test/ssltest.c:458: error: NULL_DEREFERENCE
  pointer `client_proto` last assigned on line 451 could be null and is dereferenced by call to `memcmp()` at line 458, column 9.
Showing all 32 steps of the trace


test/ssltest.c:447:1: start of procedure verify_alpn()
445.   }
446.   
447. > static int verify_alpn(SSL *client, SSL *server)
448.   {
449.       const unsigned char *client_proto, *server_proto;

test/ssltest.c:450:5: 
448.   {
449.       const unsigned char *client_proto, *server_proto;
450. >     unsigned int client_proto_len = 0, server_proto_len = 0;
451.       SSL_get0_alpn_selected(client, &client_proto, &client_proto_len);
452.       SSL_get0_alpn_selected(server, &server_proto, &server_proto_len);

test/ssltest.c:451:5: 
449.       const unsigned char *client_proto, *server_proto;
450.       unsigned int client_proto_len = 0, server_proto_len = 0;
451. >     SSL_get0_alpn_selected(client, &client_proto, &client_proto_len);
452.       SSL_get0_alpn_selected(server, &server_proto, &server_proto_len);
453.   

ssl/ssl_lib.c:1605:1: start of procedure SSL_get0_alpn_selected()
  1603.    * respond with a negotiated protocol then |*len| will be zero.
  1604.    */
  1605. > void SSL_get0_alpn_selected(const SSL *ssl, const unsigned char **data,
  1606.                               unsigned *len)
  1607.   {

ssl/ssl_lib.c:1608:5: 
  1606.                               unsigned *len)
  1607.   {
  1608. >     *data = NULL;
  1609.       if (ssl->s3)
  1610.           *data = ssl->s3->alpn_selected;

ssl/ssl_lib.c:1609:9: Taking true branch
  1607.   {
  1608.       *data = NULL;
  1609.       if (ssl->s3)
                  ^
  1610.           *data = ssl->s3->alpn_selected;
  1611.       if (*data == NULL)

ssl/ssl_lib.c:1610:9: 
  1608.       *data = NULL;
  1609.       if (ssl->s3)
  1610. >         *data = ssl->s3->alpn_selected;
  1611.       if (*data == NULL)
  1612.           *len = 0;

ssl/ssl_lib.c:1611:9: Taking true branch
  1609.       if (ssl->s3)
  1610.           *data = ssl->s3->alpn_selected;
  1611.       if (*data == NULL)
                  ^
  1612.           *len = 0;
  1613.       else

ssl/ssl_lib.c:1612:9: 
  1610.           *data = ssl->s3->alpn_selected;
  1611.       if (*data == NULL)
  1612. >         *len = 0;
  1613.       else
  1614.           *len = ssl->s3->alpn_selected_len;

ssl/ssl_lib.c:1611:5: 
  1609.       if (ssl->s3)
  1610.           *data = ssl->s3->alpn_selected;
  1611. >     if (*data == NULL)
  1612.           *len = 0;
  1613.       else

ssl/ssl_lib.c:1615:1: return from a call to SSL_get0_alpn_selected
  1613.       else
  1614.           *len = ssl->s3->alpn_selected_len;
  1615. > }
  1616.   
  1617.   

test/ssltest.c:452:5: 
450.       unsigned int client_proto_len = 0, server_proto_len = 0;
451.       SSL_get0_alpn_selected(client, &client_proto, &client_proto_len);
452. >     SSL_get0_alpn_selected(server, &server_proto, &server_proto_len);
453.   
454.       OPENSSL_free(alpn_selected);

ssl/ssl_lib.c:1605:1: start of procedure SSL_get0_alpn_selected()
  1603.    * respond with a negotiated protocol then |*len| will be zero.
  1604.    */
  1605. > void SSL_get0_alpn_selected(const SSL *ssl, const unsigned char **data,
  1606.                               unsigned *len)
  1607.   {

ssl/ssl_lib.c:1608:5: 
  1606.                               unsigned *len)
  1607.   {
  1608. >     *data = NULL;
  1609.       if (ssl->s3)
  1610.           *data = ssl->s3->alpn_selected;

ssl/ssl_lib.c:1609:9: Taking true branch
  1607.   {
  1608.       *data = NULL;
  1609.       if (ssl->s3)
                  ^
  1610.           *data = ssl->s3->alpn_selected;
  1611.       if (*data == NULL)

