ssl/ssltest.c:475: error: NULL_DEREFERENCE
  pointer `server_proto` last assigned on line 467 could be null and is dereferenced by call to `memcmp()` at line 475, column 9.
Showing all 33 steps of the trace


ssl/ssltest.c:462:1: start of procedure verify_alpn()
460.   }
461.   
462. > static int verify_alpn(SSL *client, SSL *server)
463.   {
464.       const unsigned char *client_proto, *server_proto;

ssl/ssltest.c:465:5: 
463.   {
464.       const unsigned char *client_proto, *server_proto;
465. >     unsigned int client_proto_len = 0, server_proto_len = 0;
466.       SSL_get0_alpn_selected(client, &client_proto, &client_proto_len);
467.       SSL_get0_alpn_selected(server, &server_proto, &server_proto_len);

ssl/ssltest.c:466:5: 
464.       const unsigned char *client_proto, *server_proto;
465.       unsigned int client_proto_len = 0, server_proto_len = 0;
466. >     SSL_get0_alpn_selected(client, &client_proto, &client_proto_len);
467.       SSL_get0_alpn_selected(server, &server_proto, &server_proto_len);
468.   

ssl/ssl_lib.c:1805:1: start of procedure SSL_get0_alpn_selected()
  1803.    * respond with a negotiated protocol then |*len| will be zero.
  1804.    */
  1805. > void SSL_get0_alpn_selected(const SSL *ssl, const unsigned char **data,
  1806.                               unsigned *len)
  1807.   {

ssl/ssl_lib.c:1808:5: 
  1806.                               unsigned *len)
  1807.   {
  1808. >     *data = NULL;
  1809.       if (ssl->s3)
  1810.           *data = ssl->s3->alpn_selected;

ssl/ssl_lib.c:1809:9: Taking true branch
  1807.   {
  1808.       *data = NULL;
  1809.       if (ssl->s3)
                  ^
  1810.           *data = ssl->s3->alpn_selected;
  1811.       if (*data == NULL)

ssl/ssl_lib.c:1810:9: 
  1808.       *data = NULL;
  1809.       if (ssl->s3)
  1810. >         *data = ssl->s3->alpn_selected;
  1811.       if (*data == NULL)
  1812.           *len = 0;

ssl/ssl_lib.c:1811:9: Taking false branch
  1809.       if (ssl->s3)
  1810.           *data = ssl->s3->alpn_selected;
  1811.       if (*data == NULL)
                  ^
  1812.           *len = 0;
  1813.       else

ssl/ssl_lib.c:1814:9: 
  1812.           *len = 0;
  1813.       else
  1814. >         *len = ssl->s3->alpn_selected_len;
  1815.   }
  1816.   

ssl/ssl_lib.c:1811:5: 
  1809.       if (ssl->s3)
  1810.           *data = ssl->s3->alpn_selected;
  1811. >     if (*data == NULL)
  1812.           *len = 0;
  1813.       else

ssl/ssl_lib.c:1815:1: return from a call to SSL_get0_alpn_selected
  1813.       else
  1814.           *len = ssl->s3->alpn_selected_len;
  1815. > }
  1816.   
  1817.   #endif                          /* !OPENSSL_NO_TLSEXT */

ssl/ssltest.c:467:5: 
465.       unsigned int client_proto_len = 0, server_proto_len = 0;
466.       SSL_get0_alpn_selected(client, &client_proto, &client_proto_len);
467. >     SSL_get0_alpn_selected(server, &server_proto, &server_proto_len);
468.   
469.       if (alpn_selected != NULL) {

ssl/ssl_lib.c:1805:1: start of procedure SSL_get0_alpn_selected()
  1803.    * respond with a negotiated protocol then |*len| will be zero.
  1804.    */
  1805. > void SSL_get0_alpn_selected(const SSL *ssl, const unsigned char **data,
  1806.                               unsigned *len)
  1807.   {

ssl/ssl_lib.c:1808:5: 
  1806.                               unsigned *len)
  1807.   {
  1808. >     *data = NULL;
  1809.       if (ssl->s3)
  1810.           *data = ssl->s3->alpn_selected;

ssl/ssl_lib.c:1809:9: Taking true branch
  1807.   {
  1808.       *data = NULL;
  1809.       if (ssl->s3)
                  ^
  1810.           *data = ssl->s3->alpn_selected;
  1811.       if (*data == NULL)

ssl/ssl_lib.c:1810:9: 
  1808.       *data = NULL;
  1809.       if (ssl->s3)
  1810. >         *data = ssl->s3->alpn_selected;
  1811.       if (*data == NULL)
  1812.           *len = 0;

