test/handshake_helper.c:112: error: NULL_DEREFERENCE
  pointer `ex_data` last assigned on line 93 could be null and is dereferenced at line 112, column 9.
Showing all 40 steps of the trace


test/handshake_helper.c:90:1: start of procedure select_server_ctx()
88.    * An empty SNI extension also returns SSL_TSLEXT_ERR_NOACK.
89.    */
90. > static int select_server_ctx(SSL *s, void *arg, int ignore)
91.   {
92.       const char *servername = SSL_get_servername(s, TLSEXT_NAMETYPE_host_name);

test/handshake_helper.c:92:5: 
90.   static int select_server_ctx(SSL *s, void *arg, int ignore)
91.   {
92. >     const char *servername = SSL_get_servername(s, TLSEXT_NAMETYPE_host_name);
93.       HANDSHAKE_EX_DATA *ex_data =
94.           (HANDSHAKE_EX_DATA*)(SSL_get_ex_data(s, ex_data_idx));

ssl/ssl_lib.c:2177:1: start of procedure SSL_get_servername()
  2175.    */
  2176.   
  2177. > const char *SSL_get_servername(const SSL *s, const int type)
  2178.   {
  2179.       if (type != TLSEXT_NAMETYPE_host_name)

ssl/ssl_lib.c:2179:9: Taking false branch
  2177.   const char *SSL_get_servername(const SSL *s, const int type)
  2178.   {
  2179.       if (type != TLSEXT_NAMETYPE_host_name)
                  ^
  2180.           return NULL;
  2181.   

ssl/ssl_lib.c:2182:12: Condition is true
  2180.           return NULL;
  2181.   
  2182.       return s->session && !s->ext.hostname ?
                     ^
  2183.           s->session->ext.hostname : s->ext.hostname;
  2184.   }

ssl/ssl_lib.c:2182:27: Condition is true
  2180.           return NULL;
  2181.   
  2182.       return s->session && !s->ext.hostname ?
                                    ^
  2183.           s->session->ext.hostname : s->ext.hostname;
  2184.   }

ssl/ssl_lib.c:2182:12: 
  2180.           return NULL;
  2181.   
  2182. >     return s->session && !s->ext.hostname ?
  2183.           s->session->ext.hostname : s->ext.hostname;
  2184.   }

ssl/ssl_lib.c:2182:5: 
  2180.           return NULL;
  2181.   
  2182. >     return s->session && !s->ext.hostname ?
  2183.           s->session->ext.hostname : s->ext.hostname;
  2184.   }

ssl/ssl_lib.c:2184:1: return from a call to SSL_get_servername
  2182.       return s->session && !s->ext.hostname ?
  2183.           s->session->ext.hostname : s->ext.hostname;
  2184. > }
  2185.   
  2186.   int SSL_get_servername_type(const SSL *s)

test/handshake_helper.c:93:5: 
91.   {
92.       const char *servername = SSL_get_servername(s, TLSEXT_NAMETYPE_host_name);
93. >     HANDSHAKE_EX_DATA *ex_data =
94.           (HANDSHAKE_EX_DATA*)(SSL_get_ex_data(s, ex_data_idx));
95.   

ssl/ssl_lib.c:3627:1: start of procedure SSL_get_ex_data()
  3625.   }
  3626.   
  3627. > void *SSL_get_ex_data(const SSL *s, int idx)
  3628.   {
  3629.       return (CRYPTO_get_ex_data(&s->ex_data, idx));

ssl/ssl_lib.c:3629:5: 
  3627.   void *SSL_get_ex_data(const SSL *s, int idx)
  3628.   {
  3629. >     return (CRYPTO_get_ex_data(&s->ex_data, idx));
  3630.   }
  3631.   

