test/testutil/tests.c:412: error: NULL_DEREFERENCE
  pointer `aa` last assigned on line 411 could be null and is dereferenced by call to `BN_set_negative()` at line 412, column 5.
Showing all 47 steps of the trace


test/testutil/tests.c:403:1: start of procedure test_BN_abs_eq_word()
401.   }
402.   
403. > int test_BN_abs_eq_word(const char *file, int line, const char *bns,
404.                           const char *ws, const BIGNUM *a, BN_ULONG w)
405.   {

test/testutil/tests.c:408:9: Taking true branch
406.       BIGNUM *bw, *aa;
407.   
408.       if (a != NULL && BN_abs_is_word(a, w))
               ^
409.           return 1;
410.       bw = BN_new();

test/testutil/tests.c:408:22: 
406.       BIGNUM *bw, *aa;
407.   
408. >     if (a != NULL && BN_abs_is_word(a, w))
409.           return 1;
410.       bw = BN_new();

crypto/bn/bn_lib.c:809:1: start of procedure BN_abs_is_word()
  807.   }
  808.   
  809. > int BN_abs_is_word(const BIGNUM *a, const BN_ULONG w)
  810.   {
  811.       return ((a->top == 1) && (a->d[0] == w)) || ((w == 0) && (a->top == 0));

crypto/bn/bn_lib.c:811:14: Condition is false
  809.   int BN_abs_is_word(const BIGNUM *a, const BN_ULONG w)
  810.   {
  811.       return ((a->top == 1) && (a->d[0] == w)) || ((w == 0) && (a->top == 0));
                      ^
  812.   }
  813.   

crypto/bn/bn_lib.c:811:51: Condition is false
  809.   int BN_abs_is_word(const BIGNUM *a, const BN_ULONG w)
  810.   {
  811.       return ((a->top == 1) && (a->d[0] == w)) || ((w == 0) && (a->top == 0));
                                                           ^
  812.   }
  813.   

crypto/bn/bn_lib.c:811:12: 
  809.   int BN_abs_is_word(const BIGNUM *a, const BN_ULONG w)
  810.   {
  811. >     return ((a->top == 1) && (a->d[0] == w)) || ((w == 0) && (a->top == 0));
  812.   }
  813.   

crypto/bn/bn_lib.c:811:5: 
  809.   int BN_abs_is_word(const BIGNUM *a, const BN_ULONG w)
  810.   {
  811. >     return ((a->top == 1) && (a->d[0] == w)) || ((w == 0) && (a->top == 0));
  812.   }
  813.   

crypto/bn/bn_lib.c:812:1: return from a call to BN_abs_is_word
  810.   {
  811.       return ((a->top == 1) && (a->d[0] == w)) || ((w == 0) && (a->top == 0));
  812. > }
  813.   
  814.   int BN_is_zero(const BIGNUM *a)

test/testutil/tests.c:408:22: Taking false branch
406.       BIGNUM *bw, *aa;
407.   
408.       if (a != NULL && BN_abs_is_word(a, w))
                            ^
409.           return 1;
410.       bw = BN_new();

test/testutil/tests.c:410:5: Skipping BN_new(): empty list of specs
408.       if (a != NULL && BN_abs_is_word(a, w))
409.           return 1;
410.       bw = BN_new();
           ^
411.       aa = BN_dup(a);
412.       BN_set_negative(aa, 0);

test/testutil/tests.c:411:5: 
409.           return 1;
410.       bw = BN_new();
411. >     aa = BN_dup(a);
412.       BN_set_negative(aa, 0);
413.       BN_set_word(bw, w);

crypto/bn/bn_lib.c:266:1: start of procedure BN_dup()
  264.   }
  265.   
  266. > BIGNUM *BN_dup(const BIGNUM *a)
  267.   {
  268.       BIGNUM *t;

crypto/bn/bn_lib.c:270:9: Taking false branch
  268.       BIGNUM *t;
  269.   
  270.       if (a == NULL)
                 ^
  271.           return NULL;
  272.       bn_check_top(a);

