test/ssltest_old.c:320: error: NULL_DEREFERENCE
  pointer `alpn_selected` last assigned on line 319 could be null and is dereferenced by call to `memcpy()` at line 320, column 5.
Showing all 18 steps of the trace


test/ssltest_old.c:293:1: start of procedure cb_server_alpn()
291.   }
292.   
293. > static int cb_server_alpn(SSL *s, const unsigned char **out,
294.                             unsigned char *outlen, const unsigned char *in,
295.                             unsigned int inlen, void *arg)

test/ssltest_old.c:299:5: 
297.       unsigned char *protos;
298.       size_t protos_len;
299. >     char* alpn_str = arg;
300.   
301.       protos = next_protos_parse(&protos_len, alpn_str);

test/ssltest_old.c:301:5: Skipping next_protos_parse(): empty list of specs
299.       char* alpn_str = arg;
300.   
301.       protos = next_protos_parse(&protos_len, alpn_str);
           ^
302.       if (protos == NULL) {
303.           fprintf(stderr, "failed to parser ALPN server protocol string: %s\n",

test/ssltest_old.c:302:9: Taking false branch
300.   
301.       protos = next_protos_parse(&protos_len, alpn_str);
302.       if (protos == NULL) {
               ^
303.           fprintf(stderr, "failed to parser ALPN server protocol string: %s\n",
304.                   alpn_str);

test/ssltest_old.c:308:9: Taking false branch
306.       }
307.   
308.       if (SSL_select_next_proto
               ^
309.           ((unsigned char **)out, outlen, protos, protos_len, in,
310.            inlen) != OPENSSL_NPN_NEGOTIATED) {

test/ssltest_old.c:319:5: 
317.        * verify_alpn.
318.        */
319. >     alpn_selected = OPENSSL_malloc(*outlen);
320.       memcpy(alpn_selected, *out, *outlen);
321.       *out = alpn_selected;

crypto/mem.c:158:1: start of procedure CRYPTO_malloc()
  156.   #endif
  157.   
  158. > void *CRYPTO_malloc(size_t num, const char *file, int line)
  159.   {
  160.       void *ret = NULL;

crypto/mem.c:160:5: 
  158.   void *CRYPTO_malloc(size_t num, const char *file, int line)
  159.   {
  160. >     void *ret = NULL;
  161.   
  162.       if (malloc_impl != NULL && malloc_impl != CRYPTO_malloc)

crypto/mem.c:162:9: Taking true branch
  160.       void *ret = NULL;
  161.   
  162.       if (malloc_impl != NULL && malloc_impl != CRYPTO_malloc)
                 ^
  163.           return malloc_impl(num, file, line);
  164.   

crypto/mem.c:162:32: Taking false branch
  160.       void *ret = NULL;
  161.   
  162.       if (malloc_impl != NULL && malloc_impl != CRYPTO_malloc)
                                        ^
  163.           return malloc_impl(num, file, line);
  164.   

crypto/mem.c:165:9: Taking false branch
  163.           return malloc_impl(num, file, line);
  164.   
  165.       if (num == 0)
                 ^
  166.           return NULL;
  167.   

crypto/mem.c:169:5: 
  167.   
  168.       FAILTEST();
  169. >     allow_customize = 0;
  170.   #ifndef OPENSSL_NO_CRYPTO_MDEBUG
  171.       if (call_malloc_debug) {

crypto/mem.c:179:5: 
  177.       }
  178.   #else
  179. >     osslargused(file); osslargused(line);
  180.       ret = malloc(num);
  181.   #endif

crypto/mem.c:179:24: 
  177.       }
  178.   #else
  179. >     osslargused(file); osslargused(line);
  180.       ret = malloc(num);
  181.   #endif

crypto/mem.c:180:5: 
  178.   #else
  179.       osslargused(file); osslargused(line);
  180. >     ret = malloc(num);
  181.   #endif
  182.   

crypto/mem.c:183:5: 
  181.   #endif
  182.   
  183. >     return ret;
  184.   }
  185.   

crypto/mem.c:184:1: return from a call to CRYPTO_malloc
  182.   
  183.       return ret;
  184. > }
  185.   
  186.   void *CRYPTO_zalloc(size_t num, const char *file, int line)

test/ssltest_old.c:320:5: 
318.        */
319.       alpn_selected = OPENSSL_malloc(*outlen);
320. >     memcpy(alpn_selected, *out, *outlen);
321.       *out = alpn_selected;
322.   

static int cb_server_alpn(SSL *s, const unsigned char **out,
                          unsigned char *outlen, const unsigned char *in,
                          unsigned int inlen, void *arg)
{
    unsigned char *protos;
    size_t protos_len;
    char* alpn_str = arg;
    protos = next_protos_parse(&protos_len, alpn_str);
    if (protos == NULL) {
        fprintf(stderr, "failed to parser ALPN server protocol string: %s\n",
                alpn_str);
        abort();
    }
    if (SSL_select_next_proto
        ((unsigned char **)out, outlen, protos, protos_len, in,
         inlen) != OPENSSL_NPN_NEGOTIATED) {
        OPENSSL_free(protos);
        return SSL_TLSEXT_ERR_NOACK;
    }
    alpn_selected = OPENSSL_malloc(*outlen);
    memcpy(alpn_selected, *out, *outlen);
    *out = alpn_selected;
    OPENSSL_free(protos);
    return SSL_TLSEXT_ERR_OK;
}
['static int cb_server_alpn(SSL *s, const unsigned char **out,\n                          unsigned char *outlen, const unsigned char *in,\n                          unsigned int inlen, void *arg)\n{\n    unsigned char *protos;\n    size_t protos_len;\n    char* alpn_str = arg;\n    protos = next_protos_parse(&protos_len, alpn_str);\n    if (protos == NULL) {\n        fprintf(stderr, "failed to parser ALPN server protocol string: %s\\n",\n                alpn_str);\n        abort();\n    }\n    if (SSL_select_next_proto\n        ((unsigned char **)out, outlen, protos, protos_len, in,\n         inlen) != OPENSSL_NPN_NEGOTIATED) {\n        OPENSSL_free(protos);\n        return SSL_TLSEXT_ERR_NOACK;\n    }\n    alpn_selected = OPENSSL_malloc(*outlen);\n    memcpy(alpn_selected, *out, *outlen);\n    *out = alpn_selected;\n    OPENSSL_free(protos);\n    return SSL_TLSEXT_ERR_OK;\n}', 'void *CRYPTO_malloc(size_t num, const char *file, int line)\n{\n    void *ret = NULL;\n    if (malloc_impl != NULL && malloc_impl != CRYPTO_malloc)\n        return malloc_impl(num, file, line);\n    if (num == 0)\n        return NULL;\n    FAILTEST();\n    allow_customize = 0;\n#ifndef OPENSSL_NO_CRYPTO_MDEBUG\n    if (call_malloc_debug) {\n        CRYPTO_mem_debug_malloc(NULL, num, 0, file, line);\n        ret = malloc(num);\n        CRYPTO_mem_debug_malloc(ret, num, 1, file, line);\n    } else {\n        ret = malloc(num);\n    }\n#else\n    osslargused(file); osslargused(line);\n    ret = malloc(num);\n#endif\n    return ret;\n}']