java -ea -Xmx8000000000 -jar /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/plugins/org.eclipse.equinox.launcher_1.3.100.v20150511-1540.jar -data @noDefault -ultimatedata /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/data -tc ../../../trunk/examples/toolchains/AutomizerCInline_WitnessPrinter.xml -s ../../../trunk/examples/settings/default/automizer/svcomp-Reach-32bit-Automizer_Bitvector.epf -i ../../../trunk/examples/svcomp/ssh/s3_clnt.blast.03_false-unreach-call.i.cil.c -------------------------------------------------------------------------------- This is Ultimate 0.1.23-61f4311 [2018-11-23 10:57:16,269 INFO L170 SettingsManager]: Resetting all preferences to default values... [2018-11-23 10:57:16,271 INFO L174 SettingsManager]: Resetting UltimateCore preferences to default values [2018-11-23 10:57:16,283 INFO L177 SettingsManager]: Ultimate Commandline Interface provides no preferences, ignoring... [2018-11-23 10:57:16,284 INFO L174 SettingsManager]: Resetting Boogie Preprocessor preferences to default values [2018-11-23 10:57:16,285 INFO L174 SettingsManager]: Resetting Boogie Procedure Inliner preferences to default values [2018-11-23 10:57:16,286 INFO L174 SettingsManager]: Resetting Abstract Interpretation preferences to default values [2018-11-23 10:57:16,288 INFO L174 SettingsManager]: Resetting LassoRanker preferences to default values [2018-11-23 10:57:16,289 INFO L174 SettingsManager]: Resetting Reaching Definitions preferences to default values [2018-11-23 10:57:16,290 INFO L174 SettingsManager]: Resetting SyntaxChecker preferences to default values [2018-11-23 10:57:16,291 INFO L177 SettingsManager]: Büchi Program Product provides no preferences, ignoring... [2018-11-23 10:57:16,291 INFO L174 SettingsManager]: Resetting LTL2Aut preferences to default values [2018-11-23 10:57:16,292 INFO L174 SettingsManager]: Resetting PEA to Boogie preferences to default values [2018-11-23 10:57:16,293 INFO L174 SettingsManager]: Resetting BlockEncodingV2 preferences to default values [2018-11-23 10:57:16,294 INFO L174 SettingsManager]: Resetting ChcToBoogie preferences to default values [2018-11-23 10:57:16,295 INFO L174 SettingsManager]: Resetting AutomataScriptInterpreter preferences to default values [2018-11-23 10:57:16,296 INFO L174 SettingsManager]: Resetting BuchiAutomizer preferences to default values [2018-11-23 10:57:16,298 INFO L174 SettingsManager]: Resetting CACSL2BoogieTranslator preferences to default values [2018-11-23 10:57:16,300 INFO L174 SettingsManager]: Resetting CodeCheck preferences to default values [2018-11-23 10:57:16,302 INFO L174 SettingsManager]: Resetting InvariantSynthesis preferences to default values [2018-11-23 10:57:16,303 INFO L174 SettingsManager]: Resetting RCFGBuilder preferences to default values [2018-11-23 10:57:16,306 INFO L174 SettingsManager]: Resetting TraceAbstraction preferences to default values [2018-11-23 10:57:16,311 INFO L177 SettingsManager]: TraceAbstractionConcurrent provides no preferences, ignoring... [2018-11-23 10:57:16,311 INFO L177 SettingsManager]: TraceAbstractionWithAFAs provides no preferences, ignoring... [2018-11-23 10:57:16,311 INFO L174 SettingsManager]: Resetting TreeAutomizer preferences to default values [2018-11-23 10:57:16,312 INFO L174 SettingsManager]: Resetting IcfgTransformer preferences to default values [2018-11-23 10:57:16,313 INFO L174 SettingsManager]: Resetting Boogie Printer preferences to default values [2018-11-23 10:57:16,319 INFO L174 SettingsManager]: Resetting ReqPrinter preferences to default values [2018-11-23 10:57:16,320 INFO L174 SettingsManager]: Resetting Witness Printer preferences to default values [2018-11-23 10:57:16,321 INFO L177 SettingsManager]: Boogie PL CUP Parser provides no preferences, ignoring... [2018-11-23 10:57:16,321 INFO L174 SettingsManager]: Resetting CDTParser preferences to default values [2018-11-23 10:57:16,322 INFO L177 SettingsManager]: AutomataScriptParser provides no preferences, ignoring... [2018-11-23 10:57:16,322 INFO L177 SettingsManager]: ReqParser provides no preferences, ignoring... [2018-11-23 10:57:16,322 INFO L174 SettingsManager]: Resetting SmtParser preferences to default values [2018-11-23 10:57:16,323 INFO L174 SettingsManager]: Resetting Witness Parser preferences to default values [2018-11-23 10:57:16,326 INFO L181 SettingsManager]: Finished resetting all preferences to default values... [2018-11-23 10:57:16,327 INFO L98 SettingsManager]: Beginning loading settings from /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/../../../trunk/examples/settings/default/automizer/svcomp-Reach-32bit-Automizer_Bitvector.epf [2018-11-23 10:57:16,352 INFO L110 SettingsManager]: Loading preferences was successful [2018-11-23 10:57:16,352 INFO L112 SettingsManager]: Preferences different from defaults after loading the file: [2018-11-23 10:57:16,353 INFO L131 SettingsManager]: Preferences of Boogie Procedure Inliner differ from their defaults: [2018-11-23 10:57:16,353 INFO L133 SettingsManager]: * ... calls to implemented procedures=ONLY_FOR_CONCURRENT_PROGRAMS [2018-11-23 10:57:16,354 INFO L131 SettingsManager]: Preferences of BlockEncodingV2 differ from their defaults: [2018-11-23 10:57:16,354 INFO L133 SettingsManager]: * Create parallel compositions if possible=false [2018-11-23 10:57:16,354 INFO L133 SettingsManager]: * Use SBE=true [2018-11-23 10:57:16,354 INFO L131 SettingsManager]: Preferences of CACSL2BoogieTranslator differ from their defaults: [2018-11-23 10:57:16,355 INFO L133 SettingsManager]: * sizeof long=4 [2018-11-23 10:57:16,355 INFO L133 SettingsManager]: * sizeof POINTER=4 [2018-11-23 10:57:16,355 INFO L133 SettingsManager]: * Check division by zero=IGNORE [2018-11-23 10:57:16,355 INFO L133 SettingsManager]: * Pointer to allocated memory at dereference=IGNORE [2018-11-23 10:57:16,355 INFO L133 SettingsManager]: * If two pointers are subtracted or compared they have the same base address=IGNORE [2018-11-23 10:57:16,356 INFO L133 SettingsManager]: * Check array bounds for arrays that are off heap=IGNORE [2018-11-23 10:57:16,356 INFO L133 SettingsManager]: * Use bitvectors instead of ints=true [2018-11-23 10:57:16,356 INFO L133 SettingsManager]: * Memory model=HoenickeLindenmann_4ByteResolution [2018-11-23 10:57:16,356 INFO L133 SettingsManager]: * sizeof long double=12 [2018-11-23 10:57:16,356 INFO L133 SettingsManager]: * Check if freed pointer was valid=false [2018-11-23 10:57:16,357 INFO L133 SettingsManager]: * Use constant arrays=true [2018-11-23 10:57:16,357 INFO L133 SettingsManager]: * Pointer base address is valid at dereference=IGNORE [2018-11-23 10:57:16,357 INFO L131 SettingsManager]: Preferences of RCFGBuilder differ from their defaults: [2018-11-23 10:57:16,357 INFO L133 SettingsManager]: * Size of a code block=SequenceOfStatements [2018-11-23 10:57:16,357 INFO L133 SettingsManager]: * To the following directory=./dump/ [2018-11-23 10:57:16,358 INFO L133 SettingsManager]: * SMT solver=External_DefaultMode [2018-11-23 10:57:16,358 INFO L133 SettingsManager]: * Command for external solver=z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in -t:2000 [2018-11-23 10:57:16,358 INFO L131 SettingsManager]: Preferences of TraceAbstraction differ from their defaults: [2018-11-23 10:57:16,358 INFO L133 SettingsManager]: * Compute Interpolants along a Counterexample=FPandBP [2018-11-23 10:57:16,359 INFO L133 SettingsManager]: * Positions where we compute the Hoare Annotation=LoopsAndPotentialCycles [2018-11-23 10:57:16,359 INFO L133 SettingsManager]: * Trace refinement strategy=WOLF [2018-11-23 10:57:16,359 INFO L133 SettingsManager]: * SMT solver=External_ModelsAndUnsatCoreMode [2018-11-23 10:57:16,359 INFO L133 SettingsManager]: * Command for external solver=cvc4nyu --tear-down-incremental --rewrite-divk --print-success --lang smt [2018-11-23 10:57:16,359 INFO L133 SettingsManager]: * Logic for external solver=AUFBV [2018-11-23 10:57:16,360 INFO L133 SettingsManager]: * Compute Hoare Annotation of negated interpolant automaton, abstraction and CFG=true [2018-11-23 10:57:16,404 INFO L81 nceAwareModelManager]: Repository-Root is: /tmp [2018-11-23 10:57:16,422 INFO L258 ainManager$Toolchain]: [Toolchain 1]: Applicable parser(s) successfully (re)initialized [2018-11-23 10:57:16,426 INFO L214 ainManager$Toolchain]: [Toolchain 1]: Toolchain selected. [2018-11-23 10:57:16,427 INFO L271 PluginConnector]: Initializing CDTParser... [2018-11-23 10:57:16,428 INFO L276 PluginConnector]: CDTParser initialized [2018-11-23 10:57:16,429 INFO L418 ainManager$Toolchain]: [Toolchain 1]: Parsing single file: /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/../../../trunk/examples/svcomp/ssh/s3_clnt.blast.03_false-unreach-call.i.cil.c [2018-11-23 10:57:16,500 INFO L221 CDTParser]: Created temporary CDT project at /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/data/c0dd0f3eb/064b2bf78aad4710938bbd79f6ccd035/FLAGb793138cd [2018-11-23 10:57:17,154 INFO L307 CDTParser]: Found 1 translation units. [2018-11-23 10:57:17,155 INFO L161 CDTParser]: Scanning /storage/repos/ultimate/trunk/examples/svcomp/ssh/s3_clnt.blast.03_false-unreach-call.i.cil.c [2018-11-23 10:57:17,186 INFO L355 CDTParser]: About to delete temporary CDT project at /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/data/c0dd0f3eb/064b2bf78aad4710938bbd79f6ccd035/FLAGb793138cd [2018-11-23 10:57:17,348 INFO L363 CDTParser]: Successfully deleted /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/data/c0dd0f3eb/064b2bf78aad4710938bbd79f6ccd035 [2018-11-23 10:57:17,359 INFO L296 ainManager$Toolchain]: ####################### [Toolchain 1] ####################### [2018-11-23 10:57:17,360 INFO L131 ToolchainWalker]: Walking toolchain with 6 elements. [2018-11-23 10:57:17,364 INFO L113 PluginConnector]: ------------------------CACSL2BoogieTranslator---------------------------- [2018-11-23 10:57:17,364 INFO L271 PluginConnector]: Initializing CACSL2BoogieTranslator... [2018-11-23 10:57:17,369 INFO L276 PluginConnector]: CACSL2BoogieTranslator initialized [2018-11-23 10:57:17,371 INFO L185 PluginConnector]: Executing the observer ACSLObjectContainerObserver from plugin CACSL2BoogieTranslator for "CDTParser AST 23.11 10:57:17" (1/1) ... [2018-11-23 10:57:17,374 INFO L205 PluginConnector]: Invalid model from CACSL2BoogieTranslator for observer de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator.ACSLObjectContainerObserver@6ed7254 and model type de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 23.11 10:57:17, skipping insertion in model container [2018-11-23 10:57:17,375 INFO L185 PluginConnector]: Executing the observer CACSL2BoogieTranslatorObserver from plugin CACSL2BoogieTranslator for "CDTParser AST 23.11 10:57:17" (1/1) ... [2018-11-23 10:57:17,387 INFO L145 MainTranslator]: Starting translation in SV-COMP mode [2018-11-23 10:57:17,478 INFO L176 MainTranslator]: Built tables and reachable declarations [2018-11-23 10:57:18,172 INFO L201 PostProcessor]: Analyzing one entry point: main [2018-11-23 10:57:18,196 INFO L191 MainTranslator]: Completed pre-run [2018-11-23 10:57:18,502 INFO L201 PostProcessor]: Analyzing one entry point: main [2018-11-23 10:57:18,538 INFO L195 MainTranslator]: Completed translation [2018-11-23 10:57:18,538 INFO L202 PluginConnector]: Adding new model de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 23.11 10:57:18 WrapperNode [2018-11-23 10:57:18,539 INFO L132 PluginConnector]: ------------------------ END CACSL2BoogieTranslator---------------------------- [2018-11-23 10:57:18,540 INFO L113 PluginConnector]: ------------------------Boogie Procedure Inliner---------------------------- [2018-11-23 10:57:18,540 INFO L271 PluginConnector]: Initializing Boogie Procedure Inliner... [2018-11-23 10:57:18,540 INFO L276 PluginConnector]: Boogie Procedure Inliner initialized [2018-11-23 10:57:18,551 INFO L185 PluginConnector]: Executing the observer TypeChecker from plugin Boogie Procedure Inliner for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 23.11 10:57:18" (1/1) ... [2018-11-23 10:57:18,601 INFO L185 PluginConnector]: Executing the observer Inliner from plugin Boogie Procedure Inliner for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 23.11 10:57:18" (1/1) ... [2018-11-23 10:57:18,622 INFO L132 PluginConnector]: ------------------------ END Boogie Procedure Inliner---------------------------- [2018-11-23 10:57:18,622 INFO L113 PluginConnector]: ------------------------Boogie Preprocessor---------------------------- [2018-11-23 10:57:18,622 INFO L271 PluginConnector]: Initializing Boogie Preprocessor... [2018-11-23 10:57:18,622 INFO L276 PluginConnector]: Boogie Preprocessor initialized [2018-11-23 10:57:18,635 INFO L185 PluginConnector]: Executing the observer EnsureBoogieModelObserver from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 23.11 10:57:18" (1/1) ... [2018-11-23 10:57:18,635 INFO L185 PluginConnector]: Executing the observer TypeChecker from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 23.11 10:57:18" (1/1) ... [2018-11-23 10:57:18,655 INFO L185 PluginConnector]: Executing the observer ConstExpander from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 23.11 10:57:18" (1/1) ... [2018-11-23 10:57:18,656 INFO L185 PluginConnector]: Executing the observer StructExpander from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 23.11 10:57:18" (1/1) ... [2018-11-23 10:57:18,748 INFO L185 PluginConnector]: Executing the observer UnstructureCode from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 23.11 10:57:18" (1/1) ... [2018-11-23 10:57:18,757 INFO L185 PluginConnector]: Executing the observer FunctionInliner from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 23.11 10:57:18" (1/1) ... [2018-11-23 10:57:18,761 INFO L185 PluginConnector]: Executing the observer BoogieSymbolTableConstructor from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 23.11 10:57:18" (1/1) ... [2018-11-23 10:57:18,774 INFO L132 PluginConnector]: ------------------------ END Boogie Preprocessor---------------------------- [2018-11-23 10:57:18,775 INFO L113 PluginConnector]: ------------------------RCFGBuilder---------------------------- [2018-11-23 10:57:18,775 INFO L271 PluginConnector]: Initializing RCFGBuilder... [2018-11-23 10:57:18,775 INFO L276 PluginConnector]: RCFGBuilder initialized [2018-11-23 10:57:18,779 INFO L185 PluginConnector]: Executing the observer RCFGBuilderObserver from plugin RCFGBuilder for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 23.11 10:57:18" (1/1) ... No working directory specified, using /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/z3 Starting monitored process 1 with z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in -t:2000 (exit command is (exit), workingDir is null) Waiting until toolchain timeout for monitored process 1 with z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in -t:2000 [2018-11-23 10:57:18,855 INFO L130 BoogieDeclarations]: Found specification of procedure write~init~$Pointer$ [2018-11-23 10:57:18,856 INFO L130 BoogieDeclarations]: Found specification of procedure main [2018-11-23 10:57:18,856 INFO L138 BoogieDeclarations]: Found implementation of procedure main [2018-11-23 10:57:18,856 INFO L130 BoogieDeclarations]: Found specification of procedure write~init~intINTTYPE4 [2018-11-23 10:57:18,856 INFO L130 BoogieDeclarations]: Found specification of procedure write~$Pointer$ [2018-11-23 10:57:18,857 INFO L130 BoogieDeclarations]: Found specification of procedure #Ultimate.alloc [2018-11-23 10:57:18,857 INFO L130 BoogieDeclarations]: Found specification of procedure read~intINTTYPE4 [2018-11-23 10:57:18,857 INFO L130 BoogieDeclarations]: Found specification of procedure read~$Pointer$ [2018-11-23 10:57:18,857 INFO L130 BoogieDeclarations]: Found specification of procedure ULTIMATE.init [2018-11-23 10:57:18,857 INFO L138 BoogieDeclarations]: Found implementation of procedure ULTIMATE.init [2018-11-23 10:57:18,858 INFO L130 BoogieDeclarations]: Found specification of procedure ssl3_connect [2018-11-23 10:57:18,858 INFO L138 BoogieDeclarations]: Found implementation of procedure ssl3_connect [2018-11-23 10:57:18,858 INFO L130 BoogieDeclarations]: Found specification of procedure ULTIMATE.start [2018-11-23 10:57:18,858 INFO L138 BoogieDeclarations]: Found implementation of procedure ULTIMATE.start [2018-11-23 10:57:18,858 INFO L130 BoogieDeclarations]: Found specification of procedure write~intINTTYPE4 [2018-11-23 10:57:19,388 WARN L640 $ProcedureCfgBuilder]: Two Gotos in a row! There was dead code [2018-11-23 10:57:19,388 WARN L605 $ProcedureCfgBuilder]: Label in the middle of a codeblock. [2018-11-23 10:57:24,802 INFO L275 CfgBuilder]: Using the 1 location(s) as analysis (start of procedure ULTIMATE.start) [2018-11-23 10:57:24,802 INFO L280 CfgBuilder]: Removed 1 assue(true) statements. [2018-11-23 10:57:24,803 INFO L202 PluginConnector]: Adding new model de.uni_freiburg.informatik.ultimate.plugins.generator.rcfgbuilder CFG 23.11 10:57:24 BoogieIcfgContainer [2018-11-23 10:57:24,803 INFO L132 PluginConnector]: ------------------------ END RCFGBuilder---------------------------- [2018-11-23 10:57:24,804 INFO L113 PluginConnector]: ------------------------TraceAbstraction---------------------------- [2018-11-23 10:57:24,805 INFO L271 PluginConnector]: Initializing TraceAbstraction... [2018-11-23 10:57:24,808 INFO L276 PluginConnector]: TraceAbstraction initialized [2018-11-23 10:57:24,808 INFO L185 PluginConnector]: Executing the observer TraceAbstractionObserver from plugin TraceAbstraction for "CDTParser AST 23.11 10:57:17" (1/3) ... [2018-11-23 10:57:24,809 INFO L205 PluginConnector]: Invalid model from TraceAbstraction for observer de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction.TraceAbstractionObserver@2da33921 and model type de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction AST 23.11 10:57:24, skipping insertion in model container [2018-11-23 10:57:24,809 INFO L185 PluginConnector]: Executing the observer TraceAbstractionObserver from plugin TraceAbstraction for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 23.11 10:57:18" (2/3) ... [2018-11-23 10:57:24,810 INFO L205 PluginConnector]: Invalid model from TraceAbstraction for observer de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction.TraceAbstractionObserver@2da33921 and model type de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction AST 23.11 10:57:24, skipping insertion in model container [2018-11-23 10:57:24,810 INFO L185 PluginConnector]: Executing the observer TraceAbstractionObserver from plugin TraceAbstraction for "de.uni_freiburg.informatik.ultimate.plugins.generator.rcfgbuilder CFG 23.11 10:57:24" (3/3) ... [2018-11-23 10:57:24,812 INFO L112 eAbstractionObserver]: Analyzing ICFG s3_clnt.blast.03_false-unreach-call.i.cil.c [2018-11-23 10:57:24,821 INFO L156 ceAbstractionStarter]: Automizer settings: Hoare:true NWA Interpolation:FPandBP Determinization: PREDICATE_ABSTRACTION [2018-11-23 10:57:24,830 INFO L168 ceAbstractionStarter]: Appying trace abstraction to program that has 1 error locations. [2018-11-23 10:57:24,846 INFO L257 AbstractCegarLoop]: Starting to check reachability of 1 error locations. [2018-11-23 10:57:24,881 INFO L133 ementStrategyFactory]: Using default assertion order modulation [2018-11-23 10:57:24,882 INFO L382 AbstractCegarLoop]: Interprodecural is true [2018-11-23 10:57:24,882 INFO L383 AbstractCegarLoop]: Hoare is true [2018-11-23 10:57:24,882 INFO L384 AbstractCegarLoop]: Compute interpolants for FPandBP [2018-11-23 10:57:24,882 INFO L385 AbstractCegarLoop]: Backedges is STRAIGHT_LINE [2018-11-23 10:57:24,882 INFO L386 AbstractCegarLoop]: Determinization is PREDICATE_ABSTRACTION [2018-11-23 10:57:24,883 INFO L387 AbstractCegarLoop]: Difference is false [2018-11-23 10:57:24,883 INFO L388 AbstractCegarLoop]: Minimize is MINIMIZE_SEVPA [2018-11-23 10:57:24,883 INFO L393 AbstractCegarLoop]: ======== Iteration 0==of CEGAR loop == AllErrorsAtOnce======== [2018-11-23 10:57:24,906 INFO L276 IsEmpty]: Start isEmpty. Operand 138 states. [2018-11-23 10:57:24,916 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 31 [2018-11-23 10:57:24,917 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 10:57:24,918 INFO L402 BasicCegarLoop]: trace histogram [1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 10:57:24,920 INFO L423 AbstractCegarLoop]: === Iteration 1 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 10:57:24,927 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 10:57:24,927 INFO L82 PathProgramCache]: Analyzing trace with hash 500880985, now seen corresponding path program 1 times [2018-11-23 10:57:24,934 INFO L223 ckRefinementStrategy]: Switched to mode CVC4_FPBP [2018-11-23 10:57:24,935 INFO L69 tionRefinementEngine]: Using refinement strategy WolfRefinementStrategy No working directory specified, using /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/cvc4nyu Starting monitored process 2 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk (exit command is (exit), workingDir is null) Waiting until toolchain timeout for monitored process 2 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk [2018-11-23 10:57:24,967 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 10:57:25,085 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 10:57:25,125 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 10:57:25,131 INFO L273 TraceCheckSpWp]: Computing forward predicates... [2018-11-23 10:57:25,310 INFO L256 TraceCheckUtils]: 0: Hoare triple {141#true} call ULTIMATE.init(); {141#true} is VALID [2018-11-23 10:57:25,314 INFO L273 TraceCheckUtils]: 1: Hoare triple {141#true} #NULL.base, #NULL.offset := 0bv32, 0bv32;#valid := #valid[0bv32 := 0bv1];~init~0 := 1bv32;call ~#SSLv3_client_data~0.base, ~#SSLv3_client_data~0.offset := #Ultimate.alloc(100bv32);call write~init~intINTTYPE4(0bv32, ~#SSLv3_client_data~0.base, ~#SSLv3_client_data~0.offset, 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(4bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(8bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(12bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(16bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(20bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(24bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(28bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(32bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(36bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(40bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(44bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(48bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(52bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(56bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(60bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(64bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(68bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(72bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(76bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(80bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(84bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(88bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(92bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(96bv32, ~#SSLv3_client_data~0.offset), 4bv32); {141#true} is VALID [2018-11-23 10:57:25,314 INFO L273 TraceCheckUtils]: 2: Hoare triple {141#true} assume true; {141#true} is VALID [2018-11-23 10:57:25,315 INFO L268 TraceCheckUtils]: 3: Hoare quadruple {141#true} {141#true} #544#return; {141#true} is VALID [2018-11-23 10:57:25,315 INFO L256 TraceCheckUtils]: 4: Hoare triple {141#true} call #t~ret138 := main(); {141#true} is VALID [2018-11-23 10:57:25,316 INFO L273 TraceCheckUtils]: 5: Hoare triple {141#true} call #t~malloc3.base, #t~malloc3.offset := #Ultimate.alloc(248bv32);~s~0.base, ~s~0.offset := #t~malloc3.base, #t~malloc3.offset;call #t~malloc4.base, #t~malloc4.offset := #Ultimate.alloc(899bv32);call write~$Pointer$(#t~malloc4.base, #t~malloc4.offset, ~s~0.base, ~bvadd32(84bv32, ~s~0.offset), 4bv32);call #t~malloc5.base, #t~malloc5.offset := #Ultimate.alloc(232bv32);call write~$Pointer$(#t~malloc5.base, #t~malloc5.offset, ~s~0.base, ~bvadd32(204bv32, ~s~0.offset), 4bv32);call #t~malloc6.base, #t~malloc6.offset := #Ultimate.alloc(200bv32);call write~$Pointer$(#t~malloc6.base, #t~malloc6.offset, ~s~0.base, ~bvadd32(176bv32, ~s~0.offset), 4bv32);call write~intINTTYPE4(12292bv32, ~s~0.base, ~bvadd32(52bv32, ~s~0.offset), 4bv32);call write~intINTTYPE4(#t~nondet7, ~s~0.base, ~s~0.offset, 4bv32);havoc #t~nondet7; {141#true} is VALID [2018-11-23 10:57:25,316 INFO L256 TraceCheckUtils]: 6: Hoare triple {141#true} call #t~ret8 := ssl3_connect(~s~0.base, ~s~0.offset); {141#true} is VALID [2018-11-23 10:57:25,318 INFO L273 TraceCheckUtils]: 7: Hoare triple {141#true} ~s.base, ~s.offset := #in~s.base, #in~s.offset;havoc ~buf~0.base, ~buf~0.offset;havoc ~tmp~2;havoc ~l~0;havoc ~num1~0;havoc ~cb~0.base, ~cb~0.offset;havoc ~ret~0;havoc ~new_state~0;havoc ~state~0;havoc ~skip~0;~tmp___0~1.base, ~tmp___0~1.offset := #t~nondet9.base, #t~nondet9.offset;havoc #t~nondet9.base, #t~nondet9.offset;~tmp___1~0 := #t~nondet10;havoc #t~nondet10;~tmp___2~0 := #t~nondet11;havoc #t~nondet11;~tmp___3~0 := #t~nondet12;havoc #t~nondet12;~tmp___4~0 := #t~nondet13;havoc #t~nondet13;~tmp___5~0 := #t~nondet14;havoc #t~nondet14;~tmp___6~0 := #t~nondet15;havoc #t~nondet15;~tmp___7~0 := #t~nondet16;havoc #t~nondet16;~tmp___8~0 := #t~nondet17;havoc #t~nondet17;~tmp___9~0 := #t~nondet18;havoc #t~nondet18;havoc ~blastFlag~0;~blastFlag~0 := 0bv32;call write~intINTTYPE4(#t~nondet19, ~s.base, ~bvadd32(92bv32, ~s.offset), 4bv32);havoc #t~nondet19;call write~intINTTYPE4(12292bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32);~tmp~2 := #t~nondet20;havoc #t~nondet20;~cb~0.base, ~cb~0.offset := 0bv32, 0bv32;~ret~0 := 4294967295bv32;~skip~0 := 0bv32;call write~intINTTYPE4(0bv32, ~tmp___0~1.base, ~tmp___0~1.offset, 4bv32);call #t~mem21.base, #t~mem21.offset := read~$Pointer$(~s.base, ~bvadd32(192bv32, ~s.offset), 4bv32); {167#(= ssl3_connect_~blastFlag~0 (_ bv0 32))} is VALID [2018-11-23 10:57:25,333 INFO L273 TraceCheckUtils]: 8: Hoare triple {167#(= ssl3_connect_~blastFlag~0 (_ bv0 32))} assume 0bv32 != ~bvadd32(#t~mem21.base, #t~mem21.offset);havoc #t~mem21.base, #t~mem21.offset;call #t~mem22.base, #t~mem22.offset := read~$Pointer$(~s.base, ~bvadd32(192bv32, ~s.offset), 4bv32);~cb~0.base, ~cb~0.offset := #t~mem22.base, #t~mem22.offset;havoc #t~mem22.base, #t~mem22.offset; {167#(= ssl3_connect_~blastFlag~0 (_ bv0 32))} is VALID [2018-11-23 10:57:25,343 INFO L273 TraceCheckUtils]: 9: Hoare triple {167#(= ssl3_connect_~blastFlag~0 (_ bv0 32))} call #t~mem27 := read~intINTTYPE4(~s.base, ~bvadd32(28bv32, ~s.offset), 4bv32);call write~intINTTYPE4(~bvadd32(1bv32, #t~mem27), ~s.base, ~bvadd32(28bv32, ~s.offset), 4bv32);havoc #t~mem27; {167#(= ssl3_connect_~blastFlag~0 (_ bv0 32))} is VALID [2018-11-23 10:57:25,354 INFO L273 TraceCheckUtils]: 10: Hoare triple {167#(= ssl3_connect_~blastFlag~0 (_ bv0 32))} assume !(0bv32 != ~bvand32(12288bv32, ~tmp___1~0)); {167#(= ssl3_connect_~blastFlag~0 (_ bv0 32))} is VALID [2018-11-23 10:57:25,364 INFO L273 TraceCheckUtils]: 11: Hoare triple {167#(= ssl3_connect_~blastFlag~0 (_ bv0 32))} assume !false; {167#(= ssl3_connect_~blastFlag~0 (_ bv0 32))} is VALID [2018-11-23 10:57:25,365 INFO L273 TraceCheckUtils]: 12: Hoare triple {167#(= ssl3_connect_~blastFlag~0 (_ bv0 32))} call #t~mem28 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32);~state~0 := #t~mem28;havoc #t~mem28;call #t~mem29 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {167#(= ssl3_connect_~blastFlag~0 (_ bv0 32))} is VALID [2018-11-23 10:57:25,366 INFO L273 TraceCheckUtils]: 13: Hoare triple {167#(= ssl3_connect_~blastFlag~0 (_ bv0 32))} assume !(12292bv32 == #t~mem29);havoc #t~mem29;call #t~mem30 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {167#(= ssl3_connect_~blastFlag~0 (_ bv0 32))} is VALID [2018-11-23 10:57:25,370 INFO L273 TraceCheckUtils]: 14: Hoare triple {167#(= ssl3_connect_~blastFlag~0 (_ bv0 32))} assume !(16384bv32 == #t~mem30);havoc #t~mem30;call #t~mem31 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {167#(= ssl3_connect_~blastFlag~0 (_ bv0 32))} is VALID [2018-11-23 10:57:25,384 INFO L273 TraceCheckUtils]: 15: Hoare triple {167#(= ssl3_connect_~blastFlag~0 (_ bv0 32))} assume !(4096bv32 == #t~mem31);havoc #t~mem31;call #t~mem32 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {167#(= ssl3_connect_~blastFlag~0 (_ bv0 32))} is VALID [2018-11-23 10:57:25,385 INFO L273 TraceCheckUtils]: 16: Hoare triple {167#(= ssl3_connect_~blastFlag~0 (_ bv0 32))} assume !(20480bv32 == #t~mem32);havoc #t~mem32;call #t~mem33 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {167#(= ssl3_connect_~blastFlag~0 (_ bv0 32))} is VALID [2018-11-23 10:57:25,387 INFO L273 TraceCheckUtils]: 17: Hoare triple {167#(= ssl3_connect_~blastFlag~0 (_ bv0 32))} assume !(4099bv32 == #t~mem33);havoc #t~mem33;call #t~mem34 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {167#(= ssl3_connect_~blastFlag~0 (_ bv0 32))} is VALID [2018-11-23 10:57:25,387 INFO L273 TraceCheckUtils]: 18: Hoare triple {167#(= ssl3_connect_~blastFlag~0 (_ bv0 32))} assume !(4368bv32 == #t~mem34);havoc #t~mem34;call #t~mem35 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {167#(= ssl3_connect_~blastFlag~0 (_ bv0 32))} is VALID [2018-11-23 10:57:25,405 INFO L273 TraceCheckUtils]: 19: Hoare triple {167#(= ssl3_connect_~blastFlag~0 (_ bv0 32))} assume !(4369bv32 == #t~mem35);havoc #t~mem35;call #t~mem36 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {167#(= ssl3_connect_~blastFlag~0 (_ bv0 32))} is VALID [2018-11-23 10:57:25,414 INFO L273 TraceCheckUtils]: 20: Hoare triple {167#(= ssl3_connect_~blastFlag~0 (_ bv0 32))} assume !(4384bv32 == #t~mem36);havoc #t~mem36;call #t~mem37 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {167#(= ssl3_connect_~blastFlag~0 (_ bv0 32))} is VALID [2018-11-23 10:57:25,423 INFO L273 TraceCheckUtils]: 21: Hoare triple {167#(= ssl3_connect_~blastFlag~0 (_ bv0 32))} assume !(4385bv32 == #t~mem37);havoc #t~mem37;call #t~mem38 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {167#(= ssl3_connect_~blastFlag~0 (_ bv0 32))} is VALID [2018-11-23 10:57:25,424 INFO L273 TraceCheckUtils]: 22: Hoare triple {167#(= ssl3_connect_~blastFlag~0 (_ bv0 32))} assume !(4400bv32 == #t~mem38);havoc #t~mem38;call #t~mem39 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {167#(= ssl3_connect_~blastFlag~0 (_ bv0 32))} is VALID [2018-11-23 10:57:25,424 INFO L273 TraceCheckUtils]: 23: Hoare triple {167#(= ssl3_connect_~blastFlag~0 (_ bv0 32))} assume !(4401bv32 == #t~mem39);havoc #t~mem39;call #t~mem40 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {167#(= ssl3_connect_~blastFlag~0 (_ bv0 32))} is VALID [2018-11-23 10:57:25,426 INFO L273 TraceCheckUtils]: 24: Hoare triple {167#(= ssl3_connect_~blastFlag~0 (_ bv0 32))} assume !(4416bv32 == #t~mem40);havoc #t~mem40;call #t~mem41 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {167#(= ssl3_connect_~blastFlag~0 (_ bv0 32))} is VALID [2018-11-23 10:57:25,426 INFO L273 TraceCheckUtils]: 25: Hoare triple {167#(= ssl3_connect_~blastFlag~0 (_ bv0 32))} assume !(4417bv32 == #t~mem41);havoc #t~mem41;call #t~mem42 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {167#(= ssl3_connect_~blastFlag~0 (_ bv0 32))} is VALID [2018-11-23 10:57:25,430 INFO L273 TraceCheckUtils]: 26: Hoare triple {167#(= ssl3_connect_~blastFlag~0 (_ bv0 32))} assume 4432bv32 == #t~mem42;havoc #t~mem42; {167#(= ssl3_connect_~blastFlag~0 (_ bv0 32))} is VALID [2018-11-23 10:57:25,431 INFO L273 TraceCheckUtils]: 27: Hoare triple {167#(= ssl3_connect_~blastFlag~0 (_ bv0 32))} ~ret~0 := #t~nondet79;havoc #t~nondet79; {167#(= ssl3_connect_~blastFlag~0 (_ bv0 32))} is VALID [2018-11-23 10:57:25,432 INFO L273 TraceCheckUtils]: 28: Hoare triple {167#(= ssl3_connect_~blastFlag~0 (_ bv0 32))} assume 4bv32 == ~blastFlag~0; {142#false} is VALID [2018-11-23 10:57:25,432 INFO L273 TraceCheckUtils]: 29: Hoare triple {142#false} assume !false; {142#false} is VALID [2018-11-23 10:57:25,439 INFO L134 CoverageAnalysis]: Checked inductivity of 0 backedges. 0 proven. 0 refuted. 0 times theorem prover too weak. 0 trivial. 0 not checked. [2018-11-23 10:57:25,439 INFO L312 TraceCheckSpWp]: Omiting computation of backward sequence because forward sequence was already perfect [2018-11-23 10:57:25,445 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 10:57:25,445 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [3] imperfect sequences [] total 3 [2018-11-23 10:57:25,450 INFO L78 Accepts]: Start accepts. Automaton has 3 states. Word has length 30 [2018-11-23 10:57:25,453 INFO L84 Accepts]: Finished accepts. word is accepted. [2018-11-23 10:57:25,457 INFO L86 InductivityCheck]: Starting indutivity check of a Floyd-Hoare automaton with 3 states. [2018-11-23 10:57:25,618 INFO L119 InductivityCheck]: Floyd-Hoare automaton has 30 edges. 30 inductive. 0 not inductive. 0 times theorem prover too weak to decide inductivity. [2018-11-23 10:57:25,619 INFO L459 AbstractCegarLoop]: Interpolant automaton has 3 states [2018-11-23 10:57:25,627 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 3 interpolants. [2018-11-23 10:57:25,627 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=3, Invalid=3, Unknown=0, NotChecked=0, Total=6 [2018-11-23 10:57:25,630 INFO L87 Difference]: Start difference. First operand 138 states. Second operand 3 states. [2018-11-23 10:57:30,765 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 10:57:30,765 INFO L93 Difference]: Finished difference Result 379 states and 634 transitions. [2018-11-23 10:57:30,766 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 3 states. [2018-11-23 10:57:30,766 INFO L78 Accepts]: Start accepts. Automaton has 3 states. Word has length 30 [2018-11-23 10:57:30,766 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 10:57:30,768 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 3 states. [2018-11-23 10:57:30,795 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 3 states to 3 states and 634 transitions. [2018-11-23 10:57:30,795 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 3 states. [2018-11-23 10:57:30,809 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 3 states to 3 states and 634 transitions. [2018-11-23 10:57:30,809 INFO L86 InductivityCheck]: Starting indutivity check of a Floyd-Hoare automaton with 3 states and 634 transitions. [2018-11-23 10:57:32,179 INFO L119 InductivityCheck]: Floyd-Hoare automaton has 634 edges. 634 inductive. 0 not inductive. 0 times theorem prover too weak to decide inductivity. [2018-11-23 10:57:32,206 INFO L225 Difference]: With dead ends: 379 [2018-11-23 10:57:32,207 INFO L226 Difference]: Without dead ends: 219 [2018-11-23 10:57:32,211 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 29 GetRequests, 28 SyntacticMatches, 0 SemanticMatches, 1 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=3, Invalid=3, Unknown=0, NotChecked=0, Total=6 [2018-11-23 10:57:32,234 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 219 states. [2018-11-23 10:57:32,371 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 219 to 219. [2018-11-23 10:57:32,371 INFO L214 AbstractMinimizeNwa]: Start testing correctness of minimizeSevpa [2018-11-23 10:57:32,372 INFO L82 GeneralOperation]: Start isEquivalent. First operand 219 states. Second operand 219 states. [2018-11-23 10:57:32,372 INFO L74 IsIncluded]: Start isIncluded. First operand 219 states. Second operand 219 states. [2018-11-23 10:57:32,373 INFO L87 Difference]: Start difference. First operand 219 states. Second operand 219 states. [2018-11-23 10:57:32,387 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 10:57:32,388 INFO L93 Difference]: Finished difference Result 219 states and 323 transitions. [2018-11-23 10:57:32,388 INFO L276 IsEmpty]: Start isEmpty. Operand 219 states and 323 transitions. [2018-11-23 10:57:32,391 INFO L282 IsEmpty]: Finished isEmpty. No accepting run. [2018-11-23 10:57:32,391 INFO L83 IsIncluded]: Finished isIncluded. Language is included [2018-11-23 10:57:32,392 INFO L74 IsIncluded]: Start isIncluded. First operand 219 states. Second operand 219 states. [2018-11-23 10:57:32,392 INFO L87 Difference]: Start difference. First operand 219 states. Second operand 219 states. [2018-11-23 10:57:32,405 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 10:57:32,405 INFO L93 Difference]: Finished difference Result 219 states and 323 transitions. [2018-11-23 10:57:32,406 INFO L276 IsEmpty]: Start isEmpty. Operand 219 states and 323 transitions. [2018-11-23 10:57:32,408 INFO L282 IsEmpty]: Finished isEmpty. No accepting run. [2018-11-23 10:57:32,408 INFO L83 IsIncluded]: Finished isIncluded. Language is included [2018-11-23 10:57:32,409 INFO L88 GeneralOperation]: Finished isEquivalent. [2018-11-23 10:57:32,409 INFO L221 AbstractMinimizeNwa]: Finished testing correctness of minimizeSevpa [2018-11-23 10:57:32,409 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 219 states. [2018-11-23 10:57:32,420 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 219 states to 219 states and 323 transitions. [2018-11-23 10:57:32,423 INFO L78 Accepts]: Start accepts. Automaton has 219 states and 323 transitions. Word has length 30 [2018-11-23 10:57:32,423 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 10:57:32,423 INFO L480 AbstractCegarLoop]: Abstraction has 219 states and 323 transitions. [2018-11-23 10:57:32,423 INFO L481 AbstractCegarLoop]: Interpolant automaton has 3 states. [2018-11-23 10:57:32,424 INFO L276 IsEmpty]: Start isEmpty. Operand 219 states and 323 transitions. [2018-11-23 10:57:32,426 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 46 [2018-11-23 10:57:32,426 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 10:57:32,426 INFO L402 BasicCegarLoop]: trace histogram [2, 2, 2, 2, 2, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 10:57:32,427 INFO L423 AbstractCegarLoop]: === Iteration 2 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 10:57:32,427 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 10:57:32,427 INFO L82 PathProgramCache]: Analyzing trace with hash -1966298573, now seen corresponding path program 1 times [2018-11-23 10:57:32,428 INFO L223 ckRefinementStrategy]: Switched to mode CVC4_FPBP [2018-11-23 10:57:32,428 INFO L69 tionRefinementEngine]: Using refinement strategy WolfRefinementStrategy No working directory specified, using /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/cvc4nyu Starting monitored process 3 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk (exit command is (exit), workingDir is null) Waiting until toolchain timeout for monitored process 3 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk [2018-11-23 10:57:32,457 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 10:57:32,556 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 10:57:32,583 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 10:57:32,586 INFO L273 TraceCheckSpWp]: Computing forward predicates... [2018-11-23 10:57:32,702 INFO L256 TraceCheckUtils]: 0: Hoare triple {1373#true} call ULTIMATE.init(); {1373#true} is VALID [2018-11-23 10:57:32,702 INFO L273 TraceCheckUtils]: 1: Hoare triple {1373#true} #NULL.base, #NULL.offset := 0bv32, 0bv32;#valid := #valid[0bv32 := 0bv1];~init~0 := 1bv32;call ~#SSLv3_client_data~0.base, ~#SSLv3_client_data~0.offset := #Ultimate.alloc(100bv32);call write~init~intINTTYPE4(0bv32, ~#SSLv3_client_data~0.base, ~#SSLv3_client_data~0.offset, 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(4bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(8bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(12bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(16bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(20bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(24bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(28bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(32bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(36bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(40bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(44bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(48bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(52bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(56bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(60bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(64bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(68bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(72bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(76bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(80bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(84bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(88bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(92bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(96bv32, ~#SSLv3_client_data~0.offset), 4bv32); {1373#true} is VALID [2018-11-23 10:57:32,702 INFO L273 TraceCheckUtils]: 2: Hoare triple {1373#true} assume true; {1373#true} is VALID [2018-11-23 10:57:32,703 INFO L268 TraceCheckUtils]: 3: Hoare quadruple {1373#true} {1373#true} #544#return; {1373#true} is VALID [2018-11-23 10:57:32,703 INFO L256 TraceCheckUtils]: 4: Hoare triple {1373#true} call #t~ret138 := main(); {1373#true} is VALID [2018-11-23 10:57:32,703 INFO L273 TraceCheckUtils]: 5: Hoare triple {1373#true} call #t~malloc3.base, #t~malloc3.offset := #Ultimate.alloc(248bv32);~s~0.base, ~s~0.offset := #t~malloc3.base, #t~malloc3.offset;call #t~malloc4.base, #t~malloc4.offset := #Ultimate.alloc(899bv32);call write~$Pointer$(#t~malloc4.base, #t~malloc4.offset, ~s~0.base, ~bvadd32(84bv32, ~s~0.offset), 4bv32);call #t~malloc5.base, #t~malloc5.offset := #Ultimate.alloc(232bv32);call write~$Pointer$(#t~malloc5.base, #t~malloc5.offset, ~s~0.base, ~bvadd32(204bv32, ~s~0.offset), 4bv32);call #t~malloc6.base, #t~malloc6.offset := #Ultimate.alloc(200bv32);call write~$Pointer$(#t~malloc6.base, #t~malloc6.offset, ~s~0.base, ~bvadd32(176bv32, ~s~0.offset), 4bv32);call write~intINTTYPE4(12292bv32, ~s~0.base, ~bvadd32(52bv32, ~s~0.offset), 4bv32);call write~intINTTYPE4(#t~nondet7, ~s~0.base, ~s~0.offset, 4bv32);havoc #t~nondet7; {1373#true} is VALID [2018-11-23 10:57:32,703 INFO L256 TraceCheckUtils]: 6: Hoare triple {1373#true} call #t~ret8 := ssl3_connect(~s~0.base, ~s~0.offset); {1373#true} is VALID [2018-11-23 10:57:32,704 INFO L273 TraceCheckUtils]: 7: Hoare triple {1373#true} ~s.base, ~s.offset := #in~s.base, #in~s.offset;havoc ~buf~0.base, ~buf~0.offset;havoc ~tmp~2;havoc ~l~0;havoc ~num1~0;havoc ~cb~0.base, ~cb~0.offset;havoc ~ret~0;havoc ~new_state~0;havoc ~state~0;havoc ~skip~0;~tmp___0~1.base, ~tmp___0~1.offset := #t~nondet9.base, #t~nondet9.offset;havoc #t~nondet9.base, #t~nondet9.offset;~tmp___1~0 := #t~nondet10;havoc #t~nondet10;~tmp___2~0 := #t~nondet11;havoc #t~nondet11;~tmp___3~0 := #t~nondet12;havoc #t~nondet12;~tmp___4~0 := #t~nondet13;havoc #t~nondet13;~tmp___5~0 := #t~nondet14;havoc #t~nondet14;~tmp___6~0 := #t~nondet15;havoc #t~nondet15;~tmp___7~0 := #t~nondet16;havoc #t~nondet16;~tmp___8~0 := #t~nondet17;havoc #t~nondet17;~tmp___9~0 := #t~nondet18;havoc #t~nondet18;havoc ~blastFlag~0;~blastFlag~0 := 0bv32;call write~intINTTYPE4(#t~nondet19, ~s.base, ~bvadd32(92bv32, ~s.offset), 4bv32);havoc #t~nondet19;call write~intINTTYPE4(12292bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32);~tmp~2 := #t~nondet20;havoc #t~nondet20;~cb~0.base, ~cb~0.offset := 0bv32, 0bv32;~ret~0 := 4294967295bv32;~skip~0 := 0bv32;call write~intINTTYPE4(0bv32, ~tmp___0~1.base, ~tmp___0~1.offset, 4bv32);call #t~mem21.base, #t~mem21.offset := read~$Pointer$(~s.base, ~bvadd32(192bv32, ~s.offset), 4bv32); {1373#true} is VALID [2018-11-23 10:57:32,704 INFO L273 TraceCheckUtils]: 8: Hoare triple {1373#true} assume 0bv32 != ~bvadd32(#t~mem21.base, #t~mem21.offset);havoc #t~mem21.base, #t~mem21.offset;call #t~mem22.base, #t~mem22.offset := read~$Pointer$(~s.base, ~bvadd32(192bv32, ~s.offset), 4bv32);~cb~0.base, ~cb~0.offset := #t~mem22.base, #t~mem22.offset;havoc #t~mem22.base, #t~mem22.offset; {1373#true} is VALID [2018-11-23 10:57:32,704 INFO L273 TraceCheckUtils]: 9: Hoare triple {1373#true} call #t~mem27 := read~intINTTYPE4(~s.base, ~bvadd32(28bv32, ~s.offset), 4bv32);call write~intINTTYPE4(~bvadd32(1bv32, #t~mem27), ~s.base, ~bvadd32(28bv32, ~s.offset), 4bv32);havoc #t~mem27; {1373#true} is VALID [2018-11-23 10:57:32,705 INFO L273 TraceCheckUtils]: 10: Hoare triple {1373#true} assume !(0bv32 != ~bvand32(12288bv32, ~tmp___1~0)); {1373#true} is VALID [2018-11-23 10:57:32,705 INFO L273 TraceCheckUtils]: 11: Hoare triple {1373#true} assume !false; {1373#true} is VALID [2018-11-23 10:57:32,705 INFO L273 TraceCheckUtils]: 12: Hoare triple {1373#true} call #t~mem28 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32);~state~0 := #t~mem28;havoc #t~mem28;call #t~mem29 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {1373#true} is VALID [2018-11-23 10:57:32,706 INFO L273 TraceCheckUtils]: 13: Hoare triple {1373#true} assume !(12292bv32 == #t~mem29);havoc #t~mem29;call #t~mem30 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {1373#true} is VALID [2018-11-23 10:57:32,706 INFO L273 TraceCheckUtils]: 14: Hoare triple {1373#true} assume !(16384bv32 == #t~mem30);havoc #t~mem30;call #t~mem31 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {1373#true} is VALID [2018-11-23 10:57:32,706 INFO L273 TraceCheckUtils]: 15: Hoare triple {1373#true} assume !(4096bv32 == #t~mem31);havoc #t~mem31;call #t~mem32 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {1373#true} is VALID [2018-11-23 10:57:32,707 INFO L273 TraceCheckUtils]: 16: Hoare triple {1373#true} assume !(20480bv32 == #t~mem32);havoc #t~mem32;call #t~mem33 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {1373#true} is VALID [2018-11-23 10:57:32,707 INFO L273 TraceCheckUtils]: 17: Hoare triple {1373#true} assume !(4099bv32 == #t~mem33);havoc #t~mem33;call #t~mem34 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {1373#true} is VALID [2018-11-23 10:57:32,707 INFO L273 TraceCheckUtils]: 18: Hoare triple {1373#true} assume 4368bv32 == #t~mem34;havoc #t~mem34; {1373#true} is VALID [2018-11-23 10:57:32,708 INFO L273 TraceCheckUtils]: 19: Hoare triple {1373#true} call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(48bv32, ~s.offset), 4bv32);~ret~0 := #t~nondet69;havoc #t~nondet69; {1373#true} is VALID [2018-11-23 10:57:32,713 INFO L273 TraceCheckUtils]: 20: Hoare triple {1373#true} assume 0bv32 == ~blastFlag~0;~blastFlag~0 := 1bv32; {1438#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967295 32)) (_ bv0 32))} is VALID [2018-11-23 10:57:32,717 INFO L273 TraceCheckUtils]: 21: Hoare triple {1438#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967295 32)) (_ bv0 32))} assume !~bvsle32(~ret~0, 0bv32);call write~intINTTYPE4(4384bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32);call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(64bv32, ~s.offset), 4bv32);call #t~mem70.base, #t~mem70.offset := read~$Pointer$(~s.base, ~bvadd32(20bv32, ~s.offset), 4bv32);call #t~mem71.base, #t~mem71.offset := read~$Pointer$(~s.base, ~bvadd32(16bv32, ~s.offset), 4bv32); {1438#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967295 32)) (_ bv0 32))} is VALID [2018-11-23 10:57:32,718 INFO L273 TraceCheckUtils]: 22: Hoare triple {1438#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967295 32)) (_ bv0 32))} assume ~bvadd32(#t~mem70.base, #t~mem70.offset) != ~bvadd32(#t~mem71.base, #t~mem71.offset);havoc #t~mem71.base, #t~mem71.offset;havoc #t~mem70.base, #t~mem70.offset; {1438#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967295 32)) (_ bv0 32))} is VALID [2018-11-23 10:57:32,718 INFO L273 TraceCheckUtils]: 23: Hoare triple {1438#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967295 32)) (_ bv0 32))} call #t~mem127.base, #t~mem127.offset := read~$Pointer$(~s.base, ~bvadd32(84bv32, ~s.offset), 4bv32);call #t~mem128 := read~intINTTYPE4(#t~mem127.base, ~bvadd32(848bv32, #t~mem127.offset), 4bv32); {1438#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967295 32)) (_ bv0 32))} is VALID [2018-11-23 10:57:32,719 INFO L273 TraceCheckUtils]: 24: Hoare triple {1438#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967295 32)) (_ bv0 32))} assume !(0bv32 == #t~mem128);havoc #t~mem127.base, #t~mem127.offset;havoc #t~mem128; {1438#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967295 32)) (_ bv0 32))} is VALID [2018-11-23 10:57:32,720 INFO L273 TraceCheckUtils]: 25: Hoare triple {1438#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967295 32)) (_ bv0 32))} ~skip~0 := 0bv32; {1438#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967295 32)) (_ bv0 32))} is VALID [2018-11-23 10:57:32,720 INFO L273 TraceCheckUtils]: 26: Hoare triple {1438#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967295 32)) (_ bv0 32))} assume !false; {1438#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967295 32)) (_ bv0 32))} is VALID [2018-11-23 10:57:32,722 INFO L273 TraceCheckUtils]: 27: Hoare triple {1438#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967295 32)) (_ bv0 32))} call #t~mem28 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32);~state~0 := #t~mem28;havoc #t~mem28;call #t~mem29 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {1438#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967295 32)) (_ bv0 32))} is VALID [2018-11-23 10:57:32,724 INFO L273 TraceCheckUtils]: 28: Hoare triple {1438#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967295 32)) (_ bv0 32))} assume !(12292bv32 == #t~mem29);havoc #t~mem29;call #t~mem30 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {1438#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967295 32)) (_ bv0 32))} is VALID [2018-11-23 10:57:32,724 INFO L273 TraceCheckUtils]: 29: Hoare triple {1438#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967295 32)) (_ bv0 32))} assume !(16384bv32 == #t~mem30);havoc #t~mem30;call #t~mem31 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {1438#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967295 32)) (_ bv0 32))} is VALID [2018-11-23 10:57:32,725 INFO L273 TraceCheckUtils]: 30: Hoare triple {1438#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967295 32)) (_ bv0 32))} assume !(4096bv32 == #t~mem31);havoc #t~mem31;call #t~mem32 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {1438#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967295 32)) (_ bv0 32))} is VALID [2018-11-23 10:57:32,725 INFO L273 TraceCheckUtils]: 31: Hoare triple {1438#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967295 32)) (_ bv0 32))} assume !(20480bv32 == #t~mem32);havoc #t~mem32;call #t~mem33 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {1438#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967295 32)) (_ bv0 32))} is VALID [2018-11-23 10:57:32,727 INFO L273 TraceCheckUtils]: 32: Hoare triple {1438#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967295 32)) (_ bv0 32))} assume !(4099bv32 == #t~mem33);havoc #t~mem33;call #t~mem34 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {1438#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967295 32)) (_ bv0 32))} is VALID [2018-11-23 10:57:32,728 INFO L273 TraceCheckUtils]: 33: Hoare triple {1438#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967295 32)) (_ bv0 32))} assume !(4368bv32 == #t~mem34);havoc #t~mem34;call #t~mem35 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {1438#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967295 32)) (_ bv0 32))} is VALID [2018-11-23 10:57:32,729 INFO L273 TraceCheckUtils]: 34: Hoare triple {1438#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967295 32)) (_ bv0 32))} assume !(4369bv32 == #t~mem35);havoc #t~mem35;call #t~mem36 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {1438#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967295 32)) (_ bv0 32))} is VALID [2018-11-23 10:57:32,731 INFO L273 TraceCheckUtils]: 35: Hoare triple {1438#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967295 32)) (_ bv0 32))} assume !(4384bv32 == #t~mem36);havoc #t~mem36;call #t~mem37 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {1438#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967295 32)) (_ bv0 32))} is VALID [2018-11-23 10:57:32,731 INFO L273 TraceCheckUtils]: 36: Hoare triple {1438#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967295 32)) (_ bv0 32))} assume !(4385bv32 == #t~mem37);havoc #t~mem37;call #t~mem38 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {1438#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967295 32)) (_ bv0 32))} is VALID [2018-11-23 10:57:32,732 INFO L273 TraceCheckUtils]: 37: Hoare triple {1438#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967295 32)) (_ bv0 32))} assume !(4400bv32 == #t~mem38);havoc #t~mem38;call #t~mem39 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {1438#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967295 32)) (_ bv0 32))} is VALID [2018-11-23 10:57:32,732 INFO L273 TraceCheckUtils]: 38: Hoare triple {1438#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967295 32)) (_ bv0 32))} assume !(4401bv32 == #t~mem39);havoc #t~mem39;call #t~mem40 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {1438#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967295 32)) (_ bv0 32))} is VALID [2018-11-23 10:57:32,733 INFO L273 TraceCheckUtils]: 39: Hoare triple {1438#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967295 32)) (_ bv0 32))} assume !(4416bv32 == #t~mem40);havoc #t~mem40;call #t~mem41 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {1438#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967295 32)) (_ bv0 32))} is VALID [2018-11-23 10:57:32,734 INFO L273 TraceCheckUtils]: 40: Hoare triple {1438#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967295 32)) (_ bv0 32))} assume !(4417bv32 == #t~mem41);havoc #t~mem41;call #t~mem42 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {1438#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967295 32)) (_ bv0 32))} is VALID [2018-11-23 10:57:32,735 INFO L273 TraceCheckUtils]: 41: Hoare triple {1438#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967295 32)) (_ bv0 32))} assume 4432bv32 == #t~mem42;havoc #t~mem42; {1438#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967295 32)) (_ bv0 32))} is VALID [2018-11-23 10:57:32,740 INFO L273 TraceCheckUtils]: 42: Hoare triple {1438#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967295 32)) (_ bv0 32))} ~ret~0 := #t~nondet79;havoc #t~nondet79; {1438#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967295 32)) (_ bv0 32))} is VALID [2018-11-23 10:57:32,741 INFO L273 TraceCheckUtils]: 43: Hoare triple {1438#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967295 32)) (_ bv0 32))} assume 4bv32 == ~blastFlag~0; {1374#false} is VALID [2018-11-23 10:57:32,741 INFO L273 TraceCheckUtils]: 44: Hoare triple {1374#false} assume !false; {1374#false} is VALID [2018-11-23 10:57:32,747 INFO L134 CoverageAnalysis]: Checked inductivity of 8 backedges. 8 proven. 0 refuted. 0 times theorem prover too weak. 0 trivial. 0 not checked. [2018-11-23 10:57:32,747 INFO L312 TraceCheckSpWp]: Omiting computation of backward sequence because forward sequence was already perfect [2018-11-23 10:57:32,754 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 10:57:32,754 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [3] imperfect sequences [] total 3 [2018-11-23 10:57:32,756 INFO L78 Accepts]: Start accepts. Automaton has 3 states. Word has length 45 [2018-11-23 10:57:32,756 INFO L84 Accepts]: Finished accepts. word is accepted. [2018-11-23 10:57:32,756 INFO L86 InductivityCheck]: Starting indutivity check of a Floyd-Hoare automaton with 3 states. [2018-11-23 10:57:32,863 INFO L119 InductivityCheck]: Floyd-Hoare automaton has 45 edges. 45 inductive. 0 not inductive. 0 times theorem prover too weak to decide inductivity. [2018-11-23 10:57:32,863 INFO L459 AbstractCegarLoop]: Interpolant automaton has 3 states [2018-11-23 10:57:32,864 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 3 interpolants. [2018-11-23 10:57:32,864 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=3, Invalid=3, Unknown=0, NotChecked=0, Total=6 [2018-11-23 10:57:32,865 INFO L87 Difference]: Start difference. First operand 219 states and 323 transitions. Second operand 3 states. [2018-11-23 10:57:39,225 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 10:57:39,225 INFO L93 Difference]: Finished difference Result 423 states and 632 transitions. [2018-11-23 10:57:39,226 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 3 states. [2018-11-23 10:57:39,226 INFO L78 Accepts]: Start accepts. Automaton has 3 states. Word has length 45 [2018-11-23 10:57:39,226 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 10:57:39,226 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 3 states. [2018-11-23 10:57:39,233 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 3 states to 3 states and 484 transitions. [2018-11-23 10:57:39,234 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 3 states. [2018-11-23 10:57:39,240 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 3 states to 3 states and 484 transitions. [2018-11-23 10:57:39,241 INFO L86 InductivityCheck]: Starting indutivity check of a Floyd-Hoare automaton with 3 states and 484 transitions. [2018-11-23 10:57:40,603 INFO L119 InductivityCheck]: Floyd-Hoare automaton has 484 edges. 484 inductive. 0 not inductive. 0 times theorem prover too weak to decide inductivity. [2018-11-23 10:57:40,615 INFO L225 Difference]: With dead ends: 423 [2018-11-23 10:57:40,615 INFO L226 Difference]: Without dead ends: 318 [2018-11-23 10:57:40,617 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 44 GetRequests, 43 SyntacticMatches, 0 SemanticMatches, 1 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=3, Invalid=3, Unknown=0, NotChecked=0, Total=6 [2018-11-23 10:57:40,618 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 318 states. [2018-11-23 10:57:41,021 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 318 to 318. [2018-11-23 10:57:41,021 INFO L214 AbstractMinimizeNwa]: Start testing correctness of minimizeSevpa [2018-11-23 10:57:41,022 INFO L82 GeneralOperation]: Start isEquivalent. First operand 318 states. Second operand 318 states. [2018-11-23 10:57:41,022 INFO L74 IsIncluded]: Start isIncluded. First operand 318 states. Second operand 318 states. [2018-11-23 10:57:41,022 INFO L87 Difference]: Start difference. First operand 318 states. Second operand 318 states. [2018-11-23 10:57:41,037 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 10:57:41,037 INFO L93 Difference]: Finished difference Result 318 states and 469 transitions. [2018-11-23 10:57:41,037 INFO L276 IsEmpty]: Start isEmpty. Operand 318 states and 469 transitions. [2018-11-23 10:57:41,039 INFO L282 IsEmpty]: Finished isEmpty. No accepting run. [2018-11-23 10:57:41,039 INFO L83 IsIncluded]: Finished isIncluded. Language is included [2018-11-23 10:57:41,039 INFO L74 IsIncluded]: Start isIncluded. First operand 318 states. Second operand 318 states. [2018-11-23 10:57:41,039 INFO L87 Difference]: Start difference. First operand 318 states. Second operand 318 states. [2018-11-23 10:57:41,053 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 10:57:41,053 INFO L93 Difference]: Finished difference Result 318 states and 469 transitions. [2018-11-23 10:57:41,054 INFO L276 IsEmpty]: Start isEmpty. Operand 318 states and 469 transitions. [2018-11-23 10:57:41,055 INFO L282 IsEmpty]: Finished isEmpty. No accepting run. [2018-11-23 10:57:41,055 INFO L83 IsIncluded]: Finished isIncluded. Language is included [2018-11-23 10:57:41,055 INFO L88 GeneralOperation]: Finished isEquivalent. [2018-11-23 10:57:41,055 INFO L221 AbstractMinimizeNwa]: Finished testing correctness of minimizeSevpa [2018-11-23 10:57:41,055 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 318 states. [2018-11-23 10:57:41,069 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 318 states to 318 states and 469 transitions. [2018-11-23 10:57:41,069 INFO L78 Accepts]: Start accepts. Automaton has 318 states and 469 transitions. Word has length 45 [2018-11-23 10:57:41,069 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 10:57:41,069 INFO L480 AbstractCegarLoop]: Abstraction has 318 states and 469 transitions. [2018-11-23 10:57:41,070 INFO L481 AbstractCegarLoop]: Interpolant automaton has 3 states. [2018-11-23 10:57:41,070 INFO L276 IsEmpty]: Start isEmpty. Operand 318 states and 469 transitions. [2018-11-23 10:57:41,072 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 64 [2018-11-23 10:57:41,072 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 10:57:41,072 INFO L402 BasicCegarLoop]: trace histogram [3, 3, 3, 3, 3, 3, 3, 2, 2, 2, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 10:57:41,072 INFO L423 AbstractCegarLoop]: === Iteration 3 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 10:57:41,073 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 10:57:41,073 INFO L82 PathProgramCache]: Analyzing trace with hash 4919250, now seen corresponding path program 1 times [2018-11-23 10:57:41,073 INFO L223 ckRefinementStrategy]: Switched to mode CVC4_FPBP [2018-11-23 10:57:41,074 INFO L69 tionRefinementEngine]: Using refinement strategy WolfRefinementStrategy No working directory specified, using /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/cvc4nyu Starting monitored process 4 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk (exit command is (exit), workingDir is null) Waiting until toolchain timeout for monitored process 4 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk [2018-11-23 10:57:41,108 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 10:57:41,212 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 10:57:41,256 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 10:57:41,258 INFO L273 TraceCheckSpWp]: Computing forward predicates... [2018-11-23 10:57:41,356 INFO L256 TraceCheckUtils]: 0: Hoare triple {3014#true} call ULTIMATE.init(); {3014#true} is VALID [2018-11-23 10:57:41,356 INFO L273 TraceCheckUtils]: 1: Hoare triple {3014#true} #NULL.base, #NULL.offset := 0bv32, 0bv32;#valid := #valid[0bv32 := 0bv1];~init~0 := 1bv32;call ~#SSLv3_client_data~0.base, ~#SSLv3_client_data~0.offset := #Ultimate.alloc(100bv32);call write~init~intINTTYPE4(0bv32, ~#SSLv3_client_data~0.base, ~#SSLv3_client_data~0.offset, 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(4bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(8bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(12bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(16bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(20bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(24bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(28bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(32bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(36bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(40bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(44bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(48bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(52bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(56bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(60bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(64bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(68bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(72bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(76bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(80bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(84bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(88bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(92bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(96bv32, ~#SSLv3_client_data~0.offset), 4bv32); {3014#true} is VALID [2018-11-23 10:57:41,357 INFO L273 TraceCheckUtils]: 2: Hoare triple {3014#true} assume true; {3014#true} is VALID [2018-11-23 10:57:41,357 INFO L268 TraceCheckUtils]: 3: Hoare quadruple {3014#true} {3014#true} #544#return; {3014#true} is VALID [2018-11-23 10:57:41,357 INFO L256 TraceCheckUtils]: 4: Hoare triple {3014#true} call #t~ret138 := main(); {3014#true} is VALID [2018-11-23 10:57:41,358 INFO L273 TraceCheckUtils]: 5: Hoare triple {3014#true} call #t~malloc3.base, #t~malloc3.offset := #Ultimate.alloc(248bv32);~s~0.base, ~s~0.offset := #t~malloc3.base, #t~malloc3.offset;call #t~malloc4.base, #t~malloc4.offset := #Ultimate.alloc(899bv32);call write~$Pointer$(#t~malloc4.base, #t~malloc4.offset, ~s~0.base, ~bvadd32(84bv32, ~s~0.offset), 4bv32);call #t~malloc5.base, #t~malloc5.offset := #Ultimate.alloc(232bv32);call write~$Pointer$(#t~malloc5.base, #t~malloc5.offset, ~s~0.base, ~bvadd32(204bv32, ~s~0.offset), 4bv32);call #t~malloc6.base, #t~malloc6.offset := #Ultimate.alloc(200bv32);call write~$Pointer$(#t~malloc6.base, #t~malloc6.offset, ~s~0.base, ~bvadd32(176bv32, ~s~0.offset), 4bv32);call write~intINTTYPE4(12292bv32, ~s~0.base, ~bvadd32(52bv32, ~s~0.offset), 4bv32);call write~intINTTYPE4(#t~nondet7, ~s~0.base, ~s~0.offset, 4bv32);havoc #t~nondet7; {3014#true} is VALID [2018-11-23 10:57:41,358 INFO L256 TraceCheckUtils]: 6: Hoare triple {3014#true} call #t~ret8 := ssl3_connect(~s~0.base, ~s~0.offset); {3014#true} is VALID [2018-11-23 10:57:41,358 INFO L273 TraceCheckUtils]: 7: Hoare triple {3014#true} ~s.base, ~s.offset := #in~s.base, #in~s.offset;havoc ~buf~0.base, ~buf~0.offset;havoc ~tmp~2;havoc ~l~0;havoc ~num1~0;havoc ~cb~0.base, ~cb~0.offset;havoc ~ret~0;havoc ~new_state~0;havoc ~state~0;havoc ~skip~0;~tmp___0~1.base, ~tmp___0~1.offset := #t~nondet9.base, #t~nondet9.offset;havoc #t~nondet9.base, #t~nondet9.offset;~tmp___1~0 := #t~nondet10;havoc #t~nondet10;~tmp___2~0 := #t~nondet11;havoc #t~nondet11;~tmp___3~0 := #t~nondet12;havoc #t~nondet12;~tmp___4~0 := #t~nondet13;havoc #t~nondet13;~tmp___5~0 := #t~nondet14;havoc #t~nondet14;~tmp___6~0 := #t~nondet15;havoc #t~nondet15;~tmp___7~0 := #t~nondet16;havoc #t~nondet16;~tmp___8~0 := #t~nondet17;havoc #t~nondet17;~tmp___9~0 := #t~nondet18;havoc #t~nondet18;havoc ~blastFlag~0;~blastFlag~0 := 0bv32;call write~intINTTYPE4(#t~nondet19, ~s.base, ~bvadd32(92bv32, ~s.offset), 4bv32);havoc #t~nondet19;call write~intINTTYPE4(12292bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32);~tmp~2 := #t~nondet20;havoc #t~nondet20;~cb~0.base, ~cb~0.offset := 0bv32, 0bv32;~ret~0 := 4294967295bv32;~skip~0 := 0bv32;call write~intINTTYPE4(0bv32, ~tmp___0~1.base, ~tmp___0~1.offset, 4bv32);call #t~mem21.base, #t~mem21.offset := read~$Pointer$(~s.base, ~bvadd32(192bv32, ~s.offset), 4bv32); {3014#true} is VALID [2018-11-23 10:57:41,358 INFO L273 TraceCheckUtils]: 8: Hoare triple {3014#true} assume 0bv32 != ~bvadd32(#t~mem21.base, #t~mem21.offset);havoc #t~mem21.base, #t~mem21.offset;call #t~mem22.base, #t~mem22.offset := read~$Pointer$(~s.base, ~bvadd32(192bv32, ~s.offset), 4bv32);~cb~0.base, ~cb~0.offset := #t~mem22.base, #t~mem22.offset;havoc #t~mem22.base, #t~mem22.offset; {3014#true} is VALID [2018-11-23 10:57:41,359 INFO L273 TraceCheckUtils]: 9: Hoare triple {3014#true} call #t~mem27 := read~intINTTYPE4(~s.base, ~bvadd32(28bv32, ~s.offset), 4bv32);call write~intINTTYPE4(~bvadd32(1bv32, #t~mem27), ~s.base, ~bvadd32(28bv32, ~s.offset), 4bv32);havoc #t~mem27; {3014#true} is VALID [2018-11-23 10:57:41,359 INFO L273 TraceCheckUtils]: 10: Hoare triple {3014#true} assume !(0bv32 != ~bvand32(12288bv32, ~tmp___1~0)); {3014#true} is VALID [2018-11-23 10:57:41,359 INFO L273 TraceCheckUtils]: 11: Hoare triple {3014#true} assume !false; {3014#true} is VALID [2018-11-23 10:57:41,359 INFO L273 TraceCheckUtils]: 12: Hoare triple {3014#true} call #t~mem28 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32);~state~0 := #t~mem28;havoc #t~mem28;call #t~mem29 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {3014#true} is VALID [2018-11-23 10:57:41,360 INFO L273 TraceCheckUtils]: 13: Hoare triple {3014#true} assume !(12292bv32 == #t~mem29);havoc #t~mem29;call #t~mem30 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {3014#true} is VALID [2018-11-23 10:57:41,360 INFO L273 TraceCheckUtils]: 14: Hoare triple {3014#true} assume !(16384bv32 == #t~mem30);havoc #t~mem30;call #t~mem31 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {3014#true} is VALID [2018-11-23 10:57:41,360 INFO L273 TraceCheckUtils]: 15: Hoare triple {3014#true} assume !(4096bv32 == #t~mem31);havoc #t~mem31;call #t~mem32 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {3014#true} is VALID [2018-11-23 10:57:41,361 INFO L273 TraceCheckUtils]: 16: Hoare triple {3014#true} assume !(20480bv32 == #t~mem32);havoc #t~mem32;call #t~mem33 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {3014#true} is VALID [2018-11-23 10:57:41,361 INFO L273 TraceCheckUtils]: 17: Hoare triple {3014#true} assume !(4099bv32 == #t~mem33);havoc #t~mem33;call #t~mem34 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {3014#true} is VALID [2018-11-23 10:57:41,361 INFO L273 TraceCheckUtils]: 18: Hoare triple {3014#true} assume 4368bv32 == #t~mem34;havoc #t~mem34; {3014#true} is VALID [2018-11-23 10:57:41,361 INFO L273 TraceCheckUtils]: 19: Hoare triple {3014#true} call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(48bv32, ~s.offset), 4bv32);~ret~0 := #t~nondet69;havoc #t~nondet69; {3014#true} is VALID [2018-11-23 10:57:41,362 INFO L273 TraceCheckUtils]: 20: Hoare triple {3014#true} assume 0bv32 == ~blastFlag~0;~blastFlag~0 := 1bv32; {3014#true} is VALID [2018-11-23 10:57:41,362 INFO L273 TraceCheckUtils]: 21: Hoare triple {3014#true} assume !~bvsle32(~ret~0, 0bv32);call write~intINTTYPE4(4384bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32);call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(64bv32, ~s.offset), 4bv32);call #t~mem70.base, #t~mem70.offset := read~$Pointer$(~s.base, ~bvadd32(20bv32, ~s.offset), 4bv32);call #t~mem71.base, #t~mem71.offset := read~$Pointer$(~s.base, ~bvadd32(16bv32, ~s.offset), 4bv32); {3014#true} is VALID [2018-11-23 10:57:41,362 INFO L273 TraceCheckUtils]: 22: Hoare triple {3014#true} assume ~bvadd32(#t~mem70.base, #t~mem70.offset) != ~bvadd32(#t~mem71.base, #t~mem71.offset);havoc #t~mem71.base, #t~mem71.offset;havoc #t~mem70.base, #t~mem70.offset; {3014#true} is VALID [2018-11-23 10:57:41,362 INFO L273 TraceCheckUtils]: 23: Hoare triple {3014#true} call #t~mem127.base, #t~mem127.offset := read~$Pointer$(~s.base, ~bvadd32(84bv32, ~s.offset), 4bv32);call #t~mem128 := read~intINTTYPE4(#t~mem127.base, ~bvadd32(848bv32, #t~mem127.offset), 4bv32); {3014#true} is VALID [2018-11-23 10:57:41,363 INFO L273 TraceCheckUtils]: 24: Hoare triple {3014#true} assume !(0bv32 == #t~mem128);havoc #t~mem127.base, #t~mem127.offset;havoc #t~mem128; {3014#true} is VALID [2018-11-23 10:57:41,363 INFO L273 TraceCheckUtils]: 25: Hoare triple {3014#true} ~skip~0 := 0bv32; {3014#true} is VALID [2018-11-23 10:57:41,363 INFO L273 TraceCheckUtils]: 26: Hoare triple {3014#true} assume !false; {3014#true} is VALID [2018-11-23 10:57:41,363 INFO L273 TraceCheckUtils]: 27: Hoare triple {3014#true} call #t~mem28 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32);~state~0 := #t~mem28;havoc #t~mem28;call #t~mem29 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {3014#true} is VALID [2018-11-23 10:57:41,364 INFO L273 TraceCheckUtils]: 28: Hoare triple {3014#true} assume !(12292bv32 == #t~mem29);havoc #t~mem29;call #t~mem30 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {3014#true} is VALID [2018-11-23 10:57:41,364 INFO L273 TraceCheckUtils]: 29: Hoare triple {3014#true} assume !(16384bv32 == #t~mem30);havoc #t~mem30;call #t~mem31 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {3014#true} is VALID [2018-11-23 10:57:41,364 INFO L273 TraceCheckUtils]: 30: Hoare triple {3014#true} assume !(4096bv32 == #t~mem31);havoc #t~mem31;call #t~mem32 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {3014#true} is VALID [2018-11-23 10:57:41,364 INFO L273 TraceCheckUtils]: 31: Hoare triple {3014#true} assume !(20480bv32 == #t~mem32);havoc #t~mem32;call #t~mem33 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {3014#true} is VALID [2018-11-23 10:57:41,365 INFO L273 TraceCheckUtils]: 32: Hoare triple {3014#true} assume !(4099bv32 == #t~mem33);havoc #t~mem33;call #t~mem34 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {3014#true} is VALID [2018-11-23 10:57:41,365 INFO L273 TraceCheckUtils]: 33: Hoare triple {3014#true} assume !(4368bv32 == #t~mem34);havoc #t~mem34;call #t~mem35 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {3014#true} is VALID [2018-11-23 10:57:41,365 INFO L273 TraceCheckUtils]: 34: Hoare triple {3014#true} assume !(4369bv32 == #t~mem35);havoc #t~mem35;call #t~mem36 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {3014#true} is VALID [2018-11-23 10:57:41,366 INFO L273 TraceCheckUtils]: 35: Hoare triple {3014#true} assume 4384bv32 == #t~mem36;havoc #t~mem36; {3014#true} is VALID [2018-11-23 10:57:41,366 INFO L273 TraceCheckUtils]: 36: Hoare triple {3014#true} ~ret~0 := #t~nondet72;havoc #t~nondet72; {3014#true} is VALID [2018-11-23 10:57:41,368 INFO L273 TraceCheckUtils]: 37: Hoare triple {3014#true} assume 1bv32 == ~blastFlag~0;~blastFlag~0 := 2bv32; {3130#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967294 32)) (_ bv0 32))} is VALID [2018-11-23 10:57:41,369 INFO L273 TraceCheckUtils]: 38: Hoare triple {3130#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967294 32)) (_ bv0 32))} assume !~bvsle32(~ret~0, 0bv32);call #t~mem73 := read~intINTTYPE4(~s.base, ~bvadd32(92bv32, ~s.offset), 4bv32); {3130#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967294 32)) (_ bv0 32))} is VALID [2018-11-23 10:57:41,369 INFO L273 TraceCheckUtils]: 39: Hoare triple {3130#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967294 32)) (_ bv0 32))} assume 0bv32 != #t~mem73;havoc #t~mem73;call write~intINTTYPE4(4560bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {3130#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967294 32)) (_ bv0 32))} is VALID [2018-11-23 10:57:41,370 INFO L273 TraceCheckUtils]: 40: Hoare triple {3130#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967294 32)) (_ bv0 32))} call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(64bv32, ~s.offset), 4bv32); {3130#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967294 32)) (_ bv0 32))} is VALID [2018-11-23 10:57:41,370 INFO L273 TraceCheckUtils]: 41: Hoare triple {3130#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967294 32)) (_ bv0 32))} call #t~mem127.base, #t~mem127.offset := read~$Pointer$(~s.base, ~bvadd32(84bv32, ~s.offset), 4bv32);call #t~mem128 := read~intINTTYPE4(#t~mem127.base, ~bvadd32(848bv32, #t~mem127.offset), 4bv32); {3130#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967294 32)) (_ bv0 32))} is VALID [2018-11-23 10:57:41,370 INFO L273 TraceCheckUtils]: 42: Hoare triple {3130#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967294 32)) (_ bv0 32))} assume !(0bv32 == #t~mem128);havoc #t~mem127.base, #t~mem127.offset;havoc #t~mem128; {3130#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967294 32)) (_ bv0 32))} is VALID [2018-11-23 10:57:41,371 INFO L273 TraceCheckUtils]: 43: Hoare triple {3130#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967294 32)) (_ bv0 32))} ~skip~0 := 0bv32; {3130#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967294 32)) (_ bv0 32))} is VALID [2018-11-23 10:57:41,371 INFO L273 TraceCheckUtils]: 44: Hoare triple {3130#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967294 32)) (_ bv0 32))} assume !false; {3130#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967294 32)) (_ bv0 32))} is VALID [2018-11-23 10:57:41,372 INFO L273 TraceCheckUtils]: 45: Hoare triple {3130#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967294 32)) (_ bv0 32))} call #t~mem28 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32);~state~0 := #t~mem28;havoc #t~mem28;call #t~mem29 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {3130#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967294 32)) (_ bv0 32))} is VALID [2018-11-23 10:57:41,388 INFO L273 TraceCheckUtils]: 46: Hoare triple {3130#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967294 32)) (_ bv0 32))} assume !(12292bv32 == #t~mem29);havoc #t~mem29;call #t~mem30 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {3130#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967294 32)) (_ bv0 32))} is VALID [2018-11-23 10:57:41,389 INFO L273 TraceCheckUtils]: 47: Hoare triple {3130#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967294 32)) (_ bv0 32))} assume !(16384bv32 == #t~mem30);havoc #t~mem30;call #t~mem31 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {3130#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967294 32)) (_ bv0 32))} is VALID [2018-11-23 10:57:41,391 INFO L273 TraceCheckUtils]: 48: Hoare triple {3130#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967294 32)) (_ bv0 32))} assume !(4096bv32 == #t~mem31);havoc #t~mem31;call #t~mem32 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {3130#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967294 32)) (_ bv0 32))} is VALID [2018-11-23 10:57:41,394 INFO L273 TraceCheckUtils]: 49: Hoare triple {3130#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967294 32)) (_ bv0 32))} assume !(20480bv32 == #t~mem32);havoc #t~mem32;call #t~mem33 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {3130#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967294 32)) (_ bv0 32))} is VALID [2018-11-23 10:57:41,394 INFO L273 TraceCheckUtils]: 50: Hoare triple {3130#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967294 32)) (_ bv0 32))} assume !(4099bv32 == #t~mem33);havoc #t~mem33;call #t~mem34 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {3130#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967294 32)) (_ bv0 32))} is VALID [2018-11-23 10:57:41,396 INFO L273 TraceCheckUtils]: 51: Hoare triple {3130#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967294 32)) (_ bv0 32))} assume !(4368bv32 == #t~mem34);havoc #t~mem34;call #t~mem35 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {3130#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967294 32)) (_ bv0 32))} is VALID [2018-11-23 10:57:41,397 INFO L273 TraceCheckUtils]: 52: Hoare triple {3130#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967294 32)) (_ bv0 32))} assume !(4369bv32 == #t~mem35);havoc #t~mem35;call #t~mem36 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {3130#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967294 32)) (_ bv0 32))} is VALID [2018-11-23 10:57:41,406 INFO L273 TraceCheckUtils]: 53: Hoare triple {3130#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967294 32)) (_ bv0 32))} assume !(4384bv32 == #t~mem36);havoc #t~mem36;call #t~mem37 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {3130#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967294 32)) (_ bv0 32))} is VALID [2018-11-23 10:57:41,407 INFO L273 TraceCheckUtils]: 54: Hoare triple {3130#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967294 32)) (_ bv0 32))} assume !(4385bv32 == #t~mem37);havoc #t~mem37;call #t~mem38 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {3130#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967294 32)) (_ bv0 32))} is VALID [2018-11-23 10:57:41,408 INFO L273 TraceCheckUtils]: 55: Hoare triple {3130#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967294 32)) (_ bv0 32))} assume !(4400bv32 == #t~mem38);havoc #t~mem38;call #t~mem39 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {3130#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967294 32)) (_ bv0 32))} is VALID [2018-11-23 10:57:41,408 INFO L273 TraceCheckUtils]: 56: Hoare triple {3130#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967294 32)) (_ bv0 32))} assume !(4401bv32 == #t~mem39);havoc #t~mem39;call #t~mem40 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {3130#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967294 32)) (_ bv0 32))} is VALID [2018-11-23 10:57:41,409 INFO L273 TraceCheckUtils]: 57: Hoare triple {3130#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967294 32)) (_ bv0 32))} assume !(4416bv32 == #t~mem40);havoc #t~mem40;call #t~mem41 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {3130#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967294 32)) (_ bv0 32))} is VALID [2018-11-23 10:57:41,409 INFO L273 TraceCheckUtils]: 58: Hoare triple {3130#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967294 32)) (_ bv0 32))} assume !(4417bv32 == #t~mem41);havoc #t~mem41;call #t~mem42 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {3130#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967294 32)) (_ bv0 32))} is VALID [2018-11-23 10:57:41,409 INFO L273 TraceCheckUtils]: 59: Hoare triple {3130#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967294 32)) (_ bv0 32))} assume 4432bv32 == #t~mem42;havoc #t~mem42; {3130#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967294 32)) (_ bv0 32))} is VALID [2018-11-23 10:57:41,410 INFO L273 TraceCheckUtils]: 60: Hoare triple {3130#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967294 32)) (_ bv0 32))} ~ret~0 := #t~nondet79;havoc #t~nondet79; {3130#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967294 32)) (_ bv0 32))} is VALID [2018-11-23 10:57:41,410 INFO L273 TraceCheckUtils]: 61: Hoare triple {3130#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967294 32)) (_ bv0 32))} assume 4bv32 == ~blastFlag~0; {3015#false} is VALID [2018-11-23 10:57:41,410 INFO L273 TraceCheckUtils]: 62: Hoare triple {3015#false} assume !false; {3015#false} is VALID [2018-11-23 10:57:41,417 INFO L134 CoverageAnalysis]: Checked inductivity of 29 backedges. 21 proven. 0 refuted. 0 times theorem prover too weak. 8 trivial. 0 not checked. [2018-11-23 10:57:41,417 INFO L312 TraceCheckSpWp]: Omiting computation of backward sequence because forward sequence was already perfect [2018-11-23 10:57:41,419 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 10:57:41,420 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [3] imperfect sequences [] total 3 [2018-11-23 10:57:41,420 INFO L78 Accepts]: Start accepts. Automaton has 3 states. Word has length 63 [2018-11-23 10:57:41,421 INFO L84 Accepts]: Finished accepts. word is accepted. [2018-11-23 10:57:41,421 INFO L86 InductivityCheck]: Starting indutivity check of a Floyd-Hoare automaton with 3 states. [2018-11-23 10:57:41,568 INFO L119 InductivityCheck]: Floyd-Hoare automaton has 56 edges. 56 inductive. 0 not inductive. 0 times theorem prover too weak to decide inductivity. [2018-11-23 10:57:41,568 INFO L459 AbstractCegarLoop]: Interpolant automaton has 3 states [2018-11-23 10:57:41,568 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 3 interpolants. [2018-11-23 10:57:41,568 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=3, Invalid=3, Unknown=0, NotChecked=0, Total=6 [2018-11-23 10:57:41,569 INFO L87 Difference]: Start difference. First operand 318 states and 469 transitions. Second operand 3 states. [2018-11-23 10:57:48,312 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 10:57:48,312 INFO L93 Difference]: Finished difference Result 624 states and 929 transitions. [2018-11-23 10:57:48,313 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 3 states. [2018-11-23 10:57:48,313 INFO L78 Accepts]: Start accepts. Automaton has 3 states. Word has length 63 [2018-11-23 10:57:48,313 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 10:57:48,313 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 3 states. [2018-11-23 10:57:48,319 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 3 states to 3 states and 489 transitions. [2018-11-23 10:57:48,320 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 3 states. [2018-11-23 10:57:48,325 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 3 states to 3 states and 489 transitions. [2018-11-23 10:57:48,325 INFO L86 InductivityCheck]: Starting indutivity check of a Floyd-Hoare automaton with 3 states and 489 transitions. [2018-11-23 10:57:49,248 INFO L119 InductivityCheck]: Floyd-Hoare automaton has 489 edges. 489 inductive. 0 not inductive. 0 times theorem prover too weak to decide inductivity. [2018-11-23 10:57:49,263 INFO L225 Difference]: With dead ends: 624 [2018-11-23 10:57:49,263 INFO L226 Difference]: Without dead ends: 420 [2018-11-23 10:57:49,264 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 62 GetRequests, 61 SyntacticMatches, 0 SemanticMatches, 1 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=3, Invalid=3, Unknown=0, NotChecked=0, Total=6 [2018-11-23 10:57:49,265 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 420 states. [2018-11-23 10:57:49,391 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 420 to 420. [2018-11-23 10:57:49,391 INFO L214 AbstractMinimizeNwa]: Start testing correctness of minimizeSevpa [2018-11-23 10:57:49,391 INFO L82 GeneralOperation]: Start isEquivalent. First operand 420 states. Second operand 420 states. [2018-11-23 10:57:49,392 INFO L74 IsIncluded]: Start isIncluded. First operand 420 states. Second operand 420 states. [2018-11-23 10:57:49,392 INFO L87 Difference]: Start difference. First operand 420 states. Second operand 420 states. [2018-11-23 10:57:49,407 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 10:57:49,407 INFO L93 Difference]: Finished difference Result 420 states and 619 transitions. [2018-11-23 10:57:49,407 INFO L276 IsEmpty]: Start isEmpty. Operand 420 states and 619 transitions. [2018-11-23 10:57:49,409 INFO L282 IsEmpty]: Finished isEmpty. No accepting run. [2018-11-23 10:57:49,409 INFO L83 IsIncluded]: Finished isIncluded. Language is included [2018-11-23 10:57:49,409 INFO L74 IsIncluded]: Start isIncluded. First operand 420 states. Second operand 420 states. [2018-11-23 10:57:49,409 INFO L87 Difference]: Start difference. First operand 420 states. Second operand 420 states. [2018-11-23 10:57:49,425 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 10:57:49,425 INFO L93 Difference]: Finished difference Result 420 states and 619 transitions. [2018-11-23 10:57:49,425 INFO L276 IsEmpty]: Start isEmpty. Operand 420 states and 619 transitions. [2018-11-23 10:57:49,427 INFO L282 IsEmpty]: Finished isEmpty. No accepting run. [2018-11-23 10:57:49,427 INFO L83 IsIncluded]: Finished isIncluded. Language is included [2018-11-23 10:57:49,427 INFO L88 GeneralOperation]: Finished isEquivalent. [2018-11-23 10:57:49,427 INFO L221 AbstractMinimizeNwa]: Finished testing correctness of minimizeSevpa [2018-11-23 10:57:49,427 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 420 states. [2018-11-23 10:57:49,443 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 420 states to 420 states and 619 transitions. [2018-11-23 10:57:49,443 INFO L78 Accepts]: Start accepts. Automaton has 420 states and 619 transitions. Word has length 63 [2018-11-23 10:57:49,443 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 10:57:49,443 INFO L480 AbstractCegarLoop]: Abstraction has 420 states and 619 transitions. [2018-11-23 10:57:49,444 INFO L481 AbstractCegarLoop]: Interpolant automaton has 3 states. [2018-11-23 10:57:49,444 INFO L276 IsEmpty]: Start isEmpty. Operand 420 states and 619 transitions. [2018-11-23 10:57:49,445 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 84 [2018-11-23 10:57:49,445 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 10:57:49,446 INFO L402 BasicCegarLoop]: trace histogram [4, 4, 4, 4, 4, 4, 4, 3, 3, 3, 3, 3, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 10:57:49,446 INFO L423 AbstractCegarLoop]: === Iteration 4 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 10:57:49,446 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 10:57:49,446 INFO L82 PathProgramCache]: Analyzing trace with hash 1622310809, now seen corresponding path program 1 times [2018-11-23 10:57:49,448 INFO L223 ckRefinementStrategy]: Switched to mode CVC4_FPBP [2018-11-23 10:57:49,448 INFO L69 tionRefinementEngine]: Using refinement strategy WolfRefinementStrategy No working directory specified, using /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/cvc4nyu Starting monitored process 5 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk (exit command is (exit), workingDir is null) Waiting until toolchain timeout for monitored process 5 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk [2018-11-23 10:57:49,468 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 10:57:49,579 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 10:57:49,621 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 10:57:49,623 INFO L273 TraceCheckSpWp]: Computing forward predicates... [2018-11-23 10:57:49,762 INFO L256 TraceCheckUtils]: 0: Hoare triple {5264#true} call ULTIMATE.init(); {5264#true} is VALID [2018-11-23 10:57:49,763 INFO L273 TraceCheckUtils]: 1: Hoare triple {5264#true} #NULL.base, #NULL.offset := 0bv32, 0bv32;#valid := #valid[0bv32 := 0bv1];~init~0 := 1bv32;call ~#SSLv3_client_data~0.base, ~#SSLv3_client_data~0.offset := #Ultimate.alloc(100bv32);call write~init~intINTTYPE4(0bv32, ~#SSLv3_client_data~0.base, ~#SSLv3_client_data~0.offset, 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(4bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(8bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(12bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(16bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(20bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(24bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(28bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(32bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(36bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(40bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(44bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(48bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(52bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(56bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(60bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(64bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(68bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(72bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(76bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(80bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(84bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(88bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(92bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(96bv32, ~#SSLv3_client_data~0.offset), 4bv32); {5264#true} is VALID [2018-11-23 10:57:49,763 INFO L273 TraceCheckUtils]: 2: Hoare triple {5264#true} assume true; {5264#true} is VALID [2018-11-23 10:57:49,764 INFO L268 TraceCheckUtils]: 3: Hoare quadruple {5264#true} {5264#true} #544#return; {5264#true} is VALID [2018-11-23 10:57:49,764 INFO L256 TraceCheckUtils]: 4: Hoare triple {5264#true} call #t~ret138 := main(); {5264#true} is VALID [2018-11-23 10:57:49,764 INFO L273 TraceCheckUtils]: 5: Hoare triple {5264#true} call #t~malloc3.base, #t~malloc3.offset := #Ultimate.alloc(248bv32);~s~0.base, ~s~0.offset := #t~malloc3.base, #t~malloc3.offset;call #t~malloc4.base, #t~malloc4.offset := #Ultimate.alloc(899bv32);call write~$Pointer$(#t~malloc4.base, #t~malloc4.offset, ~s~0.base, ~bvadd32(84bv32, ~s~0.offset), 4bv32);call #t~malloc5.base, #t~malloc5.offset := #Ultimate.alloc(232bv32);call write~$Pointer$(#t~malloc5.base, #t~malloc5.offset, ~s~0.base, ~bvadd32(204bv32, ~s~0.offset), 4bv32);call #t~malloc6.base, #t~malloc6.offset := #Ultimate.alloc(200bv32);call write~$Pointer$(#t~malloc6.base, #t~malloc6.offset, ~s~0.base, ~bvadd32(176bv32, ~s~0.offset), 4bv32);call write~intINTTYPE4(12292bv32, ~s~0.base, ~bvadd32(52bv32, ~s~0.offset), 4bv32);call write~intINTTYPE4(#t~nondet7, ~s~0.base, ~s~0.offset, 4bv32);havoc #t~nondet7; {5264#true} is VALID [2018-11-23 10:57:49,765 INFO L256 TraceCheckUtils]: 6: Hoare triple {5264#true} call #t~ret8 := ssl3_connect(~s~0.base, ~s~0.offset); {5264#true} is VALID [2018-11-23 10:57:49,765 INFO L273 TraceCheckUtils]: 7: Hoare triple {5264#true} ~s.base, ~s.offset := #in~s.base, #in~s.offset;havoc ~buf~0.base, ~buf~0.offset;havoc ~tmp~2;havoc ~l~0;havoc ~num1~0;havoc ~cb~0.base, ~cb~0.offset;havoc ~ret~0;havoc ~new_state~0;havoc ~state~0;havoc ~skip~0;~tmp___0~1.base, ~tmp___0~1.offset := #t~nondet9.base, #t~nondet9.offset;havoc #t~nondet9.base, #t~nondet9.offset;~tmp___1~0 := #t~nondet10;havoc #t~nondet10;~tmp___2~0 := #t~nondet11;havoc #t~nondet11;~tmp___3~0 := #t~nondet12;havoc #t~nondet12;~tmp___4~0 := #t~nondet13;havoc #t~nondet13;~tmp___5~0 := #t~nondet14;havoc #t~nondet14;~tmp___6~0 := #t~nondet15;havoc #t~nondet15;~tmp___7~0 := #t~nondet16;havoc #t~nondet16;~tmp___8~0 := #t~nondet17;havoc #t~nondet17;~tmp___9~0 := #t~nondet18;havoc #t~nondet18;havoc ~blastFlag~0;~blastFlag~0 := 0bv32;call write~intINTTYPE4(#t~nondet19, ~s.base, ~bvadd32(92bv32, ~s.offset), 4bv32);havoc #t~nondet19;call write~intINTTYPE4(12292bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32);~tmp~2 := #t~nondet20;havoc #t~nondet20;~cb~0.base, ~cb~0.offset := 0bv32, 0bv32;~ret~0 := 4294967295bv32;~skip~0 := 0bv32;call write~intINTTYPE4(0bv32, ~tmp___0~1.base, ~tmp___0~1.offset, 4bv32);call #t~mem21.base, #t~mem21.offset := read~$Pointer$(~s.base, ~bvadd32(192bv32, ~s.offset), 4bv32); {5264#true} is VALID [2018-11-23 10:57:49,765 INFO L273 TraceCheckUtils]: 8: Hoare triple {5264#true} assume 0bv32 != ~bvadd32(#t~mem21.base, #t~mem21.offset);havoc #t~mem21.base, #t~mem21.offset;call #t~mem22.base, #t~mem22.offset := read~$Pointer$(~s.base, ~bvadd32(192bv32, ~s.offset), 4bv32);~cb~0.base, ~cb~0.offset := #t~mem22.base, #t~mem22.offset;havoc #t~mem22.base, #t~mem22.offset; {5264#true} is VALID [2018-11-23 10:57:49,766 INFO L273 TraceCheckUtils]: 9: Hoare triple {5264#true} call #t~mem27 := read~intINTTYPE4(~s.base, ~bvadd32(28bv32, ~s.offset), 4bv32);call write~intINTTYPE4(~bvadd32(1bv32, #t~mem27), ~s.base, ~bvadd32(28bv32, ~s.offset), 4bv32);havoc #t~mem27; {5264#true} is VALID [2018-11-23 10:57:49,766 INFO L273 TraceCheckUtils]: 10: Hoare triple {5264#true} assume !(0bv32 != ~bvand32(12288bv32, ~tmp___1~0)); {5264#true} is VALID [2018-11-23 10:57:49,766 INFO L273 TraceCheckUtils]: 11: Hoare triple {5264#true} assume !false; {5264#true} is VALID [2018-11-23 10:57:49,767 INFO L273 TraceCheckUtils]: 12: Hoare triple {5264#true} call #t~mem28 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32);~state~0 := #t~mem28;havoc #t~mem28;call #t~mem29 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {5264#true} is VALID [2018-11-23 10:57:49,767 INFO L273 TraceCheckUtils]: 13: Hoare triple {5264#true} assume !(12292bv32 == #t~mem29);havoc #t~mem29;call #t~mem30 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {5264#true} is VALID [2018-11-23 10:57:49,767 INFO L273 TraceCheckUtils]: 14: Hoare triple {5264#true} assume !(16384bv32 == #t~mem30);havoc #t~mem30;call #t~mem31 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {5264#true} is VALID [2018-11-23 10:57:49,767 INFO L273 TraceCheckUtils]: 15: Hoare triple {5264#true} assume !(4096bv32 == #t~mem31);havoc #t~mem31;call #t~mem32 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {5264#true} is VALID [2018-11-23 10:57:49,768 INFO L273 TraceCheckUtils]: 16: Hoare triple {5264#true} assume !(20480bv32 == #t~mem32);havoc #t~mem32;call #t~mem33 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {5264#true} is VALID [2018-11-23 10:57:49,768 INFO L273 TraceCheckUtils]: 17: Hoare triple {5264#true} assume !(4099bv32 == #t~mem33);havoc #t~mem33;call #t~mem34 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {5264#true} is VALID [2018-11-23 10:57:49,768 INFO L273 TraceCheckUtils]: 18: Hoare triple {5264#true} assume 4368bv32 == #t~mem34;havoc #t~mem34; {5264#true} is VALID [2018-11-23 10:57:49,768 INFO L273 TraceCheckUtils]: 19: Hoare triple {5264#true} call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(48bv32, ~s.offset), 4bv32);~ret~0 := #t~nondet69;havoc #t~nondet69; {5264#true} is VALID [2018-11-23 10:57:49,768 INFO L273 TraceCheckUtils]: 20: Hoare triple {5264#true} assume 0bv32 == ~blastFlag~0;~blastFlag~0 := 1bv32; {5264#true} is VALID [2018-11-23 10:57:49,769 INFO L273 TraceCheckUtils]: 21: Hoare triple {5264#true} assume !~bvsle32(~ret~0, 0bv32);call write~intINTTYPE4(4384bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32);call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(64bv32, ~s.offset), 4bv32);call #t~mem70.base, #t~mem70.offset := read~$Pointer$(~s.base, ~bvadd32(20bv32, ~s.offset), 4bv32);call #t~mem71.base, #t~mem71.offset := read~$Pointer$(~s.base, ~bvadd32(16bv32, ~s.offset), 4bv32); {5264#true} is VALID [2018-11-23 10:57:49,769 INFO L273 TraceCheckUtils]: 22: Hoare triple {5264#true} assume ~bvadd32(#t~mem70.base, #t~mem70.offset) != ~bvadd32(#t~mem71.base, #t~mem71.offset);havoc #t~mem71.base, #t~mem71.offset;havoc #t~mem70.base, #t~mem70.offset; {5264#true} is VALID [2018-11-23 10:57:49,769 INFO L273 TraceCheckUtils]: 23: Hoare triple {5264#true} call #t~mem127.base, #t~mem127.offset := read~$Pointer$(~s.base, ~bvadd32(84bv32, ~s.offset), 4bv32);call #t~mem128 := read~intINTTYPE4(#t~mem127.base, ~bvadd32(848bv32, #t~mem127.offset), 4bv32); {5264#true} is VALID [2018-11-23 10:57:49,769 INFO L273 TraceCheckUtils]: 24: Hoare triple {5264#true} assume !