test/ssltest_old.c:395: error: NULL_DEREFERENCE
  pointer `alpn_selected` last assigned on line 394 could be null and is dereferenced by call to `memcpy()` at line 395, column 5.
Showing all 18 steps of the trace


test/ssltest_old.c:368:1: start of procedure cb_server_alpn()
366.   }
367.   
368. > static int cb_server_alpn(SSL *s, const unsigned char **out,
369.                             unsigned char *outlen, const unsigned char *in,
370.                             unsigned int inlen, void *arg)

test/ssltest_old.c:374:5: 
372.       unsigned char *protos;
373.       size_t protos_len;
374. >     char* alpn_str = arg;
375.   
376.       protos = next_protos_parse(&protos_len, alpn_str);

test/ssltest_old.c:376:5: Skipping next_protos_parse(): empty list of specs
374.       char* alpn_str = arg;
375.   
376.       protos = next_protos_parse(&protos_len, alpn_str);
           ^
377.       if (protos == NULL) {
378.           fprintf(stderr, "failed to parser ALPN server protocol string: %s\n",

test/ssltest_old.c:377:9: Taking false branch
375.   
376.       protos = next_protos_parse(&protos_len, alpn_str);
377.       if (protos == NULL) {
               ^
378.           fprintf(stderr, "failed to parser ALPN server protocol string: %s\n",
379.                   alpn_str);

test/ssltest_old.c:383:9: Taking false branch
381.       }
382.   
383.       if (SSL_select_next_proto
               ^
384.           ((unsigned char **)out, outlen, protos, protos_len, in,
385.            inlen) != OPENSSL_NPN_NEGOTIATED) {

test/ssltest_old.c:394:5: 
392.        * verify_alpn.
393.        */
394. >     alpn_selected = OPENSSL_malloc(*outlen);
395.       memcpy(alpn_selected, *out, *outlen);
396.       *out = alpn_selected;

crypto/mem.c:71:1: start of procedure CRYPTO_malloc()
  69.   }
  70.   
  71. > void *CRYPTO_malloc(size_t num, const char *file, int line)
  72.   {
  73.       void *ret = NULL;

crypto/mem.c:73:5: 
  71.   void *CRYPTO_malloc(size_t num, const char *file, int line)
  72.   {
  73. >     void *ret = NULL;
  74.   
  75.       if (malloc_impl != NULL && malloc_impl != CRYPTO_malloc)

crypto/mem.c:75:9: Taking true branch
  73.       void *ret = NULL;
  74.   
  75.       if (malloc_impl != NULL && malloc_impl != CRYPTO_malloc)
                ^
  76.           return malloc_impl(num, file, line);
  77.   

crypto/mem.c:75:32: Taking false branch
  73.       void *ret = NULL;
  74.   
  75.       if (malloc_impl != NULL && malloc_impl != CRYPTO_malloc)
                                       ^
  76.           return malloc_impl(num, file, line);
  77.   

crypto/mem.c:78:9: Taking false branch
  76.           return malloc_impl(num, file, line);
  77.   
  78.       if (num <= 0)
                ^
  79.           return NULL;
  80.   

crypto/mem.c:81:5: 
  79.           return NULL;
  80.   
  81. >     allow_customize = 0;
  82.   #ifndef OPENSSL_NO_CRYPTO_MDEBUG
  83.       if (call_malloc_debug) {

crypto/mem.c:91:5: 
  89.       }
  90.   #else
  91. >     osslargused(file); osslargused(line);
  92.       ret = malloc(num);
  93.   #endif

crypto/mem.c:91:24: 
  89.       }
  90.   #else
  91. >     osslargused(file); osslargused(line);
  92.       ret = malloc(num);
  93.   #endif

crypto/mem.c:92:5: 
  90.   #else
  91.       osslargused(file); osslargused(line);
  92. >     ret = malloc(num);
  93.   #endif
  94.   

crypto/mem.c:95:5: 
  93.   #endif
  94.   
  95. >     return ret;
  96.   }
  97.   

crypto/mem.c:96:1: return from a call to CRYPTO_malloc
  94.   
  95.       return ret;
  96. > }
  97.   
  98.   void *CRYPTO_zalloc(size_t num, const char *file, int line)

test/ssltest_old.c:395:5: 
393.        */
394.       alpn_selected = OPENSSL_malloc(*outlen);
395. >     memcpy(alpn_selected, *out, *outlen);
396.       *out = alpn_selected;
397.   
