ssl/ssltest.c:462: error: NULL_DEREFERENCE
  pointer `server_proto` last assigned on line 453 could be null and is dereferenced by call to `memcmp()` at line 462, column 6.
Showing all 33 steps of the trace


ssl/ssltest.c:448:1: start of procedure verify_alpn()
446.   	}
447.   
448. > static int verify_alpn(SSL *client, SSL *server)
449.   	{
450.   	const unsigned char *client_proto, *server_proto;

ssl/ssltest.c:451:2: 
449.   	{
450.   	const unsigned char *client_proto, *server_proto;
451. > 	unsigned int client_proto_len = 0, server_proto_len = 0;
452.   	SSL_get0_alpn_selected(client, &client_proto, &client_proto_len);
453.   	SSL_get0_alpn_selected(server, &server_proto, &server_proto_len);

ssl/ssltest.c:452:2: 
450.   	const unsigned char *client_proto, *server_proto;
451.   	unsigned int client_proto_len = 0, server_proto_len = 0;
452. > 	SSL_get0_alpn_selected(client, &client_proto, &client_proto_len);
453.   	SSL_get0_alpn_selected(server, &server_proto, &server_proto_len);
454.   

ssl/ssl_lib.c:1870:1: start of procedure SSL_get0_alpn_selected()
  1868.    * including the leading length-prefix byte). If the server didn't respond with
  1869.    * a negotiated protocol then |*len| will be zero. */
  1870. > void SSL_get0_alpn_selected(const SSL *ssl, const unsigned char **data,
  1871.   			    unsigned *len)
  1872.   	{

ssl/ssl_lib.c:1873:2: 
  1871.   			    unsigned *len)
  1872.   	{
  1873. > 	*data = NULL;
  1874.   	if (ssl->s3)
  1875.   		*data = ssl->s3->alpn_selected;

ssl/ssl_lib.c:1874:6: Taking true branch
  1872.   	{
  1873.   	*data = NULL;
  1874.   	if (ssl->s3)
               ^
  1875.   		*data = ssl->s3->alpn_selected;
  1876.   	if (*data == NULL)

ssl/ssl_lib.c:1875:3: 
  1873.   	*data = NULL;
  1874.   	if (ssl->s3)
  1875. > 		*data = ssl->s3->alpn_selected;
  1876.   	if (*data == NULL)
  1877.   		*len = 0;

ssl/ssl_lib.c:1876:6: Taking false branch
  1874.   	if (ssl->s3)
  1875.   		*data = ssl->s3->alpn_selected;
  1876.   	if (*data == NULL)
               ^
  1877.   		*len = 0;
  1878.   	else

ssl/ssl_lib.c:1879:3: 
  1877.   		*len = 0;
  1878.   	else
  1879. > 		*len = ssl->s3->alpn_selected_len;
  1880.   	}
  1881.   

ssl/ssl_lib.c:1876:2: 
  1874.   	if (ssl->s3)
  1875.   		*data = ssl->s3->alpn_selected;
  1876. > 	if (*data == NULL)
  1877.   		*len = 0;
  1878.   	else

ssl/ssl_lib.c:1880:2: return from a call to SSL_get0_alpn_selected
  1878.   	else
  1879.   		*len = ssl->s3->alpn_selected_len;
  1880.   	}
           ^
  1881.   
  1882.   #endif /* !OPENSSL_NO_TLSEXT */

ssl/ssltest.c:453:2: 
451.   	unsigned int client_proto_len = 0, server_proto_len = 0;
452.   	SSL_get0_alpn_selected(client, &client_proto, &client_proto_len);
453. > 	SSL_get0_alpn_selected(server, &server_proto, &server_proto_len);
454.   
455.   	if (alpn_selected != NULL)

ssl/ssl_lib.c:1870:1: start of procedure SSL_get0_alpn_selected()
  1868.    * including the leading length-prefix byte). If the server didn't respond with
  1869.    * a negotiated protocol then |*len| will be zero. */
  1870. > void SSL_get0_alpn_selected(const SSL *ssl, const unsigned char **data,
  1871.   			    unsigned *len)
  1872.   	{

ssl/ssl_lib.c:1873:2: 
  1871.   			    unsigned *len)
  1872.   	{
  1873. > 	*data = NULL;
  1874.   	if (ssl->s3)
  1875.   		*data = ssl->s3->alpn_selected;

ssl/ssl_lib.c:1874:6: Taking true branch
  1872.   	{
  1873.   	*data = NULL;
  1874.   	if (ssl->s3)
               ^
  1875.   		*data = ssl->s3->alpn_selected;
  1876.   	if (*data == NULL)