ssl/ssl_lib.c:1610:9: 
  1608.       *data = NULL;
  1609.       if (ssl->s3)
  1610. >         *data = ssl->s3->alpn_selected;
  1611.       if (*data == NULL)
  1612.           *len = 0;

ssl/ssl_lib.c:1611:9: Taking false branch
  1609.       if (ssl->s3)
  1610.           *data = ssl->s3->alpn_selected;
  1611.       if (*data == NULL)
                  ^
  1612.           *len = 0;
  1613.       else

ssl/ssl_lib.c:1614:9: 
  1612.           *len = 0;
  1613.       else
  1614. >         *len = ssl->s3->alpn_selected_len;
  1615.   }
  1616.   

ssl/ssl_lib.c:1611:5: 
  1609.       if (ssl->s3)
  1610.           *data = ssl->s3->alpn_selected;
  1611. >     if (*data == NULL)
  1612.           *len = 0;
  1613.       else

ssl/ssl_lib.c:1615:1: return from a call to SSL_get0_alpn_selected
  1613.       else
  1614.           *len = ssl->s3->alpn_selected_len;
  1615. > }
  1616.   
  1617.   

test/ssltest.c:454:5: 
452.       SSL_get0_alpn_selected(server, &server_proto, &server_proto_len);
453.   
454. >     OPENSSL_free(alpn_selected);
455.       alpn_selected = NULL;
456.   

crypto/mem.c:392:1: start of procedure CRYPTO_free()
  390.   }
  391.   
  392. > void CRYPTO_free(void *str)
  393.   {
  394.       if (free_debug_func != NULL)

crypto/mem.c:394:9: Taking true branch
  392.   void CRYPTO_free(void *str)
  393.   {
  394.       if (free_debug_func != NULL)
                 ^
  395.           free_debug_func(str, 0);
  396.   #ifdef LEVITTE_DEBUG_MEM

crypto/mem.c:395:9: Skipping __function_pointer__(): unresolved function pointer
  393.   {
  394.       if (free_debug_func != NULL)
  395.           free_debug_func(str, 0);
                 ^
  396.   #ifdef LEVITTE_DEBUG_MEM
  397.       fprintf(stderr, "LEVITTE_DEBUG_MEM:         < 0x%p\n", str);

crypto/mem.c:399:5: Skipping __function_pointer__(): unresolved function pointer
  397.       fprintf(stderr, "LEVITTE_DEBUG_MEM:         < 0x%p\n", str);
  398.   #endif
  399.       free_func(str);
             ^
  400.       if (free_debug_func != NULL)
  401.           free_debug_func(NULL, 1);

crypto/mem.c:400:9: Taking true branch
  398.   #endif
  399.       free_func(str);
  400.       if (free_debug_func != NULL)
                 ^
  401.           free_debug_func(NULL, 1);
  402.   }

crypto/mem.c:401:9: Skipping __function_pointer__(): unresolved function pointer
  399.       free_func(str);
  400.       if (free_debug_func != NULL)
  401.           free_debug_func(NULL, 1);
                 ^
  402.   }
  403.   

crypto/mem.c:400:5: 
  398.   #endif
  399.       free_func(str);
  400. >     if (free_debug_func != NULL)
  401.           free_debug_func(NULL, 1);
  402.   }

crypto/mem.c:402:1: return from a call to CRYPTO_free
  400.       if (free_debug_func != NULL)
  401.           free_debug_func(NULL, 1);
  402. > }
  403.   
  404.   void CRYPTO_clear_free(void *str, size_t num)

test/ssltest.c:455:5: 
453.   
454.       OPENSSL_free(alpn_selected);
455. >     alpn_selected = NULL;
456.   
457.       if (client_proto_len != server_proto_len ||

test/ssltest.c:457:9: Taking false branch
455.       alpn_selected = NULL;
456.   
457.       if (client_proto_len != server_proto_len ||
               ^
458.           memcmp(client_proto, server_proto, client_proto_len) != 0) {
459.           BIO_printf(bio_stdout, "ALPN selected protocols differ!\n");

test/ssltest.c:458:9: 
456.   
457.       if (client_proto_len != server_proto_len ||
458. >         memcmp(client_proto, server_proto, client_proto_len) != 0) {
459.           BIO_printf(bio_stdout, "ALPN selected protocols differ!\n");
460.           goto err;

