test/ssltest.c:441: error: NULL_DEREFERENCE
  pointer `alpn_selected` last assigned on line 440 could be null and is dereferenced by call to `memcpy()` at line 441, column 5.
Showing all 15 steps of the trace


test/ssltest.c:415:1: start of procedure cb_server_alpn()
413.   }
414.   
415. > static int cb_server_alpn(SSL *s, const unsigned char **out,
416.                             unsigned char *outlen, const unsigned char *in,
417.                             unsigned int inlen, void *arg)

test/ssltest.c:422:5: Skipping next_protos_parse(): empty list of specs
420.       unsigned short protos_len;
421.   
422.       protos = next_protos_parse(&protos_len, alpn_server);
           ^
423.       if (protos == NULL) {
424.           fprintf(stderr, "failed to parser ALPN server protocol string: %s\n",

test/ssltest.c:423:9: Taking false branch
421.   
422.       protos = next_protos_parse(&protos_len, alpn_server);
423.       if (protos == NULL) {
               ^
424.           fprintf(stderr, "failed to parser ALPN server protocol string: %s\n",
425.                   alpn_server);

test/ssltest.c:429:9: Taking false branch
427.       }
428.   
429.       if (SSL_select_next_proto
               ^
430.           ((unsigned char **)out, outlen, protos, protos_len, in,
431.            inlen) != OPENSSL_NPN_NEGOTIATED) {

test/ssltest.c:440:5: 
438.        * verify_alpn.
439.        */
440. >     alpn_selected = OPENSSL_malloc(*outlen);
441.       memcpy(alpn_selected, *out, *outlen);
442.       *out = alpn_selected;

crypto/mem.c:119:1: start of procedure CRYPTO_malloc()
  117.   }
  118.   
  119. > void *CRYPTO_malloc(size_t num, const char *file, int line)
  120.   {
  121.       void *ret = NULL;

crypto/mem.c:121:5: 
  119.   void *CRYPTO_malloc(size_t num, const char *file, int line)
  120.   {
  121. >     void *ret = NULL;
  122.   
  123.       if (num <= 0)

crypto/mem.c:123:9: Taking false branch
  121.       void *ret = NULL;
  122.   
  123.       if (num <= 0)
                 ^
  124.           return NULL;
  125.   

crypto/mem.c:126:5: 
  124.           return NULL;
  125.   
  126. >     allow_customize = 0;
  127.   #ifndef OPENSSL_NO_CRYPTO_MDEBUG
  128.       if (call_malloc_debug) {

crypto/mem.c:136:5: 
  134.       }
  135.   #else
  136. >     (void)file;
  137.       (void)line;
  138.       ret = malloc(num);

crypto/mem.c:137:5: 
  135.   #else
  136.       (void)file;
  137. >     (void)line;
  138.       ret = malloc(num);
  139.   #endif

crypto/mem.c:138:5: 
  136.       (void)file;
  137.       (void)line;
  138. >     ret = malloc(num);
  139.   #endif
  140.   

crypto/mem.c:153:5: 
  151.   #endif
  152.   
  153. >     return ret;
  154.   }
  155.   

crypto/mem.c:154:1: return from a call to CRYPTO_malloc
  152.   
  153.       return ret;
  154. > }
  155.   
  156.   void *CRYPTO_zalloc(size_t num, const char *file, int line)

test/ssltest.c:441:5: 
439.        */
440.       alpn_selected = OPENSSL_malloc(*outlen);
441. >     memcpy(alpn_selected, *out, *outlen);
442.       *out = alpn_selected;
443.   

static int cb_server_alpn(SSL *s, const unsigned char **out,
                          unsigned char *outlen, const unsigned char *in,
                          unsigned int inlen, void *arg)
{
    unsigned char *protos;
    unsigned short protos_len;
    protos = next_protos_parse(&protos_len, alpn_server);
    if (protos == NULL) {
        fprintf(stderr, "failed to parser ALPN server protocol string: %s\n",
                alpn_server);
        abort();
    }
    if (SSL_select_next_proto
        ((unsigned char **)out, outlen, protos, protos_len, in,
         inlen) != OPENSSL_NPN_NEGOTIATED) {
        OPENSSL_free(protos);
        return SSL_TLSEXT_ERR_NOACK;
    }
    alpn_selected = OPENSSL_malloc(*outlen);
    memcpy(alpn_selected, *out, *outlen);
    *out = alpn_selected;
    OPENSSL_free(protos);
    return SSL_TLSEXT_ERR_OK;
}
['static int cb_server_alpn(SSL *s, const unsigned char **out,\n                          unsigned char *outlen, const unsigned char *in,\n                          unsigned int inlen, void *arg)\n{\n    unsigned char *protos;\n    unsigned short protos_len;\n    protos = next_protos_parse(&protos_len, alpn_server);\n    if (protos == NULL) {\n        fprintf(stderr, "failed to parser ALPN server protocol string: %s\\n",\n                alpn_server);\n        abort();\n    }\n    if (SSL_select_next_proto\n        ((unsigned char **)out, outlen, protos, protos_len, in,\n         inlen) != OPENSSL_NPN_NEGOTIATED) {\n        OPENSSL_free(protos);\n        return SSL_TLSEXT_ERR_NOACK;\n    }\n    alpn_selected = OPENSSL_malloc(*outlen);\n    memcpy(alpn_selected, *out, *outlen);\n    *out = alpn_selected;\n    OPENSSL_free(protos);\n    return SSL_TLSEXT_ERR_OK;\n}', 'void *CRYPTO_malloc(size_t num, const char *file, int line)\n{\n    void *ret = NULL;\n    if (num <= 0)\n        return NULL;\n    allow_customize = 0;\n#ifndef OPENSSL_NO_CRYPTO_MDEBUG\n    if (call_malloc_debug) {\n        CRYPTO_mem_debug_malloc(NULL, num, 0, file, line);\n        ret = malloc(num);\n        CRYPTO_mem_debug_malloc(ret, num, 1, file, line);\n    } else {\n        ret = malloc(num);\n    }\n#else\n    (void)file;\n    (void)line;\n    ret = malloc(num);\n#endif\n#ifndef OPENSSL_CPUID_OBJ\n    if (ret && (num > 2048)) {\n        extern unsigned char cleanse_ctr;\n        ((unsigned char *)ret)[0] = cleanse_ctr;\n    }\n#endif\n    return ret;\n}']