ssl/ssltest.c:441: error: NULL_DEREFERENCE
  pointer `alpn_selected` last assigned on line 440 could be null and is dereferenced by call to `memcpy()` at line 441, column 2.
Showing all 19 steps of the trace


ssl/ssltest.c:420:1: start of procedure cb_server_alpn()
418.   	}
419.   
420. > static int cb_server_alpn(SSL *s, const unsigned char **out, unsigned char *outlen, const unsigned char *in, unsigned int inlen, void *arg)
421.   	{
422.   	unsigned char *protos;

ssl/ssltest.c:425:2: Skipping next_protos_parse(): empty list of specs
423.   	unsigned short protos_len;
424.   
425.   	protos = next_protos_parse(&protos_len, alpn_server);
        ^
426.   	if (protos == NULL)
427.   		{

ssl/ssltest.c:426:6: Taking false branch
424.   
425.   	protos = next_protos_parse(&protos_len, alpn_server);
426.   	if (protos == NULL)
            ^
427.   		{
428.   		fprintf(stderr, "failed to parser ALPN server protocol string: %s\n", alpn_server);

ssl/ssltest.c:432:6: Taking false branch
430.   		}
431.   
432.   	if (SSL_select_next_proto((unsigned char**) out, outlen, protos, protos_len, in, inlen) !=
            ^
433.   	    OPENSSL_NPN_NEGOTIATED)
434.   		{

ssl/ssltest.c:440:2: 
438.   
439.   	/* Make a copy of the selected protocol which will be freed in verify_alpn. */
440. > 	alpn_selected = OPENSSL_malloc(*outlen);
441.   	memcpy(alpn_selected, *out, *outlen);
442.   	*out = alpn_selected;

crypto/mem.c:295:1: start of procedure CRYPTO_malloc()
  293.   	}
  294.   
  295. > void *CRYPTO_malloc(int num, const char *file, int line)
  296.   	{
  297.   	void *ret = NULL;

crypto/mem.c:297:2: 
  295.   void *CRYPTO_malloc(int num, const char *file, int line)
  296.   	{
  297. > 	void *ret = NULL;
  298.   
  299.   	if (num <= 0) return NULL;

crypto/mem.c:299:6: Taking false branch
  297.   	void *ret = NULL;
  298.   
  299.   	if (num <= 0) return NULL;
              ^
  300.   
  301.   	allow_customize = 0;

crypto/mem.c:301:2: 
  299.   	if (num <= 0) return NULL;
  300.   
  301. > 	allow_customize = 0;
  302.   	if (malloc_debug_func != NULL)
  303.   		{

crypto/mem.c:302:6: Taking true branch
  300.   
  301.   	allow_customize = 0;
  302.   	if (malloc_debug_func != NULL)
              ^
  303.   		{
  304.   		allow_customize_debug = 0;

crypto/mem.c:304:3: 
  302.   	if (malloc_debug_func != NULL)
  303.   		{
  304. > 		allow_customize_debug = 0;
  305.   		malloc_debug_func(NULL, num, file, line, 0);
  306.   		}

crypto/mem.c:305:3: Skipping __function_pointer__(): unresolved function pointer
  303.   		{
  304.   		allow_customize_debug = 0;
  305.   		malloc_debug_func(NULL, num, file, line, 0);
           ^
  306.   		}
  307.   	ret = malloc_ex_func(num,file,line);

crypto/mem.c:307:2: Skipping __function_pointer__(): unresolved function pointer
  305.   		malloc_debug_func(NULL, num, file, line, 0);
  306.   		}
  307.   	ret = malloc_ex_func(num,file,line);
          ^
  308.   #ifdef LEVITTE_DEBUG_MEM
  309.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);

crypto/mem.c:311:6: Taking true branch
  309.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\n", ret, num);
  310.   #endif
  311.   	if (malloc_debug_func != NULL)
              ^
  312.   		malloc_debug_func(ret, num, file, line, 1);
  313.   

