ssl/ssltest.c:473: error: NULL_DEREFERENCE
  pointer `client_proto` last assigned on line 464 could be null and is dereferenced by call to `memcmp()` at line 473, column 9.
Showing all 33 steps of the trace


ssl/ssltest.c:460:1: start of procedure verify_alpn()
458.   }
459.   
460. > static int verify_alpn(SSL *client, SSL *server)
461.   {
462.       const unsigned char *client_proto, *server_proto;

ssl/ssltest.c:463:5: 
461.   {
462.       const unsigned char *client_proto, *server_proto;
463. >     unsigned int client_proto_len = 0, server_proto_len = 0;
464.       SSL_get0_alpn_selected(client, &client_proto, &client_proto_len);
465.       SSL_get0_alpn_selected(server, &server_proto, &server_proto_len);

ssl/ssltest.c:464:5: 
462.       const unsigned char *client_proto, *server_proto;
463.       unsigned int client_proto_len = 0, server_proto_len = 0;
464. >     SSL_get0_alpn_selected(client, &client_proto, &client_proto_len);
465.       SSL_get0_alpn_selected(server, &server_proto, &server_proto_len);
466.   

ssl/ssl_lib.c:1807:1: start of procedure SSL_get0_alpn_selected()
  1805.    * respond with a negotiated protocol then |*len| will be zero.
  1806.    */
  1807. > void SSL_get0_alpn_selected(const SSL *ssl, const unsigned char **data,
  1808.                               unsigned *len)
  1809.   {

ssl/ssl_lib.c:1810:5: 
  1808.                               unsigned *len)
  1809.   {
  1810. >     *data = NULL;
  1811.       if (ssl->s3)
  1812.           *data = ssl->s3->alpn_selected;

ssl/ssl_lib.c:1811:9: Taking true branch
  1809.   {
  1810.       *data = NULL;
  1811.       if (ssl->s3)
                  ^
  1812.           *data = ssl->s3->alpn_selected;
  1813.       if (*data == NULL)

ssl/ssl_lib.c:1812:9: 
  1810.       *data = NULL;
  1811.       if (ssl->s3)
  1812. >         *data = ssl->s3->alpn_selected;
  1813.       if (*data == NULL)
  1814.           *len = 0;

ssl/ssl_lib.c:1813:9: Taking true branch
  1811.       if (ssl->s3)
  1812.           *data = ssl->s3->alpn_selected;
  1813.       if (*data == NULL)
                  ^
  1814.           *len = 0;
  1815.       else

ssl/ssl_lib.c:1814:9: 
  1812.           *data = ssl->s3->alpn_selected;
  1813.       if (*data == NULL)
  1814. >         *len = 0;
  1815.       else
  1816.           *len = ssl->s3->alpn_selected_len;

ssl/ssl_lib.c:1813:5: 
  1811.       if (ssl->s3)
  1812.           *data = ssl->s3->alpn_selected;
  1813. >     if (*data == NULL)
  1814.           *len = 0;
  1815.       else

ssl/ssl_lib.c:1817:1: return from a call to SSL_get0_alpn_selected
  1815.       else
  1816.           *len = ssl->s3->alpn_selected_len;
  1817. > }
  1818.   
  1819.   #endif                          /* !OPENSSL_NO_TLSEXT */

ssl/ssltest.c:465:5: 
463.       unsigned int client_proto_len = 0, server_proto_len = 0;
464.       SSL_get0_alpn_selected(client, &client_proto, &client_proto_len);
465. >     SSL_get0_alpn_selected(server, &server_proto, &server_proto_len);
466.   
467.       if (alpn_selected != NULL) {

ssl/ssl_lib.c:1807:1: start of procedure SSL_get0_alpn_selected()
  1805.    * respond with a negotiated protocol then |*len| will be zero.
  1806.    */
  1807. > void SSL_get0_alpn_selected(const SSL *ssl, const unsigned char **data,
  1808.                               unsigned *len)
  1809.   {

ssl/ssl_lib.c:1810:5: 
  1808.                               unsigned *len)
  1809.   {
  1810. >     *data = NULL;
  1811.       if (ssl->s3)
  1812.           *data = ssl->s3->alpn_selected;

ssl/ssl_lib.c:1811:9: Taking true branch
  1809.   {
  1810.       *data = NULL;
  1811.       if (ssl->s3)
                  ^
  1812.           *data = ssl->s3->alpn_selected;
  1813.       if (*data == NULL)

ssl/ssl_lib.c:1812:9: 
  1810.       *data = NULL;
  1811.       if (ssl->s3)
  1812. >         *data = ssl->s3->alpn_selected;
  1813.       if (*data == NULL)
  1814.           *len = 0;

ssl/ssl_lib.c:1813:9: Taking false branch
  1811.       if (ssl->s3)
  1812.           *data = ssl->s3->alpn_selected;
  1813.       if (*data == NULL)
                  ^
  1814.           *len = 0;
  1815.       else

ssl/ssl_lib.c:1816:9: 
  1814.           *len = 0;
  1815.       else
  1816. >         *len = ssl->s3->alpn_selected_len;
  1817.   }
  1818.   

