test/ssltest.c:464: error: NULL_DEREFERENCE
  pointer `server_proto` last assigned on line 453 could be null and is dereferenced by call to `memcmp()` at line 464, column 9.
Showing all 33 steps of the trace


test/ssltest.c:448:1: start of procedure verify_alpn()
446.   }
447.   
448. > static int verify_alpn(SSL *client, SSL *server)
449.   {
450.       const unsigned char *client_proto, *server_proto;

test/ssltest.c:451:5: 
449.   {
450.       const unsigned char *client_proto, *server_proto;
451. >     unsigned int client_proto_len = 0, server_proto_len = 0;
452.       SSL_get0_alpn_selected(client, &client_proto, &client_proto_len);
453.       SSL_get0_alpn_selected(server, &server_proto, &server_proto_len);

test/ssltest.c:452:5: 
450.       const unsigned char *client_proto, *server_proto;
451.       unsigned int client_proto_len = 0, server_proto_len = 0;
452. >     SSL_get0_alpn_selected(client, &client_proto, &client_proto_len);
453.       SSL_get0_alpn_selected(server, &server_proto, &server_proto_len);
454.   

ssl/ssl_lib.c:1711:1: start of procedure SSL_get0_alpn_selected()
  1709.    * respond with a negotiated protocol then |*len| will be zero.
  1710.    */
  1711. > void SSL_get0_alpn_selected(const SSL *ssl, const unsigned char **data,
  1712.                               unsigned *len)
  1713.   {

ssl/ssl_lib.c:1714:5: 
  1712.                               unsigned *len)
  1713.   {
  1714. >     *data = NULL;
  1715.       if (ssl->s3)
  1716.           *data = ssl->s3->alpn_selected;

ssl/ssl_lib.c:1715:9: Taking true branch
  1713.   {
  1714.       *data = NULL;
  1715.       if (ssl->s3)
                  ^
  1716.           *data = ssl->s3->alpn_selected;
  1717.       if (*data == NULL)

ssl/ssl_lib.c:1716:9: 
  1714.       *data = NULL;
  1715.       if (ssl->s3)
  1716. >         *data = ssl->s3->alpn_selected;
  1717.       if (*data == NULL)
  1718.           *len = 0;

ssl/ssl_lib.c:1717:9: Taking false branch
  1715.       if (ssl->s3)
  1716.           *data = ssl->s3->alpn_selected;
  1717.       if (*data == NULL)
                  ^
  1718.           *len = 0;
  1719.       else

ssl/ssl_lib.c:1720:9: 
  1718.           *len = 0;
  1719.       else
  1720. >         *len = ssl->s3->alpn_selected_len;
  1721.   }
  1722.   

ssl/ssl_lib.c:1717:5: 
  1715.       if (ssl->s3)
  1716.           *data = ssl->s3->alpn_selected;
  1717. >     if (*data == NULL)
  1718.           *len = 0;
  1719.       else

ssl/ssl_lib.c:1721:1: return from a call to SSL_get0_alpn_selected
  1719.       else
  1720.           *len = ssl->s3->alpn_selected_len;
  1721. > }
  1722.   
  1723.   

test/ssltest.c:453:5: 
451.       unsigned int client_proto_len = 0, server_proto_len = 0;
452.       SSL_get0_alpn_selected(client, &client_proto, &client_proto_len);
453. >     SSL_get0_alpn_selected(server, &server_proto, &server_proto_len);
454.   
455.       OPENSSL_free(alpn_selected);

ssl/ssl_lib.c:1711:1: start of procedure SSL_get0_alpn_selected()
  1709.    * respond with a negotiated protocol then |*len| will be zero.
  1710.    */
  1711. > void SSL_get0_alpn_selected(const SSL *ssl, const unsigned char **data,
  1712.                               unsigned *len)
  1713.   {

ssl/ssl_lib.c:1714:5: 
  1712.                               unsigned *len)
  1713.   {
  1714. >     *data = NULL;
  1715.       if (ssl->s3)
  1716.           *data = ssl->s3->alpn_selected;

ssl/ssl_lib.c:1715:9: Taking true branch
  1713.   {
  1714.       *data = NULL;
  1715.       if (ssl->s3)
                  ^
  1716.           *data = ssl->s3->alpn_selected;
  1717.       if (*data == NULL)

ssl/ssl_lib.c:1716:9: 
  1714.       *data = NULL;
  1715.       if (ssl->s3)
  1716. >         *data = ssl->s3->alpn_selected;
  1717.       if (*data == NULL)
  1718.           *len = 0;

