test/ssltest.c:465: error: NULL_DEREFERENCE
  pointer `server_proto` last assigned on line 454 could be null and is dereferenced by call to `memcmp()` at line 465, column 9.
Showing all 33 steps of the trace


test/ssltest.c:449:1: start of procedure verify_alpn()
447.   }
448.   
449. > static int verify_alpn(SSL *client, SSL *server)
450.   {
451.       const unsigned char *client_proto, *server_proto;

test/ssltest.c:452:5: 
450.   {
451.       const unsigned char *client_proto, *server_proto;
452. >     unsigned int client_proto_len = 0, server_proto_len = 0;
453.       SSL_get0_alpn_selected(client, &client_proto, &client_proto_len);
454.       SSL_get0_alpn_selected(server, &server_proto, &server_proto_len);

test/ssltest.c:453:5: 
451.       const unsigned char *client_proto, *server_proto;
452.       unsigned int client_proto_len = 0, server_proto_len = 0;
453. >     SSL_get0_alpn_selected(client, &client_proto, &client_proto_len);
454.       SSL_get0_alpn_selected(server, &server_proto, &server_proto_len);
455.   

ssl/ssl_lib.c:1725:1: start of procedure SSL_get0_alpn_selected()
  1723.    * respond with a negotiated protocol then |*len| will be zero.
  1724.    */
  1725. > void SSL_get0_alpn_selected(const SSL *ssl, const unsigned char **data,
  1726.                               unsigned *len)
  1727.   {

ssl/ssl_lib.c:1728:5: 
  1726.                               unsigned *len)
  1727.   {
  1728. >     *data = NULL;
  1729.       if (ssl->s3)
  1730.           *data = ssl->s3->alpn_selected;

ssl/ssl_lib.c:1729:9: Taking true branch
  1727.   {
  1728.       *data = NULL;
  1729.       if (ssl->s3)
                  ^
  1730.           *data = ssl->s3->alpn_selected;
  1731.       if (*data == NULL)

ssl/ssl_lib.c:1730:9: 
  1728.       *data = NULL;
  1729.       if (ssl->s3)
  1730. >         *data = ssl->s3->alpn_selected;
  1731.       if (*data == NULL)
  1732.           *len = 0;

ssl/ssl_lib.c:1731:9: Taking false branch
  1729.       if (ssl->s3)
  1730.           *data = ssl->s3->alpn_selected;
  1731.       if (*data == NULL)
                  ^
  1732.           *len = 0;
  1733.       else

ssl/ssl_lib.c:1734:9: 
  1732.           *len = 0;
  1733.       else
  1734. >         *len = ssl->s3->alpn_selected_len;
  1735.   }
  1736.   

ssl/ssl_lib.c:1731:5: 
  1729.       if (ssl->s3)
  1730.           *data = ssl->s3->alpn_selected;
  1731. >     if (*data == NULL)
  1732.           *len = 0;
  1733.       else

ssl/ssl_lib.c:1735:1: return from a call to SSL_get0_alpn_selected
  1733.       else
  1734.           *len = ssl->s3->alpn_selected_len;
  1735. > }
  1736.   
  1737.   

test/ssltest.c:454:5: 
452.       unsigned int client_proto_len = 0, server_proto_len = 0;
453.       SSL_get0_alpn_selected(client, &client_proto, &client_proto_len);
454. >     SSL_get0_alpn_selected(server, &server_proto, &server_proto_len);
455.   
456.       OPENSSL_free(alpn_selected);

ssl/ssl_lib.c:1725:1: start of procedure SSL_get0_alpn_selected()
  1723.    * respond with a negotiated protocol then |*len| will be zero.
  1724.    */
  1725. > void SSL_get0_alpn_selected(const SSL *ssl, const unsigned char **data,
  1726.                               unsigned *len)
  1727.   {

ssl/ssl_lib.c:1728:5: 
  1726.                               unsigned *len)
  1727.   {
  1728. >     *data = NULL;
  1729.       if (ssl->s3)
  1730.           *data = ssl->s3->alpn_selected;

ssl/ssl_lib.c:1729:9: Taking true branch
  1727.   {
  1728.       *data = NULL;
  1729.       if (ssl->s3)
                  ^
  1730.           *data = ssl->s3->alpn_selected;
  1731.       if (*data == NULL)

