crypto/bn/bn_x931p.c:187: error: NULL_DEREFERENCE
  pointer `t` last assigned on line 180 could be null and is dereferenced by call to `BN_num_bits()` at line 187, column 13.
Showing all 32 steps of the trace


crypto/bn/bn_x931p.c:160:1: start of procedure BN_X931_generate_Xpq()
158.    */
159.   
160. > int BN_X931_generate_Xpq(BIGNUM *Xp, BIGNUM *Xq, int nbits, BN_CTX *ctx)
161.   {
162.       BIGNUM *t;

crypto/bn/bn_x931p.c:168:10: Taking false branch
166.        * ...
167.        */
168.       if ((nbits < 1024) || (nbits & 0xff))
                ^
169.           return 0;
170.       nbits >>= 1;

crypto/bn/bn_x931p.c:168:28: Taking false branch
166.        * ...
167.        */
168.       if ((nbits < 1024) || (nbits & 0xff))
                                  ^
169.           return 0;
170.       nbits >>= 1;

crypto/bn/bn_x931p.c:170:5: 
168.       if ((nbits < 1024) || (nbits & 0xff))
169.           return 0;
170. >     nbits >>= 1;
171.       /*
172.        * The random value Xp must be between sqrt(2) * 2^(nbits-1) and 2^nbits

crypto/bn/bn_x931p.c:176:10: 
174.        * exceeded.
175.        */
176. >     if (!BN_rand(Xp, nbits, BN_RAND_TOP_TWO, BN_RAND_BOTTOM_ANY))
177.           goto err;
178.   

crypto/bn/bn_rand.c:96:1: start of procedure BN_rand()
  94.   }
  95.   
  96. > int BN_rand(BIGNUM *rnd, int bits, int top, int bottom)
  97.   {
  98.       return bnrand(0, rnd, bits, top, bottom);

crypto/bn/bn_rand.c:98:5: Skipping bnrand(): empty list of specs
  96.   int BN_rand(BIGNUM *rnd, int bits, int top, int bottom)
  97.   {
  98.       return bnrand(0, rnd, bits, top, bottom);
             ^
  99.   }
  100.   

crypto/bn/bn_rand.c:99:1: return from a call to BN_rand
  97.   {
  98.       return bnrand(0, rnd, bits, top, bottom);
  99. > }
  100.   
  101.   int BN_pseudo_rand(BIGNUM *rnd, int bits, int top, int bottom)

crypto/bn/bn_x931p.c:176:10: Taking false branch
174.        * exceeded.
175.        */
176.       if (!BN_rand(Xp, nbits, BN_RAND_TOP_TWO, BN_RAND_BOTTOM_ANY))
                ^
177.           goto err;
178.   

crypto/bn/bn_x931p.c:179:5: 
177.           goto err;
178.   
179. >     BN_CTX_start(ctx);
180.       t = BN_CTX_get(ctx);
181.   

crypto/bn/bn_ctx.c:181:1: start of procedure BN_CTX_start()
  179.   }
  180.   
  181. > void BN_CTX_start(BN_CTX *ctx)
  182.   {
  183.       CTXDBG_ENTRY("BN_CTX_start", ctx);

crypto/bn/bn_ctx.c:185:9: Taking false branch
  183.       CTXDBG_ENTRY("BN_CTX_start", ctx);
  184.       /* If we're already overflowing ... */
  185.       if (ctx->err_stack || ctx->too_many)
                 ^
  186.           ctx->err_stack++;
  187.       /* (Try to) get a new frame pointer */

crypto/bn/bn_ctx.c:185:27: Taking true branch
  183.       CTXDBG_ENTRY("BN_CTX_start", ctx);
  184.       /* If we're already overflowing ... */
  185.       if (ctx->err_stack || ctx->too_many)
                                   ^
  186.           ctx->err_stack++;
  187.       /* (Try to) get a new frame pointer */

crypto/bn/bn_ctx.c:186:9: 
  184.       /* If we're already overflowing ... */
  185.       if (ctx->err_stack || ctx->too_many)
  186. >         ctx->err_stack++;
  187.       /* (Try to) get a new frame pointer */
  188.       else if (!BN_STACK_push(&ctx->stack, ctx->used)) {

crypto/bn/bn_ctx.c:185:5: 
  183.       CTXDBG_ENTRY("BN_CTX_start", ctx);
  184.       /* If we're already overflowing ... */
  185. >     if (ctx->err_stack || ctx->too_many)
  186.           ctx->err_stack++;
  187.       /* (Try to) get a new frame pointer */

crypto/bn/bn_ctx.c:193:1: return from a call to BN_CTX_start
  191.       }
  192.       CTXDBG_EXIT(ctx);
  193. > }
  194.   
  195.   void BN_CTX_end(BN_CTX *ctx)

