crypto/rsa/rsa_chk.c:226: error: NULL_DEREFERENCE
  pointer `ctx` last assigned on line 47 could be null and is dereferenced by call to `BN_CTX_free()` at line 226, column 5.
Showing all 44 steps of the trace


crypto/rsa/rsa_chk.c:19:1: start of procedure RSA_check_key_ex()
17.   }
18.   
19. > int RSA_check_key_ex(const RSA *key, BN_GENCB *cb)
20.   {
21.       BIGNUM *i, *j, *k, *l, *m;

crypto/rsa/rsa_chk.c:23:5: 
21.       BIGNUM *i, *j, *k, *l, *m;
22.       BN_CTX *ctx;
23. >     int ret = 1, ex_primes = 0, idx;
24.       RSA_PRIME_INFO *pinfo;
25.   

crypto/rsa/rsa_chk.c:26:9: Taking false branch
24.       RSA_PRIME_INFO *pinfo;
25.   
26.       if (key->p == NULL || key->q == NULL || key->n == NULL
              ^
27.               || key->e == NULL || key->d == NULL) {
28.           RSAerr(RSA_F_RSA_CHECK_KEY_EX, RSA_R_VALUE_MISSING);

crypto/rsa/rsa_chk.c:26:27: Taking false branch
24.       RSA_PRIME_INFO *pinfo;
25.   
26.       if (key->p == NULL || key->q == NULL || key->n == NULL
                                ^
27.               || key->e == NULL || key->d == NULL) {
28.           RSAerr(RSA_F_RSA_CHECK_KEY_EX, RSA_R_VALUE_MISSING);

crypto/rsa/rsa_chk.c:26:45: Taking false branch
24.       RSA_PRIME_INFO *pinfo;
25.   
26.       if (key->p == NULL || key->q == NULL || key->n == NULL
                                                  ^
27.               || key->e == NULL || key->d == NULL) {
28.           RSAerr(RSA_F_RSA_CHECK_KEY_EX, RSA_R_VALUE_MISSING);

crypto/rsa/rsa_chk.c:27:16: Taking false branch
25.   
26.       if (key->p == NULL || key->q == NULL || key->n == NULL
27.               || key->e == NULL || key->d == NULL) {
                     ^
28.           RSAerr(RSA_F_RSA_CHECK_KEY_EX, RSA_R_VALUE_MISSING);
29.           return 0;

crypto/rsa/rsa_chk.c:27:34: Taking false branch
25.   
26.       if (key->p == NULL || key->q == NULL || key->n == NULL
27.               || key->e == NULL || key->d == NULL) {
                                       ^
28.           RSAerr(RSA_F_RSA_CHECK_KEY_EX, RSA_R_VALUE_MISSING);
29.           return 0;

crypto/rsa/rsa_chk.c:33:9: Taking false branch
31.   
32.       /* multi-prime? */
33.       if (key->version == RSA_ASN1_VERSION_MULTI) {
              ^
34.           ex_primes = sk_RSA_PRIME_INFO_num(key->prime_infos);
35.           if (ex_primes <= 0

crypto/rsa/rsa_chk.c:42:5: Skipping BN_new(): empty list of specs
40.       }
41.   
42.       i = BN_new();
          ^
43.       j = BN_new();
44.       k = BN_new();

crypto/rsa/rsa_chk.c:43:5: Skipping BN_new(): empty list of specs
41.   
42.       i = BN_new();
43.       j = BN_new();
          ^
44.       k = BN_new();
45.       l = BN_new();

crypto/rsa/rsa_chk.c:44:5: Skipping BN_new(): empty list of specs
42.       i = BN_new();
43.       j = BN_new();
44.       k = BN_new();
          ^
45.       l = BN_new();
46.       m = BN_new();

crypto/rsa/rsa_chk.c:45:5: Skipping BN_new(): empty list of specs
43.       j = BN_new();
44.       k = BN_new();
45.       l = BN_new();
          ^
46.       m = BN_new();
47.       ctx = BN_CTX_new();

crypto/rsa/rsa_chk.c:46:5: Skipping BN_new(): empty list of specs
44.       k = BN_new();
45.       l = BN_new();
46.       m = BN_new();
          ^
47.       ctx = BN_CTX_new();
48.       if (i == NULL || j == NULL || k == NULL || l == NULL

