test/ssltest.c:460: error: NULL_DEREFERENCE
  pointer `server_proto` last assigned on line 449 could be null and is dereferenced by call to `memcmp()` at line 460, column 9.
Showing all 33 steps of the trace


test/ssltest.c:444:1: start of procedure verify_alpn()
442.   }
443.   
444. > static int verify_alpn(SSL *client, SSL *server)
445.   {
446.       const unsigned char *client_proto, *server_proto;

test/ssltest.c:447:5: 
445.   {
446.       const unsigned char *client_proto, *server_proto;
447. >     unsigned int client_proto_len = 0, server_proto_len = 0;
448.       SSL_get0_alpn_selected(client, &client_proto, &client_proto_len);
449.       SSL_get0_alpn_selected(server, &server_proto, &server_proto_len);

test/ssltest.c:448:5: 
446.       const unsigned char *client_proto, *server_proto;
447.       unsigned int client_proto_len = 0, server_proto_len = 0;
448. >     SSL_get0_alpn_selected(client, &client_proto, &client_proto_len);
449.       SSL_get0_alpn_selected(server, &server_proto, &server_proto_len);
450.   

ssl/ssl_lib.c:1711:1: start of procedure SSL_get0_alpn_selected()
  1709.    * respond with a negotiated protocol then |*len| will be zero.
  1710.    */
  1711. > void SSL_get0_alpn_selected(const SSL *ssl, const unsigned char **data,
  1712.                               unsigned *len)
  1713.   {

ssl/ssl_lib.c:1714:5: 
  1712.                               unsigned *len)
  1713.   {
  1714. >     *data = NULL;
  1715.       if (ssl->s3)
  1716.           *data = ssl->s3->alpn_selected;

ssl/ssl_lib.c:1715:9: Taking true branch
  1713.   {
  1714.       *data = NULL;
  1715.       if (ssl->s3)
                  ^
  1716.           *data = ssl->s3->alpn_selected;
  1717.       if (*data == NULL)

ssl/ssl_lib.c:1716:9: 
  1714.       *data = NULL;
  1715.       if (ssl->s3)
  1716. >         *data = ssl->s3->alpn_selected;
  1717.       if (*data == NULL)
  1718.           *len = 0;

ssl/ssl_lib.c:1717:9: Taking false branch
  1715.       if (ssl->s3)
  1716.           *data = ssl->s3->alpn_selected;
  1717.       if (*data == NULL)
                  ^
  1718.           *len = 0;
  1719.       else

ssl/ssl_lib.c:1720:9: 
  1718.           *len = 0;
  1719.       else
  1720. >         *len = ssl->s3->alpn_selected_len;
  1721.   }
  1722.   

ssl/ssl_lib.c:1717:5: 
  1715.       if (ssl->s3)
  1716.           *data = ssl->s3->alpn_selected;
  1717. >     if (*data == NULL)
  1718.           *len = 0;
  1719.       else

ssl/ssl_lib.c:1721:1: return from a call to SSL_get0_alpn_selected
  1719.       else
  1720.           *len = ssl->s3->alpn_selected_len;
  1721. > }
  1722.   
  1723.   

test/ssltest.c:449:5: 
447.       unsigned int client_proto_len = 0, server_proto_len = 0;
448.       SSL_get0_alpn_selected(client, &client_proto, &client_proto_len);
449. >     SSL_get0_alpn_selected(server, &server_proto, &server_proto_len);
450.   
451.       OPENSSL_free(alpn_selected);

ssl/ssl_lib.c:1711:1: start of procedure SSL_get0_alpn_selected()
  1709.    * respond with a negotiated protocol then |*len| will be zero.
  1710.    */
  1711. > void SSL_get0_alpn_selected(const SSL *ssl, const unsigned char **data,
  1712.                               unsigned *len)
  1713.   {

ssl/ssl_lib.c:1714:5: 
  1712.                               unsigned *len)
  1713.   {
  1714. >     *data = NULL;
  1715.       if (ssl->s3)
  1716.           *data = ssl->s3->alpn_selected;

ssl/ssl_lib.c:1715:9: Taking true branch
  1713.   {
  1714.       *data = NULL;
  1715.       if (ssl->s3)
                  ^
  1716.           *data = ssl->s3->alpn_selected;
  1717.       if (*data == NULL)

ssl/ssl_lib.c:1716:9: 
  1714.       *data = NULL;
  1715.       if (ssl->s3)
  1716. >         *data = ssl->s3->alpn_selected;
  1717.       if (*data == NULL)
  1718.           *len = 0;