ssl/ssl_lib.c:1717:9: Taking true branch
  1715.       if (ssl->s3)
  1716.           *data = ssl->s3->alpn_selected;
  1717.       if (*data == NULL)
                  ^
  1718.           *len = 0;
  1719.       else

ssl/ssl_lib.c:1718:9: 
  1716.           *data = ssl->s3->alpn_selected;
  1717.       if (*data == NULL)
  1718. >         *len = 0;
  1719.       else
  1720.           *len = ssl->s3->alpn_selected_len;

ssl/ssl_lib.c:1717:5: 
  1715.       if (ssl->s3)
  1716.           *data = ssl->s3->alpn_selected;
  1717. >     if (*data == NULL)
  1718.           *len = 0;
  1719.       else

ssl/ssl_lib.c:1721:1: return from a call to SSL_get0_alpn_selected
  1719.       else
  1720.           *len = ssl->s3->alpn_selected_len;
  1721. > }
  1722.   
  1723.   

test/ssltest.c:455:5: 
453.       SSL_get0_alpn_selected(server, &server_proto, &server_proto_len);
454.   
455. >     OPENSSL_free(alpn_selected);
456.       alpn_selected = NULL;
457.   

crypto/mem.c:392:1: start of procedure CRYPTO_free()
  390.   }
  391.   
  392. > void CRYPTO_free(void *str)
  393.   {
  394.       if (free_debug_func != NULL)

crypto/mem.c:394:9: Taking true branch
  392.   void CRYPTO_free(void *str)
  393.   {
  394.       if (free_debug_func != NULL)
                 ^
  395.           free_debug_func(str, 0);
  396.   #ifdef LEVITTE_DEBUG_MEM

crypto/mem.c:395:9: Skipping __function_pointer__(): unresolved function pointer
  393.   {
  394.       if (free_debug_func != NULL)
  395.           free_debug_func(str, 0);
                 ^
  396.   #ifdef LEVITTE_DEBUG_MEM
  397.       fprintf(stderr, "LEVITTE_DEBUG_MEM:         < 0x%p\n", str);

crypto/mem.c:399:5: Skipping __function_pointer__(): unresolved function pointer
  397.       fprintf(stderr, "LEVITTE_DEBUG_MEM:         < 0x%p\n", str);
  398.   #endif
  399.       free_func(str);
             ^
  400.       if (free_debug_func != NULL)
  401.           free_debug_func(NULL, 1);

crypto/mem.c:400:9: Taking true branch
  398.   #endif
  399.       free_func(str);
  400.       if (free_debug_func != NULL)
                 ^
  401.           free_debug_func(NULL, 1);
  402.   }

crypto/mem.c:401:9: Skipping __function_pointer__(): unresolved function pointer
  399.       free_func(str);
  400.       if (free_debug_func != NULL)
  401.           free_debug_func(NULL, 1);
                 ^
  402.   }
  403.   

crypto/mem.c:400:5: 
  398.   #endif
  399.       free_func(str);
  400. >     if (free_debug_func != NULL)
  401.           free_debug_func(NULL, 1);
  402.   }

crypto/mem.c:402:1: return from a call to CRYPTO_free
  400.       if (free_debug_func != NULL)
  401.           free_debug_func(NULL, 1);
  402. > }
  403.   
  404.   void CRYPTO_clear_free(void *str, size_t num)

test/ssltest.c:456:5: 
454.   
455.       OPENSSL_free(alpn_selected);
456. >     alpn_selected = NULL;
457.   
458.       if (client_proto_len != server_proto_len) {

test/ssltest.c:458:9: Taking false branch
456.       alpn_selected = NULL;
457.   
458.       if (client_proto_len != server_proto_len) {
               ^
459.           BIO_printf(bio_stdout, "ALPN selected protocols differ!\n");
460.           goto err;

test/ssltest.c:463:9: Taking true branch
461.       }
462.   
463.       if (client_proto != NULL &&
               ^
464.           memcmp(client_proto, server_proto, client_proto_len) != 0) {
465.           BIO_printf(bio_stdout, "ALPN selected protocols differ!\n");

test/ssltest.c:464:9: 
462.   
463.       if (client_proto != NULL &&
464. >         memcmp(client_proto, server_proto, client_proto_len) != 0) {
465.           BIO_printf(bio_stdout, "ALPN selected protocols differ!\n");
466.           goto err;