crypto/bn/bn_lib.c:274:9: 
  272.       bn_check_top(a);
  273.   
  274. >     t = BN_get_flags(a, BN_FLG_SECURE) ? BN_secure_new() : BN_new();
  275.       if (t == NULL)
  276.           return NULL;

crypto/bn/bn_lib.c:880:1: start of procedure BN_get_flags()
    878.   }
    879.   
    880. > int BN_get_flags(const BIGNUM *b, int n)
    881.   {
    882.       return b->flags & n;

crypto/bn/bn_lib.c:882:5: 
    880.   int BN_get_flags(const BIGNUM *b, int n)
    881.   {
    882. >     return b->flags & n;
    883.   }
    884.   

crypto/bn/bn_lib.c:883:1: return from a call to BN_get_flags
    881.   {
    882.       return b->flags & n;
    883. > }
    884.   
    885.   /* Populate a BN_GENCB structure with an "old"-style callback */

crypto/bn/bn_lib.c:274:9: Condition is false
  272.       bn_check_top(a);
  273.   
  274.       t = BN_get_flags(a, BN_FLG_SECURE) ? BN_secure_new() : BN_new();
                 ^
  275.       if (t == NULL)
  276.           return NULL;

crypto/bn/bn_lib.c:274:5: 
  272.       bn_check_top(a);
  273.   
  274. >     t = BN_get_flags(a, BN_FLG_SECURE) ? BN_secure_new() : BN_new();
  275.       if (t == NULL)
  276.           return NULL;

crypto/bn/bn_lib.c:275:9: Taking false branch
  273.   
  274.       t = BN_get_flags(a, BN_FLG_SECURE) ? BN_secure_new() : BN_new();
  275.       if (t == NULL)
                 ^
  276.           return NULL;
  277.       if (!BN_copy(t, a)) {

crypto/bn/bn_lib.c:277:10: 
  275.       if (t == NULL)
  276.           return NULL;
  277. >     if (!BN_copy(t, a)) {
  278.           BN_free(t);
  279.           return NULL;

crypto/bn/bn_lib.c:285:1: start of procedure BN_copy()
    283.   }
    284.   
    285. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
    286.   {
    287.       bn_check_top(b);

crypto/bn/bn_lib.c:289:9: Taking false branch
    287.       bn_check_top(b);
    288.   
    289.       if (a == b)
                   ^
    290.           return a;
    291.       if (bn_wexpand(a, b->top) == NULL)

crypto/bn/bn_lib.c:291:9: 
    289.       if (a == b)
    290.           return a;
    291. >     if (bn_wexpand(a, b->top) == NULL)
    292.           return NULL;
    293.   

crypto/bn/bn_lib.c:910:1: start of procedure bn_wexpand()
      908.   }
      909.   
      910. > BIGNUM *bn_wexpand(BIGNUM *a, int words)
      911.   {
      912.       return (words <= a->dmax) ? a : bn_expand2(a, words);

crypto/bn/bn_lib.c:912:13: Condition is false
      910.   BIGNUM *bn_wexpand(BIGNUM *a, int words)
      911.   {
      912.       return (words <= a->dmax) ? a : bn_expand2(a, words);
                         ^
      913.   }
      914.   

crypto/bn/bn_lib.c:912:12: 
      910.   BIGNUM *bn_wexpand(BIGNUM *a, int words)
      911.   {
      912. >     return (words <= a->dmax) ? a : bn_expand2(a, words);
      913.   }
      914.   