(0bv32 == #t~mem128);havoc #t~mem127.base, #t~mem127.offset;havoc #t~mem128; {5264#true} is VALID [2018-11-23 10:57:49,769 INFO L273 TraceCheckUtils]: 25: Hoare triple {5264#true} ~skip~0 := 0bv32; {5264#true} is VALID [2018-11-23 10:57:49,770 INFO L273 TraceCheckUtils]: 26: Hoare triple {5264#true} assume !false; {5264#true} is VALID [2018-11-23 10:57:49,770 INFO L273 TraceCheckUtils]: 27: Hoare triple {5264#true} call #t~mem28 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32);~state~0 := #t~mem28;havoc #t~mem28;call #t~mem29 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {5264#true} is VALID [2018-11-23 10:57:49,770 INFO L273 TraceCheckUtils]: 28: Hoare triple {5264#true} assume !(12292bv32 == #t~mem29);havoc #t~mem29;call #t~mem30 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {5264#true} is VALID [2018-11-23 10:57:49,770 INFO L273 TraceCheckUtils]: 29: Hoare triple {5264#true} assume !(16384bv32 == #t~mem30);havoc #t~mem30;call #t~mem31 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {5264#true} is VALID [2018-11-23 10:57:49,771 INFO L273 TraceCheckUtils]: 30: Hoare triple {5264#true} assume !(4096bv32 == #t~mem31);havoc #t~mem31;call #t~mem32 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {5264#true} is VALID [2018-11-23 10:57:49,771 INFO L273 TraceCheckUtils]: 31: Hoare triple {5264#true} assume !(20480bv32 == #t~mem32);havoc #t~mem32;call #t~mem33 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {5264#true} is VALID [2018-11-23 10:57:49,771 INFO L273 TraceCheckUtils]: 32: Hoare triple {5264#true} assume !(4099bv32 == #t~mem33);havoc #t~mem33;call #t~mem34 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {5264#true} is VALID [2018-11-23 10:57:49,771 INFO L273 TraceCheckUtils]: 33: Hoare triple {5264#true} assume !(4368bv32 == #t~mem34);havoc #t~mem34;call #t~mem35 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {5264#true} is VALID [2018-11-23 10:57:49,772 INFO L273 TraceCheckUtils]: 34: Hoare triple {5264#true} assume !(4369bv32 == #t~mem35);havoc #t~mem35;call #t~mem36 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {5264#true} is VALID [2018-11-23 10:57:49,772 INFO L273 TraceCheckUtils]: 35: Hoare triple {5264#true} assume 4384bv32 == #t~mem36;havoc #t~mem36; {5264#true} is VALID [2018-11-23 10:57:49,772 INFO L273 TraceCheckUtils]: 36: Hoare triple {5264#true} ~ret~0 := #t~nondet72;havoc #t~nondet72; {5264#true} is VALID [2018-11-23 10:57:49,772 INFO L273 TraceCheckUtils]: 37: Hoare triple {5264#true} assume 1bv32 == ~blastFlag~0;~blastFlag~0 := 2bv32; {5264#true} is VALID [2018-11-23 10:57:49,772 INFO L273 TraceCheckUtils]: 38: Hoare triple {5264#true} assume !~bvsle32(~ret~0, 0bv32);call #t~mem73 := read~intINTTYPE4(~s.base, ~bvadd32(92bv32, ~s.offset), 4bv32); {5264#true} is VALID [2018-11-23 10:57:49,773 INFO L273 TraceCheckUtils]: 39: Hoare triple {5264#true} assume 0bv32 != #t~mem73;havoc #t~mem73;call write~intINTTYPE4(4560bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {5264#true} is VALID [2018-11-23 10:57:49,773 INFO L273 TraceCheckUtils]: 40: Hoare triple {5264#true} call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(64bv32, ~s.offset), 4bv32); {5264#true} is VALID [2018-11-23 10:57:49,773 INFO L273 TraceCheckUtils]: 41: Hoare triple {5264#true} call #t~mem127.base, #t~mem127.offset := read~$Pointer$(~s.base, ~bvadd32(84bv32, ~s.offset), 4bv32);call #t~mem128 := read~intINTTYPE4(#t~mem127.base, ~bvadd32(848bv32, #t~mem127.offset), 4bv32); {5264#true} is VALID [2018-11-23 10:57:49,773 INFO L273 TraceCheckUtils]: 42: Hoare triple {5264#true} assume !(0bv32 == #t~mem128);havoc #t~mem127.base, #t~mem127.offset;havoc #t~mem128; {5264#true} is VALID [2018-11-23 10:57:49,774 INFO L273 TraceCheckUtils]: 43: Hoare triple {5264#true} ~skip~0 := 0bv32; {5264#true} is VALID [2018-11-23 10:57:49,774 INFO L273 TraceCheckUtils]: 44: Hoare triple {5264#true} assume !false; {5264#true} is VALID [2018-11-23 10:57:49,774 INFO L273 TraceCheckUtils]: 45: Hoare triple {5264#true} call #t~mem28 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32);~state~0 := #t~mem28;havoc #t~mem28;call #t~mem29 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {5264#true} is VALID [2018-11-23 10:57:49,774 INFO L273 TraceCheckUtils]: 46: Hoare triple {5264#true} assume !(12292bv32 == #t~mem29);havoc #t~mem29;call #t~mem30 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {5264#true} is VALID [2018-11-23 10:57:49,775 INFO L273 TraceCheckUtils]: 47: Hoare triple {5264#true} assume !(16384bv32 == #t~mem30);havoc #t~mem30;call #t~mem31 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {5264#true} is VALID [2018-11-23 10:57:49,775 INFO L273 TraceCheckUtils]: 48: Hoare triple {5264#true} assume !(4096bv32 == #t~mem31);havoc #t~mem31;call #t~mem32 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {5264#true} is VALID [2018-11-23 10:57:49,775 INFO L273 TraceCheckUtils]: 49: Hoare triple {5264#true} assume !(20480bv32 == #t~mem32);havoc #t~mem32;call #t~mem33 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {5264#true} is VALID [2018-11-23 10:57:49,775 INFO L273 TraceCheckUtils]: 50: Hoare triple {5264#true} assume !(4099bv32 == #t~mem33);havoc #t~mem33;call #t~mem34 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {5264#true} is VALID [2018-11-23 10:57:49,776 INFO L273 TraceCheckUtils]: 51: Hoare triple {5264#true} assume !(4368bv32 == #t~mem34);havoc #t~mem34;call #t~mem35 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {5264#true} is VALID [2018-11-23 10:57:49,776 INFO L273 TraceCheckUtils]: 52: Hoare triple {5264#true} assume !(4369bv32 == #t~mem35);havoc #t~mem35;call #t~mem36 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {5264#true} is VALID [2018-11-23 10:57:49,776 INFO L273 TraceCheckUtils]: 53: Hoare triple {5264#true} assume !(4384bv32 == #t~mem36);havoc #t~mem36;call #t~mem37 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {5264#true} is VALID [2018-11-23 10:57:49,776 INFO L273 TraceCheckUtils]: 54: Hoare triple {5264#true} assume !(4385bv32 == #t~mem37);havoc #t~mem37;call #t~mem38 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {5264#true} is VALID [2018-11-23 10:57:49,777 INFO L273 TraceCheckUtils]: 55: Hoare triple {5264#true} assume 4400bv32 == #t~mem38;havoc #t~mem38; {5264#true} is VALID [2018-11-23 10:57:49,777 INFO L273 TraceCheckUtils]: 56: Hoare triple {5264#true} call #t~mem74.base, #t~mem74.offset := read~$Pointer$(~s.base, ~bvadd32(84bv32, ~s.offset), 4bv32);call #t~mem75.base, #t~mem75.offset := read~$Pointer$(#t~mem74.base, ~bvadd32(836bv32, #t~mem74.offset), 4bv32);call #t~mem76 := read~intINTTYPE4(#t~mem75.base, ~bvadd32(12bv32, #t~mem75.offset), 4bv32); {5264#true} is VALID [2018-11-23 10:57:49,777 INFO L273 TraceCheckUtils]: 57: Hoare triple {5264#true} assume !(0bv32 != ~bvand32(256bv32, #t~mem76));havoc #t~mem76;havoc #t~mem75.base, #t~mem75.offset;havoc #t~mem74.base, #t~mem74.offset;~ret~0 := #t~nondet77;havoc #t~nondet77; {5264#true} is VALID [2018-11-23 10:57:49,784 INFO L273 TraceCheckUtils]: 58: Hoare triple {5264#true} assume 2bv32 == ~blastFlag~0;~blastFlag~0 := 3bv32; {5443#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967293 32)) (_ bv0 32))} is VALID [2018-11-23 10:57:49,785 INFO L273 TraceCheckUtils]: 59: Hoare triple {5443#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967293 32)) (_ bv0 32))} assume !~bvsle32(~ret~0, 0bv32); {5443#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967293 32)) (_ bv0 32))} is VALID [2018-11-23 10:57:49,786 INFO L273 TraceCheckUtils]: 60: Hoare triple {5443#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967293 32)) (_ bv0 32))} call write~intINTTYPE4(4416bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32);call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(64bv32, ~s.offset), 4bv32); {5443#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967293 32)) (_ bv0 32))} is VALID [2018-11-23 10:57:49,786 INFO L273 TraceCheckUtils]: 61: Hoare triple {5443#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967293 32)) (_ bv0 32))} call #t~mem127.base, #t~mem127.offset := read~$Pointer$(~s.base, ~bvadd32(84bv32, ~s.offset), 4bv32);call #t~mem128 := read~intINTTYPE4(#t~mem127.base, ~bvadd32(848bv32, #t~mem127.offset), 4bv32); {5443#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967293 32)) (_ bv0 32))} is VALID [2018-11-23 10:57:49,788 INFO L273 TraceCheckUtils]: 62: Hoare triple {5443#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967293 32)) (_ bv0 32))} assume !(0bv32 == #t~mem128);havoc #t~mem127.base, #t~mem127.offset;havoc #t~mem128; {5443#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967293 32)) (_ bv0 32))} is VALID [2018-11-23 10:57:49,790 INFO L273 TraceCheckUtils]: 63: Hoare triple {5443#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967293 32)) (_ bv0 32))} ~skip~0 := 0bv32; {5443#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967293 32)) (_ bv0 32))} is VALID [2018-11-23 10:57:49,790 INFO L273 TraceCheckUtils]: 64: Hoare triple {5443#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967293 32)) (_ bv0 32))} assume !false; {5443#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967293 32)) (_ bv0 32))} is VALID [2018-11-23 10:57:49,793 INFO L273 TraceCheckUtils]: 65: Hoare triple {5443#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967293 32)) (_ bv0 32))} call #t~mem28 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32);~state~0 := #t~mem28;havoc #t~mem28;call #t~mem29 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {5443#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967293 32)) (_ bv0 32))} is VALID [2018-11-23 10:57:49,800 INFO L273 TraceCheckUtils]: 66: Hoare triple {5443#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967293 32)) (_ bv0 32))} assume !(12292bv32 == #t~mem29);havoc #t~mem29;call #t~mem30 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {5443#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967293 32)) (_ bv0 32))} is VALID [2018-11-23 10:57:49,801 INFO L273 TraceCheckUtils]: 67: Hoare triple {5443#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967293 32)) (_ bv0 32))} assume !(16384bv32 == #t~mem30);havoc #t~mem30;call #t~mem31 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {5443#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967293 32)) (_ bv0 32))} is VALID [2018-11-23 10:57:49,802 INFO L273 TraceCheckUtils]: 68: Hoare triple {5443#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967293 32)) (_ bv0 32))} assume !(4096bv32 == #t~mem31);havoc #t~mem31;call #t~mem32 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {5443#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967293 32)) (_ bv0 32))} is VALID [2018-11-23 10:57:49,808 INFO L273 TraceCheckUtils]: 69: Hoare triple {5443#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967293 32)) (_ bv0 32))} assume !(20480bv32 == #t~mem32);havoc #t~mem32;call #t~mem33 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {5443#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967293 32)) (_ bv0 32))} is VALID [2018-11-23 10:57:49,808 INFO L273 TraceCheckUtils]: 70: Hoare triple {5443#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967293 32)) (_ bv0 32))} assume !(4099bv32 == #t~mem33);havoc #t~mem33;call #t~mem34 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {5443#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967293 32)) (_ bv0 32))} is VALID [2018-11-23 10:57:49,810 INFO L273 TraceCheckUtils]: 71: Hoare triple {5443#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967293 32)) (_ bv0 32))} assume !(4368bv32 == #t~mem34);havoc #t~mem34;call #t~mem35 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {5443#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967293 32)) (_ bv0 32))} is VALID [2018-11-23 10:57:49,810 INFO L273 TraceCheckUtils]: 72: Hoare triple {5443#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967293 32)) (_ bv0 32))} assume !(4369bv32 == #t~mem35);havoc #t~mem35;call #t~mem36 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {5443#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967293 32)) (_ bv0 32))} is VALID [2018-11-23 10:57:49,812 INFO L273 TraceCheckUtils]: 73: Hoare triple {5443#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967293 32)) (_ bv0 32))} assume !(4384bv32 == #t~mem36);havoc #t~mem36;call #t~mem37 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {5443#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967293 32)) (_ bv0 32))} is VALID [2018-11-23 10:57:49,812 INFO L273 TraceCheckUtils]: 74: Hoare triple {5443#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967293 32)) (_ bv0 32))} assume !(4385bv32 == #t~mem37);havoc #t~mem37;call #t~mem38 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {5443#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967293 32)) (_ bv0 32))} is VALID [2018-11-23 10:57:49,814 INFO L273 TraceCheckUtils]: 75: Hoare triple {5443#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967293 32)) (_ bv0 32))} assume !(4400bv32 == #t~mem38);havoc #t~mem38;call #t~mem39 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {5443#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967293 32)) (_ bv0 32))} is VALID [2018-11-23 10:57:49,814 INFO L273 TraceCheckUtils]: 76: Hoare triple {5443#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967293 32)) (_ bv0 32))} assume !(4401bv32 == #t~mem39);havoc #t~mem39;call #t~mem40 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {5443#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967293 32)) (_ bv0 32))} is VALID [2018-11-23 10:57:49,817 INFO L273 TraceCheckUtils]: 77: Hoare triple {5443#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967293 32)) (_ bv0 32))} assume !(4416bv32 == #t~mem40);havoc #t~mem40;call #t~mem41 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {5443#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967293 32)) (_ bv0 32))} is VALID [2018-11-23 10:57:49,817 INFO L273 TraceCheckUtils]: 78: Hoare triple {5443#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967293 32)) (_ bv0 32))} assume !(4417bv32 == #t~mem41);havoc #t~mem41;call #t~mem42 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {5443#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967293 32)) (_ bv0 32))} is VALID [2018-11-23 10:57:49,819 INFO L273 TraceCheckUtils]: 79: Hoare triple {5443#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967293 32)) (_ bv0 32))} assume 4432bv32 == #t~mem42;havoc #t~mem42; {5443#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967293 32)) (_ bv0 32))} is VALID [2018-11-23 10:57:49,819 INFO L273 TraceCheckUtils]: 80: Hoare triple {5443#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967293 32)) (_ bv0 32))} ~ret~0 := #t~nondet79;havoc #t~nondet79; {5443#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967293 32)) (_ bv0 32))} is VALID [2018-11-23 10:57:49,821 INFO L273 TraceCheckUtils]: 81: Hoare triple {5443#(= (bvadd ssl3_connect_~blastFlag~0 (_ bv4294967293 32)) (_ bv0 32))} assume 4bv32 == ~blastFlag~0; {5265#false} is VALID [2018-11-23 10:57:49,821 INFO L273 TraceCheckUtils]: 82: Hoare triple {5265#false} assume !false; {5265#false} is VALID [2018-11-23 10:57:49,825 INFO L134 CoverageAnalysis]: Checked inductivity of 65 backedges. 36 proven. 0 refuted. 0 times theorem prover too weak. 29 trivial. 0 not checked. [2018-11-23 10:57:49,826 INFO L312 TraceCheckSpWp]: Omiting computation of backward sequence because forward sequence was already perfect [2018-11-23 10:57:49,827 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 10:57:49,827 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [3] imperfect sequences [] total 3 [2018-11-23 10:57:49,828 INFO L78 Accepts]: Start accepts. Automaton has 3 states. Word has length 83 [2018-11-23 10:57:49,828 INFO L84 Accepts]: Finished accepts. word is accepted. [2018-11-23 10:57:49,829 INFO L86 InductivityCheck]: Starting indutivity check of a Floyd-Hoare automaton with 3 states. [2018-11-23 10:57:49,951 INFO L119 InductivityCheck]: Floyd-Hoare automaton has 64 edges. 64 inductive. 0 not inductive. 0 times theorem prover too weak to decide inductivity. [2018-11-23 10:57:49,951 INFO L459 AbstractCegarLoop]: Interpolant automaton has 3 states [2018-11-23 10:57:49,952 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 3 interpolants. [2018-11-23 10:57:49,952 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=3, Invalid=3, Unknown=0, NotChecked=0, Total=6 [2018-11-23 10:57:49,952 INFO L87 Difference]: Start difference. First operand 420 states and 619 transitions. Second operand 3 states. [2018-11-23 10:57:56,727 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 10:57:56,727 INFO L93 Difference]: Finished difference Result 827 states and 1228 transitions. [2018-11-23 10:57:56,728 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 3 states. [2018-11-23 10:57:56,728 INFO L78 Accepts]: Start accepts. Automaton has 3 states. Word has length 83 [2018-11-23 10:57:56,728 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 10:57:56,729 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 3 states. [2018-11-23 10:57:56,733 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 3 states to 3 states and 488 transitions. [2018-11-23 10:57:56,733 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 3 states. [2018-11-23 10:57:56,737 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 3 states to 3 states and 488 transitions. [2018-11-23 10:57:56,737 INFO L86 InductivityCheck]: Starting indutivity check of a Floyd-Hoare automaton with 3 states and 488 transitions. [2018-11-23 10:57:58,119 INFO L119 InductivityCheck]: Floyd-Hoare automaton has 488 edges. 488 inductive. 0 not inductive. 0 times theorem prover too weak to decide inductivity. [2018-11-23 10:57:58,141 INFO L225 Difference]: With dead ends: 827 [2018-11-23 10:57:58,141 INFO L226 Difference]: Without dead ends: 521 [2018-11-23 10:57:58,143 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 82 GetRequests, 81 SyntacticMatches, 0 SemanticMatches, 1 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=3, Invalid=3, Unknown=0, NotChecked=0, Total=6 [2018-11-23 10:57:58,144 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 521 states. [2018-11-23 10:57:58,607 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 521 to 521. [2018-11-23 10:57:58,607 INFO L214 AbstractMinimizeNwa]: Start testing correctness of minimizeSevpa [2018-11-23 10:57:58,607 INFO L82 GeneralOperation]: Start isEquivalent. First operand 521 states. Second operand 521 states. [2018-11-23 10:57:58,607 INFO L74 IsIncluded]: Start isIncluded. First operand 521 states. Second operand 521 states. [2018-11-23 10:57:58,607 INFO L87 Difference]: Start difference. First operand 521 states. Second operand 521 states. [2018-11-23 10:57:58,628 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 10:57:58,628 INFO L93 Difference]: Finished difference Result 521 states and 768 transitions. [2018-11-23 10:57:58,629 INFO L276 IsEmpty]: Start isEmpty. Operand 521 states and 768 transitions. [2018-11-23 10:57:58,630 INFO L282 IsEmpty]: Finished isEmpty. No accepting run. [2018-11-23 10:57:58,630 INFO L83 IsIncluded]: Finished isIncluded. Language is included [2018-11-23 10:57:58,630 INFO L74 IsIncluded]: Start isIncluded. First operand 521 states. Second operand 521 states. [2018-11-23 10:57:58,631 INFO L87 Difference]: Start difference. First operand 521 states. Second operand 521 states. [2018-11-23 10:57:58,654 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 10:57:58,654 INFO L93 Difference]: Finished difference Result 521 states and 768 transitions. [2018-11-23 10:57:58,654 INFO L276 IsEmpty]: Start isEmpty. Operand 521 states and 768 transitions. [2018-11-23 10:57:58,656 INFO L282 IsEmpty]: Finished isEmpty. No accepting run. [2018-11-23 10:57:58,656 INFO L83 IsIncluded]: Finished isIncluded. Language is included [2018-11-23 10:57:58,656 INFO L88 GeneralOperation]: Finished isEquivalent. [2018-11-23 10:57:58,656 INFO L221 AbstractMinimizeNwa]: Finished testing correctness of minimizeSevpa [2018-11-23 10:57:58,656 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 521 states. [2018-11-23 10:57:58,678 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 521 states to 521 states and 768 transitions. [2018-11-23 10:57:58,678 INFO L78 Accepts]: Start accepts. Automaton has 521 states and 768 transitions. Word has length 83 [2018-11-23 10:57:58,679 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 10:57:58,679 INFO L480 AbstractCegarLoop]: Abstraction has 521 states and 768 transitions. [2018-11-23 10:57:58,679 INFO L481 AbstractCegarLoop]: Interpolant automaton has 3 states. [2018-11-23 10:57:58,679 INFO L276 IsEmpty]: Start isEmpty. Operand 521 states and 768 transitions. [2018-11-23 10:57:58,682 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 105 [2018-11-23 10:57:58,683 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 10:57:58,683 INFO L402 BasicCegarLoop]: trace histogram [5, 5, 5, 5, 5, 5, 5, 4, 4, 4, 4, 4, 3, 3, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 10:57:58,683 INFO L423 AbstractCegarLoop]: === Iteration 5 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 10:57:58,683 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 10:57:58,683 INFO L82 PathProgramCache]: Analyzing trace with hash 510391332, now seen corresponding path program 1 times [2018-11-23 10:57:58,684 INFO L223 ckRefinementStrategy]: Switched to mode CVC4_FPBP [2018-11-23 10:57:58,685 INFO L69 tionRefinementEngine]: Using refinement strategy WolfRefinementStrategy No working directory specified, using /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/cvc4nyu Starting monitored process 6 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk (exit command is (exit), workingDir is null) Waiting until toolchain timeout for monitored process 6 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk [2018-11-23 10:57:58,714 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 10:57:59,284 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 10:57:59,486 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 10:57:59,490 INFO L273 TraceCheckSpWp]: Computing forward predicates... [2018-11-23 10:57:59,759 WARN L180 SmtUtils]: Spent 175.00 ms on a formula simplification that was a NOOP. DAG size: 31 [2018-11-23 10:57:59,796 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 2, 1 stores, 1 select indices, 1 select index equivalence classes, 0 disjoint index pairs (out of 0 index pairs), introduced 2 new quantified variables, introduced 0 case distinctions, treesize of input 40 treesize of output 38 [2018-11-23 10:57:59,833 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 1, 1 stores, 0 select indices, 0 select index equivalence classes, 0 disjoint index pairs (out of 0 index pairs), introduced 1 new quantified variables, introduced 0 case distinctions, treesize of input 35 treesize of output 32 [2018-11-23 10:57:59,930 INFO L701 Elim1Store]: detected not equals via solver [2018-11-23 10:57:59,953 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 1, 1 stores, 1 select indices, 1 select index equivalence classes, 1 disjoint index pairs (out of 0 index pairs), introduced 0 new quantified variables, introduced 0 case distinctions, treesize of input 32 treesize of output 38 [2018-11-23 10:57:59,979 INFO L267 ElimStorePlain]: Start of recursive call 4: End of recursive call: and 1 xjuncts. [2018-11-23 10:58:00,060 INFO L267 ElimStorePlain]: Start of recursive call 3: 1 dim-1 vars, End of recursive call: and 1 xjuncts. [2018-11-23 10:58:00,102 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 2, 1 stores, 1 select indices, 1 select index equivalence classes, 0 disjoint index pairs (out of 0 index pairs), introduced 1 new quantified variables, introduced 0 case distinctions, treesize of input 30 treesize of output 26 [2018-11-23 10:58:00,114 INFO L701 Elim1Store]: detected not equals via solver [2018-11-23 10:58:00,130 INFO L701 Elim1Store]: detected not equals via solver [2018-11-23 10:58:00,179 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 1, 1 stores, 2 select indices, 2 select index equivalence classes, 2 disjoint index pairs (out of 1 index pairs), introduced 0 new quantified variables, introduced 4 case distinctions, treesize of input 23 treesize of output 46 [2018-11-23 10:58:00,186 INFO L267 ElimStorePlain]: Start of recursive call 6: End of recursive call: and 4 xjuncts. [2018-11-23 10:58:00,274 INFO L267 ElimStorePlain]: Start of recursive call 5: 1 dim-1 vars, End of recursive call: and 3 xjuncts. [2018-11-23 10:58:00,351 INFO L267 ElimStorePlain]: Start of recursive call 2: 1 dim-1 vars, 1 dim-2 vars, End of recursive call: and 3 xjuncts. [2018-11-23 10:58:00,389 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 2, 1 stores, 2 select indices, 2 select index equivalence classes, 1 disjoint index pairs (out of 1 index pairs), introduced 2 new quantified variables, introduced 0 case distinctions, treesize of input 31 treesize of output 31 [2018-11-23 10:58:00,400 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 1, 1 stores, 0 select indices, 0 select index equivalence classes, 0 disjoint index pairs (out of 0 index pairs), introduced 1 new quantified variables, introduced 0 case distinctions, treesize of input 15 treesize of output 18 [2018-11-23 10:58:00,434 INFO L701 Elim1Store]: detected not equals via solver [2018-11-23 10:58:00,439 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 1, 1 stores, 1 select indices, 1 select index equivalence classes, 1 disjoint index pairs (out of 0 index pairs), introduced 0 new quantified variables, introduced 0 case distinctions, treesize of input 18 treesize of output 27 [2018-11-23 10:58:00,442 INFO L267 ElimStorePlain]: Start of recursive call 9: End of recursive call: and 1 xjuncts. [2018-11-23 10:58:00,457 INFO L267 ElimStorePlain]: Start of recursive call 8: 1 dim-1 vars, End of recursive call: and 1 xjuncts. [2018-11-23 10:58:00,501 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 2, 1 stores, 2 select indices, 2 select index equivalence classes, 1 disjoint index pairs (out of 1 index pairs), introduced 1 new quantified variables, introduced 0 case distinctions, treesize of input 30 treesize of output 31 [2018-11-23 10:58:00,508 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 1, 1 stores, 0 select indices, 0 select index equivalence classes, 0 disjoint index pairs (out of 0 index pairs), introduced 0 new quantified variables, introduced 0 case distinctions, treesize of input 8 treesize of output 7 [2018-11-23 10:58:00,518 INFO L267 ElimStorePlain]: Start of recursive call 11: End of recursive call: and 1 xjuncts. [2018-11-23 10:58:00,535 INFO L267 ElimStorePlain]: Start of recursive call 10: 1 dim-1 vars, End of recursive call: and 1 xjuncts. [2018-11-23 10:58:00,554 INFO L267 ElimStorePlain]: Start of recursive call 7: 1 dim-1 vars, 1 dim-2 vars, End of recursive call: and 1 xjuncts. [2018-11-23 10:58:00,650 INFO L267 ElimStorePlain]: Start of recursive call 1: 3 dim-0 vars, 1 dim-2 vars, End of recursive call: 3 dim-0 vars, and 4 xjuncts. [2018-11-23 10:58:00,651 INFO L202 ElimStorePlain]: Needed 11 recursive calls to eliminate 4 variables, input treesize:45, output treesize:76 [2018-11-23 10:58:00,705 WARN L383 uantifierElimination]: Trying to double check SDD result, but SMT solver's response was UNKNOWN. [2018-11-23 10:58:00,706 WARN L384 uantifierElimination]: Input elimination task: ∃ [|v_#memory_int_167|, |v_ssl3_connect_#t~nondet19_3|, ssl3_connect_~tmp___0~1.base, ssl3_connect_~tmp___0~1.offset]. (and (= (_ bv0 32) ssl3_connect_~s.offset) (= (let ((.cse0 (store |v_#memory_int_167| ssl3_connect_~s.base (store (store (select |v_#memory_int_167| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv92 32)) |v_ssl3_connect_#t~nondet19_3|) (bvadd ssl3_connect_~s.offset (_ bv52 32)) (_ bv12292 32))))) (store .cse0 ssl3_connect_~tmp___0~1.base (store (select .cse0 ssl3_connect_~tmp___0~1.base) ssl3_connect_~tmp___0~1.offset (_ bv0 32)))) |#memory_int|)) [2018-11-23 10:58:00,706 WARN L385 uantifierElimination]: ElimStorePlain result: ∃ [ssl3_connect_~tmp___0~1.base, ssl3_connect_~tmp___0~1.offset, v_prenex_1]. (let ((.cse2 (select |#memory_int| ssl3_connect_~s.base))) (let ((.cse3 (select .cse2 (bvadd ssl3_connect_~s.offset (_ bv52 32))))) (let ((.cse0 (= .cse3 (_ bv12292 32))) (.cse1 (= (_ bv0 32) ssl3_connect_~s.offset))) (or (and .cse0 .cse1 (= (select (select |#memory_int| ssl3_connect_~tmp___0~1.base) ssl3_connect_~tmp___0~1.offset) (_ bv0 32))) (and (= (_ bv0 32) (select .cse2 (bvadd ssl3_connect_~s.offset (_ bv92 32)))) .cse0 .cse1) (and .cse1 (= .cse3 (_ bv0 32))) (and .cse0 (= (_ bv0 32) (select .cse2 v_prenex_1)) .cse1))))) [2018-11-23 10:58:00,976 WARN L180 SmtUtils]: Spent 158.00 ms on a formula simplification. DAG size of input: 32 DAG size of output: 22 [2018-11-23 10:58:01,045 INFO L701 Elim1Store]: detected not equals via solver [2018-11-23 10:58:01,102 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 2, 1 stores, 2 select indices, 2 select index equivalence classes, 1 disjoint index pairs (out of 1 index pairs), introduced 2 new quantified variables, introduced 3 case distinctions, treesize of input 43 treesize of output 65 [2018-11-23 10:58:01,154 INFO L701 Elim1Store]: detected not equals via solver [2018-11-23 10:58:01,158 INFO L701 Elim1Store]: detected not equals via solver [2018-11-23 10:58:01,174 INFO L701 Elim1Store]: detected not equals via solver [2018-11-23 10:58:01,220 INFO L701 Elim1Store]: detected not equals via solver [2018-11-23 10:58:01,266 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 1, 1 stores, 3 select indices, 3 select index equivalence classes, 4 disjoint index pairs (out of 3 index pairs), introduced 1 new quantified variables, introduced 3 case distinctions, treesize of input 51 treesize of output 82 [2018-11-23 10:58:01,285 INFO L267 ElimStorePlain]: Start of recursive call 3: End of recursive call: and 3 xjuncts. [2018-11-23 10:58:01,594 INFO L701 Elim1Store]: detected not equals via solver [2018-11-23 10:58:01,605 INFO L701 Elim1Store]: detected not equals via solver [2018-11-23 10:58:01,607 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 1, 1 stores, 2 select indices, 2 select index equivalence classes, 2 disjoint index pairs (out of 1 index pairs), introduced 1 new quantified variables, introduced 0 case distinctions, treesize of input 40 treesize of output 51 [2018-11-23 10:58:01,612 INFO L267 ElimStorePlain]: Start of recursive call 4: End of recursive call: and 1 xjuncts. [2018-11-23 10:58:01,729 INFO L267 ElimStorePlain]: Start of recursive call 2: 2 dim-1 vars, End of recursive call: and 3 xjuncts. [2018-11-23 10:58:01,913 INFO L701 Elim1Store]: detected not equals via solver [2018-11-23 10:58:01,915 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 2, 1 stores, 1 select indices, 1 select index equivalence classes, 1 disjoint index pairs (out of 0 index pairs), introduced 1 new quantified variables, introduced 0 case distinctions, treesize of input 34 treesize of output 41 [2018-11-23 10:58:01,925 INFO L701 Elim1Store]: detected not equals via solver [2018-11-23 10:58:01,933 INFO L701 Elim1Store]: detected not equals via solver [2018-11-23 10:58:01,935 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 1, 1 stores, 2 select indices, 2 select index equivalence classes, 2 disjoint index pairs (out of 1 index pairs), introduced 1 new quantified variables, introduced 0 case distinctions, treesize of input 38 treesize of output 35 [2018-11-23 10:58:01,942 INFO L267 ElimStorePlain]: Start of recursive call 6: End of recursive call: and 1 xjuncts. [2018-11-23 10:58:01,952 INFO L267 ElimStorePlain]: Start of recursive call 5: 1 dim-1 vars, End of recursive call: and 1 xjuncts. [2018-11-23 10:58:02,072 INFO L267 ElimStorePlain]: Start of recursive call 1: 2 dim-0 vars, 2 dim-2 vars, End of recursive call: 3 dim-0 vars, and 4 xjuncts. [2018-11-23 10:58:02,073 INFO L202 ElimStorePlain]: Needed 6 recursive calls to eliminate 4 variables, input treesize:78, output treesize:92 [2018-11-23 10:58:04,112 WARN L383 uantifierElimination]: Trying to double check SDD result, but SMT solver's response was UNKNOWN. [2018-11-23 10:58:04,113 WARN L384 uantifierElimination]: Input elimination task: ∃ [v_prenex_2, ssl3_connect_~tmp___0~1.base, ssl3_connect_~tmp___0~1.offset, |v_#memory_int_168|]. (let ((.cse1 (bvadd ssl3_connect_~s.offset (_ bv52 32))) (.cse3 (bvadd ssl3_connect_~s.offset (_ bv28 32))) (.cse2 (= (_ bv0 32) ssl3_connect_~s.offset))) (or (let ((.cse0 (select v_prenex_2 ssl3_connect_~s.base))) (and (= (bvadd (select .cse0 .cse1) (_ bv4294955004 32)) (_ bv0 32)) (= (_ bv0 32) (select (select v_prenex_2 ssl3_connect_~tmp___0~1.base) ssl3_connect_~tmp___0~1.offset)) .cse2 (= (store v_prenex_2 ssl3_connect_~s.base (store .cse0 .cse3 (bvadd (select .cse0 .cse3) (_ bv1 32)))) |#memory_int|))) (let ((.cse4 (select |v_#memory_int_168| ssl3_connect_~s.base))) (and (= (_ bv0 32) (select .cse4 .cse1)) (= (store |v_#memory_int_168| ssl3_connect_~s.base (store .cse4 .cse3 (bvadd (select .cse4 .cse3) (_ bv1 32)))) |#memory_int|) .cse2)))) [2018-11-23 10:58:04,113 WARN L385 uantifierElimination]: ElimStorePlain result: ∃ [ssl3_connect_~tmp___0~1.base, ssl3_connect_~tmp___0~1.offset, v_prenex_4]. (let ((.cse2 (select |#memory_int| ssl3_connect_~s.base))) (let ((.cse4 (select .cse2 (bvadd ssl3_connect_~s.offset (_ bv52 32))))) (let ((.cse3 (bvadd ssl3_connect_~s.offset (_ bv28 32))) (.cse0 (= (_ bv0 32) ssl3_connect_~s.offset)) (.cse1 (= (_ bv0 32) (bvadd .cse4 (_ bv4294955004 32))))) (or (and .cse0 .cse1 (= (_ bv1 32) (select .cse2 .cse3))) (and .cse0 (= .cse4 (_ bv0 32))) (and (not (= v_prenex_4 .cse3)) (= (_ bv0 32) (select .cse2 v_prenex_4)) .cse0 .cse1) (and (not (= ssl3_connect_~tmp___0~1.base ssl3_connect_~s.base)) .cse0 .cse1 (= (select (select |#memory_int| ssl3_connect_~tmp___0~1.base) ssl3_connect_~tmp___0~1.offset) (_ bv0 32))))))) [2018-11-23 10:58:04,659 WARN L180 SmtUtils]: Spent 151.00 ms on a formula simplification that was a NOOP. DAG size: 42 [2018-11-23 10:58:04,799 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 2, 0 stores, 1 select indices, 1 select index equivalence classes, 0 disjoint index pairs (out of 0 index pairs), introduced 1 new quantified variables, introduced 0 case distinctions, treesize of input 15 treesize of output 11 [2018-11-23 10:58:04,802 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 1, 0 stores, 1 select indices, 1 select index equivalence classes, 0 disjoint index pairs (out of 0 index pairs), introduced 0 new quantified variables, introduced 0 case distinctions, treesize of input 11 treesize of output 3 [2018-11-23 10:58:04,803 INFO L267 ElimStorePlain]: Start of recursive call 3: End of recursive call: and 1 xjuncts. [2018-11-23 10:58:04,805 INFO L267 ElimStorePlain]: Start of recursive call 2: 1 dim-1 vars, End of recursive call: and 1 xjuncts. [2018-11-23 10:58:04,807 INFO L267 ElimStorePlain]: Start of recursive call 1: 1 dim-0 vars, 1 dim-2 vars, End of recursive call: and 1 xjuncts. [2018-11-23 10:58:04,808 INFO L202 ElimStorePlain]: Needed 3 recursive calls to eliminate 2 variables, input treesize:15, output treesize:3 [2018-11-23 10:58:04,811 WARN L383 uantifierElimination]: Trying to double check SDD result, but SMT solver's response was UNKNOWN. [2018-11-23 10:58:04,811 WARN L384 uantifierElimination]: Input elimination task: ∃ [|#memory_int|, ssl3_connect_~s.base]. (let ((.cse0 (select (select |#memory_int| ssl3_connect_~s.base) (_ bv52 32)))) (and (= |ssl3_connect_#t~mem34| .cse0) (= (_ bv0 32) .cse0))) [2018-11-23 10:58:04,811 WARN L385 uantifierElimination]: ElimStorePlain result: ∃ []. (= |ssl3_connect_#t~mem34| (_ bv0 32)) [2018-11-23 10:58:04,902 INFO L256 TraceCheckUtils]: 0: Hoare triple {8128#true} call ULTIMATE.init(); {8128#true} is VALID [2018-11-23 10:58:04,902 INFO L273 TraceCheckUtils]: 1: Hoare triple {8128#true} #NULL.base, #NULL.offset := 0bv32, 0bv32;#valid := #valid[0bv32 := 0bv1];~init~0 := 1bv32;call ~#SSLv3_client_data~0.base, ~#SSLv3_client_data~0.offset := #Ultimate.alloc(100bv32);call write~init~intINTTYPE4(0bv32, ~#SSLv3_client_data~0.base, ~#SSLv3_client_data~0.offset, 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(4bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(8bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(12bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(16bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(20bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(24bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(28bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(32bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(36bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(40bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(44bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(48bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(52bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(56bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(60bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(64bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(68bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(72bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(76bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(80bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(84bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(88bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(92bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(96bv32, ~#SSLv3_client_data~0.offset), 4bv32); {8128#true} is VALID [2018-11-23 10:58:04,902 INFO L273 TraceCheckUtils]: 2: Hoare triple {8128#true} assume true; {8128#true} is VALID [2018-11-23 10:58:04,902 INFO L268 TraceCheckUtils]: 3: Hoare quadruple {8128#true} {8128#true} #544#return; {8128#true} is VALID [2018-11-23 10:58:04,903 INFO L256 TraceCheckUtils]: 4: Hoare triple {8128#true} call #t~ret138 := main(); {8128#true} is VALID [2018-11-23 10:58:04,904 INFO L273 TraceCheckUtils]: 5: Hoare triple {8128#true} call #t~malloc3.base, #t~malloc3.offset := #Ultimate.alloc(248bv32);~s~0.base, ~s~0.offset := #t~malloc3.base, #t~malloc3.offset;call #t~malloc4.base, #t~malloc4.offset := #Ultimate.alloc(899bv32);call write~$Pointer$(#t~malloc4.base, #t~malloc4.offset, ~s~0.base, ~bvadd32(84bv32, ~s~0.offset), 4bv32);call #t~malloc5.base, #t~malloc5.offset := #Ultimate.alloc(232bv32);call write~$Pointer$(#t~malloc5.base, #t~malloc5.offset, ~s~0.base, ~bvadd32(204bv32, ~s~0.offset), 4bv32);call #t~malloc6.base, #t~malloc6.offset := #Ultimate.alloc(200bv32);call write~$Pointer$(#t~malloc6.base, #t~malloc6.offset, ~s~0.base, ~bvadd32(176bv32, ~s~0.offset), 4bv32);call write~intINTTYPE4(12292bv32, ~s~0.base, ~bvadd32(52bv32, ~s~0.offset), 4bv32);call write~intINTTYPE4(#t~nondet7, ~s~0.base, ~s~0.offset, 4bv32);havoc #t~nondet7; {8148#(= main_~s~0.offset (_ bv0 32))} is VALID [2018-11-23 10:58:04,905 INFO L256 TraceCheckUtils]: 6: Hoare triple {8148#(= main_~s~0.offset (_ bv0 32))} call #t~ret8 := ssl3_connect(~s~0.base, ~s~0.offset); {8152#(= |ssl3_connect_#in~s.offset| (_ bv0 32))} is VALID [2018-11-23 10:58:04,914 INFO L273 TraceCheckUtils]: 7: Hoare triple {8152#(= |ssl3_connect_#in~s.offset| (_ bv0 32))} ~s.base, ~s.offset := #in~s.base, #in~s.offset;havoc ~buf~0.base, ~buf~0.offset;havoc ~tmp~2;havoc ~l~0;havoc ~num1~0;havoc ~cb~0.base, ~cb~0.offset;havoc ~ret~0;havoc ~new_state~0;havoc ~state~0;havoc ~skip~0;~tmp___0~1.base, ~tmp___0~1.offset := #t~nondet9.base, #t~nondet9.offset;havoc #t~nondet9.base, #t~nondet9.offset;~tmp___1~0 := #t~nondet10;havoc #t~nondet10;~tmp___2~0 := #t~nondet11;havoc #t~nondet11;~tmp___3~0 := #t~nondet12;havoc #t~nondet12;~tmp___4~0 := #t~nondet13;havoc #t~nondet13;~tmp___5~0 := #t~nondet14;havoc #t~nondet14;~tmp___6~0 := #t~nondet15;havoc #t~nondet15;~tmp___7~0 := #t~nondet16;havoc #t~nondet16;~tmp___8~0 := #t~nondet17;havoc #t~nondet17;~tmp___9~0 := #t~nondet18;havoc #t~nondet18;havoc ~blastFlag~0;~blastFlag~0 := 0bv32;call write~intINTTYPE4(#t~nondet19, ~s.base, ~bvadd32(92bv32, ~s.offset), 4bv32);havoc #t~nondet19;call write~intINTTYPE4(12292bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32);~tmp~2 := #t~nondet20;havoc #t~nondet20;~cb~0.base, ~cb~0.offset := 0bv32, 0bv32;~ret~0 := 4294967295bv32;~skip~0 := 0bv32;call write~intINTTYPE4(0bv32, ~tmp___0~1.base, ~tmp___0~1.offset, 4bv32);call #t~mem21.base, #t~mem21.offset := read~$Pointer$(~s.base, ~bvadd32(192bv32, ~s.offset), 4bv32); {8156#(or (and (= (bvadd (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32))) (_ bv4294955004 32)) (_ bv0 32)) (= (_ bv0 32) ssl3_connect_~s.offset) (exists ((ssl3_connect_~tmp___0~1.offset (_ BitVec 32)) (ssl3_connect_~tmp___0~1.base (_ BitVec 32))) (= (select (select |#memory_int| ssl3_connect_~tmp___0~1.base) ssl3_connect_~tmp___0~1.offset) (_ bv0 32)))) (and (= (_ bv0 32) ssl3_connect_~s.offset) (= (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32))) (_ bv0 32))))} is VALID [2018-11-23 10:58:04,915 INFO L273 TraceCheckUtils]: 8: Hoare triple {8156#(or (and (= (bvadd (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32))) (_ bv4294955004 32)) (_ bv0 32)) (= (_ bv0 32) ssl3_connect_~s.offset) (exists ((ssl3_connect_~tmp___0~1.offset (_ BitVec 32)) (ssl3_connect_~tmp___0~1.base (_ BitVec 32))) (= (select (select |#memory_int| ssl3_connect_~tmp___0~1.base) ssl3_connect_~tmp___0~1.offset) (_ bv0 32)))) (and (= (_ bv0 32) ssl3_connect_~s.offset) (= (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32))) (_ bv0 32))))} assume 0bv32 != ~bvadd32(#t~mem21.base, #t~mem21.offset);havoc #t~mem21.base, #t~mem21.offset;call #t~mem22.base, #t~mem22.offset := read~$Pointer$(~s.base, ~bvadd32(192bv32, ~s.offset), 4bv32);~cb~0.base, ~cb~0.offset := #t~mem22.base, #t~mem22.offset;havoc #t~mem22.base, #t~mem22.offset; {8156#(or (and (= (bvadd (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32))) (_ bv4294955004 32)) (_ bv0 32)) (= (_ bv0 32) ssl3_connect_~s.offset) (exists ((ssl3_connect_~tmp___0~1.offset (_ BitVec 32)) (ssl3_connect_~tmp___0~1.base (_ BitVec 32))) (= (select (select |#memory_int| ssl3_connect_~tmp___0~1.base) ssl3_connect_~tmp___0~1.offset) (_ bv0 32)))) (and (= (_ bv0 32) ssl3_connect_~s.offset) (= (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32))) (_ bv0 32))))} is VALID [2018-11-23 10:58:04,946 INFO L273 TraceCheckUtils]: 9: Hoare triple {8156#(or (and (= (bvadd (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32))) (_ bv4294955004 32)) (_ bv0 32)) (= (_ bv0 32) ssl3_connect_~s.offset) (exists ((ssl3_connect_~tmp___0~1.offset (_ BitVec 32)) (ssl3_connect_~tmp___0~1.base (_ BitVec 32))) (= (select (select |#memory_int| ssl3_connect_~tmp___0~1.base) ssl3_connect_~tmp___0~1.offset) (_ bv0 32)))) (and (= (_ bv0 32) ssl3_connect_~s.offset) (= (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32))) (_ bv0 32))))} call #t~mem27 := read~intINTTYPE4(~s.base, ~bvadd32(28bv32, ~s.offset), 4bv32);call write~intINTTYPE4(~bvadd32(1bv32, #t~mem27), ~s.base, ~bvadd32(28bv32, ~s.offset), 4bv32);havoc #t~mem27; {8163#(or (and (exists ((v_prenex_4 (_ BitVec 32))) (and (= (_ bv0 32) (select (select |#memory_int| ssl3_connect_~s.base) v_prenex_4)) (not (= (bvadd v_prenex_4 (_ bv4294967268 32)) ssl3_connect_~s.offset)))) (= (_ bv0 32) ssl3_connect_~s.offset) (= (_ bv12292 32) (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32))))) (and (= (_ bv0 32) ssl3_connect_~s.offset) (= (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32))) (_ bv0 32))) (and (= (_ bv0 32) ssl3_connect_~s.offset) (= (_ bv12292 32) (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32)))) (= (_ bv1 32) (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv28 32))))) (and (exists ((ssl3_connect_~tmp___0~1.offset (_ BitVec 32)) (ssl3_connect_~tmp___0~1.base (_ BitVec 32))) (and (not (= ssl3_connect_~tmp___0~1.base ssl3_connect_~s.base)) (= (select (select |#memory_int| ssl3_connect_~tmp___0~1.base) ssl3_connect_~tmp___0~1.offset) (_ bv0 32)))) (= (_ bv0 32) ssl3_connect_~s.offset) (= (_ bv12292 32) (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32))))))} is VALID [2018-11-23 10:58:04,948 INFO L273 TraceCheckUtils]: 10: Hoare triple {8163#(or (and (exists ((v_prenex_4 (_ BitVec 32))) (and (= (_ bv0 32) (select (select |#memory_int| ssl3_connect_~s.base) v_prenex_4)) (not (= (bvadd v_prenex_4 (_ bv4294967268 32)) ssl3_connect_~s.offset)))) (= (_ bv0 32) ssl3_connect_~s.offset) (= (_ bv12292 32) (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32))))) (and (= (_ bv0 32) ssl3_connect_~s.offset) (= (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32))) (_ bv0 32))) (and (= (_ bv0 32) ssl3_connect_~s.offset) (= (_ bv12292 32) (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32)))) (= (_ bv1 32) (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv28 32))))) (and (exists ((ssl3_connect_~tmp___0~1.offset (_ BitVec 32)) (ssl3_connect_~tmp___0~1.base (_ BitVec 32))) (and (not (= ssl3_connect_~tmp___0~1.base ssl3_connect_~s.base)) (= (select (select |#memory_int| ssl3_connect_~tmp___0~1.base) ssl3_connect_~tmp___0~1.offset) (_ bv0 32)))) (= (_ bv0 32) ssl3_connect_~s.offset) (= (_ bv12292 32) (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32))))))} assume !(0bv32 != ~bvand32(12288bv32, ~tmp___1~0)); {8163#(or (and (exists ((v_prenex_4 (_ BitVec 32))) (and (= (_ bv0 32) (select (select |#memory_int| ssl3_connect_~s.base) v_prenex_4)) (not (= (bvadd v_prenex_4 (_ bv4294967268 32)) ssl3_connect_~s.offset)))) (= (_ bv0 32) ssl3_connect_~s.offset) (= (_ bv12292 32) (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32))))) (and (= (_ bv0 32) ssl3_connect_~s.offset) (= (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32))) (_ bv0 32))) (and (= (_ bv0 32) ssl3_connect_~s.offset) (= (_ bv12292 32) (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32)))) (= (_ bv1 32) (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv28 32))))) (and (exists ((ssl3_connect_~tmp___0~1.offset (_ BitVec 32)) (ssl3_connect_~tmp___0~1.base (_ BitVec 32))) (and (not (= ssl3_connect_~tmp___0~1.base ssl3_connect_~s.base)) (= (select (select |#memory_int| ssl3_connect_~tmp___0~1.base) ssl3_connect_~tmp___0~1.offset) (_ bv0 32)))) (= (_ bv0 32) ssl3_connect_~s.offset) (= (_ bv12292 32) (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32))))))} is VALID [2018-11-23 10:58:04,949 INFO L273 TraceCheckUtils]: 11: Hoare triple {8163#(or (and (exists ((v_prenex_4 (_ BitVec 32))) (and (= (_ bv0 32) (select (select |#memory_int| ssl3_connect_~s.base) v_prenex_4)) (not (= (bvadd v_prenex_4 (_ bv4294967268 32)) ssl3_connect_~s.offset)))) (= (_ bv0 32) ssl3_connect_~s.offset) (= (_ bv12292 32) (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32))))) (and (= (_ bv0 32) ssl3_connect_~s.offset) (= (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32))) (_ bv0 32))) (and (= (_ bv0 32) ssl3_connect_~s.offset) (= (_ bv12292 32) (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32)))) (= (_ bv1 32) (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv28 32))))) (and (exists ((ssl3_connect_~tmp___0~1.offset (_ BitVec 32)) (ssl3_connect_~tmp___0~1.base (_ BitVec 32))) (and (not (= ssl3_connect_~tmp___0~1.base ssl3_connect_~s.base)) (= (select (select |#memory_int| ssl3_connect_~tmp___0~1.base) ssl3_connect_~tmp___0~1.offset) (_ bv0 32)))) (= (_ bv0 32) ssl3_connect_~s.offset) (= (_ bv12292 32) (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32))))))} assume !false; {8163#(or (and (exists ((v_prenex_4 (_ BitVec 32))) (and (= (_ bv0 32) (select (select |#memory_int| ssl3_connect_~s.base) v_prenex_4)) (not (= (bvadd v_prenex_4 (_ bv4294967268 32)) ssl3_connect_~s.offset)))) (= (_ bv0 32) ssl3_connect_~s.offset) (= (_ bv12292 32) (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32))))) (and (= (_ bv0 32) ssl3_connect_~s.offset) (= (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32))) (_ bv0 32))) (and (= (_ bv0 32) ssl3_connect_~s.offset) (= (_ bv12292 32) (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32)))) (= (_ bv1 32) (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv28 32))))) (and (exists ((ssl3_connect_~tmp___0~1.offset (_ BitVec 32)) (ssl3_connect_~tmp___0~1.base (_ BitVec 32))) (and (not (= ssl3_connect_~tmp___0~1.base ssl3_connect_~s.base)) (= (select (select |#memory_int| ssl3_connect_~tmp___0~1.base) ssl3_connect_~tmp___0~1.offset) (_ bv0 32)))) (= (_ bv0 32) ssl3_connect_~s.offset) (= (_ bv12292 32) (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32))))))} is VALID [2018-11-23 10:58:04,952 INFO L273 TraceCheckUtils]: 12: Hoare triple {8163#(or (and (exists ((v_prenex_4 (_ BitVec 32))) (and (= (_ bv0 32) (select (select |#memory_int| ssl3_connect_~s.base) v_prenex_4)) (not (= (bvadd v_prenex_4 (_ bv4294967268 32)) ssl3_connect_~s.offset)))) (= (_ bv0 32) ssl3_connect_~s.offset) (= (_ bv12292 32) (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32))))) (and (= (_ bv0 32) ssl3_connect_~s.offset) (= (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32))) (_ bv0 32))) (and (= (_ bv0 32) ssl3_connect_~s.offset) (= (_ bv12292 32) (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32)))) (= (_ bv1 32) (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv28 32))))) (and (exists ((ssl3_connect_~tmp___0~1.offset (_ BitVec 32)) (ssl3_connect_~tmp___0~1.base (_ BitVec 32))) (and (not (= ssl3_connect_~tmp___0~1.base ssl3_connect_~s.base)) (= (select (select |#memory_int| ssl3_connect_~tmp___0~1.base) ssl3_connect_~tmp___0~1.offset) (_ bv0 32)))) (= (_ bv0 32) ssl3_connect_~s.offset) (= (_ bv12292 32) (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32))))))} call #t~mem28 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32);~state~0 := #t~mem28;havoc #t~mem28;call #t~mem29 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {8173#(or (and (= |ssl3_connect_#t~mem29| (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32)))) (exists ((ssl3_connect_~tmp___0~1.offset (_ BitVec 32)) (ssl3_connect_~tmp___0~1.base (_ BitVec 32))) (and (not (= ssl3_connect_~tmp___0~1.base ssl3_connect_~s.base)) (= (select (select |#memory_int| ssl3_connect_~tmp___0~1.base) ssl3_connect_~tmp___0~1.offset) (_ bv0 32)))) (= (_ bv0 32) ssl3_connect_~s.offset) (= (_ bv12292 32) (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32))))) (and (= |ssl3_connect_#t~mem29| (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32)))) (= (_ bv0 32) ssl3_connect_~s.offset) (= (_ bv12292 32) (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32)))) (= (_ bv1 32) (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv28 32))))) (and (= |ssl3_connect_#t~mem29| (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32)))) (exists ((v_prenex_4 (_ BitVec 32))) (and (= (_ bv0 32) (select (select |#memory_int| ssl3_connect_~s.base) v_prenex_4)) (not (= (bvadd v_prenex_4 (_ bv4294967268 32)) ssl3_connect_~s.offset)))) (= (_ bv0 32) ssl3_connect_~s.offset) (= (_ bv12292 32) (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32))))) (and (= |ssl3_connect_#t~mem29| (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32)))) (= (_ bv0 32) ssl3_connect_~s.offset) (= (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32))) (_ bv0 32))))} is VALID [2018-11-23 10:58:04,955 INFO L273 TraceCheckUtils]: 13: Hoare triple {8173#(or (and (= |ssl3_connect_#t~mem29| (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32)))) (exists ((ssl3_connect_~tmp___0~1.offset (_ BitVec 32)) (ssl3_connect_~tmp___0~1.base (_ BitVec 32))) (and (not (= ssl3_connect_~tmp___0~1.base ssl3_connect_~s.base)) (= (select (select |#memory_int| ssl3_connect_~tmp___0~1.base) ssl3_connect_~tmp___0~1.offset) (_ bv0 32)))) (= (_ bv0 32) ssl3_connect_~s.offset) (= (_ bv12292 32) (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32))))) (and (= |ssl3_connect_#t~mem29| (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32)))) (= (_ bv0 32) ssl3_connect_~s.offset) (= (_ bv12292 32) (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32)))) (= (_ bv1 32) (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv28 32))))) (and (= |ssl3_connect_#t~mem29| (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32)))) (exists ((v_prenex_4 (_ BitVec 32))) (and (= (_ bv0 32) (select (select |#memory_int| ssl3_connect_~s.base) v_prenex_4)) (not (= (bvadd v_prenex_4 (_ bv4294967268 32)) ssl3_connect_~s.offset)))) (= (_ bv0 32) ssl3_connect_~s.offset) (= (_ bv12292 32) (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32))))) (and (= |ssl3_connect_#t~mem29| (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32)))) (= (_ bv0 32) ssl3_connect_~s.offset) (= (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32))) (_ bv0 32))))} assume !(12292bv32 == #t~mem29);havoc #t~mem29;call #t~mem30 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {8177#(and (= (_ bv0 32) ssl3_connect_~s.offset) (= (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32))) (_ bv0 32)))} is VALID [2018-11-23 10:58:04,956 INFO L273 TraceCheckUtils]: 14: Hoare triple {8177#(and (= (_ bv0 32) ssl3_connect_~s.offset) (= (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32))) (_ bv0 32)))} assume !(16384bv32 == #t~mem30);havoc #t~mem30;call #t~mem31 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {8177#(and (= (_ bv0 32) ssl3_connect_~s.offset) (= (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32))) (_ bv0 32)))} is VALID [2018-11-23 10:58:04,958 INFO L273 TraceCheckUtils]: 15: Hoare triple {8177#(and (= (_ bv0 32) ssl3_connect_~s.offset) (= (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32))) (_ bv0 32)))} assume !(4096bv32 == #t~mem31);havoc #t~mem31;call #t~mem32 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {8177#(and (= (_ bv0 32) ssl3_connect_~s.offset) (= (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32))) (_ bv0 32)))} is VALID [2018-11-23 10:58:04,959 INFO L273 TraceCheckUtils]: 16: Hoare triple {8177#(and (= (_ bv0 32) ssl3_connect_~s.offset) (= (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32))) (_ bv0 32)))} assume !(20480bv32 == #t~mem32);havoc #t~mem32;call #t~mem33 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {8177#(and (= (_ bv0 32) ssl3_connect_~s.offset) (= (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32))) (_ bv0 32)))} is VALID [2018-11-23 10:58:04,960 INFO L273 TraceCheckUtils]: 17: Hoare triple {8177#(and (= (_ bv0 32) ssl3_connect_~s.offset) (= (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32))) (_ bv0 32)))} assume !(4099bv32 == #t~mem33);havoc #t~mem33;call #t~mem34 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {8190#(= |ssl3_connect_#t~mem34| (_ bv0 32))} is VALID [2018-11-23 10:58:04,961 INFO L273 TraceCheckUtils]: 18: Hoare triple {8190#(= |ssl3_connect_#t~mem34| (_ bv0 32))} assume 4368bv32 == #t~mem34;havoc #t~mem34; {8129#false} is VALID [2018-11-23 10:58:04,961 INFO L273 TraceCheckUtils]: 19: Hoare triple {8129#false} call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(48bv32, ~s.offset), 4bv32);~ret~0 := #t~nondet69;havoc #t~nondet69; {8129#false} is VALID [2018-11-23 10:58:04,961 INFO L273 TraceCheckUtils]: 20: Hoare triple {8129#false} assume 0bv32 == ~blastFlag~0;~blastFlag~0 := 1bv32; {8129#false} is VALID [2018-11-23 10:58:04,961 INFO L273 TraceCheckUtils]: 21: Hoare triple {8129#false} assume !~bvsle32(~ret~0, 0bv32);call write~intINTTYPE4(4384bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32);call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(64bv32, ~s.offset), 4bv32);call #t~mem70.base, #t~mem70.offset := read~$Pointer$(~s.base, ~bvadd32(20bv32, ~s.offset), 4bv32);call #t~mem71.base, #t~mem71.offset := read~$Pointer$(~s.base, ~bvadd32(16bv32, ~s.offset), 4bv32); {8129#false} is VALID [2018-11-23 10:58:04,962 INFO L273 TraceCheckUtils]: 22: Hoare triple {8129#false} assume ~bvadd32(#t~mem70.base, #t~mem70.offset) != ~bvadd32(#t~mem71.base, #t~mem71.offset);havoc #t~mem71.base, #t~mem71.offset;havoc #t~mem70.base, #t~mem70.offset; {8129#false} is VALID [2018-11-23 10:58:04,962 INFO L273 TraceCheckUtils]: 23: Hoare triple {8129#false} call #t~mem127.base, #t~mem127.offset := read~$Pointer$(~s.base, ~bvadd32(84bv32, ~s.offset), 4bv32);call #t~mem128 := read~intINTTYPE4(#t~mem127.base, ~bvadd32(848bv32, #t~mem127.offset), 4bv32); {8129#false} is VALID [2018-11-23 10:58:04,962 INFO L273 TraceCheckUtils]: 24: Hoare triple {8129#false} assume !(0bv32 == #t~mem128);havoc #t~mem127.base, #t~mem127.offset;havoc #t~mem128; {8129#false} is VALID [2018-11-23 10:58:04,962 INFO L273 TraceCheckUtils]: 25: Hoare triple {8129#false} ~skip~0 := 0bv32; {8129#false} is VALID [2018-11-23 10:58:04,963 INFO L273 TraceCheckUtils]: 26: Hoare triple {8129#false} assume !false; {8129#false} is VALID [2018-11-23 10:58:04,963 INFO L273 TraceCheckUtils]: 27: Hoare triple {8129#false} call #t~mem28 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32);~state~0 := #t~mem28;havoc #t~mem28;call #t~mem29 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {8129#false} is VALID [2018-11-23 10:58:04,963 INFO L273 TraceCheckUtils]: 28: Hoare triple {8129#false} assume !(12292bv32 == #t~mem29);havoc #t~mem29;call #t~mem30 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {8129#false} is VALID [2018-11-23 10:58:04,964 INFO L273 TraceCheckUtils]: 29: Hoare triple {8129#false} assume !(16384bv32 == #t~mem30);havoc #t~mem30;call #t~mem31 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {8129#false} is VALID [2018-11-23 10:58:04,964 INFO L273 TraceCheckUtils]: 30: Hoare triple {8129#false} assume !(4096bv32 == #t~mem31);havoc #t~mem31;call #t~mem32 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {8129#false} is VALID [2018-11-23 10:58:04,964 INFO L273 TraceCheckUtils]: 31: Hoare triple {8129#false} assume !(20480bv32 == #t~mem32);havoc #t~mem32;call #t~mem33 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {8129#false} is VALID [2018-11-23 10:58:04,965 INFO L273 TraceCheckUtils]: 32: Hoare triple {8129#false} assume !(4099bv32 == #t~mem33);havoc #t~mem33;call #t~mem34 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {8129#false} is VALID [2018-11-23 10:58:04,965 INFO L273 TraceCheckUtils]: 33: Hoare triple {8129#false} assume !(4368bv32 == #t~mem34);havoc #t~mem34;call #t~mem35 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {8129#false} is VALID [2018-11-23 10:58:04,965 INFO L273 TraceCheckUtils]: 34: Hoare triple {8129#false} assume !(4369bv32 == #t~mem35);havoc #t~mem35;call #t~mem36 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {8129#false} is VALID [2018-11-23 10:58:04,965 INFO L273 TraceCheckUtils]: 35: Hoare triple {8129#false} assume 4384bv32 == #t~mem36;havoc #t~mem36; {8129#false} is VALID [2018-11-23 10:58:04,966 INFO L273 TraceCheckUtils]: 36: Hoare triple {8129#false} ~ret~0 := #t~nondet72;havoc #t~nondet72; {8129#false} is VALID [2018-11-23 10:58:04,966 INFO L273 TraceCheckUtils]: 37: Hoare triple {8129#false} assume 1bv32 == ~blastFlag~0;~blastFlag~0 := 2bv32; {8129#false} is VALID [2018-11-23 10:58:04,966 INFO L273 TraceCheckUtils]: 38: Hoare triple {8129#false} assume !~bvsle32(~ret~0, 0bv32);call #t~mem73 := read~intINTTYPE4(~s.base, ~bvadd32(92bv32, ~s.offset), 4bv32); {8129#false} is VALID [2018-11-23 10:58:04,966 INFO L273 TraceCheckUtils]: 39: Hoare triple {8129#false} assume 0bv32 != #t~mem73;havoc #t~mem73;call write~intINTTYPE4(4560bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {8129#false} is VALID [2018-11-23 10:58:04,967 INFO L273 TraceCheckUtils]: 40: Hoare triple {8129#false} call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(64bv32, ~s.offset), 4bv32); {8129#false} is VALID [2018-11-23 10:58:04,967 INFO L273 TraceCheckUtils]: 41: Hoare triple {8129#false} call #t~mem127.base, #t~mem127.offset := read~$Pointer$(~s.base, ~bvadd32(84bv32, ~s.offset), 4bv32);call #t~mem128 := read~intINTTYPE4(#t~mem127.base, ~bvadd32(848bv32, #t~mem127.offset), 4bv32); {8129#false} is VALID [2018-11-23 10:58:04,967 INFO L273 TraceCheckUtils]: 42: Hoare triple {8129#false} assume !(0bv32 == #t~mem128);havoc #t~mem127.base, #t~mem127.offset;havoc #t~mem128; {8129#false} is VALID [2018-11-23 10:58:04,967 INFO L273 TraceCheckUtils]: 43: Hoare triple {8129#false} ~skip~0 := 0bv32; {8129#false} is VALID [2018-11-23 10:58:04,967 INFO L273 TraceCheckUtils]: 44: Hoare triple {8129#false} assume !false; {8129#false} is VALID [2018-11-23 10:58:04,967 INFO L273 TraceCheckUtils]: 45: Hoare triple {8129#false} call #t~mem28 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32);~state~0 := #t~mem28;havoc #t~mem28;call #t~mem29 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {8129#false} is VALID [2018-11-23 10:58:04,968 INFO L273 TraceCheckUtils]: 46: Hoare triple {8129#false} assume !(12292bv32 == #t~mem29);havoc #t~mem29;call #t~mem30 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {8129#false} is VALID [2018-11-23 10:58:04,968 INFO L273 TraceCheckUtils]: 47: Hoare triple {8129#false} assume !(16384bv32 == #t~mem30);havoc #t~mem30;call #t~mem31 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {8129#false} is VALID [2018-11-23 10:58:04,968 INFO L273 TraceCheckUtils]: 48: Hoare triple {8129#false} assume !(4096bv32 == #t~mem31);havoc #t~mem31;call #t~mem32 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {8129#false} is VALID [2018-11-23 10:58:04,968 INFO L273 TraceCheckUtils]: 49: Hoare triple {8129#false} assume !(20480bv32 == #t~mem32);havoc #t~mem32;call #t~mem33 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {8129#false} is VALID [2018-11-23 10:58:04,968 INFO L273 TraceCheckUtils]: 50: Hoare triple {8129#false} assume !(4099bv32 == #t~mem33);havoc #t~mem33;call #t~mem34 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {8129#false} is VALID [2018-11-23 10:58:04,968 INFO L273 TraceCheckUtils]: 51: Hoare triple {8129#false} assume !(4368bv32 == #t~mem34);havoc #t~mem34;call #t~mem35 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {8129#false} is VALID [2018-11-23 10:58:04,968 INFO L273 TraceCheckUtils]: 52: Hoare triple {8129#false} assume !(4369bv32 == #t~mem35);havoc #t~mem35;call #t~mem36 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {8129#false} is VALID [2018-11-23 10:58:04,969 INFO L273 TraceCheckUtils]: 53: Hoare triple {8129#false} assume !(4384bv32 == #t~mem36);havoc #t~mem36;call #t~mem37 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {8129#false} is VALID [2018-11-23 10:58:04,969 INFO L273 TraceCheckUtils]: 54: Hoare triple {8129#false} assume !(4385bv32 == #t~mem37);havoc #t~mem37;call #t~mem38 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {8129#false} is VALID [2018-11-23 10:58:04,969 INFO L273 TraceCheckUtils]: 55: Hoare triple {8129#false} assume 4400bv32 == #t~mem38;havoc #t~mem38; {8129#false} is VALID [2018-11-23 10:58:04,969 INFO L273 TraceCheckUtils]: 56: Hoare triple {8129#false} call #t~mem74.base, #t~mem74.offset := read~$Pointer$(~s.base, ~bvadd32(84bv32, ~s.offset), 4bv32);call #t~mem75.base, #t~mem75.offset := read~$Pointer$(#t~mem74.base, ~bvadd32(836bv32, #t~mem74.offset), 4bv32);call #t~mem76 := read~intINTTYPE4(#t~mem75.base, ~bvadd32(12bv32, #t~mem75.offset), 4bv32); {8129#false} is VALID [2018-11-23 10:58:04,969 INFO L273 TraceCheckUtils]: 57: Hoare triple {8129#false} assume !(0bv32 != ~bvand32(256bv32, #t~mem76));havoc #t~mem76;havoc #t~mem75.base, #t~mem75.offset;havoc #t~mem74.base, #t~mem74.offset;~ret~0 := #t~nondet77;havoc #t~nondet77; {8129#false} is VALID [2018-11-23 10:58:04,970 INFO L273 TraceCheckUtils]: 58: Hoare triple {8129#false} assume 2bv32 == ~blastFlag~0;~blastFlag~0 := 3bv32; {8129#false} is VALID [2018-11-23 10:58:04,970 INFO L273 TraceCheckUtils]: 59: Hoare triple {8129#false} assume !~bvsle32(~ret~0, 0bv32); {8129#false} is VALID [2018-11-23 10:58:04,970 INFO L273 TraceCheckUtils]: 60: Hoare triple {8129#false} call write~intINTTYPE4(4416bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32);call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(64bv32, ~s.offset), 4bv32); {8129#false} is VALID [2018-11-23 10:58:04,970 INFO L273 TraceCheckUtils]: 61: Hoare triple {8129#false} call #t~mem127.base, #t~mem127.offset := read~$Pointer$(~s.base, ~bvadd32(84bv32, ~s.offset), 4bv32);call #t~mem128 := read~intINTTYPE4(#t~mem127.base, ~bvadd32(848bv32, #t~mem127.offset), 4bv32); {8129#false} is VALID [2018-11-23 10:58:04,970 INFO L273 TraceCheckUtils]: 62: Hoare triple {8129#false} assume !(0bv32 == #t~mem128);havoc #t~mem127.base, #t~mem127.offset;havoc #t~mem128; {8129#false} is VALID [2018-11-23 10:58:04,971 INFO L273 TraceCheckUtils]: 63: Hoare triple {8129#false} ~skip~0 := 0bv32; {8129#false} is VALID [2018-11-23 10:58:04,971 INFO L273 TraceCheckUtils]: 64: Hoare triple {8129#false} assume !false; {8129#false} is VALID [2018-11-23 10:58:04,971 INFO L273 TraceCheckUtils]: 65: Hoare triple {8129#false} call #t~mem28 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32);~state~0 := #t~mem28;havoc #t~mem28;call #t~mem29 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {8129#false} is VALID [2018-11-23 10:58:04,971 INFO L273 TraceCheckUtils]: 66: Hoare triple {8129#false} assume !(12292bv32 == #t~mem29);havoc #t~mem29;call #t~mem30 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {8129#false} is VALID [2018-11-23 10:58:04,971 INFO L273 TraceCheckUtils]: 67: Hoare triple {8129#false} assume !(16384bv32 == #t~mem30);havoc #t~mem30;call #t~mem31 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {8129#false} is VALID [2018-11-23 10:58:04,972 INFO L273 TraceCheckUtils]: 68: Hoare triple {8129#false} assume !(4096bv32 == #t~mem31);havoc #t~mem31;call #t~mem32 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {8129#false} is VALID [2018-11-23 10:58:04,972 INFO L273 TraceCheckUtils]: 69: Hoare triple {8129#false} assume !(20480bv32 == #t~mem32);havoc #t~mem32;call #t~mem33 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {8129#false} is VALID [2018-11-23 10:58:04,972 INFO L273 TraceCheckUtils]: 70: Hoare triple {8129#false} assume !(4099bv32 == #t~mem33);havoc #t~mem33;call #t~mem34 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {8129#false} is VALID [2018-11-23 10:58:04,972 INFO L273 TraceCheckUtils]: 71: Hoare triple {8129#false} assume !(4368bv32 == #t~mem34);havoc #t~mem34;call #t~mem35 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {8129#false} is VALID [2018-11-23 10:58:04,973 INFO L273 TraceCheckUtils]: 72: Hoare triple {8129#false} assume !(4369bv32 == #t~mem35);havoc #t~mem35;call #t~mem36 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {8129#false} is VALID [2018-11-23 10:58:04,973 INFO L273 TraceCheckUtils]: 73: Hoare triple {8129#false} assume !(4384bv32 == #t~mem36);havoc #t~mem36;call #t~mem37 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {8129#false} is VALID [2018-11-23 10:58:04,973 INFO L273 TraceCheckUtils]: 74: Hoare triple {8129#false} assume !(4385bv32 == #t~mem37);havoc #t~mem37;call #t~mem38 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {8129#false} is VALID [2018-11-23 10:58:04,973 INFO L273 TraceCheckUtils]: 75: Hoare triple {8129#false} assume !(4400bv32 == #t~mem38);havoc #t~mem38;call #t~mem39 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {8129#false} is VALID [2018-11-23 10:58:04,974 INFO L273 TraceCheckUtils]: 76: Hoare triple {8129#false} assume !(4401bv32 == #t~mem39);havoc #t~mem39;call #t~mem40 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {8129#false} is VALID [2018-11-23 10:58:04,974 INFO L273 TraceCheckUtils]: 77: Hoare triple {8129#false} assume 4416bv32 == #t~mem40;havoc #t~mem40; {8129#false} is VALID [2018-11-23 10:58:04,974 INFO L273 TraceCheckUtils]: 78: Hoare triple {8129#false} ~ret~0 := #t~nondet78;havoc #t~nondet78; {8129#false} is VALID [2018-11-23 10:58:04,974 INFO L273 TraceCheckUtils]: 79: Hoare triple {8129#false} assume 3bv32 == ~blastFlag~0;~blastFlag~0 := 4bv32; {8129#false} is VALID [2018-11-23 10:58:04,975 INFO L273 TraceCheckUtils]: 80: Hoare triple {8129#false} assume !~bvsle32(~ret~0, 0bv32);call write~intINTTYPE4(4432bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32);call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(64bv32, ~s.offset), 4bv32); {8129#false} is VALID [2018-11-23 10:58:04,975 INFO L273 TraceCheckUtils]: 81: Hoare triple {8129#false} assume !(0bv32 == ~tmp___6~0); {8129#false} is VALID [2018-11-23 10:58:04,975 INFO L273 TraceCheckUtils]: 82: Hoare triple {8129#false} call #t~mem127.base, #t~mem127.offset := read~$Pointer$(~s.base, ~bvadd32(84bv32, ~s.offset), 4bv32);call #t~mem128 := read~intINTTYPE4(#t~mem127.base, ~bvadd32(848bv32, #t~mem127.offset), 4bv32); {8129#false} is VALID [2018-11-23 10:58:04,975 INFO L273 TraceCheckUtils]: 83: Hoare triple {8129#false} assume !(0bv32 == #t~mem128);havoc #t~mem127.base, #t~mem127.offset;havoc #t~mem128; {8129#false} is VALID [2018-11-23 10:58:04,976 INFO L273 TraceCheckUtils]: 84: Hoare triple {8129#false} ~skip~0 := 0bv32; {8129#false} is VALID [2018-11-23 10:58:04,976 INFO L273 TraceCheckUtils]: 85: Hoare triple {8129#false} assume !false; {8129#false} is VALID [2018-11-23 10:58:04,976 INFO L273 TraceCheckUtils]: 86: Hoare triple {8129#false} call #t~mem28 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32);~state~0 := #t~mem28;havoc #t~mem28;call #t~mem29 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {8129#false} is VALID [2018-11-23 10:58:04,977 INFO L273 TraceCheckUtils]: 87: Hoare triple {8129#false} assume !(12292bv32 == #t~mem29);havoc #t~mem29;call #t~mem30 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {8129#false} is VALID [2018-11-23 10:58:04,977 INFO L273 TraceCheckUtils]: 88: Hoare triple {8129#false} assume !(16384bv32 == #t~mem30);havoc #t~mem30;call #t~mem31 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {8129#false} is VALID [2018-11-23 10:58:04,977 INFO L273 TraceCheckUtils]: 89: Hoare triple {8129#false} assume !(4096bv32 == #t~mem31);havoc #t~mem31;call #t~mem32 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {8129#false} is VALID [2018-11-23 10:58:04,977 INFO L273 TraceCheckUtils]: 90: Hoare triple {8129#false} assume !(20480bv32 == #t~mem32);havoc #t~mem32;call #t~mem33 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {8129#false} is VALID [2018-11-23 10:58:04,977 INFO L273 TraceCheckUtils]: 91: Hoare triple {8129#false} assume !(4099bv32 == #t~mem33);havoc #t~mem33;call #t~mem34 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {8129#false} is VALID [2018-11-23 10:58:04,978 INFO L273 TraceCheckUtils]: 92: Hoare triple {8129#false} assume !(4368bv32 == #t~mem34);havoc #t~mem34;call #t~mem35 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {8129#false} is VALID [2018-11-23 10:58:04,978 INFO L273 TraceCheckUtils]: 93: Hoare triple {8129#false} assume !(4369bv32 == #t~mem35);havoc #t~mem35;call #t~mem36 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {8129#false} is VALID [2018-11-23 10:58:04,978 INFO L273 TraceCheckUtils]: 94: Hoare triple {8129#false} assume !(4384bv32 == #t~mem36);havoc #t~mem36;call #t~mem37 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {8129#false} is VALID [2018-11-23 10:58:04,978 INFO L273 TraceCheckUtils]: 95: Hoare triple {8129#false} assume !(4385bv32 == #t~mem37);havoc #t~mem37;call #t~mem38 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {8129#false} is VALID [2018-11-23 10:58:04,979 INFO L273 TraceCheckUtils]: 96: Hoare triple {8129#false} assume !(4400bv32 == #t~mem38);havoc #t~mem38;call #t~mem39 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {8129#false} is VALID [2018-11-23 10:58:04,979 INFO L273 TraceCheckUtils]: 97: Hoare triple {8129#false} assume !(4401bv32 == #t~mem39);havoc #t~mem39;call #t~mem40 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {8129#false} is VALID [2018-11-23 10:58:04,979 INFO L273 TraceCheckUtils]: 98: Hoare triple {8129#false} assume !(4416bv32 == #t~mem40);havoc #t~mem40;call #t~mem41 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {8129#false} is VALID [2018-11-23 10:58:04,979 INFO L273 TraceCheckUtils]: 99: Hoare triple {8129#false} assume !(4417bv32 == #t~mem41);havoc #t~mem41;call #t~mem42 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {8129#false} is VALID [2018-11-23 10:58:04,979 INFO L273 TraceCheckUtils]: 100: Hoare triple {8129#false} assume 4432bv32 == #t~mem42;havoc #t~mem42; {8129#false} is VALID [2018-11-23 10:58:04,979 INFO L273 TraceCheckUtils]: 101: Hoare triple {8129#false} ~ret~0 := #t~nondet79;havoc #t~nondet79; {8129#false} is VALID [2018-11-23 10:58:04,980 INFO L273 TraceCheckUtils]: 102: Hoare triple {8129#false} assume 4bv32 == ~blastFlag~0; {8129#false} is VALID [2018-11-23 10:58:04,980 INFO L273 TraceCheckUtils]: 103: Hoare triple {8129#false} assume !false; {8129#false} is VALID [2018-11-23 10:58:04,997 INFO L134 CoverageAnalysis]: Checked inductivity of 118 backedges. 32 proven. 0 refuted. 0 times theorem prover too weak. 86 trivial. 0 not checked. [2018-11-23 10:58:04,997 INFO L312 TraceCheckSpWp]: Omiting computation of backward sequence because forward sequence was already perfect [2018-11-23 10:58:05,001 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 10:58:05,001 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [9] imperfect sequences [] total 9 [2018-11-23 10:58:05,002 INFO L78 Accepts]: Start accepts. Automaton has 9 states. Word has length 104 [2018-11-23 10:58:05,002 INFO L84 Accepts]: Finished accepts. word is accepted. [2018-11-23 10:58:05,002 INFO L86 InductivityCheck]: Starting indutivity check of a Floyd-Hoare automaton with 9 states. [2018-11-23 10:58:05,173 INFO L119 InductivityCheck]: Floyd-Hoare automaton has 62 edges. 62 inductive. 0 not inductive. 0 times theorem prover too weak to decide inductivity. [2018-11-23 10:58:05,173 INFO L459 AbstractCegarLoop]: Interpolant automaton has 9 states [2018-11-23 10:58:05,173 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 9 interpolants. [2018-11-23 10:58:05,174 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=18, Invalid=54, Unknown=0, NotChecked=0, Total=72 [2018-11-23 10:58:05,174 INFO L87 Difference]: Start difference. First operand 521 states and 768 transitions. Second operand 9 states. [2018-11-23 10:58:17,352 WARN L180 SmtUtils]: Spent 118.00 ms on a formula simplification that was a NOOP. DAG size: 43 [2018-11-23 10:58:17,819 WARN L180 SmtUtils]: Spent 140.00 ms on a formula simplification that was a NOOP. DAG size: 45 [2018-11-23 10:58:47,083 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 10:58:47,083 INFO L93 Difference]: Finished difference Result 1013 states and 1495 transitions. [2018-11-23 10:58:47,084 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 9 states. [2018-11-23 10:58:47,084 INFO L78 Accepts]: Start accepts. Automaton has 9 states. Word has length 104 [2018-11-23 10:58:47,084 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 10:58:47,084 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 9 states. [2018-11-23 10:58:47,088 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 9 states to 9 states and 455 transitions. [2018-11-23 10:58:47,089 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 9 states. [2018-11-23 10:58:47,092 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 9 states to 9 states and 455 transitions. [2018-11-23 10:58:47,093 INFO L86 InductivityCheck]: Starting indutivity check of a Floyd-Hoare automaton with 9 states and 455 transitions. [2018-11-23 10:58:48,748 INFO L119 InductivityCheck]: Floyd-Hoare automaton has 455 edges. 455 inductive. 0 not inductive. 0 times theorem prover too weak to decide inductivity. [2018-11-23 10:58:48,768 INFO L225 Difference]: With dead ends: 1013 [2018-11-23 10:58:48,768 INFO L226 Difference]: Without dead ends: 604 [2018-11-23 10:58:48,770 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 108 GetRequests, 96 SyntacticMatches, 0 SemanticMatches, 12 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 10 ImplicationChecksByTransitivity, 1.3s TimeCoverageRelationStatistics Valid=50, Invalid=132, Unknown=0, NotChecked=0, Total=182 [2018-11-23 10:58:48,771 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 604 states. [2018-11-23 10:58:49,226 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 604 to 529. [2018-11-23 10:58:49,226 INFO L214 AbstractMinimizeNwa]: Start testing correctness of minimizeSevpa [2018-11-23 10:58:49,227 INFO L82 GeneralOperation]: Start isEquivalent. First operand 604 states. Second operand 529 states. [2018-11-23 10:58:49,227 INFO L74 IsIncluded]: Start isIncluded. First operand 604 states. Second operand 529 states. [2018-11-23 10:58:49,227 INFO L87 Difference]: Start difference. First operand 604 states. Second operand 529 states. [2018-11-23 10:58:49,254 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 10:58:49,255 INFO L93 Difference]: Finished difference Result 604 states and 889 transitions. [2018-11-23 10:58:49,255 INFO L276 IsEmpty]: Start isEmpty. Operand 604 states and 889 transitions. [2018-11-23 10:58:49,256 INFO L282 IsEmpty]: Finished isEmpty. No accepting run. [2018-11-23 10:58:49,256 INFO L83 IsIncluded]: Finished isIncluded. Language is included [2018-11-23 10:58:49,257 INFO L74 IsIncluded]: Start isIncluded. First operand 529 states. Second operand 604 states. [2018-11-23 10:58:49,257 INFO L87 Difference]: Start difference. First operand 529 states. Second operand 604 states. [2018-11-23 10:58:49,284 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 10:58:49,285 INFO L93 Difference]: Finished difference Result 604 states and 889 transitions. [2018-11-23 10:58:49,285 INFO L276 IsEmpty]: Start isEmpty. Operand 604 states and 889 transitions. [2018-11-23 10:58:49,286 INFO L282 IsEmpty]: Finished isEmpty. No accepting run. [2018-11-23 10:58:49,286 INFO L83 IsIncluded]: Finished isIncluded. Language is included [2018-11-23 10:58:49,287 INFO L88 GeneralOperation]: Finished isEquivalent. [2018-11-23 10:58:49,287 INFO L221 AbstractMinimizeNwa]: Finished testing correctness of minimizeSevpa [2018-11-23 10:58:49,287 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 529 states. [2018-11-23 10:58:49,309 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 529 states to 529 states and 781 transitions. [2018-11-23 10:58:49,309 INFO L78 Accepts]: Start accepts. Automaton has 529 states and 781 transitions. Word has length 104 [2018-11-23 10:58:49,309 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 10:58:49,310 INFO L480 AbstractCegarLoop]: Abstraction has 529 states and 781 transitions. [2018-11-23 10:58:49,310 INFO L481 AbstractCegarLoop]: Interpolant automaton has 9 states. [2018-11-23 10:58:49,310 INFO L276 IsEmpty]: Start isEmpty. Operand 529 states and 781 transitions. [2018-11-23 10:58:49,312 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 106 [2018-11-23 10:58:49,312 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 10:58:49,312 INFO L402 BasicCegarLoop]: trace histogram [5, 5, 5, 5, 5, 5, 5, 5, 4, 4, 4, 4, 3, 3, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 10:58:49,313 INFO L423 AbstractCegarLoop]: === Iteration 6 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 10:58:49,313 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 10:58:49,313 INFO L82 PathProgramCache]: Analyzing trace with hash -1655398293, now seen corresponding path program 1 times [2018-11-23 10:58:49,314 INFO L223 ckRefinementStrategy]: Switched to mode CVC4_FPBP [2018-11-23 10:58:49,314 INFO L69 tionRefinementEngine]: Using refinement strategy WolfRefinementStrategy No working directory specified, using /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/cvc4nyu Starting monitored process 7 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk (exit command is (exit), workingDir is null) Waiting until toolchain timeout for monitored process 7 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk [2018-11-23 10:58:49,347 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 10:58:49,975 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 10:58:50,179 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 10:58:50,182 INFO L273 TraceCheckSpWp]: Computing forward predicates... [2018-11-23 10:58:50,424 WARN L180 SmtUtils]: Spent 155.00 ms on a formula simplification that was a NOOP. DAG size: 31 [2018-11-23 10:58:50,440 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 2, 1 stores, 1 select indices, 1 select index equivalence classes, 0 disjoint index pairs (out of 0 index pairs), introduced 2 new quantified variables, introduced 0 case distinctions, treesize of input 40 treesize of output 38 [2018-11-23 10:58:50,450 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 1, 1 stores, 0 select indices, 0 select index equivalence classes, 0 disjoint index pairs (out of 0 index pairs), introduced 1 new quantified variables, introduced 0 case distinctions, treesize of input 35 treesize of output 32 [2018-11-23 10:58:50,465 INFO L701 Elim1Store]: detected not equals via solver [2018-11-23 10:58:50,473 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 1, 1 stores, 1 select indices, 1 select index equivalence classes, 1 disjoint index pairs (out of 0 index pairs), introduced 0 new quantified variables, introduced 0 case distinctions, treesize of input 32 treesize of output 38 [2018-11-23 10:58:50,476 INFO L267 ElimStorePlain]: Start of recursive call 4: End of recursive call: and 1 xjuncts. [2018-11-23 10:58:50,504 INFO L267 ElimStorePlain]: Start of recursive call 3: 1 dim-1 vars, End of recursive call: and 1 xjuncts. [2018-11-23 10:58:50,550 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 2, 1 stores, 1 select indices, 1 select index equivalence classes, 0 disjoint index pairs (out of 0 index pairs), introduced 1 new quantified variables, introduced 0 case distinctions, treesize of input 30 treesize of output 26 [2018-11-23 10:58:50,559 INFO L701 Elim1Store]: detected not equals via solver [2018-11-23 10:58:50,573 INFO L701 Elim1Store]: detected not equals via solver [2018-11-23 10:58:50,627 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 1, 1 stores, 2 select indices, 2 select index equivalence classes, 2 disjoint index pairs (out of 1 index pairs), introduced 0 new quantified variables, introduced 4 case distinctions, treesize of input 23 treesize of output 46 [2018-11-23 10:58:50,631 INFO L267 ElimStorePlain]: Start of recursive call 6: End of recursive call: and 4 xjuncts. [2018-11-23 10:58:50,698 INFO L267 ElimStorePlain]: Start of recursive call 5: 1 dim-1 vars, End of recursive call: and 3 xjuncts. [2018-11-23 10:58:50,753 INFO L267 ElimStorePlain]: Start of recursive call 2: 1 dim-1 vars, 1 dim-2 vars, End of recursive call: and 3 xjuncts. [2018-11-23 10:58:50,806 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 2, 1 stores, 2 select indices, 2 select index equivalence classes, 1 disjoint index pairs (out of 1 index pairs), introduced 2 new quantified variables, introduced 0 case distinctions, treesize of input 31 treesize of output 31 [2018-11-23 10:58:50,815 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 1, 1 stores, 0 select indices, 0 select index equivalence classes, 0 disjoint index pairs (out of 0 index pairs), introduced 1 new quantified variables, introduced 0 case distinctions, treesize of input 15 treesize of output 18 [2018-11-23 10:58:50,827 INFO L701 Elim1Store]: detected not equals via solver [2018-11-23 10:58:50,833 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 1, 1 stores, 1 select indices, 1 select index equivalence classes, 1 disjoint index pairs (out of 0 index pairs), introduced 0 new quantified variables, introduced 0 case distinctions, treesize of input 18 treesize of output 27 [2018-11-23 10:58:50,836 INFO L267 ElimStorePlain]: Start of recursive call 9: End of recursive call: and 1 xjuncts. [2018-11-23 10:58:50,851 INFO L267 ElimStorePlain]: Start of recursive call 8: 1 dim-1 vars, End of recursive call: and 1 xjuncts. [2018-11-23 10:58:50,896 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 2, 1 stores, 2 select indices, 2 select index equivalence classes, 1 disjoint index pairs (out of 1 index pairs), introduced 1 new quantified variables, introduced 0 case distinctions, treesize of input 30 treesize of output 31 [2018-11-23 10:58:50,906 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 1, 1 stores, 0 select indices, 0 select index equivalence classes, 0 disjoint index pairs (out of 0 index pairs), introduced 0 new quantified variables, introduced 0 case distinctions, treesize of input 8 treesize of output 7 [2018-11-23 10:58:50,908 INFO L267 ElimStorePlain]: Start of recursive call 11: End of recursive call: and 1 xjuncts. [2018-11-23 10:58:50,925 INFO L267 ElimStorePlain]: Start of recursive call 10: 1 dim-1 vars, End of recursive call: and 1 xjuncts. [2018-11-23 10:58:50,943 INFO L267 ElimStorePlain]: Start of recursive call 7: 1 dim-1 vars, 1 dim-2 vars, End of recursive call: and 1 xjuncts. [2018-11-23 10:58:51,018 INFO L267 ElimStorePlain]: Start of recursive call 1: 3 dim-0 vars, 1 dim-2 vars, End of recursive call: 2 dim-0 vars, and 3 xjuncts. [2018-11-23 10:58:51,018 INFO L202 ElimStorePlain]: Needed 11 recursive calls to eliminate 4 variables, input treesize:45, output treesize:56 [2018-11-23 10:58:51,073 WARN L383 uantifierElimination]: Trying to double check SDD result, but SMT solver's response was UNKNOWN. [2018-11-23 10:58:51,074 WARN L384 uantifierElimination]: Input elimination task: ∃ [|v_#memory_int_169|, |v_ssl3_connect_#t~nondet19_4|, ssl3_connect_~tmp___0~1.base, ssl3_connect_~tmp___0~1.offset]. (and (= |#memory_int| (let ((.cse0 (store |v_#memory_int_169| ssl3_connect_~s.base (store (store (select |v_#memory_int_169| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv92 32)) |v_ssl3_connect_#t~nondet19_4|) (bvadd ssl3_connect_~s.offset (_ bv52 32)) (_ bv12292 32))))) (store .cse0 ssl3_connect_~tmp___0~1.base (store (select .cse0 ssl3_connect_~tmp___0~1.base) ssl3_connect_~tmp___0~1.offset (_ bv0 32))))) (= (_ bv0 32) ssl3_connect_~s.offset)) [2018-11-23 10:58:51,074 WARN L385 uantifierElimination]: ElimStorePlain result: ∃ [ssl3_connect_~tmp___0~1.base, ssl3_connect_~tmp___0~1.offset]. (let ((.cse2 (select |#memory_int| ssl3_connect_~s.base))) (let ((.cse3 (select .cse2 (bvadd ssl3_connect_~s.offset (_ bv52 32))))) (let ((.cse0 (= .cse3 (_ bv12292 32))) (.cse1 (= (_ bv0 32) ssl3_connect_~s.offset))) (or (and .cse0 .cse1 (= (select (select |#memory_int| ssl3_connect_~tmp___0~1.base) ssl3_connect_~tmp___0~1.offset) (_ bv0 32))) (and (= (_ bv0 32) (select .cse2 (bvadd ssl3_connect_~s.offset (_ bv92 32)))) .cse0 .cse1) (and .cse1 (= .cse3 (_ bv0 32))))))) [2018-11-23 10:58:51,374 INFO L701 Elim1Store]: detected not equals via solver [2018-11-23 10:58:51,375 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 2, 1 stores, 1 select indices, 1 select index equivalence classes, 1 disjoint index pairs (out of 0 index pairs), introduced 1 new quantified variables, introduced 0 case distinctions, treesize of input 34 treesize of output 41 [2018-11-23 10:58:51,382 INFO L701 Elim1Store]: detected not equals via solver [2018-11-23 10:58:51,389 INFO L701 Elim1Store]: detected not equals via solver [2018-11-23 10:58:51,390 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 1, 1 stores, 2 select indices, 2 select index equivalence classes, 2 disjoint index pairs (out of 1 index pairs), introduced 1 new quantified variables, introduced 0 case distinctions, treesize of input 38 treesize of output 35 [2018-11-23 10:58:51,395 INFO L267 ElimStorePlain]: Start of recursive call 3: End of recursive call: and 1 xjuncts. [2018-11-23 10:58:51,404 INFO L267 ElimStorePlain]: Start of recursive call 2: 1 dim-1 vars, End of recursive call: and 1 xjuncts. [2018-11-23 10:58:51,498 INFO L701 Elim1Store]: detected not equals via solver [2018-11-23 10:58:51,553 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 2, 1 stores, 2 select indices, 2 select index equivalence classes, 1 disjoint index pairs (out of 1 index pairs), introduced 2 new quantified variables, introduced 3 case distinctions, treesize of input 43 treesize of output 65 [2018-11-23 10:58:51,584 INFO L701 Elim1Store]: detected not equals via solver [2018-11-23 10:58:51,596 INFO L701 Elim1Store]: detected not equals via solver [2018-11-23 10:58:51,597 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 1, 1 stores, 2 select indices, 2 select index equivalence classes, 2 disjoint index pairs (out of 1 index pairs), introduced 1 new quantified variables, introduced 0 case distinctions, treesize of input 54 treesize of output 51 [2018-11-23 10:58:51,629 INFO L267 ElimStorePlain]: Start of recursive call 5: End of recursive call: and 1 xjuncts. [2018-11-23 10:58:51,729 INFO L701 Elim1Store]: detected not equals via solver [2018-11-23 10:58:51,733 INFO L701 Elim1Store]: detected not equals via solver [2018-11-23 10:58:51,753 INFO L701 Elim1Store]: detected not equals via solver [2018-11-23 10:58:51,767 INFO L701 Elim1Store]: detected not equals via solver [2018-11-23 10:58:51,802 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 1, 1 stores, 3 select indices, 3 select index equivalence classes, 4 disjoint index pairs (out of 3 index pairs), introduced 1 new quantified variables, introduced 3 case distinctions, treesize of input 35 treesize of output 80 [2018-11-23 10:58:51,836 INFO L267 ElimStorePlain]: Start of recursive call 6: End of recursive call: and 3 xjuncts. [2018-11-23 10:58:51,946 INFO L267 ElimStorePlain]: Start of recursive call 4: 2 dim-1 vars, End of recursive call: and 3 xjuncts. [2018-11-23 10:58:52,036 INFO L267 ElimStorePlain]: Start of recursive call 1: 2 dim-0 vars, 2 dim-2 vars, End of recursive call: 3 dim-0 vars, and 4 xjuncts. [2018-11-23 10:58:52,036 INFO L202 ElimStorePlain]: Needed 6 recursive calls to eliminate 4 variables, input treesize:78, output treesize:88 [2018-11-23 10:58:54,073 WARN L383 uantifierElimination]: Trying to double check SDD result, but SMT solver's response was UNKNOWN. [2018-11-23 10:58:54,073 WARN L384 uantifierElimination]: Input elimination task: ∃ [v_prenex_5, ssl3_connect_~tmp___0~1.base, ssl3_connect_~tmp___0~1.offset, |v_#memory_int_170|]. (let ((.cse2 (= (_ bv0 32) ssl3_connect_~s.offset)) (.cse3 (bvadd ssl3_connect_~s.offset (_ bv52 32))) (.cse1 (bvadd ssl3_connect_~s.offset (_ bv28 32)))) (or (let ((.cse0 (select v_prenex_5 ssl3_connect_~s.base))) (and (= (store v_prenex_5 ssl3_connect_~s.base (store .cse0 .cse1 (bvadd (select .cse0 .cse1) (_ bv1 32)))) |#memory_int|) .cse2 (= (_ bv0 32) (bvadd (select .cse0 .cse3) (_ bv4294955004 32))) (= (select (select v_prenex_5 ssl3_connect_~tmp___0~1.base) ssl3_connect_~tmp___0~1.offset) (_ bv0 32)))) (let ((.cse4 (select |v_#memory_int_170| ssl3_connect_~s.base))) (and .cse2 (= (select .cse4 .cse3) (_ bv0 32)) (= (store |v_#memory_int_170| ssl3_connect_~s.base (store .cse4 .cse1 (bvadd (select .cse4 .cse1) (_ bv1 32)))) |#memory_int|))))) [2018-11-23 10:58:54,074 WARN L385 uantifierElimination]: ElimStorePlain result: ∃ [ssl3_connect_~tmp___0~1.base, v_prenex_6, ssl3_connect_~tmp___0~1.offset]. (let ((.cse2 (select |#memory_int| ssl3_connect_~s.base))) (let ((.cse4 (select .cse2 (bvadd ssl3_connect_~s.offset (_ bv52 32))))) (let ((.cse1 (= .cse4 (_ bv12292 32))) (.cse3 (= (_ bv0 32) ssl3_connect_~s.offset)) (.cse0 (bvadd ssl3_connect_~s.offset (_ bv28 32)))) (or (and (not (= ssl3_connect_~tmp___0~1.offset .cse0)) .cse1 (= (_ bv0 32) (select .cse2 ssl3_connect_~tmp___0~1.offset)) .cse3) (and .cse3 (= .cse4 (_ bv0 32))) (and (not (= ssl3_connect_~tmp___0~1.base ssl3_connect_~s.base)) .cse3 (= (_ bv0 32) (bvadd .cse4 (_ bv4294955004 32))) (= (select (select |#memory_int| ssl3_connect_~tmp___0~1.base) v_prenex_6) (_ bv0 32))) (and .cse1 .cse3 (= (_ bv1 32) (select .cse2 .cse0))))))) [2018-11-23 10:58:54,512 WARN L180 SmtUtils]: Spent 220.00 ms on a formula simplification that was a NOOP. DAG size: 43 [2018-11-23 10:58:54,969 WARN L180 SmtUtils]: Spent 122.00 ms on a formula simplification that was a NOOP. DAG size: 45 [2018-11-23 10:58:55,084 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 2, 0 stores, 1 select indices, 1 select index equivalence classes, 0 disjoint index pairs (out of 0 index pairs), introduced 1 new quantified variables, introduced 0 case distinctions, treesize of input 15 treesize of output 11 [2018-11-23 10:58:55,087 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 1, 0 stores, 1 select indices, 1 select index equivalence classes, 0 disjoint index pairs (out of 0 index pairs), introduced 0 new quantified variables, introduced 0 case distinctions, treesize of input 11 treesize of output 3 [2018-11-23 10:58:55,088 INFO L267 ElimStorePlain]: Start of recursive call 3: End of recursive call: and 1 xjuncts. [2018-11-23 10:58:55,090 INFO L267 ElimStorePlain]: Start of recursive call 2: 1 dim-1 vars, End of recursive call: and 1 xjuncts. [2018-11-23 10:58:55,093 INFO L267 ElimStorePlain]: Start of recursive call 1: 1 dim-0 vars, 1 dim-2 vars, End of recursive call: and 1 xjuncts. [2018-11-23 10:58:55,093 INFO L202 ElimStorePlain]: Needed 3 recursive calls to eliminate 2 variables, input treesize:15, output treesize:3 [2018-11-23 10:58:55,096 WARN L383 uantifierElimination]: Trying to double check SDD result, but SMT solver's response was UNKNOWN. [2018-11-23 10:58:55,096 WARN L384 uantifierElimination]: Input elimination task: ∃ [|#memory_int|, ssl3_connect_~s.base]. (let ((.cse0 (select (select |#memory_int| ssl3_connect_~s.base) (_ bv52 32)))) (and (= |ssl3_connect_#t~mem35| .cse0) (= (_ bv0 32) .cse0))) [2018-11-23 10:58:55,096 WARN L385 uantifierElimination]: ElimStorePlain result: ∃ []. (= |ssl3_connect_#t~mem35| (_ bv0 32)) [2018-11-23 10:58:55,182 INFO L256 TraceCheckUtils]: 0: Hoare triple {11463#true} call ULTIMATE.init(); {11463#true} is VALID [2018-11-23 10:58:55,182 INFO L273 TraceCheckUtils]: 1: Hoare triple {11463#true} #NULL.base, #NULL.offset := 0bv32, 0bv32;#valid := #valid[0bv32 := 0bv1];~init~0 := 1bv32;call ~#SSLv3_client_data~0.base, ~#SSLv3_client_data~0.offset := #Ultimate.alloc(100bv32);call write~init~intINTTYPE4(0bv32, ~#SSLv3_client_data~0.base, ~#SSLv3_client_data~0.offset, 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(4bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(8bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(12bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(16bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(20bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(24bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(28bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(32bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(36bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(40bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(44bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(48bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(52bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(56bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(60bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(64bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(68bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(72bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(76bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(80bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(84bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(88bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(92bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(96bv32, ~#SSLv3_client_data~0.offset), 4bv32); {11463#true} is VALID [2018-11-23 10:58:55,183 INFO L273 TraceCheckUtils]: 2: Hoare triple {11463#true} assume true; {11463#true} is VALID [2018-11-23 10:58:55,183 INFO L268 TraceCheckUtils]: 3: Hoare quadruple {11463#true} {11463#true} #544#return; {11463#true} is VALID [2018-11-23 10:58:55,183 INFO L256 TraceCheckUtils]: 4: Hoare triple {11463#true} call #t~ret138 := main(); {11463#true} is VALID [2018-11-23 10:58:55,186 INFO L273 TraceCheckUtils]: 5: Hoare triple {11463#true} call #t~malloc3.base, #t~malloc3.offset := #Ultimate.alloc(248bv32);~s~0.base, ~s~0.offset := #t~malloc3.base, #t~malloc3.offset;call #t~malloc4.base, #t~malloc4.offset := #Ultimate.alloc(899bv32);call write~$Pointer$(#t~malloc4.base, #t~malloc4.offset, ~s~0.base, ~bvadd32(84bv32, ~s~0.offset), 4bv32);call #t~malloc5.base, #t~malloc5.offset := #Ultimate.alloc(232bv32);call write~$Pointer$(#t~malloc5.base, #t~malloc5.offset, ~s~0.base, ~bvadd32(204bv32, ~s~0.offset), 4bv32);call #t~malloc6.base, #t~malloc6.offset := #Ultimate.alloc(200bv32);call write~$Pointer$(#t~malloc6.base, #t~malloc6.offset, ~s~0.base, ~bvadd32(176bv32, ~s~0.offset), 4bv32);call write~intINTTYPE4(12292bv32, ~s~0.base, ~bvadd32(52bv32, ~s~0.offset), 4bv32);call write~intINTTYPE4(#t~nondet7, ~s~0.base, ~s~0.offset, 4bv32);havoc #t~nondet7; {11483#(= main_~s~0.offset (_ bv0 32))} is VALID [2018-11-23 10:58:55,186 INFO L256 TraceCheckUtils]: 6: Hoare triple {11483#(= main_~s~0.offset (_ bv0 32))} call #t~ret8 := ssl3_connect(~s~0.base, ~s~0.offset); {11487#(= |ssl3_connect_#in~s.offset| (_ bv0 32))} is VALID [2018-11-23 10:58:55,195 INFO L273 TraceCheckUtils]: 7: Hoare triple {11487#(= |ssl3_connect_#in~s.offset| (_ bv0 32))} ~s.base, ~s.offset := #in~s.base, #in~s.offset;havoc ~buf~0.base, ~buf~0.offset;havoc ~tmp~2;havoc ~l~0;havoc ~num1~0;havoc ~cb~0.base, ~cb~0.offset;havoc ~ret~0;havoc ~new_state~0;havoc ~state~0;havoc ~skip~0;~tmp___0~1.base, ~tmp___0~1.offset := #t~nondet9.base, #t~nondet9.offset;havoc #t~nondet9.base, #t~nondet9.offset;~tmp___1~0 := #t~nondet10;havoc #t~nondet10;~tmp___2~0 := #t~nondet11;havoc #t~nondet11;~tmp___3~0 := #t~nondet12;havoc #t~nondet12;~tmp___4~0 := #t~nondet13;havoc #t~nondet13;~tmp___5~0 := #t~nondet14;havoc #t~nondet14;~tmp___6~0 := #t~nondet15;havoc #t~nondet15;~tmp___7~0 := #t~nondet16;havoc #t~nondet16;~tmp___8~0 := #t~nondet17;havoc #t~nondet17;~tmp___9~0 := #t~nondet18;havoc #t~nondet18;havoc ~blastFlag~0;~blastFlag~0 := 0bv32;call write~intINTTYPE4(#t~nondet19, ~s.base, ~bvadd32(92bv32, ~s.offset), 4bv32);havoc #t~nondet19;call write~intINTTYPE4(12292bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32);~tmp~2 := #t~nondet20;havoc #t~nondet20;~cb~0.base, ~cb~0.offset := 0bv32, 0bv32;~ret~0 := 4294967295bv32;~skip~0 := 0bv32;call write~intINTTYPE4(0bv32, ~tmp___0~1.base, ~tmp___0~1.offset, 4bv32);call #t~mem21.base, #t~mem21.offset := read~$Pointer$(~s.base, ~bvadd32(192bv32, ~s.offset), 4bv32); {11491#(or (and (= (bvadd (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32))) (_ bv4294955004 32)) (_ bv0 32)) (= (_ bv0 32) ssl3_connect_~s.offset) (exists ((ssl3_connect_~tmp___0~1.offset (_ BitVec 32)) (ssl3_connect_~tmp___0~1.base (_ BitVec 32))) (= (select (select |#memory_int| ssl3_connect_~tmp___0~1.base) ssl3_connect_~tmp___0~1.offset) (_ bv0 32)))) (and (= (_ bv0 32) ssl3_connect_~s.offset) (= (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32))) (_ bv0 32))))} is VALID [2018-11-23 10:58:55,196 INFO L273 TraceCheckUtils]: 8: Hoare triple {11491#(or (and (= (bvadd (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32))) (_ bv4294955004 32)) (_ bv0 32)) (= (_ bv0 32) ssl3_connect_~s.offset) (exists ((ssl3_connect_~tmp___0~1.offset (_ BitVec 32)) (ssl3_connect_~tmp___0~1.base (_ BitVec 32))) (= (select (select |#memory_int| ssl3_connect_~tmp___0~1.base) ssl3_connect_~tmp___0~1.offset) (_ bv0 32)))) (and (= (_ bv0 32) ssl3_connect_~s.offset) (= (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32))) (_ bv0 32))))} assume 0bv32 != ~bvadd32(#t~mem21.base, #t~mem21.offset);havoc #t~mem21.base, #t~mem21.offset;call #t~mem22.base, #t~mem22.offset := read~$Pointer$(~s.base, ~bvadd32(192bv32, ~s.offset), 4bv32);~cb~0.base, ~cb~0.offset := #t~mem22.base, #t~mem22.offset;havoc #t~mem22.base, #t~mem22.offset; {11491#(or (and (= (bvadd (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32))) (_ bv4294955004 32)) (_ bv0 32)) (= (_ bv0 32) ssl3_connect_~s.offset) (exists ((ssl3_connect_~tmp___0~1.offset (_ BitVec 32)) (ssl3_connect_~tmp___0~1.base (_ BitVec 32))) (= (select (select |#memory_int| ssl3_connect_~tmp___0~1.base) ssl3_connect_~tmp___0~1.offset) (_ bv0 32)))) (and (= (_ bv0 32) ssl3_connect_~s.offset) (= (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32))) (_ bv0 32))))} is VALID [2018-11-23 10:58:55,220 INFO L273 TraceCheckUtils]: 9: Hoare triple {11491#(or (and (= (bvadd (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32))) (_ bv4294955004 32)) (_ bv0 32)) (= (_ bv0 32) ssl3_connect_~s.offset) (exists ((ssl3_connect_~tmp___0~1.offset (_ BitVec 32)) (ssl3_connect_~tmp___0~1.base (_ BitVec 32))) (= (select (select |#memory_int| ssl3_connect_~tmp___0~1.base) ssl3_connect_~tmp___0~1.offset) (_ bv0 32)))) (and (= (_ bv0 32) ssl3_connect_~s.offset) (= (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32))) (_ bv0 32))))} call #t~mem27 := read~intINTTYPE4(~s.base, ~bvadd32(28bv32, ~s.offset), 4bv32);call write~intINTTYPE4(~bvadd32(1bv32, #t~mem27), ~s.base, ~bvadd32(28bv32, ~s.offset), 4bv32);havoc #t~mem27; {11498#(or (and (= (bvadd (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32))) (_ bv4294955004 32)) (_ bv0 32)) (= (_ bv0 32) ssl3_connect_~s.offset) (= (_ bv1 32) (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv28 32))))) (and (= (_ bv0 32) ssl3_connect_~s.offset) (= (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32))) (_ bv0 32))) (and (= (bvadd (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32))) (_ bv4294955004 32)) (_ bv0 32)) (= (_ bv0 32) ssl3_connect_~s.offset) (exists ((ssl3_connect_~tmp___0~1.offset (_ BitVec 32))) (and (= (_ bv0 32) (select (select |#memory_int| ssl3_connect_~s.base) ssl3_connect_~tmp___0~1.offset)) (not (= (bvadd ssl3_connect_~tmp___0~1.offset (_ bv4294967268 32)) ssl3_connect_~s.offset))))) (and (exists ((v_prenex_6 (_ BitVec 32)) (ssl3_connect_~tmp___0~1.base (_ BitVec 32))) (and (not (= ssl3_connect_~tmp___0~1.base ssl3_connect_~s.base)) (= (select (select |#memory_int| ssl3_connect_~tmp___0~1.base) v_prenex_6) (_ bv0 32)))) (= (_ bv0 32) ssl3_connect_~s.offset) (= (_ bv12292 32) (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32))))))} is VALID [2018-11-23 10:58:55,221 INFO L273 TraceCheckUtils]: 10: Hoare triple {11498#(or (and (= (bvadd (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32))) (_ bv4294955004 32)) (_ bv0 32)) (= (_ bv0 32) ssl3_connect_~s.offset) (= (_ bv1 32) (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv28 32))))) (and (= (_ bv0 32) ssl3_connect_~s.offset) (= (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32))) (_ bv0 32))) (and (= (bvadd (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32))) (_ bv4294955004 32)) (_ bv0 32)) (= (_ bv0 32) ssl3_connect_~s.offset) (exists ((ssl3_connect_~tmp___0~1.offset (_ BitVec 32))) (and (= (_ bv0 32) (select (select |#memory_int| ssl3_connect_~s.base) ssl3_connect_~tmp___0~1.offset)) (not (= (bvadd ssl3_connect_~tmp___0~1.offset (_ bv4294967268 32)) ssl3_connect_~s.offset))))) (and (exists ((v_prenex_6 (_ BitVec 32)) (ssl3_connect_~tmp___0~1.base (_ BitVec 32))) (and (not (= ssl3_connect_~tmp___0~1.base ssl3_connect_~s.base)) (= (select (select |#memory_int| ssl3_connect_~tmp___0~1.base) v_prenex_6) (_ bv0 32)))) (= (_ bv0 32) ssl3_connect_~s.offset) (= (_ bv12292 32) (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32))))))} assume !