ssl/ssltest.c:465: error: NULL_DEREFERENCE
  pointer `client_proto` last assigned on line 455 could be null and is dereferenced by call to `memcmp()` at line 465, column 6.
Showing all 33 steps of the trace


ssl/ssltest.c:451:1: start of procedure verify_alpn()
449.   	}
450.   
451. > static int verify_alpn(SSL *client, SSL *server)
452.   	{
453.   	const unsigned char *client_proto, *server_proto;

ssl/ssltest.c:454:2: 
452.   	{
453.   	const unsigned char *client_proto, *server_proto;
454. > 	unsigned int client_proto_len = 0, server_proto_len = 0;
455.   	SSL_get0_alpn_selected(client, &client_proto, &client_proto_len);
456.   	SSL_get0_alpn_selected(server, &server_proto, &server_proto_len);

ssl/ssltest.c:455:2: 
453.   	const unsigned char *client_proto, *server_proto;
454.   	unsigned int client_proto_len = 0, server_proto_len = 0;
455. > 	SSL_get0_alpn_selected(client, &client_proto, &client_proto_len);
456.   	SSL_get0_alpn_selected(server, &server_proto, &server_proto_len);
457.   

ssl/ssl_lib.c:1824:1: start of procedure SSL_get0_alpn_selected()
  1822.    * including the leading length-prefix byte). If the server didn't respond with
  1823.    * a negotiated protocol then |*len| will be zero. */
  1824. > void SSL_get0_alpn_selected(const SSL *ssl, const unsigned char **data,
  1825.   			    unsigned *len)
  1826.   	{

ssl/ssl_lib.c:1827:2: 
  1825.   			    unsigned *len)
  1826.   	{
  1827. > 	*data = NULL;
  1828.   	if (ssl->s3)
  1829.   		*data = ssl->s3->alpn_selected;

ssl/ssl_lib.c:1828:6: Taking true branch
  1826.   	{
  1827.   	*data = NULL;
  1828.   	if (ssl->s3)
               ^
  1829.   		*data = ssl->s3->alpn_selected;
  1830.   	if (*data == NULL)

ssl/ssl_lib.c:1829:3: 
  1827.   	*data = NULL;
  1828.   	if (ssl->s3)
  1829. > 		*data = ssl->s3->alpn_selected;
  1830.   	if (*data == NULL)
  1831.   		*len = 0;

ssl/ssl_lib.c:1830:6: Taking true branch
  1828.   	if (ssl->s3)
  1829.   		*data = ssl->s3->alpn_selected;
  1830.   	if (*data == NULL)
               ^
  1831.   		*len = 0;
  1832.   	else

ssl/ssl_lib.c:1831:3: 
  1829.   		*data = ssl->s3->alpn_selected;
  1830.   	if (*data == NULL)
  1831. > 		*len = 0;
  1832.   	else
  1833.   		*len = ssl->s3->alpn_selected_len;

ssl/ssl_lib.c:1830:2: 
  1828.   	if (ssl->s3)
  1829.   		*data = ssl->s3->alpn_selected;
  1830. > 	if (*data == NULL)
  1831.   		*len = 0;
  1832.   	else

ssl/ssl_lib.c:1834:2: return from a call to SSL_get0_alpn_selected
  1832.   	else
  1833.   		*len = ssl->s3->alpn_selected_len;
  1834.   	}
           ^
  1835.   
  1836.   #endif /* !OPENSSL_NO_TLSEXT */

ssl/ssltest.c:456:2: 
454.   	unsigned int client_proto_len = 0, server_proto_len = 0;
455.   	SSL_get0_alpn_selected(client, &client_proto, &client_proto_len);
456. > 	SSL_get0_alpn_selected(server, &server_proto, &server_proto_len);
457.   
458.   	if (alpn_selected != NULL)

ssl/ssl_lib.c:1824:1: start of procedure SSL_get0_alpn_selected()
  1822.    * including the leading length-prefix byte). If the server didn't respond with
  1823.    * a negotiated protocol then |*len| will be zero. */
  1824. > void SSL_get0_alpn_selected(const SSL *ssl, const unsigned char **data,
  1825.   			    unsigned *len)
  1826.   	{

ssl/ssl_lib.c:1827:2: 
  1825.   			    unsigned *len)
  1826.   	{
  1827. > 	*data = NULL;
  1828.   	if (ssl->s3)
  1829.   		*data = ssl->s3->alpn_selected;

ssl/ssl_lib.c:1828:6: Taking true branch
  1826.   	{
  1827.   	*data = NULL;
  1828.   	if (ssl->s3)
               ^
  1829.   		*data = ssl->s3->alpn_selected;
  1830.   	if (*data == NULL)

