crypto/bn/bn_lib.c:647:2: 
  645.   
  646.   	bn_check_top(a);
  647. > 	n=i=BN_num_bytes(a);
  648.   	while (i--)
  649.   		{

crypto/bn/bn_lib.c:248:1: start of procedure BN_num_bits()
    246.   	}
    247.   
    248. > int BN_num_bits(const BIGNUM *a)
    249.   	{
    250.   	int i = a->top - 1;

crypto/bn/bn_lib.c:250:2: 
    248.   int BN_num_bits(const BIGNUM *a)
    249.   	{
    250. > 	int i = a->top - 1;
    251.   	bn_check_top(a);
    252.   

crypto/bn/bn_lib.c:253:6: Taking false branch
    251.   	bn_check_top(a);
    252.   
    253.   	if (BN_is_zero(a)) return 0;
                ^
    254.   	return ((i*BN_BITS2) + BN_num_bits_word(a->d[i]));
    255.   	}

crypto/bn/bn_lib.c:254:2: Skipping BN_num_bits_word(): empty list of specs
    252.   
    253.   	if (BN_is_zero(a)) return 0;
    254.   	return ((i*BN_BITS2) + BN_num_bits_word(a->d[i]));
            ^
    255.   	}
    256.   

crypto/bn/bn_lib.c:255:2: return from a call to BN_num_bits
    253.   	if (BN_is_zero(a)) return 0;
    254.   	return ((i*BN_BITS2) + BN_num_bits_word(a->d[i]));
    255.   	}
            ^
    256.   
    257.   void BN_clear_free(BIGNUM *a)

crypto/bn/bn_lib.c:648:9: Loop condition is true. Entering loop body
  646.   	bn_check_top(a);
  647.   	n=i=BN_num_bytes(a);
  648.   	while (i--)
                 ^
  649.   		{
  650.   		l=a->d[i/BN_BYTES];

crypto/bn/bn_lib.c:650:3: 
  648.   	while (i--)
  649.   		{
  650. > 		l=a->d[i/BN_BYTES];
  651.   		*(to++)=(unsigned char)(l>>(8*(i%BN_BYTES)))&0xff;
  652.   		}

crypto/bn/bn_lib.c:651:3: 
  649.   		{
  650.   		l=a->d[i/BN_BYTES];
  651. > 		*(to++)=(unsigned char)(l>>(8*(i%BN_BYTES)))&0xff;
  652.   		}
  653.   	return(n);