(0bv32 != ~bvand32(12288bv32, ~tmp___1~0)); {11498#(or (and (= (bvadd (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32))) (_ bv4294955004 32)) (_ bv0 32)) (= (_ bv0 32) ssl3_connect_~s.offset) (= (_ bv1 32) (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv28 32))))) (and (= (_ bv0 32) ssl3_connect_~s.offset) (= (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32))) (_ bv0 32))) (and (= (bvadd (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32))) (_ bv4294955004 32)) (_ bv0 32)) (= (_ bv0 32) ssl3_connect_~s.offset) (exists ((ssl3_connect_~tmp___0~1.offset (_ BitVec 32))) (and (= (_ bv0 32) (select (select |#memory_int| ssl3_connect_~s.base) ssl3_connect_~tmp___0~1.offset)) (not (= (bvadd ssl3_connect_~tmp___0~1.offset (_ bv4294967268 32)) ssl3_connect_~s.offset))))) (and (exists ((v_prenex_6 (_ BitVec 32)) (ssl3_connect_~tmp___0~1.base (_ BitVec 32))) (and (not (= ssl3_connect_~tmp___0~1.base ssl3_connect_~s.base)) (= (select (select |#memory_int| ssl3_connect_~tmp___0~1.base) v_prenex_6) (_ bv0 32)))) (= (_ bv0 32) ssl3_connect_~s.offset) (= (_ bv12292 32) (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32))))))} is VALID [2018-11-23 10:58:55,221 INFO L273 TraceCheckUtils]: 11: Hoare triple {11498#(or (and (= (bvadd (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32))) (_ bv4294955004 32)) (_ bv0 32)) (= (_ bv0 32) ssl3_connect_~s.offset) (= (_ bv1 32) (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv28 32))))) (and (= (_ bv0 32) ssl3_connect_~s.offset) (= (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32))) (_ bv0 32))) (and (= (bvadd (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32))) (_ bv4294955004 32)) (_ bv0 32)) (= (_ bv0 32) ssl3_connect_~s.offset) (exists ((ssl3_connect_~tmp___0~1.offset (_ BitVec 32))) (and (= (_ bv0 32) (select (select |#memory_int| ssl3_connect_~s.base) ssl3_connect_~tmp___0~1.offset)) (not (= (bvadd ssl3_connect_~tmp___0~1.offset (_ bv4294967268 32)) ssl3_connect_~s.offset))))) (and (exists ((v_prenex_6 (_ BitVec 32)) (ssl3_connect_~tmp___0~1.base (_ BitVec 32))) (and (not (= ssl3_connect_~tmp___0~1.base ssl3_connect_~s.base)) (= (select (select |#memory_int| ssl3_connect_~tmp___0~1.base) v_prenex_6) (_ bv0 32)))) (= (_ bv0 32) ssl3_connect_~s.offset) (= (_ bv12292 32) (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32))))))} assume !false; {11498#(or (and (= (bvadd (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32))) (_ bv4294955004 32)) (_ bv0 32)) (= (_ bv0 32) ssl3_connect_~s.offset) (= (_ bv1 32) (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv28 32))))) (and (= (_ bv0 32) ssl3_connect_~s.offset) (= (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32))) (_ bv0 32))) (and (= (bvadd (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32))) (_ bv4294955004 32)) (_ bv0 32)) (= (_ bv0 32) ssl3_connect_~s.offset) (exists ((ssl3_connect_~tmp___0~1.offset (_ BitVec 32))) (and (= (_ bv0 32) (select (select |#memory_int| ssl3_connect_~s.base) ssl3_connect_~tmp___0~1.offset)) (not (= (bvadd ssl3_connect_~tmp___0~1.offset (_ bv4294967268 32)) ssl3_connect_~s.offset))))) (and (exists ((v_prenex_6 (_ BitVec 32)) (ssl3_connect_~tmp___0~1.base (_ BitVec 32))) (and (not (= ssl3_connect_~tmp___0~1.base ssl3_connect_~s.base)) (= (select (select |#memory_int| ssl3_connect_~tmp___0~1.base) v_prenex_6) (_ bv0 32)))) (= (_ bv0 32) ssl3_connect_~s.offset) (= (_ bv12292 32) (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32))))))} is VALID [2018-11-23 10:58:55,225 INFO L273 TraceCheckUtils]: 12: Hoare triple {11498#(or (and (= (bvadd (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32))) (_ bv4294955004 32)) (_ bv0 32)) (= (_ bv0 32) ssl3_connect_~s.offset) (= (_ bv1 32) (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv28 32))))) (and (= (_ bv0 32) ssl3_connect_~s.offset) (= (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32))) (_ bv0 32))) (and (= (bvadd (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32))) (_ bv4294955004 32)) (_ bv0 32)) (= (_ bv0 32) ssl3_connect_~s.offset) (exists ((ssl3_connect_~tmp___0~1.offset (_ BitVec 32))) (and (= (_ bv0 32) (select (select |#memory_int| ssl3_connect_~s.base) ssl3_connect_~tmp___0~1.offset)) (not (= (bvadd ssl3_connect_~tmp___0~1.offset (_ bv4294967268 32)) ssl3_connect_~s.offset))))) (and (exists ((v_prenex_6 (_ BitVec 32)) (ssl3_connect_~tmp___0~1.base (_ BitVec 32))) (and (not (= ssl3_connect_~tmp___0~1.base ssl3_connect_~s.base)) (= (select (select |#memory_int| ssl3_connect_~tmp___0~1.base) v_prenex_6) (_ bv0 32)))) (= (_ bv0 32) ssl3_connect_~s.offset) (= (_ bv12292 32) (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32))))))} call #t~mem28 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32);~state~0 := #t~mem28;havoc #t~mem28;call #t~mem29 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {11508#(or (and (exists ((v_prenex_6 (_ BitVec 32)) (ssl3_connect_~tmp___0~1.base (_ BitVec 32))) (and (not (= ssl3_connect_~tmp___0~1.base ssl3_connect_~s.base)) (= (select (select |#memory_int| ssl3_connect_~tmp___0~1.base) v_prenex_6) (_ bv0 32)))) (= |ssl3_connect_#t~mem29| (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32)))) (= (_ bv0 32) ssl3_connect_~s.offset) (= (_ bv12292 32) (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32))))) (and (= |ssl3_connect_#t~mem29| (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32)))) (= (bvadd (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32))) (_ bv4294955004 32)) (_ bv0 32)) (= (_ bv0 32) ssl3_connect_~s.offset) (exists ((ssl3_connect_~tmp___0~1.offset (_ BitVec 32))) (and (= (_ bv0 32) (select (select |#memory_int| ssl3_connect_~s.base) ssl3_connect_~tmp___0~1.offset)) (not (= (bvadd ssl3_connect_~tmp___0~1.offset (_ bv4294967268 32)) ssl3_connect_~s.offset))))) (and (= |ssl3_connect_#t~mem29| (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32)))) (= (_ bv0 32) ssl3_connect_~s.offset) (= (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32))) (_ bv0 32))) (and (= |ssl3_connect_#t~mem29| (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32)))) (= (bvadd (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32))) (_ bv4294955004 32)) (_ bv0 32)) (= (_ bv0 32) ssl3_connect_~s.offset) (= (_ bv1 32) (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv28 32))))))} is VALID [2018-11-23 10:58:55,227 INFO L273 TraceCheckUtils]: 13: Hoare triple {11508#(or (and (exists ((v_prenex_6 (_ BitVec 32)) (ssl3_connect_~tmp___0~1.base (_ BitVec 32))) (and (not (= ssl3_connect_~tmp___0~1.base ssl3_connect_~s.base)) (= (select (select |#memory_int| ssl3_connect_~tmp___0~1.base) v_prenex_6) (_ bv0 32)))) (= |ssl3_connect_#t~mem29| (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32)))) (= (_ bv0 32) ssl3_connect_~s.offset) (= (_ bv12292 32) (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32))))) (and (= |ssl3_connect_#t~mem29| (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32)))) (= (bvadd (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32))) (_ bv4294955004 32)) (_ bv0 32)) (= (_ bv0 32) ssl3_connect_~s.offset) (exists ((ssl3_connect_~tmp___0~1.offset (_ BitVec 32))) (and (= (_ bv0 32) (select (select |#memory_int| ssl3_connect_~s.base) ssl3_connect_~tmp___0~1.offset)) (not (= (bvadd ssl3_connect_~tmp___0~1.offset (_ bv4294967268 32)) ssl3_connect_~s.offset))))) (and (= |ssl3_connect_#t~mem29| (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32)))) (= (_ bv0 32) ssl3_connect_~s.offset) (= (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32))) (_ bv0 32))) (and (= |ssl3_connect_#t~mem29| (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32)))) (= (bvadd (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32))) (_ bv4294955004 32)) (_ bv0 32)) (= (_ bv0 32) ssl3_connect_~s.offset) (= (_ bv1 32) (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv28 32))))))} assume !(12292bv32 == #t~mem29);havoc #t~mem29;call #t~mem30 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {11512#(and (= (_ bv0 32) ssl3_connect_~s.offset) (= (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32))) (_ bv0 32)))} is VALID [2018-11-23 10:58:55,228 INFO L273 TraceCheckUtils]: 14: Hoare triple {11512#(and (= (_ bv0 32) ssl3_connect_~s.offset) (= (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32))) (_ bv0 32)))} assume !(16384bv32 == #t~mem30);havoc #t~mem30;call #t~mem31 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {11512#(and (= (_ bv0 32) ssl3_connect_~s.offset) (= (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32))) (_ bv0 32)))} is VALID [2018-11-23 10:58:55,229 INFO L273 TraceCheckUtils]: 15: Hoare triple {11512#(and (= (_ bv0 32) ssl3_connect_~s.offset) (= (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32))) (_ bv0 32)))} assume !(4096bv32 == #t~mem31);havoc #t~mem31;call #t~mem32 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {11512#(and (= (_ bv0 32) ssl3_connect_~s.offset) (= (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32))) (_ bv0 32)))} is VALID [2018-11-23 10:58:55,231 INFO L273 TraceCheckUtils]: 16: Hoare triple {11512#(and (= (_ bv0 32) ssl3_connect_~s.offset) (= (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32))) (_ bv0 32)))} assume !(20480bv32 == #t~mem32);havoc #t~mem32;call #t~mem33 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {11512#(and (= (_ bv0 32) ssl3_connect_~s.offset) (= (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32))) (_ bv0 32)))} is VALID [2018-11-23 10:58:55,232 INFO L273 TraceCheckUtils]: 17: Hoare triple {11512#(and (= (_ bv0 32) ssl3_connect_~s.offset) (= (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32))) (_ bv0 32)))} assume !(4099bv32 == #t~mem33);havoc #t~mem33;call #t~mem34 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {11512#(and (= (_ bv0 32) ssl3_connect_~s.offset) (= (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32))) (_ bv0 32)))} is VALID [2018-11-23 10:58:55,233 INFO L273 TraceCheckUtils]: 18: Hoare triple {11512#(and (= (_ bv0 32) ssl3_connect_~s.offset) (= (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32))) (_ bv0 32)))} assume !(4368bv32 == #t~mem34);havoc #t~mem34;call #t~mem35 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {11528#(= |ssl3_connect_#t~mem35| (_ bv0 32))} is VALID [2018-11-23 10:58:55,234 INFO L273 TraceCheckUtils]: 19: Hoare triple {11528#(= |ssl3_connect_#t~mem35| (_ bv0 32))} assume 4369bv32 == #t~mem35;havoc #t~mem35; {11464#false} is VALID [2018-11-23 10:58:55,234 INFO L273 TraceCheckUtils]: 20: Hoare triple {11464#false} call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(48bv32, ~s.offset), 4bv32);~ret~0 := #t~nondet69;havoc #t~nondet69; {11464#false} is VALID [2018-11-23 10:58:55,235 INFO L273 TraceCheckUtils]: 21: Hoare triple {11464#false} assume 0bv32 == ~blastFlag~0;~blastFlag~0 := 1bv32; {11464#false} is VALID [2018-11-23 10:58:55,235 INFO L273 TraceCheckUtils]: 22: Hoare triple {11464#false} assume !~bvsle32(~ret~0, 0bv32);call write~intINTTYPE4(4384bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32);call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(64bv32, ~s.offset), 4bv32);call #t~mem70.base, #t~mem70.offset := read~$Pointer$(~s.base, ~bvadd32(20bv32, ~s.offset), 4bv32);call #t~mem71.base, #t~mem71.offset := read~$Pointer$(~s.base, ~bvadd32(16bv32, ~s.offset), 4bv32); {11464#false} is VALID [2018-11-23 10:58:55,235 INFO L273 TraceCheckUtils]: 23: Hoare triple {11464#false} assume ~bvadd32(#t~mem70.base, #t~mem70.offset) != ~bvadd32(#t~mem71.base, #t~mem71.offset);havoc #t~mem71.base, #t~mem71.offset;havoc #t~mem70.base, #t~mem70.offset; {11464#false} is VALID [2018-11-23 10:58:55,235 INFO L273 TraceCheckUtils]: 24: Hoare triple {11464#false} call #t~mem127.base, #t~mem127.offset := read~$Pointer$(~s.base, ~bvadd32(84bv32, ~s.offset), 4bv32);call #t~mem128 := read~intINTTYPE4(#t~mem127.base, ~bvadd32(848bv32, #t~mem127.offset), 4bv32); {11464#false} is VALID [2018-11-23 10:58:55,236 INFO L273 TraceCheckUtils]: 25: Hoare triple {11464#false} assume !(0bv32 == #t~mem128);havoc #t~mem127.base, #t~mem127.offset;havoc #t~mem128; {11464#false} is VALID [2018-11-23 10:58:55,236 INFO L273 TraceCheckUtils]: 26: Hoare triple {11464#false} ~skip~0 := 0bv32; {11464#false} is VALID [2018-11-23 10:58:55,236 INFO L273 TraceCheckUtils]: 27: Hoare triple {11464#false} assume !false; {11464#false} is VALID [2018-11-23 10:58:55,237 INFO L273 TraceCheckUtils]: 28: Hoare triple {11464#false} call #t~mem28 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32);~state~0 := #t~mem28;havoc #t~mem28;call #t~mem29 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {11464#false} is VALID [2018-11-23 10:58:55,237 INFO L273 TraceCheckUtils]: 29: Hoare triple {11464#false} assume !(12292bv32 == #t~mem29);havoc #t~mem29;call #t~mem30 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {11464#false} is VALID [2018-11-23 10:58:55,237 INFO L273 TraceCheckUtils]: 30: Hoare triple {11464#false} assume !(16384bv32 == #t~mem30);havoc #t~mem30;call #t~mem31 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {11464#false} is VALID [2018-11-23 10:58:55,237 INFO L273 TraceCheckUtils]: 31: Hoare triple {11464#false} assume !(4096bv32 == #t~mem31);havoc #t~mem31;call #t~mem32 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {11464#false} is VALID [2018-11-23 10:58:55,238 INFO L273 TraceCheckUtils]: 32: Hoare triple {11464#false} assume !(20480bv32 == #t~mem32);havoc #t~mem32;call #t~mem33 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {11464#false} is VALID [2018-11-23 10:58:55,238 INFO L273 TraceCheckUtils]: 33: Hoare triple {11464#false} assume !(4099bv32 == #t~mem33);havoc #t~mem33;call #t~mem34 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {11464#false} is VALID [2018-11-23 10:58:55,238 INFO L273 TraceCheckUtils]: 34: Hoare triple {11464#false} assume !(4368bv32 == #t~mem34);havoc #t~mem34;call #t~mem35 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {11464#false} is VALID [2018-11-23 10:58:55,238 INFO L273 TraceCheckUtils]: 35: Hoare triple {11464#false} assume !(4369bv32 == #t~mem35);havoc #t~mem35;call #t~mem36 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {11464#false} is VALID [2018-11-23 10:58:55,239 INFO L273 TraceCheckUtils]: 36: Hoare triple {11464#false} assume 4384bv32 == #t~mem36;havoc #t~mem36; {11464#false} is VALID [2018-11-23 10:58:55,239 INFO L273 TraceCheckUtils]: 37: Hoare triple {11464#false} ~ret~0 := #t~nondet72;havoc #t~nondet72; {11464#false} is VALID [2018-11-23 10:58:55,239 INFO L273 TraceCheckUtils]: 38: Hoare triple {11464#false} assume 1bv32 == ~blastFlag~0;~blastFlag~0 := 2bv32; {11464#false} is VALID [2018-11-23 10:58:55,239 INFO L273 TraceCheckUtils]: 39: Hoare triple {11464#false} assume !~bvsle32(~ret~0, 0bv32);call #t~mem73 := read~intINTTYPE4(~s.base, ~bvadd32(92bv32, ~s.offset), 4bv32); {11464#false} is VALID [2018-11-23 10:58:55,239 INFO L273 TraceCheckUtils]: 40: Hoare triple {11464#false} assume 0bv32 != #t~mem73;havoc #t~mem73;call write~intINTTYPE4(4560bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {11464#false} is VALID [2018-11-23 10:58:55,239 INFO L273 TraceCheckUtils]: 41: Hoare triple {11464#false} call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(64bv32, ~s.offset), 4bv32); {11464#false} is VALID [2018-11-23 10:58:55,240 INFO L273 TraceCheckUtils]: 42: Hoare triple {11464#false} call #t~mem127.base, #t~mem127.offset := read~$Pointer$(~s.base, ~bvadd32(84bv32, ~s.offset), 4bv32);call #t~mem128 := read~intINTTYPE4(#t~mem127.base, ~bvadd32(848bv32, #t~mem127.offset), 4bv32); {11464#false} is VALID [2018-11-23 10:58:55,240 INFO L273 TraceCheckUtils]: 43: Hoare triple {11464#false} assume !(0bv32 == #t~mem128);havoc #t~mem127.base, #t~mem127.offset;havoc #t~mem128; {11464#false} is VALID [2018-11-23 10:58:55,240 INFO L273 TraceCheckUtils]: 44: Hoare triple {11464#false} ~skip~0 := 0bv32; {11464#false} is VALID [2018-11-23 10:58:55,240 INFO L273 TraceCheckUtils]: 45: Hoare triple {11464#false} assume !false; {11464#false} is VALID [2018-11-23 10:58:55,240 INFO L273 TraceCheckUtils]: 46: Hoare triple {11464#false} call #t~mem28 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32);~state~0 := #t~mem28;havoc #t~mem28;call #t~mem29 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {11464#false} is VALID [2018-11-23 10:58:55,241 INFO L273 TraceCheckUtils]: 47: Hoare triple {11464#false} assume !(12292bv32 == #t~mem29);havoc #t~mem29;call #t~mem30 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {11464#false} is VALID [2018-11-23 10:58:55,241 INFO L273 TraceCheckUtils]: 48: Hoare triple {11464#false} assume !(16384bv32 == #t~mem30);havoc #t~mem30;call #t~mem31 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {11464#false} is VALID [2018-11-23 10:58:55,241 INFO L273 TraceCheckUtils]: 49: Hoare triple {11464#false} assume !(4096bv32 == #t~mem31);havoc #t~mem31;call #t~mem32 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {11464#false} is VALID [2018-11-23 10:58:55,241 INFO L273 TraceCheckUtils]: 50: Hoare triple {11464#false} assume !(20480bv32 == #t~mem32);havoc #t~mem32;call #t~mem33 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {11464#false} is VALID [2018-11-23 10:58:55,241 INFO L273 TraceCheckUtils]: 51: Hoare triple {11464#false} assume !(4099bv32 == #t~mem33);havoc #t~mem33;call #t~mem34 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {11464#false} is VALID [2018-11-23 10:58:55,241 INFO L273 TraceCheckUtils]: 52: Hoare triple {11464#false} assume !(4368bv32 == #t~mem34);havoc #t~mem34;call #t~mem35 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {11464#false} is VALID [2018-11-23 10:58:55,242 INFO L273 TraceCheckUtils]: 53: Hoare triple {11464#false} assume !(4369bv32 == #t~mem35);havoc #t~mem35;call #t~mem36 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {11464#false} is VALID [2018-11-23 10:58:55,242 INFO L273 TraceCheckUtils]: 54: Hoare triple {11464#false} assume !(4384bv32 == #t~mem36);havoc #t~mem36;call #t~mem37 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {11464#false} is VALID [2018-11-23 10:58:55,242 INFO L273 TraceCheckUtils]: 55: Hoare triple {11464#false} assume !(4385bv32 == #t~mem37);havoc #t~mem37;call #t~mem38 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {11464#false} is VALID [2018-11-23 10:58:55,242 INFO L273 TraceCheckUtils]: 56: Hoare triple {11464#false} assume 4400bv32 == #t~mem38;havoc #t~mem38; {11464#false} is VALID [2018-11-23 10:58:55,243 INFO L273 TraceCheckUtils]: 57: Hoare triple {11464#false} call #t~mem74.base, #t~mem74.offset := read~$Pointer$(~s.base, ~bvadd32(84bv32, ~s.offset), 4bv32);call #t~mem75.base, #t~mem75.offset := read~$Pointer$(#t~mem74.base, ~bvadd32(836bv32, #t~mem74.offset), 4bv32);call #t~mem76 := read~intINTTYPE4(#t~mem75.base, ~bvadd32(12bv32, #t~mem75.offset), 4bv32); {11464#false} is VALID [2018-11-23 10:58:55,243 INFO L273 TraceCheckUtils]: 58: Hoare triple {11464#false} assume !(0bv32 != ~bvand32(256bv32, #t~mem76));havoc #t~mem76;havoc #t~mem75.base, #t~mem75.offset;havoc #t~mem74.base, #t~mem74.offset;~ret~0 := #t~nondet77;havoc #t~nondet77; {11464#false} is VALID [2018-11-23 10:58:55,243 INFO L273 TraceCheckUtils]: 59: Hoare triple {11464#false} assume 2bv32 == ~blastFlag~0;~blastFlag~0 := 3bv32; {11464#false} is VALID [2018-11-23 10:58:55,244 INFO L273 TraceCheckUtils]: 60: Hoare triple {11464#false} assume !~bvsle32(~ret~0, 0bv32); {11464#false} is VALID [2018-11-23 10:58:55,244 INFO L273 TraceCheckUtils]: 61: Hoare triple {11464#false} call write~intINTTYPE4(4416bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32);call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(64bv32, ~s.offset), 4bv32); {11464#false} is VALID [2018-11-23 10:58:55,244 INFO L273 TraceCheckUtils]: 62: Hoare triple {11464#false} call #t~mem127.base, #t~mem127.offset := read~$Pointer$(~s.base, ~bvadd32(84bv32, ~s.offset), 4bv32);call #t~mem128 := read~intINTTYPE4(#t~mem127.base, ~bvadd32(848bv32, #t~mem127.offset), 4bv32); {11464#false} is VALID [2018-11-23 10:58:55,244 INFO L273 TraceCheckUtils]: 63: Hoare triple {11464#false} assume !(0bv32 == #t~mem128);havoc #t~mem127.base, #t~mem127.offset;havoc #t~mem128; {11464#false} is VALID [2018-11-23 10:58:55,244 INFO L273 TraceCheckUtils]: 64: Hoare triple {11464#false} ~skip~0 := 0bv32; {11464#false} is VALID [2018-11-23 10:58:55,245 INFO L273 TraceCheckUtils]: 65: Hoare triple {11464#false} assume !false; {11464#false} is VALID [2018-11-23 10:58:55,245 INFO L273 TraceCheckUtils]: 66: Hoare triple {11464#false} call #t~mem28 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32);~state~0 := #t~mem28;havoc #t~mem28;call #t~mem29 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {11464#false} is VALID [2018-11-23 10:58:55,245 INFO L273 TraceCheckUtils]: 67: Hoare triple {11464#false} assume !(12292bv32 == #t~mem29);havoc #t~mem29;call #t~mem30 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {11464#false} is VALID [2018-11-23 10:58:55,246 INFO L273 TraceCheckUtils]: 68: Hoare triple {11464#false} assume !(16384bv32 == #t~mem30);havoc #t~mem30;call #t~mem31 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {11464#false} is VALID [2018-11-23 10:58:55,246 INFO L273 TraceCheckUtils]: 69: Hoare triple {11464#false} assume !(4096bv32 == #t~mem31);havoc #t~mem31;call #t~mem32 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {11464#false} is VALID [2018-11-23 10:58:55,246 INFO L273 TraceCheckUtils]: 70: Hoare triple {11464#false} assume !(20480bv32 == #t~mem32);havoc #t~mem32;call #t~mem33 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {11464#false} is VALID [2018-11-23 10:58:55,246 INFO L273 TraceCheckUtils]: 71: Hoare triple {11464#false} assume !(4099bv32 == #t~mem33);havoc #t~mem33;call #t~mem34 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {11464#false} is VALID [2018-11-23 10:58:55,246 INFO L273 TraceCheckUtils]: 72: Hoare triple {11464#false} assume !(4368bv32 == #t~mem34);havoc #t~mem34;call #t~mem35 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {11464#false} is VALID [2018-11-23 10:58:55,247 INFO L273 TraceCheckUtils]: 73: Hoare triple {11464#false} assume !(4369bv32 == #t~mem35);havoc #t~mem35;call #t~mem36 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {11464#false} is VALID [2018-11-23 10:58:55,247 INFO L273 TraceCheckUtils]: 74: Hoare triple {11464#false} assume !(4384bv32 == #t~mem36);havoc #t~mem36;call #t~mem37 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {11464#false} is VALID [2018-11-23 10:58:55,247 INFO L273 TraceCheckUtils]: 75: Hoare triple {11464#false} assume !(4385bv32 == #t~mem37);havoc #t~mem37;call #t~mem38 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {11464#false} is VALID [2018-11-23 10:58:55,247 INFO L273 TraceCheckUtils]: 76: Hoare triple {11464#false} assume !(4400bv32 == #t~mem38);havoc #t~mem38;call #t~mem39 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {11464#false} is VALID [2018-11-23 10:58:55,248 INFO L273 TraceCheckUtils]: 77: Hoare triple {11464#false} assume !(4401bv32 == #t~mem39);havoc #t~mem39;call #t~mem40 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {11464#false} is VALID [2018-11-23 10:58:55,248 INFO L273 TraceCheckUtils]: 78: Hoare triple {11464#false} assume 4416bv32 == #t~mem40;havoc #t~mem40; {11464#false} is VALID [2018-11-23 10:58:55,248 INFO L273 TraceCheckUtils]: 79: Hoare triple {11464#false} ~ret~0 := #t~nondet78;havoc #t~nondet78; {11464#false} is VALID [2018-11-23 10:58:55,248 INFO L273 TraceCheckUtils]: 80: Hoare triple {11464#false} assume 3bv32 == ~blastFlag~0;~blastFlag~0 := 4bv32; {11464#false} is VALID [2018-11-23 10:58:55,249 INFO L273 TraceCheckUtils]: 81: Hoare triple {11464#false} assume !~bvsle32(~ret~0, 0bv32);call write~intINTTYPE4(4432bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32);call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(64bv32, ~s.offset), 4bv32); {11464#false} is VALID [2018-11-23 10:58:55,249 INFO L273 TraceCheckUtils]: 82: Hoare triple {11464#false} assume !(0bv32 == ~tmp___6~0); {11464#false} is VALID [2018-11-23 10:58:55,249 INFO L273 TraceCheckUtils]: 83: Hoare triple {11464#false} call #t~mem127.base, #t~mem127.offset := read~$Pointer$(~s.base, ~bvadd32(84bv32, ~s.offset), 4bv32);call #t~mem128 := read~intINTTYPE4(#t~mem127.base, ~bvadd32(848bv32, #t~mem127.offset), 4bv32); {11464#false} is VALID [2018-11-23 10:58:55,249 INFO L273 TraceCheckUtils]: 84: Hoare triple {11464#false} assume !(0bv32 == #t~mem128);havoc #t~mem127.base, #t~mem127.offset;havoc #t~mem128; {11464#false} is VALID [2018-11-23 10:58:55,250 INFO L273 TraceCheckUtils]: 85: Hoare triple {11464#false} ~skip~0 := 0bv32; {11464#false} is VALID [2018-11-23 10:58:55,250 INFO L273 TraceCheckUtils]: 86: Hoare triple {11464#false} assume !false; {11464#false} is VALID [2018-11-23 10:58:55,250 INFO L273 TraceCheckUtils]: 87: Hoare triple {11464#false} call #t~mem28 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32);~state~0 := #t~mem28;havoc #t~mem28;call #t~mem29 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {11464#false} is VALID [2018-11-23 10:58:55,250 INFO L273 TraceCheckUtils]: 88: Hoare triple {11464#false} assume !(12292bv32 == #t~mem29);havoc #t~mem29;call #t~mem30 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {11464#false} is VALID [2018-11-23 10:58:55,251 INFO L273 TraceCheckUtils]: 89: Hoare triple {11464#false} assume !(16384bv32 == #t~mem30);havoc #t~mem30;call #t~mem31 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {11464#false} is VALID [2018-11-23 10:58:55,251 INFO L273 TraceCheckUtils]: 90: Hoare triple {11464#false} assume !(4096bv32 == #t~mem31);havoc #t~mem31;call #t~mem32 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {11464#false} is VALID [2018-11-23 10:58:55,251 INFO L273 TraceCheckUtils]: 91: Hoare triple {11464#false} assume !(20480bv32 == #t~mem32);havoc #t~mem32;call #t~mem33 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {11464#false} is VALID [2018-11-23 10:58:55,251 INFO L273 TraceCheckUtils]: 92: Hoare triple {11464#false} assume !(4099bv32 == #t~mem33);havoc #t~mem33;call #t~mem34 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {11464#false} is VALID [2018-11-23 10:58:55,251 INFO L273 TraceCheckUtils]: 93: Hoare triple {11464#false} assume !(4368bv32 == #t~mem34);havoc #t~mem34;call #t~mem35 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {11464#false} is VALID [2018-11-23 10:58:55,252 INFO L273 TraceCheckUtils]: 94: Hoare triple {11464#false} assume !(4369bv32 == #t~mem35);havoc #t~mem35;call #t~mem36 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {11464#false} is VALID [2018-11-23 10:58:55,252 INFO L273 TraceCheckUtils]: 95: Hoare triple {11464#false} assume !(4384bv32 == #t~mem36);havoc #t~mem36;call #t~mem37 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {11464#false} is VALID [2018-11-23 10:58:55,252 INFO L273 TraceCheckUtils]: 96: Hoare triple {11464#false} assume !(4385bv32 == #t~mem37);havoc #t~mem37;call #t~mem38 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {11464#false} is VALID [2018-11-23 10:58:55,252 INFO L273 TraceCheckUtils]: 97: Hoare triple {11464#false} assume !(4400bv32 == #t~mem38);havoc #t~mem38;call #t~mem39 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {11464#false} is VALID [2018-11-23 10:58:55,252 INFO L273 TraceCheckUtils]: 98: Hoare triple {11464#false} assume !(4401bv32 == #t~mem39);havoc #t~mem39;call #t~mem40 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {11464#false} is VALID [2018-11-23 10:58:55,252 INFO L273 TraceCheckUtils]: 99: Hoare triple {11464#false} assume !(4416bv32 == #t~mem40);havoc #t~mem40;call #t~mem41 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {11464#false} is VALID [2018-11-23 10:58:55,253 INFO L273 TraceCheckUtils]: 100: Hoare triple {11464#false} assume !(4417bv32 == #t~mem41);havoc #t~mem41;call #t~mem42 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {11464#false} is VALID [2018-11-23 10:58:55,253 INFO L273 TraceCheckUtils]: 101: Hoare triple {11464#false} assume 4432bv32 == #t~mem42;havoc #t~mem42; {11464#false} is VALID [2018-11-23 10:58:55,253 INFO L273 TraceCheckUtils]: 102: Hoare triple {11464#false} ~ret~0 := #t~nondet79;havoc #t~nondet79; {11464#false} is VALID [2018-11-23 10:58:55,253 INFO L273 TraceCheckUtils]: 103: Hoare triple {11464#false} assume 4bv32 == ~blastFlag~0; {11464#false} is VALID [2018-11-23 10:58:55,253 INFO L273 TraceCheckUtils]: 104: Hoare triple {11464#false} assume !false; {11464#false} is VALID [2018-11-23 10:58:55,274 INFO L134 CoverageAnalysis]: Checked inductivity of 122 backedges. 36 proven. 0 refuted. 0 times theorem prover too weak. 86 trivial. 0 not checked. [2018-11-23 10:58:55,275 INFO L312 TraceCheckSpWp]: Omiting computation of backward sequence because forward sequence was already perfect [2018-11-23 10:58:55,278 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 10:58:55,278 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [9] imperfect sequences [] total 9 [2018-11-23 10:58:55,278 INFO L78 Accepts]: Start accepts. Automaton has 9 states. Word has length 105 [2018-11-23 10:58:55,279 INFO L84 Accepts]: Finished accepts. word is accepted. [2018-11-23 10:58:55,279 INFO L86 InductivityCheck]: Starting indutivity check of a Floyd-Hoare automaton with 9 states. [2018-11-23 10:58:55,422 INFO L119 InductivityCheck]: Floyd-Hoare automaton has 63 edges. 63 inductive. 0 not inductive. 0 times theorem prover too weak to decide inductivity. [2018-11-23 10:58:55,422 INFO L459 AbstractCegarLoop]: Interpolant automaton has 9 states [2018-11-23 10:58:55,422 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 9 interpolants. [2018-11-23 10:58:55,423 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=18, Invalid=54, Unknown=0, NotChecked=0, Total=72 [2018-11-23 10:58:55,423 INFO L87 Difference]: Start difference. First operand 529 states and 781 transitions. Second operand 9 states. [2018-11-23 10:59:07,023 WARN L180 SmtUtils]: Spent 103.00 ms on a formula simplification that was a NOOP. DAG size: 46 [2018-11-23 10:59:07,519 WARN L180 SmtUtils]: Spent 127.00 ms on a formula simplification that was a NOOP. DAG size: 48 [2018-11-23 10:59:33,622 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 10:59:33,623 INFO L93 Difference]: Finished difference Result 1010 states and 1491 transitions. [2018-11-23 10:59:33,623 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 9 states. [2018-11-23 10:59:33,623 INFO L78 Accepts]: Start accepts. Automaton has 9 states. Word has length 105 [2018-11-23 10:59:33,623 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 10:59:33,623 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 9 states. [2018-11-23 10:59:33,627 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 9 states to 9 states and 451 transitions. [2018-11-23 10:59:33,627 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 9 states. [2018-11-23 10:59:33,630 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 9 states to 9 states and 451 transitions. [2018-11-23 10:59:33,630 INFO L86 InductivityCheck]: Starting indutivity check of a Floyd-Hoare automaton with 9 states and 451 transitions. [2018-11-23 10:59:34,652 INFO L119 InductivityCheck]: Floyd-Hoare automaton has 451 edges. 451 inductive. 0 not inductive. 0 times theorem prover too weak to decide inductivity. [2018-11-23 10:59:34,671 INFO L225 Difference]: With dead ends: 1010 [2018-11-23 10:59:34,671 INFO L226 Difference]: Without dead ends: 601 [2018-11-23 10:59:34,672 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 109 GetRequests, 97 SyntacticMatches, 0 SemanticMatches, 12 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 10 ImplicationChecksByTransitivity, 1.3s TimeCoverageRelationStatistics Valid=50, Invalid=132, Unknown=0, NotChecked=0, Total=182 [2018-11-23 10:59:34,673 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 601 states. [2018-11-23 10:59:34,852 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 601 to 530. [2018-11-23 10:59:34,852 INFO L214 AbstractMinimizeNwa]: Start testing correctness of minimizeSevpa [2018-11-23 10:59:34,852 INFO L82 GeneralOperation]: Start isEquivalent. First operand 601 states. Second operand 530 states. [2018-11-23 10:59:34,852 INFO L74 IsIncluded]: Start isIncluded. First operand 601 states. Second operand 530 states. [2018-11-23 10:59:34,853 INFO L87 Difference]: Start difference. First operand 601 states. Second operand 530 states. [2018-11-23 10:59:34,871 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 10:59:34,871 INFO L93 Difference]: Finished difference Result 601 states and 885 transitions. [2018-11-23 10:59:34,871 INFO L276 IsEmpty]: Start isEmpty. Operand 601 states and 885 transitions. [2018-11-23 10:59:34,872 INFO L282 IsEmpty]: Finished isEmpty. No accepting run. [2018-11-23 10:59:34,873 INFO L83 IsIncluded]: Finished isIncluded. Language is included [2018-11-23 10:59:34,873 INFO L74 IsIncluded]: Start isIncluded. First operand 530 states. Second operand 601 states. [2018-11-23 10:59:34,873 INFO L87 Difference]: Start difference. First operand 530 states. Second operand 601 states. [2018-11-23 10:59:34,891 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 10:59:34,892 INFO L93 Difference]: Finished difference Result 601 states and 885 transitions. [2018-11-23 10:59:34,892 INFO L276 IsEmpty]: Start isEmpty. Operand 601 states and 885 transitions. [2018-11-23 10:59:34,893 INFO L282 IsEmpty]: Finished isEmpty. No accepting run. [2018-11-23 10:59:34,893 INFO L83 IsIncluded]: Finished isIncluded. Language is included [2018-11-23 10:59:34,893 INFO L88 GeneralOperation]: Finished isEquivalent. [2018-11-23 10:59:34,894 INFO L221 AbstractMinimizeNwa]: Finished testing correctness of minimizeSevpa [2018-11-23 10:59:34,894 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 530 states. [2018-11-23 10:59:34,912 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 530 states to 530 states and 782 transitions. [2018-11-23 10:59:34,913 INFO L78 Accepts]: Start accepts. Automaton has 530 states and 782 transitions. Word has length 105 [2018-11-23 10:59:34,913 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 10:59:34,913 INFO L480 AbstractCegarLoop]: Abstraction has 530 states and 782 transitions. [2018-11-23 10:59:34,913 INFO L481 AbstractCegarLoop]: Interpolant automaton has 9 states. [2018-11-23 10:59:34,913 INFO L276 IsEmpty]: Start isEmpty. Operand 530 states and 782 transitions. [2018-11-23 10:59:34,915 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 119 [2018-11-23 10:59:34,915 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 10:59:34,916 INFO L402 BasicCegarLoop]: trace histogram [6, 6, 5, 5, 5, 5, 5, 5, 5, 5, 4, 4, 3, 3, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 10:59:34,916 INFO L423 AbstractCegarLoop]: === Iteration 7 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 10:59:34,916 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 10:59:34,916 INFO L82 PathProgramCache]: Analyzing trace with hash -480842948, now seen corresponding path program 1 times [2018-11-23 10:59:34,917 INFO L223 ckRefinementStrategy]: Switched to mode CVC4_FPBP [2018-11-23 10:59:34,917 INFO L69 tionRefinementEngine]: Using refinement strategy WolfRefinementStrategy No working directory specified, using /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/cvc4nyu Starting monitored process 8 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk (exit command is (exit), workingDir is null) Waiting until toolchain timeout for monitored process 8 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk [2018-11-23 10:59:34,947 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 10:59:47,249 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 10:59:47,958 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 10:59:47,962 INFO L273 TraceCheckSpWp]: Computing forward predicates... [2018-11-23 10:59:48,061 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 2, 1 stores, 1 select indices, 1 select index equivalence classes, 0 disjoint index pairs (out of 0 index pairs), introduced 1 new quantified variables, introduced 0 case distinctions, treesize of input 13 treesize of output 10 [2018-11-23 10:59:48,067 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 1, 1 stores, 0 select indices, 0 select index equivalence classes, 0 disjoint index pairs (out of 0 index pairs), introduced 0 new quantified variables, introduced 0 case distinctions, treesize of input 10 treesize of output 9 [2018-11-23 10:59:48,071 INFO L267 ElimStorePlain]: Start of recursive call 3: End of recursive call: and 1 xjuncts. [2018-11-23 10:59:48,073 INFO L267 ElimStorePlain]: Start of recursive call 2: 1 dim-1 vars, End of recursive call: and 1 xjuncts. [2018-11-23 10:59:48,081 INFO L267 ElimStorePlain]: Start of recursive call 1: 1 dim-2 vars, End of recursive call: and 1 xjuncts. [2018-11-23 10:59:48,082 INFO L202 ElimStorePlain]: Needed 3 recursive calls to eliminate 1 variables, input treesize:17, output treesize:13 [2018-11-23 10:59:48,122 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 2, 1 stores, 1 select indices, 1 select index equivalence classes, 0 disjoint index pairs (out of 0 index pairs), introduced 1 new quantified variables, introduced 0 case distinctions, treesize of input 23 treesize of output 18 [2018-11-23 10:59:48,131 INFO L701 Elim1Store]: detected not equals via solver [2018-11-23 10:59:48,132 INFO L701 Elim1Store]: detected not equals via solver [2018-11-23 10:59:48,133 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 1, 1 stores, 1 select indices, 1 select index equivalence classes, 2 disjoint index pairs (out of 0 index pairs), introduced 0 new quantified variables, introduced 0 case distinctions, treesize of input 18 treesize of output 37 [2018-11-23 10:59:48,135 INFO L267 ElimStorePlain]: Start of recursive call 3: End of recursive call: and 1 xjuncts. [2018-11-23 10:59:48,148 INFO L267 ElimStorePlain]: Start of recursive call 2: 1 dim-1 vars, End of recursive call: and 1 xjuncts. [2018-11-23 10:59:48,161 INFO L267 ElimStorePlain]: Start of recursive call 1: 1 dim-2 vars, End of recursive call: and 1 xjuncts. [2018-11-23 10:59:48,162 INFO L202 ElimStorePlain]: Needed 3 recursive calls to eliminate 1 variables, input treesize:26, output treesize:22 [2018-11-23 10:59:48,354 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 2, 0 stores, 1 select indices, 1 select index equivalence classes, 0 disjoint index pairs (out of 0 index pairs), introduced 1 new quantified variables, introduced 0 case distinctions, treesize of input 22 treesize of output 16 [2018-11-23 10:59:48,359 INFO L701 Elim1Store]: detected not equals via solver [2018-11-23 10:59:48,360 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 1, 0 stores, 2 select indices, 2 select index equivalence classes, 2 disjoint index pairs (out of 1 index pairs), introduced 0 new quantified variables, introduced 0 case distinctions, treesize of input 16 treesize of output 8 [2018-11-23 10:59:48,361 INFO L267 ElimStorePlain]: Start of recursive call 3: End of recursive call: and 1 xjuncts. [2018-11-23 10:59:48,365 INFO L267 ElimStorePlain]: Start of recursive call 2: 1 dim-1 vars, End of recursive call: and 1 xjuncts. [2018-11-23 10:59:48,368 INFO L267 ElimStorePlain]: Start of recursive call 1: 1 dim-0 vars, 1 dim-2 vars, End of recursive call: and 1 xjuncts. [2018-11-23 10:59:48,369 INFO L202 ElimStorePlain]: Needed 3 recursive calls to eliminate 2 variables, input treesize:22, output treesize:3 [2018-11-23 10:59:48,371 WARN L383 uantifierElimination]: Trying to double check SDD result, but SMT solver's response was UNKNOWN. [2018-11-23 10:59:48,371 WARN L384 uantifierElimination]: Input elimination task: ∃ [|#memory_int|, ssl3_connect_~s.base]. (let ((.cse1 (select |#memory_int| ssl3_connect_~s.base))) (let ((.cse0 (select .cse1 (_ bv52 32)))) (and (= (_ bv4560 32) .cse0) (= |ssl3_connect_#t~mem38| .cse0) (= (_ bv0 32) (select .cse1 (_ bv64 32)))))) [2018-11-23 10:59:48,372 WARN L385 uantifierElimination]: ElimStorePlain result: ∃ []. (= |ssl3_connect_#t~mem38| (_ bv4560 32)) [2018-11-23 10:59:48,408 INFO L256 TraceCheckUtils]: 0: Hoare triple {14792#true} call ULTIMATE.init(); {14792#true} is VALID [2018-11-23 10:59:48,408 INFO L273 TraceCheckUtils]: 1: Hoare triple {14792#true} #NULL.base, #NULL.offset := 0bv32, 0bv32;#valid := #valid[0bv32 := 0bv1];~init~0 := 1bv32;call ~#SSLv3_client_data~0.base, ~#SSLv3_client_data~0.offset := #Ultimate.alloc(100bv32);call write~init~intINTTYPE4(0bv32, ~#SSLv3_client_data~0.base, ~#SSLv3_client_data~0.offset, 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(4bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(8bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(12bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(16bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(20bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(24bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(28bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(32bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(36bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(40bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(44bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(48bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(52bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(56bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(60bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(64bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(68bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(72bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(76bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(80bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(84bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(88bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(92bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(96bv32, ~#SSLv3_client_data~0.offset), 4bv32); {14792#true} is VALID [2018-11-23 10:59:48,408 INFO L273 TraceCheckUtils]: 2: Hoare triple {14792#true} assume true; {14792#true} is VALID [2018-11-23 10:59:48,409 INFO L268 TraceCheckUtils]: 3: Hoare quadruple {14792#true} {14792#true} #544#return; {14792#true} is VALID [2018-11-23 10:59:48,409 INFO L256 TraceCheckUtils]: 4: Hoare triple {14792#true} call #t~ret138 := main(); {14792#true} is VALID [2018-11-23 10:59:48,411 INFO L273 TraceCheckUtils]: 5: Hoare triple {14792#true} call #t~malloc3.base, #t~malloc3.offset := #Ultimate.alloc(248bv32);~s~0.base, ~s~0.offset := #t~malloc3.base, #t~malloc3.offset;call #t~malloc4.base, #t~malloc4.offset := #Ultimate.alloc(899bv32);call write~$Pointer$(#t~malloc4.base, #t~malloc4.offset, ~s~0.base, ~bvadd32(84bv32, ~s~0.offset), 4bv32);call #t~malloc5.base, #t~malloc5.offset := #Ultimate.alloc(232bv32);call write~$Pointer$(#t~malloc5.base, #t~malloc5.offset, ~s~0.base, ~bvadd32(204bv32, ~s~0.offset), 4bv32);call #t~malloc6.base, #t~malloc6.offset := #Ultimate.alloc(200bv32);call write~$Pointer$(#t~malloc6.base, #t~malloc6.offset, ~s~0.base, ~bvadd32(176bv32, ~s~0.offset), 4bv32);call write~intINTTYPE4(12292bv32, ~s~0.base, ~bvadd32(52bv32, ~s~0.offset), 4bv32);call write~intINTTYPE4(#t~nondet7, ~s~0.base, ~s~0.offset, 4bv32);havoc #t~nondet7; {14812#(= main_~s~0.offset (_ bv0 32))} is VALID [2018-11-23 10:59:48,412 INFO L256 TraceCheckUtils]: 6: Hoare triple {14812#(= main_~s~0.offset (_ bv0 32))} call #t~ret8 := ssl3_connect(~s~0.base, ~s~0.offset); {14816#(= |ssl3_connect_#in~s.offset| (_ bv0 32))} is VALID [2018-11-23 10:59:48,413 INFO L273 TraceCheckUtils]: 7: Hoare triple {14816#(= |ssl3_connect_#in~s.offset| (_ bv0 32))} ~s.base, ~s.offset := #in~s.base, #in~s.offset;havoc ~buf~0.base, ~buf~0.offset;havoc ~tmp~2;havoc ~l~0;havoc ~num1~0;havoc ~cb~0.base, ~cb~0.offset;havoc ~ret~0;havoc ~new_state~0;havoc ~state~0;havoc ~skip~0;~tmp___0~1.base, ~tmp___0~1.offset := #t~nondet9.base, #t~nondet9.offset;havoc #t~nondet9.base, #t~nondet9.offset;~tmp___1~0 := #t~nondet10;havoc #t~nondet10;~tmp___2~0 := #t~nondet11;havoc #t~nondet11;~tmp___3~0 := #t~nondet12;havoc #t~nondet12;~tmp___4~0 := #t~nondet13;havoc #t~nondet13;~tmp___5~0 := #t~nondet14;havoc #t~nondet14;~tmp___6~0 := #t~nondet15;havoc #t~nondet15;~tmp___7~0 := #t~nondet16;havoc #t~nondet16;~tmp___8~0 := #t~nondet17;havoc #t~nondet17;~tmp___9~0 := #t~nondet18;havoc #t~nondet18;havoc ~blastFlag~0;~blastFlag~0 := 0bv32;call write~intINTTYPE4(#t~nondet19, ~s.base, ~bvadd32(92bv32, ~s.offset), 4bv32);havoc #t~nondet19;call write~intINTTYPE4(12292bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32);~tmp~2 := #t~nondet20;havoc #t~nondet20;~cb~0.base, ~cb~0.offset := 0bv32, 0bv32;~ret~0 := 4294967295bv32;~skip~0 := 0bv32;call write~intINTTYPE4(0bv32, ~tmp___0~1.base, ~tmp___0~1.offset, 4bv32);call #t~mem21.base, #t~mem21.offset := read~$Pointer$(~s.base, ~bvadd32(192bv32, ~s.offset), 4bv32); {14820#(= (_ bv0 32) ssl3_connect_~s.offset)} is VALID [2018-11-23 10:59:48,413 INFO L273 TraceCheckUtils]: 8: Hoare triple {14820#(= (_ bv0 32) ssl3_connect_~s.offset)} assume 0bv32 != ~bvadd32(#t~mem21.base, #t~mem21.offset);havoc #t~mem21.base, #t~mem21.offset;call #t~mem22.base, #t~mem22.offset := read~$Pointer$(~s.base, ~bvadd32(192bv32, ~s.offset), 4bv32);~cb~0.base, ~cb~0.offset := #t~mem22.base, #t~mem22.offset;havoc #t~mem22.base, #t~mem22.offset; {14820#(= (_ bv0 32) ssl3_connect_~s.offset)} is VALID [2018-11-23 10:59:48,414 INFO L273 TraceCheckUtils]: 9: Hoare triple {14820#(= (_ bv0 32) ssl3_connect_~s.offset)} call #t~mem27 := read~intINTTYPE4(~s.base, ~bvadd32(28bv32, ~s.offset), 4bv32);call write~intINTTYPE4(~bvadd32(1bv32, #t~mem27), ~s.base, ~bvadd32(28bv32, ~s.offset), 4bv32);havoc #t~mem27; {14820#(= (_ bv0 32) ssl3_connect_~s.offset)} is VALID [2018-11-23 10:59:48,414 INFO L273 TraceCheckUtils]: 10: Hoare triple {14820#(= (_ bv0 32) ssl3_connect_~s.offset)} assume !(0bv32 != ~bvand32(12288bv32, ~tmp___1~0)); {14820#(= (_ bv0 32) ssl3_connect_~s.offset)} is VALID [2018-11-23 10:59:48,415 INFO L273 TraceCheckUtils]: 11: Hoare triple {14820#(= (_ bv0 32) ssl3_connect_~s.offset)} assume !false; {14820#(= (_ bv0 32) ssl3_connect_~s.offset)} is VALID [2018-11-23 10:59:48,415 INFO L273 TraceCheckUtils]: 12: Hoare triple {14820#(= (_ bv0 32) ssl3_connect_~s.offset)} call #t~mem28 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32);~state~0 := #t~mem28;havoc #t~mem28;call #t~mem29 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {14820#(= (_ bv0 32) ssl3_connect_~s.offset)} is VALID [2018-11-23 10:59:48,416 INFO L273 TraceCheckUtils]: 13: Hoare triple {14820#(= (_ bv0 32) ssl3_connect_~s.offset)} assume 12292bv32 == #t~mem29;havoc #t~mem29; {14820#(= (_ bv0 32) ssl3_connect_~s.offset)} is VALID [2018-11-23 10:59:48,416 INFO L273 TraceCheckUtils]: 14: Hoare triple {14820#(= (_ bv0 32) ssl3_connect_~s.offset)} call write~intINTTYPE4(1bv32, ~s.base, ~bvadd32(40bv32, ~s.offset), 4bv32);call write~intINTTYPE4(4096bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32);call #t~mem62.base, #t~mem62.offset := read~$Pointer$(~s.base, ~bvadd32(204bv32, ~s.offset), 4bv32);call #t~mem63 := read~intINTTYPE4(#t~mem62.base, ~bvadd32(64bv32, #t~mem62.offset), 4bv32);call write~intINTTYPE4(~bvadd32(1bv32, #t~mem63), #t~mem62.base, ~bvadd32(64bv32, #t~mem62.offset), 4bv32);havoc #t~mem62.base, #t~mem62.offset;havoc #t~mem63; {14820#(= (_ bv0 32) ssl3_connect_~s.offset)} is VALID [2018-11-23 10:59:48,417 INFO L273 TraceCheckUtils]: 15: Hoare triple {14820#(= (_ bv0 32) ssl3_connect_~s.offset)} call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(36bv32, ~s.offset), 4bv32); {14820#(= (_ bv0 32) ssl3_connect_~s.offset)} is VALID [2018-11-23 10:59:48,418 INFO L273 TraceCheckUtils]: 16: Hoare triple {14820#(= (_ bv0 32) ssl3_connect_~s.offset)} assume 0bv32 != ~bvadd32(~cb~0.base, ~cb~0.offset); {14820#(= (_ bv0 32) ssl3_connect_~s.offset)} is VALID [2018-11-23 10:59:48,418 INFO L273 TraceCheckUtils]: 17: Hoare triple {14820#(= (_ bv0 32) ssl3_connect_~s.offset)} call #t~mem64 := read~intINTTYPE4(~s.base, ~s.offset, 4bv32); {14820#(= (_ bv0 32) ssl3_connect_~s.offset)} is VALID [2018-11-23 10:59:48,419 INFO L273 TraceCheckUtils]: 18: Hoare triple {14820#(= (_ bv0 32) ssl3_connect_~s.offset)} assume !(768bv32 != ~bvand32(65280bv32, #t~mem64));havoc #t~mem64;call write~intINTTYPE4(4096bv32, ~s.base, ~bvadd32(4bv32, ~s.offset), 4bv32);call #t~mem65.base, #t~mem65.offset := read~$Pointer$(~s.base, ~bvadd32(60bv32, ~s.offset), 4bv32); {14820#(= (_ bv0 32) ssl3_connect_~s.offset)} is VALID [2018-11-23 10:59:48,419 INFO L273 TraceCheckUtils]: 19: Hoare triple {14820#(= (_ bv0 32) ssl3_connect_~s.offset)} assume !(0bv32 == ~bvadd32(#t~mem65.base, #t~mem65.offset));havoc #t~mem65.base, #t~mem65.offset; {14820#(= (_ bv0 32) ssl3_connect_~s.offset)} is VALID [2018-11-23 10:59:48,420 INFO L273 TraceCheckUtils]: 20: Hoare triple {14820#(= (_ bv0 32) ssl3_connect_~s.offset)} assume !(0bv32 == ~tmp___4~0); {14820#(= (_ bv0 32) ssl3_connect_~s.offset)} is VALID [2018-11-23 10:59:48,420 INFO L273 TraceCheckUtils]: 21: Hoare triple {14820#(= (_ bv0 32) ssl3_connect_~s.offset)} assume !(0bv32 == ~tmp___5~0);call write~intINTTYPE4(4368bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32);call #t~mem67.base, #t~mem67.offset := read~$Pointer$(~s.base, ~bvadd32(204bv32, ~s.offset), 4bv32);call #t~mem68 := read~intINTTYPE4(#t~mem67.base, ~bvadd32(60bv32, #t~mem67.offset), 4bv32);call write~intINTTYPE4(~bvadd32(1bv32, #t~mem68), #t~mem67.base, ~bvadd32(60bv32, #t~mem67.offset), 4bv32);havoc #t~mem68;havoc #t~mem67.base, #t~mem67.offset;call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(64bv32, ~s.offset), 4bv32); {14820#(= (_ bv0 32) ssl3_connect_~s.offset)} is VALID [2018-11-23 10:59:48,421 INFO L273 TraceCheckUtils]: 22: Hoare triple {14820#(= (_ bv0 32) ssl3_connect_~s.offset)} call #t~mem127.base, #t~mem127.offset := read~$Pointer$(~s.base, ~bvadd32(84bv32, ~s.offset), 4bv32);call #t~mem128 := read~intINTTYPE4(#t~mem127.base, ~bvadd32(848bv32, #t~mem127.offset), 4bv32); {14820#(= (_ bv0 32) ssl3_connect_~s.offset)} is VALID [2018-11-23 10:59:48,422 INFO L273 TraceCheckUtils]: 23: Hoare triple {14820#(= (_ bv0 32) ssl3_connect_~s.offset)} assume !(0bv32 == #t~mem128);havoc #t~mem127.base, #t~mem127.offset;havoc #t~mem128; {14820#(= (_ bv0 32) ssl3_connect_~s.offset)} is VALID [2018-11-23 10:59:48,422 INFO L273 TraceCheckUtils]: 24: Hoare triple {14820#(= (_ bv0 32) ssl3_connect_~s.offset)} ~skip~0 := 0bv32; {14820#(= (_ bv0 32) ssl3_connect_~s.offset)} is VALID [2018-11-23 10:59:48,423 INFO L273 TraceCheckUtils]: 25: Hoare triple {14820#(= (_ bv0 32) ssl3_connect_~s.offset)} assume !false; {14820#(= (_ bv0 32) ssl3_connect_~s.offset)} is VALID [2018-11-23 10:59:48,423 INFO L273 TraceCheckUtils]: 26: Hoare triple {14820#(= (_ bv0 32) ssl3_connect_~s.offset)} call #t~mem28 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32);~state~0 := #t~mem28;havoc #t~mem28;call #t~mem29 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {14820#(= (_ bv0 32) ssl3_connect_~s.offset)} is VALID [2018-11-23 10:59:48,424 INFO L273 TraceCheckUtils]: 27: Hoare triple {14820#(= (_ bv0 32) ssl3_connect_~s.offset)} assume !(12292bv32 == #t~mem29);havoc #t~mem29;call #t~mem30 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {14820#(= (_ bv0 32) ssl3_connect_~s.offset)} is VALID [2018-11-23 10:59:48,424 INFO L273 TraceCheckUtils]: 28: Hoare triple {14820#(= (_ bv0 32) ssl3_connect_~s.offset)} assume !(16384bv32 == #t~mem30);havoc #t~mem30;call #t~mem31 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {14820#(= (_ bv0 32) ssl3_connect_~s.offset)} is VALID [2018-11-23 10:59:48,425 INFO L273 TraceCheckUtils]: 29: Hoare triple {14820#(= (_ bv0 32) ssl3_connect_~s.offset)} assume !(4096bv32 == #t~mem31);havoc #t~mem31;call #t~mem32 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {14820#(= (_ bv0 32) ssl3_connect_~s.offset)} is VALID [2018-11-23 10:59:48,426 INFO L273 TraceCheckUtils]: 30: Hoare triple {14820#(= (_ bv0 32) ssl3_connect_~s.offset)} assume !(20480bv32 == #t~mem32);havoc #t~mem32;call #t~mem33 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {14820#(= (_ bv0 32) ssl3_connect_~s.offset)} is VALID [2018-11-23 10:59:48,426 INFO L273 TraceCheckUtils]: 31: Hoare triple {14820#(= (_ bv0 32) ssl3_connect_~s.offset)} assume !(4099bv32 == #t~mem33);havoc #t~mem33;call #t~mem34 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {14820#(= (_ bv0 32) ssl3_connect_~s.offset)} is VALID [2018-11-23 10:59:48,427 INFO L273 TraceCheckUtils]: 32: Hoare triple {14820#(= (_ bv0 32) ssl3_connect_~s.offset)} assume 4368bv32 == #t~mem34;havoc #t~mem34; {14820#(= (_ bv0 32) ssl3_connect_~s.offset)} is VALID [2018-11-23 10:59:48,427 INFO L273 TraceCheckUtils]: 33: Hoare triple {14820#(= (_ bv0 32) ssl3_connect_~s.offset)} call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(48bv32, ~s.offset), 4bv32);~ret~0 := #t~nondet69;havoc #t~nondet69; {14820#(= (_ bv0 32) ssl3_connect_~s.offset)} is VALID [2018-11-23 10:59:48,428 INFO L273 TraceCheckUtils]: 34: Hoare triple {14820#(= (_ bv0 32) ssl3_connect_~s.offset)} assume 0bv32 == ~blastFlag~0;~blastFlag~0 := 1bv32; {14820#(= (_ bv0 32) ssl3_connect_~s.offset)} is VALID [2018-11-23 10:59:48,428 INFO L273 TraceCheckUtils]: 35: Hoare triple {14820#(= (_ bv0 32) ssl3_connect_~s.offset)} assume !~bvsle32(~ret~0, 0bv32);call write~intINTTYPE4(4384bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32);call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(64bv32, ~s.offset), 4bv32);call #t~mem70.base, #t~mem70.offset := read~$Pointer$(~s.base, ~bvadd32(20bv32, ~s.offset), 4bv32);call #t~mem71.base, #t~mem71.offset := read~$Pointer$(~s.base, ~bvadd32(16bv32, ~s.offset), 4bv32); {14820#(= (_ bv0 32) ssl3_connect_~s.offset)} is VALID [2018-11-23 10:59:48,429 INFO L273 TraceCheckUtils]: 36: Hoare triple {14820#(= (_ bv0 32) ssl3_connect_~s.offset)} assume ~bvadd32(#t~mem70.base, #t~mem70.offset) != ~bvadd32(#t~mem71.base, #t~mem71.offset);havoc #t~mem71.base, #t~mem71.offset;havoc #t~mem70.base, #t~mem70.offset; {14820#(= (_ bv0 32) ssl3_connect_~s.offset)} is VALID [2018-11-23 10:59:48,429 INFO L273 TraceCheckUtils]: 37: Hoare triple {14820#(= (_ bv0 32) ssl3_connect_~s.offset)} call #t~mem127.base, #t~mem127.offset := read~$Pointer$(~s.base, ~bvadd32(84bv32, ~s.offset), 4bv32);call #t~mem128 := read~intINTTYPE4(#t~mem127.base, ~bvadd32(848bv32, #t~mem127.offset), 4bv32); {14820#(= (_ bv0 32) ssl3_connect_~s.offset)} is VALID [2018-11-23 10:59:48,430 INFO L273 TraceCheckUtils]: 38: Hoare triple {14820#(= (_ bv0 32) ssl3_connect_~s.offset)} assume !(0bv32 == #t~mem128);havoc #t~mem127.base, #t~mem127.offset;havoc #t~mem128; {14820#(= (_ bv0 32) ssl3_connect_~s.offset)} is VALID [2018-11-23 10:59:48,431 INFO L273 TraceCheckUtils]: 39: Hoare triple {14820#(= (_ bv0 32) ssl3_connect_~s.offset)} ~skip~0 := 0bv32; {14820#(= (_ bv0 32) ssl3_connect_~s.offset)} is VALID [2018-11-23 10:59:48,431 INFO L273 TraceCheckUtils]: 40: Hoare triple {14820#(= (_ bv0 32) ssl3_connect_~s.offset)} assume !false; {14820#(= (_ bv0 32) ssl3_connect_~s.offset)} is VALID [2018-11-23 10:59:48,432 INFO L273 TraceCheckUtils]: 41: Hoare triple {14820#(= (_ bv0 32) ssl3_connect_~s.offset)} call #t~mem28 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32);~state~0 := #t~mem28;havoc #t~mem28;call #t~mem29 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {14820#(= (_ bv0 32) ssl3_connect_~s.offset)} is VALID [2018-11-23 10:59:48,432 INFO L273 TraceCheckUtils]: 42: Hoare triple {14820#(= (_ bv0 32) ssl3_connect_~s.offset)} assume !(12292bv32 == #t~mem29);havoc #t~mem29;call #t~mem30 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {14820#(= (_ bv0 32) ssl3_connect_~s.offset)} is VALID [2018-11-23 10:59:48,433 INFO L273 TraceCheckUtils]: 43: Hoare triple {14820#(= (_ bv0 32) ssl3_connect_~s.offset)} assume !(16384bv32 == #t~mem30);havoc #t~mem30;call #t~mem31 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {14820#(= (_ bv0 32) ssl3_connect_~s.offset)} is VALID [2018-11-23 10:59:48,433 INFO L273 TraceCheckUtils]: 44: Hoare triple {14820#(= (_ bv0 32) ssl3_connect_~s.offset)} assume !(4096bv32 == #t~mem31);havoc #t~mem31;call #t~mem32 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {14820#(= (_ bv0 32) ssl3_connect_~s.offset)} is VALID [2018-11-23 10:59:48,434 INFO L273 TraceCheckUtils]: 45: Hoare triple {14820#(= (_ bv0 32) ssl3_connect_~s.offset)} assume !(20480bv32 == #t~mem32);havoc #t~mem32;call #t~mem33 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {14820#(= (_ bv0 32) ssl3_connect_~s.offset)} is VALID [2018-11-23 10:59:48,434 INFO L273 TraceCheckUtils]: 46: Hoare triple {14820#(= (_ bv0 32) ssl3_connect_~s.offset)} assume !(4099bv32 == #t~mem33);havoc #t~mem33;call #t~mem34 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {14820#(= (_ bv0 32) ssl3_connect_~s.offset)} is VALID [2018-11-23 10:59:48,435 INFO L273 TraceCheckUtils]: 47: Hoare triple {14820#(= (_ bv0 32) ssl3_connect_~s.offset)} assume !(4368bv32 == #t~mem34);havoc #t~mem34;call #t~mem35 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {14820#(= (_ bv0 32) ssl3_connect_~s.offset)} is VALID [2018-11-23 10:59:48,435 INFO L273 TraceCheckUtils]: 48: Hoare triple {14820#(= (_ bv0 32) ssl3_connect_~s.offset)} assume !(4369bv32 == #t~mem35);havoc #t~mem35;call #t~mem36 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {14820#(= (_ bv0 32) ssl3_connect_~s.offset)} is VALID [2018-11-23 10:59:48,436 INFO L273 TraceCheckUtils]: 49: Hoare triple {14820#(= (_ bv0 32) ssl3_connect_~s.offset)} assume 4384bv32 == #t~mem36;havoc #t~mem36; {14820#(= (_ bv0 32) ssl3_connect_~s.offset)} is VALID [2018-11-23 10:59:48,437 INFO L273 TraceCheckUtils]: 50: Hoare triple {14820#(= (_ bv0 32) ssl3_connect_~s.offset)} ~ret~0 := #t~nondet72;havoc #t~nondet72; {14820#(= (_ bv0 32) ssl3_connect_~s.offset)} is VALID [2018-11-23 10:59:48,437 INFO L273 TraceCheckUtils]: 51: Hoare triple {14820#(= (_ bv0 32) ssl3_connect_~s.offset)} assume 1bv32 == ~blastFlag~0;~blastFlag~0 := 2bv32; {14820#(= (_ bv0 32) ssl3_connect_~s.offset)} is VALID [2018-11-23 10:59:48,438 INFO L273 TraceCheckUtils]: 52: Hoare triple {14820#(= (_ bv0 32) ssl3_connect_~s.offset)} assume !~bvsle32(~ret~0, 0bv32);call #t~mem73 := read~intINTTYPE4(~s.base, ~bvadd32(92bv32, ~s.offset), 4bv32); {14820#(= (_ bv0 32) ssl3_connect_~s.offset)} is VALID [2018-11-23 10:59:48,440 INFO L273 TraceCheckUtils]: 53: Hoare triple {14820#(= (_ bv0 32) ssl3_connect_~s.offset)} assume 0bv32 != #t~mem73;havoc #t~mem73;call write~intINTTYPE4(4560bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {14959#(and (= (_ bv0 32) ssl3_connect_~s.offset) (= (_ bv4560 32) (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32)))))} is VALID [2018-11-23 10:59:48,442 INFO L273 TraceCheckUtils]: 54: Hoare triple {14959#(and (= (_ bv0 32) ssl3_connect_~s.offset) (= (_ bv4560 32) (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32)))))} call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(64bv32, ~s.offset), 4bv32); {14963#(and (= (_ bv0 32) (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv64 32)))) (= (_ bv0 32) ssl3_connect_~s.offset) (= (_ bv4560 32) (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32)))))} is VALID [2018-11-23 10:59:48,443 INFO L273 TraceCheckUtils]: 55: Hoare triple {14963#(and (= (_ bv0 32) (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv64 32)))) (= (_ bv0 32) ssl3_connect_~s.offset) (= (_ bv4560 32) (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32)))))} call #t~mem127.base, #t~mem127.offset := read~$Pointer$(~s.base, ~bvadd32(84bv32, ~s.offset), 4bv32);call #t~mem128 := read~intINTTYPE4(#t~mem127.base, ~bvadd32(848bv32, #t~mem127.offset), 4bv32); {14963#(and (= (_ bv0 32) (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv64 32)))) (= (_ bv0 32) ssl3_connect_~s.offset) (= (_ bv4560 32) (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32)))))} is VALID [2018-11-23 10:59:48,444 INFO L273 TraceCheckUtils]: 56: Hoare triple {14963#(and (= (_ bv0 32) (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv64 32)))) (= (_ bv0 32) ssl3_connect_~s.offset) (= (_ bv4560 32) (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32)))))} assume !(0bv32 == #t~mem128);havoc #t~mem127.base, #t~mem127.offset;havoc #t~mem128; {14963#(and (= (_ bv0 32) (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv64 32)))) (= (_ bv0 32) ssl3_connect_~s.offset) (= (_ bv4560 32) (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32)))))} is VALID [2018-11-23 10:59:48,450 INFO L273 TraceCheckUtils]: 57: Hoare triple {14963#(and (= (_ bv0 32) (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv64 32)))) (= (_ bv0 32) ssl3_connect_~s.offset) (= (_ bv4560 32) (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32)))))} ~skip~0 := 0bv32; {14963#(and (= (_ bv0 32) (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv64 32)))) (= (_ bv0 32) ssl3_connect_~s.offset) (= (_ bv4560 32) (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32)))))} is VALID [2018-11-23 10:59:48,451 INFO L273 TraceCheckUtils]: 58: Hoare triple {14963#(and (= (_ bv0 32) (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv64 32)))) (= (_ bv0 32) ssl3_connect_~s.offset) (= (_ bv4560 32) (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32)))))} assume !false; {14963#(and (= (_ bv0 32) (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv64 32)))) (= (_ bv0 32) ssl3_connect_~s.offset) (= (_ bv4560 32) (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32)))))} is VALID [2018-11-23 10:59:48,452 INFO L273 TraceCheckUtils]: 59: Hoare triple {14963#(and (= (_ bv0 32) (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv64 32)))) (= (_ bv0 32) ssl3_connect_~s.offset) (= (_ bv4560 32) (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32)))))} call #t~mem28 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32);~state~0 := #t~mem28;havoc #t~mem28;call #t~mem29 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {14963#(and (= (_ bv0 32) (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv64 32)))) (= (_ bv0 32) ssl3_connect_~s.offset) (= (_ bv4560 32) (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32)))))} is VALID [2018-11-23 10:59:48,452 INFO L273 TraceCheckUtils]: 60: Hoare triple {14963#(and (= (_ bv0 32) (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv64 32)))) (= (_ bv0 32) ssl3_connect_~s.offset) (= (_ bv4560 32) (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32)))))} assume !(12292bv32 == #t~mem29);havoc #t~mem29;call #t~mem30 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {14963#(and (= (_ bv0 32) (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv64 32)))) (= (_ bv0 32) ssl3_connect_~s.offset) (= (_ bv4560 32) (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32)))))} is VALID [2018-11-23 10:59:48,453 INFO L273 TraceCheckUtils]: 61: Hoare triple {14963#(and (= (_ bv0 32) (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv64 32)))) (= (_ bv0 32) ssl3_connect_~s.offset) (= (_ bv4560 32) (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32)))))} assume !(16384bv32 == #t~mem30);havoc #t~mem30;call #t~mem31 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {14963#(and (= (_ bv0 32) (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv64 32)))) (= (_ bv0 32) ssl3_connect_~s.offset) (= (_ bv4560 32) (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32)))))} is VALID [2018-11-23 10:59:48,454 INFO L273 TraceCheckUtils]: 62: Hoare triple {14963#(and (= (_ bv0 32) (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv64 32)))) (= (_ bv0 32) ssl3_connect_~s.offset) (= (_ bv4560 32) (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32)))))} assume !(4096bv32 == #t~mem31);havoc #t~mem31;call #t~mem32 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {14963#(and (= (_ bv0 32) (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv64 32)))) (= (_ bv0 32) ssl3_connect_~s.offset) (= (_ bv4560 32) (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32)))))} is VALID [2018-11-23 10:59:48,455 INFO L273 TraceCheckUtils]: 63: Hoare triple {14963#(and (= (_ bv0 32) (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv64 32)))) (= (_ bv0 32) ssl3_connect_~s.offset) (= (_ bv4560 32) (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32)))))} assume !(20480bv32 == #t~mem32);havoc #t~mem32;call #t~mem33 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {14963#(and (= (_ bv0 32) (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv64 32)))) (= (_ bv0 32) ssl3_connect_~s.offset) (= (_ bv4560 32) (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32)))))} is VALID [2018-11-23 10:59:48,456 INFO L273 TraceCheckUtils]: 64: Hoare triple {14963#(and (= (_ bv0 32) (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv64 32)))) (= (_ bv0 32) ssl3_connect_~s.offset) (= (_ bv4560 32) (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32)))))} assume !(4099bv32 == #t~mem33);havoc #t~mem33;call #t~mem34 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {14963#(and (= (_ bv0 32) (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv64 32)))) (= (_ bv0 32) ssl3_connect_~s.offset) (= (_ bv4560 32) (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32)))))} is VALID [2018-11-23 10:59:48,458 INFO L273 TraceCheckUtils]: 65: Hoare triple {14963#(and (= (_ bv0 32) (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv64 32)))) (= (_ bv0 32) ssl3_connect_~s.offset) (= (_ bv4560 32) (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32)))))} assume !(4368bv32 == #t~mem34);havoc #t~mem34;call #t~mem35 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {14963#(and (= (_ bv0 32) (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv64 32)))) (= (_ bv0 32) ssl3_connect_~s.offset) (= (_ bv4560 32) (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32)))))} is VALID [2018-11-23 10:59:48,459 INFO L273 TraceCheckUtils]: 66: Hoare triple {14963#(and (= (_ bv0 32) (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv64 32)))) (= (_ bv0 32) ssl3_connect_~s.offset) (= (_ bv4560 32) (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32)))))} assume !(4369bv32 == #t~mem35);havoc #t~mem35;call #t~mem36 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {14963#(and (= (_ bv0 32) (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv64 32)))) (= (_ bv0 32) ssl3_connect_~s.offset) (= (_ bv4560 32) (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32)))))} is VALID [2018-11-23 10:59:48,460 INFO L273 TraceCheckUtils]: 67: Hoare triple {14963#(and (= (_ bv0 32) (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv64 32)))) (= (_ bv0 32) ssl3_connect_~s.offset) (= (_ bv4560 32) (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32)))))} assume !(4384bv32 == #t~mem36);havoc #t~mem36;call #t~mem37 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {14963#(and (= (_ bv0 32) (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv64 32)))) (= (_ bv0 32) ssl3_connect_~s.offset) (= (_ bv4560 32) (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32)))))} is VALID [2018-11-23 10:59:48,461 INFO L273 TraceCheckUtils]: 68: Hoare triple {14963#(and (= (_ bv0 32) (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv64 32)))) (= (_ bv0 32) ssl3_connect_~s.offset) (= (_ bv4560 32) (select (select |#memory_int| ssl3_connect_~s.base) (bvadd ssl3_connect_~s.offset (_ bv52 32)))))} assume !(4385bv32 == #t~mem37);havoc #t~mem37;call #t~mem38 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {15006#(= (bvadd |ssl3_connect_#t~mem38| (_ bv4294962736 32)) (_ bv0 32))} is VALID [2018-11-23 10:59:48,461 INFO L273 TraceCheckUtils]: 69: Hoare triple {15006#(= (bvadd |ssl3_connect_#t~mem38| (_ bv4294962736 32)) (_ bv0 32))} assume 4400bv32 == #t~mem38;havoc #t~mem38; {14793#false} is VALID [2018-11-23 10:59:48,462 INFO L273 TraceCheckUtils]: 70: Hoare triple {14793#false} call #t~mem74.base, #t~mem74.offset := read~$Pointer$(~s.base, ~bvadd32(84bv32, ~s.offset), 4bv32);call #t~mem75.base, #t~mem75.offset := read~$Pointer$(#t~mem74.base, ~bvadd32(836bv32, #t~mem74.offset), 4bv32);call #t~mem76 := read~intINTTYPE4(#t~mem75.base, ~bvadd32(12bv32, #t~mem75.offset), 4bv32); {14793#false} is VALID [2018-11-23 10:59:48,462 INFO L273 TraceCheckUtils]: 71: Hoare triple {14793#false} assume !(0bv32 != ~bvand32(256bv32, #t~mem76));havoc #t~mem76;havoc #t~mem75.base, #t~mem75.offset;havoc #t~mem74.base, #t~mem74.offset;~ret~0 := #t~nondet77;havoc #t~nondet77; {14793#false} is VALID [2018-11-23 10:59:48,462 INFO L273 TraceCheckUtils]: 72: Hoare triple {14793#false} assume 2bv32 == ~blastFlag~0;~blastFlag~0 := 3bv32; {14793#false} is VALID [2018-11-23 10:59:48,462 INFO L273 TraceCheckUtils]: 73: Hoare triple {14793#false} assume !~bvsle32(~ret~0, 0bv32); {14793#false} is VALID [2018-11-23 10:59:48,463 INFO L273 TraceCheckUtils]: 74: Hoare triple {14793#false} call write~intINTTYPE4(4416bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32);call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(64bv32, ~s.offset), 4bv32); {14793#false} is VALID [2018-11-23 10:59:48,463 INFO L273 TraceCheckUtils]: 75: Hoare triple {14793#false} call #t~mem127.base, #t~mem127.offset := read~$Pointer$(~s.base, ~bvadd32(84bv32, ~s.offset), 4bv32);call #t~mem128 := read~intINTTYPE4(#t~mem127.base, ~bvadd32(848bv32, #t~mem127.offset), 4bv32); {14793#false} is VALID [2018-11-23 10:59:48,463 INFO L273 TraceCheckUtils]: 76: Hoare triple {14793#false} assume !(0bv32 == #t~mem128);havoc #t~mem127.base, #t~mem127.offset;havoc #t~mem128; {14793#false} is VALID [2018-11-23 10:59:48,463 INFO L273 TraceCheckUtils]: 77: Hoare triple {14793#false} ~skip~0 := 0bv32; {14793#false} is VALID [2018-11-23 10:59:48,464 INFO L273 TraceCheckUtils]: 78: Hoare triple {14793#false} assume !false; {14793#false} is VALID [2018-11-23 10:59:48,464 INFO L273 TraceCheckUtils]: 79: Hoare triple {14793#false} call #t~mem28 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32);~state~0 := #t~mem28;havoc #t~mem28;call #t~mem29 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {14793#false} is VALID [2018-11-23 10:59:48,464 INFO L273 TraceCheckUtils]: 80: Hoare triple {14793#false} assume !(12292bv32 == #t~mem29);havoc #t~mem29;call #t~mem30 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {14793#false} is VALID [2018-11-23 10:59:48,464 INFO L273 TraceCheckUtils]: 81: Hoare triple {14793#false} assume !(16384bv32 == #t~mem30);havoc #t~mem30;call #t~mem31 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {14793#false} is VALID [2018-11-23 10:59:48,465 INFO L273 TraceCheckUtils]: 82: Hoare triple {14793#false} assume !(4096bv32 == #t~mem31);havoc #t~mem31;call #t~mem32 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {14793#false} is VALID [2018-11-23 10:59:48,465 INFO L273 TraceCheckUtils]: 83: Hoare triple {14793#false} assume !(20480bv32 == #t~mem32);havoc #t~mem32;call #t~mem33 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {14793#false} is VALID [2018-11-23 10:59:48,465 INFO L273 TraceCheckUtils]: 84: Hoare triple {14793#false} assume !(4099bv32 == #t~mem33);havoc #t~mem33;call #t~mem34 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {14793#false} is VALID [2018-11-23 10:59:48,465 INFO L273 TraceCheckUtils]: 85: Hoare triple {14793#false} assume !(4368bv32 == #t~mem34);havoc #t~mem34;call #t~mem35 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {14793#false} is VALID [2018-11-23 10:59:48,466 INFO L273 TraceCheckUtils]: 86: Hoare triple {14793#false} assume !(4369bv32 == #t~mem35);havoc #t~mem35;call #t~mem36 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {14793#false} is VALID [2018-11-23 10:59:48,466 INFO L273 TraceCheckUtils]: 87: Hoare triple {14793#false} assume !(4384bv32 == #t~mem36);havoc #t~mem36;call #t~mem37 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {14793#false} is VALID [2018-11-23 10:59:48,466 INFO L273 TraceCheckUtils]: 88: Hoare triple {14793#false} assume !(4385bv32 == #t~mem37);havoc #t~mem37;call #t~mem38 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {14793#false} is VALID [2018-11-23 10:59:48,466 INFO L273 TraceCheckUtils]: 89: Hoare triple {14793#false} assume !(4400bv32 == #t~mem38);havoc #t~mem38;call #t~mem39 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {14793#false} is VALID [2018-11-23 10:59:48,466 INFO L273 TraceCheckUtils]: 90: Hoare triple {14793#false} assume !(4401bv32 == #t~mem39);havoc #t~mem39;call #t~mem40 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {14793#false} is VALID [2018-11-23 10:59:48,467 INFO L273 TraceCheckUtils]: 91: Hoare triple {14793#false} assume 4416bv32 == #t~mem40;havoc #t~mem40; {14793#false} is VALID [2018-11-23 10:59:48,467 INFO L273 TraceCheckUtils]: 92: Hoare triple {14793#false} ~ret~0 := #t~nondet78;havoc #t~nondet78; {14793#false} is VALID [2018-11-23 10:59:48,467 INFO L273 TraceCheckUtils]: 93: Hoare triple {14793#false} assume 3bv32 == ~blastFlag~0;~blastFlag~0 := 4bv32; {14793#false} is VALID [2018-11-23 10:59:48,467 INFO L273 TraceCheckUtils]: 94: Hoare triple {14793#false} assume !~bvsle32(~ret~0, 0bv32);call write~intINTTYPE4(4432bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32);call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(64bv32, ~s.offset), 4bv32); {14793#false} is VALID [2018-11-23 10:59:48,467 INFO L273 TraceCheckUtils]: 95: Hoare triple {14793#false} assume !(0bv32 == ~tmp___6~0); {14793#false} is VALID [2018-11-23 10:59:48,468 INFO L273 TraceCheckUtils]: 96: Hoare triple {14793#false} call #t~mem127.base, #t~mem127.offset := read~$Pointer$(~s.base, ~bvadd32(84bv32, ~s.offset), 4bv32);call #t~mem128 := read~intINTTYPE4(#t~mem127.base, ~bvadd32(848bv32, #t~mem127.offset), 4bv32); {14793#false} is VALID [2018-11-23 10:59:48,468 INFO L273 TraceCheckUtils]: 97: Hoare triple {14793#false} assume !(0bv32 == #t~mem128);havoc #t~mem127.base, #t~mem127.offset;havoc #t~mem128; {14793#false} is VALID [2018-11-23 10:59:48,468 INFO L273 TraceCheckUtils]: 98: Hoare triple {14793#false} ~skip~0 := 0bv32; {14793#false} is VALID [2018-11-23 10:59:48,468 INFO L273 TraceCheckUtils]: 99: Hoare triple {14793#false} assume !false; {14793#false} is VALID [2018-11-23 10:59:48,468 INFO L273 TraceCheckUtils]: 100: Hoare triple {14793#false} call #t~mem28 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32);~state~0 := #t~mem28;havoc #t~mem28;call #t~mem29 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {14793#false} is VALID [2018-11-23 10:59:48,468 INFO L273 TraceCheckUtils]: 101: Hoare triple {14793#false} assume !(12292bv32 == #t~mem29);havoc #t~mem29;call #t~mem30 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {14793#false} is VALID [2018-11-23 10:59:48,469 INFO L273 TraceCheckUtils]: 102: Hoare triple {14793#false} assume !(16384bv32 == #t~mem30);havoc #t~mem30;call #t~mem31 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {14793#false} is VALID [2018-11-23 10:59:48,469 INFO L273 TraceCheckUtils]: 103: Hoare triple {14793#false} assume !(4096bv32 == #t~mem31);havoc #t~mem31;call #t~mem32 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {14793#false} is VALID [2018-11-23 10:59:48,469 INFO L273 TraceCheckUtils]: 104: Hoare triple {14793#false} assume !(20480bv32 == #t~mem32);havoc #t~mem32;call #t~mem33 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {14793#false} is VALID [2018-11-23 10:59:48,469 INFO L273 TraceCheckUtils]: 105: Hoare triple {14793#false} assume !(4099bv32 == #t~mem33);havoc #t~mem33;call #t~mem34 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {14793#false} is VALID [2018-11-23 10:59:48,469 INFO L273 TraceCheckUtils]: 106: Hoare triple {14793#false} assume !(4368bv32 == #t~mem34);havoc #t~mem34;call #t~mem35 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {14793#false} is VALID [2018-11-23 10:59:48,470 INFO L273 TraceCheckUtils]: 107: Hoare triple {14793#false} assume !(4369bv32 == #t~mem35);havoc #t~mem35;call #t~mem36 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {14793#false} is VALID [2018-11-23 10:59:48,470 INFO L273 TraceCheckUtils]: 108: Hoare triple {14793#false} assume !(4384bv32 == #t~mem36);havoc #t~mem36;call #t~mem37 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {14793#false} is VALID [2018-11-23 10:59:48,470 INFO L273 TraceCheckUtils]: 109: Hoare triple {14793#false} assume !(4385bv32 == #t~mem37);havoc #t~mem37;call #t~mem38 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {14793#false} is VALID [2018-11-23 10:59:48,470 INFO L273 TraceCheckUtils]: 110: Hoare triple {14793#false} assume !(4400bv32 == #t~mem38);havoc #t~mem38;call #t~mem39 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {14793#false} is VALID [2018-11-23 10:59:48,470 INFO L273 TraceCheckUtils]: 111: Hoare triple {14793#false} assume !(4401bv32 == #t~mem39);havoc #t~mem39;call #t~mem40 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {14793#false} is VALID [2018-11-23 10:59:48,471 INFO L273 TraceCheckUtils]: 112: Hoare triple {14793#false} assume !(4416bv32 == #t~mem40);havoc #t~mem40;call #t~mem41 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {14793#false} is VALID [2018-11-23 10:59:48,471 INFO L273 TraceCheckUtils]: 113: Hoare triple {14793#false} assume !(4417bv32 == #t~mem41);havoc #t~mem41;call #t~mem42 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); {14793#false} is VALID [2018-11-23 10:59:48,471 INFO L273 TraceCheckUtils]: 114: Hoare triple {14793#false} assume 4432bv32 == #t~mem42;havoc #t~mem42; {14793#false} is VALID [2018-11-23 10:59:48,471 INFO L273 TraceCheckUtils]: 115: Hoare triple {14793#false} ~ret~0 := #t~nondet79;havoc #t~nondet79; {14793#false} is VALID [2018-11-23 10:59:48,471 INFO L273 TraceCheckUtils]: 116: Hoare triple {14793#false} assume 4bv32 == ~blastFlag~0; {14793#false} is VALID [2018-11-23 10:59:48,471 INFO L273 TraceCheckUtils]: 117: Hoare triple {14793#false} assume !false; {14793#false} is VALID [2018-11-23 10:59:48,488 INFO L134 CoverageAnalysis]: Checked inductivity of 145 backedges. 111 proven. 0 refuted. 0 times theorem prover too weak. 34 trivial. 0 not checked. [2018-11-23 10:59:48,488 INFO L312 TraceCheckSpWp]: Omiting computation of backward sequence because forward sequence was already perfect [2018-11-23 10:59:48,495 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 10:59:48,495 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [8] imperfect sequences [] total 8 [2018-11-23 10:59:48,496 INFO L78 Accepts]: Start accepts. Automaton has 8 states. Word has length 118 [2018-11-23 10:59:48,496 INFO L84 Accepts]: Finished accepts. word is accepted. [2018-11-23 10:59:48,496 INFO L86 InductivityCheck]: Starting indutivity check of a Floyd-Hoare automaton with 8 states. [2018-11-23 10:59:48,662 INFO L119 InductivityCheck]: Floyd-Hoare automaton has 90 edges. 90 inductive. 0 not inductive. 0 times theorem prover too weak to decide inductivity. [2018-11-23 10:59:48,662 INFO L459 AbstractCegarLoop]: Interpolant automaton has 8 states [2018-11-23 10:59:48,663 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 8 interpolants. [2018-11-23 10:59:48,663 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=16, Invalid=40, Unknown=0, NotChecked=0, Total=56 [2018-11-23 10:59:48,663 INFO L87 Difference]: Start difference. First operand 530 states and 782 transitions. Second operand 8 states. [2018-11-23 11:00:23,461 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 11:00:23,462 INFO L93 Difference]: Finished difference Result 1410 states and 2086 transitions. [2018-11-23 11:00:23,462 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 8 states. [2018-11-23 11:00:23,462 INFO L78 Accepts]: Start accepts. Automaton has 8 states. Word has length 118 [2018-11-23 11:00:23,462 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 11:00:23,462 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 8 states. [2018-11-23 11:00:23,465 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 8 states to 8 states and 477 transitions. [2018-11-23 11:00:23,465 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 8 states. [2018-11-23 11:00:23,467 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 8 states to 8 states and 477 transitions. [2018-11-23 11:00:23,467 INFO L86 InductivityCheck]: Starting indutivity check of a Floyd-Hoare automaton with 8 states and 477 transitions. [2018-11-23 11:00:24,939 INFO L119 InductivityCheck]: Floyd-Hoare automaton has 477 edges. 477 inductive. 0 not inductive. 0 times theorem prover too weak to decide inductivity. [2018-11-23 11:00:24,976 INFO L225 Difference]: With dead ends: 1410 [2018-11-23 11:00:24,976 INFO L226 Difference]: Without dead ends: 902 [2018-11-23 11:00:24,977 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 121 GetRequests, 111 SyntacticMatches, 0 SemanticMatches, 10 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 3 ImplicationChecksByTransitivity, 0.1s TimeCoverageRelationStatistics Valid=44, Invalid=88, Unknown=0, NotChecked=0, Total=132 [2018-11-23 11:00:24,978 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 902 states. [2018-11-23 11:00:25,907 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 902 to 614. [2018-11-23 11:00:25,907 INFO L214 AbstractMinimizeNwa]: Start testing correctness of minimizeSevpa [2018-11-23 11:00:25,908 INFO L82 GeneralOperation]: Start isEquivalent. First operand 902 states. Second operand 614 states. [2018-11-23 11:00:25,908 INFO L74 IsIncluded]: Start isIncluded. First operand 902 states. Second operand 614 states. [2018-11-23 11:00:25,908 INFO L87 Difference]: Start difference. First operand 902 states. Second operand 614 states. [2018-11-23 11:00:25,939 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 11:00:25,939 INFO L93 Difference]: Finished difference Result 902 states and 1331 transitions. [2018-11-23 11:00:25,939 INFO L276 IsEmpty]: Start isEmpty. Operand 902 states and 1331 transitions. [2018-11-23 11:00:25,941 INFO L282 IsEmpty]: Finished isEmpty. No accepting run. [2018-11-23 11:00:25,941 INFO L83 IsIncluded]: Finished isIncluded. Language is included [2018-11-23 11:00:25,941 INFO L74 IsIncluded]: Start isIncluded. First operand 614 states. Second operand 902 states. [2018-11-23 11:00:25,941 INFO L87 Difference]: Start difference. First operand 614 states. Second operand 902 states. [2018-11-23 11:00:25,985 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 11:00:25,986 INFO L93 Difference]: Finished difference Result 902 states and 1331 transitions. [2018-11-23 11:00:25,986 INFO L276 IsEmpty]: Start isEmpty. Operand 902 states and 1331 transitions. [2018-11-23 11:00:25,987 INFO L282 IsEmpty]: Finished isEmpty. No accepting run. [2018-11-23 11:00:25,988 INFO L83 IsIncluded]: Finished isIncluded. Language is included [2018-11-23 11:00:25,988 INFO L88 GeneralOperation]: Finished isEquivalent. [2018-11-23 11:00:25,988 INFO L221 AbstractMinimizeNwa]: Finished testing correctness of minimizeSevpa [2018-11-23 11:00:25,988 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 614 states. [2018-11-23 11:00:26,011 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 614 states to 614 states and 922 transitions. [2018-11-23 11:00:26,011 INFO L78 Accepts]: Start accepts. Automaton has 614 states and 922 transitions. Word has length 118 [2018-11-23 11:00:26,011 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 11:00:26,011 INFO L480 AbstractCegarLoop]: Abstraction has 614 states and 922 transitions. [2018-11-23 11:00:26,011 INFO L481 AbstractCegarLoop]: Interpolant automaton has 8 states. [2018-11-23 11:00:26,011 INFO L276 IsEmpty]: Start isEmpty. Operand 614 states and 922 transitions. [2018-11-23 11:00:26,013 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 119 [2018-11-23 11:00:26,013 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 11:00:26,013 INFO L402 BasicCegarLoop]: trace histogram [6, 6, 5, 5, 5, 5, 5, 5, 5, 5, 4, 4, 3, 3, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 11:00:26,014 INFO L423 AbstractCegarLoop]: === Iteration 8 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 11:00:26,014 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 11:00:26,014 INFO L82 PathProgramCache]: Analyzing trace with hash 2127944510, now seen corresponding path program 1 times [2018-11-23 11:00:26,015 INFO L223 ckRefinementStrategy]: Switched to mode CVC4_FPBP [2018-11-23 11:00:26,015 INFO L69 tionRefinementEngine]: Using refinement strategy WolfRefinementStrategy No working directory specified, using /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/cvc4nyu Starting monitored process 9 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk (exit command is (exit), workingDir is null) Waiting until toolchain timeout for monitored process 9 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk [2018-11-23 11:00:26,046 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 11:00:29,269 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is sat [2018-11-23 11:00:32,991 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is sat [2018-11-23 11:00:33,697 INFO L469 BasicCegarLoop]: Counterexample might be feasible ----- class de.uni_freiburg.informatik.ultimate.plugins.generator.rcfgbuilder.RCFGBacktranslator [?] CALL call ULTIMATE.init(); VAL [|#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |old(#NULL.base)|=(_ bv0 32), |old(#NULL.offset)|=(_ bv0 32), |old(~#SSLv3_client_data~0.base)|=(_ bv0 32), |old(~#SSLv3_client_data~0.offset)|=(_ bv0 32), |old(~init~0)|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv0 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv0 32)] [?] #NULL.base, #NULL.offset := 0bv32, 0bv32;#valid := #valid[0bv32 := 0bv1];~init~0 := 1bv32;call ~#SSLv3_client_data~0.base, ~#SSLv3_client_data~0.offset := #Ultimate.alloc(100bv32);call write~init~intINTTYPE4(0bv32, ~#SSLv3_client_data~0.base, ~#SSLv3_client_data~0.offset, 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(4bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(8bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(12bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(16bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(20bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(24bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(28bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(32bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(36bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(40bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(44bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(48bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(52bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(56bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(60bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(64bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(68bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(72bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(76bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(80bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(84bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(88bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(92bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(96bv32, ~#SSLv3_client_data~0.offset), 4bv32); VAL [|#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |old(#NULL.base)|=(_ bv0 32), |old(#NULL.offset)|=(_ bv0 32), |old(~#SSLv3_client_data~0.base)|=(_ bv0 32), |old(~#SSLv3_client_data~0.offset)|=(_ bv0 32), |old(~init~0)|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume true; VAL [|#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |old(#NULL.base)|=(_ bv0 32), |old(#NULL.offset)|=(_ bv0 32), |old(~#SSLv3_client_data~0.base)|=(_ bv0 32), |old(~#SSLv3_client_data~0.offset)|=(_ bv0 32), |old(~init~0)|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] RET #544#return; VAL [|#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] CALL call #t~ret138 := main(); VAL [|#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] call #t~malloc3.base, #t~malloc3.offset := #Ultimate.alloc(248bv32);~s~0.base, ~s~0.offset := #t~malloc3.base, #t~malloc3.offset;call #t~malloc4.base, #t~malloc4.offset := #Ultimate.alloc(899bv32);call write~$Pointer$(#t~malloc4.base, #t~malloc4.offset, ~s~0.base, ~bvadd32(84bv32, ~s~0.offset), 4bv32);call #t~malloc5.base, #t~malloc5.offset := #Ultimate.alloc(232bv32);call write~$Pointer$(#t~malloc5.base, #t~malloc5.offset, ~s~0.base, ~bvadd32(204bv32, ~s~0.offset), 4bv32);call #t~malloc6.base, #t~malloc6.offset := #Ultimate.alloc(200bv32);call write~$Pointer$(#t~malloc6.base, #t~malloc6.offset, ~s~0.base, ~bvadd32(176bv32, ~s~0.offset), 4bv32);call write~intINTTYPE4(12292bv32, ~s~0.base, ~bvadd32(52bv32, ~s~0.offset), 4bv32);call write~intINTTYPE4(#t~nondet7, ~s~0.base, ~s~0.offset, 4bv32);havoc #t~nondet7; VAL [main_~s~0.base=(_ bv33554433 32), main_~s~0.offset=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |main_#t~malloc3.base|=(_ bv33554433 32), |main_#t~malloc3.offset|=(_ bv0 32), |main_#t~malloc4.base|=(_ bv2147483650 32), |main_#t~malloc4.offset|=(_ bv0 32), |main_#t~malloc5.base|=(_ bv3 32), |main_#t~malloc5.offset|=(_ bv0 32), |main_#t~malloc6.base|=(_ bv2 32), |main_#t~malloc6.