test/sslapitest.c:704: error: NULL_DEREFERENCE
  pointer `sctx` last assigned on line 639 could be null and is dereferenced by call to `SSL_CTX_free()` at line 704, column 5.
Showing all 37 steps of the trace


test/sslapitest.c:634:1: start of procedure execute_test_large_message()
632.   #endif
633.   
634. > static int execute_test_large_message(const SSL_METHOD *smeth,
635.                                         const SSL_METHOD *cmeth,
636.                                         int min_version, int max_version,

test/sslapitest.c:639:5: 
637.                                         int read_ahead)
638.   {
639. >     SSL_CTX *cctx = NULL, *sctx = NULL;
640.       SSL *clientssl = NULL, *serverssl = NULL;
641.       int testresult = 0;

test/sslapitest.c:640:5: 
638.   {
639.       SSL_CTX *cctx = NULL, *sctx = NULL;
640. >     SSL *clientssl = NULL, *serverssl = NULL;
641.       int testresult = 0;
642.       int i;

test/sslapitest.c:641:5: 
639.       SSL_CTX *cctx = NULL, *sctx = NULL;
640.       SSL *clientssl = NULL, *serverssl = NULL;
641. >     int testresult = 0;
642.       int i;
643.       BIO *certbio = NULL;

test/sslapitest.c:643:5: 
641.       int testresult = 0;
642.       int i;
643. >     BIO *certbio = NULL;
644.       X509 *chaincert = NULL;
645.       int certlen;

test/sslapitest.c:644:5: 
642.       int i;
643.       BIO *certbio = NULL;
644. >     X509 *chaincert = NULL;
645.       int certlen;
646.   

test/sslapitest.c:647:10: Skipping BIO_new_file(): empty list of specs
645.       int certlen;
646.   
647.       if (!TEST_ptr(certbio = BIO_new_file(cert, "r")))
                ^
648.           goto end;
649.       chaincert = PEM_read_bio_X509(certbio, NULL, NULL, NULL);

test/testutil/tests.c:252:1: start of procedure test_ptr()
  250.   }
  251.   
  252. > int test_ptr(const char *file, int line, const char *s, const void *p)
  253.   {
  254.       if (p != NULL)

test/testutil/tests.c:254:9: Taking false branch
  252.   int test_ptr(const char *file, int line, const char *s, const void *p)
  253.   {
  254.       if (p != NULL)
                 ^
  255.           return 1;
  256.       test_fail_message(NULL, file, line, "ptr", s, "NULL", "!=", "%p", p);

test/testutil/tests.c:256:5: Skipping test_fail_message(): empty list of specs
  254.       if (p != NULL)
  255.           return 1;
  256.       test_fail_message(NULL, file, line, "ptr", s, "NULL", "!=", "%p", p);
             ^
  257.       return 0;
  258.   }

test/testutil/tests.c:257:5: 
  255.           return 1;
  256.       test_fail_message(NULL, file, line, "ptr", s, "NULL", "!=", "%p", p);
  257. >     return 0;
  258.   }
  259.   

test/testutil/tests.c:258:1: return from a call to test_ptr
  256.       test_fail_message(NULL, file, line, "ptr", s, "NULL", "!=", "%p", p);
  257.       return 0;
  258. > }
  259.   
  260.   int test_true(const char *file, int line, const char *s, int b)

test/sslapitest.c:647:10: Taking true branch
645.       int certlen;
646.   
647.       if (!TEST_ptr(certbio = BIO_new_file(cert, "r")))
                ^
648.           goto end;
649.       chaincert = PEM_read_bio_X509(certbio, NULL, NULL, NULL);

test/sslapitest.c:700:2: 
698.   
699.       testresult = 1;
700. >  end:
701.       X509_free(chaincert);
702.       SSL_free(serverssl);

test/sslapitest.c:701:5: 
699.       testresult = 1;
700.    end:
701. >     X509_free(chaincert);
702.       SSL_free(serverssl);
703.       SSL_free(clientssl);

crypto/x509/x_x509.c:118:1: start of procedure X509_free()
  116.   } ASN1_SEQUENCE_END_ref(X509, X509)
  117.   
  118. > IMPLEMENT_ASN1_FUNCTIONS(X509)
  119.   IMPLEMENT_ASN1_DUP_FUNCTION(X509)
  120.   

