test/sslapitest.c:5582: error: NULL_DEREFERENCE
  pointer `sctx` last assigned on line 5519 could be null and is dereferenced by call to `SSL_CTX_free()` at line 5582, column 5.
Showing all 35 steps of the trace


test/sslapitest.c:5516:1: start of procedure test_srp()
5514.    * Test 5: Connection failure due to bad password, vbase loaded from new file
5515.    */
5516. > static int test_srp(int tst)
5517.   {
5518.       char *userid = "test", *password = "password", *tstsrpfile;

test/sslapitest.c:5518:5: 
5516.   static int test_srp(int tst)
5517.   {
5518. >     char *userid = "test", *password = "password", *tstsrpfile;
5519.       SSL_CTX *cctx = NULL, *sctx = NULL;
5520.       SSL *clientssl = NULL, *serverssl = NULL;

test/sslapitest.c:5519:5: 
5517.   {
5518.       char *userid = "test", *password = "password", *tstsrpfile;
5519. >     SSL_CTX *cctx = NULL, *sctx = NULL;
5520.       SSL *clientssl = NULL, *serverssl = NULL;
5521.       int ret, testresult = 0;

test/sslapitest.c:5520:5: 
5518.       char *userid = "test", *password = "password", *tstsrpfile;
5519.       SSL_CTX *cctx = NULL, *sctx = NULL;
5520. >     SSL *clientssl = NULL, *serverssl = NULL;
5521.       int ret, testresult = 0;
5522.   

test/sslapitest.c:5521:5: 
5519.       SSL_CTX *cctx = NULL, *sctx = NULL;
5520.       SSL *clientssl = NULL, *serverssl = NULL;
5521. >     int ret, testresult = 0;
5522.   
5523.       vbase = SRP_VBASE_new(NULL);

test/sslapitest.c:5523:5: Skipping SRP_VBASE_new(): empty list of specs
5521.       int ret, testresult = 0;
5522.   
5523.       vbase = SRP_VBASE_new(NULL);
            ^
5524.       if (!TEST_ptr(vbase))
5525.           goto end;

test/sslapitest.c:5524:10: 
5522.   
5523.       vbase = SRP_VBASE_new(NULL);
5524. >     if (!TEST_ptr(vbase))
5525.           goto end;
5526.   

test/testutil/tests.c:252:1: start of procedure test_ptr()
  250.   }
  251.   
  252. > int test_ptr(const char *file, int line, const char *s, const void *p)
  253.   {
  254.       if (p != NULL)

test/testutil/tests.c:254:9: Taking false branch
  252.   int test_ptr(const char *file, int line, const char *s, const void *p)
  253.   {
  254.       if (p != NULL)
                 ^
  255.           return 1;
  256.       test_fail_message(NULL, file, line, "ptr", s, "NULL", "!=", "%p", p);

test/testutil/tests.c:256:5: Skipping test_fail_message(): empty list of specs
  254.       if (p != NULL)
  255.           return 1;
  256.       test_fail_message(NULL, file, line, "ptr", s, "NULL", "!=", "%p", p);
             ^
  257.       return 0;
  258.   }

test/testutil/tests.c:257:5: 
  255.           return 1;
  256.       test_fail_message(NULL, file, line, "ptr", s, "NULL", "!=", "%p", p);
  257. >     return 0;
  258.   }
  259.   

test/testutil/tests.c:258:1: return from a call to test_ptr
  256.       test_fail_message(NULL, file, line, "ptr", s, "NULL", "!=", "%p", p);
  257.       return 0;
  258. > }
  259.   
  260.   int test_true(const char *file, int line, const char *s, int b)

test/sslapitest.c:5524:10: Taking true branch
5522.   
5523.       vbase = SRP_VBASE_new(NULL);
5524.       if (!TEST_ptr(vbase))
                 ^
5525.           goto end;
5526.   

test/sslapitest.c:5577:2: 
5575.       testresult = 1;
5576.   
5577. >  end:
5578.       SRP_VBASE_free(vbase);
5579.       vbase = NULL;

test/sslapitest.c:5578:5: 
5576.   
5577.    end:
5578. >     SRP_VBASE_free(vbase);
5579.       vbase = NULL;
5580.       SSL_free(serverssl);

crypto/srp/srp_vfy.c:298:1: start of procedure SRP_VBASE_free()
  296.   }
  297.   
  298. > void SRP_VBASE_free(SRP_VBASE *vb)
  299.   {
  300.       if (!vb)