crypto/bn/bn_x931p.c:180:5: 
178.   
179.       BN_CTX_start(ctx);
180. >     t = BN_CTX_get(ctx);
181.   
182.       for (i = 0; i < 1000; i++) {

crypto/bn/bn_ctx.c:212:1: start of procedure BN_CTX_get()
  210.   }
  211.   
  212. > BIGNUM *BN_CTX_get(BN_CTX *ctx)
  213.   {
  214.       BIGNUM *ret;

crypto/bn/bn_ctx.c:217:9: Taking true branch
  215.   
  216.       CTXDBG_ENTRY("BN_CTX_get", ctx);
  217.       if (ctx->err_stack || ctx->too_many)
                 ^
  218.           return NULL;
  219.       if ((ret = BN_POOL_get(&ctx->pool, ctx->flags)) == NULL) {

crypto/bn/bn_ctx.c:218:9: 
  216.       CTXDBG_ENTRY("BN_CTX_get", ctx);
  217.       if (ctx->err_stack || ctx->too_many)
  218. >         return NULL;
  219.       if ((ret = BN_POOL_get(&ctx->pool, ctx->flags)) == NULL) {
  220.           /*

crypto/bn/bn_ctx.c:233:1: return from a call to BN_CTX_get
  231.       CTXDBG_RET(ctx, ret);
  232.       return ret;
  233. > }
  234.   
  235.   /************/

crypto/bn/bn_x931p.c:182:10: 
180.       t = BN_CTX_get(ctx);
181.   
182. >     for (i = 0; i < 1000; i++) {
183.           if (!BN_rand(Xq, nbits, BN_RAND_TOP_TWO, BN_RAND_BOTTOM_ANY))
184.               goto err;

crypto/bn/bn_x931p.c:182:17: Loop condition is true. Entering loop body
180.       t = BN_CTX_get(ctx);
181.   
182.       for (i = 0; i < 1000; i++) {
                       ^
183.           if (!BN_rand(Xq, nbits, BN_RAND_TOP_TWO, BN_RAND_BOTTOM_ANY))
184.               goto err;

crypto/bn/bn_x931p.c:183:14: 
181.   
182.       for (i = 0; i < 1000; i++) {
183. >         if (!BN_rand(Xq, nbits, BN_RAND_TOP_TWO, BN_RAND_BOTTOM_ANY))
184.               goto err;
185.           /* Check that |Xp - Xq| > 2^(nbits - 100) */

crypto/bn/bn_rand.c:96:1: start of procedure BN_rand()
  94.   }
  95.   
  96. > int BN_rand(BIGNUM *rnd, int bits, int top, int bottom)
  97.   {
  98.       return bnrand(0, rnd, bits, top, bottom);

crypto/bn/bn_rand.c:98:5: Skipping bnrand(): empty list of specs
  96.   int BN_rand(BIGNUM *rnd, int bits, int top, int bottom)
  97.   {
  98.       return bnrand(0, rnd, bits, top, bottom);
             ^
  99.   }
  100.   

crypto/bn/bn_rand.c:99:1: return from a call to BN_rand
  97.   {
  98.       return bnrand(0, rnd, bits, top, bottom);
  99. > }
  100.   
  101.   int BN_pseudo_rand(BIGNUM *rnd, int bits, int top, int bottom)

crypto/bn/bn_x931p.c:183:14: Taking false branch
181.   
182.       for (i = 0; i < 1000; i++) {
183.           if (!BN_rand(Xq, nbits, BN_RAND_TOP_TWO, BN_RAND_BOTTOM_ANY))
                    ^
184.               goto err;
185.           /* Check that |Xp - Xq| > 2^(nbits - 100) */

crypto/bn/bn_x931p.c:186:9: Skipping BN_sub(): empty list of specs
184.               goto err;
185.           /* Check that |Xp - Xq| > 2^(nbits - 100) */
186.           BN_sub(t, Xp, Xq);
               ^
187.           if (BN_num_bits(t) > (nbits - 100))
188.               break;

crypto/bn/bn_x931p.c:187:13: 
185.           /* Check that |Xp - Xq| > 2^(nbits - 100) */
186.           BN_sub(t, Xp, Xq);
187. >         if (BN_num_bits(t) > (nbits - 100))
188.               break;
189.       }

crypto/bn/bn_lib.c:161:1: start of procedure BN_num_bits()
  159.   }
  160.   
  161. > int BN_num_bits(const BIGNUM *a)
  162.   {
  163.       int i = a->top - 1;

crypto/bn/bn_lib.c:163:5: 
  161.   int BN_num_bits(const BIGNUM *a)
  162.   {
  163. >     int i = a->top - 1;
  164.       bn_check_top(a);
  165.   