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] CALL call #t~ret8 := ssl3_connect(~s~0.base, ~s~0.offset); VAL [|#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] ~s.base, ~s.offset := #in~s.base, #in~s.offset;havoc ~buf~0.base, ~buf~0.offset;havoc ~tmp~2;havoc ~l~0;havoc ~num1~0;havoc ~cb~0.base, ~cb~0.offset;havoc ~ret~0;havoc ~new_state~0;havoc ~state~0;havoc ~skip~0;~tmp___0~1.base, ~tmp___0~1.offset := #t~nondet9.base, #t~nondet9.offset;havoc #t~nondet9.base, #t~nondet9.offset;~tmp___1~0 := #t~nondet10;havoc #t~nondet10;~tmp___2~0 := #t~nondet11;havoc #t~nondet11;~tmp___3~0 := #t~nondet12;havoc #t~nondet12;~tmp___4~0 := #t~nondet13;havoc #t~nondet13;~tmp___5~0 := #t~nondet14;havoc #t~nondet14;~tmp___6~0 := #t~nondet15;havoc #t~nondet15;~tmp___7~0 := #t~nondet16;havoc #t~nondet16;~tmp___8~0 := #t~nondet17;havoc #t~nondet17;~tmp___9~0 := #t~nondet18;havoc #t~nondet18;havoc ~blastFlag~0;~blastFlag~0 := 0bv32;call write~intINTTYPE4(#t~nondet19, ~s.base, ~bvadd32(92bv32, ~s.offset), 4bv32);havoc #t~nondet19;call write~intINTTYPE4(12292bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32);~tmp~2 := #t~nondet20;havoc #t~nondet20;~cb~0.base, ~cb~0.offset := 0bv32, 0bv32;~ret~0 := 4294967295bv32;~skip~0 := 0bv32;call write~intINTTYPE4(0bv32, ~tmp___0~1.base, ~tmp___0~1.offset, 4bv32);call #t~mem21.base, #t~mem21.offset := read~$Pointer$(~s.base, ~bvadd32(192bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv0 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem21.base|=(_ bv0 32), |ssl3_connect_#t~mem21.offset|=(_ bv1 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume 0bv32 != ~bvadd32(#t~mem21.base, #t~mem21.offset);havoc #t~mem21.base, #t~mem21.offset;call #t~mem22.base, #t~mem22.offset := read~$Pointer$(~s.base, ~bvadd32(192bv32, ~s.offset), 4bv32);~cb~0.base, ~cb~0.offset := #t~mem22.base, #t~mem22.offset;havoc #t~mem22.base, #t~mem22.offset; VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] call #t~mem27 := read~intINTTYPE4(~s.base, ~bvadd32(28bv32, ~s.offset), 4bv32);call write~intINTTYPE4(~bvadd32(1bv32, #t~mem27), ~s.base, ~bvadd32(28bv32, ~s.offset), 4bv32);havoc #t~mem27; VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(0bv32 != ~bvand32(12288bv32, ~tmp___1~0)); VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !false; VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] call #t~mem28 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32);~state~0 := #t~mem28;havoc #t~mem28;call #t~mem29 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv12292 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem29|=(_ bv12292 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume 12292bv32 == #t~mem29;havoc #t~mem29; VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv12292 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] call write~intINTTYPE4(1bv32, ~s.base, ~bvadd32(40bv32, ~s.offset), 4bv32);call write~intINTTYPE4(4096bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32);call #t~mem62.base, #t~mem62.offset := read~$Pointer$(~s.base, ~bvadd32(204bv32, ~s.offset), 4bv32);call #t~mem63 := read~intINTTYPE4(#t~mem62.base, ~bvadd32(64bv32, #t~mem62.offset), 4bv32);call write~intINTTYPE4(~bvadd32(1bv32, #t~mem63), #t~mem62.base, ~bvadd32(64bv32, #t~mem62.offset), 4bv32);havoc #t~mem62.base, #t~mem62.offset;havoc #t~mem63; VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv12292 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(36bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv12292 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume 0bv32 != ~bvadd32(~cb~0.base, ~cb~0.offset); VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv12292 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] call #t~mem64 := read~intINTTYPE4(~s.base, ~s.offset, 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv12292 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem64|=(_ bv768 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(768bv32 != ~bvand32(65280bv32, #t~mem64));havoc #t~mem64;call write~intINTTYPE4(4096bv32, ~s.base, ~bvadd32(4bv32, ~s.offset), 4bv32);call #t~mem65.base, #t~mem65.offset := read~$Pointer$(~s.base, ~bvadd32(60bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv12292 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem65.base|=(_ bv0 32), |ssl3_connect_#t~mem65.offset|=(_ bv1 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(0bv32 == ~bvadd32(#t~mem65.base, #t~mem65.offset));havoc #t~mem65.base, #t~mem65.offset; VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv12292 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(0bv32 == ~tmp___4~0); VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv12292 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(0bv32 == ~tmp___5~0);call write~intINTTYPE4(4368bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32);call #t~mem67.base, #t~mem67.offset := read~$Pointer$(~s.base, ~bvadd32(204bv32, ~s.offset), 4bv32);call #t~mem68 := read~intINTTYPE4(#t~mem67.base, ~bvadd32(60bv32, #t~mem67.offset), 4bv32);call write~intINTTYPE4(~bvadd32(1bv32, #t~mem68), #t~mem67.base, ~bvadd32(60bv32, #t~mem67.offset), 4bv32);havoc #t~mem68;havoc #t~mem67.base, #t~mem67.offset;call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(64bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv12292 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] call #t~mem127.base, #t~mem127.offset := read~$Pointer$(~s.base, ~bvadd32(84bv32, ~s.offset), 4bv32);call #t~mem128 := read~intINTTYPE4(#t~mem127.base, ~bvadd32(848bv32, #t~mem127.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv12292 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem127.base|=(_ bv33554433 32), |ssl3_connect_#t~mem127.offset|=(_ bv4294966500 32), |ssl3_connect_#t~mem128|=(_ bv4368 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(0bv32 == #t~mem128);havoc #t~mem127.base, #t~mem127.offset;havoc #t~mem128; VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv12292 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] ~skip~0 := 0bv32; VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv12292 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !false; VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv12292 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] call #t~mem28 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32);~state~0 := #t~mem28;havoc #t~mem28;call #t~mem29 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4368 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem29|=(_ bv4368 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(12292bv32 == #t~mem29);havoc #t~mem29;call #t~mem30 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4368 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem30|=(_ bv4368 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(16384bv32 == #t~mem30);havoc #t~mem30;call #t~mem31 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4368 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem31|=(_ bv4368 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4096bv32 == #t~mem31);havoc #t~mem31;call #t~mem32 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4368 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem32|=(_ bv4368 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(20480bv32 == #t~mem32);havoc #t~mem32;call #t~mem33 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4368 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem33|=(_ bv4368 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4099bv32 == #t~mem33);havoc #t~mem33;call #t~mem34 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4368 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem34|=(_ bv4368 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume 4368bv32 == #t~mem34;havoc #t~mem34; VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4368 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(48bv32, ~s.offset), 4bv32);~ret~0 := #t~nondet69;havoc #t~nondet69; VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4368 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume 0bv32 == ~blastFlag~0;~blastFlag~0 := 1bv32; VAL [ssl3_connect_~blastFlag~0=(_ bv1 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4368 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !~bvsle32(~ret~0, 0bv32);call write~intINTTYPE4(4384bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32);call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(64bv32, ~s.offset), 4bv32);call #t~mem70.base, #t~mem70.offset := read~$Pointer$(~s.base, ~bvadd32(20bv32, ~s.offset), 4bv32);call #t~mem71.base, #t~mem71.offset := read~$Pointer$(~s.base, ~bvadd32(16bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv1 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4368 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem70.base|=(_ bv1 32), |ssl3_connect_#t~mem70.offset|=(_ bv0 32), |ssl3_connect_#t~mem71.base|=(_ bv0 32), |ssl3_connect_#t~mem71.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume ~bvadd32(#t~mem70.base, #t~mem70.offset) != ~bvadd32(#t~mem71.base, #t~mem71.offset);havoc #t~mem71.base, #t~mem71.offset;havoc #t~mem70.base, #t~mem70.offset; VAL [ssl3_connect_~blastFlag~0=(_ bv1 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4368 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] call #t~mem127.base, #t~mem127.offset := read~$Pointer$(~s.base, ~bvadd32(84bv32, ~s.offset), 4bv32);call #t~mem128 := read~intINTTYPE4(#t~mem127.base, ~bvadd32(848bv32, #t~mem127.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv1 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4368 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem127.base|=(_ bv33554433 32), |ssl3_connect_#t~mem127.offset|=(_ bv4294966500 32), |ssl3_connect_#t~mem128|=(_ bv4384 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(0bv32 == #t~mem128);havoc #t~mem127.base, #t~mem127.offset;havoc #t~mem128; VAL [ssl3_connect_~blastFlag~0=(_ bv1 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4368 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] ~skip~0 := 0bv32; VAL [ssl3_connect_~blastFlag~0=(_ bv1 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4368 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !false; VAL [ssl3_connect_~blastFlag~0=(_ bv1 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4368 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] call #t~mem28 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32);~state~0 := #t~mem28;havoc #t~mem28;call #t~mem29 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv1 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4384 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem29|=(_ bv4384 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(12292bv32 == #t~mem29);havoc #t~mem29;call #t~mem30 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv1 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4384 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem30|=(_ bv4384 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(16384bv32 == #t~mem30);havoc #t~mem30;call #t~mem31 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv1 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4384 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem31|=(_ bv4384 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4096bv32 == #t~mem31);havoc #t~mem31;call #t~mem32 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv1 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4384 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem32|=(_ bv4384 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(20480bv32 == #t~mem32);havoc #t~mem32;call #t~mem33 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv1 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4384 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem33|=(_ bv4384 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4099bv32 == #t~mem33);havoc #t~mem33;call #t~mem34 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv1 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4384 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem34|=(_ bv4384 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4368bv32 == #t~mem34);havoc #t~mem34;call #t~mem35 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv1 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4384 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem35|=(_ bv4384 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4369bv32 == #t~mem35);havoc #t~mem35;call #t~mem36 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv1 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4384 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem36|=(_ bv4384 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume 4384bv32 == #t~mem36;havoc #t~mem36; VAL [ssl3_connect_~blastFlag~0=(_ bv1 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4384 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] ~ret~0 := #t~nondet72;havoc #t~nondet72; VAL [ssl3_connect_~blastFlag~0=(_ bv1 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4384 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume 1bv32 == ~blastFlag~0;~blastFlag~0 := 2bv32; VAL [ssl3_connect_~blastFlag~0=(_ bv2 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4384 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !~bvsle32(~ret~0, 0bv32);call #t~mem73 := read~intINTTYPE4(~s.base, ~bvadd32(92bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv2 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4384 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem73|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(0bv32 != #t~mem73);havoc #t~mem73;call write~intINTTYPE4(4400bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv2 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4384 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(64bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv2 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4384 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] call #t~mem127.base, #t~mem127.offset := read~$Pointer$(~s.base, ~bvadd32(84bv32, ~s.offset), 4bv32);call #t~mem128 := read~intINTTYPE4(#t~mem127.base, ~bvadd32(848bv32, #t~mem127.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv2 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4384 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem127.base|=(_ bv33554433 32), |ssl3_connect_#t~mem127.offset|=(_ bv4294966500 32), |ssl3_connect_#t~mem128|=(_ bv4400 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(0bv32 == #t~mem128);havoc #t~mem127.base, #t~mem127.offset;havoc #t~mem128; VAL [ssl3_connect_~blastFlag~0=(_ bv2 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4384 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] ~skip~0 := 0bv32; VAL [ssl3_connect_~blastFlag~0=(_ bv2 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4384 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !false; VAL [ssl3_connect_~blastFlag~0=(_ bv2 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4384 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] call #t~mem28 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32);~state~0 := #t~mem28;havoc #t~mem28;call #t~mem29 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv2 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4400 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem29|=(_ bv4400 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(12292bv32 == #t~mem29);havoc #t~mem29;call #t~mem30 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv2 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4400 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem30|=(_ bv4400 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(16384bv32 == #t~mem30);havoc #t~mem30;call #t~mem31 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv2 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4400 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem31|=(_ bv4400 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4096bv32 == #t~mem31);havoc #t~mem31;call #t~mem32 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv2 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4400 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem32|=(_ bv4400 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(20480bv32 == #t~mem32);havoc #t~mem32;call #t~mem33 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv2 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4400 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem33|=(_ bv4400 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4099bv32 == #t~mem33);havoc #t~mem33;call #t~mem34 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv2 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4400 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem34|=(_ bv4400 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4368bv32 == #t~mem34);havoc #t~mem34;call #t~mem35 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv2 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4400 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem35|=(_ bv4400 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4369bv32 == #t~mem35);havoc #t~mem35;call #t~mem36 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv2 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4400 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem36|=(_ bv4400 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4384bv32 == #t~mem36);havoc #t~mem36;call #t~mem37 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv2 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4400 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem37|=(_ bv4400 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4385bv32 == #t~mem37);havoc #t~mem37;call #t~mem38 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv2 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4400 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem38|=(_ bv4400 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume 4400bv32 == #t~mem38;havoc #t~mem38; VAL [ssl3_connect_~blastFlag~0=(_ bv2 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4400 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] call #t~mem74.base, #t~mem74.offset := read~$Pointer$(~s.base, ~bvadd32(84bv32, ~s.offset), 4bv32);call #t~mem75.base, #t~mem75.offset := read~$Pointer$(#t~mem74.base, ~bvadd32(836bv32, #t~mem74.offset), 4bv32);call #t~mem76 := read~intINTTYPE4(#t~mem75.base, ~bvadd32(12bv32, #t~mem75.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv2 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4400 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem74.base|=(_ bv33554433 32), |ssl3_connect_#t~mem74.offset|=(_ bv4294966500 32), |ssl3_connect_#t~mem75.base|=(_ bv33554433 32), |ssl3_connect_#t~mem75.offset|=(_ bv52 32), |ssl3_connect_#t~mem76|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(0bv32 != ~bvand32(256bv32, #t~mem76));havoc #t~mem76;havoc #t~mem75.base, #t~mem75.offset;havoc #t~mem74.base, #t~mem74.offset;~ret~0 := #t~nondet77;havoc #t~nondet77; VAL [ssl3_connect_~blastFlag~0=(_ bv2 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4400 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume 2bv32 == ~blastFlag~0;~blastFlag~0 := 3bv32; VAL [ssl3_connect_~blastFlag~0=(_ bv3 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4400 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !~bvsle32(~ret~0, 0bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv3 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4400 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] call write~intINTTYPE4(4416bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32);call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(64bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv3 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4400 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] call #t~mem127.base, #t~mem127.offset := read~$Pointer$(~s.base, ~bvadd32(84bv32, ~s.offset), 4bv32);call #t~mem128 := read~intINTTYPE4(#t~mem127.base, ~bvadd32(848bv32, #t~mem127.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv3 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4400 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem127.base|=(_ bv33554433 32), |ssl3_connect_#t~mem127.offset|=(_ bv4294966500 32), |ssl3_connect_#t~mem128|=(_ bv4416 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(0bv32 == #t~mem128);havoc #t~mem127.base, #t~mem127.offset;havoc #t~mem128; VAL [ssl3_connect_~blastFlag~0=(_ bv3 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4400 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] ~skip~0 := 0bv32; VAL [ssl3_connect_~blastFlag~0=(_ bv3 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4400 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !false; VAL [ssl3_connect_~blastFlag~0=(_ bv3 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4400 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] call #t~mem28 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32);~state~0 := #t~mem28;havoc #t~mem28;call #t~mem29 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv3 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4416 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem29|=(_ bv4416 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(12292bv32 == #t~mem29);havoc #t~mem29;call #t~mem30 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv3 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4416 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem30|=(_ bv4416 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(16384bv32 == #t~mem30);havoc #t~mem30;call #t~mem31 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv3 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4416 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem31|=(_ bv4416 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4096bv32 == #t~mem31);havoc #t~mem31;call #t~mem32 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv3 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4416 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem32|=(_ bv4416 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(20480bv32 == #t~mem32);havoc #t~mem32;call #t~mem33 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv3 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4416 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem33|=(_ bv4416 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4099bv32 == #t~mem33);havoc #t~mem33;call #t~mem34 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv3 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4416 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem34|=(_ bv4416 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4368bv32 == #t~mem34);havoc #t~mem34;call #t~mem35 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv3 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4416 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem35|=(_ bv4416 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4369bv32 == #t~mem35);havoc #t~mem35;call #t~mem36 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv3 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4416 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem36|=(_ bv4416 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4384bv32 == #t~mem36);havoc #t~mem36;call #t~mem37 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv3 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4416 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem37|=(_ bv4416 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4385bv32 == #t~mem37);havoc #t~mem37;call #t~mem38 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv3 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4416 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem38|=(_ bv4416 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4400bv32 == #t~mem38);havoc #t~mem38;call #t~mem39 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv3 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4416 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem39|=(_ bv4416 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4401bv32 == #t~mem39);havoc #t~mem39;call #t~mem40 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv3 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4416 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem40|=(_ bv4416 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume 4416bv32 == #t~mem40;havoc #t~mem40; VAL [ssl3_connect_~blastFlag~0=(_ bv3 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4416 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] ~ret~0 := #t~nondet78;havoc #t~nondet78; VAL [ssl3_connect_~blastFlag~0=(_ bv3 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4416 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume 3bv32 == ~blastFlag~0;~blastFlag~0 := 4bv32; VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4416 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !~bvsle32(~ret~0, 0bv32);call write~intINTTYPE4(4432bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32);call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(64bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4416 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(0bv32 == ~tmp___6~0); VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4416 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] call #t~mem127.base, #t~mem127.offset := read~$Pointer$(~s.base, ~bvadd32(84bv32, ~s.offset), 4bv32);call #t~mem128 := read~intINTTYPE4(#t~mem127.base, ~bvadd32(848bv32, #t~mem127.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4416 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem127.base|=(_ bv33554433 32), |ssl3_connect_#t~mem127.offset|=(_ bv4294966500 32), |ssl3_connect_#t~mem128|=(_ bv4432 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(0bv32 == #t~mem128);havoc #t~mem127.base, #t~mem127.offset;havoc #t~mem128; VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4416 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] ~skip~0 := 0bv32; VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4416 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !false; VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4416 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] call #t~mem28 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32);~state~0 := #t~mem28;havoc #t~mem28;call #t~mem29 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4432 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem29|=(_ bv4432 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(12292bv32 == #t~mem29);havoc #t~mem29;call #t~mem30 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4432 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem30|=(_ bv4432 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(16384bv32 == #t~mem30);havoc #t~mem30;call #t~mem31 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4432 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem31|=(_ bv4432 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4096bv32 == #t~mem31);havoc #t~mem31;call #t~mem32 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4432 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem32|=(_ bv4432 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(20480bv32 == #t~mem32);havoc #t~mem32;call #t~mem33 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4432 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem33|=(_ bv4432 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4099bv32 == #t~mem33);havoc #t~mem33;call #t~mem34 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4432 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem34|=(_ bv4432 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4368bv32 == #t~mem34);havoc #t~mem34;call #t~mem35 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4432 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem35|=(_ bv4432 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4369bv32 == #t~mem35);havoc #t~mem35;call #t~mem36 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4432 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem36|=(_ bv4432 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4384bv32 == #t~mem36);havoc #t~mem36;call #t~mem37 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4432 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem37|=(_ bv4432 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4385bv32 == #t~mem37);havoc #t~mem37;call #t~mem38 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4432 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem38|=(_ bv4432 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4400bv32 == #t~mem38);havoc #t~mem38;call #t~mem39 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4432 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem39|=(_ bv4432 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4401bv32 == #t~mem39);havoc #t~mem39;call #t~mem40 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4432 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem40|=(_ bv4432 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4416bv32 == #t~mem40);havoc #t~mem40;call #t~mem41 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4432 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem41|=(_ bv4432 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4417bv32 == #t~mem41);havoc #t~mem41;call #t~mem42 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4432 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem42|=(_ bv4432 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume 4432bv32 == #t~mem42;havoc #t~mem42; VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4432 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] ~ret~0 := #t~nondet79;havoc #t~nondet79; VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv0 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4432 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume 4bv32 == ~blastFlag~0; VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv0 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4432 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !false; VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv0 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4432 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] CALL call ULTIMATE.init(); VAL [#NULL.base=0bv32, #NULL.offset=0bv32, old(#NULL.base)=0bv32, old(#NULL.offset)=0bv32, old(~#SSLv3_client_data~0.base)=0bv32, old(~#SSLv3_client_data~0.offset)=0bv32, old(~init~0)=0bv32, ~#SSLv3_client_data~0.base=0bv32, ~#SSLv3_client_data~0.offset=0bv32, ~init~0=0bv32] [?] #NULL.base, #NULL.offset := 0bv32, 0bv32; [?] #valid := #valid[0bv32 := 0bv1]; [L1042] ~init~0 := 1bv32; [L1043] call ~#SSLv3_client_data~0.base, ~#SSLv3_client_data~0.offset := #Ultimate.alloc(100bv32); [L1043] call write~init~intINTTYPE4(0bv32, ~#SSLv3_client_data~0.base, ~#SSLv3_client_data~0.offset, 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(4bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(8bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(12bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(16bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(20bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(24bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(28bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(32bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(36bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(40bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(44bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(48bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(52bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(56bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(60bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(64bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(68bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(72bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(76bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(80bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(84bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(88bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(92bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(96bv32, ~#SSLv3_client_data~0.offset), 4bv32); VAL [#NULL.base=0bv32, #NULL.offset=0bv32, old(#NULL.base)=0bv32, old(#NULL.offset)=0bv32, old(~#SSLv3_client_data~0.base)=0bv32, old(~#SSLv3_client_data~0.offset)=0bv32, old(~init~0)=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~init~0=1bv32] [?] ensures true; VAL [#NULL.base=0bv32, #NULL.offset=0bv32, old(#NULL.base)=0bv32, old(#NULL.offset)=0bv32, old(~#SSLv3_client_data~0.base)=0bv32, old(~#SSLv3_client_data~0.offset)=0bv32, old(~init~0)=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~init~0=1bv32] [?] RET call ULTIMATE.init(); VAL [#NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~init~0=1bv32] [?] CALL call #t~ret138 := main(); VAL [#NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~init~0=1bv32] [L1065] call #t~malloc3.base, #t~malloc3.offset := #Ultimate.alloc(248bv32); [L1065] ~s~0.base, ~s~0.offset := #t~malloc3.base, #t~malloc3.offset; [L1069] call #t~malloc4.base, #t~malloc4.offset := #Ultimate.alloc(899bv32); [L1069] call write~$Pointer$(#t~malloc4.base, #t~malloc4.offset, ~s~0.base, ~bvadd32(84bv32, ~s~0.offset), 4bv32); [L1070] call #t~malloc5.base, #t~malloc5.offset := #Ultimate.alloc(232bv32); [L1070] call write~$Pointer$(#t~malloc5.base, #t~malloc5.offset, ~s~0.base, ~bvadd32(204bv32, ~s~0.offset), 4bv32); [L1071] call #t~malloc6.base, #t~malloc6.offset := #Ultimate.alloc(200bv32); [L1071] call write~$Pointer$(#t~malloc6.base, #t~malloc6.offset, ~s~0.base, ~bvadd32(176bv32, ~s~0.offset), 4bv32); [L1072] call write~intINTTYPE4(12292bv32, ~s~0.base, ~bvadd32(52bv32, ~s~0.offset), 4bv32); [L1073] call write~intINTTYPE4(#t~nondet7, ~s~0.base, ~s~0.offset, 4bv32); [L1073] havoc #t~nondet7; VAL [#NULL.base=0bv32, #NULL.offset=0bv32, #t~malloc3.base=33554433bv32, #t~malloc3.offset=0bv32, #t~malloc4.base=2147483650bv32, #t~malloc4.offset=0bv32, #t~malloc5.base=3bv32, #t~malloc5.offset=0bv32, #t~malloc6.base=2bv32, #t~malloc6.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~init~0=1bv32, ~s~0.base=33554433bv32, ~s~0.offset=0bv32] [L1074] CALL call #t~ret8 := ssl3_connect(~s~0.base, ~s~0.offset); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~init~0=1bv32] [L1079-L1645] ~s.base, ~s.offset := #in~s.base, #in~s.offset; [L1080] havoc ~buf~0.base, ~buf~0.offset; [L1081] havoc ~tmp~2; [L1082] havoc ~l~0; [L1083] havoc ~num1~0; [L1084] havoc ~cb~0.base, ~cb~0.offset; [L1085] havoc ~ret~0; [L1086] havoc ~new_state~0; [L1087] havoc ~state~0; [L1088] havoc ~skip~0; [L1089] ~tmp___0~1.base, ~tmp___0~1.offset := #t~nondet9.base, #t~nondet9.offset; [L1089] havoc #t~nondet9.base, #t~nondet9.offset; [L1090] ~tmp___1~0 := #t~nondet10; [L1090] havoc #t~nondet10; [L1091] ~tmp___2~0 := #t~nondet11; [L1091] havoc #t~nondet11; [L1092] ~tmp___3~0 := #t~nondet12; [L1092] havoc #t~nondet12; [L1093] ~tmp___4~0 := #t~nondet13; [L1093] havoc #t~nondet13; [L1094] ~tmp___5~0 := #t~nondet14; [L1094] havoc #t~nondet14; [L1095] ~tmp___6~0 := #t~nondet15; [L1095] havoc #t~nondet15; [L1096] ~tmp___7~0 := #t~nondet16; [L1096] havoc #t~nondet16; [L1097] ~tmp___8~0 := #t~nondet17; [L1097] havoc #t~nondet17; [L1098] ~tmp___9~0 := #t~nondet18; [L1098] havoc #t~nondet18; [L1099] havoc ~blastFlag~0; [L1102] ~blastFlag~0 := 0bv32; [L1103] call write~intINTTYPE4(#t~nondet19, ~s.base, ~bvadd32(92bv32, ~s.offset), 4bv32); [L1103] havoc #t~nondet19; [L1104] call write~intINTTYPE4(12292bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); [L1105] ~tmp~2 := #t~nondet20; [L1105] havoc #t~nondet20; [L1106] ~cb~0.base, ~cb~0.offset := 0bv32, 0bv32; [L1107] ~ret~0 := 4294967295bv32; [L1108] ~skip~0 := 0bv32; [L1109] call write~intINTTYPE4(0bv32, ~tmp___0~1.base, ~tmp___0~1.offset, 4bv32); [L1110] call #t~mem21.base, #t~mem21.offset := read~$Pointer$(~s.base, ~bvadd32(192bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem21.base=0bv32, #t~mem21.offset=1bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=0bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1110-L1118] assume 0bv32 != ~bvadd32(#t~mem21.base, #t~mem21.offset); [L1110] havoc #t~mem21.base, #t~mem21.offset; [L1111] call #t~mem22.base, #t~mem22.offset := read~$Pointer$(~s.base, ~bvadd32(192bv32, ~s.offset), 4bv32); [L1111] ~cb~0.base, ~cb~0.offset := #t~mem22.base, #t~mem22.offset; [L1111] havoc #t~mem22.base, #t~mem22.offset; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1119] call #t~mem27 := read~intINTTYPE4(~s.base, ~bvadd32(28bv32, ~s.offset), 4bv32); [L1119] call write~intINTTYPE4(~bvadd32(1bv32, #t~mem27), ~s.base, ~bvadd32(28bv32, ~s.offset), 4bv32); [L1119] havoc #t~mem27; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1120-L1128] assume !(0bv32 != ~bvand32(12288bv32, ~tmp___1~0)); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] assume !false; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] call #t~mem28 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] call #t~mem29 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem29=12292bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133-L1601] assume 12292bv32 == #t~mem29; [L1133] havoc #t~mem29; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1236] call write~intINTTYPE4(1bv32, ~s.base, ~bvadd32(40bv32, ~s.offset), 4bv32); [L1237] call write~intINTTYPE4(4096bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); [L1238] call #t~mem62.base, #t~mem62.offset := read~$Pointer$(~s.base, ~bvadd32(204bv32, ~s.offset), 4bv32); [L1238] call #t~mem63 := read~intINTTYPE4(#t~mem62.base, ~bvadd32(64bv32, #t~mem62.offset), 4bv32); [L1238] call write~intINTTYPE4(~bvadd32(1bv32, #t~mem63), #t~mem62.base, ~bvadd32(64bv32, #t~mem62.offset), 4bv32); [L1238] havoc #t~mem62.base, #t~mem62.offset; [L1238] havoc #t~mem63; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1243] call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(36bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1244-L1248] assume 0bv32 != ~bvadd32(~cb~0.base, ~cb~0.offset); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1249] call #t~mem64 := read~intINTTYPE4(~s.base, ~s.offset, 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem64=768bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1249-L1254] assume !(768bv32 != ~bvand32(65280bv32, #t~mem64)); [L1249] havoc #t~mem64; [L1255] call write~intINTTYPE4(4096bv32, ~s.base, ~bvadd32(4bv32, ~s.offset), 4bv32); [L1256] call #t~mem65.base, #t~mem65.offset := read~$Pointer$(~s.base, ~bvadd32(60bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem65.base=0bv32, #t~mem65.offset=1bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1256-L1273] assume !(0bv32 == ~bvadd32(#t~mem65.base, #t~mem65.offset)); [L1256] havoc #t~mem65.base, #t~mem65.offset; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1274-L1279] assume !(0bv32 == ~tmp___4~0); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1280-L1285] assume !(0bv32 == ~tmp___5~0); [L1286] call write~intINTTYPE4(4368bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); [L1287] call #t~mem67.base, #t~mem67.offset := read~$Pointer$(~s.base, ~bvadd32(204bv32, ~s.offset), 4bv32); [L1287] call #t~mem68 := read~intINTTYPE4(#t~mem67.base, ~bvadd32(60bv32, #t~mem67.offset), 4bv32); [L1287] call write~intINTTYPE4(~bvadd32(1bv32, #t~mem68), #t~mem67.base, ~bvadd32(60bv32, #t~mem67.offset), 4bv32); [L1287] havoc #t~mem68; [L1287] havoc #t~mem67.base, #t~mem67.offset; [L1288] call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(64bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] call #t~mem127.base, #t~mem127.offset := read~$Pointer$(~s.base, ~bvadd32(84bv32, ~s.offset), 4bv32); [L1602] call #t~mem128 := read~intINTTYPE4(#t~mem127.base, ~bvadd32(848bv32, #t~mem127.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem127.base=33554433bv32, #t~mem127.offset=4294966500bv32, #t~mem128=4368bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602-L1630] assume !(0bv32 == #t~mem128); [L1602] havoc #t~mem127.base, #t~mem127.offset; [L1602] havoc #t~mem128; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1631] ~skip~0 := 0bv32; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] assume !false; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] call #t~mem28 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] call #t~mem29 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem29=4368bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133-L1601] assume !(12292bv32 == #t~mem29); [L1133] havoc #t~mem29; [L1136] call #t~mem30 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem30=4368bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1136-L1600] assume !(16384bv32 == #t~mem30); [L1136] havoc #t~mem30; [L1139] call #t~mem31 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem31=4368bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1139-L1599] assume !(4096bv32 == #t~mem31); [L1139] havoc #t~mem31; [L1142] call #t~mem32 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem32=4368bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1142-L1598] assume !(20480bv32 == #t~mem32); [L1142] havoc #t~mem32; [L1145] call #t~mem33 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem33=4368bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1145-L1597] assume !(4099bv32 == #t~mem33); [L1145] havoc #t~mem33; [L1148] call #t~mem34 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem34=4368bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1148-L1596] assume 4368bv32 == #t~mem34; [L1148] havoc #t~mem34; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1292] call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(48bv32, ~s.offset), 4bv32); [L1293] ~ret~0 := #t~nondet69; [L1293] havoc #t~nondet69; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1294-L1298] assume 0bv32 == ~blastFlag~0; [L1295] ~blastFlag~0 := 1bv32; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1299-L1303] assume !~bvsle32(~ret~0, 0bv32); [L1304] call write~intINTTYPE4(4384bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); [L1305] call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(64bv32, ~s.offset), 4bv32); [L1306] call #t~mem70.base, #t~mem70.offset := read~$Pointer$(~s.base, ~bvadd32(20bv32, ~s.offset), 4bv32); [L1306] call #t~mem71.base, #t~mem71.offset := read~$Pointer$(~s.base, ~bvadd32(16bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem70.base=1bv32, #t~mem70.offset=0bv32, #t~mem71.base=0bv32, #t~mem71.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1306-L1310] assume ~bvadd32(#t~mem70.base, #t~mem70.offset) != ~bvadd32(#t~mem71.base, #t~mem71.offset); [L1306] havoc #t~mem71.base, #t~mem71.offset; [L1306] havoc #t~mem70.base, #t~mem70.offset; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] call #t~mem127.base, #t~mem127.offset := read~$Pointer$(~s.base, ~bvadd32(84bv32, ~s.offset), 4bv32); [L1602] call #t~mem128 := read~intINTTYPE4(#t~mem127.base, ~bvadd32(848bv32, #t~mem127.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem127.base=33554433bv32, #t~mem127.offset=4294966500bv32, #t~mem128=4384bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602-L1630] assume !(0bv32 == #t~mem128); [L1602] havoc #t~mem127.base, #t~mem127.offset; [L1602] havoc #t~mem128; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1631] ~skip~0 := 0bv32; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] assume !false; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] call #t~mem28 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] call #t~mem29 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem29=4384bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133-L1601] assume !(12292bv32 == #t~mem29); [L1133] havoc #t~mem29; [L1136] call #t~mem30 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem30=4384bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1136-L1600] assume !(16384bv32 == #t~mem30); [L1136] havoc #t~mem30; [L1139] call #t~mem31 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem31=4384bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1139-L1599] assume !(4096bv32 == #t~mem31); [L1139] havoc #t~mem31; [L1142] call #t~mem32 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem32=4384bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1142-L1598] assume !(20480bv32 == #t~mem32); [L1142] havoc #t~mem32; [L1145] call #t~mem33 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem33=4384bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1145-L1597] assume !(4099bv32 == #t~mem33); [L1145] havoc #t~mem33; [L1148] call #t~mem34 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem34=4384bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1148-L1596] assume !(4368bv32 == #t~mem34); [L1148] havoc #t~mem34; [L1151] call #t~mem35 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem35=4384bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1151-L1595] assume !(4369bv32 == #t~mem35); [L1151] havoc #t~mem35; [L1154] call #t~mem36 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem36=4384bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1154-L1594] assume 4384bv32 == #t~mem36; [L1154] havoc #t~mem36; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1314] ~ret~0 := #t~nondet72; [L1314] havoc #t~nondet72; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1315-L1323] assume 1bv32 == ~blastFlag~0; [L1316] ~blastFlag~0 := 2bv32; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1324-L1328] assume !~bvsle32(~ret~0, 0bv32); [L1329] call #t~mem73 := read~intINTTYPE4(~s.base, ~bvadd32(92bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem73=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1329-L1333] assume !(0bv32 != #t~mem73); [L1329] havoc #t~mem73; [L1332] call write~intINTTYPE4(4400bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1334] call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(64bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] call #t~mem127.base, #t~mem127.offset := read~$Pointer$(~s.base, ~bvadd32(84bv32, ~s.offset), 4bv32); [L1602] call #t~mem128 := read~intINTTYPE4(#t~mem127.base, ~bvadd32(848bv32, #t~mem127.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem127.base=33554433bv32, #t~mem127.offset=4294966500bv32, #t~mem128=4400bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602-L1630] assume !(0bv32 == #t~mem128); [L1602] havoc #t~mem127.base, #t~mem127.offset; [L1602] havoc #t~mem128; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1631] ~skip~0 := 0bv32; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] assume !false; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] call #t~mem28 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] call #t~mem29 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem29=4400bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133-L1601] assume !(12292bv32 == #t~mem29); [L1133] havoc #t~mem29; [L1136] call #t~mem30 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem30=4400bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1136-L1600] assume !(16384bv32 == #t~mem30); [L1136] havoc #t~mem30; [L1139] call #t~mem31 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem31=4400bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1139-L1599] assume !(4096bv32 == #t~mem31); [L1139] havoc #t~mem31; [L1142] call #t~mem32 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem32=4400bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1142-L1598] assume !(20480bv32 == #t~mem32); [L1142] havoc #t~mem32; [L1145] call #t~mem33 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem33=4400bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1145-L1597] assume !(4099bv32 == #t~mem33); [L1145] havoc #t~mem33; [L1148] call #t~mem34 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem34=4400bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1148-L1596] assume !(4368bv32 == #t~mem34); [L1148] havoc #t~mem34; [L1151] call #t~mem35 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem35=4400bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1151-L1595] assume !(4369bv32 == #t~mem35); [L1151] havoc #t~mem35; [L1154] call #t~mem36 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem36=4400bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1154-L1594] assume !(4384bv32 == #t~mem36); [L1154] havoc #t~mem36; [L1157] call #t~mem37 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem37=4400bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1157-L1593] assume !(4385bv32 == #t~mem37); [L1157] havoc #t~mem37; [L1160] call #t~mem38 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem38=4400bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1160-L1592] assume 4400bv32 == #t~mem38; [L1160] havoc #t~mem38; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1338] call #t~mem74.base, #t~mem74.offset := read~$Pointer$(~s.base, ~bvadd32(84bv32, ~s.offset), 4bv32); [L1338] call #t~mem75.base, #t~mem75.offset := read~$Pointer$(#t~mem74.base, ~bvadd32(836bv32, #t~mem74.offset), 4bv32); [L1338] call #t~mem76 := read~intINTTYPE4(#t~mem75.base, ~bvadd32(12bv32, #t~mem75.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem74.base=33554433bv32, #t~mem74.offset=4294966500bv32, #t~mem75.base=33554433bv32, #t~mem75.offset=52bv32, #t~mem76=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1338-L1352] assume !(0bv32 != ~bvand32(256bv32, #t~mem76)); [L1338] havoc #t~mem76; [L1338] havoc #t~mem75.base, #t~mem75.offset; [L1338] havoc #t~mem74.base, #t~mem74.offset; [L1341] ~ret~0 := #t~nondet77; [L1341] havoc #t~nondet77; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1342-L1346] assume 2bv32 == ~blastFlag~0; [L1343] ~blastFlag~0 := 3bv32; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1347-L1351] assume !~bvsle32(~ret~0, 0bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1353] call write~intINTTYPE4(4416bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); [L1354] call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(64bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] call #t~mem127.base, #t~mem127.offset := read~$Pointer$(~s.base, ~bvadd32(84bv32, ~s.offset), 4bv32); [L1602] call #t~mem128 := read~intINTTYPE4(#t~mem127.base, ~bvadd32(848bv32, #t~mem127.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem127.base=33554433bv32, #t~mem127.offset=4294966500bv32, #t~mem128=4416bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602-L1630] assume !(0bv32 == #t~mem128); [L1602] havoc #t~mem127.base, #t~mem127.offset; [L1602] havoc #t~mem128; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1631] ~skip~0 := 0bv32; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] assume !false; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] call #t~mem28 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] call #t~mem29 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem29=4416bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133-L1601] assume !(12292bv32 == #t~mem29); [L1133] havoc #t~mem29; [L1136] call #t~mem30 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem30=4416bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1136-L1600] assume !(16384bv32 == #t~mem30); [L1136] havoc #t~mem30; [L1139] call #t~mem31 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem31=4416bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1139-L1599] assume !(4096bv32 == #t~mem31); [L1139] havoc #t~mem31; [L1142] call #t~mem32 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem32=4416bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1142-L1598] assume !(20480bv32 == #t~mem32); [L1142] havoc #t~mem32; [L1145] call #t~mem33 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem33=4416bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1145-L1597] assume !(4099bv32 == #t~mem33); [L1145] havoc #t~mem33; [L1148] call #t~mem34 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem34=4416bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1148-L1596] assume !(4368bv32 == #t~mem34); [L1148] havoc #t~mem34; [L1151] call #t~mem35 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem35=4416bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1151-L1595] assume !(4369bv32 == #t~mem35); [L1151] havoc #t~mem35; [L1154] call #t~mem36 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem36=4416bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1154-L1594] assume !(4384bv32 == #t~mem36); [L1154] havoc #t~mem36; [L1157] call #t~mem37 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem37=4416bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1157-L1593] assume !(4385bv32 == #t~mem37); [L1157] havoc #t~mem37; [L1160] call #t~mem38 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem38=4416bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1160-L1592] assume !(4400bv32 == #t~mem38); [L1160] havoc #t~mem38; [L1163] call #t~mem39 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem39=4416bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1163-L1591] assume !(4401bv32 == #t~mem39); [L1163] havoc #t~mem39; [L1166] call #t~mem40 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem40=4416bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1166-L1590] assume 4416bv32 == #t~mem40; [L1166] havoc #t~mem40; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1358] ~ret~0 := #t~nondet78; [L1358] havoc #t~nondet78; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1359-L1363] assume 3bv32 == ~blastFlag~0; [L1360] ~blastFlag~0 := 4bv32; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1364-L1368] assume !~bvsle32(~ret~0, 0bv32); [L1369] call write~intINTTYPE4(4432bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); [L1370] call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(64bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1371-L1376] assume !(0bv32 == ~tmp___6~0); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] call #t~mem127.base, #t~mem127.offset := read~$Pointer$(~s.base, ~bvadd32(84bv32, ~s.offset), 4bv32); [L1602] call #t~mem128 := read~intINTTYPE4(#t~mem127.base, ~bvadd32(848bv32, #t~mem127.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem127.base=33554433bv32, #t~mem127.offset=4294966500bv32, #t~mem128=4432bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602-L1630] assume !(0bv32 == #t~mem128); [L1602] havoc #t~mem127.base, #t~mem127.offset; [L1602] havoc #t~mem128; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1631] ~skip~0 := 0bv32; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] assume !false; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] call #t~mem28 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] call #t~mem29 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem29=4432bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133-L1601] assume !(12292bv32 == #t~mem29); [L1133] havoc #t~mem29; [L1136] call #t~mem30 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem30=4432bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1136-L1600] assume !(16384bv32 == #t~mem30); [L1136] havoc #t~mem30; [L1139] call #t~mem31 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem31=4432bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1139-L1599] assume !(4096bv32 == #t~mem31); [L1139] havoc #t~mem31; [L1142] call #t~mem32 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem32=4432bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1142-L1598] assume !(20480bv32 == #t~mem32); [L1142] havoc #t~mem32; [L1145] call #t~mem33 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem33=4432bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1145-L1597] assume !(4099bv32 == #t~mem33); [L1145] havoc #t~mem33; [L1148] call #t~mem34 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem34=4432bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1148-L1596] assume !(4368bv32 == #t~mem34); [L1148] havoc #t~mem34; [L1151] call #t~mem35 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem35=4432bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1151-L1595] assume !(4369bv32 == #t~mem35); [L1151] havoc #t~mem35; [L1154] call #t~mem36 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem36=4432bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1154-L1594] assume !(4384bv32 == #t~mem36); [L1154] havoc #t~mem36; [L1157] call #t~mem37 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem37=4432bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1157-L1593] assume !(4385bv32 == #t~mem37); [L1157] havoc #t~mem37; [L1160] call #t~mem38 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem38=4432bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1160-L1592] assume !(4400bv32 == #t~mem38); [L1160] havoc #t~mem38; [L1163] call #t~mem39 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem39=4432bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1163-L1591] assume !(4401bv32 == #t~mem39); [L1163] havoc #t~mem39; [L1166] call #t~mem40 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem40=4432bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1166-L1590] assume !(4416bv32 == #t~mem40); [L1166] havoc #t~mem40; [L1169] call #t~mem41 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem41=4432bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1169-L1589] assume !(4417bv32 == #t~mem41); [L1169] havoc #t~mem41; [L1172] call #t~mem42 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem42=4432bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1172-L1588] assume 4432bv32 == #t~mem42; [L1172] havoc #t~mem42; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1380] ~ret~0 := #t~nondet79; [L1380] havoc #t~nondet79; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=0bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1381-L1385] assume 4bv32 == ~blastFlag~0; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=0bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1643] assert false; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=0bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] ----- ----- class de.uni_freiburg.informatik.ultimate.boogie.preprocessor.BoogiePreprocessorBacktranslator [?] CALL call ULTIMATE.init(); VAL [#NULL.base=0bv32, #NULL.offset=0bv32, old(#NULL.base)=0bv32, old(#NULL.offset)=0bv32, old(~#SSLv3_client_data~0.base)=0bv32, old(~#SSLv3_client_data~0.offset)=0bv32, old(~init~0)=0bv32, ~#SSLv3_client_data~0.base=0bv32, ~#SSLv3_client_data~0.offset=0bv32, ~init~0=0bv32] [?] #NULL.base, #NULL.offset := 0bv32, 0bv32; [?] #valid := #valid[0bv32 := 0bv1]; [L1042] ~init~0 := 1bv32; [L1043] call ~#SSLv3_client_data~0.base, ~#SSLv3_client_data~0.offset := #Ultimate.alloc(100bv32); [L1043] call write~init~intINTTYPE4(0bv32, ~#SSLv3_client_data~0.base, ~#SSLv3_client_data~0.offset, 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(4bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(8bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(12bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(16bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(20bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(24bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(28bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(32bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(36bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(40bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(44bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(48bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(52bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(56bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(60bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(64bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(68bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(72bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(76bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(80bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(84bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(88bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(92bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(96bv32, ~#SSLv3_client_data~0.offset), 4bv32); VAL [#NULL.base=0bv32, #NULL.offset=0bv32, old(#NULL.base)=0bv32, old(#NULL.offset)=0bv32, old(~#SSLv3_client_data~0.base)=0bv32, old(~#SSLv3_client_data~0.offset)=0bv32, old(~init~0)=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~init~0=1bv32] [?] ensures true; VAL [#NULL.base=0bv32, #NULL.offset=0bv32, old(#NULL.base)=0bv32, old(#NULL.offset)=0bv32, old(~#SSLv3_client_data~0.base)=0bv32, old(~#SSLv3_client_data~0.offset)=0bv32, old(~init~0)=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~init~0=1bv32] [?] RET call ULTIMATE.init(); VAL [#NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~init~0=1bv32] [?] CALL call #t~ret138 := main(); VAL [#NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~init~0=1bv32] [L1065] call #t~malloc3.base, #t~malloc3.offset := #Ultimate.alloc(248bv32); [L1065] ~s~0.base, ~s~0.offset := #t~malloc3.base, #t~malloc3.offset; [L1069] call #t~malloc4.base, #t~malloc4.offset := #Ultimate.alloc(899bv32); [L1069] call write~$Pointer$(#t~malloc4.base, #t~malloc4.offset, ~s~0.base, ~bvadd32(84bv32, ~s~0.offset), 4bv32); [L1070] call #t~malloc5.base, #t~malloc5.offset := #Ultimate.alloc(232bv32); [L1070] call write~$Pointer$(#t~malloc5.base, #t~malloc5.offset, ~s~0.base, ~bvadd32(204bv32, ~s~0.offset), 4bv32); [L1071] call #t~malloc6.base, #t~malloc6.offset := #Ultimate.alloc(200bv32); [L1071] call write~$Pointer$(#t~malloc6.base, #t~malloc6.offset, ~s~0.base, ~bvadd32(176bv32, ~s~0.offset), 4bv32); [L1072] call write~intINTTYPE4(12292bv32, ~s~0.base, ~bvadd32(52bv32, ~s~0.offset), 4bv32); [L1073] call write~intINTTYPE4(#t~nondet7, ~s~0.base, ~s~0.offset, 4bv32); [L1073] havoc #t~nondet7; VAL [#NULL.base=0bv32, #NULL.offset=0bv32, #t~malloc3.base=33554433bv32, #t~malloc3.offset=0bv32, #t~malloc4.base=2147483650bv32, #t~malloc4.offset=0bv32, #t~malloc5.base=3bv32, #t~malloc5.offset=0bv32, #t~malloc6.base=2bv32, #t~malloc6.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~init~0=1bv32, ~s~0.base=33554433bv32, ~s~0.offset=0bv32] [L1074] CALL call #t~ret8 := ssl3_connect(~s~0.base, ~s~0.offset); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~init~0=1bv32] [L1079-L1645] ~s.base, ~s.offset := #in~s.base, #in~s.offset; [L1080] havoc ~buf~0.base, ~buf~0.offset; [L1081] havoc ~tmp~2; [L1082] havoc ~l~0; [L1083] havoc ~num1~0; [L1084] havoc ~cb~0.base, ~cb~0.offset; [L1085] havoc ~ret~0; [L1086] havoc ~new_state~0; [L1087] havoc ~state~0; [L1088] havoc ~skip~0; [L1089] ~tmp___0~1.base, ~tmp___0~1.offset := #t~nondet9.base, #t~nondet9.offset; [L1089] havoc #t~nondet9.base, #t~nondet9.offset; [L1090] ~tmp___1~0 := #t~nondet10; [L1090] havoc #t~nondet10; [L1091] ~tmp___2~0 := #t~nondet11; [L1091] havoc #t~nondet11; [L1092] ~tmp___3~0 := #t~nondet12; [L1092] havoc #t~nondet12; [L1093] ~tmp___4~0 := #t~nondet13; [L1093] havoc #t~nondet13; [L1094] ~tmp___5~0 := #t~nondet14; [L1094] havoc #t~nondet14; [L1095] ~tmp___6~0 := #t~nondet15; [L1095] havoc #t~nondet15; [L1096] ~tmp___7~0 := #t~nondet16; [L1096] havoc #t~nondet16; [L1097] ~tmp___8~0 := #t~nondet17; [L1097] havoc #t~nondet17; [L1098] ~tmp___9~0 := #t~nondet18; [L1098] havoc #t~nondet18; [L1099] havoc ~blastFlag~0; [L1102] ~blastFlag~0 := 0bv32; [L1103] call write~intINTTYPE4(#t~nondet19, ~s.base, ~bvadd32(92bv32, ~s.offset), 4bv32); [L1103] havoc #t~nondet19; [L1104] call write~intINTTYPE4(12292bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); [L1105] ~tmp~2 := #t~nondet20; [L1105] havoc #t~nondet20; [L1106] ~cb~0.base, ~cb~0.offset := 0bv32, 0bv32; [L1107] ~ret~0 := 4294967295bv32; [L1108] ~skip~0 := 0bv32; [L1109] call write~intINTTYPE4(0bv32, ~tmp___0~1.base, ~tmp___0~1.offset, 4bv32); [L1110] call #t~mem21.base, #t~mem21.offset := read~$Pointer$(~s.base, ~bvadd32(192bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem21.base=0bv32, #t~mem21.offset=1bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=0bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1110-L1118] assume 0bv32 != ~bvadd32(#t~mem21.base, #t~mem21.offset); [L1110] havoc #t~mem21.base, #t~mem21.offset; [L1111] call #t~mem22.base, #t~mem22.offset := read~$Pointer$(~s.base, ~bvadd32(192bv32, ~s.offset), 4bv32); [L1111] ~cb~0.base, ~cb~0.offset := #t~mem22.base, #t~mem22.offset; [L1111] havoc #t~mem22.base, #t~mem22.offset; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1119] call #t~mem27 := read~intINTTYPE4(~s.base, ~bvadd32(28bv32, ~s.offset), 4bv32); [L1119] call write~intINTTYPE4(~bvadd32(1bv32, #t~mem27), ~s.base, ~bvadd32(28bv32, ~s.offset), 4bv32); [L1119] havoc #t~mem27; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1120-L1128] assume !(0bv32 != ~bvand32(12288bv32, ~tmp___1~0)); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] assume !false; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] call #t~mem28 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] call #t~mem29 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem29=12292bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133-L1601] assume 12292bv32 == #t~mem29; [L1133] havoc #t~mem29; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1236] call write~intINTTYPE4(1bv32, ~s.base, ~bvadd32(40bv32, ~s.offset), 4bv32); [L1237] call write~intINTTYPE4(4096bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); [L1238] call #t~mem62.base, #t~mem62.offset := read~$Pointer$(~s.base, ~bvadd32(204bv32, ~s.offset), 4bv32); [L1238] call #t~mem63 := read~intINTTYPE4(#t~mem62.base, ~bvadd32(64bv32, #t~mem62.offset), 4bv32); [L1238] call write~intINTTYPE4(~bvadd32(1bv32, #t~mem63), #t~mem62.base, ~bvadd32(64bv32, #t~mem62.offset), 4bv32); [L1238] havoc #t~mem62.base, #t~mem62.offset; [L1238] havoc #t~mem63; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1243] call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(36bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1244-L1248] assume 0bv32 != ~bvadd32(~cb~0.base, ~cb~0.offset); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1249] call #t~mem64 := read~intINTTYPE4(~s.base, ~s.offset, 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem64=768bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1249-L1254] assume !(768bv32 != ~bvand32(65280bv32, #t~mem64)); [L1249] havoc #t~mem64; [L1255] call write~intINTTYPE4(4096bv32, ~s.base, ~bvadd32(4bv32, ~s.offset), 4bv32); [L1256] call #t~mem65.base, #t~mem65.offset := read~$Pointer$(~s.base, ~bvadd32(60bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem65.base=0bv32, #t~mem65.offset=1bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1256-L1273] assume !(0bv32 == ~bvadd32(#t~mem65.base, #t~mem65.offset)); [L1256] havoc #t~mem65.base, #t~mem65.offset; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1274-L1279] assume !(0bv32 == ~tmp___4~0); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1280-L1285] assume !(0bv32 == ~tmp___5~0); [L1286] call write~intINTTYPE4(4368bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); [L1287] call #t~mem67.base, #t~mem67.offset := read~$Pointer$(~s.base, ~bvadd32(204bv32, ~s.offset), 4bv32); [L1287] call #t~mem68 := read~intINTTYPE4(#t~mem67.base, ~bvadd32(60bv32, #t~mem67.offset), 4bv32); [L1287] call write~intINTTYPE4(~bvadd32(1bv32, #t~mem68), #t~mem67.base, ~bvadd32(60bv32, #t~mem67.offset), 4bv32); [L1287] havoc #t~mem68; [L1287] havoc #t~mem67.base, #t~mem67.offset; [L1288] call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(64bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] call #t~mem127.base, #t~mem127.offset := read~$Pointer$(~s.base, ~bvadd32(84bv32, ~s.offset), 4bv32); [L1602] call #t~mem128 := read~intINTTYPE4(#t~mem127.base, ~bvadd32(848bv32, #t~mem127.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem127.base=33554433bv32, #t~mem127.offset=4294966500bv32, #t~mem128=4368bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602-L1630] assume !(0bv32 == #t~mem128); [L1602] havoc #t~mem127.base, #t~mem127.offset; [L1602] havoc #t~mem128; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1631] ~skip~0 := 0bv32; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] assume !false; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] call #t~mem28 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] call #t~mem29 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem29=4368bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133-L1601] assume !(12292bv32 == #t~mem29); [L1133] havoc #t~mem29; [L1136] call #t~mem30 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem30=4368bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1136-L1600] assume !(16384bv32 == #t~mem30); [L1136] havoc #t~mem30; [L1139] call #t~mem31 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem31=4368bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1139-L1599] assume !(4096bv32 == #t~mem31); [L1139] havoc #t~mem31; [L1142] call #t~mem32 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem32=4368bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1142-L1598] assume !(20480bv32 == #t~mem32); [L1142] havoc #t~mem32; [L1145] call #t~mem33 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem33=4368bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1145-L1597] assume !(4099bv32 == #t~mem33); [L1145] havoc #t~mem33; [L1148] call #t~mem34 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem34=4368bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1148-L1596] assume 4368bv32 == #t~mem34; [L1148] havoc #t~mem34; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1292] call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(48bv32, ~s.offset), 4bv32); [L1293] ~ret~0 := #t~nondet69; [L1293] havoc #t~nondet69; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1294-L1298] assume 0bv32 == ~blastFlag~0; [L1295] ~blastFlag~0 := 1bv32; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1299-L1303] assume !~bvsle32(~ret~0, 0bv32); [L1304] call write~intINTTYPE4(4384bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); [L1305] call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(64bv32, ~s.offset), 4bv32); [L1306] call #t~mem70.base, #t~mem70.offset := read~$Pointer$(~s.base, ~bvadd32(20bv32, ~s.offset), 4bv32); [L1306] call #t~mem71.base, #t~mem71.offset := read~$Pointer$(~s.base, ~bvadd32(16bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem70.base=1bv32, #t~mem70.offset=0bv32, #t~mem71.base=0bv32, #t~mem71.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1306-L1310] assume ~bvadd32(#t~mem70.base, #t~mem70.offset) != ~bvadd32(#t~mem71.base, #t~mem71.offset); [L1306] havoc #t~mem71.base, #t~mem71.offset; [L1306] havoc #t~mem70.base, #t~mem70.offset; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] call #t~mem127.base, #t~mem127.offset := read~$Pointer$(~s.base, ~bvadd32(84bv32, ~s.offset), 4bv32); [L1602] call #t~mem128 := read~intINTTYPE4(#t~mem127.base, ~bvadd32(848bv32, #t~mem127.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem127.base=33554433bv32, #t~mem127.offset=4294966500bv32, #t~mem128=4384bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602-L1630] assume !(0bv32 == #t~mem128); [L1602] havoc #t~mem127.base, #t~mem127.offset; [L1602] havoc #t~mem128; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1631] ~skip~0 := 0bv32; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] assume !false; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] call #t~mem28 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] call #t~mem29 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem29=4384bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133-L1601] assume !(12292bv32 == #t~mem29); [L1133] havoc #t~mem29; [L1136] call #t~mem30 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem30=4384bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1136-L1600] assume !(16384bv32 == #t~mem30); [L1136] havoc #t~mem30; [L1139] call #t~mem31 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem31=4384bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1139-L1599] assume !(4096bv32 == #t~mem31); [L1139] havoc #t~mem31; [L1142] call #t~mem32 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem32=4384bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1142-L1598] assume !(20480bv32 == #t~mem32); [L1142] havoc #t~mem32; [L1145] call #t~mem33 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem33=4384bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1145-L1597] assume !(4099bv32 == #t~mem33); [L1145] havoc #t~mem33; [L1148] call #t~mem34 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem34=4384bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1148-L1596] assume !(4368bv32 == #t~mem34); [L1148] havoc #t~mem34; [L1151] call #t~mem35 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem35=4384bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1151-L1595] assume !(4369bv32 == #t~mem35); [L1151] havoc #t~mem35; [L1154] call #t~mem36 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem36=4384bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1154-L1594] assume 4384bv32 == #t~mem36; [L1154] havoc #t~mem36; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1314] ~ret~0 := #t~nondet72; [L1314] havoc #t~nondet72; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1315-L1323] assume 1bv32 == ~blastFlag~0; [L1316] ~blastFlag~0 := 2bv32; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1324-L1328] assume !~bvsle32(~ret~0, 0bv32); [L1329] call #t~mem73 := read~intINTTYPE4(~s.base, ~bvadd32(92bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem73=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1329-L1333] assume !(0bv32 != #t~mem73); [L1329] havoc #t~mem73; [L1332] call write~intINTTYPE4(4400bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1334] call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(64bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] call #t~mem127.base, #t~mem127.offset := read~$Pointer$(~s.base, ~bvadd32(84bv32, ~s.offset), 4bv32); [L1602] call #t~mem128 := read~intINTTYPE4(#t~mem127.base, ~bvadd32(848bv32, #t~mem127.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem127.base=33554433bv32, #t~mem127.offset=4294966500bv32, #t~mem128=4400bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602-L1630] assume !(0bv32 == #t~mem128); [L1602] havoc #t~mem127.base, #t~mem127.offset; [L1602] havoc #t~mem128; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1631] ~skip~0 := 0bv32; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] assume !false; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] call #t~mem28 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] call #t~mem29 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem29=4400bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133-L1601] assume !(12292bv32 == #t~mem29); [L1133] havoc #t~mem29; [L1136] call #t~mem30 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem30=4400bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1136-L1600] assume !(16384bv32 == #t~mem30); [L1136] havoc #t~mem30; [L1139] call #t~mem31 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem31=4400bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1139-L1599] assume !(4096bv32 == #t~mem31); [L1139] havoc #t~mem31; [L1142] call #t~mem32 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem32=4400bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1142-L1598] assume !(20480bv32 == #t~mem32); [L1142] havoc #t~mem32; [L1145] call #t~mem33 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem33=4400bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1145-L1597] assume !(4099bv32 == #t~mem33); [L1145] havoc #t~mem33; [L1148] call #t~mem34 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem34=4400bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1148-L1596] assume !(4368bv32 == #t~mem34); [L1148] havoc #t~mem34; [L1151] call #t~mem35 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem35=4400bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1151-L1595] assume !(4369bv32 == #t~mem35); [L1151] havoc #t~mem35; [L1154] call #t~mem36 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem36=4400bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1154-L1594] assume !(4384bv32 == #t~mem36); [L1154] havoc #t~mem36; [L1157] call #t~mem37 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem37=4400bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1157-L1593] assume !(4385bv32 == #t~mem37); [L1157] havoc #t~mem37; [L1160] call #t~mem38 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem38=4400bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1160-L1592] assume 4400bv32 == #t~mem38; [L1160] havoc #t~mem38; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1338] call #t~mem74.base, #t~mem74.offset := read~$Pointer$(~s.base, ~bvadd32(84bv32, ~s.offset), 4bv32); [L1338] call #t~mem75.base, #t~mem75.offset := read~$Pointer$(#t~mem74.base, ~bvadd32(836bv32, #t~mem74.offset), 4bv32); [L1338] call #t~mem76 := read~intINTTYPE4(#t~mem75.base, ~bvadd32(12bv32, #t~mem75.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem74.base=33554433bv32, #t~mem74.offset=4294966500bv32, #t~mem75.base=33554433bv32, #t~mem75.offset=52bv32, #t~mem76=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1338-L1352] assume !(0bv32 != ~bvand32(256bv32, #t~mem76)); [L1338] havoc #t~mem76; [L1338] havoc #t~mem75.base, #t~mem75.offset; [L1338] havoc #t~mem74.base, #t~mem74.offset; [L1341] ~ret~0 := #t~nondet77; [L1341] havoc #t~nondet77; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1342-L1346] assume 2bv32 == ~blastFlag~0; [L1343] ~blastFlag~0 := 3bv32; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1347-L1351] assume !~bvsle32(~ret~0, 0bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1353] call write~intINTTYPE4(4416bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); [L1354] call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(64bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] call #t~mem127.base, #t~mem127.offset := read~$Pointer$(~s.base, ~bvadd32(84bv32, ~s.offset), 4bv32); [L1602] call #t~mem128 := read~intINTTYPE4(#t~mem127.base, ~bvadd32(848bv32, #t~mem127.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem127.base=33554433bv32, #t~mem127.offset=4294966500bv32, #t~mem128=4416bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602-L1630] assume !(0bv32 == #t~mem128); [L1602] havoc #t~mem127.base, #t~mem127.offset; [L1602] havoc #t~mem128; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1631] ~skip~0 := 0bv32; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] assume !false; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] call #t~mem28 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] call #t~mem29 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem29=4416bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133-L1601] assume !(12292bv32 == #t~mem29); [L1133] havoc #t~mem29; [L1136] call #t~mem30 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem30=4416bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1136-L1600] assume !(16384bv32 == #t~mem30); [L1136] havoc #t~mem30; [L1139] call #t~mem31 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem31=4416bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1139-L1599] assume !(4096bv32 == #t~mem31); [L1139] havoc #t~mem31; [L1142] call #t~mem32 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem32=4416bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1142-L1598] assume !(20480bv32 == #t~mem32); [L1142] havoc #t~mem32; [L1145] call #t~mem33 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem33=4416bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1145-L1597] assume !(4099bv32 == #t~mem33); [L1145] havoc #t~mem33; [L1148] call #t~mem34 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem34=4416bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1148-L1596] assume !(4368bv32 == #t~mem34); [L1148] havoc #t~mem34; [L1151] call #t~mem35 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem35=4416bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1151-L1595] assume !(4369bv32 == #t~mem35); [L1151] havoc #t~mem35; [L1154] call #t~mem36 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem36=4416bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1154-L1594] assume !(4384bv32 == #t~mem36); [L1154] havoc #t~mem36; [L1157] call #t~mem37 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem37=4416bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1157-L1593] assume !(4385bv32 == #t~mem37); [L1157] havoc #t~mem37; [L1160] call #t~mem38 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem38=4416bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1160-L1592] assume !(4400bv32 == #t~mem38); [L1160] havoc #t~mem38; [L1163] call #t~mem39 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem39=4416bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1163-L1591] assume !(4401bv32 == #t~mem39); [L1163] havoc #t~mem39; [L1166] call #t~mem40 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem40=4416bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1166-L1590] assume 4416bv32 == #t~mem40; [L1166] havoc #t~mem40; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1358] ~ret~0 := #t~nondet78; [L1358] havoc #t~nondet78; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1359-L1363] assume 3bv32 == ~blastFlag~0; [L1360] ~blastFlag~0 := 4bv32; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1364-L1368] assume !~bvsle32(~ret~0, 0bv32); [L1369] call write~intINTTYPE4(4432bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); [L1370] call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(64bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1371-L1376] assume !(0bv32 == ~tmp___6~0); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] call #t~mem127.base, #t~mem127.offset := read~$Pointer$(~s.base, ~bvadd32(84bv32, ~s.offset), 4bv32); [L1602] call #t~mem128 := read~intINTTYPE4(#t~mem127.base, ~bvadd32(848bv32, #t~mem127.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem127.base=33554433bv32, #t~mem127.offset=4294966500bv32, #t~mem128=4432bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602-L1630] assume !(0bv32 == #t~mem128); [L1602] havoc #t~mem127.base, #t~mem127.offset; [L1602] havoc #t~mem128; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1631] ~skip~0 := 0bv32; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] assume !false; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] call #t~mem28 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] call #t~mem29 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem29=4432bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133-L1601] assume !(12292bv32 == #t~mem29); [L1133] havoc #t~mem29; [L1136] call #t~mem30 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem30=4432bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1136-L1600] assume !(16384bv32 == #t~mem30); [L1136] havoc #t~mem30; [L1139] call #t~mem31 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem31=4432bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1139-L1599] assume !(4096bv32 == #t~mem31); [L1139] havoc #t~mem31; [L1142] call #t~mem32 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem32=4432bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1142-L1598] assume !(20480bv32 == #t~mem32); [L1142] havoc #t~mem32; [L1145] call #t~mem33 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem33=4432bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1145-L1597] assume !(4099bv32 == #t~mem33); [L1145] havoc #t~mem33; [L1148] call #t~mem34 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem34=4432bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1148-L1596] assume !(4368bv32 == #t~mem34); [L1148] havoc #t~mem34; [L1151] call #t~mem35 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem35=4432bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1151-L1595] assume !(4369bv32 == #t~mem35); [L1151] havoc #t~mem35; [L1154] call #t~mem36 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem36=4432bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1154-L1594] assume !(4384bv32 == #t~mem36); [L1154] havoc #t~mem36; [L1157] call #t~mem37 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem37=4432bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1157-L1593] assume !(4385bv32 == #t~mem37); [L1157] havoc #t~mem37; [L1160] call #t~mem38 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem38=4432bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1160-L1592] assume !(4400bv32 == #t~mem38); [L1160] havoc #t~mem38; [L1163] call #t~mem39 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem39=4432bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1163-L1591] assume !(4401bv32 == #t~mem39); [L1163] havoc #t~mem39; [L1166] call #t~mem40 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem40=4432bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1166-L1590] assume !(4416bv32 == #t~mem40); [L1166] havoc #t~mem40; [L1169] call #t~mem41 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem41=4432bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1169-L1589] assume !(4417bv32 == #t~mem41); [L1169] havoc #t~mem41; [L1172] call #t~mem42 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem42=4432bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1172-L1588] assume 4432bv32 == #t~mem42; [L1172] havoc #t~mem42; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1380] ~ret~0 := #t~nondet79; [L1380] havoc #t~nondet79; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=0bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1381-L1385] assume 4bv32 == ~blastFlag~0; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=0bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1643] assert false; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=0bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [?] CALL call ULTIMATE.init(); VAL [#NULL!base=0bv32, #NULL!offset=0bv32, old(#NULL!base)=0bv32, old(#NULL!offset)=0bv32, old(~#SSLv3_client_data~0!base)=0bv32, old(~#SSLv3_client_data~0!offset)=0bv32, old(~init~0)=0bv32, ~#SSLv3_client_data~0!base=0bv32, ~#SSLv3_client_data~0!offset=0bv32, ~init~0=0bv32] [?] #NULL := { base: 0bv32, offset: 0bv32 }; [?] #valid[0bv32] := 0bv1; [L1042] ~init~0 := 1bv32; [L1043] FCALL call ~#SSLv3_client_data~0 := #Ultimate.alloc(100bv32); [L1043] FCALL call write~init~intINTTYPE4(0bv32, { base: ~#SSLv3_client_data~0!base, offset: ~#SSLv3_client_data~0!offset }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(4bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(8bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(12bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(16bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(20bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(24bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(28bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(32bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(36bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(40bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(44bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(48bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(52bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(56bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(60bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(64bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(68bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(72bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(76bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(80bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(84bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(88bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(92bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(96bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); VAL [#NULL!base=0bv32, #NULL!offset=0bv32, old(#NULL!base)=0bv32, old(#NULL!offset)=0bv32, old(~#SSLv3_client_data~0!base)=0bv32, old(~#SSLv3_client_data~0!offset)=0bv32, old(~init~0)=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~init~0=1bv32] [?] RET call ULTIMATE.init(); VAL [#NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~init~0=1bv32] [?] CALL call #t~ret138 := main(); VAL [#NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~init~0=1bv32] [L1065] FCALL call #t~malloc3 := #Ultimate.alloc(248bv32); [L1065] ~s~0 := #t~malloc3; [L1069] FCALL call #t~malloc4 := #Ultimate.alloc(899bv32); [L1069] FCALL call write~$Pointer$(#t~malloc4, { base: ~s~0!base, offset: ~bvadd32(84bv32, ~s~0!offset) }, 4bv32); [L1070] FCALL call #t~malloc5 := #Ultimate.alloc(232bv32); [L1070] FCALL call write~$Pointer$(#t~malloc5, { base: ~s~0!base, offset: ~bvadd32(204bv32, ~s~0!offset) }, 4bv32); [L1071] FCALL call #t~malloc6 := #Ultimate.alloc(200bv32); [L1071] FCALL call write~$Pointer$(#t~malloc6, { base: ~s~0!base, offset: ~bvadd32(176bv32, ~s~0!offset) }, 4bv32); [L1072] FCALL call write~intINTTYPE4(12292bv32, { base: ~s~0!base, offset: ~bvadd32(52bv32, ~s~0!offset) }, 4bv32); [L1073] FCALL call write~intINTTYPE4(#t~nondet7, { base: ~s~0!base, offset: ~s~0!offset }, 4bv32); [L1073] havoc #t~nondet7; VAL [#NULL!base=0bv32, #NULL!offset=0bv32, #t~malloc3!base=33554433bv32, #t~malloc3!offset=0bv32, #t~malloc4!base=2147483650bv32, #t~malloc4!offset=0bv32, #t~malloc5!base=3bv32, #t~malloc5!offset=0bv32, #t~malloc6!base=2bv32, #t~malloc6!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~init~0=1bv32, ~s~0!base=33554433bv32, ~s~0!offset=0bv32] [L1074] CALL call #t~ret8 := ssl3_connect(~s~0); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~init~0=1bv32] [L1079-L1645] ~s := #in~s; [L1080] havoc ~buf~0; [L1081] havoc ~tmp~2; [L1082] havoc ~l~0; [L1083] havoc ~num1~0; [L1084] havoc ~cb~0; [L1085] havoc ~ret~0; [L1086] havoc ~new_state~0; [L1087] havoc ~state~0; [L1088] havoc ~skip~0; [L1089] ~tmp___0~1 := #t~nondet9; [L1089] havoc #t~nondet9; [L1090] ~tmp___1~0 := #t~nondet10; [L1090] havoc #t~nondet10; [L1091] ~tmp___2~0 := #t~nondet11; [L1091] havoc #t~nondet11; [L1092] ~tmp___3~0 := #t~nondet12; [L1092] havoc #t~nondet12; [L1093] ~tmp___4~0 := #t~nondet13; [L1093] havoc #t~nondet13; [L1094] ~tmp___5~0 := #t~nondet14; [L1094] havoc #t~nondet14; [L1095] ~tmp___6~0 := #t~nondet15; [L1095] havoc #t~nondet15; [L1096] ~tmp___7~0 := #t~nondet16; [L1096] havoc #t~nondet16; [L1097] ~tmp___8~0 := #t~nondet17; [L1097] havoc #t~nondet17; [L1098] ~tmp___9~0 := #t~nondet18; [L1098] havoc #t~nondet18; [L1099] havoc ~blastFlag~0; [L1102] ~blastFlag~0 := 0bv32; [L1103] FCALL call write~intINTTYPE4(#t~nondet19, { base: ~s!base, offset: ~bvadd32(92bv32, ~s!offset) }, 4bv32); [L1103] havoc #t~nondet19; [L1104] FCALL call write~intINTTYPE4(12292bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1105] ~tmp~2 := #t~nondet20; [L1105] havoc #t~nondet20; [L1106] ~cb~0 := { base: 0bv32, offset: 0bv32 }; [L1107] ~ret~0 := 4294967295bv32; [L1108] ~skip~0 := 0bv32; [L1109] FCALL call write~intINTTYPE4(0bv32, ~tmp___0~1, 4bv32); [L1110] FCALL call #t~mem21 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(192bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem21!base=0bv32, #t~mem21!offset=1bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=0bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1110] COND TRUE 0bv32 != ~bvadd32(#t~mem21!base, #t~mem21!offset) [L1110] havoc #t~mem21; [L1111] FCALL call #t~mem22 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(192bv32, ~s!offset) }, 4bv32); [L1111] ~cb~0 := #t~mem22; [L1111] havoc #t~mem22; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1119] FCALL call #t~mem27 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(28bv32, ~s!offset) }, 4bv32); [L1119] FCALL call write~intINTTYPE4(~bvadd32(1bv32, #t~mem27), { base: ~s!base, offset: ~bvadd32(28bv32, ~s!offset) }, 4bv32); [L1119] havoc #t~mem27; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1120-L1128] COND FALSE !(0bv32 != ~bvand32(12288bv32, ~tmp___1~0)) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] COND FALSE !(false) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] FCALL call #t~mem28 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] FCALL call #t~mem29 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem29=12292bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133] COND TRUE 12292bv32 == #t~mem29 [L1133] havoc #t~mem29; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1236] FCALL call write~intINTTYPE4(1bv32, { base: ~s!base, offset: ~bvadd32(40bv32, ~s!offset) }, 4bv32); [L1237] FCALL call write~intINTTYPE4(4096bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1238] FCALL call #t~mem62 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(204bv32, ~s!offset) }, 4bv32); [L1238] FCALL call #t~mem63 := read~intINTTYPE4({ base: #t~mem62!base, offset: ~bvadd32(64bv32, #t~mem62!offset) }, 4bv32); [L1238] FCALL call write~intINTTYPE4(~bvadd32(1bv32, #t~mem63), { base: #t~mem62!base, offset: ~bvadd32(64bv32, #t~mem62!offset) }, 4bv32); [L1238] havoc #t~mem62; [L1238] havoc #t~mem63; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1243] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(36bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1244] COND TRUE 0bv32 != ~bvadd32(~cb~0!base, ~cb~0!offset) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1249] FCALL call #t~mem64 := read~intINTTYPE4({ base: ~s!base, offset: ~s!offset }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem64=768bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1249] COND FALSE !(768bv32 != ~bvand32(65280bv32, #t~mem64)) [L1249] havoc #t~mem64; [L1255] FCALL call write~intINTTYPE4(4096bv32, { base: ~s!base, offset: ~bvadd32(4bv32, ~s!offset) }, 4bv32); [L1256] FCALL call #t~mem65 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(60bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem65!base=0bv32, #t~mem65!offset=1bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1256] COND FALSE !(0bv32 == ~bvadd32(#t~mem65!base, #t~mem65!offset)) [L1256] havoc #t~mem65; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1274] COND FALSE !(0bv32 == ~tmp___4~0) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1280] COND FALSE !(0bv32 == ~tmp___5~0) [L1286] FCALL call write~intINTTYPE4(4368bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1287] FCALL call #t~mem67 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(204bv32, ~s!offset) }, 4bv32); [L1287] FCALL call #t~mem68 := read~intINTTYPE4({ base: #t~mem67!base, offset: ~bvadd32(60bv32, #t~mem67!offset) }, 4bv32); [L1287] FCALL call write~intINTTYPE4(~bvadd32(1bv32, #t~mem68), { base: #t~mem67!base, offset: ~bvadd32(60bv32, #t~mem67!offset) }, 4bv32); [L1287] havoc #t~mem68; [L1287] havoc #t~mem67; [L1288] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(64bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] FCALL call #t~mem127 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(84bv32, ~s!offset) }, 4bv32); [L1602] FCALL call #t~mem128 := read~intINTTYPE4({ base: #t~mem127!base, offset: ~bvadd32(848bv32, #t~mem127!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem127!base=33554433bv32, #t~mem127!offset=4294966500bv32, #t~mem128=4368bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] COND FALSE !(0bv32 == #t~mem128) [L1602] havoc #t~mem127; [L1602] havoc #t~mem128; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1631] ~skip~0 := 0bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] COND FALSE !(false) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] FCALL call #t~mem28 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] FCALL call #t~mem29 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem29=4368bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133] COND FALSE !(12292bv32 == #t~mem29) [L1133] havoc #t~mem29; [L1136] FCALL call #t~mem30 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem30=4368bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1136] COND FALSE !(16384bv32 == #t~mem30) [L1136] havoc #t~mem30; [L1139] FCALL call #t~mem31 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem31=4368bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1139] COND FALSE !(4096bv32 == #t~mem31) [L1139] havoc #t~mem31; [L1142] FCALL call #t~mem32 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem32=4368bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1142] COND FALSE !(20480bv32 == #t~mem32) [L1142] havoc #t~mem32; [L1145] FCALL call #t~mem33 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem33=4368bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1145] COND FALSE !(4099bv32 == #t~mem33) [L1145] havoc #t~mem33; [L1148] FCALL call #t~mem34 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem34=4368bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1148] COND TRUE 4368bv32 == #t~mem34 [L1148] havoc #t~mem34; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1292] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(48bv32, ~s!offset) }, 4bv32); [L1293] ~ret~0 := #t~nondet69; [L1293] havoc #t~nondet69; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1294] COND TRUE 0bv32 == ~blastFlag~0 [L1295] ~blastFlag~0 := 1bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1299] COND FALSE !