static int verify_alpn(SSL *client, SSL *server)
{
    const unsigned char *client_proto, *server_proto;
    unsigned int client_proto_len = 0, server_proto_len = 0;
    SSL_get0_alpn_selected(client, &client_proto, &client_proto_len);
    SSL_get0_alpn_selected(server, &server_proto, &server_proto_len);
    OPENSSL_free(alpn_selected);
    alpn_selected = NULL;
    if (client_proto_len != server_proto_len) {
        BIO_printf(bio_stdout, "ALPN selected protocols differ!\n");
        goto err;
    }
    if (client_proto != NULL &&
        memcmp(client_proto, server_proto, client_proto_len) != 0) {
        BIO_printf(bio_stdout, "ALPN selected protocols differ!\n");
        goto err;
    }
    if (client_proto_len > 0 && alpn_expected == NULL) {
        BIO_printf(bio_stdout, "ALPN unexpectedly negotiated\n");
        goto err;
    }
    if (alpn_expected != NULL &&
        (client_proto_len != strlen(alpn_expected) ||
         memcmp(client_proto, alpn_expected, client_proto_len) != 0)) {
        BIO_printf(bio_stdout,
                   "ALPN selected protocols not equal to expected protocol: %s\n",
                   alpn_expected);
        goto err;
    }
    return 0;
 err:
    BIO_printf(bio_stdout, "ALPN results: client: '");
    BIO_write(bio_stdout, client_proto, client_proto_len);
    BIO_printf(bio_stdout, "', server: '");
    BIO_write(bio_stdout, server_proto, server_proto_len);
    BIO_printf(bio_stdout, "'\n");
    BIO_printf(bio_stdout, "ALPN configured: client: '%s', server: '%s'\n",
               alpn_client, alpn_server);
    return -1;
}
['static int verify_alpn(SSL *client, SSL *server)\n{\n    const unsigned char *client_proto, *server_proto;\n    unsigned int client_proto_len = 0, server_proto_len = 0;\n    SSL_get0_alpn_selected(client, &client_proto, &client_proto_len);\n    SSL_get0_alpn_selected(server, &server_proto, &server_proto_len);\n    OPENSSL_free(alpn_selected);\n    alpn_selected = NULL;\n    if (client_proto_len != server_proto_len) {\n        BIO_printf(bio_stdout, "ALPN selected protocols differ!\\n");\n        goto err;\n    }\n    if (client_proto != NULL &&\n        memcmp(client_proto, server_proto, client_proto_len) != 0) {\n        BIO_printf(bio_stdout, "ALPN selected protocols differ!\\n");\n        goto err;\n    }\n    if (client_proto_len > 0 && alpn_expected == NULL) {\n        BIO_printf(bio_stdout, "ALPN unexpectedly negotiated\\n");\n        goto err;\n    }\n    if (alpn_expected != NULL &&\n        (client_proto_len != strlen(alpn_expected) ||\n         memcmp(client_proto, alpn_expected, client_proto_len) != 0)) {\n        BIO_printf(bio_stdout,\n                   "ALPN selected protocols not equal to expected protocol: %s\\n",\n                   alpn_expected);\n        goto err;\n    }\n    return 0;\n err:\n    BIO_printf(bio_stdout, "ALPN results: client: \'");\n    BIO_write(bio_stdout, client_proto, client_proto_len);\n    BIO_printf(bio_stdout, "\', server: \'");\n    BIO_write(bio_stdout, server_proto, server_proto_len);\n    BIO_printf(bio_stdout, "\'\\n");\n    BIO_printf(bio_stdout, "ALPN configured: client: \'%s\', server: \'%s\'\\n",\n               alpn_client, alpn_server);\n    return -1;\n}', 'void SSL_get0_alpn_selected(const SSL *ssl, const unsigned char **data,\n                            unsigned *len)\n{\n    *data = NULL;\n    if (ssl->s3)\n        *data = ssl->s3->alpn_selected;\n    if (*data == NULL)\n        *len = 0;\n    else\n        *len = ssl->s3->alpn_selected_len;\n}', 'void CRYPTO_free(void *str)\n{\n    if (free_debug_func != NULL)\n        free_debug_func(str, 0);\n#ifdef LEVITTE_DEBUG_MEM\n    fprintf(stderr, "LEVITTE_DEBUG_MEM:         < 0x%p\\n", str);\n#endif\n    free_func(str);\n    if (free_debug_func != NULL)\n        free_debug_func(NULL, 1);\n}']