test/handshake_helper.c:128: error: NULL_DEREFERENCE
  pointer `ex_data` last assigned on line 109 could be null and is dereferenced at line 128, column 9.
Showing all 40 steps of the trace


test/handshake_helper.c:106:1: start of procedure select_server_ctx()
104.    * An empty SNI extension also returns SSL_TSLEXT_ERR_NOACK.
105.    */
106. > static int select_server_ctx(SSL *s, void *arg, int ignore)
107.   {
108.       const char *servername = SSL_get_servername(s, TLSEXT_NAMETYPE_host_name);

test/handshake_helper.c:108:5: 
106.   static int select_server_ctx(SSL *s, void *arg, int ignore)
107.   {
108. >     const char *servername = SSL_get_servername(s, TLSEXT_NAMETYPE_host_name);
109.       HANDSHAKE_EX_DATA *ex_data =
110.           (HANDSHAKE_EX_DATA*)(SSL_get_ex_data(s, ex_data_idx));

ssl/ssl_lib.c:2369:1: start of procedure SSL_get_servername()
  2367.    */
  2368.   
  2369. > const char *SSL_get_servername(const SSL *s, const int type)
  2370.   {
  2371.       if (type != TLSEXT_NAMETYPE_host_name)

ssl/ssl_lib.c:2371:9: Taking false branch
  2369.   const char *SSL_get_servername(const SSL *s, const int type)
  2370.   {
  2371.       if (type != TLSEXT_NAMETYPE_host_name)
                  ^
  2372.           return NULL;
  2373.   

ssl/ssl_lib.c:2374:12: Condition is true
  2372.           return NULL;
  2373.   
  2374.       return s->session && !s->ext.hostname ?
                     ^
  2375.           s->session->ext.hostname : s->ext.hostname;
  2376.   }

ssl/ssl_lib.c:2374:27: Condition is true
  2372.           return NULL;
  2373.   
  2374.       return s->session && !s->ext.hostname ?
                                    ^
  2375.           s->session->ext.hostname : s->ext.hostname;
  2376.   }

ssl/ssl_lib.c:2374:12: 
  2372.           return NULL;
  2373.   
  2374. >     return s->session && !s->ext.hostname ?
  2375.           s->session->ext.hostname : s->ext.hostname;
  2376.   }

ssl/ssl_lib.c:2374:5: 
  2372.           return NULL;
  2373.   
  2374. >     return s->session && !s->ext.hostname ?
  2375.           s->session->ext.hostname : s->ext.hostname;
  2376.   }

ssl/ssl_lib.c:2376:1: return from a call to SSL_get_servername
  2374.       return s->session && !s->ext.hostname ?
  2375.           s->session->ext.hostname : s->ext.hostname;
  2376. > }
  2377.   
  2378.   int SSL_get_servername_type(const SSL *s)

test/handshake_helper.c:109:5: 
107.   {
108.       const char *servername = SSL_get_servername(s, TLSEXT_NAMETYPE_host_name);
109. >     HANDSHAKE_EX_DATA *ex_data =
110.           (HANDSHAKE_EX_DATA*)(SSL_get_ex_data(s, ex_data_idx));
111.   

ssl/ssl_lib.c:3738:1: start of procedure SSL_get_ex_data()
  3736.   }
  3737.   
  3738. > void *SSL_get_ex_data(const SSL *s, int idx)
  3739.   {
  3740.       return (CRYPTO_get_ex_data(&s->ex_data, idx));

ssl/ssl_lib.c:3740:5: 
  3738.   void *SSL_get_ex_data(const SSL *s, int idx)
  3739.   {
  3740. >     return (CRYPTO_get_ex_data(&s->ex_data, idx));
  3741.   }
  3742.   

crypto/ex_data.c:387:1: start of procedure CRYPTO_get_ex_data()
    385.    * particular index in the class used by this variable
    386.    */
    387. > void *CRYPTO_get_ex_data(const CRYPTO_EX_DATA *ad, int idx)
    388.   {
    389.       if (ad->sk == NULL || idx >= sk_void_num(ad->sk))

crypto/ex_data.c:389:9: Taking true branch
    387.   void *CRYPTO_get_ex_data(const CRYPTO_EX_DATA *ad, int idx)
    388.   {
    389.       if (ad->sk == NULL || idx >= sk_void_num(ad->sk))
                   ^
    390.           return NULL;
    391.       return sk_void_value(ad->sk, idx);

crypto/ex_data.c:390:9: 
    388.   {
    389.       if (ad->sk == NULL || idx >= sk_void_num(ad->sk))
    390. >         return NULL;
    391.       return sk_void_value(ad->sk, idx);
    392.   }

crypto/ex_data.c:392:1: return from a call to CRYPTO_get_ex_data
    390.           return NULL;
    391.       return sk_void_value(ad->sk, idx);
    392. > }

ssl/ssl_lib.c:3741:1: return from a call to SSL_get_ex_data
  3739.   {
  3740.       return (CRYPTO_get_ex_data(&s->ex_data, idx));
  3741. > }
  3742.   
  3743.   int SSL_CTX_set_ex_data(SSL_CTX *s, int idx, void *arg)

test/handshake_helper.c:112:9: Taking false branch
110.           (HANDSHAKE_EX_DATA*)(SSL_get_ex_data(s, ex_data_idx));
111.   
112.       if (servername == NULL) {
               ^
113.           ex_data->servername = SSL_TEST_SERVERNAME_SERVER1;
114.           return SSL_TLSEXT_ERR_NOACK;

test/handshake_helper.c:117:9: Taking true branch
115.       }
116.   
117.       if (strcmp(servername, "server2") == 0) {
               ^
118.           SSL_CTX *new_ctx = (SSL_CTX*)arg;
119.           SSL_set_SSL_CTX(s, new_ctx);

