test/ecdhtest.c:390: error: NULL_DEREFERENCE
  pointer `k` last assigned on line 368 could be null and is dereferenced by call to `EC_KEY_free()` at line 390, column 5.
Showing all 20 steps of the trace


test/ecdhtest.c:361:1: start of procedure mk_eckey()
359.   /* Given private value and NID, create EC_KEY structure */
360.   
361. > static EC_KEY *mk_eckey(int nid, const unsigned char *p, size_t plen)
362.   {
363.       int ok = 0;

test/ecdhtest.c:363:5: 
361.   static EC_KEY *mk_eckey(int nid, const unsigned char *p, size_t plen)
362.   {
363. >     int ok = 0;
364.       EC_KEY *k = NULL;
365.       BIGNUM *priv = NULL;

test/ecdhtest.c:364:5: 
362.   {
363.       int ok = 0;
364. >     EC_KEY *k = NULL;
365.       BIGNUM *priv = NULL;
366.       EC_POINT *pub = NULL;

test/ecdhtest.c:365:5: 
363.       int ok = 0;
364.       EC_KEY *k = NULL;
365. >     BIGNUM *priv = NULL;
366.       EC_POINT *pub = NULL;
367.       const EC_GROUP *grp;

test/ecdhtest.c:366:5: 
364.       EC_KEY *k = NULL;
365.       BIGNUM *priv = NULL;
366. >     EC_POINT *pub = NULL;
367.       const EC_GROUP *grp;
368.       k = EC_KEY_new_by_curve_name(nid);

test/ecdhtest.c:368:5: Skipping EC_KEY_new_by_curve_name(): empty list of specs
366.       EC_POINT *pub = NULL;
367.       const EC_GROUP *grp;
368.       k = EC_KEY_new_by_curve_name(nid);
           ^
369.       if (!k)
370.           goto err;

test/ecdhtest.c:369:10: Taking true branch
367.       const EC_GROUP *grp;
368.       k = EC_KEY_new_by_curve_name(nid);
369.       if (!k)
                ^
370.           goto err;
371.       priv = BN_bin2bn(p, plen, NULL);

test/ecdhtest.c:385:2: 
383.           goto err;
384.       ok = 1;
385. >  err:
386.       BN_clear_free(priv);
387.       EC_POINT_free(pub);

test/ecdhtest.c:386:5: 
384.       ok = 1;
385.    err:
386. >     BN_clear_free(priv);
387.       EC_POINT_free(pub);
388.       if (ok)

crypto/bn/bn_lib.c:233:1: start of procedure BN_clear_free()
  231.   
  232.   
  233. > void BN_clear_free(BIGNUM *a)
  234.   {
  235.       int i;

crypto/bn/bn_lib.c:237:9: Taking true branch
  235.       int i;
  236.   
  237.       if (a == NULL)
                 ^
  238.           return;
  239.       bn_check_top(a);

crypto/bn/bn_lib.c:238:9: 
  236.   
  237.       if (a == NULL)
  238. >         return;
  239.       bn_check_top(a);
  240.       if (a->d != NULL) {

crypto/bn/bn_lib.c:249:1: return from a call to BN_clear_free
  247.       if (i)
  248.           OPENSSL_free(a);
  249. > }
  250.   
  251.   void BN_free(BIGNUM *a)

test/ecdhtest.c:387:5: 
385.    err:
386.       BN_clear_free(priv);
387. >     EC_POINT_free(pub);
388.       if (ok)
389.           return k;

crypto/ec/ec_lib.c:697:1: start of procedure EC_POINT_free()
  695.   }
  696.   
  697. > void EC_POINT_free(EC_POINT *point)
  698.   {
  699.       if (!point)

crypto/ec/ec_lib.c:699:10: Taking true branch
  697.   void EC_POINT_free(EC_POINT *point)
  698.   {
  699.       if (!point)
                  ^
  700.           return;
  701.   

crypto/ec/ec_lib.c:700:9: 
  698.   {
  699.       if (!point)
  700. >         return;
  701.   
  702.       if (point->meth->point_finish != 0)

crypto/ec/ec_lib.c:705:1: return from a call to EC_POINT_free
  703.           point->meth->point_finish(point);
  704.       OPENSSL_free(point);
  705. > }
  706.   
  707.   void EC_POINT_clear_free(EC_POINT *point)

test/ecdhtest.c:388:9: Taking false branch
386.       BN_clear_free(priv);
387.       EC_POINT_free(pub);
388.       if (ok)
               ^
389.           return k;
390.       EC_KEY_free(k);

test/ecdhtest.c:390:5: 
388.       if (ok)
389.           return k;
390. >     EC_KEY_free(k);
391.       return NULL;
392.   }