ssl/ssl_lib.c:1813:5: 
  1811.       if (ssl->s3)
  1812.           *data = ssl->s3->alpn_selected;
  1813. >     if (*data == NULL)
  1814.           *len = 0;
  1815.       else

ssl/ssl_lib.c:1817:1: return from a call to SSL_get0_alpn_selected
  1815.       else
  1816.           *len = ssl->s3->alpn_selected_len;
  1817. > }
  1818.   
  1819.   #endif                          /* !OPENSSL_NO_TLSEXT */

ssl/ssltest.c:467:9: Taking true branch
465.       SSL_get0_alpn_selected(server, &server_proto, &server_proto_len);
466.   
467.       if (alpn_selected != NULL) {
               ^
468.           OPENSSL_free(alpn_selected);
469.           alpn_selected = NULL;

ssl/ssltest.c:468:9: 
466.   
467.       if (alpn_selected != NULL) {
468. >         OPENSSL_free(alpn_selected);
469.           alpn_selected = NULL;
470.       }

crypto/mem.c:431:1: start of procedure CRYPTO_free()
  429.   }
  430.   
  431. > void CRYPTO_free(void *str)
  432.   {
  433.       if (free_debug_func != NULL)

crypto/mem.c:433:9: Taking true branch
  431.   void CRYPTO_free(void *str)
  432.   {
  433.       if (free_debug_func != NULL)
                 ^
  434.           free_debug_func(str, 0);
  435.   #ifdef LEVITTE_DEBUG_MEM

crypto/mem.c:434:9: Skipping __function_pointer__(): unresolved function pointer
  432.   {
  433.       if (free_debug_func != NULL)
  434.           free_debug_func(str, 0);
                 ^
  435.   #ifdef LEVITTE_DEBUG_MEM
  436.       fprintf(stderr, "LEVITTE_DEBUG_MEM:         < 0x%p\n", str);

crypto/mem.c:438:5: Skipping __function_pointer__(): unresolved function pointer
  436.       fprintf(stderr, "LEVITTE_DEBUG_MEM:         < 0x%p\n", str);
  437.   #endif
  438.       free_func(str);
             ^
  439.       if (free_debug_func != NULL)
  440.           free_debug_func(NULL, 1);

crypto/mem.c:439:9: Taking true branch
  437.   #endif
  438.       free_func(str);
  439.       if (free_debug_func != NULL)
                 ^
  440.           free_debug_func(NULL, 1);
  441.   }

crypto/mem.c:440:9: Skipping __function_pointer__(): unresolved function pointer
  438.       free_func(str);
  439.       if (free_debug_func != NULL)
  440.           free_debug_func(NULL, 1);
                 ^
  441.   }
  442.   

crypto/mem.c:439:5: 
  437.   #endif
  438.       free_func(str);
  439. >     if (free_debug_func != NULL)
  440.           free_debug_func(NULL, 1);
  441.   }

crypto/mem.c:441:1: return from a call to CRYPTO_free
  439.       if (free_debug_func != NULL)
  440.           free_debug_func(NULL, 1);
  441. > }
  442.   
  443.   void *CRYPTO_remalloc(void *a, int num, const char *file, int line)

ssl/ssltest.c:469:9: 
467.       if (alpn_selected != NULL) {
468.           OPENSSL_free(alpn_selected);
469. >         alpn_selected = NULL;
470.       }
471.   

ssl/ssltest.c:472:9: Taking false branch
470.       }
471.   
472.       if (client_proto_len != server_proto_len ||
               ^
473.           memcmp(client_proto, server_proto, client_proto_len) != 0) {
474.           BIO_printf(bio_stdout, "ALPN selected protocols differ!\n");

ssl/ssltest.c:473:9: 
471.   
472.       if (client_proto_len != server_proto_len ||
473. >         memcmp(client_proto, server_proto, client_proto_len) != 0) {
474.           BIO_printf(bio_stdout, "ALPN selected protocols differ!\n");
475.           goto err;