crypto/rsa/rsa_chk.c:47:5: Skipping BN_CTX_new(): empty list of specs
45.       l = BN_new();
46.       m = BN_new();
47.       ctx = BN_CTX_new();
          ^
48.       if (i == NULL || j == NULL || k == NULL || l == NULL
49.               || m == NULL || ctx == NULL) {

crypto/rsa/rsa_chk.c:48:9: Taking false branch
46.       m = BN_new();
47.       ctx = BN_CTX_new();
48.       if (i == NULL || j == NULL || k == NULL || l == NULL
              ^
49.               || m == NULL || ctx == NULL) {
50.           ret = -1;

crypto/rsa/rsa_chk.c:48:22: Taking false branch
46.       m = BN_new();
47.       ctx = BN_CTX_new();
48.       if (i == NULL || j == NULL || k == NULL || l == NULL
                           ^
49.               || m == NULL || ctx == NULL) {
50.           ret = -1;

crypto/rsa/rsa_chk.c:48:35: Taking false branch
46.       m = BN_new();
47.       ctx = BN_CTX_new();
48.       if (i == NULL || j == NULL || k == NULL || l == NULL
                                        ^
49.               || m == NULL || ctx == NULL) {
50.           ret = -1;

crypto/rsa/rsa_chk.c:48:48: Taking false branch
46.       m = BN_new();
47.       ctx = BN_CTX_new();
48.       if (i == NULL || j == NULL || k == NULL || l == NULL
                                                     ^
49.               || m == NULL || ctx == NULL) {
50.           ret = -1;

crypto/rsa/rsa_chk.c:49:16: Taking false branch
47.       ctx = BN_CTX_new();
48.       if (i == NULL || j == NULL || k == NULL || l == NULL
49.               || m == NULL || ctx == NULL) {
                     ^
50.           ret = -1;
51.           RSAerr(RSA_F_RSA_CHECK_KEY_EX, ERR_R_MALLOC_FAILURE);

crypto/rsa/rsa_chk.c:49:29: Taking true branch
47.       ctx = BN_CTX_new();
48.       if (i == NULL || j == NULL || k == NULL || l == NULL
49.               || m == NULL || ctx == NULL) {
                                  ^
50.           ret = -1;
51.           RSAerr(RSA_F_RSA_CHECK_KEY_EX, ERR_R_MALLOC_FAILURE);

crypto/rsa/rsa_chk.c:50:9: 
48.       if (i == NULL || j == NULL || k == NULL || l == NULL
49.               || m == NULL || ctx == NULL) {
50. >         ret = -1;
51.           RSAerr(RSA_F_RSA_CHECK_KEY_EX, ERR_R_MALLOC_FAILURE);
52.           goto err;

crypto/rsa/rsa_chk.c:51:9: Skipping ERR_put_error(): empty list of specs
49.               || m == NULL || ctx == NULL) {
50.           ret = -1;
51.           RSAerr(RSA_F_RSA_CHECK_KEY_EX, ERR_R_MALLOC_FAILURE);
              ^
52.           goto err;
53.       }

crypto/rsa/rsa_chk.c:220:2: 
218.       }
219.   
220. >  err:
221.       BN_free(i);
222.       BN_free(j);

crypto/rsa/rsa_chk.c:221:5: Skipping BN_free(): empty list of specs
219.   
220.    err:
221.       BN_free(i);
           ^
222.       BN_free(j);
223.       BN_free(k);

crypto/rsa/rsa_chk.c:222:5: Skipping BN_free(): empty list of specs
220.    err:
221.       BN_free(i);
222.       BN_free(j);
           ^
223.       BN_free(k);
224.       BN_free(l);

crypto/rsa/rsa_chk.c:223:5: Skipping BN_free(): empty list of specs
221.       BN_free(i);
222.       BN_free(j);
223.       BN_free(k);
           ^
224.       BN_free(l);
225.       BN_free(m);

crypto/rsa/rsa_chk.c:224:5: Skipping BN_free(): empty list of specs
222.       BN_free(j);
223.       BN_free(k);
224.       BN_free(l);
           ^
225.       BN_free(m);
226.       BN_CTX_free(ctx);