ssl/ssl_lib.c:1829:3: 
  1827.   	*data = NULL;
  1828.   	if (ssl->s3)
  1829. > 		*data = ssl->s3->alpn_selected;
  1830.   	if (*data == NULL)
  1831.   		*len = 0;

ssl/ssl_lib.c:1830:6: Taking false branch
  1828.   	if (ssl->s3)
  1829.   		*data = ssl->s3->alpn_selected;
  1830.   	if (*data == NULL)
               ^
  1831.   		*len = 0;
  1832.   	else

ssl/ssl_lib.c:1833:3: 
  1831.   		*len = 0;
  1832.   	else
  1833. > 		*len = ssl->s3->alpn_selected_len;
  1834.   	}
  1835.   

ssl/ssl_lib.c:1830:2: 
  1828.   	if (ssl->s3)
  1829.   		*data = ssl->s3->alpn_selected;
  1830. > 	if (*data == NULL)
  1831.   		*len = 0;
  1832.   	else

ssl/ssl_lib.c:1834:2: return from a call to SSL_get0_alpn_selected
  1832.   	else
  1833.   		*len = ssl->s3->alpn_selected_len;
  1834.   	}
           ^
  1835.   
  1836.   #endif /* !OPENSSL_NO_TLSEXT */

ssl/ssltest.c:458:6: Taking true branch
456.   	SSL_get0_alpn_selected(server, &server_proto, &server_proto_len);
457.   
458.   	if (alpn_selected != NULL)
            ^
459.   		{
460.   		OPENSSL_free(alpn_selected);

ssl/ssltest.c:460:3: 
458.   	if (alpn_selected != NULL)
459.   		{
460. > 		OPENSSL_free(alpn_selected);
461.   		alpn_selected = NULL;
462.   		}

crypto/mem.c:393:1: start of procedure CRYPTO_free()
  391.   	}
  392.   
  393. > void CRYPTO_free(void *str)
  394.   	{
  395.   	if (free_debug_func != NULL)

crypto/mem.c:395:6: Taking true branch
  393.   void CRYPTO_free(void *str)
  394.   	{
  395.   	if (free_debug_func != NULL)
              ^
  396.   		free_debug_func(str, 0);
  397.   #ifdef LEVITTE_DEBUG_MEM

crypto/mem.c:396:3: Skipping __function_pointer__(): unresolved function pointer
  394.   	{
  395.   	if (free_debug_func != NULL)
  396.   		free_debug_func(str, 0);
           ^
  397.   #ifdef LEVITTE_DEBUG_MEM
  398.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         < 0x%p\n", str);

crypto/mem.c:400:2: Skipping __function_pointer__(): unresolved function pointer
  398.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         < 0x%p\n", str);
  399.   #endif
  400.   	free_func(str);
          ^
  401.   	if (free_debug_func != NULL)
  402.   		free_debug_func(NULL, 1);

crypto/mem.c:401:6: Taking true branch
  399.   #endif
  400.   	free_func(str);
  401.   	if (free_debug_func != NULL)
              ^
  402.   		free_debug_func(NULL, 1);
  403.   	}

crypto/mem.c:402:3: Skipping __function_pointer__(): unresolved function pointer
  400.   	free_func(str);
  401.   	if (free_debug_func != NULL)
  402.   		free_debug_func(NULL, 1);
           ^
  403.   	}
  404.   

crypto/mem.c:401:2: 
  399.   #endif
  400.   	free_func(str);
  401. > 	if (free_debug_func != NULL)
  402.   		free_debug_func(NULL, 1);
  403.   	}

crypto/mem.c:403:2: return from a call to CRYPTO_free
  401.   	if (free_debug_func != NULL)
  402.   		free_debug_func(NULL, 1);
  403.   	}
          ^
  404.   
  405.   void *CRYPTO_remalloc(void *a, int num, const char *file, int line)

ssl/ssltest.c:461:3: 
459.   		{
460.   		OPENSSL_free(alpn_selected);
461. > 		alpn_selected = NULL;
462.   		}
463.   

