test/sslapitest.c:5404: error: NULL_DEREFERENCE
  pointer `sctx` last assigned on line 5341 could be null and is dereferenced by call to `SSL_CTX_free()` at line 5404, column 5.
Showing all 35 steps of the trace


test/sslapitest.c:5338:1: start of procedure test_srp()
5336.    * Test 5: Connection failure due to bad password, vbase loaded from new file
5337.    */
5338. > static int test_srp(int tst)
5339.   {
5340.       char *userid = "test", *password = "password", *tstsrpfile;

test/sslapitest.c:5340:5: 
5338.   static int test_srp(int tst)
5339.   {
5340. >     char *userid = "test", *password = "password", *tstsrpfile;
5341.       SSL_CTX *cctx = NULL, *sctx = NULL;
5342.       SSL *clientssl = NULL, *serverssl = NULL;

test/sslapitest.c:5341:5: 
5339.   {
5340.       char *userid = "test", *password = "password", *tstsrpfile;
5341. >     SSL_CTX *cctx = NULL, *sctx = NULL;
5342.       SSL *clientssl = NULL, *serverssl = NULL;
5343.       int ret, testresult = 0;

test/sslapitest.c:5342:5: 
5340.       char *userid = "test", *password = "password", *tstsrpfile;
5341.       SSL_CTX *cctx = NULL, *sctx = NULL;
5342. >     SSL *clientssl = NULL, *serverssl = NULL;
5343.       int ret, testresult = 0;
5344.   

test/sslapitest.c:5343:5: 
5341.       SSL_CTX *cctx = NULL, *sctx = NULL;
5342.       SSL *clientssl = NULL, *serverssl = NULL;
5343. >     int ret, testresult = 0;
5344.   
5345.       vbase = SRP_VBASE_new(NULL);

test/sslapitest.c:5345:5: Skipping SRP_VBASE_new(): empty list of specs
5343.       int ret, testresult = 0;
5344.   
5345.       vbase = SRP_VBASE_new(NULL);
            ^
5346.       if (!TEST_ptr(vbase))
5347.           goto end;

test/sslapitest.c:5346:10: 
5344.   
5345.       vbase = SRP_VBASE_new(NULL);
5346. >     if (!TEST_ptr(vbase))
5347.           goto end;
5348.   

test/testutil/tests.c:252:1: start of procedure test_ptr()
  250.   }
  251.   
  252. > int test_ptr(const char *file, int line, const char *s, const void *p)
  253.   {
  254.       if (p != NULL)

test/testutil/tests.c:254:9: Taking false branch
  252.   int test_ptr(const char *file, int line, const char *s, const void *p)
  253.   {
  254.       if (p != NULL)
                 ^
  255.           return 1;
  256.       test_fail_message(NULL, file, line, "ptr", s, "NULL", "!=", "%p", p);

test/testutil/tests.c:256:5: Skipping test_fail_message(): empty list of specs
  254.       if (p != NULL)
  255.           return 1;
  256.       test_fail_message(NULL, file, line, "ptr", s, "NULL", "!=", "%p", p);
             ^
  257.       return 0;
  258.   }

test/testutil/tests.c:257:5: 
  255.           return 1;
  256.       test_fail_message(NULL, file, line, "ptr", s, "NULL", "!=", "%p", p);
  257. >     return 0;
  258.   }
  259.   

test/testutil/tests.c:258:1: return from a call to test_ptr
  256.       test_fail_message(NULL, file, line, "ptr", s, "NULL", "!=", "%p", p);
  257.       return 0;
  258. > }
  259.   
  260.   int test_true(const char *file, int line, const char *s, int b)

test/sslapitest.c:5346:10: Taking true branch
5344.   
5345.       vbase = SRP_VBASE_new(NULL);
5346.       if (!TEST_ptr(vbase))
                 ^
5347.           goto end;
5348.   

test/sslapitest.c:5399:2: 
5397.       testresult = 1;
5398.   
5399. >  end:
5400.       SRP_VBASE_free(vbase);
5401.       vbase = NULL;

test/sslapitest.c:5400:5: 
5398.   
5399.    end:
5400. >     SRP_VBASE_free(vbase);
5401.       vbase = NULL;
5402.       SSL_free(serverssl);

crypto/srp/srp_vfy.c:298:1: start of procedure SRP_VBASE_free()
  296.   }
  297.   
  298. > void SRP_VBASE_free(SRP_VBASE *vb)
  299.   {
  300.       if (!vb)

crypto/srp/srp_vfy.c:300:10: Taking true branch
  298.   void SRP_VBASE_free(SRP_VBASE *vb)
  299.   {
  300.       if (!vb)
                  ^
  301.           return;
  302.       sk_SRP_user_pwd_pop_free(vb->users_pwd, SRP_user_pwd_free);

crypto/srp/srp_vfy.c:301:9: 
  299.   {
  300.       if (!vb)
  301. >         return;
  302.       sk_SRP_user_pwd_pop_free(vb->users_pwd, SRP_user_pwd_free);
  303.       sk_SRP_gN_cache_free(vb->gN_cache);