crypto/x509/x_x509.c:116:3: start of procedure X509_it()
    114.           ASN1_EMBED(X509, sig_alg, X509_ALGOR),
    115.           ASN1_EMBED(X509, signature, ASN1_BIT_STRING)
    116.   } ASN1_SEQUENCE_END_ref(X509, X509)
             ^
    117.   
    118.   IMPLEMENT_ASN1_FUNCTIONS(X509)

crypto/x509/x_x509.c:116:3: return from a call to X509_it
    114.           ASN1_EMBED(X509, sig_alg, X509_ALGOR),
    115.           ASN1_EMBED(X509, signature, ASN1_BIT_STRING)
    116.   } ASN1_SEQUENCE_END_ref(X509, X509)
             ^
    117.   
    118.   IMPLEMENT_ASN1_FUNCTIONS(X509)

crypto/asn1/tasn_fre.c:18:1: start of procedure ASN1_item_free()
    16.   /* Free up an ASN1 structure */
    17.   
    18. > void ASN1_item_free(ASN1_VALUE *val, const ASN1_ITEM *it)
    19.   {
    20.       asn1_item_embed_free(&val, it, 0);

crypto/asn1/tasn_fre.c:20:5: Skipping asn1_item_embed_free(): empty list of specs
    18.   void ASN1_item_free(ASN1_VALUE *val, const ASN1_ITEM *it)
    19.   {
    20.       asn1_item_embed_free(&val, it, 0);
              ^
    21.   }
    22.   

crypto/asn1/tasn_fre.c:21:1: return from a call to ASN1_item_free
    19.   {
    20.       asn1_item_embed_free(&val, it, 0);
    21. > }
    22.   
    23.   void ASN1_item_ex_free(ASN1_VALUE **pval, const ASN1_ITEM *it)

crypto/x509/x_x509.c:118:1: return from a call to X509_free
  116.   } ASN1_SEQUENCE_END_ref(X509, X509)
  117.   
  118. > IMPLEMENT_ASN1_FUNCTIONS(X509)
  119.   IMPLEMENT_ASN1_DUP_FUNCTION(X509)
  120.   

test/sslapitest.c:702:5: Skipping SSL_free(): empty list of specs
700.    end:
701.       X509_free(chaincert);
702.       SSL_free(serverssl);
           ^
703.       SSL_free(clientssl);
704.       SSL_CTX_free(sctx);

test/sslapitest.c:703:5: Skipping SSL_free(): empty list of specs
701.       X509_free(chaincert);
702.       SSL_free(serverssl);
703.       SSL_free(clientssl);
           ^
704.       SSL_CTX_free(sctx);
705.       SSL_CTX_free(cctx);

test/sslapitest.c:704:5: 
702.       SSL_free(serverssl);
703.       SSL_free(clientssl);
704. >     SSL_CTX_free(sctx);
705.       SSL_CTX_free(cctx);
706.   

ssl/ssl_lib.c:3240:1: start of procedure SSL_CTX_free()
  3238.   }
  3239.   
  3240. > void SSL_CTX_free(SSL_CTX *a)
  3241.   {
  3242.       int i;

ssl/ssl_lib.c:3244:9: Taking false branch
  3242.       int i;
  3243.   
  3244.       if (a == NULL)
                  ^
  3245.           return;
  3246.   

ssl/ssl_lib.c:3247:5: 
  3245.           return;
  3246.   
  3247. >     CRYPTO_DOWN_REF(&a->references, &i, a->lock);
  3248.       REF_PRINT_COUNT("SSL_CTX", a);
  3249.       if (i > 0)

include/internal/refcount.h:49:1: start of procedure CRYPTO_DOWN_REF()
    47.    * otherwise imply an acquire fence. Hence conditional acquire fence...
    48.    */
    49. > static inline int CRYPTO_DOWN_REF(_Atomic int *val, int *ret, void *lock)
    50.   {
    51.       *ret = atomic_fetch_sub_explicit(val, 1, memory_order_relaxed) - 1;

include/internal/refcount.h:51:5: 
    49.   static inline int CRYPTO_DOWN_REF(_Atomic int *val, int *ret, void *lock)
    50.   {
    51. >     *ret = atomic_fetch_sub_explicit(val, 1, memory_order_relaxed) - 1;
    52.       if (*ret == 0)
    53.           atomic_thread_fence(memory_order_acquire);

include/internal/refcount.h:52:9: Taking true branch
    50.   {
    51.       *ret = atomic_fetch_sub_explicit(val, 1, memory_order_relaxed) - 1;
    52.       if (*ret == 0)
                  ^
    53.           atomic_thread_fence(memory_order_acquire);
    54.       return 1;

include/internal/refcount.h:53:9: Skipping __c11_atomic_thread_fence(): method has no implementation
    51.       *ret = atomic_fetch_sub_explicit(val, 1, memory_order_relaxed) - 1;
    52.       if (*ret == 0)
    53.           atomic_thread_fence(memory_order_acquire);
                  ^
    54.       return 1;
    55.   }

include/internal/refcount.h:54:5: 
    52.       if (*ret == 0)
    53.           atomic_thread_fence(memory_order_acquire);
    54. >     return 1;
    55.   }
    56.   