test/handshake_helper.c:118:9: 
116.   
117.       if (strcmp(servername, "server2") == 0) {
118. >         SSL_CTX *new_ctx = (SSL_CTX*)arg;
119.           SSL_set_SSL_CTX(s, new_ctx);
120.           /*

test/handshake_helper.c:119:9: 
117.       if (strcmp(servername, "server2") == 0) {
118.           SSL_CTX *new_ctx = (SSL_CTX*)arg;
119. >         SSL_set_SSL_CTX(s, new_ctx);
120.           /*
121.            * Copy over all the SSL_CTX options - reasonable behavior

ssl/ssl_lib.c:3588:1: start of procedure SSL_set_SSL_CTX()
  3586.   }
  3587.   
  3588. > SSL_CTX *SSL_set_SSL_CTX(SSL *ssl, SSL_CTX *ctx)
  3589.   {
  3590.       CERT *new_cert;

ssl/ssl_lib.c:3591:9: Taking false branch
  3589.   {
  3590.       CERT *new_cert;
  3591.       if (ssl->ctx == ctx)
                  ^
  3592.           return ssl->ctx;
  3593.       if (ctx == NULL)

ssl/ssl_lib.c:3593:9: Taking false branch
  3591.       if (ssl->ctx == ctx)
  3592.           return ssl->ctx;
  3593.       if (ctx == NULL)
                  ^
  3594.           ctx = ssl->session_ctx;
  3595.       new_cert = ssl_cert_dup(ctx->cert);

ssl/ssl_lib.c:3595:5: Skipping ssl_cert_dup(): empty list of specs
  3593.       if (ctx == NULL)
  3594.           ctx = ssl->session_ctx;
  3595.       new_cert = ssl_cert_dup(ctx->cert);
              ^
  3596.       if (new_cert == NULL) {
  3597.           return NULL;

ssl/ssl_lib.c:3596:9: Taking true branch
  3594.           ctx = ssl->session_ctx;
  3595.       new_cert = ssl_cert_dup(ctx->cert);
  3596.       if (new_cert == NULL) {
                  ^
  3597.           return NULL;
  3598.       }

ssl/ssl_lib.c:3597:9: 
  3595.       new_cert = ssl_cert_dup(ctx->cert);
  3596.       if (new_cert == NULL) {
  3597. >         return NULL;
  3598.       }
  3599.   

ssl/ssl_lib.c:3632:1: return from a call to SSL_set_SSL_CTX
  3630.   
  3631.       return ssl->ctx;
  3632. > }
  3633.   
  3634.   int SSL_CTX_set_default_verify_paths(SSL_CTX *ctx)

test/handshake_helper.c:125:9: 
123.            * contexts differ/conflict
124.            */
125. >         SSL_clear_options(s, 0xFFFFFFFFL);
126.           SSL_set_options(s, SSL_CTX_get_options(new_ctx));
127.   

ssl/ssl_lib.c:4134:1: start of procedure SSL_clear_options()
  4132.   }
  4133.   
  4134. > unsigned long SSL_clear_options(SSL *s, unsigned long op)
  4135.   {
  4136.       return s->options &= ~op;

ssl/ssl_lib.c:4136:5: 
  4134.   unsigned long SSL_clear_options(SSL *s, unsigned long op)
  4135.   {
  4136. >     return s->options &= ~op;
  4137.   }
  4138.   

ssl/ssl_lib.c:4137:1: return from a call to SSL_clear_options
  4135.   {
  4136.       return s->options &= ~op;
  4137. > }
  4138.   
  4139.   STACK_OF(X509) *SSL_get0_verified_chain(const SSL *s)

test/handshake_helper.c:126:9: 
124.            */
125.           SSL_clear_options(s, 0xFFFFFFFFL);
126. >         SSL_set_options(s, SSL_CTX_get_options(new_ctx));
127.   
128.           ex_data->servername = SSL_TEST_SERVERNAME_SERVER2;

ssl/ssl_lib.c:4109:1: start of procedure SSL_CTX_get_options()
  4107.    * control interface.
  4108.    */
  4109. > unsigned long SSL_CTX_get_options(const SSL_CTX *ctx)
  4110.   {
  4111.       return ctx->options;

ssl/ssl_lib.c:4111:5: 
  4109.   unsigned long SSL_CTX_get_options(const SSL_CTX *ctx)
  4110.   {
  4111. >     return ctx->options;
  4112.   }
  4113.   

ssl/ssl_lib.c:4112:1: return from a call to SSL_CTX_get_options
  4110.   {
  4111.       return ctx->options;
  4112. > }
  4113.   
  4114.   unsigned long SSL_get_options(const SSL *s)

ssl/ssl_lib.c:4124:1: start of procedure SSL_set_options()
  4122.   }
  4123.   
  4124. > unsigned long SSL_set_options(SSL *s, unsigned long op)
  4125.   {
  4126.       return s->options |= op;

ssl/ssl_lib.c:4126:5: 
  4124.   unsigned long SSL_set_options(SSL *s, unsigned long op)
  4125.   {
  4126. >     return s->options |= op;
  4127.   }
  4128.   

ssl/ssl_lib.c:4127:1: return from a call to SSL_set_options
  4125.   {
  4126.       return s->options |= op;
  4127. > }
  4128.   
  4129.   unsigned long SSL_CTX_clear_options(SSL_CTX *ctx, unsigned long op)

test/handshake_helper.c:128:9: 
126.           SSL_set_options(s, SSL_CTX_get_options(new_ctx));
127.   
128. >         ex_data->servername = SSL_TEST_SERVERNAME_SERVER2;
129.           return SSL_TLSEXT_ERR_OK;
130.       } else if (strcmp(servername, "server1") == 0) {
