crypto/bn/bn_x931p.c:124: error: NULL_DEREFERENCE
  pointer `p1` last assigned on line 113 could be null and is dereferenced by call to `bn_x931_derive_pi()` at line 124, column 10.
Showing all 47 steps of the trace


crypto/bn/bn_x931p.c:98:1: start of procedure BN_X931_derive_prime_ex()
96.    */
97.   
98. > int BN_X931_derive_prime_ex(BIGNUM *p, BIGNUM *p1, BIGNUM *p2,
99.                               const BIGNUM *Xp, const BIGNUM *Xp1,
100.                               const BIGNUM *Xp2, const BIGNUM *e, BN_CTX *ctx,

crypto/bn/bn_x931p.c:103:5: 
101.                               BN_GENCB *cb)
102.   {
103. >     int ret = 0;
104.   
105.       BIGNUM *t, *p1p2, *pm1;

crypto/bn/bn_x931p.c:108:10: 
106.   
107.       /* Only even e supported */
108. >     if (!BN_is_odd(e))
109.           return 0;
110.   

crypto/bn/bn_lib.c:912:1: start of procedure BN_is_odd()
  910.   }
  911.   
  912. > int BN_is_odd(const BIGNUM *a)
  913.   {
  914.       return (a->top > 0) && (a->d[0] & 1);

crypto/bn/bn_lib.c:914:13: Condition is true
  912.   int BN_is_odd(const BIGNUM *a)
  913.   {
  914.       return (a->top > 0) && (a->d[0] & 1);
                     ^
  915.   }
  916.   

crypto/bn/bn_lib.c:914:29: Condition is true
  912.   int BN_is_odd(const BIGNUM *a)
  913.   {
  914.       return (a->top > 0) && (a->d[0] & 1);
                                     ^
  915.   }
  916.   

crypto/bn/bn_lib.c:914:12: 
  912.   int BN_is_odd(const BIGNUM *a)
  913.   {
  914. >     return (a->top > 0) && (a->d[0] & 1);
  915.   }
  916.   

crypto/bn/bn_lib.c:914:5: 
  912.   int BN_is_odd(const BIGNUM *a)
  913.   {
  914. >     return (a->top > 0) && (a->d[0] & 1);
  915.   }
  916.   

crypto/bn/bn_lib.c:915:1: return from a call to BN_is_odd
  913.   {
  914.       return (a->top > 0) && (a->d[0] & 1);
  915. > }
  916.   
  917.   int BN_is_negative(const BIGNUM *a)

crypto/bn/bn_x931p.c:108:10: Taking false branch
106.   
107.       /* Only even e supported */
108.       if (!BN_is_odd(e))
                ^
109.           return 0;
110.   

crypto/bn/bn_x931p.c:111:5: 
109.           return 0;
110.   
111. >     BN_CTX_start(ctx);
112.       if (!p1)
113.           p1 = BN_CTX_get(ctx);

crypto/bn/bn_ctx.c:240:1: start of procedure BN_CTX_start()
  238.   }
  239.   
  240. > void BN_CTX_start(BN_CTX *ctx)
  241.   {
  242.       CTXDBG_ENTRY("BN_CTX_start", ctx);

crypto/bn/bn_ctx.c:244:9: Taking true branch
  242.       CTXDBG_ENTRY("BN_CTX_start", ctx);
  243.       /* If we're already overflowing ... */
  244.       if (ctx->err_stack || ctx->too_many)
                 ^
  245.           ctx->err_stack++;
  246.       /* (Try to) get a new frame pointer */

crypto/bn/bn_ctx.c:245:9: 
  243.       /* If we're already overflowing ... */
  244.       if (ctx->err_stack || ctx->too_many)
  245. >         ctx->err_stack++;
  246.       /* (Try to) get a new frame pointer */
  247.       else if (!BN_STACK_push(&ctx->stack, ctx->used)) {

crypto/bn/bn_ctx.c:244:5: 
  242.       CTXDBG_ENTRY("BN_CTX_start", ctx);
  243.       /* If we're already overflowing ... */
  244. >     if (ctx->err_stack || ctx->too_many)
  245.           ctx->err_stack++;
  246.       /* (Try to) get a new frame pointer */

crypto/bn/bn_ctx.c:252:1: return from a call to BN_CTX_start
  250.       }
  251.       CTXDBG_EXIT(ctx);
  252. > }
  253.   
  254.   void BN_CTX_end(BN_CTX *ctx)

crypto/bn/bn_x931p.c:112:10: Taking true branch
110.   
111.       BN_CTX_start(ctx);
112.       if (!p1)
                ^
113.           p1 = BN_CTX_get(ctx);
114.   

