ssl/ssltest.c:463: error: NULL_DEREFERENCE
  pointer `client_proto` last assigned on line 453 could be null and is dereferenced by call to `memcmp()` at line 463, column 6.
Showing all 33 steps of the trace


ssl/ssltest.c:449:1: start of procedure verify_alpn()
447.   	}
448.   
449. > static int verify_alpn(SSL *client, SSL *server)
450.   	{
451.   	const unsigned char *client_proto, *server_proto;

ssl/ssltest.c:452:2: 
450.   	{
451.   	const unsigned char *client_proto, *server_proto;
452. > 	unsigned int client_proto_len = 0, server_proto_len = 0;
453.   	SSL_get0_alpn_selected(client, &client_proto, &client_proto_len);
454.   	SSL_get0_alpn_selected(server, &server_proto, &server_proto_len);

ssl/ssltest.c:453:2: 
451.   	const unsigned char *client_proto, *server_proto;
452.   	unsigned int client_proto_len = 0, server_proto_len = 0;
453. > 	SSL_get0_alpn_selected(client, &client_proto, &client_proto_len);
454.   	SSL_get0_alpn_selected(server, &server_proto, &server_proto_len);
455.   

ssl/ssl_lib.c:1819:1: start of procedure SSL_get0_alpn_selected()
  1817.    * including the leading length-prefix byte). If the server didn't respond with
  1818.    * a negotiated protocol then |*len| will be zero. */
  1819. > void SSL_get0_alpn_selected(const SSL *ssl, const unsigned char **data,
  1820.   			    unsigned *len)
  1821.   	{

ssl/ssl_lib.c:1822:2: 
  1820.   			    unsigned *len)
  1821.   	{
  1822. > 	*data = NULL;
  1823.   	if (ssl->s3)
  1824.   		*data = ssl->s3->alpn_selected;

ssl/ssl_lib.c:1823:6: Taking true branch
  1821.   	{
  1822.   	*data = NULL;
  1823.   	if (ssl->s3)
               ^
  1824.   		*data = ssl->s3->alpn_selected;
  1825.   	if (*data == NULL)

ssl/ssl_lib.c:1824:3: 
  1822.   	*data = NULL;
  1823.   	if (ssl->s3)
  1824. > 		*data = ssl->s3->alpn_selected;
  1825.   	if (*data == NULL)
  1826.   		*len = 0;

ssl/ssl_lib.c:1825:6: Taking true branch
  1823.   	if (ssl->s3)
  1824.   		*data = ssl->s3->alpn_selected;
  1825.   	if (*data == NULL)
               ^
  1826.   		*len = 0;
  1827.   	else

ssl/ssl_lib.c:1826:3: 
  1824.   		*data = ssl->s3->alpn_selected;
  1825.   	if (*data == NULL)
  1826. > 		*len = 0;
  1827.   	else
  1828.   		*len = ssl->s3->alpn_selected_len;

ssl/ssl_lib.c:1825:2: 
  1823.   	if (ssl->s3)
  1824.   		*data = ssl->s3->alpn_selected;
  1825. > 	if (*data == NULL)
  1826.   		*len = 0;
  1827.   	else

ssl/ssl_lib.c:1829:2: return from a call to SSL_get0_alpn_selected
  1827.   	else
  1828.   		*len = ssl->s3->alpn_selected_len;
  1829.   	}
           ^
  1830.   
  1831.   #endif /* !OPENSSL_NO_TLSEXT */

ssl/ssltest.c:454:2: 
452.   	unsigned int client_proto_len = 0, server_proto_len = 0;
453.   	SSL_get0_alpn_selected(client, &client_proto, &client_proto_len);
454. > 	SSL_get0_alpn_selected(server, &server_proto, &server_proto_len);
455.   
456.   	if (alpn_selected != NULL)

ssl/ssl_lib.c:1819:1: start of procedure SSL_get0_alpn_selected()
  1817.    * including the leading length-prefix byte). If the server didn't respond with
  1818.    * a negotiated protocol then |*len| will be zero. */
  1819. > void SSL_get0_alpn_selected(const SSL *ssl, const unsigned char **data,
  1820.   			    unsigned *len)
  1821.   	{

ssl/ssl_lib.c:1822:2: 
  1820.   			    unsigned *len)
  1821.   	{
  1822. > 	*data = NULL;
  1823.   	if (ssl->s3)
  1824.   		*data = ssl->s3->alpn_selected;

ssl/ssl_lib.c:1823:6: Taking true branch
  1821.   	{
  1822.   	*data = NULL;
  1823.   	if (ssl->s3)
               ^
  1824.   		*data = ssl->s3->alpn_selected;
  1825.   	if (*data == NULL)