crypto/ex_data.c:375:1: start of procedure CRYPTO_get_ex_data()
    373.    * particular index in the class used by this variable
    374.    */
    375. > void *CRYPTO_get_ex_data(const CRYPTO_EX_DATA *ad, int idx)
    376.   {
    377.       if (ad->sk == NULL || idx >= sk_void_num(ad->sk))

crypto/ex_data.c:377:9: Taking true branch
    375.   void *CRYPTO_get_ex_data(const CRYPTO_EX_DATA *ad, int idx)
    376.   {
    377.       if (ad->sk == NULL || idx >= sk_void_num(ad->sk))
                   ^
    378.           return NULL;
    379.       return sk_void_value(ad->sk, idx);

crypto/ex_data.c:378:9: 
    376.   {
    377.       if (ad->sk == NULL || idx >= sk_void_num(ad->sk))
    378. >         return NULL;
    379.       return sk_void_value(ad->sk, idx);
    380.   }

crypto/ex_data.c:380:1: return from a call to CRYPTO_get_ex_data
    378.           return NULL;
    379.       return sk_void_value(ad->sk, idx);
    380. > }

ssl/ssl_lib.c:3630:1: return from a call to SSL_get_ex_data
  3628.   {
  3629.       return (CRYPTO_get_ex_data(&s->ex_data, idx));
  3630. > }
  3631.   
  3632.   int SSL_CTX_set_ex_data(SSL_CTX *s, int idx, void *arg)

test/handshake_helper.c:96:9: Taking false branch
94.           (HANDSHAKE_EX_DATA*)(SSL_get_ex_data(s, ex_data_idx));
95.   
96.       if (servername == NULL) {
              ^
97.           ex_data->servername = SSL_TEST_SERVERNAME_SERVER1;
98.           return SSL_TLSEXT_ERR_NOACK;

test/handshake_helper.c:101:9: Taking true branch
99.       }
100.   
101.       if (strcmp(servername, "server2") == 0) {
               ^
102.           SSL_CTX *new_ctx = (SSL_CTX*)arg;
103.           SSL_set_SSL_CTX(s, new_ctx);

test/handshake_helper.c:102:9: 
100.   
101.       if (strcmp(servername, "server2") == 0) {
102. >         SSL_CTX *new_ctx = (SSL_CTX*)arg;
103.           SSL_set_SSL_CTX(s, new_ctx);
104.           /*

test/handshake_helper.c:103:9: 
101.       if (strcmp(servername, "server2") == 0) {
102.           SSL_CTX *new_ctx = (SSL_CTX*)arg;
103. >         SSL_set_SSL_CTX(s, new_ctx);
104.           /*
105.            * Copy over all the SSL_CTX options - reasonable behavior

ssl/ssl_lib.c:3483:1: start of procedure SSL_set_SSL_CTX()
  3481.   }
  3482.   
  3483. > SSL_CTX *SSL_set_SSL_CTX(SSL *ssl, SSL_CTX *ctx)
  3484.   {
  3485.       CERT *new_cert;

ssl/ssl_lib.c:3486:9: Taking false branch
  3484.   {
  3485.       CERT *new_cert;
  3486.       if (ssl->ctx == ctx)
                  ^
  3487.           return ssl->ctx;
  3488.       if (ctx == NULL)

ssl/ssl_lib.c:3488:9: Taking false branch
  3486.       if (ssl->ctx == ctx)
  3487.           return ssl->ctx;
  3488.       if (ctx == NULL)
                  ^
  3489.           ctx = ssl->session_ctx;
  3490.       new_cert = ssl_cert_dup(ctx->cert);

ssl/ssl_lib.c:3490:5: Skipping ssl_cert_dup(): empty list of specs
  3488.       if (ctx == NULL)
  3489.           ctx = ssl->session_ctx;
  3490.       new_cert = ssl_cert_dup(ctx->cert);
              ^
  3491.       if (new_cert == NULL) {
  3492.           return NULL;