crypto/srp/srp_vfy.c:300:10: Taking true branch
  298.   void SRP_VBASE_free(SRP_VBASE *vb)
  299.   {
  300.       if (!vb)
                  ^
  301.           return;
  302.       sk_SRP_user_pwd_pop_free(vb->users_pwd, SRP_user_pwd_free);

crypto/srp/srp_vfy.c:301:9: 
  299.   {
  300.       if (!vb)
  301. >         return;
  302.       sk_SRP_user_pwd_pop_free(vb->users_pwd, SRP_user_pwd_free);
  303.       sk_SRP_gN_cache_free(vb->gN_cache);

crypto/srp/srp_vfy.c:306:1: return from a call to SRP_VBASE_free
  304.       OPENSSL_free(vb->seed_key);
  305.       OPENSSL_free(vb);
  306. > }
  307.   
  308.   static SRP_gN_cache *SRP_gN_new_init(const char *ch)

test/sslapitest.c:5579:5: 
5577.    end:
5578.       SRP_VBASE_free(vbase);
5579. >     vbase = NULL;
5580.       SSL_free(serverssl);
5581.       SSL_free(clientssl);

test/sslapitest.c:5580:5: Skipping SSL_free(): empty list of specs
5578.       SRP_VBASE_free(vbase);
5579.       vbase = NULL;
5580.       SSL_free(serverssl);
            ^
5581.       SSL_free(clientssl);
5582.       SSL_CTX_free(sctx);

test/sslapitest.c:5581:5: Skipping SSL_free(): empty list of specs
5579.       vbase = NULL;
5580.       SSL_free(serverssl);
5581.       SSL_free(clientssl);
            ^
5582.       SSL_CTX_free(sctx);
5583.       SSL_CTX_free(cctx);

test/sslapitest.c:5582:5: 
5580.       SSL_free(serverssl);
5581.       SSL_free(clientssl);
5582. >     SSL_CTX_free(sctx);
5583.       SSL_CTX_free(cctx);
5584.   

ssl/ssl_lib.c:3240:1: start of procedure SSL_CTX_free()
  3238.   }
  3239.   
  3240. > void SSL_CTX_free(SSL_CTX *a)
  3241.   {
  3242.       int i;

ssl/ssl_lib.c:3244:9: Taking false branch
  3242.       int i;
  3243.   
  3244.       if (a == NULL)
                  ^
  3245.           return;
  3246.   

ssl/ssl_lib.c:3247:5: 
  3245.           return;
  3246.   
  3247. >     CRYPTO_DOWN_REF(&a->references, &i, a->lock);
  3248.       REF_PRINT_COUNT("SSL_CTX", a);
  3249.       if (i > 0)

include/internal/refcount.h:49:1: start of procedure CRYPTO_DOWN_REF()
    47.    * otherwise imply an acquire fence. Hence conditional acquire fence...
    48.    */
    49. > static inline int CRYPTO_DOWN_REF(_Atomic int *val, int *ret, void *lock)
    50.   {
    51.       *ret = atomic_fetch_sub_explicit(val, 1, memory_order_relaxed) - 1;

include/internal/refcount.h:51:5: 
    49.   static inline int CRYPTO_DOWN_REF(_Atomic int *val, int *ret, void *lock)
    50.   {
    51. >     *ret = atomic_fetch_sub_explicit(val, 1, memory_order_relaxed) - 1;
    52.       if (*ret == 0)
    53.           atomic_thread_fence(memory_order_acquire);

include/internal/refcount.h:52:9: Taking true branch
    50.   {
    51.       *ret = atomic_fetch_sub_explicit(val, 1, memory_order_relaxed) - 1;
    52.       if (*ret == 0)
                  ^
    53.           atomic_thread_fence(memory_order_acquire);
    54.       return 1;

include/internal/refcount.h:53:9: Skipping __c11_atomic_thread_fence(): method has no implementation
    51.       *ret = atomic_fetch_sub_explicit(val, 1, memory_order_relaxed) - 1;
    52.       if (*ret == 0)
    53.           atomic_thread_fence(memory_order_acquire);
                  ^
    54.       return 1;
    55.   }

include/internal/refcount.h:54:5: 
    52.       if (*ret == 0)
    53.           atomic_thread_fence(memory_order_acquire);
    54. >     return 1;
    55.   }
    56.   

