test/ssltest.c:465: error: NULL_DEREFERENCE
  pointer `server_proto` last assigned on line 454 could be null and is dereferenced by call to `memcmp()` at line 465, column 9.
Showing all 28 steps of the trace


test/ssltest.c:449:1: start of procedure verify_alpn()
447.   }
448.   
449. > static int verify_alpn(SSL *client, SSL *server)
450.   {
451.       const unsigned char *client_proto, *server_proto;

test/ssltest.c:452:5: 
450.   {
451.       const unsigned char *client_proto, *server_proto;
452. >     unsigned int client_proto_len = 0, server_proto_len = 0;
453.       SSL_get0_alpn_selected(client, &client_proto, &client_proto_len);
454.       SSL_get0_alpn_selected(server, &server_proto, &server_proto_len);

test/ssltest.c:453:5: 
451.       const unsigned char *client_proto, *server_proto;
452.       unsigned int client_proto_len = 0, server_proto_len = 0;
453. >     SSL_get0_alpn_selected(client, &client_proto, &client_proto_len);
454.       SSL_get0_alpn_selected(server, &server_proto, &server_proto_len);
455.   

ssl/ssl_lib.c:2179:1: start of procedure SSL_get0_alpn_selected()
  2177.    * respond with a negotiated protocol then |*len| will be zero.
  2178.    */
  2179. > void SSL_get0_alpn_selected(const SSL *ssl, const unsigned char **data,
  2180.                               unsigned *len)
  2181.   {

ssl/ssl_lib.c:2182:5: 
  2180.                               unsigned *len)
  2181.   {
  2182. >     *data = NULL;
  2183.       if (ssl->s3)
  2184.           *data = ssl->s3->alpn_selected;

ssl/ssl_lib.c:2183:9: Taking true branch
  2181.   {
  2182.       *data = NULL;
  2183.       if (ssl->s3)
                  ^
  2184.           *data = ssl->s3->alpn_selected;
  2185.       if (*data == NULL)

ssl/ssl_lib.c:2184:9: 
  2182.       *data = NULL;
  2183.       if (ssl->s3)
  2184. >         *data = ssl->s3->alpn_selected;
  2185.       if (*data == NULL)
  2186.           *len = 0;

ssl/ssl_lib.c:2185:9: Taking false branch
  2183.       if (ssl->s3)
  2184.           *data = ssl->s3->alpn_selected;
  2185.       if (*data == NULL)
                  ^
  2186.           *len = 0;
  2187.       else

ssl/ssl_lib.c:2188:9: 
  2186.           *len = 0;
  2187.       else
  2188. >         *len = ssl->s3->alpn_selected_len;
  2189.   }
  2190.   

ssl/ssl_lib.c:2185:5: 
  2183.       if (ssl->s3)
  2184.           *data = ssl->s3->alpn_selected;
  2185. >     if (*data == NULL)
  2186.           *len = 0;
  2187.       else

ssl/ssl_lib.c:2189:1: return from a call to SSL_get0_alpn_selected
  2187.       else
  2188.           *len = ssl->s3->alpn_selected_len;
  2189. > }
  2190.   
  2191.   

test/ssltest.c:454:5: 
452.       unsigned int client_proto_len = 0, server_proto_len = 0;
453.       SSL_get0_alpn_selected(client, &client_proto, &client_proto_len);
454. >     SSL_get0_alpn_selected(server, &server_proto, &server_proto_len);
455.   
456.       OPENSSL_free(alpn_selected);

ssl/ssl_lib.c:2179:1: start of procedure SSL_get0_alpn_selected()
  2177.    * respond with a negotiated protocol then |*len| will be zero.
  2178.    */
  2179. > void SSL_get0_alpn_selected(const SSL *ssl, const unsigned char **data,
  2180.                               unsigned *len)
  2181.   {

ssl/ssl_lib.c:2182:5: 
  2180.                               unsigned *len)
  2181.   {
  2182. >     *data = NULL;
  2183.       if (ssl->s3)
  2184.           *data = ssl->s3->alpn_selected;

ssl/ssl_lib.c:2183:9: Taking true branch
  2181.   {
  2182.       *data = NULL;
  2183.       if (ssl->s3)
                  ^
  2184.           *data = ssl->s3->alpn_selected;
  2185.       if (*data == NULL)

ssl/ssl_lib.c:2184:9: 
  2182.       *data = NULL;
  2183.       if (ssl->s3)
  2184. >         *data = ssl->s3->alpn_selected;
  2185.       if (*data == NULL)
  2186.           *len = 0;

ssl/ssl_lib.c:2185:9: Taking true branch
  2183.       if (ssl->s3)
  2184.           *data = ssl->s3->alpn_selected;
  2185.       if (*data == NULL)
                  ^
  2186.           *len = 0;
  2187.       else

ssl/ssl_lib.c:2186:9: 
  2184.           *data = ssl->s3->alpn_selected;
  2185.       if (*data == NULL)
  2186. >         *len = 0;
  2187.       else
  2188.           *len = ssl->s3->alpn_selected_len;

ssl/ssl_lib.c:2185:5: 
  2183.       if (ssl->s3)
  2184.           *data = ssl->s3->alpn_selected;
  2185. >     if (*data == NULL)
  2186.           *len = 0;
  2187.       else

ssl/ssl_lib.c:2189:1: return from a call to SSL_get0_alpn_selected
  2187.       else
  2188.           *len = ssl->s3->alpn_selected_len;
  2189. > }
  2190.   
  2191.   

test/ssltest.c:456:5: 
454.       SSL_get0_alpn_selected(server, &server_proto, &server_proto_len);
455.   
456. >     OPENSSL_free(alpn_selected);
457.       alpn_selected = NULL;
458.   

crypto/mem.c:234:1: start of procedure CRYPTO_free()
  232.   }
  233.   
  234. > void CRYPTO_free(void *str)
  235.   {
  236.   #ifndef OPENSSL_NO_CRYPTO_MDEBUG

crypto/mem.c:245:5: 
  243.       }
  244.   #else
  245. >     free(str);
  246.   #endif
  247.   }

crypto/mem.c:247:1: return from a call to CRYPTO_free
  245.       free(str);
  246.   #endif
  247. > }
  248.   
  249.   void CRYPTO_clear_free(void *str, size_t num)

test/ssltest.c:457:5: 
455.   
456.       OPENSSL_free(alpn_selected);
457. >     alpn_selected = NULL;
458.   
459.       if (client_proto_len != server_proto_len) {

test/ssltest.c:459:9: Taking false branch
457.       alpn_selected = NULL;
458.   
459.       if (client_proto_len != server_proto_len) {
               ^
460.           BIO_printf(bio_stdout, "ALPN selected protocols differ!\n");
461.           goto err;

test/ssltest.c:464:9: Taking true branch
462.       }
463.   
464.       if (client_proto != NULL &&
               ^
465.           memcmp(client_proto, server_proto, client_proto_len) != 0) {
466.           BIO_printf(bio_stdout, "ALPN selected protocols differ!\n");

test/ssltest.c:465:9: 
463.   
464.       if (client_proto != NULL &&
465. >         memcmp(client_proto, server_proto, client_proto_len) != 0) {
466.           BIO_printf(bio_stdout, "ALPN selected protocols differ!\n");
467.           goto err;