ssl/ssltest.c:464:6: Taking false branch
462.   		}
463.   
464.   	if (client_proto_len != server_proto_len ||
            ^
465.   	    memcmp(client_proto, server_proto, client_proto_len) != 0)
466.   		{

ssl/ssltest.c:465:6: 
463.   
464.   	if (client_proto_len != server_proto_len ||
465. > 	    memcmp(client_proto, server_proto, client_proto_len) != 0)
466.   		{
467.   		BIO_printf(bio_stdout, "ALPN selected protocols differ!\n");

static int verify_alpn(SSL *client, SSL *server)
	{
	const unsigned char *client_proto, *server_proto;
	unsigned int client_proto_len = 0, server_proto_len = 0;
	SSL_get0_alpn_selected(client, &client_proto, &client_proto_len);
	SSL_get0_alpn_selected(server, &server_proto, &server_proto_len);
	if (alpn_selected != NULL)
		{
		OPENSSL_free(alpn_selected);
		alpn_selected = NULL;
		}
	if (client_proto_len != server_proto_len ||
	    memcmp(client_proto, server_proto, client_proto_len) != 0)
		{
		BIO_printf(bio_stdout, "ALPN selected protocols differ!\n");
		goto err;
		}
	if (client_proto_len > 0 && alpn_expected == NULL)
		{
		BIO_printf(bio_stdout, "ALPN unexpectedly negotiated\n");
		goto err;
		}
	if (alpn_expected != NULL &&
	    (client_proto_len != strlen(alpn_expected) ||
	     memcmp(client_proto, alpn_expected, client_proto_len) != 0))
		{
		BIO_printf(bio_stdout, "ALPN selected protocols not equal to expected protocol: %s\n", alpn_expected);
		goto err;
		}
	return 0;
err:
	BIO_printf(bio_stdout, "ALPN results: client: '");
	BIO_write(bio_stdout, client_proto, client_proto_len);
	BIO_printf(bio_stdout, "', server: '");
	BIO_write(bio_stdout, server_proto, server_proto_len);
	BIO_printf(bio_stdout, "'\n");
	BIO_printf(bio_stdout, "ALPN configured: client: '%s', server: '%s'\n", alpn_client, alpn_server);
	return -1;
	}
['static int verify_alpn(SSL *client, SSL *server)\n\t{\n\tconst unsigned char *client_proto, *server_proto;\n\tunsigned int client_proto_len = 0, server_proto_len = 0;\n\tSSL_get0_alpn_selected(client, &client_proto, &client_proto_len);\n\tSSL_get0_alpn_selected(server, &server_proto, &server_proto_len);\n\tif (alpn_selected != NULL)\n\t\t{\n\t\tOPENSSL_free(alpn_selected);\n\t\talpn_selected = NULL;\n\t\t}\n\tif (client_proto_len != server_proto_len ||\n\t    memcmp(client_proto, server_proto, client_proto_len) != 0)\n\t\t{\n\t\tBIO_printf(bio_stdout, "ALPN selected protocols differ!\\n");\n\t\tgoto err;\n\t\t}\n\tif (client_proto_len > 0 && alpn_expected == NULL)\n\t\t{\n\t\tBIO_printf(bio_stdout, "ALPN unexpectedly negotiated\\n");\n\t\tgoto err;\n\t\t}\n\tif (alpn_expected != NULL &&\n\t    (client_proto_len != strlen(alpn_expected) ||\n\t     memcmp(client_proto, alpn_expected, client_proto_len) != 0))\n\t\t{\n\t\tBIO_printf(bio_stdout, "ALPN selected protocols not equal to expected protocol: %s\\n", alpn_expected);\n\t\tgoto err;\n\t\t}\n\treturn 0;\nerr:\n\tBIO_printf(bio_stdout, "ALPN results: client: \'");\n\tBIO_write(bio_stdout, client_proto, client_proto_len);\n\tBIO_printf(bio_stdout, "\', server: \'");\n\tBIO_write(bio_stdout, server_proto, server_proto_len);\n\tBIO_printf(bio_stdout, "\'\\n");\n\tBIO_printf(bio_stdout, "ALPN configured: client: \'%s\', server: \'%s\'\\n", alpn_client, alpn_server);\n\treturn -1;\n\t}', 'void SSL_get0_alpn_selected(const SSL *ssl, const unsigned char **data,\n\t\t\t    unsigned *len)\n\t{\n\t*data = NULL;\n\tif (ssl->s3)\n\t\t*data = ssl->s3->alpn_selected;\n\tif (*data == NULL)\n\t\t*len = 0;\n\telse\n\t\t*len = ssl->s3->alpn_selected_len;\n\t}', 'void CRYPTO_free(void *str)\n\t{\n\tif (free_debug_func != NULL)\n\t\tfree_debug_func(str, 0);\n#ifdef LEVITTE_DEBUG_MEM\n\tfprintf(stderr, "LEVITTE_DEBUG_MEM:         < 0x%p\\n", str);\n#endif\n\tfree_func(str);\n\tif (free_debug_func != NULL)\n\t\tfree_debug_func(NULL, 1);\n\t}']