test/ssltest.c:472: error: NULL_DEREFERENCE
  pointer `server_proto` last assigned on line 466 could be null and is dereferenced by call to `memcmp()` at line 472, column 9.
Showing all 32 steps of the trace


test/ssltest.c:461:1: start of procedure verify_alpn()
459.   }
460.   
461. > static int verify_alpn(SSL *client, SSL *server)
462.   {
463.       const unsigned char *client_proto, *server_proto;

test/ssltest.c:464:5: 
462.   {
463.       const unsigned char *client_proto, *server_proto;
464. >     unsigned int client_proto_len = 0, server_proto_len = 0;
465.       SSL_get0_alpn_selected(client, &client_proto, &client_proto_len);
466.       SSL_get0_alpn_selected(server, &server_proto, &server_proto_len);

test/ssltest.c:465:5: 
463.       const unsigned char *client_proto, *server_proto;
464.       unsigned int client_proto_len = 0, server_proto_len = 0;
465. >     SSL_get0_alpn_selected(client, &client_proto, &client_proto_len);
466.       SSL_get0_alpn_selected(server, &server_proto, &server_proto_len);
467.   

ssl/ssl_lib.c:1606:1: start of procedure SSL_get0_alpn_selected()
  1604.    * respond with a negotiated protocol then |*len| will be zero.
  1605.    */
  1606. > void SSL_get0_alpn_selected(const SSL *ssl, const unsigned char **data,
  1607.                               unsigned *len)
  1608.   {

ssl/ssl_lib.c:1609:5: 
  1607.                               unsigned *len)
  1608.   {
  1609. >     *data = NULL;
  1610.       if (ssl->s3)
  1611.           *data = ssl->s3->alpn_selected;

ssl/ssl_lib.c:1610:9: Taking true branch
  1608.   {
  1609.       *data = NULL;
  1610.       if (ssl->s3)
                  ^
  1611.           *data = ssl->s3->alpn_selected;
  1612.       if (*data == NULL)

ssl/ssl_lib.c:1611:9: 
  1609.       *data = NULL;
  1610.       if (ssl->s3)
  1611. >         *data = ssl->s3->alpn_selected;
  1612.       if (*data == NULL)
  1613.           *len = 0;

ssl/ssl_lib.c:1612:9: Taking false branch
  1610.       if (ssl->s3)
  1611.           *data = ssl->s3->alpn_selected;
  1612.       if (*data == NULL)
                  ^
  1613.           *len = 0;
  1614.       else

ssl/ssl_lib.c:1615:9: 
  1613.           *len = 0;
  1614.       else
  1615. >         *len = ssl->s3->alpn_selected_len;
  1616.   }
  1617.   

ssl/ssl_lib.c:1612:5: 
  1610.       if (ssl->s3)
  1611.           *data = ssl->s3->alpn_selected;
  1612. >     if (*data == NULL)
  1613.           *len = 0;
  1614.       else

ssl/ssl_lib.c:1616:1: return from a call to SSL_get0_alpn_selected
  1614.       else
  1615.           *len = ssl->s3->alpn_selected_len;
  1616. > }
  1617.   
  1618.   

test/ssltest.c:466:5: 
464.       unsigned int client_proto_len = 0, server_proto_len = 0;
465.       SSL_get0_alpn_selected(client, &client_proto, &client_proto_len);
466. >     SSL_get0_alpn_selected(server, &server_proto, &server_proto_len);
467.   
468.       OPENSSL_free(alpn_selected);

ssl/ssl_lib.c:1606:1: start of procedure SSL_get0_alpn_selected()
  1604.    * respond with a negotiated protocol then |*len| will be zero.
  1605.    */
  1606. > void SSL_get0_alpn_selected(const SSL *ssl, const unsigned char **data,
  1607.                               unsigned *len)
  1608.   {

ssl/ssl_lib.c:1609:5: 
  1607.                               unsigned *len)
  1608.   {
  1609. >     *data = NULL;
  1610.       if (ssl->s3)
  1611.           *data = ssl->s3->alpn_selected;

ssl/ssl_lib.c:1610:9: Taking true branch
  1608.   {
  1609.       *data = NULL;
  1610.       if (ssl->s3)
                  ^
  1611.           *data = ssl->s3->alpn_selected;
  1612.       if (*data == NULL)

