crypto/bn/bn_x931p.c:226: error: NULL_DEREFERENCE
  pointer `t` last assigned on line 219 could be null and is dereferenced by call to `BN_num_bits()` at line 226, column 13.
Showing all 32 steps of the trace


crypto/bn/bn_x931p.c:199:1: start of procedure BN_X931_generate_Xpq()
197.    */
198.   
199. > int BN_X931_generate_Xpq(BIGNUM *Xp, BIGNUM *Xq, int nbits, BN_CTX *ctx)
200.   {
201.       BIGNUM *t;

crypto/bn/bn_x931p.c:207:10: Taking false branch
205.        * ...
206.        */
207.       if ((nbits < 1024) || (nbits & 0xff))
                ^
208.           return 0;
209.       nbits >>= 1;

crypto/bn/bn_x931p.c:207:28: Taking false branch
205.        * ...
206.        */
207.       if ((nbits < 1024) || (nbits & 0xff))
                                  ^
208.           return 0;
209.       nbits >>= 1;

crypto/bn/bn_x931p.c:209:5: 
207.       if ((nbits < 1024) || (nbits & 0xff))
208.           return 0;
209. >     nbits >>= 1;
210.       /*
211.        * The random value Xp must be between sqrt(2) * 2^(nbits-1) and 2^nbits

crypto/bn/bn_x931p.c:215:10: 
213.        * exceeded.
214.        */
215. >     if (!BN_rand(Xp, nbits, 1, 0))
216.           goto err;
217.   

crypto/bn/bn_rand.c:199:1: start of procedure BN_rand()
  197.   }
  198.   
  199. > int BN_rand(BIGNUM *rnd, int bits, int top, int bottom)
  200.   {
  201.       return bnrand(0, rnd, bits, top, bottom);

crypto/bn/bn_rand.c:201:5: Skipping bnrand(): empty list of specs
  199.   int BN_rand(BIGNUM *rnd, int bits, int top, int bottom)
  200.   {
  201.       return bnrand(0, rnd, bits, top, bottom);
             ^
  202.   }
  203.   

crypto/bn/bn_rand.c:202:1: return from a call to BN_rand
  200.   {
  201.       return bnrand(0, rnd, bits, top, bottom);
  202. > }
  203.   
  204.   int BN_pseudo_rand(BIGNUM *rnd, int bits, int top, int bottom)

crypto/bn/bn_x931p.c:215:10: Taking false branch
213.        * exceeded.
214.        */
215.       if (!BN_rand(Xp, nbits, 1, 0))
                ^
216.           goto err;
217.   

crypto/bn/bn_x931p.c:218:5: 
216.           goto err;
217.   
218. >     BN_CTX_start(ctx);
219.       t = BN_CTX_get(ctx);
220.   

crypto/bn/bn_ctx.c:235:1: start of procedure BN_CTX_start()
  233.   }
  234.   
  235. > void BN_CTX_start(BN_CTX *ctx)
  236.   {
  237.       CTXDBG_ENTRY("BN_CTX_start", ctx);

crypto/bn/bn_ctx.c:239:9: Taking false branch
  237.       CTXDBG_ENTRY("BN_CTX_start", ctx);
  238.       /* If we're already overflowing ... */
  239.       if (ctx->err_stack || ctx->too_many)
                 ^
  240.           ctx->err_stack++;
  241.       /* (Try to) get a new frame pointer */

crypto/bn/bn_ctx.c:239:27: Taking true branch
  237.       CTXDBG_ENTRY("BN_CTX_start", ctx);
  238.       /* If we're already overflowing ... */
  239.       if (ctx->err_stack || ctx->too_many)
                                   ^
  240.           ctx->err_stack++;
  241.       /* (Try to) get a new frame pointer */

crypto/bn/bn_ctx.c:240:9: 
  238.       /* If we're already overflowing ... */
  239.       if (ctx->err_stack || ctx->too_many)
  240. >         ctx->err_stack++;
  241.       /* (Try to) get a new frame pointer */
  242.       else if (!BN_STACK_push(&ctx->stack, ctx->used)) {

crypto/bn/bn_ctx.c:239:5: 
  237.       CTXDBG_ENTRY("BN_CTX_start", ctx);
  238.       /* If we're already overflowing ... */
  239. >     if (ctx->err_stack || ctx->too_many)
  240.           ctx->err_stack++;
  241.       /* (Try to) get a new frame pointer */

crypto/bn/bn_ctx.c:247:1: return from a call to BN_CTX_start
  245.       }
  246.       CTXDBG_EXIT(ctx);
  247. > }
  248.   
  249.   void BN_CTX_end(BN_CTX *ctx)

