ssl/ssltest.c:444: error: NULL_DEREFERENCE
  pointer `alpn_selected` last assigned on line 443 could be null and is dereferenced by call to `memcpy()` at line 444, column 2.
Showing all 11 steps of the trace


ssl/ssltest.c:423:1: start of procedure cb_server_alpn()
421.   	}
422.   
423. > static int cb_server_alpn(SSL *s, const unsigned char **out, unsigned char *outlen, const unsigned char *in, unsigned int inlen, void *arg)
424.   	{
425.   	unsigned char *protos;

ssl/ssltest.c:428:2: Skipping next_protos_parse(): empty list of specs
426.   	unsigned short protos_len;
427.   
428.   	protos = next_protos_parse(&protos_len, alpn_server);
        ^
429.   	if (protos == NULL)
430.   		{

ssl/ssltest.c:429:6: Taking false branch
427.   
428.   	protos = next_protos_parse(&protos_len, alpn_server);
429.   	if (protos == NULL)
            ^
430.   		{
431.   		fprintf(stderr, "failed to parser ALPN server protocol string: %s\n", alpn_server);

ssl/ssltest.c:435:6: Taking false branch
433.   		}
434.   
435.   	if (SSL_select_next_proto((unsigned char**) out, outlen, protos, protos_len, in, inlen) !=
            ^
436.   	    OPENSSL_NPN_NEGOTIATED)
437.   		{

ssl/ssltest.c:443:2: 
441.   
442.   	/* Make a copy of the selected protocol which will be freed in verify_alpn. */
443. > 	alpn_selected = OPENSSL_malloc(*outlen);
444.   	memcpy(alpn_selected, *out, *outlen);
445.   	*out = alpn_selected;

crypto/mem.c:297:1: start of procedure CRYPTO_malloc()
  295.   	}
  296.   
  297. > void *CRYPTO_malloc(int num, const char *file, int line)
  298.   	{
  299.   	void *ret = NULL;

crypto/mem.c:299:2: 
  297.   void *CRYPTO_malloc(int num, const char *file, int line)
  298.   	{
  299. > 	void *ret = NULL;
  300.   
  301.   	if (num <= 0) return NULL;

crypto/mem.c:301:6: Taking true branch
  299.   	void *ret = NULL;
  300.   
  301.   	if (num <= 0) return NULL;
              ^
  302.   
  303.   	if(allow_customize)

crypto/mem.c:301:16: 
  299.   	void *ret = NULL;
  300.   
  301. > 	if (num <= 0) return NULL;
  302.   
  303.   	if(allow_customize)

crypto/mem.c:329:2: return from a call to CRYPTO_malloc
  327.   
  328.   	return ret;
  329.   	}
          ^
  330.   char *CRYPTO_strdup(const char *str, const char *file, int line)
  331.   	{

ssl/ssltest.c:444:2: 
442.   	/* Make a copy of the selected protocol which will be freed in verify_alpn. */
443.   	alpn_selected = OPENSSL_malloc(*outlen);
444. > 	memcpy(alpn_selected, *out, *outlen);
445.   	*out = alpn_selected;
446.   

static int cb_server_alpn(SSL *s, const unsigned char **out, unsigned char *outlen, const unsigned char *in, unsigned int inlen, void *arg)
	{
	unsigned char *protos;
	unsigned short protos_len;
	protos = next_protos_parse(&protos_len, alpn_server);
	if (protos == NULL)
		{
		fprintf(stderr, "failed to parser ALPN server protocol string: %s\n", alpn_server);
		abort();
		}
	if (SSL_select_next_proto((unsigned char**) out, outlen, protos, protos_len, in, inlen) !=
	    OPENSSL_NPN_NEGOTIATED)
		{
		OPENSSL_free(protos);
		return SSL_TLSEXT_ERR_NOACK;
		}
	alpn_selected = OPENSSL_malloc(*outlen);
	memcpy(alpn_selected, *out, *outlen);
	*out = alpn_selected;
	OPENSSL_free(protos);
	return SSL_TLSEXT_ERR_OK;
	}
['static int cb_server_alpn(SSL *s, const unsigned char **out, unsigned char *outlen, const unsigned char *in, unsigned int inlen, void *arg)\n\t{\n\tunsigned char *protos;\n\tunsigned short protos_len;\n\tprotos = next_protos_parse(&protos_len, alpn_server);\n\tif (protos == NULL)\n\t\t{\n\t\tfprintf(stderr, "failed to parser ALPN server protocol string: %s\\n", alpn_server);\n\t\tabort();\n\t\t}\n\tif (SSL_select_next_proto((unsigned char**) out, outlen, protos, protos_len, in, inlen) !=\n\t    OPENSSL_NPN_NEGOTIATED)\n\t\t{\n\t\tOPENSSL_free(protos);\n\t\treturn SSL_TLSEXT_ERR_NOACK;\n\t\t}\n\talpn_selected = OPENSSL_malloc(*outlen);\n\tmemcpy(alpn_selected, *out, *outlen);\n\t*out = alpn_selected;\n\tOPENSSL_free(protos);\n\treturn SSL_TLSEXT_ERR_OK;\n\t}', 'void *CRYPTO_malloc(int num, const char *file, int line)\n\t{\n\tvoid *ret = NULL;\n\tif (num <= 0) return NULL;\n\tif(allow_customize)\n\t\tallow_customize = 0;\n\tif (malloc_debug_func != NULL)\n\t\t{\n\t\tif(allow_customize_debug)\n\t\t\tallow_customize_debug = 0;\n\t\tmalloc_debug_func(NULL, num, file, line, 0);\n\t\t}\n\tret = malloc_ex_func(num,file,line);\n#ifdef LEVITTE_DEBUG_MEM\n\tfprintf(stderr, "LEVITTE_DEBUG_MEM:         > 0x%p (%d)\\n", ret, num);\n#endif\n\tif (malloc_debug_func != NULL)\n\t\tmalloc_debug_func(ret, num, file, line, 1);\n#ifndef OPENSSL_CPUID_OBJ\n        if(ret && (num > 2048))\n\t{\textern unsigned char cleanse_ctr;\n                ((unsigned char *)ret)[0] = cleanse_ctr;\n\t}\n#endif\n\treturn ret;\n\t}']