crypto/bn/bn_lib.c:246:1: start of procedure bn_expand2()
        244.    */
        245.   
        246. > BIGNUM *bn_expand2(BIGNUM *b, int words)
        247.   {
        248.       bn_check_top(b);

crypto/bn/bn_lib.c:250:9: Taking true branch
        248.       bn_check_top(b);
        249.   
        250.       if (words > b->dmax) {
                       ^
        251.           BN_ULONG *a = bn_expand_internal(b, words);
        252.           if (!a)

crypto/bn/bn_lib.c:251:9: Skipping bn_expand_internal(): empty list of specs
        249.   
        250.       if (words > b->dmax) {
        251.           BN_ULONG *a = bn_expand_internal(b, words);
                       ^
        252.           if (!a)
        253.               return NULL;

crypto/bn/bn_lib.c:252:14: Taking true branch
        250.       if (words > b->dmax) {
        251.           BN_ULONG *a = bn_expand_internal(b, words);
        252.           if (!a)
                            ^
        253.               return NULL;
        254.           if (b->d) {

crypto/bn/bn_lib.c:253:13: 
        251.           BN_ULONG *a = bn_expand_internal(b, words);
        252.           if (!a)
        253. >             return NULL;
        254.           if (b->d) {
        255.               OPENSSL_cleanse(b->d, b->dmax * sizeof(b->d[0]));

crypto/bn/bn_lib.c:264:1: return from a call to bn_expand2
        262.       bn_check_top(b);
        263.       return b;
        264. > }
        265.   
        266.   BIGNUM *BN_dup(const BIGNUM *a)

crypto/bn/bn_lib.c:912:5: 
      910.   BIGNUM *bn_wexpand(BIGNUM *a, int words)
      911.   {
      912. >     return (words <= a->dmax) ? a : bn_expand2(a, words);
      913.   }
      914.   

crypto/bn/bn_lib.c:913:1: return from a call to bn_wexpand
      911.   {
      912.       return (words <= a->dmax) ? a : bn_expand2(a, words);
      913. > }
      914.   
      915.   void bn_correct_top(BIGNUM *a)

crypto/bn/bn_lib.c:291:9: Taking true branch
    289.       if (a == b)
    290.           return a;
    291.       if (bn_wexpand(a, b->top) == NULL)
                   ^
    292.           return NULL;
    293.   

crypto/bn/bn_lib.c:292:9: 
    290.           return a;
    291.       if (bn_wexpand(a, b->top) == NULL)
    292. >         return NULL;
    293.   
    294.       if (b->top > 0)

crypto/bn/bn_lib.c:301:1: return from a call to BN_copy
    299.       bn_check_top(a);
    300.       return a;
    301. > }
    302.   
    303.   void BN_swap(BIGNUM *a, BIGNUM *b)

crypto/bn/bn_lib.c:277:10: Taking true branch
  275.       if (t == NULL)
  276.           return NULL;
  277.       if (!BN_copy(t, a)) {
                  ^
  278.           BN_free(t);
  279.           return NULL;

crypto/bn/bn_lib.c:278:9: Skipping BN_free(): empty list of specs
  276.           return NULL;
  277.       if (!BN_copy(t, a)) {
  278.           BN_free(t);
                 ^
  279.           return NULL;
  280.       }

crypto/bn/bn_lib.c:279:9: 
  277.       if (!BN_copy(t, a)) {
  278.           BN_free(t);
  279. >         return NULL;
  280.       }
  281.       bn_check_top(t);

crypto/bn/bn_lib.c:283:1: return from a call to BN_dup
  281.       bn_check_top(t);
  282.       return t;
  283. > }
  284.   
  285.   BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)

test/testutil/tests.c:412:5: 
410.       bw = BN_new();
411.       aa = BN_dup(a);
412. >     BN_set_negative(aa, 0);
413.       BN_set_word(bw, w);
414.       test_fail_bignum_message(NULL, file, line, "BIGNUM", bns, ws, "abs==",

crypto/bn/bn_lib.c:662:1: start of procedure BN_set_negative()
  660.   }
  661.   
  662. > void BN_set_negative(BIGNUM *a, int b)
  663.   {
  664.       if (b && !BN_is_zero(a))

crypto/bn/bn_lib.c:664:9: Taking false branch
  662.   void BN_set_negative(BIGNUM *a, int b)
  663.   {
  664.       if (b && !BN_is_zero(a))
                 ^
  665.           a->neg = 1;
  666.       else

crypto/bn/bn_lib.c:667:9: 
  665.           a->neg = 1;
  666.       else
  667. >         a->neg = 0;
  668.   }
  669.   