include/internal/refcount.h:55:1: return from a call to CRYPTO_DOWN_REF
    53.           atomic_thread_fence(memory_order_acquire);
    54.       return 1;
    55. > }
    56.   
    57.   #  elif defined(__GNUC__) && defined(__ATOMIC_RELAXED) && __GCC_ATOMIC_INT_LOCK_FREE > 0

ssl/ssl_lib.c:3249:9: Taking true branch
  3247.       CRYPTO_DOWN_REF(&a->references, &i, a->lock);
  3248.       REF_PRINT_COUNT("SSL_CTX", a);
  3249.       if (i > 0)
                  ^
  3250.           return;
  3251.       REF_ASSERT_ISNT(i < 0);

ssl/ssl_lib.c:3250:9: 
  3248.       REF_PRINT_COUNT("SSL_CTX", a);
  3249.       if (i > 0)
  3250. >         return;
  3251.       REF_ASSERT_ISNT(i < 0);
  3252.   

ssl/ssl_lib.c:3302:1: return from a call to SSL_CTX_free
  3300.   
  3301.       OPENSSL_free(a);
  3302. > }
  3303.   
  3304.   void SSL_CTX_set_default_passwd_cb(SSL_CTX *ctx, pem_password_cb *cb)

static int execute_test_large_message(const SSL_METHOD *smeth,
                                      const SSL_METHOD *cmeth,
                                      int min_version, int max_version,
                                      int read_ahead)
{
    SSL_CTX *cctx = NULL, *sctx = NULL;
    SSL *clientssl = NULL, *serverssl = NULL;
    int testresult = 0;
    int i;
    BIO *certbio = NULL;
    X509 *chaincert = NULL;
    int certlen;
    if (!TEST_ptr(certbio = BIO_new_file(cert, "r")))
        goto end;
    chaincert = PEM_read_bio_X509(certbio, NULL, NULL, NULL);
    BIO_free(certbio);
    certbio = NULL;
    if (!TEST_ptr(chaincert))
        goto end;
    if (!TEST_true(create_ssl_ctx_pair(smeth, cmeth, min_version, max_version,
                                       &sctx, &cctx, cert, privkey)))
        goto end;
    if (read_ahead) {
        SSL_CTX_set_read_ahead(cctx, 1);
    }
    certlen = i2d_X509(chaincert, NULL);
    OPENSSL_assert(certlen * NUM_EXTRA_CERTS >
                   (SSL3_RT_MAX_PLAIN_LENGTH * 4) / 3);
    for (i = 0; i < NUM_EXTRA_CERTS; i++) {
        if (!X509_up_ref(chaincert))
            goto end;
        if (!SSL_CTX_add_extra_chain_cert(sctx, chaincert)) {
            X509_free(chaincert);
            goto end;
        }
    }
    if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
                                      NULL, NULL))
            || !TEST_true(create_ssl_connection(serverssl, clientssl,
                                                SSL_ERROR_NONE)))
        goto end;
    if (!TEST_true(SSL_clear(serverssl)))
        goto end;
    testresult = 1;
 end:
    X509_free(chaincert);
    SSL_free(serverssl);
    SSL_free(clientssl);
    SSL_CTX_free(sctx);
    SSL_CTX_free(cctx);
    return testresult;
}
['static int execute_test_large_message(const SSL_METHOD *smeth,\n                                      const SSL_METHOD *cmeth,\n                                      int min_version, int max_version,\n                                      int read_ahead)\n{\n    SSL_CTX *cctx = NULL, *sctx = NULL;\n    SSL *clientssl = NULL, *serverssl = NULL;\n    int testresult = 0;\n    int i;\n    BIO *certbio = NULL;\n    X509 *chaincert = NULL;\n    int certlen;\n    if (!TEST_ptr(certbio = BIO_new_file(cert, "r")))\n        goto end;\n    chaincert = PEM_read_bio_X509(certbio, NULL, NULL, NULL);\n    