ssl/ssl_lib.c:1717:9: Taking true branch
  1715.       if (ssl->s3)
  1716.           *data = ssl->s3->alpn_selected;
  1717.       if (*data == NULL)
                  ^
  1718.           *len = 0;
  1719.       else

ssl/ssl_lib.c:1718:9: 
  1716.           *data = ssl->s3->alpn_selected;
  1717.       if (*data == NULL)
  1718. >         *len = 0;
  1719.       else
  1720.           *len = ssl->s3->alpn_selected_len;

ssl/ssl_lib.c:1717:5: 
  1715.       if (ssl->s3)
  1716.           *data = ssl->s3->alpn_selected;
  1717. >     if (*data == NULL)
  1718.           *len = 0;
  1719.       else

ssl/ssl_lib.c:1721:1: return from a call to SSL_get0_alpn_selected
  1719.       else
  1720.           *len = ssl->s3->alpn_selected_len;
  1721. > }
  1722.   
  1723.   

test/ssltest.c:451:5: 
449.       SSL_get0_alpn_selected(server, &server_proto, &server_proto_len);
450.   
451. >     OPENSSL_free(alpn_selected);
452.       alpn_selected = NULL;
453.   

crypto/mem.c:392:1: start of procedure CRYPTO_free()
  390.   }
  391.   
  392. > void CRYPTO_free(void *str)
  393.   {
  394.       if (free_debug_func != NULL)

crypto/mem.c:394:9: Taking true branch
  392.   void CRYPTO_free(void *str)
  393.   {
  394.       if (free_debug_func != NULL)
                 ^
  395.           free_debug_func(str, 0);
  396.   #ifdef LEVITTE_DEBUG_MEM

crypto/mem.c:395:9: Skipping __function_pointer__(): unresolved function pointer
  393.   {
  394.       if (free_debug_func != NULL)
  395.           free_debug_func(str, 0);
                 ^
  396.   #ifdef LEVITTE_DEBUG_MEM
  397.       fprintf(stderr, "LEVITTE_DEBUG_MEM:         < 0x%p\n", str);

crypto/mem.c:399:5: Skipping __function_pointer__(): unresolved function pointer
  397.       fprintf(stderr, "LEVITTE_DEBUG_MEM:         < 0x%p\n", str);
  398.   #endif
  399.       free_func(str);
             ^
  400.       if (free_debug_func != NULL)
  401.           free_debug_func(NULL, 1);

crypto/mem.c:400:9: Taking true branch
  398.   #endif
  399.       free_func(str);
  400.       if (free_debug_func != NULL)
                 ^
  401.           free_debug_func(NULL, 1);
  402.   }

crypto/mem.c:401:9: Skipping __function_pointer__(): unresolved function pointer
  399.       free_func(str);
  400.       if (free_debug_func != NULL)
  401.           free_debug_func(NULL, 1);
                 ^
  402.   }
  403.   

crypto/mem.c:400:5: 
  398.   #endif
  399.       free_func(str);
  400. >     if (free_debug_func != NULL)
  401.           free_debug_func(NULL, 1);
  402.   }

crypto/mem.c:402:1: return from a call to CRYPTO_free
  400.       if (free_debug_func != NULL)
  401.           free_debug_func(NULL, 1);
  402. > }
  403.   
  404.   void CRYPTO_clear_free(void *str, size_t num)

test/ssltest.c:452:5: 
450.   
451.       OPENSSL_free(alpn_selected);
452. >     alpn_selected = NULL;
453.   
454.       if (client_proto_len != server_proto_len) {

test/ssltest.c:454:9: Taking false branch
452.       alpn_selected = NULL;
453.   
454.       if (client_proto_len != server_proto_len) {
               ^
455.           BIO_printf(bio_stdout, "ALPN selected protocols differ!\n");
456.           goto err;

test/ssltest.c:459:9: Taking true branch
457.       }
458.   
459.       if (client_proto != NULL &&
               ^
460.           memcmp(client_proto, server_proto, client_proto_len) != 0) {
461.           BIO_printf(bio_stdout, "ALPN selected protocols differ!\n");

test/ssltest.c:460:9: 
458.   
459.       if (client_proto != NULL &&
460. >         memcmp(client_proto, server_proto, client_proto_len) != 0) {
461.           BIO_printf(bio_stdout, "ALPN selected protocols differ!\n");
462.           goto err;
