test/sslapitest.c:4582: error: NULL_DEREFERENCE
  pointer `sctx2` last assigned on line 4383 could be null and is dereferenced by call to `SSL_CTX_free()` at line 4582, column 5.
Showing all 43 steps of the trace


test/sslapitest.c:4381:1: start of procedure test_custom_exts()
4379.    * Test 4: New style callbacks in TLSv1.3. Extensions in CH, SH, EE, Cert + NST
4380.    */
4381. > static int test_custom_exts(int tst)
4382.   {
4383.       SSL_CTX *cctx = NULL, *sctx = NULL, *sctx2 = NULL;

test/sslapitest.c:4383:5: 
4381.   static int test_custom_exts(int tst)
4382.   {
4383. >     SSL_CTX *cctx = NULL, *sctx = NULL, *sctx2 = NULL;
4384.       SSL *clientssl = NULL, *serverssl = NULL;
4385.       int testresult = 0;

test/sslapitest.c:4384:5: 
4382.   {
4383.       SSL_CTX *cctx = NULL, *sctx = NULL, *sctx2 = NULL;
4384. >     SSL *clientssl = NULL, *serverssl = NULL;
4385.       int testresult = 0;
4386.       static int server = 1;

test/sslapitest.c:4385:5: 
4383.       SSL_CTX *cctx = NULL, *sctx = NULL, *sctx2 = NULL;
4384.       SSL *clientssl = NULL, *serverssl = NULL;
4385. >     int testresult = 0;
4386.       static int server = 1;
4387.       static int client = 0;

test/sslapitest.c:4386:5: 
4384.       SSL *clientssl = NULL, *serverssl = NULL;
4385.       int testresult = 0;
4386. >     static int server = 1;
4387.       static int client = 0;
4388.       SSL_SESSION *sess = NULL;

test/sslapitest.c:4387:5: 
4385.       int testresult = 0;
4386.       static int server = 1;
4387. >     static int client = 0;
4388.       SSL_SESSION *sess = NULL;
4389.       unsigned int context;

test/sslapitest.c:4388:5: 
4386.       static int server = 1;
4387.       static int client = 0;
4388. >     SSL_SESSION *sess = NULL;
4389.       unsigned int context;
4390.   

test/sslapitest.c:4398:5: 
4396.   
4397.       /* Reset callback counters */
4398. >     clntaddoldcb = clntparseoldcb = srvaddoldcb = srvparseoldcb = 0;
4399.       clntaddnewcb = clntparsenewcb = srvaddnewcb = srvparsenewcb = 0;
4400.       snicb = 0;

test/sslapitest.c:4399:5: 
4397.       /* Reset callback counters */
4398.       clntaddoldcb = clntparseoldcb = srvaddoldcb = srvparseoldcb = 0;
4399. >     clntaddnewcb = clntparsenewcb = srvaddnewcb = srvparsenewcb = 0;
4400.       snicb = 0;
4401.   

test/sslapitest.c:4400:5: 
4398.       clntaddoldcb = clntparseoldcb = srvaddoldcb = srvparseoldcb = 0;
4399.       clntaddnewcb = clntparsenewcb = srvaddnewcb = srvparsenewcb = 0;
4400. >     snicb = 0;
4401.   
4402.       if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(), TLS_client_method(),

test/sslapitest.c:4402:10: 
4400.       snicb = 0;
4401.   
4402. >     if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(), TLS_client_method(),
4403.                                          TLS1_VERSION, 0,
4404.                                          &sctx, &cctx, cert, privkey)))

ssl/methods.c:49:1: start of procedure TLS_server_method()
  47.    * TLS/SSLv3 server methods
  48.    */
  49. > IMPLEMENT_tls_meth_func(TLS_ANY_VERSION, 0, 0,
  50.                           TLS_server_method,
  51.                           ossl_statem_accept,

ssl/methods.c:49:1: return from a call to TLS_server_method
  47.    * TLS/SSLv3 server methods
  48.    */
  49. > IMPLEMENT_tls_meth_func(TLS_ANY_VERSION, 0, 0,
  50.                           TLS_server_method,
  51.                           ossl_statem_accept,