crypto/srp/srp_vfy.c:306:1: return from a call to SRP_VBASE_free
  304.       OPENSSL_free(vb->seed_key);
  305.       OPENSSL_free(vb);
  306. > }
  307.   
  308.   static SRP_gN_cache *SRP_gN_new_init(const char *ch)

test/sslapitest.c:5401:5: 
5399.    end:
5400.       SRP_VBASE_free(vbase);
5401. >     vbase = NULL;
5402.       SSL_free(serverssl);
5403.       SSL_free(clientssl);

test/sslapitest.c:5402:5: Skipping SSL_free(): empty list of specs
5400.       SRP_VBASE_free(vbase);
5401.       vbase = NULL;
5402.       SSL_free(serverssl);
            ^
5403.       SSL_free(clientssl);
5404.       SSL_CTX_free(sctx);

test/sslapitest.c:5403:5: Skipping SSL_free(): empty list of specs
5401.       vbase = NULL;
5402.       SSL_free(serverssl);
5403.       SSL_free(clientssl);
            ^
5404.       SSL_CTX_free(sctx);
5405.       SSL_CTX_free(cctx);

test/sslapitest.c:5404:5: 
5402.       SSL_free(serverssl);
5403.       SSL_free(clientssl);
5404. >     SSL_CTX_free(sctx);
5405.       SSL_CTX_free(cctx);
5406.   

ssl/ssl_lib.c:3239:1: start of procedure SSL_CTX_free()
  3237.   }
  3238.   
  3239. > void SSL_CTX_free(SSL_CTX *a)
  3240.   {
  3241.       int i;

ssl/ssl_lib.c:3243:9: Taking false branch
  3241.       int i;
  3242.   
  3243.       if (a == NULL)
                  ^
  3244.           return;
  3245.   

ssl/ssl_lib.c:3246:5: 
  3244.           return;
  3245.   
  3246. >     CRYPTO_DOWN_REF(&a->references, &i, a->lock);
  3247.       REF_PRINT_COUNT("SSL_CTX", a);
  3248.       if (i > 0)

include/internal/refcount.h:49:1: start of procedure CRYPTO_DOWN_REF()
    47.    * otherwise imply an acquire fence. Hence conditional acquire fence...
    48.    */
    49. > static inline int CRYPTO_DOWN_REF(_Atomic int *val, int *ret, void *lock)
    50.   {
    51.       *ret = atomic_fetch_sub_explicit(val, 1, memory_order_relaxed) - 1;

include/internal/refcount.h:51:5: 
    49.   static inline int CRYPTO_DOWN_REF(_Atomic int *val, int *ret, void *lock)
    50.   {
    51. >     *ret = atomic_fetch_sub_explicit(val, 1, memory_order_relaxed) - 1;
    52.       if (*ret == 0)
    53.           atomic_thread_fence(memory_order_acquire);

include/internal/refcount.h:52:9: Taking true branch
    50.   {
    51.       *ret = atomic_fetch_sub_explicit(val, 1, memory_order_relaxed) - 1;
    52.       if (*ret == 0)
                  ^
    53.           atomic_thread_fence(memory_order_acquire);
    54.       return 1;

include/internal/refcount.h:53:9: Skipping __c11_atomic_thread_fence(): method has no implementation
    51.       *ret = atomic_fetch_sub_explicit(val, 1, memory_order_relaxed) - 1;
    52.       if (*ret == 0)
    53.           atomic_thread_fence(memory_order_acquire);
                  ^
    54.       return 1;
    55.   }

include/internal/refcount.h:54:5: 
    52.       if (*ret == 0)
    53.           atomic_thread_fence(memory_order_acquire);
    54. >     return 1;
    55.   }
    56.   

include/internal/refcount.h:55:1: return from a call to CRYPTO_DOWN_REF
    53.           atomic_thread_fence(memory_order_acquire);
    54.       return 1;
    55. > }
    56.   
    57.   #  elif defined(__GNUC__) && defined(__ATOMIC_RELAXED) && __GCC_ATOMIC_INT_LOCK_FREE > 0

ssl/ssl_lib.c:3248:9: Taking true branch
  3246.       CRYPTO_DOWN_REF(&a->references, &i, a->lock);
  3247.       REF_PRINT_COUNT("SSL_CTX", a);
  3248.       if (i > 0)
                  ^
  3249.           return;
  3250.       REF_ASSERT_ISNT(i < 0);

ssl/ssl_lib.c:3249:9: 
  3247.       REF_PRINT_COUNT("SSL_CTX", a);
  3248.       if (i > 0)
  3249. >         return;
  3250.       REF_ASSERT_ISNT(i < 0);
  3251.   

ssl/ssl_lib.c:3301:1: return from a call to SSL_CTX_free
  3299.   
  3300.       OPENSSL_free(a);
  3301. > }
  3302.   
  3303.   void SSL_CTX_set_default_passwd_cb(SSL_CTX *ctx, pem_password_cb *cb)