include/internal/refcount.h:55:1: return from a call to CRYPTO_DOWN_REF
    53.           atomic_thread_fence(memory_order_acquire);
    54.       return 1;
    55. > }
    56.   
    57.   #  elif defined(__GNUC__) && defined(__ATOMIC_RELAXED) && __GCC_ATOMIC_INT_LOCK_FREE > 0

ssl/ssl_lib.c:3249:9: Taking true branch
  3247.       CRYPTO_DOWN_REF(&a->references, &i, a->lock);
  3248.       REF_PRINT_COUNT("SSL_CTX", a);
  3249.       if (i > 0)
                  ^
  3250.           return;
  3251.       REF_ASSERT_ISNT(i < 0);

ssl/ssl_lib.c:3250:9: 
  3248.       REF_PRINT_COUNT("SSL_CTX", a);
  3249.       if (i > 0)
  3250. >         return;
  3251.       REF_ASSERT_ISNT(i < 0);
  3252.   

ssl/ssl_lib.c:3302:1: return from a call to SSL_CTX_free
  3300.   
  3301.       OPENSSL_free(a);
  3302. > }
  3303.   
  3304.   void SSL_CTX_set_default_passwd_cb(SSL_CTX *ctx, pem_password_cb *cb)

static int test_srp(int tst)
{
    char *userid = "test", *password = "password", *tstsrpfile;
    SSL_CTX *cctx = NULL, *sctx = NULL;
    SSL *clientssl = NULL, *serverssl = NULL;
    int ret, testresult = 0;
    vbase = SRP_VBASE_new(NULL);
    if (!TEST_ptr(vbase))
        goto end;
    if (tst == 0 || tst == 1) {
        if (!TEST_true(create_new_vbase(userid, password)))
            goto end;
    } else {
        if (tst == 4 || tst == 5) {
            if (!TEST_true(create_new_vfile(userid, password, tmpfilename)))
                goto end;
            tstsrpfile = tmpfilename;
        } else {
            tstsrpfile = srpvfile;
        }
        if (!TEST_int_eq(SRP_VBASE_init(vbase, tstsrpfile), SRP_NO_ERROR))
            goto end;
    }
    if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(), TLS_client_method(),
                                       TLS1_VERSION, 0,
                                       &sctx, &cctx, cert, privkey)))
        goto end;
    if (!TEST_int_gt(SSL_CTX_set_srp_username_callback(sctx, ssl_srp_cb), 0)
            || !TEST_true(SSL_CTX_set_cipher_list(cctx, "SRP-AES-128-CBC-SHA"))
            || !TEST_true(SSL_CTX_set_max_proto_version(sctx, TLS1_2_VERSION))
            || !TEST_true(SSL_CTX_set_max_proto_version(cctx, TLS1_2_VERSION))
            || !TEST_int_gt(SSL_CTX_set_srp_username(cctx, userid), 0))
        goto end;
    if (tst % 2 == 1) {
        if (!TEST_int_gt(SSL_CTX_set_srp_password(cctx, "badpass"), 0))
            goto end;
    } else {
        if (!TEST_int_gt(SSL_CTX_set_srp_password(cctx, password), 0))
            goto end;
    }
    if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
                                      NULL, NULL)))
        goto end;
    ret = create_ssl_connection(serverssl, clientssl, SSL_ERROR_NONE);
    if (ret) {
        if (!TEST_true(tst % 2 == 0))
            goto end;
    } else {
        if (!TEST_true(tst % 2 == 1))
            goto end;
    }
    testresult = 1;
 end:
    SRP_VBASE_free(vbase);
    vbase = NULL;
    SSL_free(serverssl);
    SSL_free(clientssl);
    SSL_CTX_free(sctx);
    SSL_CTX_free(cctx);
    return testresult;
}
['static int test_srp(int tst)\n{\n    char *userid = "test", *password = "password", *tstsrpfile;\n    SSL_CTX *cctx = NULL, *sctx = NULL;\n    SSL *clientssl = NULL, *serverssl = NULL;\n    int ret, testresult = 0;\n    vbase = SRP_VBASE_new(NULL);\n    if (!TEST_ptr(vbase))\n        goto end;\n    if (tst == 0 || tst == 1) {\n        if (!TEST_true(create_new_vbase(userid, password)))\n            goto end;\n    } else {\n        if (tst == 4 || tst == 5) {\n            if (!TEST_true(create_new_vfile(userid, password, tmpfilename)))\n                goto end;\n            tstsrpfile = tmpfilename;\n        } else {\n            