ssl/ssl_lib.c:1811:9: Taking true branch
  1809.       if (ssl->s3)
  1810.           *data = ssl->s3->alpn_selected;
  1811.       if (*data == NULL)
                  ^
  1812.           *len = 0;
  1813.       else

ssl/ssl_lib.c:1812:9: 
  1810.           *data = ssl->s3->alpn_selected;
  1811.       if (*data == NULL)
  1812. >         *len = 0;
  1813.       else
  1814.           *len = ssl->s3->alpn_selected_len;

ssl/ssl_lib.c:1811:5: 
  1809.       if (ssl->s3)
  1810.           *data = ssl->s3->alpn_selected;
  1811. >     if (*data == NULL)
  1812.           *len = 0;
  1813.       else

ssl/ssl_lib.c:1815:1: return from a call to SSL_get0_alpn_selected
  1813.       else
  1814.           *len = ssl->s3->alpn_selected_len;
  1815. > }
  1816.   
  1817.   #endif                          /* !OPENSSL_NO_TLSEXT */

ssl/ssltest.c:469:9: Taking true branch
467.       SSL_get0_alpn_selected(server, &server_proto, &server_proto_len);
468.   
469.       if (alpn_selected != NULL) {
               ^
470.           OPENSSL_free(alpn_selected);
471.           alpn_selected = NULL;

ssl/ssltest.c:470:9: 
468.   
469.       if (alpn_selected != NULL) {
470. >         OPENSSL_free(alpn_selected);
471.           alpn_selected = NULL;
472.       }

crypto/mem.c:431:1: start of procedure CRYPTO_free()
  429.   }
  430.   
  431. > void CRYPTO_free(void *str)
  432.   {
  433.       if (free_debug_func != NULL)

crypto/mem.c:433:9: Taking true branch
  431.   void CRYPTO_free(void *str)
  432.   {
  433.       if (free_debug_func != NULL)
                 ^
  434.           free_debug_func(str, 0);
  435.   #ifdef LEVITTE_DEBUG_MEM

crypto/mem.c:434:9: Skipping __function_pointer__(): unresolved function pointer
  432.   {
  433.       if (free_debug_func != NULL)
  434.           free_debug_func(str, 0);
                 ^
  435.   #ifdef LEVITTE_DEBUG_MEM
  436.       fprintf(stderr, "LEVITTE_DEBUG_MEM:         < 0x%p\n", str);

crypto/mem.c:438:5: Skipping __function_pointer__(): unresolved function pointer
  436.       fprintf(stderr, "LEVITTE_DEBUG_MEM:         < 0x%p\n", str);
  437.   #endif
  438.       free_func(str);
             ^
  439.       if (free_debug_func != NULL)
  440.           free_debug_func(NULL, 1);

crypto/mem.c:439:9: Taking true branch
  437.   #endif
  438.       free_func(str);
  439.       if (free_debug_func != NULL)
                 ^
  440.           free_debug_func(NULL, 1);
  441.   }

crypto/mem.c:440:9: Skipping __function_pointer__(): unresolved function pointer
  438.       free_func(str);
  439.       if (free_debug_func != NULL)
  440.           free_debug_func(NULL, 1);
                 ^
  441.   }
  442.   

crypto/mem.c:439:5: 
  437.   #endif
  438.       free_func(str);
  439. >     if (free_debug_func != NULL)
  440.           free_debug_func(NULL, 1);
  441.   }

crypto/mem.c:441:1: return from a call to CRYPTO_free
  439.       if (free_debug_func != NULL)
  440.           free_debug_func(NULL, 1);
  441. > }
  442.   
  443.   void *CRYPTO_remalloc(void *a, int num, const char *file, int line)

ssl/ssltest.c:471:9: 
469.       if (alpn_selected != NULL) {
470.           OPENSSL_free(alpn_selected);
471. >         alpn_selected = NULL;
472.       }
473.   

ssl/ssltest.c:474:9: Taking false branch
472.       }
473.   
474.       if (client_proto_len != server_proto_len ||
               ^
475.           memcmp(client_proto, server_proto, client_proto_len) != 0) {
476.           BIO_printf(bio_stdout, "ALPN selected protocols differ!\n");

ssl/ssltest.c:475:9: 
473.   
474.       if (client_proto_len != server_proto_len ||
475. >         memcmp(client_proto, server_proto, client_proto_len) != 0) {
476.           BIO_printf(bio_stdout, "ALPN selected protocols differ!\n");
477.           goto err;