crypto/rsa/rsa_chk.c:225:5: Skipping BN_free(): empty list of specs
223.       BN_free(k);
224.       BN_free(l);
225.       BN_free(m);
           ^
226.       BN_CTX_free(ctx);
227.       return ret;

crypto/rsa/rsa_chk.c:226:5: 
224.       BN_free(l);
225.       BN_free(m);
226. >     BN_CTX_free(ctx);
227.       return ret;
228.   }

crypto/bn/bn_ctx.c:157:1: start of procedure BN_CTX_free()
  155.   }
  156.   
  157. > void BN_CTX_free(BN_CTX *ctx)
  158.   {
  159.   #ifdef BN_CTX_DEBUG

crypto/bn/bn_ctx.c:174:5: 
  172.       }
  173.   #endif
  174. >     BN_STACK_finish(&ctx->stack);
  175.       BN_POOL_finish(&ctx->pool);
  176.       OPENSSL_free(ctx);

crypto/bn/bn_ctx.c:243:1: start of procedure BN_STACK_finish()
    241.   }
    242.   
    243. > static void BN_STACK_finish(BN_STACK *st)
    244.   {
    245.       OPENSSL_free(st->indexes);

crypto/bn/bn_ctx.c:245:5: 
    243.   static void BN_STACK_finish(BN_STACK *st)
    244.   {
    245. >     OPENSSL_free(st->indexes);
    246.       st->indexes = NULL;
    247.   }

crypto/mem.c:295:1: start of procedure CRYPTO_free()
      293.   }
      294.   
      295. > void CRYPTO_free(void *str, const char *file, int line)
      296.   {
      297.       INCREMENT(free_count);

crypto/mem.c:298:9: Taking true branch
      296.   {
      297.       INCREMENT(free_count);
      298.       if (free_impl != NULL && free_impl != &CRYPTO_free) {
                     ^
      299.           free_impl(str, file, line);
      300.           return;

crypto/mem.c:298:30: Taking true branch
      296.   {
      297.       INCREMENT(free_count);
      298.       if (free_impl != NULL && free_impl != &CRYPTO_free) {
                                          ^
      299.           free_impl(str, file, line);
      300.           return;

crypto/mem.c:299:9: Skipping __function_pointer__(): unresolved function pointer
      297.       INCREMENT(free_count);
      298.       if (free_impl != NULL && free_impl != &CRYPTO_free) {
      299.           free_impl(str, file, line);
                     ^
      300.           return;
      301.       }

crypto/mem.c:300:9: 
      298.       if (free_impl != NULL && free_impl != &CRYPTO_free) {
      299.           free_impl(str, file, line);
      300. >         return;
      301.       }
      302.   

crypto/mem.c:314:1: return from a call to CRYPTO_free
      312.       free(str);
      313.   #endif
      314. > }
      315.   
      316.   void CRYPTO_clear_free(void *str, size_t num, const char *file, int line)

crypto/bn/bn_ctx.c:246:5: 
    244.   {
    245.       OPENSSL_free(st->indexes);
    246. >     st->indexes = NULL;
    247.   }
    248.   

crypto/bn/bn_ctx.c:247:1: return from a call to BN_STACK_finish
    245.       OPENSSL_free(st->indexes);
    246.       st->indexes = NULL;
    247. > }
    248.   
    249.   

crypto/bn/bn_ctx.c:175:5: 
  173.   #endif
  174.       BN_STACK_finish(&ctx->stack);
  175. >     BN_POOL_finish(&ctx->pool);
  176.       OPENSSL_free(ctx);
  177.   }

crypto/bn/bn_ctx.c:284:1: start of procedure BN_POOL_finish()
    282.   }
    283.   
    284. > static void BN_POOL_finish(BN_POOL *p)
    285.   {
    286.       unsigned int loop;

crypto/bn/bn_ctx.c:289:12: Loop condition is false. Leaving loop
    287.       BIGNUM *bn;
    288.   
    289.       while (p->head) {
                      ^
    290.           for (loop = 0, bn = p->head->vals; loop++ < BN_CTX_POOL_SIZE; bn++)
    291.               if (bn->d)