ssl/ssl_lib.c:1730:9: 
  1728.       *data = NULL;
  1729.       if (ssl->s3)
  1730. >         *data = ssl->s3->alpn_selected;
  1731.       if (*data == NULL)
  1732.           *len = 0;

ssl/ssl_lib.c:1731:9: Taking true branch
  1729.       if (ssl->s3)
  1730.           *data = ssl->s3->alpn_selected;
  1731.       if (*data == NULL)
                  ^
  1732.           *len = 0;
  1733.       else

ssl/ssl_lib.c:1732:9: 
  1730.           *data = ssl->s3->alpn_selected;
  1731.       if (*data == NULL)
  1732. >         *len = 0;
  1733.       else
  1734.           *len = ssl->s3->alpn_selected_len;

ssl/ssl_lib.c:1731:5: 
  1729.       if (ssl->s3)
  1730.           *data = ssl->s3->alpn_selected;
  1731. >     if (*data == NULL)
  1732.           *len = 0;
  1733.       else

ssl/ssl_lib.c:1735:1: return from a call to SSL_get0_alpn_selected
  1733.       else
  1734.           *len = ssl->s3->alpn_selected_len;
  1735. > }
  1736.   
  1737.   

test/ssltest.c:456:5: 
454.       SSL_get0_alpn_selected(server, &server_proto, &server_proto_len);
455.   
456. >     OPENSSL_free(alpn_selected);
457.       alpn_selected = NULL;
458.   

crypto/mem.c:371:1: start of procedure CRYPTO_free()
  369.   }
  370.   
  371. > void CRYPTO_free(void *str)
  372.   {
  373.       if (free_debug_func != NULL)

crypto/mem.c:373:9: Taking true branch
  371.   void CRYPTO_free(void *str)
  372.   {
  373.       if (free_debug_func != NULL)
                 ^
  374.           free_debug_func(str, 0);
  375.       free_func(str);

crypto/mem.c:374:9: Skipping __function_pointer__(): unresolved function pointer
  372.   {
  373.       if (free_debug_func != NULL)
  374.           free_debug_func(str, 0);
                 ^
  375.       free_func(str);
  376.       if (free_debug_func != NULL)

crypto/mem.c:375:5: Skipping __function_pointer__(): unresolved function pointer
  373.       if (free_debug_func != NULL)
  374.           free_debug_func(str, 0);
  375.       free_func(str);
             ^
  376.       if (free_debug_func != NULL)
  377.           free_debug_func(NULL, 1);

crypto/mem.c:376:9: Taking true branch
  374.           free_debug_func(str, 0);
  375.       free_func(str);
  376.       if (free_debug_func != NULL)
                 ^
  377.           free_debug_func(NULL, 1);
  378.   }

crypto/mem.c:377:9: Skipping __function_pointer__(): unresolved function pointer
  375.       free_func(str);
  376.       if (free_debug_func != NULL)
  377.           free_debug_func(NULL, 1);
                 ^
  378.   }
  379.   

crypto/mem.c:376:5: 
  374.           free_debug_func(str, 0);
  375.       free_func(str);
  376. >     if (free_debug_func != NULL)
  377.           free_debug_func(NULL, 1);
  378.   }

crypto/mem.c:378:1: return from a call to CRYPTO_free
  376.       if (free_debug_func != NULL)
  377.           free_debug_func(NULL, 1);
  378. > }
  379.   
  380.   void CRYPTO_clear_free(void *str, size_t num)

test/ssltest.c:457:5: 
455.   
456.       OPENSSL_free(alpn_selected);
457. >     alpn_selected = NULL;
458.   
459.       if (client_proto_len != server_proto_len) {

test/ssltest.c:459:9: Taking false branch
457.       alpn_selected = NULL;
458.   
459.       if (client_proto_len != server_proto_len) {
               ^
460.           BIO_printf(bio_stdout, "ALPN selected protocols differ!\n");
461.           goto err;

test/ssltest.c:464:9: Taking true branch
462.       }
463.   
464.       if (client_proto != NULL &&
               ^
465.           memcmp(client_proto, server_proto, client_proto_len) != 0) {
466.           BIO_printf(bio_stdout, "ALPN selected protocols differ!\n");

test/ssltest.c:465:9: 
463.   
464.       if (client_proto != NULL &&
465. >         memcmp(client_proto, server_proto, client_proto_len) != 0) {
466.           BIO_printf(bio_stdout, "ALPN selected protocols differ!\n");
467.           goto err;