tstsrpfile = srpvfile;\n        }\n        if (!TEST_int_eq(SRP_VBASE_init(vbase, tstsrpfile), SRP_NO_ERROR))\n            goto end;\n    }\n    if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(), TLS_client_method(),\n                                       TLS1_VERSION, 0,\n                                       &sctx, &cctx, cert, privkey)))\n        goto end;\n    if (!TEST_int_gt(SSL_CTX_set_srp_username_callback(sctx, ssl_srp_cb), 0)\n            || !TEST_true(SSL_CTX_set_cipher_list(cctx, "SRP-AES-128-CBC-SHA"))\n            || !TEST_true(SSL_CTX_set_max_proto_version(sctx, TLS1_2_VERSION))\n            || !TEST_true(SSL_CTX_set_max_proto_version(cctx, TLS1_2_VERSION))\n            || !TEST_int_gt(SSL_CTX_set_srp_username(cctx, userid), 0))\n        goto end;\n    if (tst % 2 == 1) {\n        if (!TEST_int_gt(SSL_CTX_set_srp_password(cctx, "badpass"), 0))\n            goto end;\n    } else {\n        if (!TEST_int_gt(SSL_CTX_set_srp_password(cctx, password), 0))\n            goto end;\n    }\n    if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,\n                                      NULL, NULL)))\n        goto end;\n    ret = create_ssl_connection(serverssl, clientssl, SSL_ERROR_NONE);\n    if (ret) {\n        if (!TEST_true(tst % 2 == 0))\n            goto end;\n    } else {\n        if (!TEST_true(tst % 2 == 1))\n            goto end;\n    }\n    testresult = 1;\n end:\n    SRP_VBASE_free(vbase);\n    vbase = NULL;\n    SSL_free(serverssl);\n    SSL_free(clientssl);\n    SSL_CTX_free(sctx);\n    SSL_CTX_free(cctx);\n    return testresult;\n}', 'int test_ptr(const char *file, int line, const char *s, const void *p)\n{\n    if (p != NULL)\n        return 1;\n    test_fail_message(NULL, file, line, "ptr", s, "NULL", "!=", "%p", p);\n    return 0;\n}', 'void SRP_VBASE_free(SRP_VBASE *vb)\n{\n    if (!vb)\n        return;\n    sk_SRP_user_pwd_pop_free(vb->users_pwd, SRP_user_pwd_free);\n    sk_SRP_gN_cache_free(vb->gN_cache);\n    OPENSSL_free(vb->seed_key);\n    OPENSSL_free(vb);\n}', 'void SSL_CTX_free(SSL_CTX *a)\n{\n    int i;\n    if (a == NULL)\n        return;\n    CRYPTO_DOWN_REF(&a->references, &i, a->lock);\n    REF_PRINT_COUNT("SSL_CTX", a);\n    if (i > 0)\n        return;\n    REF_ASSERT_ISNT(i < 0);\n    X509_VERIFY_PARAM_free(a->param);\n    dane_ctx_final(&a->dane);\n    if (a->sessions != NULL)\n        SSL_CTX_flush_sessions(a, 0);\n    CRYPTO_free_ex_data(CRYPTO_EX_INDEX_SSL_CTX, a, &a->ex_data);\n    lh_SSL_SESSION_free(a->sessions);\n    X509_STORE_free(a->cert_store);\n#ifndef OPENSSL_NO_CT\n    CTLOG_STORE_free(a->ctlog_store);\n#endif\n    sk_SSL_CIPHER_free(a->cipher_list);\n    sk_SSL_CIPHER_free(a->cipher_list_by_id);\n    sk_SSL_CIPHER_free(a->tls13_ciphersuites);\n    ssl_cert_free(a->cert);\n    sk_X509_NAME_pop_free(a->ca_names, X509_NAME_free);\n    sk_X509_NAME_pop_free(a->client_ca_names, X509_NAME_free);\n    sk_X509_pop_free(a->extra_certs, X509_free);\n    a->comp_methods = NULL;\n#ifndef OPENSSL_NO_SRTP\n    sk_SRTP_PROTECTION_PROFILE_free(a->srtp_profiles);\n#endif\n#ifndef OPENSSL_NO_SRP\n    SSL_CTX_SRP_CTX_free(a);\n#endif\n#ifndef OPENSSL_NO_ENGINE\n    ENGINE_finish(a->client_cert_engine);\n#endif\n#ifndef OPENSSL_NO_EC\n    OPENSSL_free(a->ext.ecpointformats);\n    OPENSSL_free(a->ext.supportedgroups);\n#endif\n    OPENSSL_free(a->ext.alpn);\n    OPENSSL_secure_free(a->ext.secure);\n    CRYPTO_THREAD_lock_free(a->lock);\n    OPENSSL_free(a);\n}', 'static inline int CRYPTO_DOWN_REF(_Atomic int *val, int *ret, void *lock)\n{\n    *ret = atomic_fetch_sub_explicit(val, 1, memory_order_relaxed) - 1;\n    if (*ret == 0)\n        atomic_thread_fence(memory_order_acquire);\n    return 1;\n}']