crypto/bn/bn_x931p.c:219:5: 
217.   
218.       BN_CTX_start(ctx);
219. >     t = BN_CTX_get(ctx);
220.   
221.       for (i = 0; i < 1000; i++) {

crypto/bn/bn_ctx.c:266:1: start of procedure BN_CTX_get()
  264.   }
  265.   
  266. > BIGNUM *BN_CTX_get(BN_CTX *ctx)
  267.   {
  268.       BIGNUM *ret;

crypto/bn/bn_ctx.c:271:9: Taking true branch
  269.   
  270.       CTXDBG_ENTRY("BN_CTX_get", ctx);
  271.       if (ctx->err_stack || ctx->too_many)
                 ^
  272.           return NULL;
  273.       if ((ret = BN_POOL_get(&ctx->pool, ctx->flags)) == NULL) {

crypto/bn/bn_ctx.c:272:9: 
  270.       CTXDBG_ENTRY("BN_CTX_get", ctx);
  271.       if (ctx->err_stack || ctx->too_many)
  272. >         return NULL;
  273.       if ((ret = BN_POOL_get(&ctx->pool, ctx->flags)) == NULL) {
  274.           /*

crypto/bn/bn_ctx.c:287:1: return from a call to BN_CTX_get
  285.       CTXDBG_RET(ctx, ret);
  286.       return ret;
  287. > }
  288.   
  289.   /************/

crypto/bn/bn_x931p.c:221:10: 
219.       t = BN_CTX_get(ctx);
220.   
221. >     for (i = 0; i < 1000; i++) {
222.           if (!BN_rand(Xq, nbits, 1, 0))
223.               goto err;

crypto/bn/bn_x931p.c:221:17: Loop condition is true. Entering loop body
219.       t = BN_CTX_get(ctx);
220.   
221.       for (i = 0; i < 1000; i++) {
                       ^
222.           if (!BN_rand(Xq, nbits, 1, 0))
223.               goto err;

crypto/bn/bn_x931p.c:222:14: 
220.   
221.       for (i = 0; i < 1000; i++) {
222. >         if (!BN_rand(Xq, nbits, 1, 0))
223.               goto err;
224.           /* Check that |Xp - Xq| > 2^(nbits - 100) */

crypto/bn/bn_rand.c:199:1: start of procedure BN_rand()
  197.   }
  198.   
  199. > int BN_rand(BIGNUM *rnd, int bits, int top, int bottom)
  200.   {
  201.       return bnrand(0, rnd, bits, top, bottom);

crypto/bn/bn_rand.c:201:5: Skipping bnrand(): empty list of specs
  199.   int BN_rand(BIGNUM *rnd, int bits, int top, int bottom)
  200.   {
  201.       return bnrand(0, rnd, bits, top, bottom);
             ^
  202.   }
  203.   

crypto/bn/bn_rand.c:202:1: return from a call to BN_rand
  200.   {
  201.       return bnrand(0, rnd, bits, top, bottom);
  202. > }
  203.   
  204.   int BN_pseudo_rand(BIGNUM *rnd, int bits, int top, int bottom)

crypto/bn/bn_x931p.c:222:14: Taking false branch
220.   
221.       for (i = 0; i < 1000; i++) {
222.           if (!BN_rand(Xq, nbits, 1, 0))
                    ^
223.               goto err;
224.           /* Check that |Xp - Xq| > 2^(nbits - 100) */

crypto/bn/bn_x931p.c:225:9: Skipping BN_sub(): empty list of specs
223.               goto err;
224.           /* Check that |Xp - Xq| > 2^(nbits - 100) */
225.           BN_sub(t, Xp, Xq);
               ^
226.           if (BN_num_bits(t) > (nbits - 100))
227.               break;

crypto/bn/bn_x931p.c:226:13: 
224.           /* Check that |Xp - Xq| > 2^(nbits - 100) */
225.           BN_sub(t, Xp, Xq);
226. >         if (BN_num_bits(t) > (nbits - 100))
227.               break;
228.       }

crypto/bn/bn_lib.c:214:1: start of procedure BN_num_bits()
  212.   }
  213.   
  214. > int BN_num_bits(const BIGNUM *a)
  215.   {
  216.       int i = a->top - 1;

crypto/bn/bn_lib.c:216:5: 
  214.   int BN_num_bits(const BIGNUM *a)
  215.   {
  216. >     int i = a->top - 1;
  217.       bn_check_top(a);
  218.   