ssl/methods.c:82:1: start of procedure TLS_client_method()
  80.    * TLS/SSLv3 client methods
  81.    */
  82. > IMPLEMENT_tls_meth_func(TLS_ANY_VERSION, 0, 0,
  83.                           TLS_client_method,
  84.                           ssl_undefined_function,

ssl/methods.c:82:1: return from a call to TLS_client_method
  80.    * TLS/SSLv3 client methods
  81.    */
  82. > IMPLEMENT_tls_meth_func(TLS_ANY_VERSION, 0, 0,
  83.                           TLS_client_method,
  84.                           ssl_undefined_function,

test/sslapitest.c:4402:10: Condition is false
4400.       snicb = 0;
4401.   
4402.       if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(), TLS_client_method(),
                 ^
4403.                                          TLS1_VERSION, 0,
4404.                                          &sctx, &cctx, cert, privkey)))

test/testutil/tests.c:260:1: start of procedure test_true()
  258.   }
  259.   
  260. > int test_true(const char *file, int line, const char *s, int b)
  261.   {
  262.       if (b)

test/testutil/tests.c:262:9: Taking false branch
  260.   int test_true(const char *file, int line, const char *s, int b)
  261.   {
  262.       if (b)
                 ^
  263.           return 1;
  264.       test_fail_message(NULL, file, line, "bool", s, "true", "==", "false");

test/testutil/tests.c:264:5: Skipping test_fail_message(): empty list of specs
  262.       if (b)
  263.           return 1;
  264.       test_fail_message(NULL, file, line, "bool", s, "true", "==", "false");
             ^
  265.       return 0;
  266.   }

test/testutil/tests.c:265:5: 
  263.           return 1;
  264.       test_fail_message(NULL, file, line, "bool", s, "true", "==", "false");
  265. >     return 0;
  266.   }
  267.   

test/testutil/tests.c:266:1: return from a call to test_true
  264.       test_fail_message(NULL, file, line, "bool", s, "true", "==", "false");
  265.       return 0;
  266. > }
  267.   
  268.   int test_false(const char *file, int line, const char *s, int b)

test/sslapitest.c:4402:10: Taking true branch
4400.       snicb = 0;
4401.   
4402.       if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(), TLS_client_method(),
                 ^
4403.                                          TLS1_VERSION, 0,
4404.                                          &sctx, &cctx, cert, privkey)))

test/sslapitest.c:4578:1: 
4576.       testresult = 1;
4577.   
4578. > end:
4579.       SSL_SESSION_free(sess);
4580.       SSL_free(serverssl);

test/sslapitest.c:4579:5: 
4577.   
4578.   end:
4579. >     SSL_SESSION_free(sess);
4580.       SSL_free(serverssl);
4581.       SSL_free(clientssl);

ssl/ssl_sess.c:747:1: start of procedure SSL_SESSION_free()
  745.   }
  746.   
  747. > void SSL_SESSION_free(SSL_SESSION *ss)
  748.   {
  749.       int i;

ssl/ssl_sess.c:751:9: Taking true branch
  749.       int i;
  750.   
  751.       if (ss == NULL)
                 ^
  752.           return;
  753.       CRYPTO_DOWN_REF(&ss->references, &i, ss->lock);

ssl/ssl_sess.c:752:9: 
  750.   
  751.       if (ss == NULL)
  752. >         return;
  753.       CRYPTO_DOWN_REF(&ss->references, &i, ss->lock);
  754.       REF_PRINT_COUNT("SSL_SESSION", ss);

ssl/ssl_sess.c:778:1: return from a call to SSL_SESSION_free
  776.       CRYPTO_THREAD_lock_free(ss->lock);
  777.       OPENSSL_clear_free(ss, sizeof(*ss));
  778. > }
  779.   
  780.   int SSL_SESSION_up_ref(SSL_SESSION *ss)

test/sslapitest.c:4580:5: Skipping SSL_free(): empty list of specs
4578.   end:
4579.       SSL_SESSION_free(sess);
4580.       SSL_free(serverssl);
            ^
4581.       SSL_free(clientssl);
4582.       SSL_CTX_free(sctx2);