crypto/mem.c:312:3: Skipping __function_pointer__(): unresolved function pointer
  310.   #endif
  311.   	if (malloc_debug_func != NULL)
  312.   		malloc_debug_func(ret, num, file, line, 1);
           ^
  313.   
  314.   #ifndef OPENSSL_CPUID_OBJ

crypto/mem.c:318:12: Taking false branch
  316.            * sanitisation function can't be optimised out. NB: We only do
  317.            * this for >2Kb so the overhead doesn't bother us. */
  318.           if(ret && (num > 2048))
                    ^
  319.   	{	extern unsigned char cleanse_ctr;
  320.                   ((unsigned char *)ret)[0] = cleanse_ctr;

crypto/mem.c:324:2: 
  322.   #endif
  323.   
  324. > 	return ret;
  325.   	}
  326.   char *CRYPTO_strdup(const char *str, const char *file, int line)

crypto/mem.c:325:2: return from a call to CRYPTO_malloc
  323.   
  324.   	return ret;
  325.   	}
          ^
  326.   char *CRYPTO_strdup(const char *str, const char *file, int line)
  327.   	{

ssl/ssltest.c:441:2: 
439.   	/* Make a copy of the selected protocol which will be freed in verify_alpn. */
440.   	alpn_selected = OPENSSL_malloc(*outlen);
441. > 	memcpy(alpn_selected, *out, *outlen);
442.   	*out = alpn_selected;
443.   

static int cb_server_alpn(SSL *s, const unsigned char **out, unsigned char *outlen, const unsigned char *in, unsigned int inlen, void *arg)
	{
	unsigned char *protos;
	unsigned short protos_len;
	protos = next_protos_parse(&protos_len, alpn_server);
	if (protos == NULL)
		{
		fprintf(stderr, "failed to parser ALPN server protocol string: %s\n", alpn_server);
		abort();
		}
	if (SSL_select_next_proto((unsigned char**) out, outlen, protos, protos_len, in, inlen) !=
	    OPENSSL_NPN_NEGOTIATED)
		{
		OPENSSL_free(protos);
		return SSL_TLSEXT_ERR_NOACK;
		}
	alpn_selected = OPENSSL_malloc(*outlen);
	memcpy(alpn_selected, *out, *outlen);
	*out = alpn_selected;
	OPENSSL_free(protos);
	return SSL_TLSEXT_ERR_OK;
	}
['static int cb_server_alpn(SSL *s, const unsigned char **out, unsigned char *outlen, const unsigned char *in, unsigned int inlen, void *arg)\n\t{\n\tunsigned char *protos;\n\tunsigned short protos_len;\n\tprotos = next_protos_parse(&protos_len, alpn_server);\n\tif (protos == NULL)\n\t\t{\n\t\tfprintf(stderr, "failed to parser ALPN server protocol string: %s\\n", alpn_server);\n\t\tabort();\n\t\t}\n\tif (SSL_select_next_proto((unsigned char**) out, outlen, protos, protos_len, in, inlen) !=\n\t    OPENSSL_NPN_NEGOTIATED)\n\t\t{\n\t\tOPENSSL_free(protos);\n\t\treturn SSL_TLSEXT_ERR_NOACK;\n\t\t}\n\talpn_selected = OPENSSL_malloc(*outlen);\n\tmemcpy(alpn_selected, *out, *outlen);\n\t*out = alpn_selected;\n\tOPENSSL_free(protos);\n\treturn SSL_TLSEXT_ERR_OK;\n\t}', 'void *CRYPTO_malloc(int num, const char *file, int line)\n\t{\n\tvoid *ret = NULL;\n\tif (num <= 0) return NULL;\n\tallow_customize = 0;\n\tif (malloc_debug_func != NULL)\n\t\t{\n\t\tallow_customize_debug = 0;\n\t\tmalloc_debug_func(NULL, num, file, line, 0);\n\t\t}\n\tret = malloc_ex_func(num,file,line);\n#ifdef LEVITTE_DEBUG_MEM\n\tfprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\\n", ret, num);\n#endif\n\tif (malloc_debug_func != NULL)\n\t\tmalloc_debug_func(ret, num, file, line, 1);\n#ifndef OPENSSL_CPUID_OBJ\n        if(ret && (num > 2048))\n\t{\textern unsigned char cleanse_ctr;\n                ((unsigned char *)ret)[0] = cleanse_ctr;\n\t}\n#endif\n\treturn ret;\n\t}']