(~bvsle32(~ret~0, 0bv32)) [L1304] FCALL call write~intINTTYPE4(4384bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1305] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(64bv32, ~s!offset) }, 4bv32); [L1306] FCALL call #t~mem70 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(20bv32, ~s!offset) }, 4bv32); [L1306] FCALL call #t~mem71 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(16bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem70!base=1bv32, #t~mem70!offset=0bv32, #t~mem71!base=0bv32, #t~mem71!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1306] COND TRUE ~bvadd32(#t~mem70!base, #t~mem70!offset) != ~bvadd32(#t~mem71!base, #t~mem71!offset) [L1306] havoc #t~mem71; [L1306] havoc #t~mem70; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] FCALL call #t~mem127 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(84bv32, ~s!offset) }, 4bv32); [L1602] FCALL call #t~mem128 := read~intINTTYPE4({ base: #t~mem127!base, offset: ~bvadd32(848bv32, #t~mem127!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem127!base=33554433bv32, #t~mem127!offset=4294966500bv32, #t~mem128=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] COND FALSE !(0bv32 == #t~mem128) [L1602] havoc #t~mem127; [L1602] havoc #t~mem128; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1631] ~skip~0 := 0bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] COND FALSE !(false) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] FCALL call #t~mem28 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] FCALL call #t~mem29 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem29=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133] COND FALSE !(12292bv32 == #t~mem29) [L1133] havoc #t~mem29; [L1136] FCALL call #t~mem30 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem30=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1136] COND FALSE !(16384bv32 == #t~mem30) [L1136] havoc #t~mem30; [L1139] FCALL call #t~mem31 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem31=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1139] COND FALSE !(4096bv32 == #t~mem31) [L1139] havoc #t~mem31; [L1142] FCALL call #t~mem32 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem32=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1142] COND FALSE !(20480bv32 == #t~mem32) [L1142] havoc #t~mem32; [L1145] FCALL call #t~mem33 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem33=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1145] COND FALSE !(4099bv32 == #t~mem33) [L1145] havoc #t~mem33; [L1148] FCALL call #t~mem34 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem34=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1148] COND FALSE !(4368bv32 == #t~mem34) [L1148] havoc #t~mem34; [L1151] FCALL call #t~mem35 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem35=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1151] COND FALSE !(4369bv32 == #t~mem35) [L1151] havoc #t~mem35; [L1154] FCALL call #t~mem36 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem36=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1154] COND TRUE 4384bv32 == #t~mem36 [L1154] havoc #t~mem36; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1314] ~ret~0 := #t~nondet72; [L1314] havoc #t~nondet72; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1315] COND TRUE 1bv32 == ~blastFlag~0 [L1316] ~blastFlag~0 := 2bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1324] COND FALSE !(~bvsle32(~ret~0, 0bv32)) [L1329] FCALL call #t~mem73 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(92bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem73=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1329-L1333] COND FALSE !(0bv32 != #t~mem73) [L1329] havoc #t~mem73; [L1332] FCALL call write~intINTTYPE4(4400bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1334] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(64bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] FCALL call #t~mem127 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(84bv32, ~s!offset) }, 4bv32); [L1602] FCALL call #t~mem128 := read~intINTTYPE4({ base: #t~mem127!base, offset: ~bvadd32(848bv32, #t~mem127!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem127!base=33554433bv32, #t~mem127!offset=4294966500bv32, #t~mem128=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] COND FALSE !(0bv32 == #t~mem128) [L1602] havoc #t~mem127; [L1602] havoc #t~mem128; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1631] ~skip~0 := 0bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] COND FALSE !(false) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] FCALL call #t~mem28 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] FCALL call #t~mem29 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem29=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133] COND FALSE !(12292bv32 == #t~mem29) [L1133] havoc #t~mem29; [L1136] FCALL call #t~mem30 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem30=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1136] COND FALSE !(16384bv32 == #t~mem30) [L1136] havoc #t~mem30; [L1139] FCALL call #t~mem31 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem31=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1139] COND FALSE !(4096bv32 == #t~mem31) [L1139] havoc #t~mem31; [L1142] FCALL call #t~mem32 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem32=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1142] COND FALSE !(20480bv32 == #t~mem32) [L1142] havoc #t~mem32; [L1145] FCALL call #t~mem33 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem33=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1145] COND FALSE !(4099bv32 == #t~mem33) [L1145] havoc #t~mem33; [L1148] FCALL call #t~mem34 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem34=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1148] COND FALSE !(4368bv32 == #t~mem34) [L1148] havoc #t~mem34; [L1151] FCALL call #t~mem35 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem35=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1151] COND FALSE !(4369bv32 == #t~mem35) [L1151] havoc #t~mem35; [L1154] FCALL call #t~mem36 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem36=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1154] COND FALSE !(4384bv32 == #t~mem36) [L1154] havoc #t~mem36; [L1157] FCALL call #t~mem37 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem37=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1157] COND FALSE !(4385bv32 == #t~mem37) [L1157] havoc #t~mem37; [L1160] FCALL call #t~mem38 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem38=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1160] COND TRUE 4400bv32 == #t~mem38 [L1160] havoc #t~mem38; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1338] FCALL call #t~mem74 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(84bv32, ~s!offset) }, 4bv32); [L1338] FCALL call #t~mem75 := read~$Pointer$({ base: #t~mem74!base, offset: ~bvadd32(836bv32, #t~mem74!offset) }, 4bv32); [L1338] FCALL call #t~mem76 := read~intINTTYPE4({ base: #t~mem75!base, offset: ~bvadd32(12bv32, #t~mem75!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem74!base=33554433bv32, #t~mem74!offset=4294966500bv32, #t~mem75!base=33554433bv32, #t~mem75!offset=52bv32, #t~mem76=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1338-L1352] COND FALSE !(0bv32 != ~bvand32(256bv32, #t~mem76)) [L1338] havoc #t~mem76; [L1338] havoc #t~mem75; [L1338] havoc #t~mem74; [L1341] ~ret~0 := #t~nondet77; [L1341] havoc #t~nondet77; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1342] COND TRUE 2bv32 == ~blastFlag~0 [L1343] ~blastFlag~0 := 3bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1347] COND FALSE !(~bvsle32(~ret~0, 0bv32)) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1353] FCALL call write~intINTTYPE4(4416bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1354] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(64bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] FCALL call #t~mem127 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(84bv32, ~s!offset) }, 4bv32); [L1602] FCALL call #t~mem128 := read~intINTTYPE4({ base: #t~mem127!base, offset: ~bvadd32(848bv32, #t~mem127!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem127!base=33554433bv32, #t~mem127!offset=4294966500bv32, #t~mem128=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] COND FALSE !(0bv32 == #t~mem128) [L1602] havoc #t~mem127; [L1602] havoc #t~mem128; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1631] ~skip~0 := 0bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] COND FALSE !(false) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] FCALL call #t~mem28 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] FCALL call #t~mem29 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem29=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133] COND FALSE !(12292bv32 == #t~mem29) [L1133] havoc #t~mem29; [L1136] FCALL call #t~mem30 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem30=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1136] COND FALSE !(16384bv32 == #t~mem30) [L1136] havoc #t~mem30; [L1139] FCALL call #t~mem31 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem31=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1139] COND FALSE !(4096bv32 == #t~mem31) [L1139] havoc #t~mem31; [L1142] FCALL call #t~mem32 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem32=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1142] COND FALSE !(20480bv32 == #t~mem32) [L1142] havoc #t~mem32; [L1145] FCALL call #t~mem33 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem33=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1145] COND FALSE !(4099bv32 == #t~mem33) [L1145] havoc #t~mem33; [L1148] FCALL call #t~mem34 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem34=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1148] COND FALSE !(4368bv32 == #t~mem34) [L1148] havoc #t~mem34; [L1151] FCALL call #t~mem35 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem35=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1151] COND FALSE !(4369bv32 == #t~mem35) [L1151] havoc #t~mem35; [L1154] FCALL call #t~mem36 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem36=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1154] COND FALSE !(4384bv32 == #t~mem36) [L1154] havoc #t~mem36; [L1157] FCALL call #t~mem37 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem37=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1157] COND FALSE !(4385bv32 == #t~mem37) [L1157] havoc #t~mem37; [L1160] FCALL call #t~mem38 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem38=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1160] COND FALSE !(4400bv32 == #t~mem38) [L1160] havoc #t~mem38; [L1163] FCALL call #t~mem39 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem39=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1163] COND FALSE !(4401bv32 == #t~mem39) [L1163] havoc #t~mem39; [L1166] FCALL call #t~mem40 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem40=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1166] COND TRUE 4416bv32 == #t~mem40 [L1166] havoc #t~mem40; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1358] ~ret~0 := #t~nondet78; [L1358] havoc #t~nondet78; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1359] COND TRUE 3bv32 == ~blastFlag~0 [L1360] ~blastFlag~0 := 4bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1364] COND FALSE !(~bvsle32(~ret~0, 0bv32)) [L1369] FCALL call write~intINTTYPE4(4432bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1370] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(64bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1371] COND FALSE !(0bv32 == ~tmp___6~0) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] FCALL call #t~mem127 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(84bv32, ~s!offset) }, 4bv32); [L1602] FCALL call #t~mem128 := read~intINTTYPE4({ base: #t~mem127!base, offset: ~bvadd32(848bv32, #t~mem127!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem127!base=33554433bv32, #t~mem127!offset=4294966500bv32, #t~mem128=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] COND FALSE !(0bv32 == #t~mem128) [L1602] havoc #t~mem127; [L1602] havoc #t~mem128; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1631] ~skip~0 := 0bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] COND FALSE !(false) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] FCALL call #t~mem28 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] FCALL call #t~mem29 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem29=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133] COND FALSE !(12292bv32 == #t~mem29) [L1133] havoc #t~mem29; [L1136] FCALL call #t~mem30 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem30=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1136] COND FALSE !(16384bv32 == #t~mem30) [L1136] havoc #t~mem30; [L1139] FCALL call #t~mem31 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem31=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1139] COND FALSE !(4096bv32 == #t~mem31) [L1139] havoc #t~mem31; [L1142] FCALL call #t~mem32 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem32=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1142] COND FALSE !(20480bv32 == #t~mem32) [L1142] havoc #t~mem32; [L1145] FCALL call #t~mem33 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem33=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1145] COND FALSE !(4099bv32 == #t~mem33) [L1145] havoc #t~mem33; [L1148] FCALL call #t~mem34 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem34=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1148] COND FALSE !(4368bv32 == #t~mem34) [L1148] havoc #t~mem34; [L1151] FCALL call #t~mem35 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem35=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1151] COND FALSE !(4369bv32 == #t~mem35) [L1151] havoc #t~mem35; [L1154] FCALL call #t~mem36 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem36=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1154] COND FALSE !(4384bv32 == #t~mem36) [L1154] havoc #t~mem36; [L1157] FCALL call #t~mem37 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem37=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1157] COND FALSE !(4385bv32 == #t~mem37) [L1157] havoc #t~mem37; [L1160] FCALL call #t~mem38 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem38=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1160] COND FALSE !(4400bv32 == #t~mem38) [L1160] havoc #t~mem38; [L1163] FCALL call #t~mem39 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem39=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1163] COND FALSE !(4401bv32 == #t~mem39) [L1163] havoc #t~mem39; [L1166] FCALL call #t~mem40 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem40=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1166] COND FALSE !(4416bv32 == #t~mem40) [L1166] havoc #t~mem40; [L1169] FCALL call #t~mem41 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem41=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1169] COND FALSE !(4417bv32 == #t~mem41) [L1169] havoc #t~mem41; [L1172] FCALL call #t~mem42 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem42=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1172] COND TRUE 4432bv32 == #t~mem42 [L1172] havoc #t~mem42; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1380] ~ret~0 := #t~nondet79; [L1380] havoc #t~nondet79; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=0bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1381] COND TRUE 4bv32 == ~blastFlag~0 VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=0bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1643] assert false; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=0bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] ----- ----- class de.uni_freiburg.informatik.ultimate.boogie.procedureinliner.backtranslation.InlinerBacktranslator [?] CALL call ULTIMATE.init(); VAL [#NULL!base=0bv32, #NULL!offset=0bv32, old(#NULL!base)=0bv32, old(#NULL!offset)=0bv32, old(~#SSLv3_client_data~0!base)=0bv32, old(~#SSLv3_client_data~0!offset)=0bv32, old(~init~0)=0bv32, ~#SSLv3_client_data~0!base=0bv32, ~#SSLv3_client_data~0!offset=0bv32, ~init~0=0bv32] [?] #NULL := { base: 0bv32, offset: 0bv32 }; [?] #valid[0bv32] := 0bv1; [L1042] ~init~0 := 1bv32; [L1043] FCALL call ~#SSLv3_client_data~0 := #Ultimate.alloc(100bv32); [L1043] FCALL call write~init~intINTTYPE4(0bv32, { base: ~#SSLv3_client_data~0!base, offset: ~#SSLv3_client_data~0!offset }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(4bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(8bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(12bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(16bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(20bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(24bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(28bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(32bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(36bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(40bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(44bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(48bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(52bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(56bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(60bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(64bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(68bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(72bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(76bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(80bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(84bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(88bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(92bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(96bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); VAL [#NULL!base=0bv32, #NULL!offset=0bv32, old(#NULL!base)=0bv32, old(#NULL!offset)=0bv32, old(~#SSLv3_client_data~0!base)=0bv32, old(~#SSLv3_client_data~0!offset)=0bv32, old(~init~0)=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~init~0=1bv32] [?] RET call ULTIMATE.init(); VAL [#NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~init~0=1bv32] [?] CALL call #t~ret138 := main(); VAL [#NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~init~0=1bv32] [L1065] FCALL call #t~malloc3 := #Ultimate.alloc(248bv32); [L1065] ~s~0 := #t~malloc3; [L1069] FCALL call #t~malloc4 := #Ultimate.alloc(899bv32); [L1069] FCALL call write~$Pointer$(#t~malloc4, { base: ~s~0!base, offset: ~bvadd32(84bv32, ~s~0!offset) }, 4bv32); [L1070] FCALL call #t~malloc5 := #Ultimate.alloc(232bv32); [L1070] FCALL call write~$Pointer$(#t~malloc5, { base: ~s~0!base, offset: ~bvadd32(204bv32, ~s~0!offset) }, 4bv32); [L1071] FCALL call #t~malloc6 := #Ultimate.alloc(200bv32); [L1071] FCALL call write~$Pointer$(#t~malloc6, { base: ~s~0!base, offset: ~bvadd32(176bv32, ~s~0!offset) }, 4bv32); [L1072] FCALL call write~intINTTYPE4(12292bv32, { base: ~s~0!base, offset: ~bvadd32(52bv32, ~s~0!offset) }, 4bv32); [L1073] FCALL call write~intINTTYPE4(#t~nondet7, { base: ~s~0!base, offset: ~s~0!offset }, 4bv32); [L1073] havoc #t~nondet7; VAL [#NULL!base=0bv32, #NULL!offset=0bv32, #t~malloc3!base=33554433bv32, #t~malloc3!offset=0bv32, #t~malloc4!base=2147483650bv32, #t~malloc4!offset=0bv32, #t~malloc5!base=3bv32, #t~malloc5!offset=0bv32, #t~malloc6!base=2bv32, #t~malloc6!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~init~0=1bv32, ~s~0!base=33554433bv32, ~s~0!offset=0bv32] [L1074] CALL call #t~ret8 := ssl3_connect(~s~0); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~init~0=1bv32] [L1079-L1645] ~s := #in~s; [L1080] havoc ~buf~0; [L1081] havoc ~tmp~2; [L1082] havoc ~l~0; [L1083] havoc ~num1~0; [L1084] havoc ~cb~0; [L1085] havoc ~ret~0; [L1086] havoc ~new_state~0; [L1087] havoc ~state~0; [L1088] havoc ~skip~0; [L1089] ~tmp___0~1 := #t~nondet9; [L1089] havoc #t~nondet9; [L1090] ~tmp___1~0 := #t~nondet10; [L1090] havoc #t~nondet10; [L1091] ~tmp___2~0 := #t~nondet11; [L1091] havoc #t~nondet11; [L1092] ~tmp___3~0 := #t~nondet12; [L1092] havoc #t~nondet12; [L1093] ~tmp___4~0 := #t~nondet13; [L1093] havoc #t~nondet13; [L1094] ~tmp___5~0 := #t~nondet14; [L1094] havoc #t~nondet14; [L1095] ~tmp___6~0 := #t~nondet15; [L1095] havoc #t~nondet15; [L1096] ~tmp___7~0 := #t~nondet16; [L1096] havoc #t~nondet16; [L1097] ~tmp___8~0 := #t~nondet17; [L1097] havoc #t~nondet17; [L1098] ~tmp___9~0 := #t~nondet18; [L1098] havoc #t~nondet18; [L1099] havoc ~blastFlag~0; [L1102] ~blastFlag~0 := 0bv32; [L1103] FCALL call write~intINTTYPE4(#t~nondet19, { base: ~s!base, offset: ~bvadd32(92bv32, ~s!offset) }, 4bv32); [L1103] havoc #t~nondet19; [L1104] FCALL call write~intINTTYPE4(12292bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1105] ~tmp~2 := #t~nondet20; [L1105] havoc #t~nondet20; [L1106] ~cb~0 := { base: 0bv32, offset: 0bv32 }; [L1107] ~ret~0 := 4294967295bv32; [L1108] ~skip~0 := 0bv32; [L1109] FCALL call write~intINTTYPE4(0bv32, ~tmp___0~1, 4bv32); [L1110] FCALL call #t~mem21 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(192bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem21!base=0bv32, #t~mem21!offset=1bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=0bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1110] COND TRUE 0bv32 != ~bvadd32(#t~mem21!base, #t~mem21!offset) [L1110] havoc #t~mem21; [L1111] FCALL call #t~mem22 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(192bv32, ~s!offset) }, 4bv32); [L1111] ~cb~0 := #t~mem22; [L1111] havoc #t~mem22; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1119] FCALL call #t~mem27 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(28bv32, ~s!offset) }, 4bv32); [L1119] FCALL call write~intINTTYPE4(~bvadd32(1bv32, #t~mem27), { base: ~s!base, offset: ~bvadd32(28bv32, ~s!offset) }, 4bv32); [L1119] havoc #t~mem27; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1120-L1128] COND FALSE !(0bv32 != ~bvand32(12288bv32, ~tmp___1~0)) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] COND FALSE !(false) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] FCALL call #t~mem28 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] FCALL call #t~mem29 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem29=12292bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133] COND TRUE 12292bv32 == #t~mem29 [L1133] havoc #t~mem29; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1236] FCALL call write~intINTTYPE4(1bv32, { base: ~s!base, offset: ~bvadd32(40bv32, ~s!offset) }, 4bv32); [L1237] FCALL call write~intINTTYPE4(4096bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1238] FCALL call #t~mem62 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(204bv32, ~s!offset) }, 4bv32); [L1238] FCALL call #t~mem63 := read~intINTTYPE4({ base: #t~mem62!base, offset: ~bvadd32(64bv32, #t~mem62!offset) }, 4bv32); [L1238] FCALL call write~intINTTYPE4(~bvadd32(1bv32, #t~mem63), { base: #t~mem62!base, offset: ~bvadd32(64bv32, #t~mem62!offset) }, 4bv32); [L1238] havoc #t~mem62; [L1238] havoc #t~mem63; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1243] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(36bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1244] COND TRUE 0bv32 != ~bvadd32(~cb~0!base, ~cb~0!offset) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1249] FCALL call #t~mem64 := read~intINTTYPE4({ base: ~s!base, offset: ~s!offset }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem64=768bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1249] COND FALSE !(768bv32 != ~bvand32(65280bv32, #t~mem64)) [L1249] havoc #t~mem64; [L1255] FCALL call write~intINTTYPE4(4096bv32, { base: ~s!base, offset: ~bvadd32(4bv32, ~s!offset) }, 4bv32); [L1256] FCALL call #t~mem65 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(60bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem65!base=0bv32, #t~mem65!offset=1bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1256] COND FALSE !(0bv32 == ~bvadd32(#t~mem65!base, #t~mem65!offset)) [L1256] havoc #t~mem65; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1274] COND FALSE !(0bv32 == ~tmp___4~0) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1280] COND FALSE !(0bv32 == ~tmp___5~0) [L1286] FCALL call write~intINTTYPE4(4368bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1287] FCALL call #t~mem67 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(204bv32, ~s!offset) }, 4bv32); [L1287] FCALL call #t~mem68 := read~intINTTYPE4({ base: #t~mem67!base, offset: ~bvadd32(60bv32, #t~mem67!offset) }, 4bv32); [L1287] FCALL call write~intINTTYPE4(~bvadd32(1bv32, #t~mem68), { base: #t~mem67!base, offset: ~bvadd32(60bv32, #t~mem67!offset) }, 4bv32); [L1287] havoc #t~mem68; [L1287] havoc #t~mem67; [L1288] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(64bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] FCALL call #t~mem127 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(84bv32, ~s!offset) }, 4bv32); [L1602] FCALL call #t~mem128 := read~intINTTYPE4({ base: #t~mem127!base, offset: ~bvadd32(848bv32, #t~mem127!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem127!base=33554433bv32, #t~mem127!offset=4294966500bv32, #t~mem128=4368bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] COND FALSE !(0bv32 == #t~mem128) [L1602] havoc #t~mem127; [L1602] havoc #t~mem128; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1631] ~skip~0 := 0bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] COND FALSE !(false) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] FCALL call #t~mem28 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] FCALL call #t~mem29 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem29=4368bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133] COND FALSE !(12292bv32 == #t~mem29) [L1133] havoc #t~mem29; [L1136] FCALL call #t~mem30 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem30=4368bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1136] COND FALSE !(16384bv32 == #t~mem30) [L1136] havoc #t~mem30; [L1139] FCALL call #t~mem31 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem31=4368bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1139] COND FALSE !(4096bv32 == #t~mem31) [L1139] havoc #t~mem31; [L1142] FCALL call #t~mem32 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem32=4368bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1142] COND FALSE !(20480bv32 == #t~mem32) [L1142] havoc #t~mem32; [L1145] FCALL call #t~mem33 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem33=4368bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1145] COND FALSE !(4099bv32 == #t~mem33) [L1145] havoc #t~mem33; [L1148] FCALL call #t~mem34 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem34=4368bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1148] COND TRUE 4368bv32 == #t~mem34 [L1148] havoc #t~mem34; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1292] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(48bv32, ~s!offset) }, 4bv32); [L1293] ~ret~0 := #t~nondet69; [L1293] havoc #t~nondet69; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1294] COND TRUE 0bv32 == ~blastFlag~0 [L1295] ~blastFlag~0 := 1bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1299] COND FALSE !(~bvsle32(~ret~0, 0bv32)) [L1304] FCALL call write~intINTTYPE4(4384bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1305] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(64bv32, ~s!offset) }, 4bv32); [L1306] FCALL call #t~mem70 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(20bv32, ~s!offset) }, 4bv32); [L1306] FCALL call #t~mem71 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(16bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem70!base=1bv32, #t~mem70!offset=0bv32, #t~mem71!base=0bv32, #t~mem71!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1306] COND TRUE ~bvadd32(#t~mem70!base, #t~mem70!offset) != ~bvadd32(#t~mem71!base, #t~mem71!offset) [L1306] havoc #t~mem71; [L1306] havoc #t~mem70; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] FCALL call #t~mem127 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(84bv32, ~s!offset) }, 4bv32); [L1602] FCALL call #t~mem128 := read~intINTTYPE4({ base: #t~mem127!base, offset: ~bvadd32(848bv32, #t~mem127!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem127!base=33554433bv32, #t~mem127!offset=4294966500bv32, #t~mem128=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] COND FALSE !(0bv32 == #t~mem128) [L1602] havoc #t~mem127; [L1602] havoc #t~mem128; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1631] ~skip~0 := 0bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] COND FALSE !(false) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] FCALL call #t~mem28 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] FCALL call #t~mem29 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem29=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133] COND FALSE !(12292bv32 == #t~mem29) [L1133] havoc #t~mem29; [L1136] FCALL call #t~mem30 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem30=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1136] COND FALSE !(16384bv32 == #t~mem30) [L1136] havoc #t~mem30; [L1139] FCALL call #t~mem31 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem31=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1139] COND FALSE !(4096bv32 == #t~mem31) [L1139] havoc #t~mem31; [L1142] FCALL call #t~mem32 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem32=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1142] COND FALSE !(20480bv32 == #t~mem32) [L1142] havoc #t~mem32; [L1145] FCALL call #t~mem33 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem33=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1145] COND FALSE !(4099bv32 == #t~mem33) [L1145] havoc #t~mem33; [L1148] FCALL call #t~mem34 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem34=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1148] COND FALSE !(4368bv32 == #t~mem34) [L1148] havoc #t~mem34; [L1151] FCALL call #t~mem35 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem35=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1151] COND FALSE !(4369bv32 == #t~mem35) [L1151] havoc #t~mem35; [L1154] FCALL call #t~mem36 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem36=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1154] COND TRUE 4384bv32 == #t~mem36 [L1154] havoc #t~mem36; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1314] ~ret~0 := #t~nondet72; [L1314] havoc #t~nondet72; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1315] COND TRUE 1bv32 == ~blastFlag~0 [L1316] ~blastFlag~0 := 2bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1324] COND FALSE !(~bvsle32(~ret~0, 0bv32)) [L1329] FCALL call #t~mem73 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(92bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem73=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1329-L1333] COND FALSE !(0bv32 != #t~mem73) [L1329] havoc #t~mem73; [L1332] FCALL call write~intINTTYPE4(4400bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1334] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(64bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] FCALL call #t~mem127 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(84bv32, ~s!offset) }, 4bv32); [L1602] FCALL call #t~mem128 := read~intINTTYPE4({ base: #t~mem127!base, offset: ~bvadd32(848bv32, #t~mem127!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem127!base=33554433bv32, #t~mem127!offset=4294966500bv32, #t~mem128=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] COND FALSE !(0bv32 == #t~mem128) [L1602] havoc #t~mem127; [L1602] havoc #t~mem128; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1631] ~skip~0 := 0bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] COND FALSE !(false) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] FCALL call #t~mem28 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] FCALL call #t~mem29 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem29=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133] COND FALSE !(12292bv32 == #t~mem29) [L1133] havoc #t~mem29; [L1136] FCALL call #t~mem30 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem30=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1136] COND FALSE !(16384bv32 == #t~mem30) [L1136] havoc #t~mem30; [L1139] FCALL call #t~mem31 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem31=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1139] COND FALSE !(4096bv32 == #t~mem31) [L1139] havoc #t~mem31; [L1142] FCALL call #t~mem32 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem32=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1142] COND FALSE !(20480bv32 == #t~mem32) [L1142] havoc #t~mem32; [L1145] FCALL call #t~mem33 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem33=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1145] COND FALSE !(4099bv32 == #t~mem33) [L1145] havoc #t~mem33; [L1148] FCALL call #t~mem34 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem34=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1148] COND FALSE !(4368bv32 == #t~mem34) [L1148] havoc #t~mem34; [L1151] FCALL call #t~mem35 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem35=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1151] COND FALSE !(4369bv32 == #t~mem35) [L1151] havoc #t~mem35; [L1154] FCALL call #t~mem36 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem36=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1154] COND FALSE !(4384bv32 == #t~mem36) [L1154] havoc #t~mem36; [L1157] FCALL call #t~mem37 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem37=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1157] COND FALSE !(4385bv32 == #t~mem37) [L1157] havoc #t~mem37; [L1160] FCALL call #t~mem38 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem38=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1160] COND TRUE 4400bv32 == #t~mem38 [L1160] havoc #t~mem38; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1338] FCALL call #t~mem74 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(84bv32, ~s!offset) }, 4bv32); [L1338] FCALL call #t~mem75 := read~$Pointer$({ base: #t~mem74!base, offset: ~bvadd32(836bv32, #t~mem74!offset) }, 4bv32); [L1338] FCALL call #t~mem76 := read~intINTTYPE4({ base: #t~mem75!base, offset: ~bvadd32(12bv32, #t~mem75!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem74!base=33554433bv32, #t~mem74!offset=4294966500bv32, #t~mem75!base=33554433bv32, #t~mem75!offset=52bv32, #t~mem76=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1338-L1352] COND FALSE !(0bv32 != ~bvand32(256bv32, #t~mem76)) [L1338] havoc #t~mem76; [L1338] havoc #t~mem75; [L1338] havoc #t~mem74; [L1341] ~ret~0 := #t~nondet77; [L1341] havoc #t~nondet77; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1342] COND TRUE 2bv32 == ~blastFlag~0 [L1343] ~blastFlag~0 := 3bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1347] COND FALSE !(~bvsle32(~ret~0, 0bv32)) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1353] FCALL call write~intINTTYPE4(4416bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1354] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(64bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] FCALL call #t~mem127 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(84bv32, ~s!offset) }, 4bv32); [L1602] FCALL call #t~mem128 := read~intINTTYPE4({ base: #t~mem127!base, offset: ~bvadd32(848bv32, #t~mem127!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem127!base=33554433bv32, #t~mem127!offset=4294966500bv32, #t~mem128=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] COND FALSE !(0bv32 == #t~mem128) [L1602] havoc #t~mem127; [L1602] havoc #t~mem128; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1631] ~skip~0 := 0bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] COND FALSE !(false) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] FCALL call #t~mem28 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] FCALL call #t~mem29 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem29=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133] COND FALSE !(12292bv32 == #t~mem29) [L1133] havoc #t~mem29; [L1136] FCALL call #t~mem30 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem30=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1136] COND FALSE !(16384bv32 == #t~mem30) [L1136] havoc #t~mem30; [L1139] FCALL call #t~mem31 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem31=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1139] COND FALSE !(4096bv32 == #t~mem31) [L1139] havoc #t~mem31; [L1142] FCALL call #t~mem32 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem32=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1142] COND FALSE !(20480bv32 == #t~mem32) [L1142] havoc #t~mem32; [L1145] FCALL call #t~mem33 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem33=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1145] COND FALSE !(4099bv32 == #t~mem33) [L1145] havoc #t~mem33; [L1148] FCALL call #t~mem34 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem34=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1148] COND FALSE !(4368bv32 == #t~mem34) [L1148] havoc #t~mem34; [L1151] FCALL call #t~mem35 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem35=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1151] COND FALSE !(4369bv32 == #t~mem35) [L1151] havoc #t~mem35; [L1154] FCALL call #t~mem36 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem36=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1154] COND FALSE !(4384bv32 == #t~mem36) [L1154] havoc #t~mem36; [L1157] FCALL call #t~mem37 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem37=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1157] COND FALSE !(4385bv32 == #t~mem37) [L1157] havoc #t~mem37; [L1160] FCALL call #t~mem38 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem38=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1160] COND FALSE !(4400bv32 == #t~mem38) [L1160] havoc #t~mem38; [L1163] FCALL call #t~mem39 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem39=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1163] COND FALSE !(4401bv32 == #t~mem39) [L1163] havoc #t~mem39; [L1166] FCALL call #t~mem40 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem40=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1166] COND TRUE 4416bv32 == #t~mem40 [L1166] havoc #t~mem40; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1358] ~ret~0 := #t~nondet78; [L1358] havoc #t~nondet78; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1359] COND TRUE 3bv32 == ~blastFlag~0 [L1360] ~blastFlag~0 := 4bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1364] COND FALSE !(~bvsle32(~ret~0, 0bv32)) [L1369] FCALL call write~intINTTYPE4(4432bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1370] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(64bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1371] COND FALSE !(0bv32 == ~tmp___6~0) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] FCALL call #t~mem127 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(84bv32, ~s!offset) }, 4bv32); [L1602] FCALL call #t~mem128 := read~intINTTYPE4({ base: #t~mem127!base, offset: ~bvadd32(848bv32, #t~mem127!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem127!base=33554433bv32, #t~mem127!offset=4294966500bv32, #t~mem128=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] COND FALSE !(0bv32 == #t~mem128) [L1602] havoc #t~mem127; [L1602] havoc #t~mem128; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1631] ~skip~0 := 0bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] COND FALSE !(false) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] FCALL call #t~mem28 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] FCALL call #t~mem29 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem29=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133] COND FALSE !(12292bv32 == #t~mem29) [L1133] havoc #t~mem29; [L1136] FCALL call #t~mem30 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem30=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1136] COND FALSE !(16384bv32 == #t~mem30) [L1136] havoc #t~mem30; [L1139] FCALL call #t~mem31 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem31=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1139] COND FALSE !(4096bv32 == #t~mem31) [L1139] havoc #t~mem31; [L1142] FCALL call #t~mem32 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem32=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1142] COND FALSE !(20480bv32 == #t~mem32) [L1142] havoc #t~mem32; [L1145] FCALL call #t~mem33 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem33=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1145] COND FALSE !(4099bv32 == #t~mem33) [L1145] havoc #t~mem33; [L1148] FCALL call #t~mem34 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem34=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1148] COND FALSE !(4368bv32 == #t~mem34) [L1148] havoc #t~mem34; [L1151] FCALL call #t~mem35 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem35=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1151] COND FALSE !(4369bv32 == #t~mem35) [L1151] havoc #t~mem35; [L1154] FCALL call #t~mem36 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem36=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1154] COND FALSE !(4384bv32 == #t~mem36) [L1154] havoc #t~mem36; [L1157] FCALL call #t~mem37 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem37=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1157] COND FALSE !(4385bv32 == #t~mem37) [L1157] havoc #t~mem37; [L1160] FCALL call #t~mem38 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem38=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1160] COND FALSE !(4400bv32 == #t~mem38) [L1160] havoc #t~mem38; [L1163] FCALL call #t~mem39 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem39=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1163] COND FALSE !(4401bv32 == #t~mem39) [L1163] havoc #t~mem39; [L1166] FCALL call #t~mem40 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem40=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1166] COND FALSE !(4416bv32 == #t~mem40) [L1166] havoc #t~mem40; [L1169] FCALL call #t~mem41 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem41=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1169] COND FALSE !(4417bv32 == #t~mem41) [L1169] havoc #t~mem41; [L1172] FCALL call #t~mem42 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem42=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1172] COND TRUE 4432bv32 == #t~mem42 [L1172] havoc #t~mem42; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1380] ~ret~0 := #t~nondet79; [L1380] havoc #t~nondet79; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=0bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1381] COND TRUE 4bv32 == ~blastFlag~0 VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=0bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1643] assert false; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=0bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [?] CALL call ULTIMATE.init(); VAL [#NULL!base=0bv32, #NULL!offset=0bv32, old(#NULL!base)=0bv32, old(#NULL!offset)=0bv32, old(~#SSLv3_client_data~0!base)=0bv32, old(~#SSLv3_client_data~0!offset)=0bv32, old(~init~0)=0bv32, ~#SSLv3_client_data~0!base=0bv32, ~#SSLv3_client_data~0!offset=0bv32, ~init~0=0bv32] [?] #NULL := { base: 0bv32, offset: 0bv32 }; [?] #valid[0bv32] := 0bv1; [L1042] ~init~0 := 1bv32; [L1043] FCALL call ~#SSLv3_client_data~0 := #Ultimate.alloc(100bv32); [L1043] FCALL call write~init~intINTTYPE4(0bv32, { base: ~#SSLv3_client_data~0!base, offset: ~#SSLv3_client_data~0!offset }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(4bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(8bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(12bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(16bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(20bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(24bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(28bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(32bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(36bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(40bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(44bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(48bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(52bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(56bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(60bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(64bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(68bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(72bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(76bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(80bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(84bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(88bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(92bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(96bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); VAL [#NULL!base=0bv32, #NULL!offset=0bv32, old(#NULL!base)=0bv32, old(#NULL!offset)=0bv32, old(~#SSLv3_client_data~0!base)=0bv32, old(~#SSLv3_client_data~0!offset)=0bv32, old(~init~0)=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~init~0=1bv32] [?] RET call ULTIMATE.init(); VAL [#NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~init~0=1bv32] [?] CALL call #t~ret138 := main(); VAL [#NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~init~0=1bv32] [L1065] FCALL call #t~malloc3 := #Ultimate.alloc(248bv32); [L1065] ~s~0 := #t~malloc3; [L1069] FCALL call #t~malloc4 := #Ultimate.alloc(899bv32); [L1069] FCALL call write~$Pointer$(#t~malloc4, { base: ~s~0!base, offset: ~bvadd32(84bv32, ~s~0!offset) }, 4bv32); [L1070] FCALL call #t~malloc5 := #Ultimate.alloc(232bv32); [L1070] FCALL call write~$Pointer$(#t~malloc5, { base: ~s~0!base, offset: ~bvadd32(204bv32, ~s~0!offset) }, 4bv32); [L1071] FCALL call #t~malloc6 := #Ultimate.alloc(200bv32); [L1071] FCALL call write~$Pointer$(#t~malloc6, { base: ~s~0!base, offset: ~bvadd32(176bv32, ~s~0!offset) }, 4bv32); [L1072] FCALL call write~intINTTYPE4(12292bv32, { base: ~s~0!base, offset: ~bvadd32(52bv32, ~s~0!offset) }, 4bv32); [L1073] FCALL call write~intINTTYPE4(#t~nondet7, { base: ~s~0!base, offset: ~s~0!offset }, 4bv32); [L1073] havoc #t~nondet7; VAL [#NULL!base=0bv32, #NULL!offset=0bv32, #t~malloc3!base=33554433bv32, #t~malloc3!offset=0bv32, #t~malloc4!base=2147483650bv32, #t~malloc4!offset=0bv32, #t~malloc5!base=3bv32, #t~malloc5!offset=0bv32, #t~malloc6!base=2bv32, #t~malloc6!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~init~0=1bv32, ~s~0!base=33554433bv32, ~s~0!offset=0bv32] [L1074] CALL call #t~ret8 := ssl3_connect(~s~0); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~init~0=1bv32] [L1079-L1645] ~s := #in~s; [L1080] havoc ~buf~0; [L1081] havoc ~tmp~2; [L1082] havoc ~l~0; [L1083] havoc ~num1~0; [L1084] havoc ~cb~0; [L1085] havoc ~ret~0; [L1086] havoc ~new_state~0; [L1087] havoc ~state~0; [L1088] havoc ~skip~0; [L1089] ~tmp___0~1 := #t~nondet9; [L1089] havoc #t~nondet9; [L1090] ~tmp___1~0 := #t~nondet10; [L1090] havoc #t~nondet10; [L1091] ~tmp___2~0 := #t~nondet11; [L1091] havoc #t~nondet11; [L1092] ~tmp___3~0 := #t~nondet12; [L1092] havoc #t~nondet12; [L1093] ~tmp___4~0 := #t~nondet13; [L1093] havoc #t~nondet13; [L1094] ~tmp___5~0 := #t~nondet14; [L1094] havoc #t~nondet14; [L1095] ~tmp___6~0 := #t~nondet15; [L1095] havoc #t~nondet15; [L1096] ~tmp___7~0 := #t~nondet16; [L1096] havoc #t~nondet16; [L1097] ~tmp___8~0 := #t~nondet17; [L1097] havoc #t~nondet17; [L1098] ~tmp___9~0 := #t~nondet18; [L1098] havoc #t~nondet18; [L1099] havoc ~blastFlag~0; [L1102] ~blastFlag~0 := 0bv32; [L1103] FCALL call write~intINTTYPE4(#t~nondet19, { base: ~s!base, offset: ~bvadd32(92bv32, ~s!offset) }, 4bv32); [L1103] havoc #t~nondet19; [L1104] FCALL call write~intINTTYPE4(12292bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1105] ~tmp~2 := #t~nondet20; [L1105] havoc #t~nondet20; [L1106] ~cb~0 := { base: 0bv32, offset: 0bv32 }; [L1107] ~ret~0 := 4294967295bv32; [L1108] ~skip~0 := 0bv32; [L1109] FCALL call write~intINTTYPE4(0bv32, ~tmp___0~1, 4bv32); [L1110] FCALL call #t~mem21 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(192bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem21!base=0bv32, #t~mem21!offset=1bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=0bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1110] COND TRUE 0bv32 != ~bvadd32(#t~mem21!base, #t~mem21!offset) [L1110] havoc #t~mem21; [L1111] FCALL call #t~mem22 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(192bv32, ~s!offset) }, 4bv32); [L1111] ~cb~0 := #t~mem22; [L1111] havoc #t~mem22; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1119] FCALL call #t~mem27 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(28bv32, ~s!offset) }, 4bv32); [L1119] FCALL call write~intINTTYPE4(~bvadd32(1bv32, #t~mem27), { base: ~s!base, offset: ~bvadd32(28bv32, ~s!offset) }, 4bv32); [L1119] havoc #t~mem27; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1120-L1128] COND FALSE !(0bv32 != ~bvand32(12288bv32, ~tmp___1~0)) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] COND FALSE !(false) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] FCALL call #t~mem28 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] FCALL call #t~mem29 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem29=12292bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133] COND TRUE 12292bv32 == #t~mem29 [L1133] havoc #t~mem29; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1236] FCALL call write~intINTTYPE4(1bv32, { base: ~s!base, offset: ~bvadd32(40bv32, ~s!offset) }, 4bv32); [L1237] FCALL call write~intINTTYPE4(4096bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1238] FCALL call #t~mem62 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(204bv32, ~s!offset) }, 4bv32); [L1238] FCALL call #t~mem63 := read~intINTTYPE4({ base: #t~mem62!base, offset: ~bvadd32(64bv32, #t~mem62!offset) }, 4bv32); [L1238] FCALL call write~intINTTYPE4(~bvadd32(1bv32, #t~mem63), { base: #t~mem62!base, offset: ~bvadd32(64bv32, #t~mem62!offset) }, 4bv32); [L1238] havoc #t~mem62; [L1238] havoc #t~mem63; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1243] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(36bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1244] COND TRUE 0bv32 != ~bvadd32(~cb~0!base, ~cb~0!offset) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1249] FCALL call #t~mem64 := read~intINTTYPE4({ base: ~s!base, offset: ~s!offset }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem64=768bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1249] COND FALSE !(768bv32 != ~bvand32(65280bv32, #t~mem64)) [L1249] havoc #t~mem64; [L1255] FCALL call write~intINTTYPE4(4096bv32, { base: ~s!base, offset: ~bvadd32(4bv32, ~s!offset) }, 4bv32); [L1256] FCALL call #t~mem65 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(60bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem65!base=0bv32, #t~mem65!offset=1bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1256] COND FALSE !(0bv32 == ~bvadd32(#t~mem65!base, #t~mem65!offset)) [L1256] havoc #t~mem65; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1274] COND FALSE !(0bv32 == ~tmp___4~0) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1280] COND FALSE !(0bv32 == ~tmp___5~0) [L1286] FCALL call write~intINTTYPE4(4368bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1287] FCALL call #t~mem67 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(204bv32, ~s!offset) }, 4bv32); [L1287] FCALL call #t~mem68 := read~intINTTYPE4({ base: #t~mem67!base, offset: ~bvadd32(60bv32, #t~mem67!offset) }, 4bv32); [L1287] FCALL call write~intINTTYPE4(~bvadd32(1bv32, #t~mem68), { base: #t~mem67!base, offset: ~bvadd32(60bv32, #t~mem67!offset) }, 4bv32); [L1287] havoc #t~mem68; [L1287] havoc #t~mem67; [L1288] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(64bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] FCALL call #t~mem127 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(84bv32, ~s!offset) }, 4bv32); [L1602] FCALL call #t~mem128 := read~intINTTYPE4({ base: #t~mem127!base, offset: ~bvadd32(848bv32, #t~mem127!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem127!base=33554433bv32, #t~mem127!offset=4294966500bv32, #t~mem128=4368bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] COND FALSE !(0bv32 == #t~mem128) [L1602] havoc #t~mem127; [L1602] havoc #t~mem128; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1631] ~skip~0 := 0bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] COND FALSE !(false) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] FCALL call #t~mem28 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] FCALL call #t~mem29 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem29=4368bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133] COND FALSE !(12292bv32 == #t~mem29) [L1133] havoc #t~mem29; [L1136] FCALL call #t~mem30 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem30=4368bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1136] COND FALSE !(16384bv32 == #t~mem30) [L1136] havoc #t~mem30; [L1139] FCALL call #t~mem31 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem31=4368bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1139] COND FALSE !(4096bv32 == #t~mem31) [L1139] havoc #t~mem31; [L1142] FCALL call #t~mem32 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem32=4368bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1142] COND FALSE !(20480bv32 == #t~mem32) [L1142] havoc #t~mem32; [L1145] FCALL call #t~mem33 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem33=4368bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1145] COND FALSE !(4099bv32 == #t~mem33) [L1145] havoc #t~mem33; [L1148] FCALL call #t~mem34 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem34=4368bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1148] COND TRUE 4368bv32 == #t~mem34 [L1148] havoc #t~mem34; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1292] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(48bv32, ~s!offset) }, 4bv32); [L1293] ~ret~0 := #t~nondet69; [L1293] havoc #t~nondet69; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1294] COND TRUE 0bv32 == ~blastFlag~0 [L1295] ~blastFlag~0 := 1bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1299] COND FALSE !(~bvsle32(~ret~0, 0bv32)) [L1304] FCALL call write~intINTTYPE4(4384bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1305] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(64bv32, ~s!offset) }, 4bv32); [L1306] FCALL call #t~mem70 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(20bv32, ~s!offset) }, 4bv32); [L1306] FCALL call #t~mem71 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(16bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem70!base=1bv32, #t~mem70!offset=0bv32, #t~mem71!base=0bv32, #t~mem71!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1306] COND TRUE ~bvadd32(#t~mem70!base, #t~mem70!offset) != ~bvadd32(#t~mem71!base, #t~mem71!offset) [L1306] havoc #t~mem71; [L1306] havoc #t~mem70; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] FCALL call #t~mem127 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(84bv32, ~s!offset) }, 4bv32); [L1602] FCALL call #t~mem128 := read~intINTTYPE4({ base: #t~mem127!base, offset: ~bvadd32(848bv32, #t~mem127!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem127!base=33554433bv32, #t~mem127!offset=4294966500bv32, #t~mem128=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] COND FALSE !(0bv32 == #t~mem128) [L1602] havoc #t~mem127; [L1602] havoc #t~mem128; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1631] ~skip~0 := 0bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] COND FALSE !(false) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] FCALL call #t~mem28 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] FCALL call #t~mem29 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem29=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133] COND FALSE !(12292bv32 == #t~mem29) [L1133] havoc #t~mem29; [L1136] FCALL call #t~mem30 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem30=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1136] COND FALSE !(16384bv32 == #t~mem30) [L1136] havoc #t~mem30; [L1139] FCALL call #t~mem31 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem31=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1139] COND FALSE !(4096bv32 == #t~mem31) [L1139] havoc #t~mem31; [L1142] FCALL call #t~mem32 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem32=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1142] COND FALSE !(20480bv32 == #t~mem32) [L1142] havoc #t~mem32; [L1145] FCALL call #t~mem33 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem33=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1145] COND FALSE !(4099bv32 == #t~mem33) [L1145] havoc #t~mem33; [L1148] FCALL call #t~mem34 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem34=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1148] COND FALSE !(4368bv32 == #t~mem34) [L1148] havoc #t~mem34; [L1151] FCALL call #t~mem35 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem35=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1151] COND FALSE !(4369bv32 == #t~mem35) [L1151] havoc #t~mem35; [L1154] FCALL call #t~mem36 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem36=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1154] COND TRUE 4384bv32 == #t~mem36 [L1154] havoc #t~mem36; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1314] ~ret~0 := #t~nondet72; [L1314] havoc #t~nondet72; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1315] COND TRUE 1bv32 == ~blastFlag~0 [L1316] ~blastFlag~0 := 2bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1324] COND FALSE !(~bvsle32(~ret~0, 0bv32)) [L1329] FCALL call #t~mem73 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(92bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem73=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1329-L1333] COND FALSE !(0bv32 != #t~mem73) [L1329] havoc #t~mem73; [L1332] FCALL call write~intINTTYPE4(4400bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1334] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(64bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] FCALL call #t~mem127 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(84bv32, ~s!offset) }, 4bv32); [L1602] FCALL call #t~mem128 := read~intINTTYPE4({ base: #t~mem127!base, offset: ~bvadd32(848bv32, #t~mem127!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem127!base=33554433bv32, #t~mem127!offset=4294966500bv32, #t~mem128=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] COND FALSE !(0bv32 == #t~mem128) [L1602] havoc #t~mem127; [L1602] havoc #t~mem128; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1631] ~skip~0 := 0bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] COND FALSE !(false) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] FCALL call #t~mem28 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] FCALL call #t~mem29 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem29=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133] COND FALSE !(12292bv32 == #t~mem29) [L1133] havoc #t~mem29; [L1136] FCALL call #t~mem30 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem30=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1136] COND FALSE !(16384bv32 == #t~mem30) [L1136] havoc #t~mem30; [L1139] FCALL call #t~mem31 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem31=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1139] COND FALSE !(4096bv32 == #t~mem31) [L1139] havoc #t~mem31; [L1142] FCALL call #t~mem32 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem32=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1142] COND FALSE !(20480bv32 == #t~mem32) [L1142] havoc #t~mem32; [L1145] FCALL call #t~mem33 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem33=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1145] COND FALSE !(4099bv32 == #t~mem33) [L1145] havoc #t~mem33; [L1148] FCALL call #t~mem34 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem34=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1148] COND FALSE !(4368bv32 == #t~mem34) [L1148] havoc #t~mem34; [L1151] FCALL call #t~mem35 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem35=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1151] COND FALSE !(4369bv32 == #t~mem35) [L1151] havoc #t~mem35; [L1154] FCALL call #t~mem36 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem36=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1154] COND FALSE !(4384bv32 == #t~mem36) [L1154] havoc #t~mem36; [L1157] FCALL call #t~mem37 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem37=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1157] COND FALSE !(4385bv32 == #t~mem37) [L1157] havoc #t~mem37; [L1160] FCALL call #t~mem38 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem38=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1160] COND TRUE 4400bv32 == #t~mem38 [L1160] havoc #t~mem38; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1338] FCALL call #t~mem74 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(84bv32, ~s!offset) }, 4bv32); [L1338] FCALL call #t~mem75 := read~$Pointer$({ base: #t~mem74!base, offset: ~bvadd32(836bv32, #t~mem74!offset) }, 4bv32); [L1338] FCALL call #t~mem76 := read~intINTTYPE4({ base: #t~mem75!base, offset: ~bvadd32(12bv32, #t~mem75!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem74!base=33554433bv32, #t~mem74!offset=4294966500bv32, #t~mem75!base=33554433bv32, #t~mem75!offset=52bv32, #t~mem76=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1338-L1352] COND FALSE !(0bv32 != ~bvand32(256bv32, #t~mem76)) [L1338] havoc #t~mem76; [L1338] havoc #t~mem75; [L1338] havoc #t~mem74; [L1341] ~ret~0 := #t~nondet77; [L1341] havoc #t~nondet77; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1342] COND TRUE 2bv32 == ~blastFlag~0 [L1343] ~blastFlag~0 := 3bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1347] COND FALSE !(~bvsle32(~ret~0, 0bv32)) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1353] FCALL call write~intINTTYPE4(4416bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1354] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(64bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] FCALL call #t~mem127 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(84bv32, ~s!offset) }, 4bv32); [L1602] FCALL call #t~mem128 := read~intINTTYPE4({ base: #t~mem127!base, offset: ~bvadd32(848bv32, #t~mem127!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem127!base=33554433bv32, #t~mem127!offset=4294966500bv32, #t~mem128=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] COND FALSE !(0bv32 == #t~mem128) [L1602] havoc #t~mem127; [L1602] havoc #t~mem128; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1631] ~skip~0 := 0bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] COND FALSE !(false) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] FCALL call #t~mem28 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] FCALL call #t~mem29 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem29=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133] COND FALSE !(12292bv32 == #t~mem29) [L1133] havoc #t~mem29; [L1136] FCALL call #t~mem30 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem30=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1136] COND FALSE !(16384bv32 == #t~mem30) [L1136] havoc #t~mem30; [L1139] FCALL call #t~mem31 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem31=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1139] COND FALSE !(4096bv32 == #t~mem31) [L1139] havoc #t~mem31; [L1142] FCALL call #t~mem32 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem32=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1142] COND FALSE !(20480bv32 == #t~mem32) [L1142] havoc #t~mem32; [L1145] FCALL call #t~mem33 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem33=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1145] COND FALSE !(4099bv32 == #t~mem33) [L1145] havoc #t~mem33; [L1148] FCALL call #t~mem34 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem34=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1148] COND FALSE !(4368bv32 == #t~mem34) [L1148] havoc #t~mem34; [L1151] FCALL call #t~mem35 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem35=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1151] COND FALSE !(4369bv32 == #t~mem35) [L1151] havoc #t~mem35; [L1154] FCALL call #t~mem36 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem36=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1154] COND FALSE !(4384bv32 == #t~mem36) [L1154] havoc #t~mem36; [L1157] FCALL call #t~mem37 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem37=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1157] COND FALSE !(4385bv32 == #t~mem37) [L1157] havoc #t~mem37; [L1160] FCALL call #t~mem38 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem38=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1160] COND FALSE !(4400bv32 == #t~mem38) [L1160] havoc #t~mem38; [L1163] FCALL call #t~mem39 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem39=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1163] COND FALSE !(4401bv32 == #t~mem39) [L1163] havoc #t~mem39; [L1166] FCALL call #t~mem40 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem40=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1166] COND TRUE 4416bv32 == #t~mem40 [L1166] havoc #t~mem40; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1358] ~ret~0 := #t~nondet78; [L1358] havoc #t~nondet78; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1359] COND TRUE 3bv32 == ~blastFlag~0 [L1360] ~blastFlag~0 := 4bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1364] COND FALSE !(~bvsle32(~ret~0, 0bv32)) [L1369] FCALL call write~intINTTYPE4(4432bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1370] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(64bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1371] COND FALSE !(0bv32 == ~tmp___6~0) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] FCALL call #t~mem127 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(84bv32, ~s!offset) }, 4bv32); [L1602] FCALL call #t~mem128 := read~intINTTYPE4({ base: #t~mem127!base, offset: ~bvadd32(848bv32, #t~mem127!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem127!base=33554433bv32, #t~mem127!offset=4294966500bv32, #t~mem128=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] COND FALSE !(0bv32 == #t~mem128) [L1602] havoc #t~mem127; [L1602] havoc #t~mem128; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1631] ~skip~0 := 0bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] COND FALSE !(false) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] FCALL call #t~mem28 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] FCALL call #t~mem29 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem29=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133] COND FALSE !(12292bv32 == #t~mem29) [L1133] havoc #t~mem29; [L1136] FCALL call #t~mem30 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem30=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1136] COND FALSE !(16384bv32 == #t~mem30) [L1136] havoc #t~mem30; [L1139] FCALL call #t~mem31 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem31=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1139] COND FALSE !(4096bv32 == #t~mem31) [L1139] havoc #t~mem31; [L1142] FCALL call #t~mem32 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem32=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1142] COND FALSE !(20480bv32 == #t~mem32) [L1142] havoc #t~mem32; [L1145] FCALL call #t~mem33 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem33=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1145] COND FALSE !(4099bv32 == #t~mem33) [L1145] havoc #t~mem33; [L1148] FCALL call #t~mem34 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem34=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1148] COND FALSE !(4368bv32 == #t~mem34) [L1148] havoc #t~mem34; [L1151] FCALL call #t~mem35 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem35=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1151] COND FALSE !(4369bv32 == #t~mem35) [L1151] havoc #t~mem35; [L1154] FCALL call #t~mem36 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem36=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1154] COND FALSE !(4384bv32 == #t~mem36) [L1154] havoc #t~mem36; [L1157] FCALL call #t~mem37 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem37=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1157] COND FALSE !(4385bv32 == #t~mem37) [L1157] havoc #t~mem37; [L1160] FCALL call #t~mem38 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem38=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1160] COND FALSE !(4400bv32 == #t~mem38) [L1160] havoc #t~mem38; [L1163] FCALL call #t~mem39 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem39=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1163] COND FALSE !(4401bv32 == #t~mem39) [L1163] havoc #t~mem39; [L1166] FCALL call #t~mem40 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem40=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1166] COND FALSE !(4416bv32 == #t~mem40) [L1166] havoc #t~mem40; [L1169] FCALL call #t~mem41 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem41=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1169] COND FALSE !(4417bv32 == #t~mem41) [L1169] havoc #t~mem41; [L1172] FCALL call #t~mem42 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem42=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1172] COND TRUE 4432bv32 == #t~mem42 [L1172] havoc #t~mem42; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1380] ~ret~0 := #t~nondet79; [L1380] havoc #t~nondet79; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=0bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1381] COND TRUE 4bv32 == ~blastFlag~0 VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=0bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1643] assert false; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=0bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] ----- [2018-11-23 11:00:33,934 WARN L1272 BoogieBacktranslator]: Unfinished Backtranslation: BitvecLiteral 0bv32 could not be translated for associated CType STRUCT~~ssl_method_st?version~INT?ssl_new~*((*~SSL~0 ) : INT)?ssl_clear~*((*~SSL~0 ) : VOID)?ssl_free~*((*~SSL~0 ) : VOID)?ssl_accept~*((*~SSL~0 ) : INT)?ssl_connect~*((*~SSL~0 ) : INT)?ssl_read~*((*~SSL~0 *VOID INT ) : INT)?ssl_peek~*((*~SSL~0 *VOID INT ) : INT)?ssl_write~*((*~SSL~0 *VOID INT ) : INT)?ssl_shutdown~*((*~SSL~0 ) : INT)?ssl_renegotiate~*((*~SSL~0 ) : INT)?ssl_renegotiate_check~*((*~SSL~0 ) : INT)?ssl_ctrl~*((*~SSL~0 INT LONG *CHAR ) : LONG)?ssl_ctx_ctrl~*((*~SSL_CTX~0 INT LONG *CHAR ) : LONG)?get_cipher_by_char~*((*UCHAR ) : *~SSL_CIPHER~0)?put_cipher_by_char~*((*~SSL_CIPHER~0 *UCHAR ) : INT)?ssl_pending~*((*~SSL~0 ) : INT)?num_ciphers~*(() : INT)?get_cipher~*((UINT ) : *~SSL_CIPHER~0)?get_ssl_method~*((INT ) : *ssl_method_st)?get_timeout~*(() : LONG)?ssl3_enc~*ssl3_enc_method?ssl_version~*(() : INT)?ssl_callback_ctrl~*((*~SSL~0 INT *(() : VOID) ) : LONG)?ssl_ctx_callback_ctrl~*((*~SSL_CTX~0 INT *(() : VOID) ) : LONG)# [2018-11-23 11:00:33,935 WARN L1272 BoogieBacktranslator]: Unfinished Backtranslation: BitvecLiteral 0bv32 could not be translated for associated CType STRUCT~~ssl_method_st?version~INT?ssl_new~*((*~SSL~0 ) : INT)?ssl_clear~*((*~SSL~0 ) : VOID)?ssl_free~*((*~SSL~0 ) : VOID)?ssl_accept~*((*~SSL~0 ) : INT)?ssl_connect~*((*~SSL~0 ) : INT)?ssl_read~*((*~SSL~0 *VOID INT ) : INT)?ssl_peek~*((*~SSL~0 *VOID INT ) : INT)?ssl_write~*((*~SSL~0 *VOID INT ) : INT)?ssl_shutdown~*((*~SSL~0 ) : INT)?ssl_renegotiate~*((*~SSL~0 ) : INT)?ssl_renegotiate_check~*((*~SSL~0 ) : INT)?ssl_ctrl~*((*~SSL~0 INT LONG *CHAR ) : LONG)?ssl_ctx_ctrl~*((*~SSL_CTX~0 INT LONG *CHAR ) : LONG)?get_cipher_by_char~*((*UCHAR ) : *~SSL_CIPHER~0)?put_cipher_by_char~*((*~SSL_CIPHER~0 *UCHAR ) : INT)?ssl_pending~*((*~SSL~0 ) : INT)?num_ciphers~*(() : INT)?get_cipher~*((UINT ) : *~SSL_CIPHER~0)?get_ssl_method~*((INT ) : *ssl_method_st)?get_timeout~*(() : LONG)?ssl3_enc~*ssl3_enc_method?ssl_version~*(() : INT)?ssl_callback_ctrl~*((*~SSL~0 INT *(() : VOID) ) : LONG)?ssl_ctx_callback_ctrl~*((*~SSL_CTX~0 INT *(() : VOID) ) : LONG)# ----- class de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator.CACSL2BoogieBacktranslator [?] CALL call ULTIMATE.init(); VAL [#NULL!base=0bv32, #NULL!offset=0bv32, old(#NULL!base)=0bv32, old(#NULL!offset)=0bv32, old(~#SSLv3_client_data~0!base)=0bv32, old(~#SSLv3_client_data~0!offset)=0bv32, old(~init~0)=0bv32, ~#SSLv3_client_data~0!base=0bv32, ~#SSLv3_client_data~0!offset=0bv32, ~init~0=0bv32] [?] #NULL := { base: 0bv32, offset: 0bv32 }; [?] #valid[0bv32] := 0bv1; [L1042] ~init~0 := 1bv32; [L1043] FCALL call ~#SSLv3_client_data~0 := #Ultimate.alloc(100bv32); [L1043] FCALL call write~init~intINTTYPE4(0bv32, { base: ~#SSLv3_client_data~0!base, offset: ~#SSLv3_client_data~0!offset }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(4bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(8bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(12bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(16bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(20bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(24bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(28bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(32bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(36bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(40bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(44bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(48bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(52bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(56bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(60bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(64bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(68bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(72bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(76bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(80bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(84bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(88bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(92bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(96bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); VAL [#NULL!base=0bv32, #NULL!offset=0bv32, old(#NULL!base)=0bv32, old(#NULL!offset)=0bv32, old(~#SSLv3_client_data~0!base)=0bv32, old(~#SSLv3_client_data~0!offset)=0bv32, old(~init~0)=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~init~0=1bv32] [?] RET call ULTIMATE.init(); VAL [#NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~init~0=1bv32] [?] CALL call #t~ret138 := main(); VAL [#NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~init~0=1bv32] [L1065] FCALL call #t~malloc3 := #Ultimate.alloc(248bv32); [L1065] ~s~0 := #t~malloc3; [L1069] FCALL call #t~malloc4 := #Ultimate.alloc(899bv32); [L1069] FCALL call write~$Pointer$(#t~malloc4, { base: ~s~0!base, offset: ~bvadd32(84bv32, ~s~0!offset) }, 4bv32); [L1070] FCALL call #t~malloc5 := #Ultimate.alloc(232bv32); [L1070] FCALL call write~$Pointer$(#t~malloc5, { base: ~s~0!base, offset: ~bvadd32(204bv32, ~s~0!offset) }, 4bv32); [L1071] FCALL call #t~malloc6 := #Ultimate.alloc(200bv32); [L1071] FCALL call write~$Pointer$(#t~malloc6, { base: ~s~0!base, offset: ~bvadd32(176bv32, ~s~0!offset) }, 4bv32); [L1072] FCALL call write~intINTTYPE4(12292bv32, { base: ~s~0!base, offset: ~bvadd32(52bv32, ~s~0!offset) }, 4bv32); [L1073] FCALL call write~intINTTYPE4(#t~nondet7, { base: ~s~0!base, offset: ~s~0!offset }, 4bv32); [L1073] havoc #t~nondet7; VAL [#NULL!base=0bv32, #NULL!offset=0bv32, #t~malloc3!base=33554433bv32, #t~malloc3!offset=0bv32, #t~malloc4!base=2147483650bv32, #t~malloc4!offset=0bv32, #t~malloc5!base=3bv32, #t~malloc5!offset=0bv32, #t~malloc6!base=2bv32, #t~malloc6!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~init~0=1bv32, ~s~0!base=33554433bv32, ~s~0!offset=0bv32] [L1074] CALL call #t~ret8 := ssl3_connect(~s~0); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~init~0=1bv32] [L1079-L1645] ~s := #in~s; [L1080] havoc ~buf~0; [L1081] havoc ~tmp~2; [L1082] havoc ~l~0; [L1083] havoc ~num1~0; [L1084] havoc ~cb~0; [L1085] havoc ~ret~0; [L1086] havoc ~new_state~0; [L1087] havoc ~state~0; [L1088] havoc ~skip~0; [L1089] ~tmp___0~1 := #t~nondet9; [L1089] havoc #t~nondet9; [L1090] ~tmp___1~0 := #t~nondet10; [L1090] havoc #t~nondet10; [L1091] ~tmp___2~0 := #t~nondet11; [L1091] havoc #t~nondet11; [L1092] ~tmp___3~0 := #t~nondet12; [L1092] havoc #t~nondet12; [L1093] ~tmp___4~0 := #t~nondet13; [L1093] havoc #t~nondet13; [L1094] ~tmp___5~0 := #t~nondet14; [L1094] havoc #t~nondet14; [L1095] ~tmp___6~0 := #t~nondet15; [L1095] havoc #t~nondet15; [L1096] ~tmp___7~0 := #t~nondet16; [L1096] havoc #t~nondet16; [L1097] ~tmp___8~0 := #t~nondet17; [L1097] havoc #t~nondet17; [L1098] ~tmp___9~0 := #t~nondet18; [L1098] havoc #t~nondet18; [L1099] havoc ~blastFlag~0; [L1102] ~blastFlag~0 := 0bv32; [L1103] FCALL call write~intINTTYPE4(#t~nondet19, { base: ~s!base, offset: ~bvadd32(92bv32, ~s!offset) }, 4bv32); [L1103] havoc #t~nondet19; [L1104] FCALL call write~intINTTYPE4(12292bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1105] ~tmp~2 := #t~nondet20; [L1105] havoc #t~nondet20; [L1106] ~cb~0 := { base: 0bv32, offset: 0bv32 }; [L1107] ~ret~0 := 4294967295bv32; [L1108] ~skip~0 := 0bv32; [L1109] FCALL call write~intINTTYPE4(0bv32, ~tmp___0~1, 4bv32); [L1110] FCALL call #t~mem21 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(192bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem21!base=0bv32, #t~mem21!offset=1bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=0bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1110] COND TRUE 0bv32 != ~bvadd32(#t~mem21!base, #t~mem21!offset) [L1110] havoc #t~mem21; [L1111] FCALL call #t~mem22 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(192bv32, ~s!offset) }, 4bv32); [L1111] ~cb~0 := #t~mem22; [L1111] havoc #t~mem22; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1119] FCALL call #t~mem27 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(28bv32, ~s!offset) }, 4bv32); [L1119] FCALL call write~intINTTYPE4(~bvadd32(1bv32, #t~mem27), { base: ~s!base, offset: ~bvadd32(28bv32, ~s!offset) }, 4bv32); [L1119] havoc #t~mem27; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1120-L1128] COND FALSE !(0bv32 != ~bvand32(12288bv32, ~tmp___1~0)) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] COND FALSE !(false) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] FCALL call #t~mem28 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] FCALL call #t~mem29 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem29=12292bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133] COND TRUE 12292bv32 == #t~mem29 [L1133] havoc #t~mem29; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1236] FCALL call write~intINTTYPE4(1bv32, { base: ~s!base, offset: ~bvadd32(40bv32, ~s!offset) }, 4bv32); [L1237] FCALL call write~intINTTYPE4(4096bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1238] FCALL call #t~mem62 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(204bv32, ~s!offset) }, 4bv32); [L1238] FCALL call #t~mem63 := read~intINTTYPE4({ base: #t~mem62!base, offset: ~bvadd32(64bv32, #t~mem62!offset) }, 4bv32); [L1238] FCALL call write~intINTTYPE4(~bvadd32(1bv32, #t~mem63), { base: #t~mem62!base, offset: ~bvadd32(64bv32, #t~mem62!offset) }, 4bv32); [L1238] havoc #t~mem62; [L1238] havoc #t~mem63; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1243] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(36bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1244] COND TRUE 0bv32 != ~bvadd32(~cb~0!base, ~cb~0!offset) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1249] FCALL call #t~mem64 := read~intINTTYPE4({ base: ~s!base, offset: ~s!offset }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem64=768bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1249] COND FALSE !(768bv32 != ~bvand32(65280bv32, #t~mem64)) [L1249] havoc #t~mem64; [L1255] FCALL call write~intINTTYPE4(4096bv32, { base: ~s!base, offset: ~bvadd32(4bv32, ~s!offset) }, 4bv32); [L1256] FCALL call #t~mem65 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(60bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem65!base=0bv32, #t~mem65!offset=1bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1256] COND FALSE !(0bv32 == ~bvadd32(#t~mem65!base, #t~mem65!offset)) [L1256] havoc #t~mem65; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1274] COND FALSE !(0bv32 == ~tmp___4~0) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1280] COND FALSE !(0bv32 == ~tmp___5~0) [L1286] FCALL call write~intINTTYPE4(4368bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1287] FCALL call #t~mem67 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(204bv32, ~s!offset) }, 4bv32); [L1287] FCALL call #t~mem68 := read~intINTTYPE4({ base: #t~mem67!base, offset: ~bvadd32(60bv32, #t~mem67!offset) }, 4bv32); [L1287] FCALL call write~intINTTYPE4(~bvadd32(1bv32, #t~mem68), { base: #t~mem67!base, offset: ~bvadd32(60bv32, #t~mem67!offset) }, 4bv32); [L1287] havoc #t~mem68; [L1287] havoc #t~mem67; [L1288] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(64bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] FCALL call #t~mem127 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(84bv32, ~s!offset) }, 4bv32); [L1602] FCALL call #t~mem128 := read~intINTTYPE4({ base: #t~mem127!base, offset: ~bvadd32(848bv32, #t~mem127!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem127!base=33554433bv32, #t~mem127!offset=4294966500bv32, #t~mem128=4368bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] COND FALSE !(0bv32 == #t~mem128) [L1602] havoc #t~mem127; [L1602] havoc #t~mem128; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1631] ~skip~0 := 0bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] COND FALSE !(false) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] FCALL call #t~mem28 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] FCALL call #t~mem29 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem29=4368bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133] COND FALSE !(12292bv32 == #t~mem29) [L1133] havoc #t~mem29; [L1136] FCALL call #t~mem30 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem30=4368bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1136] COND FALSE !(16384bv32 == #t~mem30) [L1136] havoc #t~mem30; [L1139] FCALL call #t~mem31 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem31=4368bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1139] COND FALSE !(4096bv32 == #t~mem31) [L1139] havoc #t~mem31; [L1142] FCALL call #t~mem32 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem32=4368bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1142] COND FALSE !(20480bv32 == #t~mem32) [L1142] havoc #t~mem32; [L1145] FCALL call #t~mem33 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem33=4368bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1145] COND FALSE !(4099bv32 == #t~mem33) [L1145] havoc #t~mem33; [L1148] FCALL call #t~mem34 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem34=4368bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1148] COND TRUE 4368bv32 == #t~mem34 [L1148] havoc #t~mem34; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1292] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(48bv32, ~s!offset) }, 4bv32); [L1293] ~ret~0 := #t~nondet69; [L1293] havoc #t~nondet69; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1294] COND TRUE 0bv32 == ~blastFlag~0 [L1295] ~blastFlag~0 := 1bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1299] COND FALSE !(~bvsle32(~ret~0, 0bv32)) [L1304] FCALL call write~intINTTYPE4(4384bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1305] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(64bv32, ~s!offset) }, 4bv32); [L1306] FCALL call #t~mem70 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(20bv32, ~s!offset) }, 4bv32); [L1306] FCALL call #t~mem71 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(16bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem70!base=1bv32, #t~mem70!offset=0bv32, #t~mem71!base=0bv32, #t~mem71!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1306] COND TRUE ~bvadd32(#t~mem70!base, #t~mem70!offset) != ~bvadd32(#t~mem71!base, #t~mem71!offset) [L1306] havoc #t~mem71; [L1306] havoc #t~mem70; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] FCALL call #t~mem127 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(84bv32, ~s!offset) }, 4bv32); [L1602] FCALL call #t~mem128 := read~intINTTYPE4({ base: #t~mem127!base, offset: ~bvadd32(848bv32, #t~mem127!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem127!base=33554433bv32, #t~mem127!offset=4294966500bv32, #t~mem128=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] COND FALSE !(0bv32 == #t~mem128) [L1602] havoc #t~mem127; [L1602] havoc #t~mem128; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1631] ~skip~0 := 0bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] COND FALSE !(false) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] FCALL call #t~mem28 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] FCALL call #t~mem29 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem29=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133] COND FALSE !(12292bv32 == #t~mem29) [L1133] havoc #t~mem29; [L1136] FCALL call #t~mem30 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem30=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1136] COND FALSE !(16384bv32 == #t~mem30) [L1136] havoc #t~mem30; [L1139] FCALL call #t~mem31 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem31=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1139] COND FALSE !(4096bv32 == #t~mem31) [L1139] havoc #t~mem31; [L1142] FCALL call #t~mem32 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem32=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1142] COND FALSE !(20480bv32 == #t~mem32) [L1142] havoc #t~mem32; [L1145] FCALL call #t~mem33 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem33=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1145] COND FALSE !(4099bv32 == #t~mem33) [L1145] havoc #t~mem33; [L1148] FCALL call #t~mem34 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem34=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1148] COND FALSE !(4368bv32 == #t~mem34) [L1148] havoc #t~mem34; [L1151] FCALL call #t~mem35 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem35=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1151] COND FALSE !(4369bv32 == #t~mem35) [L1151] havoc #t~mem35; [L1154] FCALL call #t~mem36 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem36=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1154] COND TRUE 4384bv32 == #t~mem36 [L1154] havoc #t~mem36; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1314] ~ret~0 := #t~nondet72; [L1314] havoc #t~nondet72; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1315] COND TRUE 1bv32 == ~blastFlag~0 [L1316] ~blastFlag~0 := 2bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1324] COND FALSE !(~bvsle32(~ret~0, 0bv32)) [L1329] FCALL call #t~mem73 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(92bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem73=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1329-L1333] COND FALSE !(0bv32 != #t~mem73) [L1329] havoc #t~mem73; [L1332] FCALL call write~intINTTYPE4(4400bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1334] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(64bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] FCALL call #t~mem127 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(84bv32, ~s!offset) }, 4bv32); [L1602] FCALL call #t~mem128 := read~intINTTYPE4({ base: #t~mem127!base, offset: ~bvadd32(848bv32, #t~mem127!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem127!base=33554433bv32, #t~mem127!offset=4294966500bv32, #t~mem128=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] COND FALSE !(0bv32 == #t~mem128) [L1602] havoc #t~mem127; [L1602] havoc #t~mem128; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1631] ~skip~0 := 0bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] COND FALSE !(false) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] FCALL call #t~mem28 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] FCALL call #t~mem29 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem29=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133] COND FALSE !(12292bv32 == #t~mem29) [L1133] havoc #t~mem29; [L1136] FCALL call #t~mem30 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem30=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1136] COND FALSE !(16384bv32 == #t~mem30) [L1136] havoc #t~mem30; [L1139] FCALL call #t~mem31 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem31=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1139] COND FALSE !(4096bv32 == #t~mem31) [L1139] havoc #t~mem31; [L1142] FCALL call #t~mem32 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem32=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1142] COND FALSE !(20480bv32 == #t~mem32) [L1142] havoc #t~mem32; [L1145] FCALL call #t~mem33 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem33=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1145] COND FALSE !(4099bv32 == #t~mem33) [L1145] havoc #t~mem33; [L1148] FCALL call #t~mem34 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem34=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1148] COND FALSE !(4368bv32 == #t~mem34) [L1148] havoc #t~mem34; [L1151] FCALL call #t~mem35 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem35=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1151] COND FALSE !(4369bv32 == #t~mem35) [L1151] havoc #t~mem35; [L1154] FCALL call #t~mem36 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem36=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1154] COND FALSE !(4384bv32 == #t~mem36) [L1154] havoc #t~mem36; [L1157] FCALL call #t~mem37 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem37=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1157] COND FALSE !(4385bv32 == #t~mem37) [L1157] havoc #t~mem37; [L1160] FCALL call #t~mem38 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem38=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1160] COND TRUE 4400bv32 == #t~mem38 [L1160] havoc #t~mem38; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1338] FCALL call #t~mem74 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(84bv32, ~s!offset) }, 4bv32); [L1338] FCALL call #t~mem75 := read~$Pointer$({ base: #t~mem74!base, offset: ~bvadd32(836bv32, #t~mem74!offset) }, 4bv32); [L1338] FCALL call #t~mem76 := read~intINTTYPE4({ base: #t~mem75!base, offset: ~bvadd32(12bv32, #t~mem75!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem74!base=33554433bv32, #t~mem74!offset=4294966500bv32, #t~mem75!base=33554433bv32, #t~mem75!offset=52bv32, #t~mem76=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1338-L1352] COND FALSE !(0bv32 != ~bvand32(256bv32, #t~mem76)) [L1338] havoc #t~mem76; [L1338] havoc #t~mem75; [L1338] havoc #t~mem74; [L1341] ~ret~0 := #t~nondet77; [L1341] havoc #t~nondet77; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1342] COND TRUE 2bv32 == ~blastFlag~0 [L1343] ~blastFlag~0 := 3bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1347] COND FALSE !(~bvsle32(~ret~0, 0bv32)) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1353] FCALL call write~intINTTYPE4(4416bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1354] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(64bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] FCALL call #t~mem127 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(84bv32, ~s!offset) }, 4bv32); [L1602] FCALL call #t~mem128 := read~intINTTYPE4({ base: #t~mem127!base, offset: ~bvadd32(848bv32, #t~mem127!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem127!base=33554433bv32, #t~mem127!offset=4294966500bv32, #t~mem128=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] COND FALSE !(0bv32 == #t~mem128) [L1602] havoc #t~mem127; [L1602] havoc #t~mem128; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1631] ~skip~0 := 0bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] COND FALSE !(false) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] FCALL call #t~mem28 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] FCALL call #t~mem29 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem29=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133] COND FALSE !(12292bv32 == #t~mem29) [L1133] havoc #t~mem29; [L1136] FCALL call #t~mem30 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem30=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1136] COND FALSE !(16384bv32 == #t~mem30) [L1136] havoc #t~mem30; [L1139] FCALL call #t~mem31 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem31=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1139] COND FALSE !(4096bv32 == #t~mem31) [L1139] havoc #t~mem31; [L1142] FCALL call #t~mem32 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem32=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1142] COND FALSE !(20480bv32 == #t~mem32) [L1142] havoc #t~mem32; [L1145] FCALL call #t~mem33 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem33=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1145] COND FALSE !(4099bv32 == #t~mem33) [L1145] havoc #t~mem33; [L1148] FCALL call #t~mem34 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem34=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1148] COND FALSE !(4368bv32 == #t~mem34) [L1148] havoc #t~mem34; [L1151] FCALL call #t~mem35 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem35=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1151] COND FALSE !(4369bv32 == #t~mem35) [L1151] havoc #t~mem35; [L1154] FCALL call #t~mem36 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem36=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1154] COND FALSE !(4384bv32 == #t~mem36) [L1154] havoc #t~mem36; [L1157] FCALL call #t~mem37 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem37=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1157] COND FALSE !(4385bv32 == #t~mem37) [L1157] havoc #t~mem37; [L1160] FCALL call #t~mem38 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem38=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1160] COND FALSE !(4400bv32 == #t~mem38) [L1160] havoc #t~mem38; [L1163] FCALL call #t~mem39 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem39=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1163] COND FALSE !(4401bv32 == #t~mem39) [L1163] havoc #t~mem39; [L1166] FCALL call #t~mem40 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem40=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1166] COND TRUE 4416bv32 == #t~mem40 [L1166] havoc #t~mem40; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1358] ~ret~0 := #t~nondet78; [L1358] havoc #t~nondet78; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1359] COND TRUE 3bv32 == ~blastFlag~0 [L1360] ~blastFlag~0 := 4bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1364] COND FALSE !(~bvsle32(~ret~0, 0bv32)) [L1369] FCALL call write~intINTTYPE4(4432bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1370] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(64bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1371] COND FALSE !(0bv32 == ~tmp___6~0) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] FCALL call #t~mem127 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(84bv32, ~s!offset) }, 4bv32); [L1602] FCALL call #t~mem128 := read~intINTTYPE4({ base: #t~mem127!base, offset: ~bvadd32(848bv32, #t~mem127!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem127!base=33554433bv32, #t~mem127!offset=4294966500bv32, #t~mem128=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] COND FALSE !(0bv32 == #t~mem128) [L1602] havoc #t~mem127; [L1602] havoc #t~mem128; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1631] ~skip~0 := 0bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] COND FALSE !(false) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] FCALL call #t~mem28 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] FCALL call #t~mem29 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem29=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133] COND FALSE !(12292bv32 == #t~mem29) [L1133] havoc #t~mem29; [L1136] FCALL call #t~mem30 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem30=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1136] COND FALSE !(16384bv32 == #t~mem30) [L1136] havoc #t~mem30; [L1139] FCALL call #t~mem31 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem31=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1139] COND FALSE !