static int verify_alpn(SSL *client, SSL *server)
{
    const unsigned char *client_proto, *server_proto;
    unsigned int client_proto_len = 0, server_proto_len = 0;
    SSL_get0_alpn_selected(client, &client_proto, &client_proto_len);
    SSL_get0_alpn_selected(server, &server_proto, &server_proto_len);
    OPENSSL_free(alpn_selected);
    alpn_selected = NULL;
    if (client_proto_len != server_proto_len ||
        memcmp(client_proto, server_proto, client_proto_len) != 0) {
        BIO_printf(bio_stdout, "ALPN selected protocols differ!\n");
        goto err;
    }
    if (client_proto_len > 0 && alpn_expected == NULL) {
        BIO_printf(bio_stdout, "ALPN unexpectedly negotiated\n");
        goto err;
    }
    if (alpn_expected != NULL &&
        (client_proto_len != strlen(alpn_expected) ||
         memcmp(client_proto, alpn_expected, client_proto_len) != 0)) {
        BIO_printf(bio_stdout,
                   "ALPN selected protocols not equal to expected protocol: %s\n",
                   alpn_expected);
        goto err;
    }
    return 0;
 err:
    BIO_printf(bio_stdout, "ALPN results: client: '");
    BIO_write(bio_stdout, client_proto, client_proto_len);
    BIO_printf(bio_stdout, "', server: '");
    BIO_write(bio_stdout, server_proto, server_proto_len);
    BIO_printf(bio_stdout, "'\n");
    BIO_printf(bio_stdout, "ALPN configured: client: '%s', server: '%s'\n",
               alpn_client, alpn_server);
    return -1;
}
['static int verify_alpn(SSL *client, SSL *server)\n{\n    const unsigned char *client_proto, *server_proto;\n    unsigned int client_proto_len = 0, server_proto_len = 0;\n    SSL_get0_alpn_selected(client, &client_proto, &client_proto_len);\n    SSL_get0_alpn_selected(server, &server_proto, &server_proto_len);\n    OPENSSL_free(alpn_selected);\n    alpn_selected = NULL;\n    if (client_proto_len != server_proto_len ||\n        memcmp(client_proto, server_proto, client_proto_len) != 0) {\n        BIO_printf(bio_stdout, "ALPN selected protocols differ!\\n");\n        goto err;\n    }\n    if (client_proto_len > 0 && alpn_expected == NULL) {\n        BIO_printf(bio_stdout, "ALPN unexpectedly negotiated\\n");\n        goto err;\n    }\n    if (alpn_expected != NULL &&\n        (client_proto_len != strlen(alpn_expected) ||\n         memcmp(client_proto, alpn_expected, client_proto_len) != 0)) {\n        BIO_printf(bio_stdout,\n                   "ALPN selected protocols not equal to expected protocol: %s\\n",\n                   alpn_expected);\n        goto err;\n    }\n    return 0;\n err:\n    BIO_printf(bio_stdout, "ALPN results: client: \'");\n    BIO_write(bio_stdout, client_proto, client_proto_len);\n    BIO_printf(bio_stdout, "\', server: \'");\n    BIO_write(bio_stdout, server_proto, server_proto_len);\n    BIO_printf(bio_stdout, "\'\\n");\n    BIO_printf(bio_stdout, "ALPN configured: client: \'%s\', server: \'%s\'\\n",\n               alpn_client, alpn_server);\n    return -1;\n}', 'void SSL_get0_alpn_selected(const SSL *ssl, const unsigned char **data,\n                            unsigned *len)\n{\n    *data = NULL;\n    if (ssl->s3)\n        *data = ssl->s3->alpn_selected;\n    if (*data == NULL)\n        *len = 0;\n    else\n        *len = ssl->s3->alpn_selected_len;\n}', 'void CRYPTO_free(void *str)\n{\n    if (free_debug_func != NULL)\n        free_debug_func(str, 0);\n#ifdef LEVITTE_DEBUG_MEM\n    fprintf(stderr, "LEVITTE_DEBUG_MEM:         < 0x%p\\n", str);\n#endif\n    free_func(str);\n    if (free_debug_func != NULL)\n        free_debug_func(NULL, 1);\n}']