test/ssltest.c:458: error: NULL_DEREFERENCE
  pointer `server_proto` last assigned on line 452 could be null and is dereferenced by call to `memcmp()` at line 458, column 9.
Showing all 32 steps of the trace


test/ssltest.c:447:1: start of procedure verify_alpn()
445.   }
446.   
447. > static int verify_alpn(SSL *client, SSL *server)
448.   {
449.       const unsigned char *client_proto, *server_proto;

test/ssltest.c:450:5: 
448.   {
449.       const unsigned char *client_proto, *server_proto;
450. >     unsigned int client_proto_len = 0, server_proto_len = 0;
451.       SSL_get0_alpn_selected(client, &client_proto, &client_proto_len);
452.       SSL_get0_alpn_selected(server, &server_proto, &server_proto_len);

test/ssltest.c:451:5: 
449.       const unsigned char *client_proto, *server_proto;
450.       unsigned int client_proto_len = 0, server_proto_len = 0;
451. >     SSL_get0_alpn_selected(client, &client_proto, &client_proto_len);
452.       SSL_get0_alpn_selected(server, &server_proto, &server_proto_len);
453.   

ssl/ssl_lib.c:1605:1: start of procedure SSL_get0_alpn_selected()
  1603.    * respond with a negotiated protocol then |*len| will be zero.
  1604.    */
  1605. > void SSL_get0_alpn_selected(const SSL *ssl, const unsigned char **data,
  1606.                               unsigned *len)
  1607.   {

ssl/ssl_lib.c:1608:5: 
  1606.                               unsigned *len)
  1607.   {
  1608. >     *data = NULL;
  1609.       if (ssl->s3)
  1610.           *data = ssl->s3->alpn_selected;

ssl/ssl_lib.c:1609:9: Taking true branch
  1607.   {
  1608.       *data = NULL;
  1609.       if (ssl->s3)
                  ^
  1610.           *data = ssl->s3->alpn_selected;
  1611.       if (*data == NULL)

ssl/ssl_lib.c:1610:9: 
  1608.       *data = NULL;
  1609.       if (ssl->s3)
  1610. >         *data = ssl->s3->alpn_selected;
  1611.       if (*data == NULL)
  1612.           *len = 0;

ssl/ssl_lib.c:1611:9: Taking false branch
  1609.       if (ssl->s3)
  1610.           *data = ssl->s3->alpn_selected;
  1611.       if (*data == NULL)
                  ^
  1612.           *len = 0;
  1613.       else

ssl/ssl_lib.c:1614:9: 
  1612.           *len = 0;
  1613.       else
  1614. >         *len = ssl->s3->alpn_selected_len;
  1615.   }
  1616.   

ssl/ssl_lib.c:1611:5: 
  1609.       if (ssl->s3)
  1610.           *data = ssl->s3->alpn_selected;
  1611. >     if (*data == NULL)
  1612.           *len = 0;
  1613.       else

ssl/ssl_lib.c:1615:1: return from a call to SSL_get0_alpn_selected
  1613.       else
  1614.           *len = ssl->s3->alpn_selected_len;
  1615. > }
  1616.   
  1617.   

test/ssltest.c:452:5: 
450.       unsigned int client_proto_len = 0, server_proto_len = 0;
451.       SSL_get0_alpn_selected(client, &client_proto, &client_proto_len);
452. >     SSL_get0_alpn_selected(server, &server_proto, &server_proto_len);
453.   
454.       OPENSSL_free(alpn_selected);

ssl/ssl_lib.c:1605:1: start of procedure SSL_get0_alpn_selected()
  1603.    * respond with a negotiated protocol then |*len| will be zero.
  1604.    */
  1605. > void SSL_get0_alpn_selected(const SSL *ssl, const unsigned char **data,
  1606.                               unsigned *len)
  1607.   {

ssl/ssl_lib.c:1608:5: 
  1606.                               unsigned *len)
  1607.   {
  1608. >     *data = NULL;
  1609.       if (ssl->s3)
  1610.           *data = ssl->s3->alpn_selected;

ssl/ssl_lib.c:1609:9: Taking true branch
  1607.   {
  1608.       *data = NULL;
  1609.       if (ssl->s3)
                  ^
  1610.           *data = ssl->s3->alpn_selected;
  1611.       if (*data == NULL)