(4096bv32 == #t~mem31) [L1139] havoc #t~mem31; [L1142] FCALL call #t~mem32 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem32=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1142] COND FALSE !(20480bv32 == #t~mem32) [L1142] havoc #t~mem32; [L1145] FCALL call #t~mem33 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem33=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1145] COND FALSE !(4099bv32 == #t~mem33) [L1145] havoc #t~mem33; [L1148] FCALL call #t~mem34 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem34=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1148] COND FALSE !(4368bv32 == #t~mem34) [L1148] havoc #t~mem34; [L1151] FCALL call #t~mem35 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem35=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1151] COND FALSE !(4369bv32 == #t~mem35) [L1151] havoc #t~mem35; [L1154] FCALL call #t~mem36 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem36=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1154] COND FALSE !(4384bv32 == #t~mem36) [L1154] havoc #t~mem36; [L1157] FCALL call #t~mem37 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem37=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1157] COND FALSE !(4385bv32 == #t~mem37) [L1157] havoc #t~mem37; [L1160] FCALL call #t~mem38 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem38=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1160] COND FALSE !(4400bv32 == #t~mem38) [L1160] havoc #t~mem38; [L1163] FCALL call #t~mem39 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem39=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1163] COND FALSE !(4401bv32 == #t~mem39) [L1163] havoc #t~mem39; [L1166] FCALL call #t~mem40 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem40=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1166] COND FALSE !(4416bv32 == #t~mem40) [L1166] havoc #t~mem40; [L1169] FCALL call #t~mem41 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem41=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1169] COND FALSE !(4417bv32 == #t~mem41) [L1169] havoc #t~mem41; [L1172] FCALL call #t~mem42 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem42=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1172] COND TRUE 4432bv32 == #t~mem42 [L1172] havoc #t~mem42; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1380] ~ret~0 := #t~nondet79; [L1380] havoc #t~nondet79; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=0bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1381] COND TRUE 4bv32 == ~blastFlag~0 VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=0bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1643] assert false; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=0bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1042] static int init = 1; [L1043] static SSL_METHOD SSLv3_client_data ; VAL [\old(init)=0, \old(SSLv3_client_data)=null, \old(SSLv3_client_data)=null, init=1, SSLv3_client_data={33554434:0}] [L1065] SSL *s = (SSL*)malloc(sizeof(SSL)) ; [L1069] s->s3 = malloc(sizeof(struct ssl3_state_st)) [L1070] s->ctx = malloc(sizeof(SSL_CTX)) [L1071] s->session = malloc(sizeof(SSL_SESSION)) [L1072] s->state = 12292 [L1073] s->version = __VERIFIER_nondet_int() [L1074] CALL ssl3_connect(s) VAL [init=1, s={33554433:0}, SSLv3_client_data={33554434:0}] [L1080] BUF_MEM *buf ; [L1081] unsigned long tmp ; [L1082] unsigned long l ; [L1083] long num1 ; [L1084] void (*cb)() ; [L1085] int ret ; [L1086] int new_state ; [L1087] int state ; [L1088] int skip ; [L1089] int *tmp___0 = __VERIFIER_nondet_pointer() ; [L1090] int tmp___1 = __VERIFIER_nondet_int() ; [L1091] int tmp___2 = __VERIFIER_nondet_int() ; [L1092] int tmp___3 = __VERIFIER_nondet_int() ; [L1093] int tmp___4 = __VERIFIER_nondet_int() ; [L1094] int tmp___5 = __VERIFIER_nondet_int() ; [L1095] int tmp___6 = __VERIFIER_nondet_int() ; [L1096] int tmp___7 = __VERIFIER_nondet_int() ; [L1097] int tmp___8 = __VERIFIER_nondet_int() ; [L1098] long tmp___9 = __VERIFIER_nondet_long() ; [L1099] int blastFlag ; [L1102] blastFlag = 0 [L1103] s->hit=__VERIFIER_nondet_int () [L1104] s->state = 12292 [L1105] tmp = __VERIFIER_nondet_int() [L1106] cb = (void (*)())((void *)0) [L1107] ret = -1 [L1108] skip = 0 [L1109] *tmp___0 = 0 [L1110] EXPR s->info_callback VAL [={0:0}, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, s->info_callback={0:1}, skip=0, SSLv3_client_data={33554434:0}, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1110] COND TRUE (unsigned long )s->info_callback != (unsigned long )((void *)0) [L1111] EXPR s->info_callback [L1111] cb = s->info_callback [L1119] EXPR s->in_handshake [L1119] s->in_handshake += 1 [L1120] COND FALSE !(tmp___1 & 12288) VAL [={0:1}, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1130] COND TRUE 1 VAL [={0:1}, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1132] EXPR s->state [L1132] state = s->state [L1133] EXPR s->state VAL [={0:1}, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, s->state=12292, skip=0, SSLv3_client_data={33554434:0}, state=12292, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1133] COND TRUE s->state == 12292 [L1236] s->new_session = 1 [L1237] s->state = 4096 [L1238] EXPR s->ctx [L1238] EXPR (s->ctx)->stats.sess_connect_renegotiate [L1238] (s->ctx)->stats.sess_connect_renegotiate += 1 [L1243] s->server = 0 VAL [={0:1}, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=12292, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1244] COND TRUE (unsigned long )cb != (unsigned long )((void *)0) VAL [={0:1}, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=12292, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1249] EXPR s->version VAL [={0:1}, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, s->version=768, skip=0, SSLv3_client_data={33554434:0}, state=12292, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1249] COND FALSE !((s->version & 65280) != 768) [L1255] s->type = 4096 [L1256] EXPR s->init_buf VAL [={0:1}, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, s->init_buf={0:1}, skip=0, SSLv3_client_data={33554434:0}, state=12292, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1256] COND FALSE !((unsigned long )s->init_buf == (unsigned long )((void *)0)) [L1274] COND FALSE !(! tmp___4) VAL [={0:1}, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=12292, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1280] COND FALSE !(! tmp___5) [L1286] s->state = 4368 [L1287] EXPR s->ctx [L1287] EXPR (s->ctx)->stats.sess_connect [L1287] (s->ctx)->stats.sess_connect += 1 [L1288] s->init_num = 0 VAL [={0:1}, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=12292, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1602] EXPR s->s3 [L1602] EXPR (s->s3)->tmp.reuse_message VAL [={0:1}, (s->s3)->tmp.reuse_message=4368, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, s->s3={33554433:-796}, skip=0, SSLv3_client_data={33554434:0}, state=12292, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1602] COND FALSE !(! (s->s3)->tmp.reuse_message) [L1631] skip = 0 VAL [={0:1}, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=12292, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1130] COND TRUE 1 VAL [={0:1}, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=12292, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1132] EXPR s->state [L1132] state = s->state [L1133] EXPR s->state VAL [={0:1}, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, s->state=4368, skip=0, SSLv3_client_data={33554434:0}, state=4368, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1133] COND FALSE !(s->state == 12292) [L1136] EXPR s->state VAL [={0:1}, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, s->state=4368, skip=0, SSLv3_client_data={33554434:0}, state=4368, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1136] COND FALSE !(s->state == 16384) [L1139] EXPR s->state VAL [={0:1}, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, s->state=4368, skip=0, SSLv3_client_data={33554434:0}, state=4368, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1139] COND FALSE !(s->state == 4096) [L1142] EXPR s->state VAL [={0:1}, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, s->state=4368, skip=0, SSLv3_client_data={33554434:0}, state=4368, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1142] COND FALSE !(s->state == 20480) [L1145] EXPR s->state VAL [={0:1}, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, s->state=4368, skip=0, SSLv3_client_data={33554434:0}, state=4368, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1145] COND FALSE !(s->state == 4099) [L1148] EXPR s->state VAL [={0:1}, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, s->state=4368, skip=0, SSLv3_client_data={33554434:0}, state=4368, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1148] COND TRUE s->state == 4368 [L1292] s->shutdown = 0 [L1293] ret = __VERIFIER_nondet_int() [L1294] COND TRUE blastFlag == 0 [L1295] blastFlag = 1 VAL [={0:1}, blastFlag=1, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4368, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1299] COND FALSE !(ret <= 0) [L1304] s->state = 4384 [L1305] s->init_num = 0 [L1306] EXPR s->bbio [L1306] EXPR s->wbio VAL [={0:1}, blastFlag=1, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->bbio={1:0}, s->wbio={0:0}, skip=0, SSLv3_client_data={33554434:0}, state=4368, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1306] COND TRUE (unsigned long )s->bbio != (unsigned long )s->wbio [L1602] EXPR s->s3 [L1602] EXPR (s->s3)->tmp.reuse_message VAL [={0:1}, (s->s3)->tmp.reuse_message=4384, blastFlag=1, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->s3={33554433:-796}, skip=0, SSLv3_client_data={33554434:0}, state=4368, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1602] COND FALSE !(! (s->s3)->tmp.reuse_message) [L1631] skip = 0 VAL [={0:1}, blastFlag=1, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4368, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1130] COND TRUE 1 VAL [={0:1}, blastFlag=1, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4368, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1132] EXPR s->state [L1132] state = s->state [L1133] EXPR s->state VAL [={0:1}, blastFlag=1, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4384, skip=0, SSLv3_client_data={33554434:0}, state=4384, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1133] COND FALSE !(s->state == 12292) [L1136] EXPR s->state VAL [={0:1}, blastFlag=1, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4384, skip=0, SSLv3_client_data={33554434:0}, state=4384, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1136] COND FALSE !(s->state == 16384) [L1139] EXPR s->state VAL [={0:1}, blastFlag=1, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4384, skip=0, SSLv3_client_data={33554434:0}, state=4384, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1139] COND FALSE !(s->state == 4096) [L1142] EXPR s->state VAL [={0:1}, blastFlag=1, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4384, skip=0, SSLv3_client_data={33554434:0}, state=4384, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1142] COND FALSE !(s->state == 20480) [L1145] EXPR s->state VAL [={0:1}, blastFlag=1, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4384, skip=0, SSLv3_client_data={33554434:0}, state=4384, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1145] COND FALSE !(s->state == 4099) [L1148] EXPR s->state VAL [={0:1}, blastFlag=1, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4384, skip=0, SSLv3_client_data={33554434:0}, state=4384, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1148] COND FALSE !(s->state == 4368) [L1151] EXPR s->state VAL [={0:1}, blastFlag=1, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4384, skip=0, SSLv3_client_data={33554434:0}, state=4384, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1151] COND FALSE !(s->state == 4369) [L1154] EXPR s->state VAL [={0:1}, blastFlag=1, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4384, skip=0, SSLv3_client_data={33554434:0}, state=4384, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1154] COND TRUE s->state == 4384 [L1314] ret = __VERIFIER_nondet_int() [L1315] COND TRUE blastFlag == 1 [L1316] blastFlag = 2 VAL [={0:1}, blastFlag=2, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4384, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1324] COND FALSE !(ret <= 0) [L1329] s->hit VAL [={0:1}, blastFlag=2, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->hit=0, skip=0, SSLv3_client_data={33554434:0}, state=4384, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1329] COND FALSE !(s->hit) [L1332] s->state = 4400 VAL [={0:1}, blastFlag=2, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4384, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1334] s->init_num = 0 VAL [={0:1}, blastFlag=2, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4384, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1602] EXPR s->s3 [L1602] EXPR (s->s3)->tmp.reuse_message VAL [={0:1}, (s->s3)->tmp.reuse_message=4400, blastFlag=2, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->s3={33554433:-796}, skip=0, SSLv3_client_data={33554434:0}, state=4384, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1602] COND FALSE !(! (s->s3)->tmp.reuse_message) [L1631] skip = 0 VAL [={0:1}, blastFlag=2, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4384, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1130] COND TRUE 1 VAL [={0:1}, blastFlag=2, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4384, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1132] EXPR s->state [L1132] state = s->state [L1133] EXPR s->state VAL [={0:1}, blastFlag=2, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4400, skip=0, SSLv3_client_data={33554434:0}, state=4400, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1133] COND FALSE !(s->state == 12292) [L1136] EXPR s->state VAL [={0:1}, blastFlag=2, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4400, skip=0, SSLv3_client_data={33554434:0}, state=4400, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1136] COND FALSE !(s->state == 16384) [L1139] EXPR s->state VAL [={0:1}, blastFlag=2, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4400, skip=0, SSLv3_client_data={33554434:0}, state=4400, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1139] COND FALSE !(s->state == 4096) [L1142] EXPR s->state VAL [={0:1}, blastFlag=2, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4400, skip=0, SSLv3_client_data={33554434:0}, state=4400, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1142] COND FALSE !(s->state == 20480) [L1145] EXPR s->state VAL [={0:1}, blastFlag=2, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4400, skip=0, SSLv3_client_data={33554434:0}, state=4400, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1145] COND FALSE !(s->state == 4099) [L1148] EXPR s->state VAL [={0:1}, blastFlag=2, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4400, skip=0, SSLv3_client_data={33554434:0}, state=4400, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1148] COND FALSE !(s->state == 4368) [L1151] EXPR s->state VAL [={0:1}, blastFlag=2, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4400, skip=0, SSLv3_client_data={33554434:0}, state=4400, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1151] COND FALSE !(s->state == 4369) [L1154] EXPR s->state VAL [={0:1}, blastFlag=2, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4400, skip=0, SSLv3_client_data={33554434:0}, state=4400, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1154] COND FALSE !(s->state == 4384) [L1157] EXPR s->state VAL [={0:1}, blastFlag=2, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4400, skip=0, SSLv3_client_data={33554434:0}, state=4400, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1157] COND FALSE !(s->state == 4385) [L1160] EXPR s->state VAL [={0:1}, blastFlag=2, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4400, skip=0, SSLv3_client_data={33554434:0}, state=4400, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1160] COND TRUE s->state == 4400 [L1338] EXPR s->s3 [L1338] EXPR (s->s3)->tmp.new_cipher [L1338] EXPR ((s->s3)->tmp.new_cipher)->algorithms VAL [={0:1}, ((s->s3)->tmp.new_cipher)->algorithms=0, (s->s3)->tmp.new_cipher={33554433:52}, blastFlag=2, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->s3={33554433:-796}, skip=0, SSLv3_client_data={33554434:0}, state=4400, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1338] COND FALSE !(((s->s3)->tmp.new_cipher)->algorithms & 256UL) [L1341] ret = __VERIFIER_nondet_int() [L1342] COND TRUE blastFlag == 2 [L1343] blastFlag = 3 VAL [={0:1}, blastFlag=3, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4400, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1347] COND FALSE !(ret <= 0) VAL [={0:1}, blastFlag=3, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4400, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1353] s->state = 4416 [L1354] s->init_num = 0 VAL [={0:1}, blastFlag=3, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4400, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1602] EXPR s->s3 [L1602] EXPR (s->s3)->tmp.reuse_message VAL [={0:1}, (s->s3)->tmp.reuse_message=4416, blastFlag=3, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->s3={33554433:-796}, skip=0, SSLv3_client_data={33554434:0}, state=4400, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1602] COND FALSE !(! (s->s3)->tmp.reuse_message) [L1631] skip = 0 VAL [={0:1}, blastFlag=3, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4400, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1130] COND TRUE 1 VAL [={0:1}, blastFlag=3, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4400, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1132] EXPR s->state [L1132] state = s->state [L1133] EXPR s->state VAL [={0:1}, blastFlag=3, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4416, skip=0, SSLv3_client_data={33554434:0}, state=4416, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1133] COND FALSE !(s->state == 12292) [L1136] EXPR s->state VAL [={0:1}, blastFlag=3, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4416, skip=0, SSLv3_client_data={33554434:0}, state=4416, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1136] COND FALSE !(s->state == 16384) [L1139] EXPR s->state VAL [={0:1}, blastFlag=3, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4416, skip=0, SSLv3_client_data={33554434:0}, state=4416, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1139] COND FALSE !(s->state == 4096) [L1142] EXPR s->state VAL [={0:1}, blastFlag=3, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4416, skip=0, SSLv3_client_data={33554434:0}, state=4416, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1142] COND FALSE !(s->state == 20480) [L1145] EXPR s->state VAL [={0:1}, blastFlag=3, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4416, skip=0, SSLv3_client_data={33554434:0}, state=4416, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1145] COND FALSE !(s->state == 4099) [L1148] EXPR s->state VAL [={0:1}, blastFlag=3, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4416, skip=0, SSLv3_client_data={33554434:0}, state=4416, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1148] COND FALSE !(s->state == 4368) [L1151] EXPR s->state VAL [={0:1}, blastFlag=3, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4416, skip=0, SSLv3_client_data={33554434:0}, state=4416, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1151] COND FALSE !(s->state == 4369) [L1154] EXPR s->state VAL [={0:1}, blastFlag=3, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4416, skip=0, SSLv3_client_data={33554434:0}, state=4416, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1154] COND FALSE !(s->state == 4384) [L1157] EXPR s->state VAL [={0:1}, blastFlag=3, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4416, skip=0, SSLv3_client_data={33554434:0}, state=4416, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1157] COND FALSE !(s->state == 4385) [L1160] EXPR s->state VAL [={0:1}, blastFlag=3, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4416, skip=0, SSLv3_client_data={33554434:0}, state=4416, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1160] COND FALSE !(s->state == 4400) [L1163] EXPR s->state VAL [={0:1}, blastFlag=3, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4416, skip=0, SSLv3_client_data={33554434:0}, state=4416, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1163] COND FALSE !(s->state == 4401) [L1166] EXPR s->state VAL [={0:1}, blastFlag=3, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4416, skip=0, SSLv3_client_data={33554434:0}, state=4416, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1166] COND TRUE s->state == 4416 [L1358] ret = __VERIFIER_nondet_int() [L1359] COND TRUE blastFlag == 3 [L1360] blastFlag = 4 VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4416, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1364] COND FALSE !(ret <= 0) [L1369] s->state = 4432 [L1370] s->init_num = 0 VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4416, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1371] COND FALSE !(! tmp___6) VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4416, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1602] EXPR s->s3 [L1602] EXPR (s->s3)->tmp.reuse_message VAL [={0:1}, (s->s3)->tmp.reuse_message=4432, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->s3={33554433:-796}, skip=0, SSLv3_client_data={33554434:0}, state=4416, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1602] COND FALSE !(! (s->s3)->tmp.reuse_message) [L1631] skip = 0 VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4416, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1130] COND TRUE 1 VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4416, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1132] EXPR s->state [L1132] state = s->state [L1133] EXPR s->state VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4432, skip=0, SSLv3_client_data={33554434:0}, state=4432, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1133] COND FALSE !(s->state == 12292) [L1136] EXPR s->state VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4432, skip=0, SSLv3_client_data={33554434:0}, state=4432, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1136] COND FALSE !(s->state == 16384) [L1139] EXPR s->state VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4432, skip=0, SSLv3_client_data={33554434:0}, state=4432, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1139] COND FALSE !(s->state == 4096) [L1142] EXPR s->state VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4432, skip=0, SSLv3_client_data={33554434:0}, state=4432, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1142] COND FALSE !(s->state == 20480) [L1145] EXPR s->state VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4432, skip=0, SSLv3_client_data={33554434:0}, state=4432, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1145] COND FALSE !(s->state == 4099) [L1148] EXPR s->state VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4432, skip=0, SSLv3_client_data={33554434:0}, state=4432, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1148] COND FALSE !(s->state == 4368) [L1151] EXPR s->state VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4432, skip=0, SSLv3_client_data={33554434:0}, state=4432, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1151] COND FALSE !(s->state == 4369) [L1154] EXPR s->state VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4432, skip=0, SSLv3_client_data={33554434:0}, state=4432, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1154] COND FALSE !(s->state == 4384) [L1157] EXPR s->state VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4432, skip=0, SSLv3_client_data={33554434:0}, state=4432, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1157] COND FALSE !(s->state == 4385) [L1160] EXPR s->state VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4432, skip=0, SSLv3_client_data={33554434:0}, state=4432, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1160] COND FALSE !(s->state == 4400) [L1163] EXPR s->state VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4432, skip=0, SSLv3_client_data={33554434:0}, state=4432, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1163] COND FALSE !(s->state == 4401) [L1166] EXPR s->state VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4432, skip=0, SSLv3_client_data={33554434:0}, state=4432, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1166] COND FALSE !(s->state == 4416) [L1169] EXPR s->state VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4432, skip=0, SSLv3_client_data={33554434:0}, state=4432, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1169] COND FALSE !(s->state == 4417) [L1172] EXPR s->state VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4432, skip=0, SSLv3_client_data={33554434:0}, state=4432, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1172] COND TRUE s->state == 4432 [L1380] ret = __VERIFIER_nondet_int() [L1381] COND TRUE blastFlag == 4 VAL [={0:1}, blastFlag=4, init=1, ret=0, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4432, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1643] __VERIFIER_error() VAL [={0:1}, blastFlag=4, init=1, ret=0, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4432, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] ----- [2018-11-23 11:00:34,051 WARN L170 areAnnotationChecker]: ULTIMATE.initENTRY has no Hoare annotation [2018-11-23 11:00:34,051 WARN L170 areAnnotationChecker]: ssl3_connectENTRY has no Hoare annotation [2018-11-23 11:00:34,051 WARN L170 areAnnotationChecker]: ULTIMATE.startENTRY has no Hoare annotation [2018-11-23 11:00:34,051 WARN L170 areAnnotationChecker]: ULTIMATE.startENTRY has no Hoare annotation [2018-11-23 11:00:34,052 WARN L170 areAnnotationChecker]: mainENTRY has no Hoare annotation [2018-11-23 11:00:34,052 WARN L170 areAnnotationChecker]: ULTIMATE.initFINAL has no Hoare annotation [2018-11-23 11:00:34,052 WARN L170 areAnnotationChecker]: L1110 has no Hoare annotation [2018-11-23 11:00:34,052 WARN L170 areAnnotationChecker]: L1110 has no Hoare annotation [2018-11-23 11:00:34,052 WARN L170 areAnnotationChecker]: L-1 has no Hoare annotation [2018-11-23 11:00:34,052 WARN L170 areAnnotationChecker]: L-1 has no Hoare annotation [2018-11-23 11:00:34,052 WARN L170 areAnnotationChecker]: L1074 has no Hoare annotation [2018-11-23 11:00:34,052 WARN L170 areAnnotationChecker]: L1074 has no Hoare annotation [2018-11-23 11:00:34,052 WARN L170 areAnnotationChecker]: ULTIMATE.initEXIT has no Hoare annotation [2018-11-23 11:00:34,053 WARN L170 areAnnotationChecker]: L1113-2 has no Hoare annotation [2018-11-23 11:00:34,053 WARN L170 areAnnotationChecker]: L1113 has no Hoare annotation [2018-11-23 11:00:34,053 WARN L170 areAnnotationChecker]: L1113 has no Hoare annotation [2018-11-23 11:00:34,053 WARN L170 areAnnotationChecker]: ULTIMATE.startFINAL has no Hoare annotation [2018-11-23 11:00:34,053 WARN L170 areAnnotationChecker]: L1074-1 has no Hoare annotation [2018-11-23 11:00:34,053 WARN L170 areAnnotationChecker]: L1120 has no Hoare annotation [2018-11-23 11:00:34,053 WARN L170 areAnnotationChecker]: L1120 has no Hoare annotation [2018-11-23 11:00:34,053 WARN L170 areAnnotationChecker]: mainFINAL has no Hoare annotation [2018-11-23 11:00:34,053 WARN L170 areAnnotationChecker]: L1121 has no Hoare annotation [2018-11-23 11:00:34,053 WARN L170 areAnnotationChecker]: L1121 has no Hoare annotation [2018-11-23 11:00:34,054 WARN L170 areAnnotationChecker]: L1130-1 has no Hoare annotation [2018-11-23 11:00:34,054 WARN L170 areAnnotationChecker]: L1130-1 has no Hoare annotation [2018-11-23 11:00:34,054 WARN L170 areAnnotationChecker]: L1130-1 has no Hoare annotation [2018-11-23 11:00:34,054 WARN L170 areAnnotationChecker]: mainEXIT has no Hoare annotation [2018-11-23 11:00:34,054 WARN L170 areAnnotationChecker]: L1633 has no Hoare annotation [2018-11-23 11:00:34,054 WARN L170 areAnnotationChecker]: L1131 has no Hoare annotation [2018-11-23 11:00:34,054 WARN L170 areAnnotationChecker]: L1637 has no Hoare annotation [2018-11-23 11:00:34,054 WARN L170 areAnnotationChecker]: L1637 has no Hoare annotation [2018-11-23 11:00:34,054 WARN L170 areAnnotationChecker]: L1133 has no Hoare annotation [2018-11-23 11:00:34,054 WARN L170 areAnnotationChecker]: L1133 has no Hoare annotation [2018-11-23 11:00:34,055 WARN L170 areAnnotationChecker]: L1637-2 has no Hoare annotation [2018-11-23 11:00:34,055 WARN L170 areAnnotationChecker]: L1134 has no Hoare annotation [2018-11-23 11:00:34,055 WARN L170 areAnnotationChecker]: L1136 has no Hoare annotation [2018-11-23 11:00:34,055 WARN L170 areAnnotationChecker]: L1136 has no Hoare annotation [2018-11-23 11:00:34,055 WARN L170 areAnnotationChecker]: ssl3_connectFINAL has no Hoare annotation [2018-11-23 11:00:34,055 WARN L170 areAnnotationChecker]: L1239 has no Hoare annotation [2018-11-23 11:00:34,055 WARN L170 areAnnotationChecker]: L1139 has no Hoare annotation [2018-11-23 11:00:34,055 WARN L170 areAnnotationChecker]: L1139 has no Hoare annotation [2018-11-23 11:00:34,055 WARN L170 areAnnotationChecker]: ssl3_connectEXIT has no Hoare annotation [2018-11-23 11:00:34,055 WARN L170 areAnnotationChecker]: L1244 has no Hoare annotation [2018-11-23 11:00:34,055 WARN L170 areAnnotationChecker]: L1244 has no Hoare annotation [2018-11-23 11:00:34,056 WARN L170 areAnnotationChecker]: L1142 has no Hoare annotation [2018-11-23 11:00:34,056 WARN L170 areAnnotationChecker]: L1142 has no Hoare annotation [2018-11-23 11:00:34,056 WARN L170 areAnnotationChecker]: L1244-2 has no Hoare annotation [2018-11-23 11:00:34,056 WARN L170 areAnnotationChecker]: L1145 has no Hoare annotation [2018-11-23 11:00:34,056 WARN L170 areAnnotationChecker]: L1145 has no Hoare annotation [2018-11-23 11:00:34,056 WARN L170 areAnnotationChecker]: L1249 has no Hoare annotation [2018-11-23 11:00:34,056 WARN L170 areAnnotationChecker]: L1249 has no Hoare annotation [2018-11-23 11:00:34,056 WARN L170 areAnnotationChecker]: L1148 has no Hoare annotation [2018-11-23 11:00:34,056 WARN L170 areAnnotationChecker]: L1148 has no Hoare annotation [2018-11-23 11:00:34,056 WARN L170 areAnnotationChecker]: L1256 has no Hoare annotation [2018-11-23 11:00:34,057 WARN L170 areAnnotationChecker]: L1256 has no Hoare annotation [2018-11-23 11:00:34,057 WARN L170 areAnnotationChecker]: L1152 has no Hoare annotation [2018-11-23 11:00:34,057 WARN L170 areAnnotationChecker]: L1151 has no Hoare annotation [2018-11-23 11:00:34,057 WARN L170 areAnnotationChecker]: L1151 has no Hoare annotation [2018-11-23 11:00:34,057 WARN L170 areAnnotationChecker]: L1258 has no Hoare annotation [2018-11-23 11:00:34,057 WARN L170 areAnnotationChecker]: L1258 has no Hoare annotation [2018-11-23 11:00:34,057 WARN L170 areAnnotationChecker]: L1256-2 has no Hoare annotation [2018-11-23 11:00:34,057 WARN L170 areAnnotationChecker]: L1256-2 has no Hoare annotation [2018-11-23 11:00:34,057 WARN L170 areAnnotationChecker]: L1294 has no Hoare annotation [2018-11-23 11:00:34,057 WARN L170 areAnnotationChecker]: L1294 has no Hoare annotation [2018-11-23 11:00:34,058 WARN L170 areAnnotationChecker]: L1154 has no Hoare annotation [2018-11-23 11:00:34,058 WARN L170 areAnnotationChecker]: L1154 has no Hoare annotation [2018-11-23 11:00:34,058 WARN L170 areAnnotationChecker]: L1264 has no Hoare annotation [2018-11-23 11:00:34,058 WARN L170 areAnnotationChecker]: L1264 has no Hoare annotation [2018-11-23 11:00:34,058 WARN L170 areAnnotationChecker]: L1280 has no Hoare annotation [2018-11-23 11:00:34,058 WARN L170 areAnnotationChecker]: L1280 has no Hoare annotation [2018-11-23 11:00:34,058 WARN L170 areAnnotationChecker]: L1294-2 has no Hoare annotation [2018-11-23 11:00:34,058 WARN L170 areAnnotationChecker]: L1294-2 has no Hoare annotation [2018-11-23 11:00:34,058 WARN L170 areAnnotationChecker]: L1158 has no Hoare annotation [2018-11-23 11:00:34,058 WARN L170 areAnnotationChecker]: L1157 has no Hoare annotation [2018-11-23 11:00:34,059 WARN L170 areAnnotationChecker]: L1157 has no Hoare annotation [2018-11-23 11:00:34,059 WARN L170 areAnnotationChecker]: L1566 has no Hoare annotation [2018-11-23 11:00:34,059 WARN L170 areAnnotationChecker]: L1306 has no Hoare annotation [2018-11-23 11:00:34,059 WARN L170 areAnnotationChecker]: L1306 has no Hoare annotation [2018-11-23 11:00:34,059 WARN L170 areAnnotationChecker]: L1315 has no Hoare annotation [2018-11-23 11:00:34,059 WARN L170 areAnnotationChecker]: L1315 has no Hoare annotation [2018-11-23 11:00:34,059 WARN L170 areAnnotationChecker]: L1160 has no Hoare annotation [2018-11-23 11:00:34,059 WARN L170 areAnnotationChecker]: L1160 has no Hoare annotation [2018-11-23 11:00:34,059 WARN L170 areAnnotationChecker]: L1602 has no Hoare annotation [2018-11-23 11:00:34,059 WARN L170 areAnnotationChecker]: L1602 has no Hoare annotation [2018-11-23 11:00:34,060 WARN L170 areAnnotationChecker]: L1318-2 has no Hoare annotation [2018-11-23 11:00:34,060 WARN L170 areAnnotationChecker]: L1318-2 has no Hoare annotation [2018-11-23 11:00:34,060 WARN L170 areAnnotationChecker]: L1318 has no Hoare annotation [2018-11-23 11:00:34,060 WARN L170 areAnnotationChecker]: L1318 has no Hoare annotation [2018-11-23 11:00:34,060 WARN L170 areAnnotationChecker]: L1164 has no Hoare annotation [2018-11-23 11:00:34,060 WARN L170 areAnnotationChecker]: L1163 has no Hoare annotation [2018-11-23 11:00:34,060 WARN L170 areAnnotationChecker]: L1163 has no Hoare annotation [2018-11-23 11:00:34,060 WARN L170 areAnnotationChecker]: L1603 has no Hoare annotation [2018-11-23 11:00:34,060 WARN L170 areAnnotationChecker]: L1603 has no Hoare annotation [2018-11-23 11:00:34,060 WARN L170 areAnnotationChecker]: L1602-1 has no Hoare annotation [2018-11-23 11:00:34,061 WARN L170 areAnnotationChecker]: L1329 has no Hoare annotation [2018-11-23 11:00:34,061 WARN L170 areAnnotationChecker]: L1329 has no Hoare annotation [2018-11-23 11:00:34,061 WARN L170 areAnnotationChecker]: L1338 has no Hoare annotation [2018-11-23 11:00:34,061 WARN L170 areAnnotationChecker]: L1338 has no Hoare annotation [2018-11-23 11:00:34,061 WARN L170 areAnnotationChecker]: L1166 has no Hoare annotation [2018-11-23 11:00:34,061 WARN L170 areAnnotationChecker]: L1166 has no Hoare annotation [2018-11-23 11:00:34,061 WARN L170 areAnnotationChecker]: L1604 has no Hoare annotation [2018-11-23 11:00:34,061 WARN L170 areAnnotationChecker]: L1604 has no Hoare annotation [2018-11-23 11:00:34,061 WARN L170 areAnnotationChecker]: L1329-2 has no Hoare annotation [2018-11-23 11:00:34,062 WARN L170 areAnnotationChecker]: L1338-2 has no Hoare annotation [2018-11-23 11:00:34,062 WARN L170 areAnnotationChecker]: L1342 has no Hoare annotation [2018-11-23 11:00:34,062 WARN L170 areAnnotationChecker]: L1342 has no Hoare annotation [2018-11-23 11:00:34,062 WARN L170 areAnnotationChecker]: L1170 has no Hoare annotation [2018-11-23 11:00:34,062 WARN L170 areAnnotationChecker]: L1169 has no Hoare annotation [2018-11-23 11:00:34,062 WARN L170 areAnnotationChecker]: L1169 has no Hoare annotation [2018-11-23 11:00:34,062 WARN L170 areAnnotationChecker]: L1606 has no Hoare annotation [2018-11-23 11:00:34,062 WARN L170 areAnnotationChecker]: L1606 has no Hoare annotation [2018-11-23 11:00:34,062 WARN L170 areAnnotationChecker]: L1604-2 has no Hoare annotation [2018-11-23 11:00:34,062 WARN L170 areAnnotationChecker]: L1604-2 has no Hoare annotation [2018-11-23 11:00:34,063 WARN L170 areAnnotationChecker]: L1342-2 has no Hoare annotation [2018-11-23 11:00:34,063 WARN L170 areAnnotationChecker]: L1342-2 has no Hoare annotation [2018-11-23 11:00:34,063 WARN L170 areAnnotationChecker]: L1359 has no Hoare annotation [2018-11-23 11:00:34,063 WARN L170 areAnnotationChecker]: L1359 has no Hoare annotation [2018-11-23 11:00:34,063 WARN L170 areAnnotationChecker]: L1172 has no Hoare annotation [2018-11-23 11:00:34,063 WARN L170 areAnnotationChecker]: L1172 has no Hoare annotation [2018-11-23 11:00:34,063 WARN L170 areAnnotationChecker]: L1615 has no Hoare annotation [2018-11-23 11:00:34,063 WARN L170 areAnnotationChecker]: L1615 has no Hoare annotation [2018-11-23 11:00:34,063 WARN L170 areAnnotationChecker]: L1359-2 has no Hoare annotation [2018-11-23 11:00:34,064 WARN L170 areAnnotationChecker]: L1359-2 has no Hoare annotation [2018-11-23 11:00:34,064 WARN L170 areAnnotationChecker]: L1176 has no Hoare annotation [2018-11-23 11:00:34,064 WARN L170 areAnnotationChecker]: L1175 has no Hoare annotation [2018-11-23 11:00:34,064 WARN L170 areAnnotationChecker]: L1175 has no Hoare annotation [2018-11-23 11:00:34,064 WARN L170 areAnnotationChecker]: L1371 has no Hoare annotation [2018-11-23 11:00:34,064 WARN L170 areAnnotationChecker]: L1371 has no Hoare annotation [2018-11-23 11:00:34,064 WARN L170 areAnnotationChecker]: L1381 has no Hoare annotation [2018-11-23 11:00:34,064 WARN L170 areAnnotationChecker]: L1381 has no Hoare annotation [2018-11-23 11:00:34,064 WARN L170 areAnnotationChecker]: L1178 has no Hoare annotation [2018-11-23 11:00:34,065 WARN L170 areAnnotationChecker]: L1178 has no Hoare annotation [2018-11-23 11:00:34,065 WARN L170 areAnnotationChecker]: L1382 has no Hoare annotation [2018-11-23 11:00:34,065 WARN L170 areAnnotationChecker]: L1382 has no Hoare annotation [2018-11-23 11:00:34,065 WARN L170 areAnnotationChecker]: L1386 has no Hoare annotation [2018-11-23 11:00:34,065 WARN L170 areAnnotationChecker]: L1386 has no Hoare annotation [2018-11-23 11:00:34,065 WARN L170 areAnnotationChecker]: L1182 has no Hoare annotation [2018-11-23 11:00:34,065 WARN L170 areAnnotationChecker]: L1181 has no Hoare annotation [2018-11-23 11:00:34,065 WARN L170 areAnnotationChecker]: L1181 has no Hoare annotation [2018-11-23 11:00:34,065 WARN L170 areAnnotationChecker]: L1397 has no Hoare annotation [2018-11-23 11:00:34,066 WARN L170 areAnnotationChecker]: L1397 has no Hoare annotation [2018-11-23 11:00:34,066 WARN L170 areAnnotationChecker]: L1184 has no Hoare annotation [2018-11-23 11:00:34,066 WARN L170 areAnnotationChecker]: L1184 has no Hoare annotation [2018-11-23 11:00:34,066 WARN L170 areAnnotationChecker]: L1402 has no Hoare annotation [2018-11-23 11:00:34,066 WARN L170 areAnnotationChecker]: L1402 has no Hoare annotation [2018-11-23 11:00:34,066 WARN L170 areAnnotationChecker]: L1194 has no Hoare annotation [2018-11-23 11:00:34,066 WARN L170 areAnnotationChecker]: L1187 has no Hoare annotation [2018-11-23 11:00:34,066 WARN L170 areAnnotationChecker]: L1187 has no Hoare annotation [2018-11-23 11:00:34,066 WARN L170 areAnnotationChecker]: L1402-2 has no Hoare annotation [2018-11-23 11:00:34,067 WARN L170 areAnnotationChecker]: L1414 has no Hoare annotation [2018-11-23 11:00:34,067 WARN L170 areAnnotationChecker]: L1414 has no Hoare annotation [2018-11-23 11:00:34,067 WARN L170 areAnnotationChecker]: L1190 has no Hoare annotation [2018-11-23 11:00:34,067 WARN L170 areAnnotationChecker]: L1190 has no Hoare annotation [2018-11-23 11:00:34,067 WARN L170 areAnnotationChecker]: L1193 has no Hoare annotation [2018-11-23 11:00:34,067 WARN L170 areAnnotationChecker]: L1193 has no Hoare annotation [2018-11-23 11:00:34,067 WARN L170 areAnnotationChecker]: L1196 has no Hoare annotation [2018-11-23 11:00:34,067 WARN L170 areAnnotationChecker]: L1196 has no Hoare annotation [2018-11-23 11:00:34,067 WARN L170 areAnnotationChecker]: L1200 has no Hoare annotation [2018-11-23 11:00:34,068 WARN L170 areAnnotationChecker]: L1199 has no Hoare annotation [2018-11-23 11:00:34,068 WARN L170 areAnnotationChecker]: L1199 has no Hoare annotation [2018-11-23 11:00:34,068 WARN L170 areAnnotationChecker]: L1425 has no Hoare annotation [2018-11-23 11:00:34,068 WARN L170 areAnnotationChecker]: L1425 has no Hoare annotation [2018-11-23 11:00:34,068 WARN L170 areAnnotationChecker]: L1202 has no Hoare annotation [2018-11-23 11:00:34,068 WARN L170 areAnnotationChecker]: L1202 has no Hoare annotation [2018-11-23 11:00:34,068 WARN L170 areAnnotationChecker]: L1431 has no Hoare annotation [2018-11-23 11:00:34,068 WARN L170 areAnnotationChecker]: L1431 has no Hoare annotation [2018-11-23 11:00:34,068 WARN L170 areAnnotationChecker]: L1206 has no Hoare annotation [2018-11-23 11:00:34,069 WARN L170 areAnnotationChecker]: L1205 has no Hoare annotation [2018-11-23 11:00:34,069 WARN L170 areAnnotationChecker]: L1205 has no Hoare annotation [2018-11-23 11:00:34,069 WARN L170 areAnnotationChecker]: L1431-2 has no Hoare annotation [2018-11-23 11:00:34,069 WARN L170 areAnnotationChecker]: L1442 has no Hoare annotation [2018-11-23 11:00:34,069 WARN L170 areAnnotationChecker]: L1442 has no Hoare annotation [2018-11-23 11:00:34,069 WARN L170 areAnnotationChecker]: L1208 has no Hoare annotation [2018-11-23 11:00:34,069 WARN L170 areAnnotationChecker]: L1208 has no Hoare annotation [2018-11-23 11:00:34,069 WARN L170 areAnnotationChecker]: L1212 has no Hoare annotation [2018-11-23 11:00:34,069 WARN L170 areAnnotationChecker]: L1211 has no Hoare annotation [2018-11-23 11:00:34,069 WARN L170 areAnnotationChecker]: L1211 has no Hoare annotation [2018-11-23 11:00:34,070 WARN L170 areAnnotationChecker]: L1454 has no Hoare annotation [2018-11-23 11:00:34,070 WARN L170 areAnnotationChecker]: L1454 has no Hoare annotation [2018-11-23 11:00:34,070 WARN L170 areAnnotationChecker]: L1214 has no Hoare annotation [2018-11-23 11:00:34,070 WARN L170 areAnnotationChecker]: L1214 has no Hoare annotation [2018-11-23 11:00:34,070 WARN L170 areAnnotationChecker]: L1462 has no Hoare annotation [2018-11-23 11:00:34,070 WARN L170 areAnnotationChecker]: L1462 has no Hoare annotation [2018-11-23 11:00:34,070 WARN L170 areAnnotationChecker]: L1218 has no Hoare annotation [2018-11-23 11:00:34,070 WARN L170 areAnnotationChecker]: L1217 has no Hoare annotation [2018-11-23 11:00:34,070 WARN L170 areAnnotationChecker]: L1217 has no Hoare annotation [2018-11-23 11:00:34,070 WARN L170 areAnnotationChecker]: L1462-2 has no Hoare annotation [2018-11-23 11:00:34,071 WARN L170 areAnnotationChecker]: L1462-2 has no Hoare annotation [2018-11-23 11:00:34,071 WARN L170 areAnnotationChecker]: L1483 has no Hoare annotation [2018-11-23 11:00:34,071 WARN L170 areAnnotationChecker]: L1483 has no Hoare annotation [2018-11-23 11:00:34,071 WARN L170 areAnnotationChecker]: L1220 has no Hoare annotation [2018-11-23 11:00:34,071 WARN L170 areAnnotationChecker]: L1220 has no Hoare annotation [2018-11-23 11:00:34,071 WARN L170 areAnnotationChecker]: L1473 has no Hoare annotation [2018-11-23 11:00:34,071 WARN L170 areAnnotationChecker]: L1473 has no Hoare annotation [2018-11-23 11:00:34,071 WARN L170 areAnnotationChecker]: L1490 has no Hoare annotation [2018-11-23 11:00:34,071 WARN L170 areAnnotationChecker]: L1490 has no Hoare annotation [2018-11-23 11:00:34,071 WARN L170 areAnnotationChecker]: L1224 has no Hoare annotation [2018-11-23 11:00:34,071 WARN L170 areAnnotationChecker]: L1223 has no Hoare annotation [2018-11-23 11:00:34,072 WARN L170 areAnnotationChecker]: L1223 has no Hoare annotation [2018-11-23 11:00:34,072 WARN L170 areAnnotationChecker]: L1492 has no Hoare annotation [2018-11-23 11:00:34,072 WARN L170 areAnnotationChecker]: L1492 has no Hoare annotation [2018-11-23 11:00:34,072 WARN L170 areAnnotationChecker]: L1490-1 has no Hoare annotation [2018-11-23 11:00:34,072 WARN L170 areAnnotationChecker]: L1507 has no Hoare annotation [2018-11-23 11:00:34,072 WARN L170 areAnnotationChecker]: L1507 has no Hoare annotation [2018-11-23 11:00:34,072 WARN L170 areAnnotationChecker]: L1226 has no Hoare annotation [2018-11-23 11:00:34,072 WARN L170 areAnnotationChecker]: L1226 has no Hoare annotation [2018-11-23 11:00:34,072 WARN L170 areAnnotationChecker]: L1512 has no Hoare annotation [2018-11-23 11:00:34,072 WARN L170 areAnnotationChecker]: L1512 has no Hoare annotation [2018-11-23 11:00:34,073 WARN L170 areAnnotationChecker]: L1227 has no Hoare annotation [2018-11-23 11:00:34,073 WARN L170 areAnnotationChecker]: L1227 has no Hoare annotation [2018-11-23 11:00:34,073 WARN L170 areAnnotationChecker]: L1229 has no Hoare annotation [2018-11-23 11:00:34,073 WARN L170 areAnnotationChecker]: L1229 has no Hoare annotation [2018-11-23 11:00:34,073 WARN L170 areAnnotationChecker]: L1512-2 has no Hoare annotation [2018-11-23 11:00:34,073 WARN L170 areAnnotationChecker]: L1523 has no Hoare annotation [2018-11-23 11:00:34,073 WARN L170 areAnnotationChecker]: L1523 has no Hoare annotation [2018-11-23 11:00:34,073 WARN L170 areAnnotationChecker]: L1520-1 has no Hoare annotation [2018-11-23 11:00:34,073 WARN L170 areAnnotationChecker]: L1230 has no Hoare annotation [2018-11-23 11:00:34,073 WARN L170 areAnnotationChecker]: L1233 has no Hoare annotation [2018-11-23 11:00:34,074 WARN L170 areAnnotationChecker]: L1536 has no Hoare annotation [2018-11-23 11:00:34,074 WARN L170 areAnnotationChecker]: L1536 has no Hoare annotation [2018-11-23 11:00:34,074 WARN L170 areAnnotationChecker]: L1536-2 has no Hoare annotation [2018-11-23 11:00:34,074 WARN L170 areAnnotationChecker]: L1541 has no Hoare annotation [2018-11-23 11:00:34,074 WARN L170 areAnnotationChecker]: L1541 has no Hoare annotation [2018-11-23 11:00:34,074 WARN L170 areAnnotationChecker]: L1541-2 has no Hoare annotation [2018-11-23 11:00:34,074 WARN L170 areAnnotationChecker]: L1548 has no Hoare annotation [2018-11-23 11:00:34,074 WARN L170 areAnnotationChecker]: L1548 has no Hoare annotation [2018-11-23 11:00:34,074 WARN L170 areAnnotationChecker]: L1548-2 has no Hoare annotation [2018-11-23 11:00:34,075 WARN L170 areAnnotationChecker]: L1556 has no Hoare annotation [2018-11-23 11:00:34,075 WARN L170 areAnnotationChecker]: L1556 has no Hoare annotation [2018-11-23 11:00:34,075 INFO L163 areAnnotationChecker]: CFG has 0 edges. 0 inductive. 0 not inductive. 0 times theorem prover too weak to decide inductivity. 0 times interpolants missing. [2018-11-23 11:00:34,078 INFO L202 PluginConnector]: Adding new model de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction CFG 23.11 11:00:34 BoogieIcfgContainer [2018-11-23 11:00:34,078 INFO L132 PluginConnector]: ------------------------ END TraceAbstraction---------------------------- [2018-11-23 11:00:34,078 INFO L113 PluginConnector]: ------------------------Witness Printer---------------------------- [2018-11-23 11:00:34,078 INFO L271 PluginConnector]: Initializing Witness Printer... [2018-11-23 11:00:34,079 INFO L276 PluginConnector]: Witness Printer initialized [2018-11-23 11:00:34,079 INFO L185 PluginConnector]: Executing the observer RCFGCatcher from plugin Witness Printer for "de.uni_freiburg.informatik.ultimate.plugins.generator.rcfgbuilder CFG 23.11 10:57:24" (3/4) ... [2018-11-23 11:00:34,082 INFO L138 WitnessPrinter]: Generating witness for reachability counterexample ----- class de.uni_freiburg.informatik.ultimate.plugins.generator.rcfgbuilder.RCFGBacktranslator [?] CALL call ULTIMATE.init(); VAL [|#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |old(#NULL.base)|=(_ bv0 32), |old(#NULL.offset)|=(_ bv0 32), |old(~#SSLv3_client_data~0.base)|=(_ bv0 32), |old(~#SSLv3_client_data~0.offset)|=(_ bv0 32), |old(~init~0)|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv0 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv0 32)] [?] #NULL.base, #NULL.offset := 0bv32, 0bv32;#valid := #valid[0bv32 := 0bv1];~init~0 := 1bv32;call ~#SSLv3_client_data~0.base, ~#SSLv3_client_data~0.offset := #Ultimate.alloc(100bv32);call write~init~intINTTYPE4(0bv32, ~#SSLv3_client_data~0.base, ~#SSLv3_client_data~0.offset, 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(4bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(8bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(12bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(16bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(20bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(24bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(28bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(32bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(36bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(40bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(44bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(48bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(52bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(56bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(60bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(64bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(68bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(72bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(76bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(80bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(84bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(88bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(92bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(96bv32, ~#SSLv3_client_data~0.offset), 4bv32); VAL [|#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |old(#NULL.base)|=(_ bv0 32), |old(#NULL.offset)|=(_ bv0 32), |old(~#SSLv3_client_data~0.base)|=(_ bv0 32), |old(~#SSLv3_client_data~0.offset)|=(_ bv0 32), |old(~init~0)|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume true; VAL [|#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |old(#NULL.base)|=(_ bv0 32), |old(#NULL.offset)|=(_ bv0 32), |old(~#SSLv3_client_data~0.base)|=(_ bv0 32), |old(~#SSLv3_client_data~0.offset)|=(_ bv0 32), |old(~init~0)|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] RET #544#return; VAL [|#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] CALL call #t~ret138 := main(); VAL [|#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] call #t~malloc3.base, #t~malloc3.offset := #Ultimate.alloc(248bv32);~s~0.base, ~s~0.offset := #t~malloc3.base, #t~malloc3.offset;call #t~malloc4.base, #t~malloc4.offset := #Ultimate.alloc(899bv32);call write~$Pointer$(#t~malloc4.base, #t~malloc4.offset, ~s~0.base, ~bvadd32(84bv32, ~s~0.offset), 4bv32);call #t~malloc5.base, #t~malloc5.offset := #Ultimate.alloc(232bv32);call write~$Pointer$(#t~malloc5.base, #t~malloc5.offset, ~s~0.base, ~bvadd32(204bv32, ~s~0.offset), 4bv32);call #t~malloc6.base, #t~malloc6.offset := #Ultimate.alloc(200bv32);call write~$Pointer$(#t~malloc6.base, #t~malloc6.offset, ~s~0.base, ~bvadd32(176bv32, ~s~0.offset), 4bv32);call write~intINTTYPE4(12292bv32, ~s~0.base, ~bvadd32(52bv32, ~s~0.offset), 4bv32);call write~intINTTYPE4(#t~nondet7, ~s~0.base, ~s~0.offset, 4bv32);havoc #t~nondet7; VAL [main_~s~0.base=(_ bv33554433 32), main_~s~0.offset=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |main_#t~malloc3.base|=(_ bv33554433 32), |main_#t~malloc3.offset|=(_ bv0 32), |main_#t~malloc4.base|=(_ bv2147483650 32), |main_#t~malloc4.offset|=(_ bv0 32), |main_#t~malloc5.base|=(_ bv3 32), |main_#t~malloc5.offset|=(_ bv0 32), |main_#t~malloc6.base|=(_ bv2 32), |main_#t~malloc6.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] CALL call #t~ret8 := ssl3_connect(~s~0.base, ~s~0.offset); VAL [|#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] ~s.base, ~s.offset := #in~s.base, #in~s.offset;havoc ~buf~0.base, ~buf~0.offset;havoc ~tmp~2;havoc ~l~0;havoc ~num1~0;havoc ~cb~0.base, ~cb~0.offset;havoc ~ret~0;havoc ~new_state~0;havoc ~state~0;havoc ~skip~0;~tmp___0~1.base, ~tmp___0~1.offset := #t~nondet9.base, #t~nondet9.offset;havoc #t~nondet9.base, #t~nondet9.offset;~tmp___1~0 := #t~nondet10;havoc #t~nondet10;~tmp___2~0 := #t~nondet11;havoc #t~nondet11;~tmp___3~0 := #t~nondet12;havoc #t~nondet12;~tmp___4~0 := #t~nondet13;havoc #t~nondet13;~tmp___5~0 := #t~nondet14;havoc #t~nondet14;~tmp___6~0 := #t~nondet15;havoc #t~nondet15;~tmp___7~0 := #t~nondet16;havoc #t~nondet16;~tmp___8~0 := #t~nondet17;havoc #t~nondet17;~tmp___9~0 := #t~nondet18;havoc #t~nondet18;havoc ~blastFlag~0;~blastFlag~0 := 0bv32;call write~intINTTYPE4(#t~nondet19, ~s.base, ~bvadd32(92bv32, ~s.offset), 4bv32);havoc #t~nondet19;call write~intINTTYPE4(12292bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32);~tmp~2 := #t~nondet20;havoc #t~nondet20;~cb~0.base, ~cb~0.offset := 0bv32, 0bv32;~ret~0 := 4294967295bv32;~skip~0 := 0bv32;call write~intINTTYPE4(0bv32, ~tmp___0~1.base, ~tmp___0~1.offset, 4bv32);call #t~mem21.base, #t~mem21.offset := read~$Pointer$(~s.base, ~bvadd32(192bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv0 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem21.base|=(_ bv0 32), |ssl3_connect_#t~mem21.offset|=(_ bv1 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume 0bv32 != ~bvadd32(#t~mem21.base, #t~mem21.offset);havoc #t~mem21.base, #t~mem21.offset;call #t~mem22.base, #t~mem22.offset := read~$Pointer$(~s.base, ~bvadd32(192bv32, ~s.offset), 4bv32);~cb~0.base, ~cb~0.offset := #t~mem22.base, #t~mem22.offset;havoc #t~mem22.base, #t~mem22.offset; VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] call #t~mem27 := read~intINTTYPE4(~s.base, ~bvadd32(28bv32, ~s.offset), 4bv32);call write~intINTTYPE4(~bvadd32(1bv32, #t~mem27), ~s.base, ~bvadd32(28bv32, ~s.offset), 4bv32);havoc #t~mem27; VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(0bv32 != ~bvand32(12288bv32, ~tmp___1~0)); VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !false; VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] call #t~mem28 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32);~state~0 := #t~mem28;havoc #t~mem28;call #t~mem29 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv12292 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem29|=(_ bv12292 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume 12292bv32 == #t~mem29;havoc #t~mem29; VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv12292 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] call write~intINTTYPE4(1bv32, ~s.base, ~bvadd32(40bv32, ~s.offset), 4bv32);call write~intINTTYPE4(4096bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32);call #t~mem62.base, #t~mem62.offset := read~$Pointer$(~s.base, ~bvadd32(204bv32, ~s.offset), 4bv32);call #t~mem63 := read~intINTTYPE4(#t~mem62.base, ~bvadd32(64bv32, #t~mem62.offset), 4bv32);call write~intINTTYPE4(~bvadd32(1bv32, #t~mem63), #t~mem62.base, ~bvadd32(64bv32, #t~mem62.offset), 4bv32);havoc #t~mem62.base, #t~mem62.offset;havoc #t~mem63; VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv12292 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(36bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv12292 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume 0bv32 != ~bvadd32(~cb~0.base, ~cb~0.offset); VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv12292 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] call #t~mem64 := read~intINTTYPE4(~s.base, ~s.offset, 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv12292 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem64|=(_ bv768 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(768bv32 != ~bvand32(65280bv32, #t~mem64));havoc #t~mem64;call write~intINTTYPE4(4096bv32, ~s.base, ~bvadd32(4bv32, ~s.offset), 4bv32);call #t~mem65.base, #t~mem65.offset := read~$Pointer$(~s.base, ~bvadd32(60bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv12292 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem65.base|=(_ bv0 32), |ssl3_connect_#t~mem65.offset|=(_ bv1 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(0bv32 == ~bvadd32(#t~mem65.base, #t~mem65.offset));havoc #t~mem65.base, #t~mem65.offset; VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv12292 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(0bv32 == ~tmp___4~0); VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv12292 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(0bv32 == ~tmp___5~0);call write~intINTTYPE4(4368bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32);call #t~mem67.base, #t~mem67.offset := read~$Pointer$(~s.base, ~bvadd32(204bv32, ~s.offset), 4bv32);call #t~mem68 := read~intINTTYPE4(#t~mem67.base, ~bvadd32(60bv32, #t~mem67.offset), 4bv32);call write~intINTTYPE4(~bvadd32(1bv32, #t~mem68), #t~mem67.base, ~bvadd32(60bv32, #t~mem67.offset), 4bv32);havoc #t~mem68;havoc #t~mem67.base, #t~mem67.offset;call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(64bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv12292 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] call #t~mem127.base, #t~mem127.offset := read~$Pointer$(~s.base, ~bvadd32(84bv32, ~s.offset), 4bv32);call #t~mem128 := read~intINTTYPE4(#t~mem127.base, ~bvadd32(848bv32, #t~mem127.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv12292 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem127.base|=(_ bv33554433 32), |ssl3_connect_#t~mem127.offset|=(_ bv4294966500 32), |ssl3_connect_#t~mem128|=(_ bv4368 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(0bv32 == #t~mem128);havoc #t~mem127.base, #t~mem127.offset;havoc #t~mem128; VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv12292 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] ~skip~0 := 0bv32; VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv12292 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !false; VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv12292 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] call #t~mem28 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32);~state~0 := #t~mem28;havoc #t~mem28;call #t~mem29 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4368 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem29|=(_ bv4368 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(12292bv32 == #t~mem29);havoc #t~mem29;call #t~mem30 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4368 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem30|=(_ bv4368 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(16384bv32 == #t~mem30);havoc #t~mem30;call #t~mem31 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4368 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem31|=(_ bv4368 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4096bv32 == #t~mem31);havoc #t~mem31;call #t~mem32 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4368 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem32|=(_ bv4368 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(20480bv32 == #t~mem32);havoc #t~mem32;call #t~mem33 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4368 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem33|=(_ bv4368 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4099bv32 == #t~mem33);havoc #t~mem33;call #t~mem34 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4368 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem34|=(_ bv4368 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume 4368bv32 == #t~mem34;havoc #t~mem34; VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4368 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(48bv32, ~s.offset), 4bv32);~ret~0 := #t~nondet69;havoc #t~nondet69; VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4368 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume 0bv32 == ~blastFlag~0;~blastFlag~0 := 1bv32; VAL [ssl3_connect_~blastFlag~0=(_ bv1 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4368 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !~bvsle32(~ret~0, 0bv32);call write~intINTTYPE4(4384bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32);call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(64bv32, ~s.offset), 4bv32);call #t~mem70.base, #t~mem70.offset := read~$Pointer$(~s.base, ~bvadd32(20bv32, ~s.offset), 4bv32);call #t~mem71.base, #t~mem71.offset := read~$Pointer$(~s.base, ~bvadd32(16bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv1 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4368 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem70.base|=(_ bv1 32), |ssl3_connect_#t~mem70.offset|=(_ bv0 32), |ssl3_connect_#t~mem71.base|=(_ bv0 32), |ssl3_connect_#t~mem71.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume ~bvadd32(#t~mem70.base, #t~mem70.offset) != ~bvadd32(#t~mem71.base, #t~mem71.offset);havoc #t~mem71.base, #t~mem71.offset;havoc #t~mem70.base, #t~mem70.offset; VAL [ssl3_connect_~blastFlag~0=(_ bv1 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4368 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] call #t~mem127.base, #t~mem127.offset := read~$Pointer$(~s.base, ~bvadd32(84bv32, ~s.offset), 4bv32);call #t~mem128 := read~intINTTYPE4(#t~mem127.base, ~bvadd32(848bv32, #t~mem127.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv1 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4368 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem127.base|=(_ bv33554433 32), |ssl3_connect_#t~mem127.offset|=(_ bv4294966500 32), |ssl3_connect_#t~mem128|=(_ bv4384 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(0bv32 == #t~mem128);havoc #t~mem127.base, #t~mem127.offset;havoc #t~mem128; VAL [ssl3_connect_~blastFlag~0=(_ bv1 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4368 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] ~skip~0 := 0bv32; VAL [ssl3_connect_~blastFlag~0=(_ bv1 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4368 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !false; VAL [ssl3_connect_~blastFlag~0=(_ bv1 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4368 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] call #t~mem28 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32);~state~0 := #t~mem28;havoc #t~mem28;call #t~mem29 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv1 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4384 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem29|=(_ bv4384 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(12292bv32 == #t~mem29);havoc #t~mem29;call #t~mem30 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv1 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4384 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem30|=(_ bv4384 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(16384bv32 == #t~mem30);havoc #t~mem30;call #t~mem31 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv1 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4384 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem31|=(_ bv4384 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4096bv32 == #t~mem31);havoc #t~mem31;call #t~mem32 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv1 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4384 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem32|=(_ bv4384 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(20480bv32 == #t~mem32);havoc #t~mem32;call #t~mem33 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv1 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4384 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem33|=(_ bv4384 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4099bv32 == #t~mem33);havoc #t~mem33;call #t~mem34 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv1 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4384 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem34|=(_ bv4384 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4368bv32 == #t~mem34);havoc #t~mem34;call #t~mem35 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv1 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4384 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem35|=(_ bv4384 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4369bv32 == #t~mem35);havoc #t~mem35;call #t~mem36 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv1 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4384 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem36|=(_ bv4384 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume 4384bv32 == #t~mem36;havoc #t~mem36; VAL [ssl3_connect_~blastFlag~0=(_ bv1 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4384 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] ~ret~0 := #t~nondet72;havoc #t~nondet72; VAL [ssl3_connect_~blastFlag~0=(_ bv1 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4384 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume 1bv32 == ~blastFlag~0;~blastFlag~0 := 2bv32; VAL [ssl3_connect_~blastFlag~0=(_ bv2 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4384 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !~bvsle32(~ret~0, 0bv32);call #t~mem73 := read~intINTTYPE4(~s.base, ~bvadd32(92bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv2 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4384 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem73|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(0bv32 != #t~mem73);havoc #t~mem73;call write~intINTTYPE4(4400bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv2 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4384 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(64bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv2 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4384 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] call #t~mem127.base, #t~mem127.offset := read~$Pointer$(~s.base, ~bvadd32(84bv32, ~s.offset), 4bv32);call #t~mem128 := read~intINTTYPE4(#t~mem127.base, ~bvadd32(848bv32, #t~mem127.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv2 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4384 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem127.base|=(_ bv33554433 32), |ssl3_connect_#t~mem127.offset|=(_ bv4294966500 32), |ssl3_connect_#t~mem128|=(_ bv4400 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(0bv32 == #t~mem128);havoc #t~mem127.base, #t~mem127.offset;havoc #t~mem128; VAL [ssl3_connect_~blastFlag~0=(_ bv2 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4384 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] ~skip~0 := 0bv32; VAL [ssl3_connect_~blastFlag~0=(_ bv2 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4384 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !false; VAL [ssl3_connect_~blastFlag~0=(_ bv2 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4384 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] call #t~mem28 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32);~state~0 := #t~mem28;havoc #t~mem28;call #t~mem29 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv2 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4400 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem29|=(_ bv4400 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(12292bv32 == #t~mem29);havoc #t~mem29;call #t~mem30 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv2 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4400 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem30|=(_ bv4400 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(16384bv32 == #t~mem30);havoc #t~mem30;call #t~mem31 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv2 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4400 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem31|=(_ bv4400 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4096bv32 == #t~mem31);havoc #t~mem31;call #t~mem32 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv2 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4400 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem32|=(_ bv4400 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(20480bv32 == #t~mem32);havoc #t~mem32;call #t~mem33 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv2 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4400 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem33|=(_ bv4400 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4099bv32 == #t~mem33);havoc #t~mem33;call #t~mem34 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv2 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4400 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem34|=(_ bv4400 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4368bv32 == #t~mem34);havoc #t~mem34;call #t~mem35 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv2 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4400 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem35|=(_ bv4400 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4369bv32 == #t~mem35);havoc #t~mem35;call #t~mem36 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv2 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4400 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem36|=(_ bv4400 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4384bv32 == #t~mem36);havoc #t~mem36;call #t~mem37 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv2 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4400 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem37|=(_ bv4400 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4385bv32 == #t~mem37);havoc #t~mem37;call #t~mem38 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv2 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4400 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem38|=(_ bv4400 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume 4400bv32 == #t~mem38;havoc #t~mem38; VAL [ssl3_connect_~blastFlag~0=(_ bv2 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4400 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] call #t~mem74.base, #t~mem74.offset := read~$Pointer$(~s.base, ~bvadd32(84bv32, ~s.offset), 4bv32);call #t~mem75.base, #t~mem75.offset := read~$Pointer$(#t~mem74.base, ~bvadd32(836bv32, #t~mem74.offset), 4bv32);call #t~mem76 := read~intINTTYPE4(#t~mem75.base, ~bvadd32(12bv32, #t~mem75.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv2 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4400 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem74.base|=(_ bv33554433 32), |ssl3_connect_#t~mem74.offset|=(_ bv4294966500 32), |ssl3_connect_#t~mem75.base|=(_ bv33554433 32), |ssl3_connect_#t~mem75.offset|=(_ bv52 32), |ssl3_connect_#t~mem76|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(0bv32 != ~bvand32(256bv32, #t~mem76));havoc #t~mem76;havoc #t~mem75.base, #t~mem75.offset;havoc #t~mem74.base, #t~mem74.offset;~ret~0 := #t~nondet77;havoc #t~nondet77; VAL [ssl3_connect_~blastFlag~0=(_ bv2 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4400 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume 2bv32 == ~blastFlag~0;~blastFlag~0 := 3bv32; VAL [ssl3_connect_~blastFlag~0=(_ bv3 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4400 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !~bvsle32(~ret~0, 0bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv3 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4400 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] call write~intINTTYPE4(4416bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32);call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(64bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv3 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4400 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] call #t~mem127.base, #t~mem127.offset := read~$Pointer$(~s.base, ~bvadd32(84bv32, ~s.offset), 4bv32);call #t~mem128 := read~intINTTYPE4(#t~mem127.base, ~bvadd32(848bv32, #t~mem127.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv3 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4400 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem127.base|=(_ bv33554433 32), |ssl3_connect_#t~mem127.offset|=(_ bv4294966500 32), |ssl3_connect_#t~mem128|=(_ bv4416 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(0bv32 == #t~mem128);havoc #t~mem127.base, #t~mem127.offset;havoc #t~mem128; VAL [ssl3_connect_~blastFlag~0=(_ bv3 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4400 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] ~skip~0 := 0bv32; VAL [ssl3_connect_~blastFlag~0=(_ bv3 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4400 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !false; VAL [ssl3_connect_~blastFlag~0=(_ bv3 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4400 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] call #t~mem28 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32);~state~0 := #t~mem28;havoc #t~mem28;call #t~mem29 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv3 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4416 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem29|=(_ bv4416 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(12292bv32 == #t~mem29);havoc #t~mem29;call #t~mem30 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv3 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4416 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem30|=(_ bv4416 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(16384bv32 == #t~mem30);havoc #t~mem30;call #t~mem31 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv3 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4416 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem31|=(_ bv4416 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4096bv32 == #t~mem31);havoc #t~mem31;call #t~mem32 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv3 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4416 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem32|=(_ bv4416 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(20480bv32 == #t~mem32);havoc #t~mem32;call #t~mem33 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv3 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4416 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem33|=(_ bv4416 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4099bv32 == #t~mem33);havoc #t~mem33;call #t~mem34 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv3 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4416 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem34|=(_ bv4416 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4368bv32 == #t~mem34);havoc #t~mem34;call #t~mem35 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv3 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4416 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem35|=(_ bv4416 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4369bv32 == #t~mem35);havoc #t~mem35;call #t~mem36 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv3 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4416 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem36|=(_ bv4416 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4384bv32 == #t~mem36);havoc #t~mem36;call #t~mem37 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv3 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4416 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem37|=(_ bv4416 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4385bv32 == #t~mem37);havoc #t~mem37;call #t~mem38 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv3 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4416 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem38|=(_ bv4416 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4400bv32 == #t~mem38);havoc #t~mem38;call #t~mem39 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv3 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4416 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem39|=(_ bv4416 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4401bv32 == #t~mem39);havoc #t~mem39;call #t~mem40 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv3 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4416 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem40|=(_ bv4416 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume 4416bv32 == #t~mem40;havoc #t~mem40; VAL [ssl3_connect_~blastFlag~0=(_ bv3 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4416 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] ~ret~0 := #t~nondet78;havoc #t~nondet78; VAL [ssl3_connect_~blastFlag~0=(_ bv3 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4416 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume 3bv32 == ~blastFlag~0;~blastFlag~0 := 4bv32; VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4416 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !~bvsle32(~ret~0, 0bv32);call write~intINTTYPE4(4432bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32);call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(64bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4416 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(0bv32 == ~tmp___6~0); VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4416 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] call #t~mem127.base, #t~mem127.offset := read~$Pointer$(~s.base, ~bvadd32(84bv32, ~s.offset), 4bv32);call #t~mem128 := read~intINTTYPE4(#t~mem127.base, ~bvadd32(848bv32, #t~mem127.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4416 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem127.base|=(_ bv33554433 32), |ssl3_connect_#t~mem127.offset|=(_ bv4294966500 32), |ssl3_connect_#t~mem128|=(_ bv4432 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(0bv32 == #t~mem128);havoc #t~mem127.base, #t~mem127.offset;havoc #t~mem128; VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4416 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] ~skip~0 := 0bv32; VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4416 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !false; VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4416 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] call #t~mem28 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32);~state~0 := #t~mem28;havoc #t~mem28;call #t~mem29 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4432 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem29|=(_ bv4432 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(12292bv32 == #t~mem29);havoc #t~mem29;call #t~mem30 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4432 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem30|=(_ bv4432 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(16384bv32 == #t~mem30);havoc #t~mem30;call #t~mem31 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4432 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem31|=(_ bv4432 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4096bv32 == #t~mem31);havoc #t~mem31;call #t~mem32 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4432 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem32|=(_ bv4432 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(20480bv32 == #t~mem32);havoc #t~mem32;call #t~mem33 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4432 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem33|=(_ bv4432 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4099bv32 == #t~mem33);havoc #t~mem33;call #t~mem34 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4432 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem34|=(_ bv4432 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4368bv32 == #t~mem34);havoc #t~mem34;call #t~mem35 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4432 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem35|=(_ bv4432 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4369bv32 == #t~mem35);havoc #t~mem35;call #t~mem36 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4432 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem36|=(_ bv4432 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4384bv32 == #t~mem36);havoc #t~mem36;call #t~mem37 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4432 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem37|=(_ bv4432 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4385bv32 == #t~mem37);havoc #t~mem37;call #t~mem38 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4432 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem38|=(_ bv4432 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4400bv32 == #t~mem38);havoc #t~mem38;call #t~mem39 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4432 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem39|=(_ bv4432 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4401bv32 == #t~mem39);havoc #t~mem39;call #t~mem40 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4432 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem40|=(_ bv4432 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4416bv32 == #t~mem40);havoc #t~mem40;call #t~mem41 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4432 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem41|=(_ bv4432 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4417bv32 == #t~mem41);havoc #t~mem41;call #t~mem42 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4432 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem42|=(_ bv4432 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume 4432bv32 == #t~mem42;havoc #t~mem42; VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4432 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] ~ret~0 := #t~nondet79;havoc #t~nondet79; VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv0 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4432 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume 4bv32 == ~blastFlag~0; VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv0 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4432 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !false; VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv1 32), ssl3_connect_~ret~0=(_ bv0 32), ssl3_connect_~s.base=(_ bv33554433 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4432 32), ssl3_connect_~tmp___0~1.base=(_ bv33554433 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___3~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp___7~0=(_ bv0 32), ssl3_connect_~tmp___8~0=(_ bv0 32), ssl3_connect_~tmp___9~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv33554433 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv33554434 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] CALL call ULTIMATE.init(); VAL [#NULL.base=0bv32, #NULL.offset=0bv32, old(#NULL.base)=0bv32, old(#NULL.offset)=0bv32, old(~#SSLv3_client_data~0.base)=0bv32, old(~#SSLv3_client_data~0.offset)=0bv32, old(~init~0)=0bv32, ~#SSLv3_client_data~0.base=0bv32, ~#SSLv3_client_data~0.offset=0bv32, ~init~0=0bv32] [?] #NULL.base, #NULL.offset := 0bv32, 0bv32; [?] #valid := #valid[0bv32 := 0bv1]; [L1042] ~init~0 := 1bv32; [L1043] call ~#SSLv3_client_data~0.base, ~#SSLv3_client_data~0.offset := #Ultimate.alloc(100bv32); [L1043] call write~init~intINTTYPE4(0bv32, ~#SSLv3_client_data~0.base, ~#SSLv3_client_data~0.offset, 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(4bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(8bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(12bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(16bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(20bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(24bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(28bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(32bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(36bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(40bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(44bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(48bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(52bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(56bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(60bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(64bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(68bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(72bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(76bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(80bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(84bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(88bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(92bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(96bv32, ~#SSLv3_client_data~0.offset), 4bv32); VAL [#NULL.base=0bv32, #NULL.offset=0bv32, old(#NULL.base)=0bv32, old(#NULL.offset)=0bv32, old(~#SSLv3_client_data~0.base)=0bv32, old(~#SSLv3_client_data~0.offset)=0bv32, old(~init~0)=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~init~0=1bv32] [?] ensures true; VAL [#NULL.base=0bv32, #NULL.offset=0bv32, old(#NULL.base)=0bv32, old(#NULL.offset)=0bv32, old(~#SSLv3_client_data~0.base)=0bv32, old(~#SSLv3_client_data~0.offset)=0bv32, old(~init~0)=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~init~0=1bv32] [?] RET call ULTIMATE.init(); VAL [#NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~init~0=1bv32] [?] CALL call #t~ret138 := main(); VAL [#NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~init~0=1bv32] [L1065] call #t~malloc3.base, #t~malloc3.offset := #Ultimate.alloc(248bv32); [L1065] ~s~0.base, ~s~0.offset := #t~malloc3.base, #t~malloc3.offset; [L1069] call #t~malloc4.base, #t~malloc4.offset := #Ultimate.alloc(899bv32); [L1069] call write~$Pointer$(#t~malloc4.base, #t~malloc4.offset, ~s~0.base, ~bvadd32(84bv32, ~s~0.offset), 4bv32); [L1070] call #t~malloc5.base, #t~malloc5.offset := #Ultimate.alloc(232bv32); [L1070] call write~$Pointer$(#t~malloc5.base, #t~malloc5.offset, ~s~0.base, ~bvadd32(204bv32, ~s~0.offset), 4bv32); [L1071] call #t~malloc6.base, #t~malloc6.offset := #Ultimate.alloc(200bv32); [L1071] call write~$Pointer$(#t~malloc6.base, #t~malloc6.offset, ~s~0.base, ~bvadd32(176bv32, ~s~0.offset), 4bv32); [L1072] call write~intINTTYPE4(12292bv32, ~s~0.base, ~bvadd32(52bv32, ~s~0.offset), 4bv32); [L1073] call write~intINTTYPE4(#t~nondet7, ~s~0.base, ~s~0.offset, 4bv32); [L1073] havoc #t~nondet7; VAL [#NULL.base=0bv32, #NULL.offset=0bv32, #t~malloc3.base=33554433bv32, #t~malloc3.offset=0bv32, #t~malloc4.base=2147483650bv32, #t~malloc4.offset=0bv32, #t~malloc5.base=3bv32, #t~malloc5.offset=0bv32, #t~malloc6.base=2bv32, #t~malloc6.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~init~0=1bv32, ~s~0.base=33554433bv32, ~s~0.offset=0bv32] [L1074] CALL call #t~ret8 := ssl3_connect(~s~0.base, ~s~0.offset); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~init~0=1bv32] [L1079-L1645] ~s.base, ~s.offset := #in~s.base, #in~s.offset; [L1080] havoc ~buf~0.base, ~buf~0.offset; [L1081] havoc ~tmp~2; [L1082] havoc ~l~0; [L1083] havoc ~num1~0; [L1084] havoc ~cb~0.base, ~cb~0.offset; [L1085] havoc ~ret~0; [L1086] havoc ~new_state~0; [L1087] havoc ~state~0; [L1088] havoc ~skip~0; [L1089] ~tmp___0~1.base, ~tmp___0~1.offset := #t~nondet9.base, #t~nondet9.offset; [L1089] havoc #t~nondet9.base, #t~nondet9.offset; [L1090] ~tmp___1~0 := #t~nondet10; [L1090] havoc #t~nondet10; [L1091] ~tmp___2~0 := #t~nondet11; [L1091] havoc #t~nondet11; [L1092] ~tmp___3~0 := #t~nondet12; [L1092] havoc #t~nondet12; [L1093] ~tmp___4~0 := #t~nondet13; [L1093] havoc #t~nondet13; [L1094] ~tmp___5~0 := #t~nondet14; [L1094] havoc #t~nondet14; [L1095] ~tmp___6~0 := #t~nondet15; [L1095] havoc #t~nondet15; [L1096] ~tmp___7~0 := #t~nondet16; [L1096] havoc #t~nondet16; [L1097] ~tmp___8~0 := #t~nondet17; [L1097] havoc #t~nondet17; [L1098] ~tmp___9~0 := #t~nondet18; [L1098] havoc #t~nondet18; [L1099] havoc ~blastFlag~0; [L1102] ~blastFlag~0 := 0bv32; [L1103] call write~intINTTYPE4(#t~nondet19, ~s.base, ~bvadd32(92bv32, ~s.offset), 4bv32); [L1103] havoc #t~nondet19; [L1104] call write~intINTTYPE4(12292bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); [L1105] ~tmp~2 := #t~nondet20; [L1105] havoc #t~nondet20; [L1106] ~cb~0.base, ~cb~0.offset := 0bv32, 0bv32; [L1107] ~ret~0 := 4294967295bv32; [L1108] ~skip~0 := 0bv32; [L1109] call write~intINTTYPE4(0bv32, ~tmp___0~1.base, ~tmp___0~1.offset, 4bv32); [L1110] call #t~mem21.base, #t~mem21.offset := read~$Pointer$(~s.base, ~bvadd32(192bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem21.base=0bv32, #t~mem21.offset=1bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=0bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1110-L1118] assume 0bv32 != ~bvadd32(#t~mem21.base, #t~mem21.offset); [L1110] havoc #t~mem21.base, #t~mem21.offset; [L1111] call #t~mem22.base, #t~mem22.offset := read~$Pointer$(~s.base, ~bvadd32(192bv32, ~s.offset), 4bv32); [L1111] ~cb~0.base, ~cb~0.offset := #t~mem22.base, #t~mem22.offset; [L1111] havoc #t~mem22.base, #t~mem22.offset; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1119] call #t~mem27 := read~intINTTYPE4(~s.base, ~bvadd32(28bv32, ~s.offset), 4bv32); [L1119] call write~intINTTYPE4(~bvadd32(1bv32, #t~mem27), ~s.base, ~bvadd32(28bv32, ~s.offset), 4bv32); [L1119] havoc #t~mem27; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1120-L1128] assume !(0bv32 != ~bvand32(12288bv32, ~tmp___1~0)); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] assume !false; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] call #t~mem28 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] call #t~mem29 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem29=12292bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133-L1601] assume 12292bv32 == #t~mem29; [L1133] havoc #t~mem29; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1236] call write~intINTTYPE4(1bv32, ~s.base, ~bvadd32(40bv32, ~s.offset), 4bv32); [L1237] call write~intINTTYPE4(4096bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); [L1238] call #t~mem62.base, #t~mem62.offset := read~$Pointer$(~s.base, ~bvadd32(204bv32, ~s.offset), 4bv32); [L1238] call #t~mem63 := read~intINTTYPE4(#t~mem62.base, ~bvadd32(64bv32, #t~mem62.offset), 4bv32); [L1238] call write~intINTTYPE4(~bvadd32(1bv32, #t~mem63), #t~mem62.base, ~bvadd32(64bv32, #t~mem62.offset), 4bv32); [L1238] havoc #t~mem62.base, #t~mem62.offset; [L1238] havoc #t~mem63; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1243] call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(36bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1244-L1248] assume 0bv32 != ~bvadd32(~cb~0.base, ~cb~0.offset); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1249] call #t~mem64 := read~intINTTYPE4(~s.base, ~s.offset, 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem64=768bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1249-L1254] assume !(768bv32 != ~bvand32(65280bv32, #t~mem64)); [L1249] havoc #t~mem64; [L1255] call write~intINTTYPE4(4096bv32, ~s.base, ~bvadd32(4bv32, ~s.offset), 4bv32); [L1256] call #t~mem65.base, #t~mem65.offset := read~$Pointer$(~s.base, ~bvadd32(60bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem65.base=0bv32, #t~mem65.offset=1bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1256-L1273] assume !(0bv32 == ~bvadd32(#t~mem65.base, #t~mem65.offset)); [L1256] havoc #t~mem65.base, #t~mem65.offset; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1274-L1279] assume !(0bv32 == ~tmp___4~0); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1280-L1285] assume !(0bv32 == ~tmp___5~0); [L1286] call write~intINTTYPE4(4368bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); [L1287] call #t~mem67.base, #t~mem67.offset := read~$Pointer$(~s.base, ~bvadd32(204bv32, ~s.offset), 4bv32); [L1287] call #t~mem68 := read~intINTTYPE4(#t~mem67.base, ~bvadd32(60bv32, #t~mem67.offset), 4bv32); [L1287] call write~intINTTYPE4(~bvadd32(1bv32, #t~mem68), #t~mem67.base, ~bvadd32(60bv32, #t~mem67.offset), 4bv32); [L1287] havoc #t~mem68; [L1287] havoc #t~mem67.base, #t~mem67.offset; [L1288] call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(64bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] call #t~mem127.base, #t~mem127.offset := read~$Pointer$(~s.base, ~bvadd32(84bv32, ~s.offset), 4bv32); [L1602] call #t~mem128 := read~intINTTYPE4(#t~mem127.base, ~bvadd32(848bv32, #t~mem127.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem127.base=33554433bv32, #t~mem127.offset=4294966500bv32, #t~mem128=4368bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602-L1630] assume !(0bv32 == #t~mem128); [L1602] havoc #t~mem127.base, #t~mem127.offset; [L1602] havoc #t~mem128; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1631] ~skip~0 := 0bv32; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] assume !false; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] call #t~mem28 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] call #t~mem29 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem29=4368bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133-L1601] assume !(12292bv32 == #t~mem29); [L1133] havoc #t~mem29; [L1136] call #t~mem30 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem30=4368bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1136-L1600] assume !(16384bv32 == #t~mem30); [L1136] havoc #t~mem30; [L1139] call #t~mem31 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem31=4368bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1139-L1599] assume !(4096bv32 == #t~mem31); [L1139] havoc #t~mem31; [L1142] call #t~mem32 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem32=4368bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1142-L1598] assume !(20480bv32 == #t~mem32); [L1142] havoc #t~mem32; [L1145] call #t~mem33 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem33=4368bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1145-L1597] assume !(4099bv32 == #t~mem33); [L1145] havoc #t~mem33; [L1148] call #t~mem34 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem34=4368bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1148-L1596] assume 4368bv32 == #t~mem34; [L1148] havoc #t~mem34; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1292] call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(48bv32, ~s.offset), 4bv32); [L1293] ~ret~0 := #t~nondet69; [L1293] havoc #t~nondet69; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1294-L1298] assume 0bv32 == ~blastFlag~0; [L1295] ~blastFlag~0 := 1bv32; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1299-L1303] assume !~bvsle32(~ret~0, 0bv32); [L1304] call write~intINTTYPE4(4384bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); [L1305] call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(64bv32, ~s.offset), 4bv32); [L1306] call #t~mem70.base, #t~mem70.offset := read~$Pointer$(~s.base, ~bvadd32(20bv32, ~s.offset), 4bv32); [L1306] call #t~mem71.base, #t~mem71.offset := read~$Pointer$(~s.base, ~bvadd32(16bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem70.base=1bv32, #t~mem70.offset=0bv32, #t~mem71.base=0bv32, #t~mem71.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1306-L1310] assume ~bvadd32(#t~mem70.base, #t~mem70.offset) != ~bvadd32(#t~mem71.base, #t~mem71.offset); [L1306] havoc #t~mem71.base, #t~mem71.offset; [L1306] havoc #t~mem70.base, #t~mem70.offset; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] call #t~mem127.base, #t~mem127.offset := read~$Pointer$(~s.base, ~bvadd32(84bv32, ~s.offset), 4bv32); [L1602] call #t~mem128 := read~intINTTYPE4(#t~mem127.base, ~bvadd32(848bv32, #t~mem127.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem127.base=33554433bv32, #t~mem127.offset=4294966500bv32, #t~mem128=4384bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602-L1630] assume !(0bv32 == #t~mem128); [L1602] havoc #t~mem127.base, #t~mem127.offset; [L1602] havoc #t~mem128; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1631] ~skip~0 := 0bv32; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] assume !false; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] call #t~mem28 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] call #t~mem29 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem29=4384bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133-L1601] assume !(12292bv32 == #t~mem29); [L1133] havoc #t~mem29; [L1136] call #t~mem30 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem30=4384bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1136-L1600] assume !(16384bv32 == #t~mem30); [L1136] havoc #t~mem30; [L1139] call #t~mem31 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem31=4384bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1139-L1599] assume !(4096bv32 == #t~mem31); [L1139] havoc #t~mem31; [L1142] call #t~mem32 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem32=4384bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1142-L1598] assume !(20480bv32 == #t~mem32); [L1142] havoc #t~mem32; [L1145] call #t~mem33 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem33=4384bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1145-L1597] assume !(4099bv32 == #t~mem33); [L1145] havoc #t~mem33; [L1148] call #t~mem34 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem34=4384bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1148-L1596] assume !(4368bv32 == #t~mem34); [L1148] havoc #t~mem34; [L1151] call #t~mem35 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem35=4384bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1151-L1595] assume !(4369bv32 == #t~mem35); [L1151] havoc #t~mem35; [L1154] call #t~mem36 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem36=4384bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1154-L1594] assume 4384bv32 == #t~mem36; [L1154] havoc #t~mem36; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1314] ~ret~0 := #t~nondet72; [L1314] havoc #t~nondet72; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1315-L1323] assume 1bv32 == ~blastFlag~0; [L1316] ~blastFlag~0 := 2bv32; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1324-L1328] assume !