BIO_free(certbio);\n    certbio = NULL;\n    if (!TEST_ptr(chaincert))\n        goto end;\n    if (!TEST_true(create_ssl_ctx_pair(smeth, cmeth, min_version, max_version,\n                                       &sctx, &cctx, cert, privkey)))\n        goto end;\n    if (read_ahead) {\n        SSL_CTX_set_read_ahead(cctx, 1);\n    }\n    certlen = i2d_X509(chaincert, NULL);\n    OPENSSL_assert(certlen * NUM_EXTRA_CERTS >\n                   (SSL3_RT_MAX_PLAIN_LENGTH * 4) / 3);\n    for (i = 0; i < NUM_EXTRA_CERTS; i++) {\n        if (!X509_up_ref(chaincert))\n            goto end;\n        if (!SSL_CTX_add_extra_chain_cert(sctx, chaincert)) {\n            X509_free(chaincert);\n            goto end;\n        }\n    }\n    if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,\n                                      NULL, NULL))\n            || !TEST_true(create_ssl_connection(serverssl, clientssl,\n                                                SSL_ERROR_NONE)))\n        goto end;\n    if (!TEST_true(SSL_clear(serverssl)))\n        goto end;\n    testresult = 1;\n end:\n    X509_free(chaincert);\n    SSL_free(serverssl);\n    SSL_free(clientssl);\n    SSL_CTX_free(sctx);\n    SSL_CTX_free(cctx);\n    return testresult;\n}', 'int test_ptr(const char *file, int line, const char *s, const void *p)\n{\n    if (p != NULL)\n        return 1;\n    test_fail_message(NULL, file, line, "ptr", s, "NULL", "!=", "%p", p);\n    return 0;\n}', 'IMPLEMENT_ASN1_FUNCTIONS(X509)', 'ASN1_SEQUENCE_END_ref(X509, X509)', 'void ASN1_item_free(ASN1_VALUE *val, const ASN1_ITEM *it)\n{\n    asn1_item_embed_free(&val, it, 0);\n}', 'void SSL_CTX_free(SSL_CTX *a)\n{\n    int i;\n    if (a == NULL)\n        return;\n    CRYPTO_DOWN_REF(&a->references, &i, a->lock);\n    REF_PRINT_COUNT("SSL_CTX", a);\n    if (i > 0)\n        return;\n    REF_ASSERT_ISNT(i < 0);\n    X509_VERIFY_PARAM_free(a->param);\n    dane_ctx_final(&a->dane);\n    if (a->sessions != NULL)\n        SSL_CTX_flush_sessions(a, 0);\n    CRYPTO_free_ex_data(CRYPTO_EX_INDEX_SSL_CTX, a, &a->ex_data);\n    lh_SSL_SESSION_free(a->sessions);\n    X509_STORE_free(a->cert_store);\n#ifndef OPENSSL_NO_CT\n    CTLOG_STORE_free(a->ctlog_store);\n#endif\n    sk_SSL_CIPHER_free(a->cipher_list);\n    sk_SSL_CIPHER_free(a->cipher_list_by_id);\n    sk_SSL_CIPHER_free(a->tls13_ciphersuites);\n    ssl_cert_free(a->cert);\n    sk_X509_NAME_pop_free(a->ca_names, X509_NAME_free);\n    sk_X509_NAME_pop_free(a->client_ca_names, X509_NAME_free);\n    sk_X509_pop_free(a->extra_certs, X509_free);\n    a->comp_methods = NULL;\n#ifndef OPENSSL_NO_SRTP\n    sk_SRTP_PROTECTION_PROFILE_free(a->srtp_profiles);\n#endif\n#ifndef OPENSSL_NO_SRP\n    SSL_CTX_SRP_CTX_free(a);\n#endif\n#ifndef OPENSSL_NO_ENGINE\n    ENGINE_finish(a->client_cert_engine);\n#endif\n#ifndef OPENSSL_NO_EC\n    OPENSSL_free(a->ext.ecpointformats);\n    OPENSSL_free(a->ext.supportedgroups);\n#endif\n    OPENSSL_free(a->ext.alpn);\n    OPENSSL_secure_free(a->ext.secure);\n    CRYPTO_THREAD_lock_free(a->lock);\n    OPENSSL_free(a);\n}', 'static inline int CRYPTO_DOWN_REF(_Atomic int *val, int *ret, void *lock)\n{\n    *ret = atomic_fetch_sub_explicit(val, 1, memory_order_relaxed) - 1;\n    if (*ret == 0)\n        atomic_thread_fence(memory_order_acquire);\n    return 1;\n}']