ssl/ssl_lib.c:1610:9: 
  1608.       *data = NULL;
  1609.       if (ssl->s3)
  1610. >         *data = ssl->s3->alpn_selected;
  1611.       if (*data == NULL)
  1612.           *len = 0;

ssl/ssl_lib.c:1611:9: Taking true branch
  1609.       if (ssl->s3)
  1610.           *data = ssl->s3->alpn_selected;
  1611.       if (*data == NULL)
                  ^
  1612.           *len = 0;
  1613.       else

ssl/ssl_lib.c:1612:9: 
  1610.           *data = ssl->s3->alpn_selected;
  1611.       if (*data == NULL)
  1612. >         *len = 0;
  1613.       else
  1614.           *len = ssl->s3->alpn_selected_len;

ssl/ssl_lib.c:1611:5: 
  1609.       if (ssl->s3)
  1610.           *data = ssl->s3->alpn_selected;
  1611. >     if (*data == NULL)
  1612.           *len = 0;
  1613.       else

ssl/ssl_lib.c:1615:1: return from a call to SSL_get0_alpn_selected
  1613.       else
  1614.           *len = ssl->s3->alpn_selected_len;
  1615. > }
  1616.   
  1617.   

test/ssltest.c:454:5: 
452.       SSL_get0_alpn_selected(server, &server_proto, &server_proto_len);
453.   
454. >     OPENSSL_free(alpn_selected);
455.       alpn_selected = NULL;
456.   

crypto/mem.c:392:1: start of procedure CRYPTO_free()
  390.   }
  391.   
  392. > void CRYPTO_free(void *str)
  393.   {
  394.       if (free_debug_func != NULL)

crypto/mem.c:394:9: Taking true branch
  392.   void CRYPTO_free(void *str)
  393.   {
  394.       if (free_debug_func != NULL)
                 ^
  395.           free_debug_func(str, 0);
  396.   #ifdef LEVITTE_DEBUG_MEM

crypto/mem.c:395:9: Skipping __function_pointer__(): unresolved function pointer
  393.   {
  394.       if (free_debug_func != NULL)
  395.           free_debug_func(str, 0);
                 ^
  396.   #ifdef LEVITTE_DEBUG_MEM
  397.       fprintf(stderr, "LEVITTE_DEBUG_MEM:         < 0x%p\n", str);

crypto/mem.c:399:5: Skipping __function_pointer__(): unresolved function pointer
  397.       fprintf(stderr, "LEVITTE_DEBUG_MEM:         < 0x%p\n", str);
  398.   #endif
  399.       free_func(str);
             ^
  400.       if (free_debug_func != NULL)
  401.           free_debug_func(NULL, 1);

crypto/mem.c:400:9: Taking true branch
  398.   #endif
  399.       free_func(str);
  400.       if (free_debug_func != NULL)
                 ^
  401.           free_debug_func(NULL, 1);
  402.   }

crypto/mem.c:401:9: Skipping __function_pointer__(): unresolved function pointer
  399.       free_func(str);
  400.       if (free_debug_func != NULL)
  401.           free_debug_func(NULL, 1);
                 ^
  402.   }
  403.   

crypto/mem.c:400:5: 
  398.   #endif
  399.       free_func(str);
  400. >     if (free_debug_func != NULL)
  401.           free_debug_func(NULL, 1);
  402.   }

crypto/mem.c:402:1: return from a call to CRYPTO_free
  400.       if (free_debug_func != NULL)
  401.           free_debug_func(NULL, 1);
  402. > }
  403.   
  404.   void CRYPTO_clear_free(void *str, size_t num)

test/ssltest.c:455:5: 
453.   
454.       OPENSSL_free(alpn_selected);
455. >     alpn_selected = NULL;
456.   
457.       if (client_proto_len != server_proto_len ||

test/ssltest.c:457:9: Taking false branch
455.       alpn_selected = NULL;
456.   
457.       if (client_proto_len != server_proto_len ||
               ^
458.           memcmp(client_proto, server_proto, client_proto_len) != 0) {
459.           BIO_printf(bio_stdout, "ALPN selected protocols differ!\n");

test/ssltest.c:458:9: 
456.   
457.       if (client_proto_len != server_proto_len ||
458. >         memcmp(client_proto, server_proto, client_proto_len) != 0) {
459.           BIO_printf(bio_stdout, "ALPN selected protocols differ!\n");
460.           goto err;