~bvsle32(~ret~0, 0bv32); [L1329] call #t~mem73 := read~intINTTYPE4(~s.base, ~bvadd32(92bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem73=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1329-L1333] assume !(0bv32 != #t~mem73); [L1329] havoc #t~mem73; [L1332] call write~intINTTYPE4(4400bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1334] call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(64bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] call #t~mem127.base, #t~mem127.offset := read~$Pointer$(~s.base, ~bvadd32(84bv32, ~s.offset), 4bv32); [L1602] call #t~mem128 := read~intINTTYPE4(#t~mem127.base, ~bvadd32(848bv32, #t~mem127.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem127.base=33554433bv32, #t~mem127.offset=4294966500bv32, #t~mem128=4400bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602-L1630] assume !(0bv32 == #t~mem128); [L1602] havoc #t~mem127.base, #t~mem127.offset; [L1602] havoc #t~mem128; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1631] ~skip~0 := 0bv32; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] assume !false; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] call #t~mem28 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] call #t~mem29 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem29=4400bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133-L1601] assume !(12292bv32 == #t~mem29); [L1133] havoc #t~mem29; [L1136] call #t~mem30 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem30=4400bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1136-L1600] assume !(16384bv32 == #t~mem30); [L1136] havoc #t~mem30; [L1139] call #t~mem31 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem31=4400bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1139-L1599] assume !(4096bv32 == #t~mem31); [L1139] havoc #t~mem31; [L1142] call #t~mem32 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem32=4400bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1142-L1598] assume !(20480bv32 == #t~mem32); [L1142] havoc #t~mem32; [L1145] call #t~mem33 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem33=4400bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1145-L1597] assume !(4099bv32 == #t~mem33); [L1145] havoc #t~mem33; [L1148] call #t~mem34 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem34=4400bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1148-L1596] assume !(4368bv32 == #t~mem34); [L1148] havoc #t~mem34; [L1151] call #t~mem35 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem35=4400bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1151-L1595] assume !(4369bv32 == #t~mem35); [L1151] havoc #t~mem35; [L1154] call #t~mem36 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem36=4400bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1154-L1594] assume !(4384bv32 == #t~mem36); [L1154] havoc #t~mem36; [L1157] call #t~mem37 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem37=4400bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1157-L1593] assume !(4385bv32 == #t~mem37); [L1157] havoc #t~mem37; [L1160] call #t~mem38 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem38=4400bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1160-L1592] assume 4400bv32 == #t~mem38; [L1160] havoc #t~mem38; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1338] call #t~mem74.base, #t~mem74.offset := read~$Pointer$(~s.base, ~bvadd32(84bv32, ~s.offset), 4bv32); [L1338] call #t~mem75.base, #t~mem75.offset := read~$Pointer$(#t~mem74.base, ~bvadd32(836bv32, #t~mem74.offset), 4bv32); [L1338] call #t~mem76 := read~intINTTYPE4(#t~mem75.base, ~bvadd32(12bv32, #t~mem75.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem74.base=33554433bv32, #t~mem74.offset=4294966500bv32, #t~mem75.base=33554433bv32, #t~mem75.offset=52bv32, #t~mem76=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1338-L1352] assume !(0bv32 != ~bvand32(256bv32, #t~mem76)); [L1338] havoc #t~mem76; [L1338] havoc #t~mem75.base, #t~mem75.offset; [L1338] havoc #t~mem74.base, #t~mem74.offset; [L1341] ~ret~0 := #t~nondet77; [L1341] havoc #t~nondet77; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1342-L1346] assume 2bv32 == ~blastFlag~0; [L1343] ~blastFlag~0 := 3bv32; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1347-L1351] assume !~bvsle32(~ret~0, 0bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1353] call write~intINTTYPE4(4416bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); [L1354] call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(64bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] call #t~mem127.base, #t~mem127.offset := read~$Pointer$(~s.base, ~bvadd32(84bv32, ~s.offset), 4bv32); [L1602] call #t~mem128 := read~intINTTYPE4(#t~mem127.base, ~bvadd32(848bv32, #t~mem127.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem127.base=33554433bv32, #t~mem127.offset=4294966500bv32, #t~mem128=4416bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602-L1630] assume !(0bv32 == #t~mem128); [L1602] havoc #t~mem127.base, #t~mem127.offset; [L1602] havoc #t~mem128; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1631] ~skip~0 := 0bv32; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] assume !false; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] call #t~mem28 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] call #t~mem29 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem29=4416bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133-L1601] assume !(12292bv32 == #t~mem29); [L1133] havoc #t~mem29; [L1136] call #t~mem30 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem30=4416bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1136-L1600] assume !(16384bv32 == #t~mem30); [L1136] havoc #t~mem30; [L1139] call #t~mem31 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem31=4416bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1139-L1599] assume !(4096bv32 == #t~mem31); [L1139] havoc #t~mem31; [L1142] call #t~mem32 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem32=4416bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1142-L1598] assume !(20480bv32 == #t~mem32); [L1142] havoc #t~mem32; [L1145] call #t~mem33 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem33=4416bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1145-L1597] assume !(4099bv32 == #t~mem33); [L1145] havoc #t~mem33; [L1148] call #t~mem34 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem34=4416bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1148-L1596] assume !(4368bv32 == #t~mem34); [L1148] havoc #t~mem34; [L1151] call #t~mem35 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem35=4416bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1151-L1595] assume !(4369bv32 == #t~mem35); [L1151] havoc #t~mem35; [L1154] call #t~mem36 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem36=4416bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1154-L1594] assume !(4384bv32 == #t~mem36); [L1154] havoc #t~mem36; [L1157] call #t~mem37 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem37=4416bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1157-L1593] assume !(4385bv32 == #t~mem37); [L1157] havoc #t~mem37; [L1160] call #t~mem38 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem38=4416bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1160-L1592] assume !(4400bv32 == #t~mem38); [L1160] havoc #t~mem38; [L1163] call #t~mem39 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem39=4416bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1163-L1591] assume !(4401bv32 == #t~mem39); [L1163] havoc #t~mem39; [L1166] call #t~mem40 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem40=4416bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1166-L1590] assume 4416bv32 == #t~mem40; [L1166] havoc #t~mem40; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1358] ~ret~0 := #t~nondet78; [L1358] havoc #t~nondet78; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1359-L1363] assume 3bv32 == ~blastFlag~0; [L1360] ~blastFlag~0 := 4bv32; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1364-L1368] assume !~bvsle32(~ret~0, 0bv32); [L1369] call write~intINTTYPE4(4432bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); [L1370] call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(64bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1371-L1376] assume !(0bv32 == ~tmp___6~0); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] call #t~mem127.base, #t~mem127.offset := read~$Pointer$(~s.base, ~bvadd32(84bv32, ~s.offset), 4bv32); [L1602] call #t~mem128 := read~intINTTYPE4(#t~mem127.base, ~bvadd32(848bv32, #t~mem127.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem127.base=33554433bv32, #t~mem127.offset=4294966500bv32, #t~mem128=4432bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602-L1630] assume !(0bv32 == #t~mem128); [L1602] havoc #t~mem127.base, #t~mem127.offset; [L1602] havoc #t~mem128; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1631] ~skip~0 := 0bv32; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] assume !false; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] call #t~mem28 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] call #t~mem29 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem29=4432bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133-L1601] assume !(12292bv32 == #t~mem29); [L1133] havoc #t~mem29; [L1136] call #t~mem30 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem30=4432bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1136-L1600] assume !(16384bv32 == #t~mem30); [L1136] havoc #t~mem30; [L1139] call #t~mem31 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem31=4432bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1139-L1599] assume !(4096bv32 == #t~mem31); [L1139] havoc #t~mem31; [L1142] call #t~mem32 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem32=4432bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1142-L1598] assume !(20480bv32 == #t~mem32); [L1142] havoc #t~mem32; [L1145] call #t~mem33 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem33=4432bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1145-L1597] assume !(4099bv32 == #t~mem33); [L1145] havoc #t~mem33; [L1148] call #t~mem34 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem34=4432bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1148-L1596] assume !(4368bv32 == #t~mem34); [L1148] havoc #t~mem34; [L1151] call #t~mem35 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem35=4432bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1151-L1595] assume !(4369bv32 == #t~mem35); [L1151] havoc #t~mem35; [L1154] call #t~mem36 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem36=4432bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1154-L1594] assume !(4384bv32 == #t~mem36); [L1154] havoc #t~mem36; [L1157] call #t~mem37 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem37=4432bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1157-L1593] assume !(4385bv32 == #t~mem37); [L1157] havoc #t~mem37; [L1160] call #t~mem38 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem38=4432bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1160-L1592] assume !(4400bv32 == #t~mem38); [L1160] havoc #t~mem38; [L1163] call #t~mem39 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem39=4432bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1163-L1591] assume !(4401bv32 == #t~mem39); [L1163] havoc #t~mem39; [L1166] call #t~mem40 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem40=4432bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1166-L1590] assume !(4416bv32 == #t~mem40); [L1166] havoc #t~mem40; [L1169] call #t~mem41 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem41=4432bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1169-L1589] assume !(4417bv32 == #t~mem41); [L1169] havoc #t~mem41; [L1172] call #t~mem42 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem42=4432bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1172-L1588] assume 4432bv32 == #t~mem42; [L1172] havoc #t~mem42; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1380] ~ret~0 := #t~nondet79; [L1380] havoc #t~nondet79; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=0bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1381-L1385] assume 4bv32 == ~blastFlag~0; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=0bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1643] assert false; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=0bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] ----- ----- class de.uni_freiburg.informatik.ultimate.boogie.preprocessor.BoogiePreprocessorBacktranslator [?] CALL call ULTIMATE.init(); VAL [#NULL.base=0bv32, #NULL.offset=0bv32, old(#NULL.base)=0bv32, old(#NULL.offset)=0bv32, old(~#SSLv3_client_data~0.base)=0bv32, old(~#SSLv3_client_data~0.offset)=0bv32, old(~init~0)=0bv32, ~#SSLv3_client_data~0.base=0bv32, ~#SSLv3_client_data~0.offset=0bv32, ~init~0=0bv32] [?] #NULL.base, #NULL.offset := 0bv32, 0bv32; [?] #valid := #valid[0bv32 := 0bv1]; [L1042] ~init~0 := 1bv32; [L1043] call ~#SSLv3_client_data~0.base, ~#SSLv3_client_data~0.offset := #Ultimate.alloc(100bv32); [L1043] call write~init~intINTTYPE4(0bv32, ~#SSLv3_client_data~0.base, ~#SSLv3_client_data~0.offset, 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(4bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(8bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(12bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(16bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(20bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(24bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(28bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(32bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(36bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(40bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(44bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(48bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(52bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(56bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(60bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(64bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(68bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(72bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(76bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(80bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(84bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(88bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(92bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(96bv32, ~#SSLv3_client_data~0.offset), 4bv32); VAL [#NULL.base=0bv32, #NULL.offset=0bv32, old(#NULL.base)=0bv32, old(#NULL.offset)=0bv32, old(~#SSLv3_client_data~0.base)=0bv32, old(~#SSLv3_client_data~0.offset)=0bv32, old(~init~0)=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~init~0=1bv32] [?] ensures true; VAL [#NULL.base=0bv32, #NULL.offset=0bv32, old(#NULL.base)=0bv32, old(#NULL.offset)=0bv32, old(~#SSLv3_client_data~0.base)=0bv32, old(~#SSLv3_client_data~0.offset)=0bv32, old(~init~0)=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~init~0=1bv32] [?] RET call ULTIMATE.init(); VAL [#NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~init~0=1bv32] [?] CALL call #t~ret138 := main(); VAL [#NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~init~0=1bv32] [L1065] call #t~malloc3.base, #t~malloc3.offset := #Ultimate.alloc(248bv32); [L1065] ~s~0.base, ~s~0.offset := #t~malloc3.base, #t~malloc3.offset; [L1069] call #t~malloc4.base, #t~malloc4.offset := #Ultimate.alloc(899bv32); [L1069] call write~$Pointer$(#t~malloc4.base, #t~malloc4.offset, ~s~0.base, ~bvadd32(84bv32, ~s~0.offset), 4bv32); [L1070] call #t~malloc5.base, #t~malloc5.offset := #Ultimate.alloc(232bv32); [L1070] call write~$Pointer$(#t~malloc5.base, #t~malloc5.offset, ~s~0.base, ~bvadd32(204bv32, ~s~0.offset), 4bv32); [L1071] call #t~malloc6.base, #t~malloc6.offset := #Ultimate.alloc(200bv32); [L1071] call write~$Pointer$(#t~malloc6.base, #t~malloc6.offset, ~s~0.base, ~bvadd32(176bv32, ~s~0.offset), 4bv32); [L1072] call write~intINTTYPE4(12292bv32, ~s~0.base, ~bvadd32(52bv32, ~s~0.offset), 4bv32); [L1073] call write~intINTTYPE4(#t~nondet7, ~s~0.base, ~s~0.offset, 4bv32); [L1073] havoc #t~nondet7; VAL [#NULL.base=0bv32, #NULL.offset=0bv32, #t~malloc3.base=33554433bv32, #t~malloc3.offset=0bv32, #t~malloc4.base=2147483650bv32, #t~malloc4.offset=0bv32, #t~malloc5.base=3bv32, #t~malloc5.offset=0bv32, #t~malloc6.base=2bv32, #t~malloc6.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~init~0=1bv32, ~s~0.base=33554433bv32, ~s~0.offset=0bv32] [L1074] CALL call #t~ret8 := ssl3_connect(~s~0.base, ~s~0.offset); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~init~0=1bv32] [L1079-L1645] ~s.base, ~s.offset := #in~s.base, #in~s.offset; [L1080] havoc ~buf~0.base, ~buf~0.offset; [L1081] havoc ~tmp~2; [L1082] havoc ~l~0; [L1083] havoc ~num1~0; [L1084] havoc ~cb~0.base, ~cb~0.offset; [L1085] havoc ~ret~0; [L1086] havoc ~new_state~0; [L1087] havoc ~state~0; [L1088] havoc ~skip~0; [L1089] ~tmp___0~1.base, ~tmp___0~1.offset := #t~nondet9.base, #t~nondet9.offset; [L1089] havoc #t~nondet9.base, #t~nondet9.offset; [L1090] ~tmp___1~0 := #t~nondet10; [L1090] havoc #t~nondet10; [L1091] ~tmp___2~0 := #t~nondet11; [L1091] havoc #t~nondet11; [L1092] ~tmp___3~0 := #t~nondet12; [L1092] havoc #t~nondet12; [L1093] ~tmp___4~0 := #t~nondet13; [L1093] havoc #t~nondet13; [L1094] ~tmp___5~0 := #t~nondet14; [L1094] havoc #t~nondet14; [L1095] ~tmp___6~0 := #t~nondet15; [L1095] havoc #t~nondet15; [L1096] ~tmp___7~0 := #t~nondet16; [L1096] havoc #t~nondet16; [L1097] ~tmp___8~0 := #t~nondet17; [L1097] havoc #t~nondet17; [L1098] ~tmp___9~0 := #t~nondet18; [L1098] havoc #t~nondet18; [L1099] havoc ~blastFlag~0; [L1102] ~blastFlag~0 := 0bv32; [L1103] call write~intINTTYPE4(#t~nondet19, ~s.base, ~bvadd32(92bv32, ~s.offset), 4bv32); [L1103] havoc #t~nondet19; [L1104] call write~intINTTYPE4(12292bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); [L1105] ~tmp~2 := #t~nondet20; [L1105] havoc #t~nondet20; [L1106] ~cb~0.base, ~cb~0.offset := 0bv32, 0bv32; [L1107] ~ret~0 := 4294967295bv32; [L1108] ~skip~0 := 0bv32; [L1109] call write~intINTTYPE4(0bv32, ~tmp___0~1.base, ~tmp___0~1.offset, 4bv32); [L1110] call #t~mem21.base, #t~mem21.offset := read~$Pointer$(~s.base, ~bvadd32(192bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem21.base=0bv32, #t~mem21.offset=1bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=0bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1110-L1118] assume 0bv32 != ~bvadd32(#t~mem21.base, #t~mem21.offset); [L1110] havoc #t~mem21.base, #t~mem21.offset; [L1111] call #t~mem22.base, #t~mem22.offset := read~$Pointer$(~s.base, ~bvadd32(192bv32, ~s.offset), 4bv32); [L1111] ~cb~0.base, ~cb~0.offset := #t~mem22.base, #t~mem22.offset; [L1111] havoc #t~mem22.base, #t~mem22.offset; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1119] call #t~mem27 := read~intINTTYPE4(~s.base, ~bvadd32(28bv32, ~s.offset), 4bv32); [L1119] call write~intINTTYPE4(~bvadd32(1bv32, #t~mem27), ~s.base, ~bvadd32(28bv32, ~s.offset), 4bv32); [L1119] havoc #t~mem27; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1120-L1128] assume !(0bv32 != ~bvand32(12288bv32, ~tmp___1~0)); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] assume !false; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] call #t~mem28 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] call #t~mem29 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem29=12292bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133-L1601] assume 12292bv32 == #t~mem29; [L1133] havoc #t~mem29; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1236] call write~intINTTYPE4(1bv32, ~s.base, ~bvadd32(40bv32, ~s.offset), 4bv32); [L1237] call write~intINTTYPE4(4096bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); [L1238] call #t~mem62.base, #t~mem62.offset := read~$Pointer$(~s.base, ~bvadd32(204bv32, ~s.offset), 4bv32); [L1238] call #t~mem63 := read~intINTTYPE4(#t~mem62.base, ~bvadd32(64bv32, #t~mem62.offset), 4bv32); [L1238] call write~intINTTYPE4(~bvadd32(1bv32, #t~mem63), #t~mem62.base, ~bvadd32(64bv32, #t~mem62.offset), 4bv32); [L1238] havoc #t~mem62.base, #t~mem62.offset; [L1238] havoc #t~mem63; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1243] call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(36bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1244-L1248] assume 0bv32 != ~bvadd32(~cb~0.base, ~cb~0.offset); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1249] call #t~mem64 := read~intINTTYPE4(~s.base, ~s.offset, 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem64=768bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1249-L1254] assume !(768bv32 != ~bvand32(65280bv32, #t~mem64)); [L1249] havoc #t~mem64; [L1255] call write~intINTTYPE4(4096bv32, ~s.base, ~bvadd32(4bv32, ~s.offset), 4bv32); [L1256] call #t~mem65.base, #t~mem65.offset := read~$Pointer$(~s.base, ~bvadd32(60bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem65.base=0bv32, #t~mem65.offset=1bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1256-L1273] assume !(0bv32 == ~bvadd32(#t~mem65.base, #t~mem65.offset)); [L1256] havoc #t~mem65.base, #t~mem65.offset; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1274-L1279] assume !(0bv32 == ~tmp___4~0); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1280-L1285] assume !(0bv32 == ~tmp___5~0); [L1286] call write~intINTTYPE4(4368bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); [L1287] call #t~mem67.base, #t~mem67.offset := read~$Pointer$(~s.base, ~bvadd32(204bv32, ~s.offset), 4bv32); [L1287] call #t~mem68 := read~intINTTYPE4(#t~mem67.base, ~bvadd32(60bv32, #t~mem67.offset), 4bv32); [L1287] call write~intINTTYPE4(~bvadd32(1bv32, #t~mem68), #t~mem67.base, ~bvadd32(60bv32, #t~mem67.offset), 4bv32); [L1287] havoc #t~mem68; [L1287] havoc #t~mem67.base, #t~mem67.offset; [L1288] call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(64bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] call #t~mem127.base, #t~mem127.offset := read~$Pointer$(~s.base, ~bvadd32(84bv32, ~s.offset), 4bv32); [L1602] call #t~mem128 := read~intINTTYPE4(#t~mem127.base, ~bvadd32(848bv32, #t~mem127.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem127.base=33554433bv32, #t~mem127.offset=4294966500bv32, #t~mem128=4368bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602-L1630] assume !(0bv32 == #t~mem128); [L1602] havoc #t~mem127.base, #t~mem127.offset; [L1602] havoc #t~mem128; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1631] ~skip~0 := 0bv32; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] assume !false; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] call #t~mem28 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] call #t~mem29 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem29=4368bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133-L1601] assume !(12292bv32 == #t~mem29); [L1133] havoc #t~mem29; [L1136] call #t~mem30 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem30=4368bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1136-L1600] assume !(16384bv32 == #t~mem30); [L1136] havoc #t~mem30; [L1139] call #t~mem31 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem31=4368bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1139-L1599] assume !(4096bv32 == #t~mem31); [L1139] havoc #t~mem31; [L1142] call #t~mem32 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem32=4368bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1142-L1598] assume !(20480bv32 == #t~mem32); [L1142] havoc #t~mem32; [L1145] call #t~mem33 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem33=4368bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1145-L1597] assume !(4099bv32 == #t~mem33); [L1145] havoc #t~mem33; [L1148] call #t~mem34 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem34=4368bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1148-L1596] assume 4368bv32 == #t~mem34; [L1148] havoc #t~mem34; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1292] call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(48bv32, ~s.offset), 4bv32); [L1293] ~ret~0 := #t~nondet69; [L1293] havoc #t~nondet69; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1294-L1298] assume 0bv32 == ~blastFlag~0; [L1295] ~blastFlag~0 := 1bv32; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1299-L1303] assume !~bvsle32(~ret~0, 0bv32); [L1304] call write~intINTTYPE4(4384bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); [L1305] call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(64bv32, ~s.offset), 4bv32); [L1306] call #t~mem70.base, #t~mem70.offset := read~$Pointer$(~s.base, ~bvadd32(20bv32, ~s.offset), 4bv32); [L1306] call #t~mem71.base, #t~mem71.offset := read~$Pointer$(~s.base, ~bvadd32(16bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem70.base=1bv32, #t~mem70.offset=0bv32, #t~mem71.base=0bv32, #t~mem71.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1306-L1310] assume ~bvadd32(#t~mem70.base, #t~mem70.offset) != ~bvadd32(#t~mem71.base, #t~mem71.offset); [L1306] havoc #t~mem71.base, #t~mem71.offset; [L1306] havoc #t~mem70.base, #t~mem70.offset; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] call #t~mem127.base, #t~mem127.offset := read~$Pointer$(~s.base, ~bvadd32(84bv32, ~s.offset), 4bv32); [L1602] call #t~mem128 := read~intINTTYPE4(#t~mem127.base, ~bvadd32(848bv32, #t~mem127.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem127.base=33554433bv32, #t~mem127.offset=4294966500bv32, #t~mem128=4384bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602-L1630] assume !(0bv32 == #t~mem128); [L1602] havoc #t~mem127.base, #t~mem127.offset; [L1602] havoc #t~mem128; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1631] ~skip~0 := 0bv32; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] assume !false; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] call #t~mem28 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] call #t~mem29 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem29=4384bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133-L1601] assume !(12292bv32 == #t~mem29); [L1133] havoc #t~mem29; [L1136] call #t~mem30 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem30=4384bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1136-L1600] assume !(16384bv32 == #t~mem30); [L1136] havoc #t~mem30; [L1139] call #t~mem31 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem31=4384bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1139-L1599] assume !(4096bv32 == #t~mem31); [L1139] havoc #t~mem31; [L1142] call #t~mem32 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem32=4384bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1142-L1598] assume !(20480bv32 == #t~mem32); [L1142] havoc #t~mem32; [L1145] call #t~mem33 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem33=4384bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1145-L1597] assume !(4099bv32 == #t~mem33); [L1145] havoc #t~mem33; [L1148] call #t~mem34 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem34=4384bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1148-L1596] assume !(4368bv32 == #t~mem34); [L1148] havoc #t~mem34; [L1151] call #t~mem35 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem35=4384bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1151-L1595] assume !(4369bv32 == #t~mem35); [L1151] havoc #t~mem35; [L1154] call #t~mem36 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem36=4384bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1154-L1594] assume 4384bv32 == #t~mem36; [L1154] havoc #t~mem36; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1314] ~ret~0 := #t~nondet72; [L1314] havoc #t~nondet72; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1315-L1323] assume 1bv32 == ~blastFlag~0; [L1316] ~blastFlag~0 := 2bv32; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1324-L1328] assume !~bvsle32(~ret~0, 0bv32); [L1329] call #t~mem73 := read~intINTTYPE4(~s.base, ~bvadd32(92bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem73=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1329-L1333] assume !(0bv32 != #t~mem73); [L1329] havoc #t~mem73; [L1332] call write~intINTTYPE4(4400bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1334] call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(64bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] call #t~mem127.base, #t~mem127.offset := read~$Pointer$(~s.base, ~bvadd32(84bv32, ~s.offset), 4bv32); [L1602] call #t~mem128 := read~intINTTYPE4(#t~mem127.base, ~bvadd32(848bv32, #t~mem127.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem127.base=33554433bv32, #t~mem127.offset=4294966500bv32, #t~mem128=4400bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602-L1630] assume !(0bv32 == #t~mem128); [L1602] havoc #t~mem127.base, #t~mem127.offset; [L1602] havoc #t~mem128; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1631] ~skip~0 := 0bv32; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] assume !false; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] call #t~mem28 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] call #t~mem29 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem29=4400bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133-L1601] assume !(12292bv32 == #t~mem29); [L1133] havoc #t~mem29; [L1136] call #t~mem30 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem30=4400bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1136-L1600] assume !(16384bv32 == #t~mem30); [L1136] havoc #t~mem30; [L1139] call #t~mem31 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem31=4400bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1139-L1599] assume !(4096bv32 == #t~mem31); [L1139] havoc #t~mem31; [L1142] call #t~mem32 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem32=4400bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1142-L1598] assume !(20480bv32 == #t~mem32); [L1142] havoc #t~mem32; [L1145] call #t~mem33 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem33=4400bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1145-L1597] assume !(4099bv32 == #t~mem33); [L1145] havoc #t~mem33; [L1148] call #t~mem34 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem34=4400bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1148-L1596] assume !(4368bv32 == #t~mem34); [L1148] havoc #t~mem34; [L1151] call #t~mem35 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem35=4400bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1151-L1595] assume !(4369bv32 == #t~mem35); [L1151] havoc #t~mem35; [L1154] call #t~mem36 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem36=4400bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1154-L1594] assume !(4384bv32 == #t~mem36); [L1154] havoc #t~mem36; [L1157] call #t~mem37 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem37=4400bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1157-L1593] assume !(4385bv32 == #t~mem37); [L1157] havoc #t~mem37; [L1160] call #t~mem38 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem38=4400bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1160-L1592] assume 4400bv32 == #t~mem38; [L1160] havoc #t~mem38; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1338] call #t~mem74.base, #t~mem74.offset := read~$Pointer$(~s.base, ~bvadd32(84bv32, ~s.offset), 4bv32); [L1338] call #t~mem75.base, #t~mem75.offset := read~$Pointer$(#t~mem74.base, ~bvadd32(836bv32, #t~mem74.offset), 4bv32); [L1338] call #t~mem76 := read~intINTTYPE4(#t~mem75.base, ~bvadd32(12bv32, #t~mem75.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem74.base=33554433bv32, #t~mem74.offset=4294966500bv32, #t~mem75.base=33554433bv32, #t~mem75.offset=52bv32, #t~mem76=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1338-L1352] assume !(0bv32 != ~bvand32(256bv32, #t~mem76)); [L1338] havoc #t~mem76; [L1338] havoc #t~mem75.base, #t~mem75.offset; [L1338] havoc #t~mem74.base, #t~mem74.offset; [L1341] ~ret~0 := #t~nondet77; [L1341] havoc #t~nondet77; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1342-L1346] assume 2bv32 == ~blastFlag~0; [L1343] ~blastFlag~0 := 3bv32; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1347-L1351] assume !~bvsle32(~ret~0, 0bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1353] call write~intINTTYPE4(4416bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); [L1354] call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(64bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] call #t~mem127.base, #t~mem127.offset := read~$Pointer$(~s.base, ~bvadd32(84bv32, ~s.offset), 4bv32); [L1602] call #t~mem128 := read~intINTTYPE4(#t~mem127.base, ~bvadd32(848bv32, #t~mem127.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem127.base=33554433bv32, #t~mem127.offset=4294966500bv32, #t~mem128=4416bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602-L1630] assume !(0bv32 == #t~mem128); [L1602] havoc #t~mem127.base, #t~mem127.offset; [L1602] havoc #t~mem128; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1631] ~skip~0 := 0bv32; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] assume !false; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] call #t~mem28 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] call #t~mem29 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem29=4416bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133-L1601] assume !(12292bv32 == #t~mem29); [L1133] havoc #t~mem29; [L1136] call #t~mem30 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem30=4416bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1136-L1600] assume !(16384bv32 == #t~mem30); [L1136] havoc #t~mem30; [L1139] call #t~mem31 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem31=4416bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1139-L1599] assume !(4096bv32 == #t~mem31); [L1139] havoc #t~mem31; [L1142] call #t~mem32 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem32=4416bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1142-L1598] assume !(20480bv32 == #t~mem32); [L1142] havoc #t~mem32; [L1145] call #t~mem33 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem33=4416bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1145-L1597] assume !(4099bv32 == #t~mem33); [L1145] havoc #t~mem33; [L1148] call #t~mem34 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem34=4416bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1148-L1596] assume !(4368bv32 == #t~mem34); [L1148] havoc #t~mem34; [L1151] call #t~mem35 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem35=4416bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1151-L1595] assume !(4369bv32 == #t~mem35); [L1151] havoc #t~mem35; [L1154] call #t~mem36 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem36=4416bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1154-L1594] assume !(4384bv32 == #t~mem36); [L1154] havoc #t~mem36; [L1157] call #t~mem37 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem37=4416bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1157-L1593] assume !(4385bv32 == #t~mem37); [L1157] havoc #t~mem37; [L1160] call #t~mem38 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem38=4416bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1160-L1592] assume !(4400bv32 == #t~mem38); [L1160] havoc #t~mem38; [L1163] call #t~mem39 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem39=4416bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1163-L1591] assume !(4401bv32 == #t~mem39); [L1163] havoc #t~mem39; [L1166] call #t~mem40 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem40=4416bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1166-L1590] assume 4416bv32 == #t~mem40; [L1166] havoc #t~mem40; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1358] ~ret~0 := #t~nondet78; [L1358] havoc #t~nondet78; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1359-L1363] assume 3bv32 == ~blastFlag~0; [L1360] ~blastFlag~0 := 4bv32; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1364-L1368] assume !~bvsle32(~ret~0, 0bv32); [L1369] call write~intINTTYPE4(4432bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); [L1370] call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(64bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1371-L1376] assume !(0bv32 == ~tmp___6~0); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] call #t~mem127.base, #t~mem127.offset := read~$Pointer$(~s.base, ~bvadd32(84bv32, ~s.offset), 4bv32); [L1602] call #t~mem128 := read~intINTTYPE4(#t~mem127.base, ~bvadd32(848bv32, #t~mem127.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem127.base=33554433bv32, #t~mem127.offset=4294966500bv32, #t~mem128=4432bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602-L1630] assume !(0bv32 == #t~mem128); [L1602] havoc #t~mem127.base, #t~mem127.offset; [L1602] havoc #t~mem128; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1631] ~skip~0 := 0bv32; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] assume !false; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] call #t~mem28 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] call #t~mem29 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem29=4432bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133-L1601] assume !(12292bv32 == #t~mem29); [L1133] havoc #t~mem29; [L1136] call #t~mem30 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem30=4432bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1136-L1600] assume !(16384bv32 == #t~mem30); [L1136] havoc #t~mem30; [L1139] call #t~mem31 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem31=4432bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1139-L1599] assume !(4096bv32 == #t~mem31); [L1139] havoc #t~mem31; [L1142] call #t~mem32 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem32=4432bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1142-L1598] assume !(20480bv32 == #t~mem32); [L1142] havoc #t~mem32; [L1145] call #t~mem33 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem33=4432bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1145-L1597] assume !(4099bv32 == #t~mem33); [L1145] havoc #t~mem33; [L1148] call #t~mem34 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem34=4432bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1148-L1596] assume !(4368bv32 == #t~mem34); [L1148] havoc #t~mem34; [L1151] call #t~mem35 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem35=4432bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1151-L1595] assume !(4369bv32 == #t~mem35); [L1151] havoc #t~mem35; [L1154] call #t~mem36 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem36=4432bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1154-L1594] assume !(4384bv32 == #t~mem36); [L1154] havoc #t~mem36; [L1157] call #t~mem37 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem37=4432bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1157-L1593] assume !(4385bv32 == #t~mem37); [L1157] havoc #t~mem37; [L1160] call #t~mem38 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem38=4432bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1160-L1592] assume !(4400bv32 == #t~mem38); [L1160] havoc #t~mem38; [L1163] call #t~mem39 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem39=4432bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1163-L1591] assume !(4401bv32 == #t~mem39); [L1163] havoc #t~mem39; [L1166] call #t~mem40 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem40=4432bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1166-L1590] assume !(4416bv32 == #t~mem40); [L1166] havoc #t~mem40; [L1169] call #t~mem41 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem41=4432bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1169-L1589] assume !(4417bv32 == #t~mem41); [L1169] havoc #t~mem41; [L1172] call #t~mem42 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem42=4432bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1172-L1588] assume 4432bv32 == #t~mem42; [L1172] havoc #t~mem42; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1380] ~ret~0 := #t~nondet79; [L1380] havoc #t~nondet79; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=0bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1381-L1385] assume 4bv32 == ~blastFlag~0; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=0bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1643] assert false; VAL [#in~s.base=33554433bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=33554434bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~cb~0.base=0bv32, ~cb~0.offset=1bv32, ~init~0=1bv32, ~ret~0=0bv32, ~s.base=33554433bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=33554433bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [?] CALL call ULTIMATE.init(); VAL [#NULL!base=0bv32, #NULL!offset=0bv32, old(#NULL!base)=0bv32, old(#NULL!offset)=0bv32, old(~#SSLv3_client_data~0!base)=0bv32, old(~#SSLv3_client_data~0!offset)=0bv32, old(~init~0)=0bv32, ~#SSLv3_client_data~0!base=0bv32, ~#SSLv3_client_data~0!offset=0bv32, ~init~0=0bv32] [?] #NULL := { base: 0bv32, offset: 0bv32 }; [?] #valid[0bv32] := 0bv1; [L1042] ~init~0 := 1bv32; [L1043] FCALL call ~#SSLv3_client_data~0 := #Ultimate.alloc(100bv32); [L1043] FCALL call write~init~intINTTYPE4(0bv32, { base: ~#SSLv3_client_data~0!base, offset: ~#SSLv3_client_data~0!offset }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(4bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(8bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(12bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(16bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(20bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(24bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(28bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(32bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(36bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(40bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(44bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(48bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(52bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(56bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(60bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(64bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(68bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(72bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(76bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(80bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(84bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(88bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(92bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(96bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); VAL [#NULL!base=0bv32, #NULL!offset=0bv32, old(#NULL!base)=0bv32, old(#NULL!offset)=0bv32, old(~#SSLv3_client_data~0!base)=0bv32, old(~#SSLv3_client_data~0!offset)=0bv32, old(~init~0)=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~init~0=1bv32] [?] RET call ULTIMATE.init(); VAL [#NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~init~0=1bv32] [?] CALL call #t~ret138 := main(); VAL [#NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~init~0=1bv32] [L1065] FCALL call #t~malloc3 := #Ultimate.alloc(248bv32); [L1065] ~s~0 := #t~malloc3; [L1069] FCALL call #t~malloc4 := #Ultimate.alloc(899bv32); [L1069] FCALL call write~$Pointer$(#t~malloc4, { base: ~s~0!base, offset: ~bvadd32(84bv32, ~s~0!offset) }, 4bv32); [L1070] FCALL call #t~malloc5 := #Ultimate.alloc(232bv32); [L1070] FCALL call write~$Pointer$(#t~malloc5, { base: ~s~0!base, offset: ~bvadd32(204bv32, ~s~0!offset) }, 4bv32); [L1071] FCALL call #t~malloc6 := #Ultimate.alloc(200bv32); [L1071] FCALL call write~$Pointer$(#t~malloc6, { base: ~s~0!base, offset: ~bvadd32(176bv32, ~s~0!offset) }, 4bv32); [L1072] FCALL call write~intINTTYPE4(12292bv32, { base: ~s~0!base, offset: ~bvadd32(52bv32, ~s~0!offset) }, 4bv32); [L1073] FCALL call write~intINTTYPE4(#t~nondet7, { base: ~s~0!base, offset: ~s~0!offset }, 4bv32); [L1073] havoc #t~nondet7; VAL [#NULL!base=0bv32, #NULL!offset=0bv32, #t~malloc3!base=33554433bv32, #t~malloc3!offset=0bv32, #t~malloc4!base=2147483650bv32, #t~malloc4!offset=0bv32, #t~malloc5!base=3bv32, #t~malloc5!offset=0bv32, #t~malloc6!base=2bv32, #t~malloc6!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~init~0=1bv32, ~s~0!base=33554433bv32, ~s~0!offset=0bv32] [L1074] CALL call #t~ret8 := ssl3_connect(~s~0); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~init~0=1bv32] [L1079-L1645] ~s := #in~s; [L1080] havoc ~buf~0; [L1081] havoc ~tmp~2; [L1082] havoc ~l~0; [L1083] havoc ~num1~0; [L1084] havoc ~cb~0; [L1085] havoc ~ret~0; [L1086] havoc ~new_state~0; [L1087] havoc ~state~0; [L1088] havoc ~skip~0; [L1089] ~tmp___0~1 := #t~nondet9; [L1089] havoc #t~nondet9; [L1090] ~tmp___1~0 := #t~nondet10; [L1090] havoc #t~nondet10; [L1091] ~tmp___2~0 := #t~nondet11; [L1091] havoc #t~nondet11; [L1092] ~tmp___3~0 := #t~nondet12; [L1092] havoc #t~nondet12; [L1093] ~tmp___4~0 := #t~nondet13; [L1093] havoc #t~nondet13; [L1094] ~tmp___5~0 := #t~nondet14; [L1094] havoc #t~nondet14; [L1095] ~tmp___6~0 := #t~nondet15; [L1095] havoc #t~nondet15; [L1096] ~tmp___7~0 := #t~nondet16; [L1096] havoc #t~nondet16; [L1097] ~tmp___8~0 := #t~nondet17; [L1097] havoc #t~nondet17; [L1098] ~tmp___9~0 := #t~nondet18; [L1098] havoc #t~nondet18; [L1099] havoc ~blastFlag~0; [L1102] ~blastFlag~0 := 0bv32; [L1103] FCALL call write~intINTTYPE4(#t~nondet19, { base: ~s!base, offset: ~bvadd32(92bv32, ~s!offset) }, 4bv32); [L1103] havoc #t~nondet19; [L1104] FCALL call write~intINTTYPE4(12292bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1105] ~tmp~2 := #t~nondet20; [L1105] havoc #t~nondet20; [L1106] ~cb~0 := { base: 0bv32, offset: 0bv32 }; [L1107] ~ret~0 := 4294967295bv32; [L1108] ~skip~0 := 0bv32; [L1109] FCALL call write~intINTTYPE4(0bv32, ~tmp___0~1, 4bv32); [L1110] FCALL call #t~mem21 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(192bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem21!base=0bv32, #t~mem21!offset=1bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=0bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1110] COND TRUE 0bv32 != ~bvadd32(#t~mem21!base, #t~mem21!offset) [L1110] havoc #t~mem21; [L1111] FCALL call #t~mem22 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(192bv32, ~s!offset) }, 4bv32); [L1111] ~cb~0 := #t~mem22; [L1111] havoc #t~mem22; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1119] FCALL call #t~mem27 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(28bv32, ~s!offset) }, 4bv32); [L1119] FCALL call write~intINTTYPE4(~bvadd32(1bv32, #t~mem27), { base: ~s!base, offset: ~bvadd32(28bv32, ~s!offset) }, 4bv32); [L1119] havoc #t~mem27; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1120-L1128] COND FALSE !(0bv32 != ~bvand32(12288bv32, ~tmp___1~0)) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] COND FALSE !(false) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] FCALL call #t~mem28 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] FCALL call #t~mem29 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem29=12292bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133] COND TRUE 12292bv32 == #t~mem29 [L1133] havoc #t~mem29; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1236] FCALL call write~intINTTYPE4(1bv32, { base: ~s!base, offset: ~bvadd32(40bv32, ~s!offset) }, 4bv32); [L1237] FCALL call write~intINTTYPE4(4096bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1238] FCALL call #t~mem62 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(204bv32, ~s!offset) }, 4bv32); [L1238] FCALL call #t~mem63 := read~intINTTYPE4({ base: #t~mem62!base, offset: ~bvadd32(64bv32, #t~mem62!offset) }, 4bv32); [L1238] FCALL call write~intINTTYPE4(~bvadd32(1bv32, #t~mem63), { base: #t~mem62!base, offset: ~bvadd32(64bv32, #t~mem62!offset) }, 4bv32); [L1238] havoc #t~mem62; [L1238] havoc #t~mem63; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1243] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(36bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1244] COND TRUE 0bv32 != ~bvadd32(~cb~0!base, ~cb~0!offset) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1249] FCALL call #t~mem64 := read~intINTTYPE4({ base: ~s!base, offset: ~s!offset }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem64=768bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1249] COND FALSE !(768bv32 != ~bvand32(65280bv32, #t~mem64)) [L1249] havoc #t~mem64; [L1255] FCALL call write~intINTTYPE4(4096bv32, { base: ~s!base, offset: ~bvadd32(4bv32, ~s!offset) }, 4bv32); [L1256] FCALL call #t~mem65 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(60bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem65!base=0bv32, #t~mem65!offset=1bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1256] COND FALSE !(0bv32 == ~bvadd32(#t~mem65!base, #t~mem65!offset)) [L1256] havoc #t~mem65; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1274] COND FALSE !(0bv32 == ~tmp___4~0) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1280] COND FALSE !(0bv32 == ~tmp___5~0) [L1286] FCALL call write~intINTTYPE4(4368bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1287] FCALL call #t~mem67 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(204bv32, ~s!offset) }, 4bv32); [L1287] FCALL call #t~mem68 := read~intINTTYPE4({ base: #t~mem67!base, offset: ~bvadd32(60bv32, #t~mem67!offset) }, 4bv32); [L1287] FCALL call write~intINTTYPE4(~bvadd32(1bv32, #t~mem68), { base: #t~mem67!base, offset: ~bvadd32(60bv32, #t~mem67!offset) }, 4bv32); [L1287] havoc #t~mem68; [L1287] havoc #t~mem67; [L1288] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(64bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] FCALL call #t~mem127 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(84bv32, ~s!offset) }, 4bv32); [L1602] FCALL call #t~mem128 := read~intINTTYPE4({ base: #t~mem127!base, offset: ~bvadd32(848bv32, #t~mem127!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem127!base=33554433bv32, #t~mem127!offset=4294966500bv32, #t~mem128=4368bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] COND FALSE !(0bv32 == #t~mem128) [L1602] havoc #t~mem127; [L1602] havoc #t~mem128; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1631] ~skip~0 := 0bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] COND FALSE !(false) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] FCALL call #t~mem28 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] FCALL call #t~mem29 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem29=4368bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133] COND FALSE !(12292bv32 == #t~mem29) [L1133] havoc #t~mem29; [L1136] FCALL call #t~mem30 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem30=4368bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1136] COND FALSE !(16384bv32 == #t~mem30) [L1136] havoc #t~mem30; [L1139] FCALL call #t~mem31 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem31=4368bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1139] COND FALSE !(4096bv32 == #t~mem31) [L1139] havoc #t~mem31; [L1142] FCALL call #t~mem32 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem32=4368bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1142] COND FALSE !(20480bv32 == #t~mem32) [L1142] havoc #t~mem32; [L1145] FCALL call #t~mem33 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem33=4368bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1145] COND FALSE !(4099bv32 == #t~mem33) [L1145] havoc #t~mem33; [L1148] FCALL call #t~mem34 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem34=4368bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1148] COND TRUE 4368bv32 == #t~mem34 [L1148] havoc #t~mem34; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1292] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(48bv32, ~s!offset) }, 4bv32); [L1293] ~ret~0 := #t~nondet69; [L1293] havoc #t~nondet69; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1294] COND TRUE 0bv32 == ~blastFlag~0 [L1295] ~blastFlag~0 := 1bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1299] COND FALSE !(~bvsle32(~ret~0, 0bv32)) [L1304] FCALL call write~intINTTYPE4(4384bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1305] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(64bv32, ~s!offset) }, 4bv32); [L1306] FCALL call #t~mem70 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(20bv32, ~s!offset) }, 4bv32); [L1306] FCALL call #t~mem71 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(16bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem70!base=1bv32, #t~mem70!offset=0bv32, #t~mem71!base=0bv32, #t~mem71!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1306] COND TRUE ~bvadd32(#t~mem70!base, #t~mem70!offset) != ~bvadd32(#t~mem71!base, #t~mem71!offset) [L1306] havoc #t~mem71; [L1306] havoc #t~mem70; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] FCALL call #t~mem127 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(84bv32, ~s!offset) }, 4bv32); [L1602] FCALL call #t~mem128 := read~intINTTYPE4({ base: #t~mem127!base, offset: ~bvadd32(848bv32, #t~mem127!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem127!base=33554433bv32, #t~mem127!offset=4294966500bv32, #t~mem128=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] COND FALSE !(0bv32 == #t~mem128) [L1602] havoc #t~mem127; [L1602] havoc #t~mem128; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1631] ~skip~0 := 0bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] COND FALSE !(false) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] FCALL call #t~mem28 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] FCALL call #t~mem29 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem29=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133] COND FALSE !(12292bv32 == #t~mem29) [L1133] havoc #t~mem29; [L1136] FCALL call #t~mem30 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem30=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1136] COND FALSE !(16384bv32 == #t~mem30) [L1136] havoc #t~mem30; [L1139] FCALL call #t~mem31 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem31=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1139] COND FALSE !(4096bv32 == #t~mem31) [L1139] havoc #t~mem31; [L1142] FCALL call #t~mem32 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem32=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1142] COND FALSE !(20480bv32 == #t~mem32) [L1142] havoc #t~mem32; [L1145] FCALL call #t~mem33 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem33=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1145] COND FALSE !(4099bv32 == #t~mem33) [L1145] havoc #t~mem33; [L1148] FCALL call #t~mem34 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem34=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1148] COND FALSE !(4368bv32 == #t~mem34) [L1148] havoc #t~mem34; [L1151] FCALL call #t~mem35 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem35=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1151] COND FALSE !(4369bv32 == #t~mem35) [L1151] havoc #t~mem35; [L1154] FCALL call #t~mem36 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem36=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1154] COND TRUE 4384bv32 == #t~mem36 [L1154] havoc #t~mem36; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1314] ~ret~0 := #t~nondet72; [L1314] havoc #t~nondet72; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1315] COND TRUE 1bv32 == ~blastFlag~0 [L1316] ~blastFlag~0 := 2bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1324] COND FALSE !(~bvsle32(~ret~0, 0bv32)) [L1329] FCALL call #t~mem73 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(92bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem73=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1329-L1333] COND FALSE !(0bv32 != #t~mem73) [L1329] havoc #t~mem73; [L1332] FCALL call write~intINTTYPE4(4400bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1334] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(64bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] FCALL call #t~mem127 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(84bv32, ~s!offset) }, 4bv32); [L1602] FCALL call #t~mem128 := read~intINTTYPE4({ base: #t~mem127!base, offset: ~bvadd32(848bv32, #t~mem127!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem127!base=33554433bv32, #t~mem127!offset=4294966500bv32, #t~mem128=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] COND FALSE !(0bv32 == #t~mem128) [L1602] havoc #t~mem127; [L1602] havoc #t~mem128; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1631] ~skip~0 := 0bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] COND FALSE !(false) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] FCALL call #t~mem28 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] FCALL call #t~mem29 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem29=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133] COND FALSE !(12292bv32 == #t~mem29) [L1133] havoc #t~mem29; [L1136] FCALL call #t~mem30 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem30=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1136] COND FALSE !(16384bv32 == #t~mem30) [L1136] havoc #t~mem30; [L1139] FCALL call #t~mem31 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem31=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1139] COND FALSE !(4096bv32 == #t~mem31) [L1139] havoc #t~mem31; [L1142] FCALL call #t~mem32 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem32=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1142] COND FALSE !(20480bv32 == #t~mem32) [L1142] havoc #t~mem32; [L1145] FCALL call #t~mem33 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem33=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1145] COND FALSE !(4099bv32 == #t~mem33) [L1145] havoc #t~mem33; [L1148] FCALL call #t~mem34 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem34=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1148] COND FALSE !(4368bv32 == #t~mem34) [L1148] havoc #t~mem34; [L1151] FCALL call #t~mem35 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem35=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1151] COND FALSE !(4369bv32 == #t~mem35) [L1151] havoc #t~mem35; [L1154] FCALL call #t~mem36 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem36=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1154] COND FALSE !(4384bv32 == #t~mem36) [L1154] havoc #t~mem36; [L1157] FCALL call #t~mem37 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem37=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1157] COND FALSE !(4385bv32 == #t~mem37) [L1157] havoc #t~mem37; [L1160] FCALL call #t~mem38 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem38=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1160] COND TRUE 4400bv32 == #t~mem38 [L1160] havoc #t~mem38; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1338] FCALL call #t~mem74 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(84bv32, ~s!offset) }, 4bv32); [L1338] FCALL call #t~mem75 := read~$Pointer$({ base: #t~mem74!base, offset: ~bvadd32(836bv32, #t~mem74!offset) }, 4bv32); [L1338] FCALL call #t~mem76 := read~intINTTYPE4({ base: #t~mem75!base, offset: ~bvadd32(12bv32, #t~mem75!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem74!base=33554433bv32, #t~mem74!offset=4294966500bv32, #t~mem75!base=33554433bv32, #t~mem75!offset=52bv32, #t~mem76=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1338-L1352] COND FALSE !(0bv32 != ~bvand32(256bv32, #t~mem76)) [L1338] havoc #t~mem76; [L1338] havoc #t~mem75; [L1338] havoc #t~mem74; [L1341] ~ret~0 := #t~nondet77; [L1341] havoc #t~nondet77; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1342] COND TRUE 2bv32 == ~blastFlag~0 [L1343] ~blastFlag~0 := 3bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1347] COND FALSE !(~bvsle32(~ret~0, 0bv32)) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1353] FCALL call write~intINTTYPE4(4416bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1354] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(64bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] FCALL call #t~mem127 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(84bv32, ~s!offset) }, 4bv32); [L1602] FCALL call #t~mem128 := read~intINTTYPE4({ base: #t~mem127!base, offset: ~bvadd32(848bv32, #t~mem127!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem127!base=33554433bv32, #t~mem127!offset=4294966500bv32, #t~mem128=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] COND FALSE !(0bv32 == #t~mem128) [L1602] havoc #t~mem127; [L1602] havoc #t~mem128; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1631] ~skip~0 := 0bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] COND FALSE !(false) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] FCALL call #t~mem28 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] FCALL call #t~mem29 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem29=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133] COND FALSE !(12292bv32 == #t~mem29) [L1133] havoc #t~mem29; [L1136] FCALL call #t~mem30 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem30=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1136] COND FALSE !(16384bv32 == #t~mem30) [L1136] havoc #t~mem30; [L1139] FCALL call #t~mem31 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem31=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1139] COND FALSE !(4096bv32 == #t~mem31) [L1139] havoc #t~mem31; [L1142] FCALL call #t~mem32 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem32=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1142] COND FALSE !(20480bv32 == #t~mem32) [L1142] havoc #t~mem32; [L1145] FCALL call #t~mem33 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem33=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1145] COND FALSE !(4099bv32 == #t~mem33) [L1145] havoc #t~mem33; [L1148] FCALL call #t~mem34 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem34=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1148] COND FALSE !(4368bv32 == #t~mem34) [L1148] havoc #t~mem34; [L1151] FCALL call #t~mem35 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem35=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1151] COND FALSE !(4369bv32 == #t~mem35) [L1151] havoc #t~mem35; [L1154] FCALL call #t~mem36 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem36=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1154] COND FALSE !(4384bv32 == #t~mem36) [L1154] havoc #t~mem36; [L1157] FCALL call #t~mem37 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem37=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1157] COND FALSE !(4385bv32 == #t~mem37) [L1157] havoc #t~mem37; [L1160] FCALL call #t~mem38 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem38=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1160] COND FALSE !(4400bv32 == #t~mem38) [L1160] havoc #t~mem38; [L1163] FCALL call #t~mem39 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem39=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1163] COND FALSE !(4401bv32 == #t~mem39) [L1163] havoc #t~mem39; [L1166] FCALL call #t~mem40 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem40=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1166] COND TRUE 4416bv32 == #t~mem40 [L1166] havoc #t~mem40; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1358] ~ret~0 := #t~nondet78; [L1358] havoc #t~nondet78; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1359] COND TRUE 3bv32 == ~blastFlag~0 [L1360] ~blastFlag~0 := 4bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1364] COND FALSE !(~bvsle32(~ret~0, 0bv32)) [L1369] FCALL call write~intINTTYPE4(4432bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1370] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(64bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1371] COND FALSE !(0bv32 == ~tmp___6~0) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] FCALL call #t~mem127 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(84bv32, ~s!offset) }, 4bv32); [L1602] FCALL call #t~mem128 := read~intINTTYPE4({ base: #t~mem127!base, offset: ~bvadd32(848bv32, #t~mem127!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem127!base=33554433bv32, #t~mem127!offset=4294966500bv32, #t~mem128=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] COND FALSE !(0bv32 == #t~mem128) [L1602] havoc #t~mem127; [L1602] havoc #t~mem128; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1631] ~skip~0 := 0bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] COND FALSE !(false) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] FCALL call #t~mem28 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] FCALL call #t~mem29 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem29=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133] COND FALSE !(12292bv32 == #t~mem29) [L1133] havoc #t~mem29; [L1136] FCALL call #t~mem30 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem30=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1136] COND FALSE !(16384bv32 == #t~mem30) [L1136] havoc #t~mem30; [L1139] FCALL call #t~mem31 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem31=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1139] COND FALSE !(4096bv32 == #t~mem31) [L1139] havoc #t~mem31; [L1142] FCALL call #t~mem32 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem32=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1142] COND FALSE !(20480bv32 == #t~mem32) [L1142] havoc #t~mem32; [L1145] FCALL call #t~mem33 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem33=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1145] COND FALSE !(4099bv32 == #t~mem33) [L1145] havoc #t~mem33; [L1148] FCALL call #t~mem34 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem34=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1148] COND FALSE !(4368bv32 == #t~mem34) [L1148] havoc #t~mem34; [L1151] FCALL call #t~mem35 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem35=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1151] COND FALSE !(4369bv32 == #t~mem35) [L1151] havoc #t~mem35; [L1154] FCALL call #t~mem36 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem36=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1154] COND FALSE !(4384bv32 == #t~mem36) [L1154] havoc #t~mem36; [L1157] FCALL call #t~mem37 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem37=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1157] COND FALSE !(4385bv32 == #t~mem37) [L1157] havoc #t~mem37; [L1160] FCALL call #t~mem38 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem38=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1160] COND FALSE !(4400bv32 == #t~mem38) [L1160] havoc #t~mem38; [L1163] FCALL call #t~mem39 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem39=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1163] COND FALSE !(4401bv32 == #t~mem39) [L1163] havoc #t~mem39; [L1166] FCALL call #t~mem40 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem40=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1166] COND FALSE !(4416bv32 == #t~mem40) [L1166] havoc #t~mem40; [L1169] FCALL call #t~mem41 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem41=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1169] COND FALSE !(4417bv32 == #t~mem41) [L1169] havoc #t~mem41; [L1172] FCALL call #t~mem42 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem42=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1172] COND TRUE 4432bv32 == #t~mem42 [L1172] havoc #t~mem42; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1380] ~ret~0 := #t~nondet79; [L1380] havoc #t~nondet79; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=0bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1381] COND TRUE 4bv32 == ~blastFlag~0 VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=0bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1643] assert false; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=0bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] ----- ----- class de.uni_freiburg.informatik.ultimate.boogie.procedureinliner.backtranslation.InlinerBacktranslator [?] CALL call ULTIMATE.init(); VAL [#NULL!base=0bv32, #NULL!offset=0bv32, old(#NULL!base)=0bv32, old(#NULL!offset)=0bv32, old(~#SSLv3_client_data~0!base)=0bv32, old(~#SSLv3_client_data~0!offset)=0bv32, old(~init~0)=0bv32, ~#SSLv3_client_data~0!base=0bv32, ~#SSLv3_client_data~0!offset=0bv32, ~init~0=0bv32] [?] #NULL := { base: 0bv32, offset: 0bv32 }; [?] #valid[0bv32] := 0bv1; [L1042] ~init~0 := 1bv32; [L1043] FCALL call ~#SSLv3_client_data~0 := #Ultimate.alloc(100bv32); [L1043] FCALL call write~init~intINTTYPE4(0bv32, { base: ~#SSLv3_client_data~0!base, offset: ~#SSLv3_client_data~0!offset }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(4bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(8bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(12bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(16bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(20bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(24bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(28bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(32bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(36bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(40bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(44bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(48bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(52bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(56bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(60bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(64bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(68bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(72bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(76bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(80bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(84bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(88bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(92bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(96bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); VAL [#NULL!base=0bv32, #NULL!offset=0bv32, old(#NULL!base)=0bv32, old(#NULL!offset)=0bv32, old(~#SSLv3_client_data~0!base)=0bv32, old(~#SSLv3_client_data~0!offset)=0bv32, old(~init~0)=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~init~0=1bv32] [?] RET call ULTIMATE.init(); VAL [#NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~init~0=1bv32] [?] CALL call #t~ret138 := main(); VAL [#NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~init~0=1bv32] [L1065] FCALL call #t~malloc3 := #Ultimate.alloc(248bv32); [L1065] ~s~0 := #t~malloc3; [L1069] FCALL call #t~malloc4 := #Ultimate.alloc(899bv32); [L1069] FCALL call write~$Pointer$(#t~malloc4, { base: ~s~0!base, offset: ~bvadd32(84bv32, ~s~0!offset) }, 4bv32); [L1070] FCALL call #t~malloc5 := #Ultimate.alloc(232bv32); [L1070] FCALL call write~$Pointer$(#t~malloc5, { base: ~s~0!base, offset: ~bvadd32(204bv32, ~s~0!offset) }, 4bv32); [L1071] FCALL call #t~malloc6 := #Ultimate.alloc(200bv32); [L1071] FCALL call write~$Pointer$(#t~malloc6, { base: ~s~0!base, offset: ~bvadd32(176bv32, ~s~0!offset) }, 4bv32); [L1072] FCALL call write~intINTTYPE4(12292bv32, { base: ~s~0!base, offset: ~bvadd32(52bv32, ~s~0!offset) }, 4bv32); [L1073] FCALL call write~intINTTYPE4(#t~nondet7, { base: ~s~0!base, offset: ~s~0!offset }, 4bv32); [L1073] havoc #t~nondet7; VAL [#NULL!base=0bv32, #NULL!offset=0bv32, #t~malloc3!base=33554433bv32, #t~malloc3!offset=0bv32, #t~malloc4!base=2147483650bv32, #t~malloc4!offset=0bv32, #t~malloc5!base=3bv32, #t~malloc5!offset=0bv32, #t~malloc6!base=2bv32, #t~malloc6!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~init~0=1bv32, ~s~0!base=33554433bv32, ~s~0!offset=0bv32] [L1074] CALL call #t~ret8 := ssl3_connect(~s~0); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~init~0=1bv32] [L1079-L1645] ~s := #in~s; [L1080] havoc ~buf~0; [L1081] havoc ~tmp~2; [L1082] havoc ~l~0; [L1083] havoc ~num1~0; [L1084] havoc ~cb~0; [L1085] havoc ~ret~0; [L1086] havoc ~new_state~0; [L1087] havoc ~state~0; [L1088] havoc ~skip~0; [L1089] ~tmp___0~1 := #t~nondet9; [L1089] havoc #t~nondet9; [L1090] ~tmp___1~0 := #t~nondet10; [L1090] havoc #t~nondet10; [L1091] ~tmp___2~0 := #t~nondet11; [L1091] havoc #t~nondet11; [L1092] ~tmp___3~0 := #t~nondet12; [L1092] havoc #t~nondet12; [L1093] ~tmp___4~0 := #t~nondet13; [L1093] havoc #t~nondet13; [L1094] ~tmp___5~0 := #t~nondet14; [L1094] havoc #t~nondet14; [L1095] ~tmp___6~0 := #t~nondet15; [L1095] havoc #t~nondet15; [L1096] ~tmp___7~0 := #t~nondet16; [L1096] havoc #t~nondet16; [L1097] ~tmp___8~0 := #t~nondet17; [L1097] havoc #t~nondet17; [L1098] ~tmp___9~0 := #t~nondet18; [L1098] havoc #t~nondet18; [L1099] havoc ~blastFlag~0; [L1102] ~blastFlag~0 := 0bv32; [L1103] FCALL call write~intINTTYPE4(#t~nondet19, { base: ~s!base, offset: ~bvadd32(92bv32, ~s!offset) }, 4bv32); [L1103] havoc #t~nondet19; [L1104] FCALL call write~intINTTYPE4(12292bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1105] ~tmp~2 := #t~nondet20; [L1105] havoc #t~nondet20; [L1106] ~cb~0 := { base: 0bv32, offset: 0bv32 }; [L1107] ~ret~0 := 4294967295bv32; [L1108] ~skip~0 := 0bv32; [L1109] FCALL call write~intINTTYPE4(0bv32, ~tmp___0~1, 4bv32); [L1110] FCALL call #t~mem21 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(192bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem21!base=0bv32, #t~mem21!offset=1bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=0bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1110] COND TRUE 0bv32 != ~bvadd32(#t~mem21!base, #t~mem21!offset) [L1110] havoc #t~mem21; [L1111] FCALL call #t~mem22 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(192bv32, ~s!offset) }, 4bv32); [L1111] ~cb~0 := #t~mem22; [L1111] havoc #t~mem22; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1119] FCALL call #t~mem27 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(28bv32, ~s!offset) }, 4bv32); [L1119] FCALL call write~intINTTYPE4(~bvadd32(1bv32, #t~mem27), { base: ~s!base, offset: ~bvadd32(28bv32, ~s!offset) }, 4bv32); [L1119] havoc #t~mem27; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1120-L1128] COND FALSE !(0bv32 != ~bvand32(12288bv32, ~tmp___1~0)) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] COND FALSE !(false) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] FCALL call #t~mem28 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] FCALL call #t~mem29 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem29=12292bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133] COND TRUE 12292bv32 == #t~mem29 [L1133] havoc #t~mem29; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1236] FCALL call write~intINTTYPE4(1bv32, { base: ~s!base, offset: ~bvadd32(40bv32, ~s!offset) }, 4bv32); [L1237] FCALL call write~intINTTYPE4(4096bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1238] FCALL call #t~mem62 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(204bv32, ~s!offset) }, 4bv32); [L1238] FCALL call #t~mem63 := read~intINTTYPE4({ base: #t~mem62!base, offset: ~bvadd32(64bv32, #t~mem62!offset) }, 4bv32); [L1238] FCALL call write~intINTTYPE4(~bvadd32(1bv32, #t~mem63), { base: #t~mem62!base, offset: ~bvadd32(64bv32, #t~mem62!offset) }, 4bv32); [L1238] havoc #t~mem62; [L1238] havoc #t~mem63; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1243] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(36bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1244] COND TRUE 0bv32 != ~bvadd32(~cb~0!base, ~cb~0!offset) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1249] FCALL call #t~mem64 := read~intINTTYPE4({ base: ~s!base, offset: ~s!offset }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem64=768bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1249] COND FALSE !(768bv32 != ~bvand32(65280bv32, #t~mem64)) [L1249] havoc #t~mem64; [L1255] FCALL call write~intINTTYPE4(4096bv32, { base: ~s!base, offset: ~bvadd32(4bv32, ~s!offset) }, 4bv32); [L1256] FCALL call #t~mem65 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(60bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem65!base=0bv32, #t~mem65!offset=1bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1256] COND FALSE !(0bv32 == ~bvadd32(#t~mem65!base, #t~mem65!offset)) [L1256] havoc #t~mem65; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1274] COND FALSE !(0bv32 == ~tmp___4~0) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1280] COND FALSE !(0bv32 == ~tmp___5~0) [L1286] FCALL call write~intINTTYPE4(4368bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1287] FCALL call #t~mem67 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(204bv32, ~s!offset) }, 4bv32); [L1287] FCALL call #t~mem68 := read~intINTTYPE4({ base: #t~mem67!base, offset: ~bvadd32(60bv32, #t~mem67!offset) }, 4bv32); [L1287] FCALL call write~intINTTYPE4(~bvadd32(1bv32, #t~mem68), { base: #t~mem67!base, offset: ~bvadd32(60bv32, #t~mem67!offset) }, 4bv32); [L1287] havoc #t~mem68; [L1287] havoc #t~mem67; [L1288] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(64bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] FCALL call #t~mem127 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(84bv32, ~s!offset) }, 4bv32); [L1602] FCALL call #t~mem128 := read~intINTTYPE4({ base: #t~mem127!base, offset: ~bvadd32(848bv32, #t~mem127!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem127!base=33554433bv32, #t~mem127!offset=4294966500bv32, #t~mem128=4368bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] COND FALSE !(0bv32 == #t~mem128) [L1602] havoc #t~mem127; [L1602] havoc #t~mem128; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1631] ~skip~0 := 0bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] COND FALSE !(false) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] FCALL call #t~mem28 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] FCALL call #t~mem29 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem29=4368bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133] COND FALSE !(12292bv32 == #t~mem29) [L1133] havoc #t~mem29; [L1136] FCALL call #t~mem30 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem30=4368bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1136] COND FALSE !(16384bv32 == #t~mem30) [L1136] havoc #t~mem30; [L1139] FCALL call #t~mem31 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem31=4368bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1139] COND FALSE !(4096bv32 == #t~mem31) [L1139] havoc #t~mem31; [L1142] FCALL call #t~mem32 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem32=4368bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1142] COND FALSE !(20480bv32 == #t~mem32) [L1142] havoc #t~mem32; [L1145] FCALL call #t~mem33 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem33=4368bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1145] COND FALSE !(4099bv32 == #t~mem33) [L1145] havoc #t~mem33; [L1148] FCALL call #t~mem34 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem34=4368bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1148] COND TRUE 4368bv32 == #t~mem34 [L1148] havoc #t~mem34; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1292] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(48bv32, ~s!offset) }, 4bv32); [L1293] ~ret~0 := #t~nondet69; [L1293] havoc #t~nondet69; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1294] COND TRUE 0bv32 == ~blastFlag~0 [L1295] ~blastFlag~0 := 1bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1299] COND FALSE !(~bvsle32(~ret~0, 0bv32)) [L1304] FCALL call write~intINTTYPE4(4384bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1305] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(64bv32, ~s!offset) }, 4bv32); [L1306] FCALL call #t~mem70 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(20bv32, ~s!offset) }, 4bv32); [L1306] FCALL call #t~mem71 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(16bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem70!base=1bv32, #t~mem70!offset=0bv32, #t~mem71!base=0bv32, #t~mem71!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1306] COND TRUE ~bvadd32(#t~mem70!base, #t~mem70!offset) != ~bvadd32(#t~mem71!base, #t~mem71!offset) [L1306] havoc #t~mem71; [L1306] havoc #t~mem70; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] FCALL call #t~mem127 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(84bv32, ~s!offset) }, 4bv32); [L1602] FCALL call #t~mem128 := read~intINTTYPE4({ base: #t~mem127!base, offset: ~bvadd32(848bv32, #t~mem127!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem127!base=33554433bv32, #t~mem127!offset=4294966500bv32, #t~mem128=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] COND FALSE !(0bv32 == #t~mem128) [L1602] havoc #t~mem127; [L1602] havoc #t~mem128; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1631] ~skip~0 := 0bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] COND FALSE !(false) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] FCALL call #t~mem28 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] FCALL call #t~mem29 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem29=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133] COND FALSE !(12292bv32 == #t~mem29) [L1133] havoc #t~mem29; [L1136] FCALL call #t~mem30 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem30=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1136] COND FALSE !(16384bv32 == #t~mem30) [L1136] havoc #t~mem30; [L1139] FCALL call #t~mem31 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem31=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1139] COND FALSE !(4096bv32 == #t~mem31) [L1139] havoc #t~mem31; [L1142] FCALL call #t~mem32 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem32=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1142] COND FALSE !(20480bv32 == #t~mem32) [L1142] havoc #t~mem32; [L1145] FCALL call #t~mem33 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem33=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1145] COND FALSE !(4099bv32 == #t~mem33) [L1145] havoc #t~mem33; [L1148] FCALL call #t~mem34 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem34=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1148] COND FALSE !(4368bv32 == #t~mem34) [L1148] havoc #t~mem34; [L1151] FCALL call #t~mem35 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem35=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1151] COND FALSE !(4369bv32 == #t~mem35) [L1151] havoc #t~mem35; [L1154] FCALL call #t~mem36 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem36=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1154] COND TRUE 4384bv32 == #t~mem36 [L1154] havoc #t~mem36; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1314] ~ret~0 := #t~nondet72; [L1314] havoc #t~nondet72; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1315] COND TRUE 1bv32 == ~blastFlag~0 [L1316] ~blastFlag~0 := 2bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1324] COND FALSE !(~bvsle32(~ret~0, 0bv32)) [L1329] FCALL call #t~mem73 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(92bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem73=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1329-L1333] COND FALSE !(0bv32 != #t~mem73) [L1329] havoc #t~mem73; [L1332] FCALL call write~intINTTYPE4(4400bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1334] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(64bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] FCALL call #t~mem127 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(84bv32, ~s!offset) }, 4bv32); [L1602] FCALL call #t~mem128 := read~intINTTYPE4({ base: #t~mem127!base, offset: ~bvadd32(848bv32, #t~mem127!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem127!base=33554433bv32, #t~mem127!offset=4294966500bv32, #t~mem128=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] COND FALSE !(0bv32 == #t~mem128) [L1602] havoc #t~mem127; [L1602] havoc #t~mem128; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1631] ~skip~0 := 0bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] COND FALSE !(false) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] FCALL call #t~mem28 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] FCALL call #t~mem29 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem29=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133] COND FALSE !(12292bv32 == #t~mem29) [L1133] havoc #t~mem29; [L1136] FCALL call #t~mem30 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem30=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1136] COND FALSE !(16384bv32 == #t~mem30) [L1136] havoc #t~mem30; [L1139] FCALL call #t~mem31 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem31=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1139] COND FALSE !(4096bv32 == #t~mem31) [L1139] havoc #t~mem31; [L1142] FCALL call #t~mem32 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem32=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1142] COND FALSE !(20480bv32 == #t~mem32) [L1142] havoc #t~mem32; [L1145] FCALL call #t~mem33 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem33=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1145] COND FALSE !(4099bv32 == #t~mem33) [L1145] havoc #t~mem33; [L1148] FCALL call #t~mem34 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem34=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1148] COND FALSE !(4368bv32 == #t~mem34) [L1148] havoc #t~mem34; [L1151] FCALL call #t~mem35 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem35=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1151] COND FALSE !(4369bv32 == #t~mem35) [L1151] havoc #t~mem35; [L1154] FCALL call #t~mem36 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem36=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1154] COND FALSE !(4384bv32 == #t~mem36) [L1154] havoc #t~mem36; [L1157] FCALL call #t~mem37 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem37=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1157] COND FALSE !(4385bv32 == #t~mem37) [L1157] havoc #t~mem37; [L1160] FCALL call #t~mem38 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem38=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1160] COND TRUE 4400bv32 == #t~mem38 [L1160] havoc #t~mem38; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1338] FCALL call #t~mem74 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(84bv32, ~s!offset) }, 4bv32); [L1338] FCALL call #t~mem75 := read~$Pointer$({ base: #t~mem74!base, offset: ~bvadd32(836bv32, #t~mem74!offset) }, 4bv32); [L1338] FCALL call #t~mem76 := read~intINTTYPE4({ base: #t~mem75!base, offset: ~bvadd32(12bv32, #t~mem75!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem74!base=33554433bv32, #t~mem74!offset=4294966500bv32, #t~mem75!base=33554433bv32, #t~mem75!offset=52bv32, #t~mem76=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1338-L1352] COND FALSE !(0bv32 != ~bvand32(256bv32, #t~mem76)) [L1338] havoc #t~mem76; [L1338] havoc #t~mem75; [L1338] havoc #t~mem74; [L1341] ~ret~0 := #t~nondet77; [L1341] havoc #t~nondet77; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1342] COND TRUE 2bv32 == ~blastFlag~0 [L1343] ~blastFlag~0 := 3bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1347] COND FALSE !(~bvsle32(~ret~0, 0bv32)) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1353] FCALL call write~intINTTYPE4(4416bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1354] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(64bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] FCALL call #t~mem127 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(84bv32, ~s!offset) }, 4bv32); [L1602] FCALL call #t~mem128 := read~intINTTYPE4({ base: #t~mem127!base, offset: ~bvadd32(848bv32, #t~mem127!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem127!base=33554433bv32, #t~mem127!offset=4294966500bv32, #t~mem128=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] COND FALSE !(0bv32 == #t~mem128) [L1602] havoc #t~mem127; [L1602] havoc #t~mem128; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1631] ~skip~0 := 0bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] COND FALSE !(false) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] FCALL call #t~mem28 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] FCALL call #t~mem29 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem29=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133] COND FALSE !(12292bv32 == #t~mem29) [L1133] havoc #t~mem29; [L1136] FCALL call #t~mem30 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem30=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1136] COND FALSE !(16384bv32 == #t~mem30) [L1136] havoc #t~mem30; [L1139] FCALL call #t~mem31 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem31=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1139] COND FALSE !(4096bv32 == #t~mem31) [L1139] havoc #t~mem31; [L1142] FCALL call #t~mem32 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem32=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1142] COND FALSE !(20480bv32 == #t~mem32) [L1142] havoc #t~mem32; [L1145] FCALL call #t~mem33 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem33=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1145] COND FALSE !(4099bv32 == #t~mem33) [L1145] havoc #t~mem33; [L1148] FCALL call #t~mem34 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem34=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1148] COND FALSE !(4368bv32 == #t~mem34) [L1148] havoc #t~mem34; [L1151] FCALL call #t~mem35 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem35=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1151] COND FALSE !(4369bv32 == #t~mem35) [L1151] havoc #t~mem35; [L1154] FCALL call #t~mem36 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem36=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1154] COND FALSE !(4384bv32 == #t~mem36) [L1154] havoc #t~mem36; [L1157] FCALL call #t~mem37 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem37=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1157] COND FALSE !(4385bv32 == #t~mem37) [L1157] havoc #t~mem37; [L1160] FCALL call #t~mem38 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem38=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1160] COND FALSE !(4400bv32 == #t~mem38) [L1160] havoc #t~mem38; [L1163] FCALL call #t~mem39 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem39=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1163] COND FALSE !(4401bv32 == #t~mem39) [L1163] havoc #t~mem39; [L1166] FCALL call #t~mem40 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem40=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1166] COND TRUE 4416bv32 == #t~mem40 [L1166] havoc #t~mem40; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1358] ~ret~0 := #t~nondet78; [L1358] havoc #t~nondet78; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1359] COND TRUE 3bv32 == ~blastFlag~0 [L1360] ~blastFlag~0 := 4bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1364] COND FALSE !(~bvsle32(~ret~0, 0bv32)) [L1369] FCALL call write~intINTTYPE4(4432bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1370] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(64bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1371] COND FALSE !(0bv32 == ~tmp___6~0) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] FCALL call #t~mem127 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(84bv32, ~s!offset) }, 4bv32); [L1602] FCALL call #t~mem128 := read~intINTTYPE4({ base: #t~mem127!base, offset: ~bvadd32(848bv32, #t~mem127!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem127!base=33554433bv32, #t~mem127!offset=4294966500bv32, #t~mem128=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] COND FALSE !(0bv32 == #t~mem128) [L1602] havoc #t~mem127; [L1602] havoc #t~mem128; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1631] ~skip~0 := 0bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] COND FALSE !(false) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] FCALL call #t~mem28 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] FCALL call #t~mem29 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem29=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133] COND FALSE !(12292bv32 == #t~mem29) [L1133] havoc #t~mem29; [L1136] FCALL call #t~mem30 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem30=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1136] COND FALSE !(16384bv32 == #t~mem30) [L1136] havoc #t~mem30; [L1139] FCALL call #t~mem31 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem31=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1139] COND FALSE !(4096bv32 == #t~mem31) [L1139] havoc #t~mem31; [L1142] FCALL call #t~mem32 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem32=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1142] COND FALSE !(20480bv32 == #t~mem32) [L1142] havoc #t~mem32; [L1145] FCALL call #t~mem33 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem33=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1145] COND FALSE !(4099bv32 == #t~mem33) [L1145] havoc #t~mem33; [L1148] FCALL call #t~mem34 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem34=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1148] COND FALSE !(4368bv32 == #t~mem34) [L1148] havoc #t~mem34; [L1151] FCALL call #t~mem35 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem35=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1151] COND FALSE !(4369bv32 == #t~mem35) [L1151] havoc #t~mem35; [L1154] FCALL call #t~mem36 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem36=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1154] COND FALSE !(4384bv32 == #t~mem36) [L1154] havoc #t~mem36; [L1157] FCALL call #t~mem37 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem37=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1157] COND FALSE !(4385bv32 == #t~mem37) [L1157] havoc #t~mem37; [L1160] FCALL call #t~mem38 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem38=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1160] COND FALSE !(4400bv32 == #t~mem38) [L1160] havoc #t~mem38; [L1163] FCALL call #t~mem39 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem39=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1163] COND FALSE !(4401bv32 == #t~mem39) [L1163] havoc #t~mem39; [L1166] FCALL call #t~mem40 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem40=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1166] COND FALSE !(4416bv32 == #t~mem40) [L1166] havoc #t~mem40; [L1169] FCALL call #t~mem41 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem41=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1169] COND FALSE !(4417bv32 == #t~mem41) [L1169] havoc #t~mem41; [L1172] FCALL call #t~mem42 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem42=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1172] COND TRUE 4432bv32 == #t~mem42 [L1172] havoc #t~mem42; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1380] ~ret~0 := #t~nondet79; [L1380] havoc #t~nondet79; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=0bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1381] COND TRUE 4bv32 == ~blastFlag~0 VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=0bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1643] assert false; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=0bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [?] CALL call ULTIMATE.init(); VAL [#NULL!base=0bv32, #NULL!offset=0bv32, old(#NULL!base)=0bv32, old(#NULL!offset)=0bv32, old(~#SSLv3_client_data~0!base)=0bv32, old(~#SSLv3_client_data~0!offset)=0bv32, old(~init~0)=0bv32, ~#SSLv3_client_data~0!base=0bv32, ~#SSLv3_client_data~0!offset=0bv32, ~init~0=0bv32] [?] #NULL := { base: 0bv32, offset: 0bv32 }; [?] #valid[0bv32] := 0bv1; [L1042] ~init~0 := 1bv32; [L1043] FCALL call ~#SSLv3_client_data~0 := #Ultimate.alloc(100bv32); [L1043] FCALL call write~init~intINTTYPE4(0bv32, { base: ~#SSLv3_client_data~0!base, offset: ~#SSLv3_client_data~0!offset }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(4bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(8bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(12bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(16bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(20bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(24bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(28bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(32bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(36bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(40bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(44bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(48bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(52bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(56bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(60bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(64bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(68bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(72bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(76bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(80bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(84bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(88bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(92bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(96bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); VAL [#NULL!base=0bv32, #NULL!offset=0bv32, old(#NULL!base)=0bv32, old(#NULL!offset)=0bv32, old(~#SSLv3_client_data~0!base)=0bv32, old(~#SSLv3_client_data~0!offset)=0bv32, old(~init~0)=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~init~0=1bv32] [?] RET call ULTIMATE.init(); VAL [#NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~init~0=1bv32] [?] CALL call #t~ret138 := main(); VAL [#NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~init~0=1bv32] [L1065] FCALL call #t~malloc3 := #Ultimate.alloc(248bv32); [L1065] ~s~0 := #t~malloc3; [L1069] FCALL call #t~malloc4 := #Ultimate.alloc(899bv32); [L1069] FCALL call write~$Pointer$(#t~malloc4, { base: ~s~0!base, offset: ~bvadd32(84bv32, ~s~0!offset) }, 4bv32); [L1070] FCALL call #t~malloc5 := #Ultimate.alloc(232bv32); [L1070] FCALL call write~$Pointer$(#t~malloc5, { base: ~s~0!base, offset: ~bvadd32(204bv32, ~s~0!offset) }, 4bv32); [L1071] FCALL call #t~malloc6 := #Ultimate.alloc(200bv32); [L1071] FCALL call write~$Pointer$(#t~malloc6, { base: ~s~0!base, offset: ~bvadd32(176bv32, ~s~0!offset) }, 4bv32); [L1072] FCALL call write~intINTTYPE4(12292bv32, { base: ~s~0!base, offset: ~bvadd32(52bv32, ~s~0!offset) }, 4bv32); [L1073] FCALL call write~intINTTYPE4(#t~nondet7, { base: ~s~0!base, offset: ~s~0!offset }, 4bv32); [L1073] havoc #t~nondet7; VAL [#NULL!base=0bv32, #NULL!offset=0bv32, #t~malloc3!base=33554433bv32, #t~malloc3!offset=0bv32, #t~malloc4!base=2147483650bv32, #t~malloc4!offset=0bv32, #t~malloc5!base=3bv32, #t~malloc5!offset=0bv32, #t~malloc6!base=2bv32, #t~malloc6!