test/sslapitest.c:4581:5: Skipping SSL_free(): empty list of specs
4579.       SSL_SESSION_free(sess);
4580.       SSL_free(serverssl);
4581.       SSL_free(clientssl);
            ^
4582.       SSL_CTX_free(sctx2);
4583.       SSL_CTX_free(sctx);

test/sslapitest.c:4582:5: 
4580.       SSL_free(serverssl);
4581.       SSL_free(clientssl);
4582. >     SSL_CTX_free(sctx2);
4583.       SSL_CTX_free(sctx);
4584.       SSL_CTX_free(cctx);

ssl/ssl_lib.c:3240:1: start of procedure SSL_CTX_free()
  3238.   }
  3239.   
  3240. > void SSL_CTX_free(SSL_CTX *a)
  3241.   {
  3242.       int i;

ssl/ssl_lib.c:3244:9: Taking false branch
  3242.       int i;
  3243.   
  3244.       if (a == NULL)
                  ^
  3245.           return;
  3246.   

ssl/ssl_lib.c:3247:5: 
  3245.           return;
  3246.   
  3247. >     CRYPTO_DOWN_REF(&a->references, &i, a->lock);
  3248.       REF_PRINT_COUNT("SSL_CTX", a);
  3249.       if (i > 0)

include/internal/refcount.h:49:1: start of procedure CRYPTO_DOWN_REF()
    47.    * otherwise imply an acquire fence. Hence conditional acquire fence...
    48.    */
    49. > static inline int CRYPTO_DOWN_REF(_Atomic int *val, int *ret, void *lock)
    50.   {
    51.       *ret = atomic_fetch_sub_explicit(val, 1, memory_order_relaxed) - 1;

include/internal/refcount.h:51:5: 
    49.   static inline int CRYPTO_DOWN_REF(_Atomic int *val, int *ret, void *lock)
    50.   {
    51. >     *ret = atomic_fetch_sub_explicit(val, 1, memory_order_relaxed) - 1;
    52.       if (*ret == 0)
    53.           atomic_thread_fence(memory_order_acquire);

include/internal/refcount.h:52:9: Taking true branch
    50.   {
    51.       *ret = atomic_fetch_sub_explicit(val, 1, memory_order_relaxed) - 1;
    52.       if (*ret == 0)
                  ^
    53.           atomic_thread_fence(memory_order_acquire);
    54.       return 1;

include/internal/refcount.h:53:9: Skipping __c11_atomic_thread_fence(): method has no implementation
    51.       *ret = atomic_fetch_sub_explicit(val, 1, memory_order_relaxed) - 1;
    52.       if (*ret == 0)
    53.           atomic_thread_fence(memory_order_acquire);
                  ^
    54.       return 1;
    55.   }

include/internal/refcount.h:54:5: 
    52.       if (*ret == 0)
    53.           atomic_thread_fence(memory_order_acquire);
    54. >     return 1;
    55.   }
    56.   

include/internal/refcount.h:55:1: return from a call to CRYPTO_DOWN_REF
    53.           atomic_thread_fence(memory_order_acquire);
    54.       return 1;
    55. > }
    56.   
    57.   #  elif defined(__GNUC__) && defined(__ATOMIC_RELAXED) && __GCC_ATOMIC_INT_LOCK_FREE > 0

ssl/ssl_lib.c:3249:9: Taking true branch
  3247.       CRYPTO_DOWN_REF(&a->references, &i, a->lock);
  3248.       REF_PRINT_COUNT("SSL_CTX", a);
  3249.       if (i > 0)
                  ^
  3250.           return;
  3251.       REF_ASSERT_ISNT(i < 0);

ssl/ssl_lib.c:3250:9: 
  3248.       REF_PRINT_COUNT("SSL_CTX", a);
  3249.       if (i > 0)
  3250. >         return;
  3251.       REF_ASSERT_ISNT(i < 0);
  3252.   

ssl/ssl_lib.c:3302:1: return from a call to SSL_CTX_free
  3300.   
  3301.       OPENSSL_free(a);
  3302. > }
  3303.   
  3304.   void SSL_CTX_set_default_passwd_cb(SSL_CTX *ctx, pem_password_cb *cb)