ssl/ssl_lib.c:1611:9: 
  1609.       *data = NULL;
  1610.       if (ssl->s3)
  1611. >         *data = ssl->s3->alpn_selected;
  1612.       if (*data == NULL)
  1613.           *len = 0;

ssl/ssl_lib.c:1612:9: Taking true branch
  1610.       if (ssl->s3)
  1611.           *data = ssl->s3->alpn_selected;
  1612.       if (*data == NULL)
                  ^
  1613.           *len = 0;
  1614.       else

ssl/ssl_lib.c:1613:9: 
  1611.           *data = ssl->s3->alpn_selected;
  1612.       if (*data == NULL)
  1613. >         *len = 0;
  1614.       else
  1615.           *len = ssl->s3->alpn_selected_len;

ssl/ssl_lib.c:1612:5: 
  1610.       if (ssl->s3)
  1611.           *data = ssl->s3->alpn_selected;
  1612. >     if (*data == NULL)
  1613.           *len = 0;
  1614.       else

ssl/ssl_lib.c:1616:1: return from a call to SSL_get0_alpn_selected
  1614.       else
  1615.           *len = ssl->s3->alpn_selected_len;
  1616. > }
  1617.   
  1618.   

test/ssltest.c:468:5: 
466.       SSL_get0_alpn_selected(server, &server_proto, &server_proto_len);
467.   
468. >     OPENSSL_free(alpn_selected);
469.       alpn_selected = NULL;
470.   

crypto/mem.c:504:1: start of procedure CRYPTO_free()
  502.   }
  503.   
  504. > void CRYPTO_free(void *str)
  505.   {
  506.       if (free_debug_func != NULL)

crypto/mem.c:506:9: Taking true branch
  504.   void CRYPTO_free(void *str)
  505.   {
  506.       if (free_debug_func != NULL)
                 ^
  507.           free_debug_func(str, 0);
  508.   #ifdef LEVITTE_DEBUG_MEM

crypto/mem.c:507:9: Skipping __function_pointer__(): unresolved function pointer
  505.   {
  506.       if (free_debug_func != NULL)
  507.           free_debug_func(str, 0);
                 ^
  508.   #ifdef LEVITTE_DEBUG_MEM
  509.       fprintf(stderr, "LEVITTE_DEBUG_MEM:         < 0x%p\n", str);

crypto/mem.c:511:5: Skipping __function_pointer__(): unresolved function pointer
  509.       fprintf(stderr, "LEVITTE_DEBUG_MEM:         < 0x%p\n", str);
  510.   #endif
  511.       free_func(str);
             ^
  512.       if (free_debug_func != NULL)
  513.           free_debug_func(NULL, 1);

crypto/mem.c:512:9: Taking true branch
  510.   #endif
  511.       free_func(str);
  512.       if (free_debug_func != NULL)
                 ^
  513.           free_debug_func(NULL, 1);
  514.   }

crypto/mem.c:513:9: Skipping __function_pointer__(): unresolved function pointer
  511.       free_func(str);
  512.       if (free_debug_func != NULL)
  513.           free_debug_func(NULL, 1);
                 ^
  514.   }
  515.   

crypto/mem.c:512:5: 
  510.   #endif
  511.       free_func(str);
  512. >     if (free_debug_func != NULL)
  513.           free_debug_func(NULL, 1);
  514.   }

crypto/mem.c:514:1: return from a call to CRYPTO_free
  512.       if (free_debug_func != NULL)
  513.           free_debug_func(NULL, 1);
  514. > }
  515.   
  516.   void CRYPTO_clear_free(void *str, size_t num)

test/ssltest.c:469:5: 
467.   
468.       OPENSSL_free(alpn_selected);
469. >     alpn_selected = NULL;
470.   
471.       if (client_proto_len != server_proto_len ||

test/ssltest.c:471:9: Taking false branch
469.       alpn_selected = NULL;
470.   
471.       if (client_proto_len != server_proto_len ||
               ^
472.           memcmp(client_proto, server_proto, client_proto_len) != 0) {
473.           BIO_printf(bio_stdout, "ALPN selected protocols differ!\n");

test/ssltest.c:472:9: 
470.   
471.       if (client_proto_len != server_proto_len ||
472. >         memcmp(client_proto, server_proto, client_proto_len) != 0) {
473.           BIO_printf(bio_stdout, "ALPN selected protocols differ!\n");
474.           goto err;