ssl/ssl_lib.c:1824:3: 
  1822.   	*data = NULL;
  1823.   	if (ssl->s3)
  1824. > 		*data = ssl->s3->alpn_selected;
  1825.   	if (*data == NULL)
  1826.   		*len = 0;

ssl/ssl_lib.c:1825:6: Taking false branch
  1823.   	if (ssl->s3)
  1824.   		*data = ssl->s3->alpn_selected;
  1825.   	if (*data == NULL)
               ^
  1826.   		*len = 0;
  1827.   	else

ssl/ssl_lib.c:1828:3: 
  1826.   		*len = 0;
  1827.   	else
  1828. > 		*len = ssl->s3->alpn_selected_len;
  1829.   	}
  1830.   

ssl/ssl_lib.c:1825:2: 
  1823.   	if (ssl->s3)
  1824.   		*data = ssl->s3->alpn_selected;
  1825. > 	if (*data == NULL)
  1826.   		*len = 0;
  1827.   	else

ssl/ssl_lib.c:1829:2: return from a call to SSL_get0_alpn_selected
  1827.   	else
  1828.   		*len = ssl->s3->alpn_selected_len;
  1829.   	}
           ^
  1830.   
  1831.   #endif /* !OPENSSL_NO_TLSEXT */

ssl/ssltest.c:456:6: Taking true branch
454.   	SSL_get0_alpn_selected(server, &server_proto, &server_proto_len);
455.   
456.   	if (alpn_selected != NULL)
            ^
457.   		{
458.   		OPENSSL_free(alpn_selected);

ssl/ssltest.c:458:3: 
456.   	if (alpn_selected != NULL)
457.   		{
458. > 		OPENSSL_free(alpn_selected);
459.   		alpn_selected = NULL;
460.   		}

crypto/mem.c:393:1: start of procedure CRYPTO_free()
  391.   	}
  392.   
  393. > void CRYPTO_free(void *str)
  394.   	{
  395.   	if (free_debug_func != NULL)

crypto/mem.c:395:6: Taking true branch
  393.   void CRYPTO_free(void *str)
  394.   	{
  395.   	if (free_debug_func != NULL)
              ^
  396.   		free_debug_func(str, 0);
  397.   #ifdef LEVITTE_DEBUG_MEM

crypto/mem.c:396:3: Skipping __function_pointer__(): unresolved function pointer
  394.   	{
  395.   	if (free_debug_func != NULL)
  396.   		free_debug_func(str, 0);
           ^
  397.   #ifdef LEVITTE_DEBUG_MEM
  398.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         < 0x%p\n", str);

crypto/mem.c:400:2: Skipping __function_pointer__(): unresolved function pointer
  398.   	fprintf(stderr, "LEVITTE_DEBUG_MEM:         < 0x%p\n", str);
  399.   #endif
  400.   	free_func(str);
          ^
  401.   	if (free_debug_func != NULL)
  402.   		free_debug_func(NULL, 1);

crypto/mem.c:401:6: Taking true branch
  399.   #endif
  400.   	free_func(str);
  401.   	if (free_debug_func != NULL)
              ^
  402.   		free_debug_func(NULL, 1);
  403.   	}

crypto/mem.c:402:3: Skipping __function_pointer__(): unresolved function pointer
  400.   	free_func(str);
  401.   	if (free_debug_func != NULL)
  402.   		free_debug_func(NULL, 1);
           ^
  403.   	}
  404.   

crypto/mem.c:401:2: 
  399.   #endif
  400.   	free_func(str);
  401. > 	if (free_debug_func != NULL)
  402.   		free_debug_func(NULL, 1);
  403.   	}

crypto/mem.c:403:2: return from a call to CRYPTO_free
  401.   	if (free_debug_func != NULL)
  402.   		free_debug_func(NULL, 1);
  403.   	}
          ^
  404.   
  405.   void *CRYPTO_remalloc(void *a, int num, const char *file, int line)

ssl/ssltest.c:459:3: 
457.   		{
458.   		OPENSSL_free(alpn_selected);
459. > 		alpn_selected = NULL;
460.   		}
461.   

ssl/ssltest.c:462:6: Taking false branch
460.   		}
461.   
462.   	if (client_proto_len != server_proto_len ||
            ^
463.   	    memcmp(client_proto, server_proto, client_proto_len) != 0)
464.   		{

ssl/ssltest.c:463:6: 
461.   
462.   	if (client_proto_len != server_proto_len ||
463. > 	    memcmp(client_proto, server_proto, client_proto_len) != 0)
464.   		{
465.   		BIO_printf(bio_stdout, "ALPN selected protocols differ!\n");