ssl/ssl_lib.c:1875:3: 
  1873.   	*data = NULL;
  1874.   	if (ssl->s3)
  1875. > 		*data = ssl->s3->alpn_selected;
  1876.   	if (*data == NULL)
  1877.   		*len = 0;

ssl/ssl_lib.c:1876:6: Taking true branch
  1874.   	if (ssl->s3)
  1875.   		*data = ssl->s3->alpn_selected;
  1876.   	if (*data == NULL)
               ^
  1877.   		*len = 0;
  1878.   	else

ssl/ssl_lib.c:1877:3: 
  1875.   		*data = ssl->s3->alpn_selected;
  1876.   	if (*data == NULL)
  1877. > 		*len = 0;
  1878.   	else
  1879.   		*len = ssl->s3->alpn_selected_len;

ssl/ssl_lib.c:1876:2: 
  1874.   	if (ssl->s3)
  1875.   		*data = ssl->s3->alpn_selected;
  1876. > 	if (*data == NULL)
  1877.   		*len = 0;
  1878.   	else

ssl/ssl_lib.c:1880:2: return from a call to SSL_get0_alpn_selected
  1878.   	else
  1879.   		*len = ssl->s3->alpn_selected_len;
  1880.   	}
           ^
  1881.   
  1882.   #endif /* !OPENSSL_NO_TLSEXT */

ssl/ssltest.c:455:6: Taking true branch
453.   	SSL_get0_alpn_selected(server, &server_proto, &server_proto_len);
454.   
455.   	if (alpn_selected != NULL)
            ^
456.   		{
457.   		OPENSSL_free(alpn_selected);

ssl/ssltest.c:457:3: 
455.   	if (alpn_selected != NULL)
456.   		{
457. > 		OPENSSL_free(alpn_selected);
458.   		alpn_selected = NULL;
459.   		}

crypto/mem.c:389:1: start of procedure CRYPTO_free()
  387.   	}
  388.   
  389. > void CRYPTO_free(void *str)
  390.   	{
  391.   	if (free_debug_func != NULL)

crypto/mem.c:391:6: Taking true branch
  389.   void CRYPTO_free(void *str)
  390.   	{
  391.   	if (free_debug_func != NULL)
              ^
  392.   		free_debug_func(str, 0);
  393.   #ifdef LEVITTE_DEBUG_MEM

crypto/mem.c:392:3: Skipping __function_pointer__(): unresolved function pointer
  390.   	{
  391.   	if (free_debug_func != NULL)
  392.   		free_debug_func(str, 0);
           ^
  393.   #ifdef LEVITTE_DEBUG_MEM
  394.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         < 0x%p\n", str);

crypto/mem.c:396:2: Skipping __function_pointer__(): unresolved function pointer
  394.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         < 0x%p\n", str);
  395.   #endif
  396.   	free_func(str);
          ^
  397.   	if (free_debug_func != NULL)
  398.   		free_debug_func(NULL, 1);

crypto/mem.c:397:6: Taking true branch
  395.   #endif
  396.   	free_func(str);
  397.   	if (free_debug_func != NULL)
              ^
  398.   		free_debug_func(NULL, 1);
  399.   	}

crypto/mem.c:398:3: Skipping __function_pointer__(): unresolved function pointer
  396.   	free_func(str);
  397.   	if (free_debug_func != NULL)
  398.   		free_debug_func(NULL, 1);
           ^
  399.   	}
  400.   

crypto/mem.c:397:2: 
  395.   #endif
  396.   	free_func(str);
  397. > 	if (free_debug_func != NULL)
  398.   		free_debug_func(NULL, 1);
  399.   	}

crypto/mem.c:399:2: return from a call to CRYPTO_free
  397.   	if (free_debug_func != NULL)
  398.   		free_debug_func(NULL, 1);
  399.   	}
          ^
  400.   
  401.   void *CRYPTO_remalloc(void *a, int num, const char *file, int line)

ssl/ssltest.c:458:3: 
456.   		{
457.   		OPENSSL_free(alpn_selected);
458. > 		alpn_selected = NULL;
459.   		}
460.   