crypto/bn/bn_x931p.c:113:9: 
111.       BN_CTX_start(ctx);
112.       if (!p1)
113. >         p1 = BN_CTX_get(ctx);
114.   
115.       if (!p2)

crypto/bn/bn_ctx.c:271:1: start of procedure BN_CTX_get()
  269.   }
  270.   
  271. > BIGNUM *BN_CTX_get(BN_CTX *ctx)
  272.   {
  273.       BIGNUM *ret;

crypto/bn/bn_ctx.c:276:9: Taking true branch
  274.   
  275.       CTXDBG_ENTRY("BN_CTX_get", ctx);
  276.       if (ctx->err_stack || ctx->too_many)
                 ^
  277.           return NULL;
  278.       if ((ret = BN_POOL_get(&ctx->pool, ctx->flags)) == NULL) {

crypto/bn/bn_ctx.c:277:9: 
  275.       CTXDBG_ENTRY("BN_CTX_get", ctx);
  276.       if (ctx->err_stack || ctx->too_many)
  277. >         return NULL;
  278.       if ((ret = BN_POOL_get(&ctx->pool, ctx->flags)) == NULL) {
  279.           /*

crypto/bn/bn_ctx.c:292:1: return from a call to BN_CTX_get
  290.       CTXDBG_RET(ctx, ret);
  291.       return ret;
  292. > }
  293.   
  294.   /************/

crypto/bn/bn_x931p.c:115:10: Taking false branch
113.           p1 = BN_CTX_get(ctx);
114.   
115.       if (!p2)
                ^
116.           p2 = BN_CTX_get(ctx);
117.   

crypto/bn/bn_x931p.c:118:5: 
116.           p2 = BN_CTX_get(ctx);
117.   
118. >     t = BN_CTX_get(ctx);
119.   
120.       p1p2 = BN_CTX_get(ctx);

crypto/bn/bn_ctx.c:271:1: start of procedure BN_CTX_get()
  269.   }
  270.   
  271. > BIGNUM *BN_CTX_get(BN_CTX *ctx)
  272.   {
  273.       BIGNUM *ret;

crypto/bn/bn_ctx.c:276:9: Taking true branch
  274.   
  275.       CTXDBG_ENTRY("BN_CTX_get", ctx);
  276.       if (ctx->err_stack || ctx->too_many)
                 ^
  277.           return NULL;
  278.       if ((ret = BN_POOL_get(&ctx->pool, ctx->flags)) == NULL) {

crypto/bn/bn_ctx.c:277:9: 
  275.       CTXDBG_ENTRY("BN_CTX_get", ctx);
  276.       if (ctx->err_stack || ctx->too_many)
  277. >         return NULL;
  278.       if ((ret = BN_POOL_get(&ctx->pool, ctx->flags)) == NULL) {
  279.           /*

crypto/bn/bn_ctx.c:292:1: return from a call to BN_CTX_get
  290.       CTXDBG_RET(ctx, ret);
  291.       return ret;
  292. > }
  293.   
  294.   /************/

crypto/bn/bn_x931p.c:120:5: 
118.       t = BN_CTX_get(ctx);
119.   
120. >     p1p2 = BN_CTX_get(ctx);
121.   
122.       pm1 = BN_CTX_get(ctx);

crypto/bn/bn_ctx.c:271:1: start of procedure BN_CTX_get()
  269.   }
  270.   
  271. > BIGNUM *BN_CTX_get(BN_CTX *ctx)
  272.   {
  273.       BIGNUM *ret;

crypto/bn/bn_ctx.c:276:9: Taking true branch
  274.   
  275.       CTXDBG_ENTRY("BN_CTX_get", ctx);
  276.       if (ctx->err_stack || ctx->too_many)
                 ^
  277.           return NULL;
  278.       if ((ret = BN_POOL_get(&ctx->pool, ctx->flags)) == NULL) {