ssl/ssl_lib.c:3491:9: Taking true branch
  3489.           ctx = ssl->session_ctx;
  3490.       new_cert = ssl_cert_dup(ctx->cert);
  3491.       if (new_cert == NULL) {
                  ^
  3492.           return NULL;
  3493.       }

ssl/ssl_lib.c:3492:9: 
  3490.       new_cert = ssl_cert_dup(ctx->cert);
  3491.       if (new_cert == NULL) {
  3492. >         return NULL;
  3493.       }
  3494.       ssl_cert_free(ssl->cert);

ssl/ssl_lib.c:3521:1: return from a call to SSL_set_SSL_CTX
  3519.   
  3520.       return ssl->ctx;
  3521. > }
  3522.   
  3523.   int SSL_CTX_set_default_verify_paths(SSL_CTX *ctx)

test/handshake_helper.c:109:9: 
107.            * contexts differ/conflict
108.            */
109. >         SSL_clear_options(s, 0xFFFFFFFFL);
110.           SSL_set_options(s, SSL_CTX_get_options(new_ctx));
111.   

ssl/ssl_lib.c:3970:1: start of procedure SSL_clear_options()
  3968.   }
  3969.   
  3970. > unsigned long SSL_clear_options(SSL *s, unsigned long op)
  3971.   {
  3972.       return s->options &= ~op;

ssl/ssl_lib.c:3972:5: 
  3970.   unsigned long SSL_clear_options(SSL *s, unsigned long op)
  3971.   {
  3972. >     return s->options &= ~op;
  3973.   }
  3974.   

ssl/ssl_lib.c:3973:1: return from a call to SSL_clear_options
  3971.   {
  3972.       return s->options &= ~op;
  3973. > }
  3974.   
  3975.   STACK_OF(X509) *SSL_get0_verified_chain(const SSL *s)

test/handshake_helper.c:110:9: 
108.            */
109.           SSL_clear_options(s, 0xFFFFFFFFL);
110. >         SSL_set_options(s, SSL_CTX_get_options(new_ctx));
111.   
112.           ex_data->servername = SSL_TEST_SERVERNAME_SERVER2;

ssl/ssl_lib.c:3945:1: start of procedure SSL_CTX_get_options()
  3943.    * control interface.
  3944.    */
  3945. > unsigned long SSL_CTX_get_options(const SSL_CTX *ctx)
  3946.   {
  3947.       return ctx->options;

ssl/ssl_lib.c:3947:5: 
  3945.   unsigned long SSL_CTX_get_options(const SSL_CTX *ctx)
  3946.   {
  3947. >     return ctx->options;
  3948.   }
  3949.   

ssl/ssl_lib.c:3948:1: return from a call to SSL_CTX_get_options
  3946.   {
  3947.       return ctx->options;
  3948. > }
  3949.   
  3950.   unsigned long SSL_get_options(const SSL *s)

ssl/ssl_lib.c:3960:1: start of procedure SSL_set_options()
  3958.   }
  3959.   
  3960. > unsigned long SSL_set_options(SSL *s, unsigned long op)
  3961.   {
  3962.       return s->options |= op;

ssl/ssl_lib.c:3962:5: 
  3960.   unsigned long SSL_set_options(SSL *s, unsigned long op)
  3961.   {
  3962. >     return s->options |= op;
  3963.   }
  3964.   

ssl/ssl_lib.c:3963:1: return from a call to SSL_set_options
  3961.   {
  3962.       return s->options |= op;
  3963. > }
  3964.   
  3965.   unsigned long SSL_CTX_clear_options(SSL_CTX *ctx, unsigned long op)

test/handshake_helper.c:112:9: 
110.           SSL_set_options(s, SSL_CTX_get_options(new_ctx));
111.   
112. >         ex_data->servername = SSL_TEST_SERVERNAME_SERVER2;
113.           return SSL_TLSEXT_ERR_OK;
114.       } else if (strcmp(servername, "server1") == 0) {