ssl/ssltest.c:461:6: Taking false branch
459.   		}
460.   
461.   	if (client_proto_len != server_proto_len ||
            ^
462.   	    memcmp(client_proto, server_proto, client_proto_len) != 0)
463.   		{

ssl/ssltest.c:462:6: 
460.   
461.   	if (client_proto_len != server_proto_len ||
462. > 	    memcmp(client_proto, server_proto, client_proto_len) != 0)
463.   		{
464.   		BIO_printf(bio_stdout, "ALPN selected protocols differ!\n");

static int verify_alpn(SSL *client, SSL *server)
	{
	const unsigned char *client_proto, *server_proto;
	unsigned int client_proto_len = 0, server_proto_len = 0;
	SSL_get0_alpn_selected(client, &client_proto, &client_proto_len);
	SSL_get0_alpn_selected(server, &server_proto, &server_proto_len);
	if (alpn_selected != NULL)
		{
		OPENSSL_free(alpn_selected);
		alpn_selected = NULL;
		}
	if (client_proto_len != server_proto_len ||
	    memcmp(client_proto, server_proto, client_proto_len) != 0)
		{
		BIO_printf(bio_stdout, "ALPN selected protocols differ!\n");
		goto err;
		}
	if (client_proto_len > 0 && alpn_expected == NULL)
		{
		BIO_printf(bio_stdout, "ALPN unexpectedly negotiated\n");
		goto err;
		}
	if (alpn_expected != NULL &&
	    (client_proto_len != strlen(alpn_expected) ||
	     memcmp(client_proto, alpn_expected, client_proto_len) != 0))
		{
		BIO_printf(bio_stdout, "ALPN selected protocols not equal to expected protocol: %s\n", alpn_expected);
		goto err;
		}
	return 0;
err:
	BIO_printf(bio_stdout, "ALPN results: client: '");
	BIO_write(bio_stdout, client_proto, client_proto_len);
	BIO_printf(bio_stdout, "', server: '");
	BIO_write(bio_stdout, server_proto, server_proto_len);
	BIO_printf(bio_stdout, "'\n");
	BIO_printf(bio_stdout, "ALPN configured: client: '%s', server: '%s'\n", alpn_client, alpn_server);
	return -1;
	}
['static int verify_alpn(SSL *client, SSL *server)\n\t{\n\tconst unsigned char *client_proto, *server_proto;\n\tunsigned int client_proto_len = 0, server_proto_len = 0;\n\tSSL_get0_alpn_selected(client, &client_proto, &client_proto_len);\n\tSSL_get0_alpn_selected(server, &server_proto, &server_proto_len);\n\tif (alpn_selected != NULL)\n\t\t{\n\t\tOPENSSL_free(alpn_selected);\n\t\talpn_selected = NULL;\n\t\t}\n\tif (client_proto_len != server_proto_len ||\n\t    memcmp(client_proto, server_proto, client_proto_len) != 0)\n\t\t{\n\t\tBIO_printf(bio_stdout, "ALPN selected protocols differ!\\n");\n\t\tgoto err;\n\t\t}\n\tif (client_proto_len > 0 && alpn_expected == NULL)\n\t\t{\n\t\tBIO_printf(bio_stdout, "ALPN unexpectedly negotiated\\n");\n\t\tgoto err;\n\t\t}\n\tif (alpn_expected != NULL &&\n\t    (client_proto_len != strlen(alpn_expected) ||\n\t     memcmp(client_proto, alpn_expected, client_proto_len) != 0))\n\t\t{\n\t\tBIO_printf(bio_stdout, "ALPN selected protocols not equal to expected protocol: %s\\n", alpn_expected);\n\t\tgoto err;\n\t\t}\n\treturn 0;\nerr:\n\tBIO_printf(bio_stdout, "ALPN results: client: \'");\n\tBIO_write(bio_stdout, client_proto, client_proto_len);\n\tBIO_printf(bio_stdout, "\', server: \'");\n\tBIO_write(bio_stdout, server_proto, server_proto_len);\n\tBIO_printf(bio_stdout, "\'\\n");\n\tBIO_printf(bio_stdout, "ALPN configured: client: \'%s\', server: \'%s\'\\n", alpn_client, alpn_server);\n\treturn -1;\n\t}', 'void SSL_get0_alpn_selected(const SSL *ssl, const unsigned char **data,\n\t\t\t    unsigned *len)\n\t{\n\t*data = NULL;\n\tif (ssl->s3)\n\t\t*data = ssl->s3->alpn_selected;\n\tif (*data == NULL)\n\t\t*len = 0;\n\telse\n\t\t*len = ssl->s3->alpn_selected_len;\n\t}', 'void CRYPTO_free(void *str)\n\t{\n\tif (free_debug_func != NULL)\n\t\tfree_debug_func(str, 0);\n#ifdef LEVITTE_DEBUG_MEM\n\tfprintf(stderr, "LEVITTE_DEBUG_MEM:         < 0x%p\\n", str);\n#endif\n\tfree_func(str);\n\tif (free_debug_func != NULL)\n\t\tfree_debug_func(NULL, 1);\n\t}']