crypto/bn/bn_ctx.c:277:9: 
  275.       CTXDBG_ENTRY("BN_CTX_get", ctx);
  276.       if (ctx->err_stack || ctx->too_many)
  277. >         return NULL;
  278.       if ((ret = BN_POOL_get(&ctx->pool, ctx->flags)) == NULL) {
  279.           /*

crypto/bn/bn_ctx.c:292:1: return from a call to BN_CTX_get
  290.       CTXDBG_RET(ctx, ret);
  291.       return ret;
  292. > }
  293.   
  294.   /************/

crypto/bn/bn_x931p.c:122:5: 
120.       p1p2 = BN_CTX_get(ctx);
121.   
122. >     pm1 = BN_CTX_get(ctx);
123.   
124.       if (!bn_x931_derive_pi(p1, Xp1, ctx, cb))

crypto/bn/bn_ctx.c:271:1: start of procedure BN_CTX_get()
  269.   }
  270.   
  271. > BIGNUM *BN_CTX_get(BN_CTX *ctx)
  272.   {
  273.       BIGNUM *ret;

crypto/bn/bn_ctx.c:276:9: Taking true branch
  274.   
  275.       CTXDBG_ENTRY("BN_CTX_get", ctx);
  276.       if (ctx->err_stack || ctx->too_many)
                 ^
  277.           return NULL;
  278.       if ((ret = BN_POOL_get(&ctx->pool, ctx->flags)) == NULL) {

crypto/bn/bn_ctx.c:277:9: 
  275.       CTXDBG_ENTRY("BN_CTX_get", ctx);
  276.       if (ctx->err_stack || ctx->too_many)
  277. >         return NULL;
  278.       if ((ret = BN_POOL_get(&ctx->pool, ctx->flags)) == NULL) {
  279.           /*

crypto/bn/bn_ctx.c:292:1: return from a call to BN_CTX_get
  290.       CTXDBG_RET(ctx, ret);
  291.       return ret;
  292. > }
  293.   
  294.   /************/

crypto/bn/bn_x931p.c:124:10: 
122.       pm1 = BN_CTX_get(ctx);
123.   
124. >     if (!bn_x931_derive_pi(p1, Xp1, ctx, cb))
125.           goto err;
126.   

crypto/bn/bn_x931p.c:71:1: start of procedure bn_x931_derive_pi()
  69.    */
  70.   
  71. > static int bn_x931_derive_pi(BIGNUM *pi, const BIGNUM *Xpi, BN_CTX *ctx,
  72.                                BN_GENCB *cb)
  73.   {

crypto/bn/bn_x931p.c:74:5: 
  72.                                BN_GENCB *cb)
  73.   {
  74. >     int i = 0;
  75.       if (!BN_copy(pi, Xpi))
  76.           return 0;

crypto/bn/bn_x931p.c:75:10: 
  73.   {
  74.       int i = 0;
  75. >     if (!BN_copy(pi, Xpi))
  76.           return 0;
  77.       if (!BN_is_odd(pi) && !BN_add_word(pi, 1))

crypto/bn/bn_lib.c:430:1: start of procedure BN_copy()
    428.   }
    429.   
    430. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
    431.   {
    432.       int i;

crypto/bn/bn_lib.c:438:9: Taking false branch
    436.       bn_check_top(b);
    437.   
    438.       if (a == b)
                   ^
    439.           return (a);
    440.       if (bn_wexpand(a, b->top) == NULL)

crypto/bn/bn_lib.c:440:9: 
    438.       if (a == b)
    439.           return (a);
    440. >     if (bn_wexpand(a, b->top) == NULL)
    441.           return (NULL);
    442.   

crypto/bn/bn_lib.c:993:1: start of procedure bn_wexpand()
      991.   }
      992.   
      993. > BIGNUM *bn_wexpand(BIGNUM *a, int words)
      994.   {
      995.       return (words <= a->dmax) ? a : bn_expand2(a, words);

crypto/bn/bn_lib.c:995:13: 
      993.   BIGNUM *bn_wexpand(BIGNUM *a, int words)
      994.   {
      995. >     return (words <= a->dmax) ? a : bn_expand2(a, words);
      996.   }
      997.   