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~init~0=1bv32, ~s~0!base=33554433bv32, ~s~0!offset=0bv32] [L1074] CALL call #t~ret8 := ssl3_connect(~s~0); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~init~0=1bv32] [L1079-L1645] ~s := #in~s; [L1080] havoc ~buf~0; [L1081] havoc ~tmp~2; [L1082] havoc ~l~0; [L1083] havoc ~num1~0; [L1084] havoc ~cb~0; [L1085] havoc ~ret~0; [L1086] havoc ~new_state~0; [L1087] havoc ~state~0; [L1088] havoc ~skip~0; [L1089] ~tmp___0~1 := #t~nondet9; [L1089] havoc #t~nondet9; [L1090] ~tmp___1~0 := #t~nondet10; [L1090] havoc #t~nondet10; [L1091] ~tmp___2~0 := #t~nondet11; [L1091] havoc #t~nondet11; [L1092] ~tmp___3~0 := #t~nondet12; [L1092] havoc #t~nondet12; [L1093] ~tmp___4~0 := #t~nondet13; [L1093] havoc #t~nondet13; [L1094] ~tmp___5~0 := #t~nondet14; [L1094] havoc #t~nondet14; [L1095] ~tmp___6~0 := #t~nondet15; [L1095] havoc #t~nondet15; [L1096] ~tmp___7~0 := #t~nondet16; [L1096] havoc #t~nondet16; [L1097] ~tmp___8~0 := #t~nondet17; [L1097] havoc #t~nondet17; [L1098] ~tmp___9~0 := #t~nondet18; [L1098] havoc #t~nondet18; [L1099] havoc ~blastFlag~0; [L1102] ~blastFlag~0 := 0bv32; [L1103] FCALL call write~intINTTYPE4(#t~nondet19, { base: ~s!base, offset: ~bvadd32(92bv32, ~s!offset) }, 4bv32); [L1103] havoc #t~nondet19; [L1104] FCALL call write~intINTTYPE4(12292bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1105] ~tmp~2 := #t~nondet20; [L1105] havoc #t~nondet20; [L1106] ~cb~0 := { base: 0bv32, offset: 0bv32 }; [L1107] ~ret~0 := 4294967295bv32; [L1108] ~skip~0 := 0bv32; [L1109] FCALL call write~intINTTYPE4(0bv32, ~tmp___0~1, 4bv32); [L1110] FCALL call #t~mem21 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(192bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem21!base=0bv32, #t~mem21!offset=1bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=0bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1110] COND TRUE 0bv32 != ~bvadd32(#t~mem21!base, #t~mem21!offset) [L1110] havoc #t~mem21; [L1111] FCALL call #t~mem22 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(192bv32, ~s!offset) }, 4bv32); [L1111] ~cb~0 := #t~mem22; [L1111] havoc #t~mem22; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1119] FCALL call #t~mem27 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(28bv32, ~s!offset) }, 4bv32); [L1119] FCALL call write~intINTTYPE4(~bvadd32(1bv32, #t~mem27), { base: ~s!base, offset: ~bvadd32(28bv32, ~s!offset) }, 4bv32); [L1119] havoc #t~mem27; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1120-L1128] COND FALSE !(0bv32 != ~bvand32(12288bv32, ~tmp___1~0)) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] COND FALSE !(false) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] FCALL call #t~mem28 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] FCALL call #t~mem29 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem29=12292bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133] COND TRUE 12292bv32 == #t~mem29 [L1133] havoc #t~mem29; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1236] FCALL call write~intINTTYPE4(1bv32, { base: ~s!base, offset: ~bvadd32(40bv32, ~s!offset) }, 4bv32); [L1237] FCALL call write~intINTTYPE4(4096bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1238] FCALL call #t~mem62 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(204bv32, ~s!offset) }, 4bv32); [L1238] FCALL call #t~mem63 := read~intINTTYPE4({ base: #t~mem62!base, offset: ~bvadd32(64bv32, #t~mem62!offset) }, 4bv32); [L1238] FCALL call write~intINTTYPE4(~bvadd32(1bv32, #t~mem63), { base: #t~mem62!base, offset: ~bvadd32(64bv32, #t~mem62!offset) }, 4bv32); [L1238] havoc #t~mem62; [L1238] havoc #t~mem63; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1243] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(36bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1244] COND TRUE 0bv32 != ~bvadd32(~cb~0!base, ~cb~0!offset) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1249] FCALL call #t~mem64 := read~intINTTYPE4({ base: ~s!base, offset: ~s!offset }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem64=768bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1249] COND FALSE !(768bv32 != ~bvand32(65280bv32, #t~mem64)) [L1249] havoc #t~mem64; [L1255] FCALL call write~intINTTYPE4(4096bv32, { base: ~s!base, offset: ~bvadd32(4bv32, ~s!offset) }, 4bv32); [L1256] FCALL call #t~mem65 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(60bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem65!base=0bv32, #t~mem65!offset=1bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1256] COND FALSE !(0bv32 == ~bvadd32(#t~mem65!base, #t~mem65!offset)) [L1256] havoc #t~mem65; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1274] COND FALSE !(0bv32 == ~tmp___4~0) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1280] COND FALSE !(0bv32 == ~tmp___5~0) [L1286] FCALL call write~intINTTYPE4(4368bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1287] FCALL call #t~mem67 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(204bv32, ~s!offset) }, 4bv32); [L1287] FCALL call #t~mem68 := read~intINTTYPE4({ base: #t~mem67!base, offset: ~bvadd32(60bv32, #t~mem67!offset) }, 4bv32); [L1287] FCALL call write~intINTTYPE4(~bvadd32(1bv32, #t~mem68), { base: #t~mem67!base, offset: ~bvadd32(60bv32, #t~mem67!offset) }, 4bv32); [L1287] havoc #t~mem68; [L1287] havoc #t~mem67; [L1288] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(64bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] FCALL call #t~mem127 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(84bv32, ~s!offset) }, 4bv32); [L1602] FCALL call #t~mem128 := read~intINTTYPE4({ base: #t~mem127!base, offset: ~bvadd32(848bv32, #t~mem127!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem127!base=33554433bv32, #t~mem127!offset=4294966500bv32, #t~mem128=4368bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] COND FALSE !(0bv32 == #t~mem128) [L1602] havoc #t~mem127; [L1602] havoc #t~mem128; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1631] ~skip~0 := 0bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] COND FALSE !(false) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] FCALL call #t~mem28 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] FCALL call #t~mem29 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem29=4368bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133] COND FALSE !(12292bv32 == #t~mem29) [L1133] havoc #t~mem29; [L1136] FCALL call #t~mem30 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem30=4368bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1136] COND FALSE !(16384bv32 == #t~mem30) [L1136] havoc #t~mem30; [L1139] FCALL call #t~mem31 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem31=4368bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1139] COND FALSE !(4096bv32 == #t~mem31) [L1139] havoc #t~mem31; [L1142] FCALL call #t~mem32 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem32=4368bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1142] COND FALSE !(20480bv32 == #t~mem32) [L1142] havoc #t~mem32; [L1145] FCALL call #t~mem33 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem33=4368bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1145] COND FALSE !(4099bv32 == #t~mem33) [L1145] havoc #t~mem33; [L1148] FCALL call #t~mem34 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem34=4368bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1148] COND TRUE 4368bv32 == #t~mem34 [L1148] havoc #t~mem34; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1292] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(48bv32, ~s!offset) }, 4bv32); [L1293] ~ret~0 := #t~nondet69; [L1293] havoc #t~nondet69; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1294] COND TRUE 0bv32 == ~blastFlag~0 [L1295] ~blastFlag~0 := 1bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1299] COND FALSE !(~bvsle32(~ret~0, 0bv32)) [L1304] FCALL call write~intINTTYPE4(4384bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1305] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(64bv32, ~s!offset) }, 4bv32); [L1306] FCALL call #t~mem70 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(20bv32, ~s!offset) }, 4bv32); [L1306] FCALL call #t~mem71 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(16bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem70!base=1bv32, #t~mem70!offset=0bv32, #t~mem71!base=0bv32, #t~mem71!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1306] COND TRUE ~bvadd32(#t~mem70!base, #t~mem70!offset) != ~bvadd32(#t~mem71!base, #t~mem71!offset) [L1306] havoc #t~mem71; [L1306] havoc #t~mem70; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] FCALL call #t~mem127 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(84bv32, ~s!offset) }, 4bv32); [L1602] FCALL call #t~mem128 := read~intINTTYPE4({ base: #t~mem127!base, offset: ~bvadd32(848bv32, #t~mem127!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem127!base=33554433bv32, #t~mem127!offset=4294966500bv32, #t~mem128=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] COND FALSE !(0bv32 == #t~mem128) [L1602] havoc #t~mem127; [L1602] havoc #t~mem128; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1631] ~skip~0 := 0bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] COND FALSE !(false) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] FCALL call #t~mem28 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] FCALL call #t~mem29 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem29=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133] COND FALSE !(12292bv32 == #t~mem29) [L1133] havoc #t~mem29; [L1136] FCALL call #t~mem30 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem30=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1136] COND FALSE !(16384bv32 == #t~mem30) [L1136] havoc #t~mem30; [L1139] FCALL call #t~mem31 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem31=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1139] COND FALSE !(4096bv32 == #t~mem31) [L1139] havoc #t~mem31; [L1142] FCALL call #t~mem32 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem32=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1142] COND FALSE !(20480bv32 == #t~mem32) [L1142] havoc #t~mem32; [L1145] FCALL call #t~mem33 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem33=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1145] COND FALSE !(4099bv32 == #t~mem33) [L1145] havoc #t~mem33; [L1148] FCALL call #t~mem34 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem34=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1148] COND FALSE !(4368bv32 == #t~mem34) [L1148] havoc #t~mem34; [L1151] FCALL call #t~mem35 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem35=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1151] COND FALSE !(4369bv32 == #t~mem35) [L1151] havoc #t~mem35; [L1154] FCALL call #t~mem36 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem36=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1154] COND TRUE 4384bv32 == #t~mem36 [L1154] havoc #t~mem36; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1314] ~ret~0 := #t~nondet72; [L1314] havoc #t~nondet72; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1315] COND TRUE 1bv32 == ~blastFlag~0 [L1316] ~blastFlag~0 := 2bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1324] COND FALSE !(~bvsle32(~ret~0, 0bv32)) [L1329] FCALL call #t~mem73 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(92bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem73=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1329-L1333] COND FALSE !(0bv32 != #t~mem73) [L1329] havoc #t~mem73; [L1332] FCALL call write~intINTTYPE4(4400bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1334] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(64bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] FCALL call #t~mem127 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(84bv32, ~s!offset) }, 4bv32); [L1602] FCALL call #t~mem128 := read~intINTTYPE4({ base: #t~mem127!base, offset: ~bvadd32(848bv32, #t~mem127!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem127!base=33554433bv32, #t~mem127!offset=4294966500bv32, #t~mem128=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] COND FALSE !(0bv32 == #t~mem128) [L1602] havoc #t~mem127; [L1602] havoc #t~mem128; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1631] ~skip~0 := 0bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] COND FALSE !(false) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] FCALL call #t~mem28 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] FCALL call #t~mem29 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem29=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133] COND FALSE !(12292bv32 == #t~mem29) [L1133] havoc #t~mem29; [L1136] FCALL call #t~mem30 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem30=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1136] COND FALSE !(16384bv32 == #t~mem30) [L1136] havoc #t~mem30; [L1139] FCALL call #t~mem31 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem31=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1139] COND FALSE !(4096bv32 == #t~mem31) [L1139] havoc #t~mem31; [L1142] FCALL call #t~mem32 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem32=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1142] COND FALSE !(20480bv32 == #t~mem32) [L1142] havoc #t~mem32; [L1145] FCALL call #t~mem33 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem33=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1145] COND FALSE !(4099bv32 == #t~mem33) [L1145] havoc #t~mem33; [L1148] FCALL call #t~mem34 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem34=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1148] COND FALSE !(4368bv32 == #t~mem34) [L1148] havoc #t~mem34; [L1151] FCALL call #t~mem35 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem35=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1151] COND FALSE !(4369bv32 == #t~mem35) [L1151] havoc #t~mem35; [L1154] FCALL call #t~mem36 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem36=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1154] COND FALSE !(4384bv32 == #t~mem36) [L1154] havoc #t~mem36; [L1157] FCALL call #t~mem37 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem37=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1157] COND FALSE !(4385bv32 == #t~mem37) [L1157] havoc #t~mem37; [L1160] FCALL call #t~mem38 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem38=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1160] COND TRUE 4400bv32 == #t~mem38 [L1160] havoc #t~mem38; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1338] FCALL call #t~mem74 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(84bv32, ~s!offset) }, 4bv32); [L1338] FCALL call #t~mem75 := read~$Pointer$({ base: #t~mem74!base, offset: ~bvadd32(836bv32, #t~mem74!offset) }, 4bv32); [L1338] FCALL call #t~mem76 := read~intINTTYPE4({ base: #t~mem75!base, offset: ~bvadd32(12bv32, #t~mem75!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem74!base=33554433bv32, #t~mem74!offset=4294966500bv32, #t~mem75!base=33554433bv32, #t~mem75!offset=52bv32, #t~mem76=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1338-L1352] COND FALSE !(0bv32 != ~bvand32(256bv32, #t~mem76)) [L1338] havoc #t~mem76; [L1338] havoc #t~mem75; [L1338] havoc #t~mem74; [L1341] ~ret~0 := #t~nondet77; [L1341] havoc #t~nondet77; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1342] COND TRUE 2bv32 == ~blastFlag~0 [L1343] ~blastFlag~0 := 3bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1347] COND FALSE !(~bvsle32(~ret~0, 0bv32)) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1353] FCALL call write~intINTTYPE4(4416bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1354] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(64bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] FCALL call #t~mem127 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(84bv32, ~s!offset) }, 4bv32); [L1602] FCALL call #t~mem128 := read~intINTTYPE4({ base: #t~mem127!base, offset: ~bvadd32(848bv32, #t~mem127!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem127!base=33554433bv32, #t~mem127!offset=4294966500bv32, #t~mem128=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] COND FALSE !(0bv32 == #t~mem128) [L1602] havoc #t~mem127; [L1602] havoc #t~mem128; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1631] ~skip~0 := 0bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] COND FALSE !(false) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] FCALL call #t~mem28 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] FCALL call #t~mem29 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem29=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133] COND FALSE !(12292bv32 == #t~mem29) [L1133] havoc #t~mem29; [L1136] FCALL call #t~mem30 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem30=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1136] COND FALSE !(16384bv32 == #t~mem30) [L1136] havoc #t~mem30; [L1139] FCALL call #t~mem31 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem31=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1139] COND FALSE !(4096bv32 == #t~mem31) [L1139] havoc #t~mem31; [L1142] FCALL call #t~mem32 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem32=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1142] COND FALSE !(20480bv32 == #t~mem32) [L1142] havoc #t~mem32; [L1145] FCALL call #t~mem33 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem33=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1145] COND FALSE !(4099bv32 == #t~mem33) [L1145] havoc #t~mem33; [L1148] FCALL call #t~mem34 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem34=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1148] COND FALSE !(4368bv32 == #t~mem34) [L1148] havoc #t~mem34; [L1151] FCALL call #t~mem35 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem35=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1151] COND FALSE !(4369bv32 == #t~mem35) [L1151] havoc #t~mem35; [L1154] FCALL call #t~mem36 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem36=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1154] COND FALSE !(4384bv32 == #t~mem36) [L1154] havoc #t~mem36; [L1157] FCALL call #t~mem37 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem37=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1157] COND FALSE !(4385bv32 == #t~mem37) [L1157] havoc #t~mem37; [L1160] FCALL call #t~mem38 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem38=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1160] COND FALSE !(4400bv32 == #t~mem38) [L1160] havoc #t~mem38; [L1163] FCALL call #t~mem39 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem39=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1163] COND FALSE !(4401bv32 == #t~mem39) [L1163] havoc #t~mem39; [L1166] FCALL call #t~mem40 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem40=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1166] COND TRUE 4416bv32 == #t~mem40 [L1166] havoc #t~mem40; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1358] ~ret~0 := #t~nondet78; [L1358] havoc #t~nondet78; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1359] COND TRUE 3bv32 == ~blastFlag~0 [L1360] ~blastFlag~0 := 4bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1364] COND FALSE !(~bvsle32(~ret~0, 0bv32)) [L1369] FCALL call write~intINTTYPE4(4432bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1370] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(64bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1371] COND FALSE !(0bv32 == ~tmp___6~0) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] FCALL call #t~mem127 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(84bv32, ~s!offset) }, 4bv32); [L1602] FCALL call #t~mem128 := read~intINTTYPE4({ base: #t~mem127!base, offset: ~bvadd32(848bv32, #t~mem127!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem127!base=33554433bv32, #t~mem127!offset=4294966500bv32, #t~mem128=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] COND FALSE !(0bv32 == #t~mem128) [L1602] havoc #t~mem127; [L1602] havoc #t~mem128; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1631] ~skip~0 := 0bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] COND FALSE !(false) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] FCALL call #t~mem28 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] FCALL call #t~mem29 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem29=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133] COND FALSE !(12292bv32 == #t~mem29) [L1133] havoc #t~mem29; [L1136] FCALL call #t~mem30 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem30=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1136] COND FALSE !(16384bv32 == #t~mem30) [L1136] havoc #t~mem30; [L1139] FCALL call #t~mem31 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem31=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1139] COND FALSE !(4096bv32 == #t~mem31) [L1139] havoc #t~mem31; [L1142] FCALL call #t~mem32 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem32=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1142] COND FALSE !(20480bv32 == #t~mem32) [L1142] havoc #t~mem32; [L1145] FCALL call #t~mem33 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem33=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1145] COND FALSE !(4099bv32 == #t~mem33) [L1145] havoc #t~mem33; [L1148] FCALL call #t~mem34 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem34=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1148] COND FALSE !(4368bv32 == #t~mem34) [L1148] havoc #t~mem34; [L1151] FCALL call #t~mem35 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem35=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1151] COND FALSE !(4369bv32 == #t~mem35) [L1151] havoc #t~mem35; [L1154] FCALL call #t~mem36 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem36=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1154] COND FALSE !(4384bv32 == #t~mem36) [L1154] havoc #t~mem36; [L1157] FCALL call #t~mem37 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem37=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1157] COND FALSE !(4385bv32 == #t~mem37) [L1157] havoc #t~mem37; [L1160] FCALL call #t~mem38 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem38=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1160] COND FALSE !(4400bv32 == #t~mem38) [L1160] havoc #t~mem38; [L1163] FCALL call #t~mem39 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem39=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1163] COND FALSE !(4401bv32 == #t~mem39) [L1163] havoc #t~mem39; [L1166] FCALL call #t~mem40 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem40=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1166] COND FALSE !(4416bv32 == #t~mem40) [L1166] havoc #t~mem40; [L1169] FCALL call #t~mem41 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem41=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1169] COND FALSE !(4417bv32 == #t~mem41) [L1169] havoc #t~mem41; [L1172] FCALL call #t~mem42 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem42=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1172] COND TRUE 4432bv32 == #t~mem42 [L1172] havoc #t~mem42; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1380] ~ret~0 := #t~nondet79; [L1380] havoc #t~nondet79; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=0bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1381] COND TRUE 4bv32 == ~blastFlag~0 VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=0bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1643] assert false; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=0bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] ----- [2018-11-23 11:00:34,228 WARN L1272 BoogieBacktranslator]: Unfinished Backtranslation: BitvecLiteral 0bv32 could not be translated for associated CType STRUCT~~ssl_method_st?version~INT?ssl_new~*((*~SSL~0 ) : INT)?ssl_clear~*((*~SSL~0 ) : VOID)?ssl_free~*((*~SSL~0 ) : VOID)?ssl_accept~*((*~SSL~0 ) : INT)?ssl_connect~*((*~SSL~0 ) : INT)?ssl_read~*((*~SSL~0 *VOID INT ) : INT)?ssl_peek~*((*~SSL~0 *VOID INT ) : INT)?ssl_write~*((*~SSL~0 *VOID INT ) : INT)?ssl_shutdown~*((*~SSL~0 ) : INT)?ssl_renegotiate~*((*~SSL~0 ) : INT)?ssl_renegotiate_check~*((*~SSL~0 ) : INT)?ssl_ctrl~*((*~SSL~0 INT LONG *CHAR ) : LONG)?ssl_ctx_ctrl~*((*~SSL_CTX~0 INT LONG *CHAR ) : LONG)?get_cipher_by_char~*((*UCHAR ) : *~SSL_CIPHER~0)?put_cipher_by_char~*((*~SSL_CIPHER~0 *UCHAR ) : INT)?ssl_pending~*((*~SSL~0 ) : INT)?num_ciphers~*(() : INT)?get_cipher~*((UINT ) : *~SSL_CIPHER~0)?get_ssl_method~*((INT ) : *ssl_method_st)?get_timeout~*(() : LONG)?ssl3_enc~*ssl3_enc_method?ssl_version~*(() : INT)?ssl_callback_ctrl~*((*~SSL~0 INT *(() : VOID) ) : LONG)?ssl_ctx_callback_ctrl~*((*~SSL_CTX~0 INT *(() : VOID) ) : LONG)# [2018-11-23 11:00:34,229 WARN L1272 BoogieBacktranslator]: Unfinished Backtranslation: BitvecLiteral 0bv32 could not be translated for associated CType STRUCT~~ssl_method_st?version~INT?ssl_new~*((*~SSL~0 ) : INT)?ssl_clear~*((*~SSL~0 ) : VOID)?ssl_free~*((*~SSL~0 ) : VOID)?ssl_accept~*((*~SSL~0 ) : INT)?ssl_connect~*((*~SSL~0 ) : INT)?ssl_read~*((*~SSL~0 *VOID INT ) : INT)?ssl_peek~*((*~SSL~0 *VOID INT ) : INT)?ssl_write~*((*~SSL~0 *VOID INT ) : INT)?ssl_shutdown~*((*~SSL~0 ) : INT)?ssl_renegotiate~*((*~SSL~0 ) : INT)?ssl_renegotiate_check~*((*~SSL~0 ) : INT)?ssl_ctrl~*((*~SSL~0 INT LONG *CHAR ) : LONG)?ssl_ctx_ctrl~*((*~SSL_CTX~0 INT LONG *CHAR ) : LONG)?get_cipher_by_char~*((*UCHAR ) : *~SSL_CIPHER~0)?put_cipher_by_char~*((*~SSL_CIPHER~0 *UCHAR ) : INT)?ssl_pending~*((*~SSL~0 ) : INT)?num_ciphers~*(() : INT)?get_cipher~*((UINT ) : *~SSL_CIPHER~0)?get_ssl_method~*((INT ) : *ssl_method_st)?get_timeout~*(() : LONG)?ssl3_enc~*ssl3_enc_method?ssl_version~*(() : INT)?ssl_callback_ctrl~*((*~SSL~0 INT *(() : VOID) ) : LONG)?ssl_ctx_callback_ctrl~*((*~SSL_CTX~0 INT *(() : VOID) ) : LONG)# ----- class de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator.CACSL2BoogieBacktranslator [?] CALL call ULTIMATE.init(); VAL [#NULL!base=0bv32, #NULL!offset=0bv32, old(#NULL!base)=0bv32, old(#NULL!offset)=0bv32, old(~#SSLv3_client_data~0!base)=0bv32, old(~#SSLv3_client_data~0!offset)=0bv32, old(~init~0)=0bv32, ~#SSLv3_client_data~0!base=0bv32, ~#SSLv3_client_data~0!offset=0bv32, ~init~0=0bv32] [?] #NULL := { base: 0bv32, offset: 0bv32 }; [?] #valid[0bv32] := 0bv1; [L1042] ~init~0 := 1bv32; [L1043] FCALL call ~#SSLv3_client_data~0 := #Ultimate.alloc(100bv32); [L1043] FCALL call write~init~intINTTYPE4(0bv32, { base: ~#SSLv3_client_data~0!base, offset: ~#SSLv3_client_data~0!offset }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(4bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(8bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(12bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(16bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(20bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(24bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(28bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(32bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(36bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(40bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(44bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(48bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(52bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(56bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(60bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(64bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(68bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(72bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(76bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(80bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(84bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(88bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(92bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(96bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); VAL [#NULL!base=0bv32, #NULL!offset=0bv32, old(#NULL!base)=0bv32, old(#NULL!offset)=0bv32, old(~#SSLv3_client_data~0!base)=0bv32, old(~#SSLv3_client_data~0!offset)=0bv32, old(~init~0)=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~init~0=1bv32] [?] RET call ULTIMATE.init(); VAL [#NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~init~0=1bv32] [?] CALL call #t~ret138 := main(); VAL [#NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~init~0=1bv32] [L1065] FCALL call #t~malloc3 := #Ultimate.alloc(248bv32); [L1065] ~s~0 := #t~malloc3; [L1069] FCALL call #t~malloc4 := #Ultimate.alloc(899bv32); [L1069] FCALL call write~$Pointer$(#t~malloc4, { base: ~s~0!base, offset: ~bvadd32(84bv32, ~s~0!offset) }, 4bv32); [L1070] FCALL call #t~malloc5 := #Ultimate.alloc(232bv32); [L1070] FCALL call write~$Pointer$(#t~malloc5, { base: ~s~0!base, offset: ~bvadd32(204bv32, ~s~0!offset) }, 4bv32); [L1071] FCALL call #t~malloc6 := #Ultimate.alloc(200bv32); [L1071] FCALL call write~$Pointer$(#t~malloc6, { base: ~s~0!base, offset: ~bvadd32(176bv32, ~s~0!offset) }, 4bv32); [L1072] FCALL call write~intINTTYPE4(12292bv32, { base: ~s~0!base, offset: ~bvadd32(52bv32, ~s~0!offset) }, 4bv32); [L1073] FCALL call write~intINTTYPE4(#t~nondet7, { base: ~s~0!base, offset: ~s~0!offset }, 4bv32); [L1073] havoc #t~nondet7; VAL [#NULL!base=0bv32, #NULL!offset=0bv32, #t~malloc3!base=33554433bv32, #t~malloc3!offset=0bv32, #t~malloc4!base=2147483650bv32, #t~malloc4!offset=0bv32, #t~malloc5!base=3bv32, #t~malloc5!offset=0bv32, #t~malloc6!base=2bv32, #t~malloc6!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~init~0=1bv32, ~s~0!base=33554433bv32, ~s~0!offset=0bv32] [L1074] CALL call #t~ret8 := ssl3_connect(~s~0); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~init~0=1bv32] [L1079-L1645] ~s := #in~s; [L1080] havoc ~buf~0; [L1081] havoc ~tmp~2; [L1082] havoc ~l~0; [L1083] havoc ~num1~0; [L1084] havoc ~cb~0; [L1085] havoc ~ret~0; [L1086] havoc ~new_state~0; [L1087] havoc ~state~0; [L1088] havoc ~skip~0; [L1089] ~tmp___0~1 := #t~nondet9; [L1089] havoc #t~nondet9; [L1090] ~tmp___1~0 := #t~nondet10; [L1090] havoc #t~nondet10; [L1091] ~tmp___2~0 := #t~nondet11; [L1091] havoc #t~nondet11; [L1092] ~tmp___3~0 := #t~nondet12; [L1092] havoc #t~nondet12; [L1093] ~tmp___4~0 := #t~nondet13; [L1093] havoc #t~nondet13; [L1094] ~tmp___5~0 := #t~nondet14; [L1094] havoc #t~nondet14; [L1095] ~tmp___6~0 := #t~nondet15; [L1095] havoc #t~nondet15; [L1096] ~tmp___7~0 := #t~nondet16; [L1096] havoc #t~nondet16; [L1097] ~tmp___8~0 := #t~nondet17; [L1097] havoc #t~nondet17; [L1098] ~tmp___9~0 := #t~nondet18; [L1098] havoc #t~nondet18; [L1099] havoc ~blastFlag~0; [L1102] ~blastFlag~0 := 0bv32; [L1103] FCALL call write~intINTTYPE4(#t~nondet19, { base: ~s!base, offset: ~bvadd32(92bv32, ~s!offset) }, 4bv32); [L1103] havoc #t~nondet19; [L1104] FCALL call write~intINTTYPE4(12292bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1105] ~tmp~2 := #t~nondet20; [L1105] havoc #t~nondet20; [L1106] ~cb~0 := { base: 0bv32, offset: 0bv32 }; [L1107] ~ret~0 := 4294967295bv32; [L1108] ~skip~0 := 0bv32; [L1109] FCALL call write~intINTTYPE4(0bv32, ~tmp___0~1, 4bv32); [L1110] FCALL call #t~mem21 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(192bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem21!base=0bv32, #t~mem21!offset=1bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=0bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1110] COND TRUE 0bv32 != ~bvadd32(#t~mem21!base, #t~mem21!offset) [L1110] havoc #t~mem21; [L1111] FCALL call #t~mem22 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(192bv32, ~s!offset) }, 4bv32); [L1111] ~cb~0 := #t~mem22; [L1111] havoc #t~mem22; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1119] FCALL call #t~mem27 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(28bv32, ~s!offset) }, 4bv32); [L1119] FCALL call write~intINTTYPE4(~bvadd32(1bv32, #t~mem27), { base: ~s!base, offset: ~bvadd32(28bv32, ~s!offset) }, 4bv32); [L1119] havoc #t~mem27; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1120-L1128] COND FALSE !(0bv32 != ~bvand32(12288bv32, ~tmp___1~0)) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] COND FALSE !(false) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] FCALL call #t~mem28 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] FCALL call #t~mem29 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem29=12292bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133] COND TRUE 12292bv32 == #t~mem29 [L1133] havoc #t~mem29; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1236] FCALL call write~intINTTYPE4(1bv32, { base: ~s!base, offset: ~bvadd32(40bv32, ~s!offset) }, 4bv32); [L1237] FCALL call write~intINTTYPE4(4096bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1238] FCALL call #t~mem62 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(204bv32, ~s!offset) }, 4bv32); [L1238] FCALL call #t~mem63 := read~intINTTYPE4({ base: #t~mem62!base, offset: ~bvadd32(64bv32, #t~mem62!offset) }, 4bv32); [L1238] FCALL call write~intINTTYPE4(~bvadd32(1bv32, #t~mem63), { base: #t~mem62!base, offset: ~bvadd32(64bv32, #t~mem62!offset) }, 4bv32); [L1238] havoc #t~mem62; [L1238] havoc #t~mem63; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1243] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(36bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1244] COND TRUE 0bv32 != ~bvadd32(~cb~0!base, ~cb~0!offset) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1249] FCALL call #t~mem64 := read~intINTTYPE4({ base: ~s!base, offset: ~s!offset }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem64=768bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1249] COND FALSE !(768bv32 != ~bvand32(65280bv32, #t~mem64)) [L1249] havoc #t~mem64; [L1255] FCALL call write~intINTTYPE4(4096bv32, { base: ~s!base, offset: ~bvadd32(4bv32, ~s!offset) }, 4bv32); [L1256] FCALL call #t~mem65 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(60bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem65!base=0bv32, #t~mem65!offset=1bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1256] COND FALSE !(0bv32 == ~bvadd32(#t~mem65!base, #t~mem65!offset)) [L1256] havoc #t~mem65; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1274] COND FALSE !(0bv32 == ~tmp___4~0) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1280] COND FALSE !(0bv32 == ~tmp___5~0) [L1286] FCALL call write~intINTTYPE4(4368bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1287] FCALL call #t~mem67 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(204bv32, ~s!offset) }, 4bv32); [L1287] FCALL call #t~mem68 := read~intINTTYPE4({ base: #t~mem67!base, offset: ~bvadd32(60bv32, #t~mem67!offset) }, 4bv32); [L1287] FCALL call write~intINTTYPE4(~bvadd32(1bv32, #t~mem68), { base: #t~mem67!base, offset: ~bvadd32(60bv32, #t~mem67!offset) }, 4bv32); [L1287] havoc #t~mem68; [L1287] havoc #t~mem67; [L1288] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(64bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] FCALL call #t~mem127 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(84bv32, ~s!offset) }, 4bv32); [L1602] FCALL call #t~mem128 := read~intINTTYPE4({ base: #t~mem127!base, offset: ~bvadd32(848bv32, #t~mem127!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem127!base=33554433bv32, #t~mem127!offset=4294966500bv32, #t~mem128=4368bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] COND FALSE !(0bv32 == #t~mem128) [L1602] havoc #t~mem127; [L1602] havoc #t~mem128; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1631] ~skip~0 := 0bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] COND FALSE !(false) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] FCALL call #t~mem28 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] FCALL call #t~mem29 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem29=4368bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133] COND FALSE !(12292bv32 == #t~mem29) [L1133] havoc #t~mem29; [L1136] FCALL call #t~mem30 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem30=4368bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1136] COND FALSE !(16384bv32 == #t~mem30) [L1136] havoc #t~mem30; [L1139] FCALL call #t~mem31 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem31=4368bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1139] COND FALSE !(4096bv32 == #t~mem31) [L1139] havoc #t~mem31; [L1142] FCALL call #t~mem32 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem32=4368bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1142] COND FALSE !(20480bv32 == #t~mem32) [L1142] havoc #t~mem32; [L1145] FCALL call #t~mem33 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem33=4368bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1145] COND FALSE !(4099bv32 == #t~mem33) [L1145] havoc #t~mem33; [L1148] FCALL call #t~mem34 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem34=4368bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1148] COND TRUE 4368bv32 == #t~mem34 [L1148] havoc #t~mem34; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1292] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(48bv32, ~s!offset) }, 4bv32); [L1293] ~ret~0 := #t~nondet69; [L1293] havoc #t~nondet69; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1294] COND TRUE 0bv32 == ~blastFlag~0 [L1295] ~blastFlag~0 := 1bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1299] COND FALSE !(~bvsle32(~ret~0, 0bv32)) [L1304] FCALL call write~intINTTYPE4(4384bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1305] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(64bv32, ~s!offset) }, 4bv32); [L1306] FCALL call #t~mem70 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(20bv32, ~s!offset) }, 4bv32); [L1306] FCALL call #t~mem71 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(16bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem70!base=1bv32, #t~mem70!offset=0bv32, #t~mem71!base=0bv32, #t~mem71!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1306] COND TRUE ~bvadd32(#t~mem70!base, #t~mem70!offset) != ~bvadd32(#t~mem71!base, #t~mem71!offset) [L1306] havoc #t~mem71; [L1306] havoc #t~mem70; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] FCALL call #t~mem127 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(84bv32, ~s!offset) }, 4bv32); [L1602] FCALL call #t~mem128 := read~intINTTYPE4({ base: #t~mem127!base, offset: ~bvadd32(848bv32, #t~mem127!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem127!base=33554433bv32, #t~mem127!offset=4294966500bv32, #t~mem128=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] COND FALSE !(0bv32 == #t~mem128) [L1602] havoc #t~mem127; [L1602] havoc #t~mem128; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1631] ~skip~0 := 0bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] COND FALSE !(false) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] FCALL call #t~mem28 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] FCALL call #t~mem29 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem29=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133] COND FALSE !(12292bv32 == #t~mem29) [L1133] havoc #t~mem29; [L1136] FCALL call #t~mem30 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem30=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1136] COND FALSE !(16384bv32 == #t~mem30) [L1136] havoc #t~mem30; [L1139] FCALL call #t~mem31 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem31=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1139] COND FALSE !(4096bv32 == #t~mem31) [L1139] havoc #t~mem31; [L1142] FCALL call #t~mem32 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem32=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1142] COND FALSE !(20480bv32 == #t~mem32) [L1142] havoc #t~mem32; [L1145] FCALL call #t~mem33 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem33=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1145] COND FALSE !(4099bv32 == #t~mem33) [L1145] havoc #t~mem33; [L1148] FCALL call #t~mem34 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem34=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1148] COND FALSE !(4368bv32 == #t~mem34) [L1148] havoc #t~mem34; [L1151] FCALL call #t~mem35 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem35=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1151] COND FALSE !(4369bv32 == #t~mem35) [L1151] havoc #t~mem35; [L1154] FCALL call #t~mem36 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem36=4384bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1154] COND TRUE 4384bv32 == #t~mem36 [L1154] havoc #t~mem36; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1314] ~ret~0 := #t~nondet72; [L1314] havoc #t~nondet72; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1315] COND TRUE 1bv32 == ~blastFlag~0 [L1316] ~blastFlag~0 := 2bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1324] COND FALSE !(~bvsle32(~ret~0, 0bv32)) [L1329] FCALL call #t~mem73 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(92bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem73=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1329-L1333] COND FALSE !(0bv32 != #t~mem73) [L1329] havoc #t~mem73; [L1332] FCALL call write~intINTTYPE4(4400bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1334] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(64bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] FCALL call #t~mem127 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(84bv32, ~s!offset) }, 4bv32); [L1602] FCALL call #t~mem128 := read~intINTTYPE4({ base: #t~mem127!base, offset: ~bvadd32(848bv32, #t~mem127!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem127!base=33554433bv32, #t~mem127!offset=4294966500bv32, #t~mem128=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] COND FALSE !(0bv32 == #t~mem128) [L1602] havoc #t~mem127; [L1602] havoc #t~mem128; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1631] ~skip~0 := 0bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] COND FALSE !(false) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] FCALL call #t~mem28 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] FCALL call #t~mem29 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem29=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133] COND FALSE !(12292bv32 == #t~mem29) [L1133] havoc #t~mem29; [L1136] FCALL call #t~mem30 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem30=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1136] COND FALSE !(16384bv32 == #t~mem30) [L1136] havoc #t~mem30; [L1139] FCALL call #t~mem31 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem31=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1139] COND FALSE !(4096bv32 == #t~mem31) [L1139] havoc #t~mem31; [L1142] FCALL call #t~mem32 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem32=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1142] COND FALSE !(20480bv32 == #t~mem32) [L1142] havoc #t~mem32; [L1145] FCALL call #t~mem33 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem33=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1145] COND FALSE !(4099bv32 == #t~mem33) [L1145] havoc #t~mem33; [L1148] FCALL call #t~mem34 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem34=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1148] COND FALSE !(4368bv32 == #t~mem34) [L1148] havoc #t~mem34; [L1151] FCALL call #t~mem35 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem35=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1151] COND FALSE !(4369bv32 == #t~mem35) [L1151] havoc #t~mem35; [L1154] FCALL call #t~mem36 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem36=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1154] COND FALSE !(4384bv32 == #t~mem36) [L1154] havoc #t~mem36; [L1157] FCALL call #t~mem37 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem37=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1157] COND FALSE !(4385bv32 == #t~mem37) [L1157] havoc #t~mem37; [L1160] FCALL call #t~mem38 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem38=4400bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1160] COND TRUE 4400bv32 == #t~mem38 [L1160] havoc #t~mem38; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1338] FCALL call #t~mem74 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(84bv32, ~s!offset) }, 4bv32); [L1338] FCALL call #t~mem75 := read~$Pointer$({ base: #t~mem74!base, offset: ~bvadd32(836bv32, #t~mem74!offset) }, 4bv32); [L1338] FCALL call #t~mem76 := read~intINTTYPE4({ base: #t~mem75!base, offset: ~bvadd32(12bv32, #t~mem75!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem74!base=33554433bv32, #t~mem74!offset=4294966500bv32, #t~mem75!base=33554433bv32, #t~mem75!offset=52bv32, #t~mem76=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1338-L1352] COND FALSE !(0bv32 != ~bvand32(256bv32, #t~mem76)) [L1338] havoc #t~mem76; [L1338] havoc #t~mem75; [L1338] havoc #t~mem74; [L1341] ~ret~0 := #t~nondet77; [L1341] havoc #t~nondet77; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1342] COND TRUE 2bv32 == ~blastFlag~0 [L1343] ~blastFlag~0 := 3bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1347] COND FALSE !(~bvsle32(~ret~0, 0bv32)) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1353] FCALL call write~intINTTYPE4(4416bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1354] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(64bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] FCALL call #t~mem127 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(84bv32, ~s!offset) }, 4bv32); [L1602] FCALL call #t~mem128 := read~intINTTYPE4({ base: #t~mem127!base, offset: ~bvadd32(848bv32, #t~mem127!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem127!base=33554433bv32, #t~mem127!offset=4294966500bv32, #t~mem128=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] COND FALSE !(0bv32 == #t~mem128) [L1602] havoc #t~mem127; [L1602] havoc #t~mem128; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1631] ~skip~0 := 0bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] COND FALSE !(false) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] FCALL call #t~mem28 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] FCALL call #t~mem29 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem29=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133] COND FALSE !(12292bv32 == #t~mem29) [L1133] havoc #t~mem29; [L1136] FCALL call #t~mem30 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem30=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1136] COND FALSE !(16384bv32 == #t~mem30) [L1136] havoc #t~mem30; [L1139] FCALL call #t~mem31 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem31=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1139] COND FALSE !(4096bv32 == #t~mem31) [L1139] havoc #t~mem31; [L1142] FCALL call #t~mem32 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem32=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1142] COND FALSE !(20480bv32 == #t~mem32) [L1142] havoc #t~mem32; [L1145] FCALL call #t~mem33 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem33=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1145] COND FALSE !(4099bv32 == #t~mem33) [L1145] havoc #t~mem33; [L1148] FCALL call #t~mem34 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem34=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1148] COND FALSE !(4368bv32 == #t~mem34) [L1148] havoc #t~mem34; [L1151] FCALL call #t~mem35 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem35=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1151] COND FALSE !(4369bv32 == #t~mem35) [L1151] havoc #t~mem35; [L1154] FCALL call #t~mem36 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem36=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1154] COND FALSE !(4384bv32 == #t~mem36) [L1154] havoc #t~mem36; [L1157] FCALL call #t~mem37 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem37=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1157] COND FALSE !(4385bv32 == #t~mem37) [L1157] havoc #t~mem37; [L1160] FCALL call #t~mem38 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem38=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1160] COND FALSE !(4400bv32 == #t~mem38) [L1160] havoc #t~mem38; [L1163] FCALL call #t~mem39 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem39=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1163] COND FALSE !(4401bv32 == #t~mem39) [L1163] havoc #t~mem39; [L1166] FCALL call #t~mem40 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem40=4416bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1166] COND TRUE 4416bv32 == #t~mem40 [L1166] havoc #t~mem40; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1358] ~ret~0 := #t~nondet78; [L1358] havoc #t~nondet78; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1359] COND TRUE 3bv32 == ~blastFlag~0 [L1360] ~blastFlag~0 := 4bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1364] COND FALSE !(~bvsle32(~ret~0, 0bv32)) [L1369] FCALL call write~intINTTYPE4(4432bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1370] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(64bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1371] COND FALSE !(0bv32 == ~tmp___6~0) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] FCALL call #t~mem127 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(84bv32, ~s!offset) }, 4bv32); [L1602] FCALL call #t~mem128 := read~intINTTYPE4({ base: #t~mem127!base, offset: ~bvadd32(848bv32, #t~mem127!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem127!base=33554433bv32, #t~mem127!offset=4294966500bv32, #t~mem128=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1602] COND FALSE !(0bv32 == #t~mem128) [L1602] havoc #t~mem127; [L1602] havoc #t~mem128; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1631] ~skip~0 := 0bv32; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1130-L1632] COND FALSE !(false) VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1132] FCALL call #t~mem28 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1132] ~state~0 := #t~mem28; [L1132] havoc #t~mem28; [L1133] FCALL call #t~mem29 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem29=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1133] COND FALSE !(12292bv32 == #t~mem29) [L1133] havoc #t~mem29; [L1136] FCALL call #t~mem30 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem30=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1136] COND FALSE !(16384bv32 == #t~mem30) [L1136] havoc #t~mem30; [L1139] FCALL call #t~mem31 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem31=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1139] COND FALSE !(4096bv32 == #t~mem31) [L1139] havoc #t~mem31; [L1142] FCALL call #t~mem32 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem32=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1142] COND FALSE !(20480bv32 == #t~mem32) [L1142] havoc #t~mem32; [L1145] FCALL call #t~mem33 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem33=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1145] COND FALSE !(4099bv32 == #t~mem33) [L1145] havoc #t~mem33; [L1148] FCALL call #t~mem34 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem34=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1148] COND FALSE !(4368bv32 == #t~mem34) [L1148] havoc #t~mem34; [L1151] FCALL call #t~mem35 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem35=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1151] COND FALSE !(4369bv32 == #t~mem35) [L1151] havoc #t~mem35; [L1154] FCALL call #t~mem36 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem36=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1154] COND FALSE !(4384bv32 == #t~mem36) [L1154] havoc #t~mem36; [L1157] FCALL call #t~mem37 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem37=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1157] COND FALSE !(4385bv32 == #t~mem37) [L1157] havoc #t~mem37; [L1160] FCALL call #t~mem38 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem38=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1160] COND FALSE !(4400bv32 == #t~mem38) [L1160] havoc #t~mem38; [L1163] FCALL call #t~mem39 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem39=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1163] COND FALSE !(4401bv32 == #t~mem39) [L1163] havoc #t~mem39; [L1166] FCALL call #t~mem40 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem40=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1166] COND FALSE !(4416bv32 == #t~mem40) [L1166] havoc #t~mem40; [L1169] FCALL call #t~mem41 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem41=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1169] COND FALSE !(4417bv32 == #t~mem41) [L1169] havoc #t~mem41; [L1172] FCALL call #t~mem42 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem42=4432bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1172] COND TRUE 4432bv32 == #t~mem42 [L1172] havoc #t~mem42; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1380] ~ret~0 := #t~nondet79; [L1380] havoc #t~nondet79; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=0bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1381] COND TRUE 4bv32 == ~blastFlag~0 VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=0bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1643] assert false; VAL [#in~s!base=33554433bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=33554434bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~cb~0!base=0bv32, ~cb~0!offset=1bv32, ~init~0=1bv32, ~ret~0=0bv32, ~s!base=33554433bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=33554433bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___3~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp___7~0=0bv32, ~tmp___8~0=0bv32, ~tmp___9~0=0bv32, ~tmp~2=0bv32] [L1042] static int init = 1; [L1043] static SSL_METHOD SSLv3_client_data ; VAL [\old(init)=0, \old(SSLv3_client_data)=null, \old(SSLv3_client_data)=null, init=1, SSLv3_client_data={33554434:0}] [L1065] SSL *s = (SSL*)malloc(sizeof(SSL)) ; [L1069] s->s3 = malloc(sizeof(struct ssl3_state_st)) [L1070] s->ctx = malloc(sizeof(SSL_CTX)) [L1071] s->session = malloc(sizeof(SSL_SESSION)) [L1072] s->state = 12292 [L1073] s->version = __VERIFIER_nondet_int() [L1074] CALL ssl3_connect(s) VAL [init=1, s={33554433:0}, SSLv3_client_data={33554434:0}] [L1080] BUF_MEM *buf ; [L1081] unsigned long tmp ; [L1082] unsigned long l ; [L1083] long num1 ; [L1084] void (*cb)() ; [L1085] int ret ; [L1086] int new_state ; [L1087] int state ; [L1088] int skip ; [L1089] int *tmp___0 = __VERIFIER_nondet_pointer() ; [L1090] int tmp___1 = __VERIFIER_nondet_int() ; [L1091] int tmp___2 = __VERIFIER_nondet_int() ; [L1092] int tmp___3 = __VERIFIER_nondet_int() ; [L1093] int tmp___4 = __VERIFIER_nondet_int() ; [L1094] int tmp___5 = __VERIFIER_nondet_int() ; [L1095] int tmp___6 = __VERIFIER_nondet_int() ; [L1096] int tmp___7 = __VERIFIER_nondet_int() ; [L1097] int tmp___8 = __VERIFIER_nondet_int() ; [L1098] long tmp___9 = __VERIFIER_nondet_long() ; [L1099] int blastFlag ; [L1102] blastFlag = 0 [L1103] s->hit=__VERIFIER_nondet_int () [L1104] s->state = 12292 [L1105] tmp = __VERIFIER_nondet_int() [L1106] cb = (void (*)())((void *)0) [L1107] ret = -1 [L1108] skip = 0 [L1109] *tmp___0 = 0 [L1110] EXPR s->info_callback VAL [={0:0}, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, s->info_callback={0:1}, skip=0, SSLv3_client_data={33554434:0}, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1110] COND TRUE (unsigned long )s->info_callback != (unsigned long )((void *)0) [L1111] EXPR s->info_callback [L1111] cb = s->info_callback [L1119] EXPR s->in_handshake [L1119] s->in_handshake += 1 [L1120] COND FALSE !(tmp___1 & 12288) VAL [={0:1}, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1130] COND TRUE 1 VAL [={0:1}, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1132] EXPR s->state [L1132] state = s->state [L1133] EXPR s->state VAL [={0:1}, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, s->state=12292, skip=0, SSLv3_client_data={33554434:0}, state=12292, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1133] COND TRUE s->state == 12292 [L1236] s->new_session = 1 [L1237] s->state = 4096 [L1238] EXPR s->ctx [L1238] EXPR (s->ctx)->stats.sess_connect_renegotiate [L1238] (s->ctx)->stats.sess_connect_renegotiate += 1 [L1243] s->server = 0 VAL [={0:1}, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=12292, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1244] COND TRUE (unsigned long )cb != (unsigned long )((void *)0) VAL [={0:1}, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=12292, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1249] EXPR s->version VAL [={0:1}, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, s->version=768, skip=0, SSLv3_client_data={33554434:0}, state=12292, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1249] COND FALSE !((s->version & 65280) != 768) [L1255] s->type = 4096 [L1256] EXPR s->init_buf VAL [={0:1}, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, s->init_buf={0:1}, skip=0, SSLv3_client_data={33554434:0}, state=12292, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1256] COND FALSE !((unsigned long )s->init_buf == (unsigned long )((void *)0)) [L1274] COND FALSE !(! tmp___4) VAL [={0:1}, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=12292, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1280] COND FALSE !(! tmp___5) [L1286] s->state = 4368 [L1287] EXPR s->ctx [L1287] EXPR (s->ctx)->stats.sess_connect [L1287] (s->ctx)->stats.sess_connect += 1 [L1288] s->init_num = 0 VAL [={0:1}, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=12292, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1602] EXPR s->s3 [L1602] EXPR (s->s3)->tmp.reuse_message VAL [={0:1}, (s->s3)->tmp.reuse_message=4368, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, s->s3={33554433:-796}, skip=0, SSLv3_client_data={33554434:0}, state=12292, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1602] COND FALSE !(! (s->s3)->tmp.reuse_message) [L1631] skip = 0 VAL [={0:1}, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=12292, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1130] COND TRUE 1 VAL [={0:1}, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=12292, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1132] EXPR s->state [L1132] state = s->state [L1133] EXPR s->state VAL [={0:1}, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, s->state=4368, skip=0, SSLv3_client_data={33554434:0}, state=4368, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1133] COND FALSE !(s->state == 12292) [L1136] EXPR s->state VAL [={0:1}, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, s->state=4368, skip=0, SSLv3_client_data={33554434:0}, state=4368, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1136] COND FALSE !(s->state == 16384) [L1139] EXPR s->state VAL [={0:1}, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, s->state=4368, skip=0, SSLv3_client_data={33554434:0}, state=4368, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1139] COND FALSE !(s->state == 4096) [L1142] EXPR s->state VAL [={0:1}, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, s->state=4368, skip=0, SSLv3_client_data={33554434:0}, state=4368, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1142] COND FALSE !(s->state == 20480) [L1145] EXPR s->state VAL [={0:1}, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, s->state=4368, skip=0, SSLv3_client_data={33554434:0}, state=4368, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1145] COND FALSE !(s->state == 4099) [L1148] EXPR s->state VAL [={0:1}, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, s->state=4368, skip=0, SSLv3_client_data={33554434:0}, state=4368, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1148] COND TRUE s->state == 4368 [L1292] s->shutdown = 0 [L1293] ret = __VERIFIER_nondet_int() [L1294] COND TRUE blastFlag == 0 [L1295] blastFlag = 1 VAL [={0:1}, blastFlag=1, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4368, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1299] COND FALSE !(ret <= 0) [L1304] s->state = 4384 [L1305] s->init_num = 0 [L1306] EXPR s->bbio [L1306] EXPR s->wbio VAL [={0:1}, blastFlag=1, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->bbio={1:0}, s->wbio={0:0}, skip=0, SSLv3_client_data={33554434:0}, state=4368, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1306] COND TRUE (unsigned long )s->bbio != (unsigned long )s->wbio [L1602] EXPR s->s3 [L1602] EXPR (s->s3)->tmp.reuse_message VAL [={0:1}, (s->s3)->tmp.reuse_message=4384, blastFlag=1, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->s3={33554433:-796}, skip=0, SSLv3_client_data={33554434:0}, state=4368, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1602] COND FALSE !(! (s->s3)->tmp.reuse_message) [L1631] skip = 0 VAL [={0:1}, blastFlag=1, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4368, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1130] COND TRUE 1 VAL [={0:1}, blastFlag=1, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4368, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1132] EXPR s->state [L1132] state = s->state [L1133] EXPR s->state VAL [={0:1}, blastFlag=1, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4384, skip=0, SSLv3_client_data={33554434:0}, state=4384, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1133] COND FALSE !(s->state == 12292) [L1136] EXPR s->state VAL [={0:1}, blastFlag=1, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4384, skip=0, SSLv3_client_data={33554434:0}, state=4384, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1136] COND FALSE !(s->state == 16384) [L1139] EXPR s->state VAL [={0:1}, blastFlag=1, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4384, skip=0, SSLv3_client_data={33554434:0}, state=4384, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1139] COND FALSE !(s->state == 4096) [L1142] EXPR s->state VAL [={0:1}, blastFlag=1, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4384, skip=0, SSLv3_client_data={33554434:0}, state=4384, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1142] COND FALSE !(s->state == 20480) [L1145] EXPR s->state VAL [={0:1}, blastFlag=1, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4384, skip=0, SSLv3_client_data={33554434:0}, state=4384, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1145] COND FALSE !(s->state == 4099) [L1148] EXPR s->state VAL [={0:1}, blastFlag=1, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4384, skip=0, SSLv3_client_data={33554434:0}, state=4384, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1148] COND FALSE !(s->state == 4368) [L1151] EXPR s->state VAL [={0:1}, blastFlag=1, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4384, skip=0, SSLv3_client_data={33554434:0}, state=4384, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1151] COND FALSE !(s->state == 4369) [L1154] EXPR s->state VAL [={0:1}, blastFlag=1, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4384, skip=0, SSLv3_client_data={33554434:0}, state=4384, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1154] COND TRUE s->state == 4384 [L1314] ret = __VERIFIER_nondet_int() [L1315] COND TRUE blastFlag == 1 [L1316] blastFlag = 2 VAL [={0:1}, blastFlag=2, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4384, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1324] COND FALSE !(ret <= 0) [L1329] s->hit VAL [={0:1}, blastFlag=2, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->hit=0, skip=0, SSLv3_client_data={33554434:0}, state=4384, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1329] COND FALSE !(s->hit) [L1332] s->state = 4400 VAL [={0:1}, blastFlag=2, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4384, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1334] s->init_num = 0 VAL [={0:1}, blastFlag=2, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4384, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1602] EXPR s->s3 [L1602] EXPR (s->s3)->tmp.reuse_message VAL [={0:1}, (s->s3)->tmp.reuse_message=4400, blastFlag=2, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->s3={33554433:-796}, skip=0, SSLv3_client_data={33554434:0}, state=4384, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1602] COND FALSE !(! (s->s3)->tmp.reuse_message) [L1631] skip = 0 VAL [={0:1}, blastFlag=2, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4384, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1130] COND TRUE 1 VAL [={0:1}, blastFlag=2, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4384, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1132] EXPR s->state [L1132] state = s->state [L1133] EXPR s->state VAL [={0:1}, blastFlag=2, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4400, skip=0, SSLv3_client_data={33554434:0}, state=4400, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1133] COND FALSE !(s->state == 12292) [L1136] EXPR s->state VAL [={0:1}, blastFlag=2, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4400, skip=0, SSLv3_client_data={33554434:0}, state=4400, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1136] COND FALSE !(s->state == 16384) [L1139] EXPR s->state VAL [={0:1}, blastFlag=2, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4400, skip=0, SSLv3_client_data={33554434:0}, state=4400, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1139] COND FALSE !(s->state == 4096) [L1142] EXPR s->state VAL [={0:1}, blastFlag=2, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4400, skip=0, SSLv3_client_data={33554434:0}, state=4400, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1142] COND FALSE !(s->state == 20480) [L1145] EXPR s->state VAL [={0:1}, blastFlag=2, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4400, skip=0, SSLv3_client_data={33554434:0}, state=4400, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1145] COND FALSE !(s->state == 4099) [L1148] EXPR s->state VAL [={0:1}, blastFlag=2, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4400, skip=0, SSLv3_client_data={33554434:0}, state=4400, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1148] COND FALSE !(s->state == 4368) [L1151] EXPR s->state VAL [={0:1}, blastFlag=2, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4400, skip=0, SSLv3_client_data={33554434:0}, state=4400, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1151] COND FALSE !(s->state == 4369) [L1154] EXPR s->state VAL [={0:1}, blastFlag=2, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4400, skip=0, SSLv3_client_data={33554434:0}, state=4400, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1154] COND FALSE !(s->state == 4384) [L1157] EXPR s->state VAL [={0:1}, blastFlag=2, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4400, skip=0, SSLv3_client_data={33554434:0}, state=4400, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1157] COND FALSE !(s->state == 4385) [L1160] EXPR s->state VAL [={0:1}, blastFlag=2, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4400, skip=0, SSLv3_client_data={33554434:0}, state=4400, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1160] COND TRUE s->state == 4400 [L1338] EXPR s->s3 [L1338] EXPR (s->s3)->tmp.new_cipher [L1338] EXPR ((s->s3)->tmp.new_cipher)->algorithms VAL [={0:1}, ((s->s3)->tmp.new_cipher)->algorithms=0, (s->s3)->tmp.new_cipher={33554433:52}, blastFlag=2, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->s3={33554433:-796}, skip=0, SSLv3_client_data={33554434:0}, state=4400, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1338] COND FALSE !(((s->s3)->tmp.new_cipher)->algorithms & 256UL) [L1341] ret = __VERIFIER_nondet_int() [L1342] COND TRUE blastFlag == 2 [L1343] blastFlag = 3 VAL [={0:1}, blastFlag=3, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4400, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1347] COND FALSE !(ret <= 0) VAL [={0:1}, blastFlag=3, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4400, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1353] s->state = 4416 [L1354] s->init_num = 0 VAL [={0:1}, blastFlag=3, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4400, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1602] EXPR s->s3 [L1602] EXPR (s->s3)->tmp.reuse_message VAL [={0:1}, (s->s3)->tmp.reuse_message=4416, blastFlag=3, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->s3={33554433:-796}, skip=0, SSLv3_client_data={33554434:0}, state=4400, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1602] COND FALSE !(! (s->s3)->tmp.reuse_message) [L1631] skip = 0 VAL [={0:1}, blastFlag=3, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4400, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1130] COND TRUE 1 VAL [={0:1}, blastFlag=3, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4400, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1132] EXPR s->state [L1132] state = s->state [L1133] EXPR s->state VAL [={0:1}, blastFlag=3, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4416, skip=0, SSLv3_client_data={33554434:0}, state=4416, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1133] COND FALSE !(s->state == 12292) [L1136] EXPR s->state VAL [={0:1}, blastFlag=3, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4416, skip=0, SSLv3_client_data={33554434:0}, state=4416, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1136] COND FALSE !(s->state == 16384) [L1139] EXPR s->state VAL [={0:1}, blastFlag=3, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4416, skip=0, SSLv3_client_data={33554434:0}, state=4416, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1139] COND FALSE !(s->state == 4096) [L1142] EXPR s->state VAL [={0:1}, blastFlag=3, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4416, skip=0, SSLv3_client_data={33554434:0}, state=4416, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1142] COND FALSE !(s->state == 20480) [L1145] EXPR s->state VAL [={0:1}, blastFlag=3, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4416, skip=0, SSLv3_client_data={33554434:0}, state=4416, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1145] COND FALSE !(s->state == 4099) [L1148] EXPR s->state VAL [={0:1}, blastFlag=3, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4416, skip=0, SSLv3_client_data={33554434:0}, state=4416, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1148] COND FALSE !(s->state == 4368) [L1151] EXPR s->state VAL [={0:1}, blastFlag=3, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4416, skip=0, SSLv3_client_data={33554434:0}, state=4416, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1151] COND FALSE !(s->state == 4369) [L1154] EXPR s->state VAL [={0:1}, blastFlag=3, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4416, skip=0, SSLv3_client_data={33554434:0}, state=4416, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1154] COND FALSE !(s->state == 4384) [L1157] EXPR s->state VAL [={0:1}, blastFlag=3, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4416, skip=0, SSLv3_client_data={33554434:0}, state=4416, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1157] COND FALSE !(s->state == 4385) [L1160] EXPR s->state VAL [={0:1}, blastFlag=3, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4416, skip=0, SSLv3_client_data={33554434:0}, state=4416, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1160] COND FALSE !(s->state == 4400) [L1163] EXPR s->state VAL [={0:1}, blastFlag=3, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4416, skip=0, SSLv3_client_data={33554434:0}, state=4416, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1163] COND FALSE !(s->state == 4401) [L1166] EXPR s->state VAL [={0:1}, blastFlag=3, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4416, skip=0, SSLv3_client_data={33554434:0}, state=4416, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1166] COND TRUE s->state == 4416 [L1358] ret = __VERIFIER_nondet_int() [L1359] COND TRUE blastFlag == 3 [L1360] blastFlag = 4 VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4416, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1364] COND FALSE !(ret <= 0) [L1369] s->state = 4432 [L1370] s->init_num = 0 VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4416, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1371] COND FALSE !(! tmp___6) VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4416, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1602] EXPR s->s3 [L1602] EXPR (s->s3)->tmp.reuse_message VAL [={0:1}, (s->s3)->tmp.reuse_message=4432, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->s3={33554433:-796}, skip=0, SSLv3_client_data={33554434:0}, state=4416, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1602] COND FALSE !(! (s->s3)->tmp.reuse_message) [L1631] skip = 0 VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4416, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1130] COND TRUE 1 VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4416, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1132] EXPR s->state [L1132] state = s->state [L1133] EXPR s->state VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4432, skip=0, SSLv3_client_data={33554434:0}, state=4432, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1133] COND FALSE !(s->state == 12292) [L1136] EXPR s->state VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4432, skip=0, SSLv3_client_data={33554434:0}, state=4432, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1136] COND FALSE !(s->state == 16384) [L1139] EXPR s->state VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4432, skip=0, SSLv3_client_data={33554434:0}, state=4432, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1139] COND FALSE !(s->state == 4096) [L1142] EXPR s->state VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4432, skip=0, SSLv3_client_data={33554434:0}, state=4432, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1142] COND FALSE !(s->state == 20480) [L1145] EXPR s->state VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4432, skip=0, SSLv3_client_data={33554434:0}, state=4432, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1145] COND FALSE !(s->state == 4099) [L1148] EXPR s->state VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4432, skip=0, SSLv3_client_data={33554434:0}, state=4432, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1148] COND FALSE !(s->state == 4368) [L1151] EXPR s->state VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4432, skip=0, SSLv3_client_data={33554434:0}, state=4432, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1151] COND FALSE !(s->state == 4369) [L1154] EXPR s->state VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4432, skip=0, SSLv3_client_data={33554434:0}, state=4432, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1154] COND FALSE !(s->state == 4384) [L1157] EXPR s->state VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4432, skip=0, SSLv3_client_data={33554434:0}, state=4432, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1157] COND FALSE !(s->state == 4385) [L1160] EXPR s->state VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4432, skip=0, SSLv3_client_data={33554434:0}, state=4432, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1160] COND FALSE !(s->state == 4400) [L1163] EXPR s->state VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4432, skip=0, SSLv3_client_data={33554434:0}, state=4432, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1163] COND FALSE !(s->state == 4401) [L1166] EXPR s->state VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4432, skip=0, SSLv3_client_data={33554434:0}, state=4432, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1166] COND FALSE !(s->state == 4416) [L1169] EXPR s->state VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4432, skip=0, SSLv3_client_data={33554434:0}, state=4432, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1169] COND FALSE !(s->state == 4417) [L1172] EXPR s->state VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4432, skip=0, SSLv3_client_data={33554434:0}, state=4432, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1172] COND TRUE s->state == 4432 [L1380] ret = __VERIFIER_nondet_int() [L1381] COND TRUE blastFlag == 4 VAL [={0:1}, blastFlag=4, init=1, ret=0, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4432, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1643] __VERIFIER_error() VAL [={0:1}, blastFlag=4, init=1, ret=0, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4432, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] ----- [2018-11-23 11:00:34,345 INFO L145 WitnessManager]: Wrote witness to /storage/repos/svcomp/c/ssh/s3_clnt.blast.03_false-unreach-call.i.cil.c-witness.graphml [2018-11-23 11:00:34,345 INFO L132 PluginConnector]: ------------------------ END Witness Printer---------------------------- [2018-11-23 11:00:34,346 INFO L168 Benchmark]: Toolchain (without parser) took 196986.91 ms. Allocated memory was 1.5 GB in the beginning and 2.5 GB in the end (delta: 976.7 MB). Free memory was 1.4 GB in the beginning and 1.8 GB in the end (delta: -396.7 MB). Peak memory consumption was 580.1 MB. Max. memory is 7.1 GB. [2018-11-23 11:00:34,347 INFO L168 Benchmark]: CDTParser took 0.26 ms. Allocated memory is still 1.5 GB. Free memory is still 1.4 GB. There was no memory consumed. Max. memory is 7.1 GB. [2018-11-23 11:00:34,347 INFO L168 Benchmark]: CACSL2BoogieTranslator took 1175.50 ms. Allocated memory was 1.5 GB in the beginning and 2.2 GB in the end (delta: 709.9 MB). Free memory was 1.4 GB in the beginning and 2.1 GB in the end (delta: -745.4 MB). Peak memory consumption was 62.3 MB. Max. memory is 7.1 GB. [2018-11-23 11:00:34,347 INFO L168 Benchmark]: Boogie Procedure Inliner took 82.32 ms. Allocated memory is still 2.2 GB. Free memory is still 2.1 GB. There was no memory consumed. Max. memory is 7.1 GB. [2018-11-23 11:00:34,348 INFO L168 Benchmark]: Boogie Preprocessor took 152.19 ms. Allocated memory is still 2.2 GB. Free memory is still 2.1 GB. There was no memory consumed. Max. memory is 7.1 GB. [2018-11-23 11:00:34,348 INFO L168 Benchmark]: RCFGBuilder took 6028.69 ms. Allocated memory is still 2.2 GB. Free memory was 2.1 GB in the beginning and 2.0 GB in the end (delta: 144.9 MB). Peak memory consumption was 144.9 MB. Max. memory is 7.1 GB. [2018-11-23 11:00:34,348 INFO L168 Benchmark]: TraceAbstraction took 189273.44 ms. Allocated memory was 2.2 GB in the beginning and 2.5 GB in the end (delta: 266.9 MB). Free memory was 2.0 GB in the beginning and 1.9 GB in the end (delta: 111.9 MB). Peak memory consumption was 378.7 MB. Max. memory is 7.1 GB. [2018-11-23 11:00:34,349 INFO L168 Benchmark]: Witness Printer took 266.94 ms. Allocated memory is still 2.5 GB. Free memory was 1.9 GB in the beginning and 1.8 GB in the end (delta: 91.9 MB). Peak memory consumption was 91.9 MB. Max. memory is 7.1 GB. [2018-11-23 11:00:34,351 INFO L336 ainManager$Toolchain]: ####################### End [Toolchain 1] ####################### --- Results --- * Results from de.uni_freiburg.informatik.ultimate.core: - GenericResult: Assertions are enabled Assertions are enabled - StatisticsResult: Toolchain Benchmarks Benchmark results are: * CDTParser took 0.26 ms. Allocated memory is still 1.5 GB. Free memory is still 1.4 GB. There was no memory consumed. Max. memory is 7.1 GB. * CACSL2BoogieTranslator took 1175.50 ms. Allocated memory was 1.5 GB in the beginning and 2.2 GB in the end (delta: 709.9 MB). Free memory was 1.4 GB in the beginning and 2.1 GB in the end (delta: -745.4 MB). Peak memory consumption was 62.3 MB. Max. memory is 7.1 GB. * Boogie Procedure Inliner took 82.32 ms. Allocated memory is still 2.2 GB. Free memory is still 2.1 GB. There was no memory consumed. Max. memory is 7.1 GB. * Boogie Preprocessor took 152.19 ms. Allocated memory is still 2.2 GB. Free memory is still 2.1 GB. There was no memory consumed. Max. memory is 7.1 GB. * RCFGBuilder took 6028.69 ms. Allocated memory is still 2.2 GB. Free memory was 2.1 GB in the beginning and 2.0 GB in the end (delta: 144.9 MB). Peak memory consumption was 144.9 MB. Max. memory is 7.1 GB. * TraceAbstraction took 189273.44 ms. Allocated memory was 2.2 GB in the beginning and 2.5 GB in the end (delta: 266.9 MB). Free memory was 2.0 GB in the beginning and 1.9 GB in the end (delta: 111.9 MB). Peak memory consumption was 378.7 MB. Max. memory is 7.1 GB. * Witness Printer took 266.94 ms. Allocated memory is still 2.5 GB. Free memory was 1.9 GB in the beginning and 1.8 GB in the end (delta: 91.9 MB). Peak memory consumption was 91.9 MB. Max. memory is 7.1 GB. * Results from de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator: - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: BitvecLiteral 0bv32 could not be translated for associated CType STRUCT~~ssl_method_st?version~INT?ssl_new~*((*~SSL~0 ) : INT)?ssl_clear~*((*~SSL~0 ) : VOID)?ssl_free~*((*~SSL~0 ) : VOID)?ssl_accept~*((*~SSL~0 ) : INT)?ssl_connect~*((*~SSL~0 ) : INT)?ssl_read~*((*~SSL~0 *VOID INT ) : INT)?ssl_peek~*((*~SSL~0 *VOID INT ) : INT)?ssl_write~*((*~SSL~0 *VOID INT ) : INT)?ssl_shutdown~*((*~SSL~0 ) : INT)?ssl_renegotiate~*((*~SSL~0 ) : INT)?ssl_renegotiate_check~*((*~SSL~0 ) : INT)?ssl_ctrl~*((*~SSL~0 INT LONG *CHAR ) : LONG)?ssl_ctx_ctrl~*((*~SSL_CTX~0 INT LONG *CHAR ) : LONG)?get_cipher_by_char~*((*UCHAR ) : *~SSL_CIPHER~0)?put_cipher_by_char~*((*~SSL_CIPHER~0 *UCHAR ) : INT)?ssl_pending~*((*~SSL~0 ) : INT)?num_ciphers~*(() : INT)?get_cipher~*((UINT ) : *~SSL_CIPHER~0)?get_ssl_method~*((INT ) : *ssl_method_st)?get_timeout~*(() : LONG)?ssl3_enc~*ssl3_enc_method?ssl_version~*(() : INT)?ssl_callback_ctrl~*((*~SSL~0 INT *(() : VOID) ) : LONG)?ssl_ctx_callback_ctrl~*((*~SSL_CTX~0 INT *(() : VOID) ) : LONG)# - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: BitvecLiteral 0bv32 could not be translated for associated CType STRUCT~~ssl_method_st?version~INT?ssl_new~*((*~SSL~0 ) : INT)?ssl_clear~*((*~SSL~0 ) : VOID)?ssl_free~*((*~SSL~0 ) : VOID)?ssl_accept~*((*~SSL~0 ) : INT)?ssl_connect~*((*~SSL~0 ) : INT)?ssl_read~*((*~SSL~0 *VOID INT ) : INT)?ssl_peek~*((*~SSL~0 *VOID INT ) : INT)?ssl_write~*((*~SSL~0 *VOID INT ) : INT)?ssl_shutdown~*((*~SSL~0 ) : INT)?ssl_renegotiate~*((*~SSL~0 ) : INT)?ssl_renegotiate_check~*((*~SSL~0 ) : INT)?ssl_ctrl~*((*~SSL~0 INT LONG *CHAR ) : LONG)?ssl_ctx_ctrl~*((*~SSL_CTX~0 INT LONG *CHAR ) : LONG)?get_cipher_by_char~*((*UCHAR ) : *~SSL_CIPHER~0)?put_cipher_by_char~*((*~SSL_CIPHER~0 *UCHAR ) : INT)?ssl_pending~*((*~SSL~0 ) : INT)?num_ciphers~*(() : INT)?get_cipher~*((UINT ) : *~SSL_CIPHER~0)?get_ssl_method~*((INT ) : *ssl_method_st)?get_timeout~*(() : LONG)?ssl3_enc~*ssl3_enc_method?ssl_version~*(() : INT)?ssl_callback_ctrl~*((*~SSL~0 INT *(() : VOID) ) : LONG)?ssl_ctx_callback_ctrl~*((*~SSL_CTX~0 INT *(() : VOID) ) : LONG)# - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: BitvecLiteral 0bv32 could not be translated for associated CType STRUCT~~ssl_method_st?version~INT?ssl_new~*((*~SSL~0 ) : INT)?ssl_clear~*((*~SSL~0 ) : VOID)?ssl_free~*((*~SSL~0 ) : VOID)?ssl_accept~*((*~SSL~0 ) : INT)?ssl_connect~*((*~SSL~0 ) : INT)?ssl_read~*((*~SSL~0 *VOID INT ) : INT)?ssl_peek~*((*~SSL~0 *VOID INT ) : INT)?ssl_write~*((*~SSL~0 *VOID INT ) : INT)?ssl_shutdown~*((*~SSL~0 ) : INT)?ssl_renegotiate~*((*~SSL~0 ) : INT)?ssl_renegotiate_check~*((*~SSL~0 ) : INT)?ssl_ctrl~*((*~SSL~0 INT LONG *CHAR ) : LONG)?ssl_ctx_ctrl~*((*~SSL_CTX~0 INT LONG *CHAR ) : LONG)?get_cipher_by_char~*((*UCHAR ) : *~SSL_CIPHER~0)?put_cipher_by_char~*((*~SSL_CIPHER~0 *UCHAR ) : INT)?ssl_pending~*((*~SSL~0 ) : INT)?num_ciphers~*(() : INT)?get_cipher~*((UINT ) : *~SSL_CIPHER~0)?get_ssl_method~*((INT ) : *ssl_method_st)?get_timeout~*(() : LONG)?ssl3_enc~*ssl3_enc_method?ssl_version~*(() : INT)?ssl_callback_ctrl~*((*~SSL~0 INT *(() : VOID) ) : LONG)?ssl_ctx_callback_ctrl~*((*~SSL_CTX~0 INT *(() : VOID) ) : LONG)# - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: BitvecLiteral 0bv32 could not be translated for associated CType STRUCT~~ssl_method_st?version~INT?ssl_new~*((*~SSL~0 ) : INT)?ssl_clear~*((*~SSL~0 ) : VOID)?ssl_free~*((*~SSL~0 ) : VOID)?ssl_accept~*((*~SSL~0 ) : INT)?ssl_connect~*((*~SSL~0 ) : INT)?ssl_read~*((*~SSL~0 *VOID INT ) : INT)?ssl_peek~*((*~SSL~0 *VOID INT ) : INT)?ssl_write~*((*~SSL~0 *VOID INT ) : INT)?ssl_shutdown~*((*~SSL~0 ) : INT)?ssl_renegotiate~*((*~SSL~0 ) : INT)?ssl_renegotiate_check~*((*~SSL~0 ) : INT)?ssl_ctrl~*((*~SSL~0 INT LONG *CHAR ) : LONG)?ssl_ctx_ctrl~*((*~SSL_CTX~0 INT LONG *CHAR ) : LONG)?get_cipher_by_char~*((*UCHAR ) : *~SSL_CIPHER~0)?put_cipher_by_char~*((*~SSL_CIPHER~0 *UCHAR ) : INT)?ssl_pending~*((*~SSL~0 ) : INT)?num_ciphers~*(() : INT)?get_cipher~*((UINT ) : *~SSL_CIPHER~0)?get_ssl_method~*((INT ) : *ssl_method_st)?get_timeout~*(() : LONG)?ssl3_enc~*ssl3_enc_method?ssl_version~*(() : INT)?ssl_callback_ctrl~*((*~SSL~0 INT *(() : VOID) ) : LONG)?ssl_ctx_callback_ctrl~*((*~SSL_CTX~0 INT *(() : VOID) ) : LONG)# * Results from de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction: - CounterExampleResult [Line: 1643]: a call of __VERIFIER_error() is reachable a call of __VERIFIER_error() is reachable We found a FailurePath: [L1042] static int init = 1; [L1043] static SSL_METHOD SSLv3_client_data ; VAL [\old(init)=0, \old(SSLv3_client_data)=null, \old(SSLv3_client_data)=null, init=1, SSLv3_client_data={33554434:0}] [L1065] SSL *s = (SSL*)malloc(sizeof(SSL)) ; [L1069] s->s3 = malloc(sizeof(struct ssl3_state_st)) [L1070] s->ctx = malloc(sizeof(SSL_CTX)) [L1071] s->session = malloc(sizeof(SSL_SESSION)) [L1072] s->state = 12292 [L1073] s->version = __VERIFIER_nondet_int() [L1074] CALL ssl3_connect(s) VAL [init=1, s={33554433:0}, SSLv3_client_data={33554434:0}] [L1080] BUF_MEM *buf ; [L1081] unsigned long tmp ; [L1082] unsigned long l ; [L1083] long num1 ; [L1084] void (*cb)() ; [L1085] int ret ; [L1086] int new_state ; [L1087] int state ; [L1088] int skip ; [L1089] int *tmp___0 = __VERIFIER_nondet_pointer() ; [L1090] int tmp___1 = __VERIFIER_nondet_int() ; [L1091] int tmp___2 = __VERIFIER_nondet_int() ; [L1092] int tmp___3 = __VERIFIER_nondet_int() ; [L1093] int tmp___4 = __VERIFIER_nondet_int() ; [L1094] int tmp___5 = __VERIFIER_nondet_int() ; [L1095] int tmp___6 = __VERIFIER_nondet_int() ; [L1096] int tmp___7 = __VERIFIER_nondet_int() ; [L1097] int tmp___8 = __VERIFIER_nondet_int() ; [L1098] long tmp___9 = __VERIFIER_nondet_long() ; [L1099] int blastFlag ; [L1102] blastFlag = 0 [L1103] s->hit=__VERIFIER_nondet_int () [L1104] s->state = 12292 [L1105] tmp = __VERIFIER_nondet_int() [L1106] cb = (void (*)())((void *)0) [L1107] ret = -1 [L1108] skip = 0 [L1109] *tmp___0 = 0 [L1110] EXPR s->info_callback VAL [={0:0}, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, s->info_callback={0:1}, skip=0, SSLv3_client_data={33554434:0}, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1110] COND TRUE (unsigned long )s->info_callback != (unsigned long )((void *)0) [L1111] EXPR s->info_callback [L1111] cb = s->info_callback [L1119] EXPR s->in_handshake [L1119] s->in_handshake += 1 [L1120] COND FALSE !(tmp___1 & 12288) VAL [={0:1}, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1130] COND TRUE 1 VAL [={0:1}, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1132] EXPR s->state [L1132] state = s->state [L1133] EXPR s->state VAL [={0:1}, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, s->state=12292, skip=0, SSLv3_client_data={33554434:0}, state=12292, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1133] COND TRUE s->state == 12292 [L1236] s->new_session = 1 [L1237] s->state = 4096 [L1238] EXPR s->ctx [L1238] EXPR (s->ctx)->stats.sess_connect_renegotiate [L1238] (s->ctx)->stats.sess_connect_renegotiate += 1 [L1243] s->server = 0 VAL [={0:1}, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=12292, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1244] COND TRUE (unsigned long )cb != (unsigned long )((void *)0) VAL [={0:1}, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=12292, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1249] EXPR s->version VAL [={0:1}, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, s->version=768, skip=0, SSLv3_client_data={33554434:0}, state=12292, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1249] COND FALSE !((s->version & 65280) != 768) [L1255] s->type = 4096 [L1256] EXPR s->init_buf VAL [={0:1}, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, s->init_buf={0:1}, skip=0, SSLv3_client_data={33554434:0}, state=12292, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1256] COND FALSE !((unsigned long )s->init_buf == (unsigned long )((void *)0)) [L1274] COND FALSE !(! tmp___4) VAL [={0:1}, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=12292, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1280] COND FALSE !(! tmp___5) [L1286] s->state = 4368 [L1287] EXPR s->ctx [L1287] EXPR (s->ctx)->stats.sess_connect [L1287] (s->ctx)->stats.sess_connect += 1 [L1288] s->init_num = 0 VAL [={0:1}, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=12292, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1602] EXPR s->s3 [L1602] EXPR (s->s3)->tmp.reuse_message VAL [={0:1}, (s->s3)->tmp.reuse_message=4368, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, s->s3={33554433:-796}, skip=0, SSLv3_client_data={33554434:0}, state=12292, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1602] COND FALSE !(! (s->s3)->tmp.reuse_message) [L1631] skip = 0 VAL [={0:1}, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=12292, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1130] COND TRUE 1 VAL [={0:1}, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=12292, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1132] EXPR s->state [L1132] state = s->state [L1133] EXPR s->state VAL [={0:1}, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, s->state=4368, skip=0, SSLv3_client_data={33554434:0}, state=4368, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1133] COND FALSE !(s->state == 12292) [L1136] EXPR s->state VAL [={0:1}, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, s->state=4368, skip=0, SSLv3_client_data={33554434:0}, state=4368, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1136] COND FALSE !(s->state == 16384) [L1139] EXPR s->state VAL [={0:1}, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, s->state=4368, skip=0, SSLv3_client_data={33554434:0}, state=4368, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1139] COND FALSE !(s->state == 4096) [L1142] EXPR s->state VAL [={0:1}, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, s->state=4368, skip=0, SSLv3_client_data={33554434:0}, state=4368, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1142] COND FALSE !(s->state == 20480) [L1145] EXPR s->state VAL [={0:1}, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, s->state=4368, skip=0, SSLv3_client_data={33554434:0}, state=4368, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1145] COND FALSE !(s->state == 4099) [L1148] EXPR s->state VAL [={0:1}, blastFlag=0, init=1, ret=4294967295, s={33554433:0}, s={33554433:0}, s->state=4368, skip=0, SSLv3_client_data={33554434:0}, state=4368, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1148] COND TRUE s->state == 4368 [L1292] s->shutdown = 0 [L1293] ret = __VERIFIER_nondet_int() [L1294] COND TRUE blastFlag == 0 [L1295] blastFlag = 1 VAL [={0:1}, blastFlag=1, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4368, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1299] COND FALSE !(ret <= 0) [L1304] s->state = 4384 [L1305] s->init_num = 0 [L1306] EXPR s->bbio [L1306] EXPR s->wbio VAL [={0:1}, blastFlag=1, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->bbio={1:0}, s->wbio={0:0}, skip=0, SSLv3_client_data={33554434:0}, state=4368, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1306] COND TRUE (unsigned long )s->bbio != (unsigned long )s->wbio [L1602] EXPR s->s3 [L1602] EXPR (s->s3)->tmp.reuse_message VAL [={0:1}, (s->s3)->tmp.reuse_message=4384, blastFlag=1, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->s3={33554433:-796}, skip=0, SSLv3_client_data={33554434:0}, state=4368, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1602] COND FALSE !(! (s->s3)->tmp.reuse_message) [L1631] skip = 0 VAL [={0:1}, blastFlag=1, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4368, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1130] COND TRUE 1 VAL [={0:1}, blastFlag=1, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4368, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1132] EXPR s->state [L1132] state = s->state [L1133] EXPR s->state VAL [={0:1}, blastFlag=1, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4384, skip=0, SSLv3_client_data={33554434:0}, state=4384, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1133] COND FALSE !(s->state == 12292) [L1136] EXPR s->state VAL [={0:1}, blastFlag=1, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4384, skip=0, SSLv3_client_data={33554434:0}, state=4384, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1136] COND FALSE !(s->state == 16384) [L1139] EXPR s->state VAL [={0:1}, blastFlag=1, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4384, skip=0, SSLv3_client_data={33554434:0}, state=4384, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1139] COND FALSE !(s->state == 4096) [L1142] EXPR s->state VAL [={0:1}, blastFlag=1, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4384, skip=0, SSLv3_client_data={33554434:0}, state=4384, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1142] COND FALSE !(s->state == 20480) [L1145] EXPR s->state VAL [={0:1}, blastFlag=1, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4384, skip=0, SSLv3_client_data={33554434:0}, state=4384, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1145] COND FALSE !(s->state == 4099) [L1148] EXPR s->state VAL [={0:1}, blastFlag=1, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4384, skip=0, SSLv3_client_data={33554434:0}, state=4384, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1148] COND FALSE !(s->state == 4368) [L1151] EXPR s->state VAL [={0:1}, blastFlag=1, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4384, skip=0, SSLv3_client_data={33554434:0}, state=4384, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1151] COND FALSE !(s->state == 4369) [L1154] EXPR s->state VAL [={0:1}, blastFlag=1, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4384, skip=0, SSLv3_client_data={33554434:0}, state=4384, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1154] COND TRUE s->state == 4384 [L1314] ret = __VERIFIER_nondet_int() [L1315] COND TRUE blastFlag == 1 [L1316] blastFlag = 2 VAL [={0:1}, blastFlag=2, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4384, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1324] COND FALSE !(ret <= 0) [L1329] s->hit VAL [={0:1}, blastFlag=2, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->hit=0, skip=0, SSLv3_client_data={33554434:0}, state=4384, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1329] COND FALSE !(s->hit) [L1332] s->state = 4400 VAL [={0:1}, blastFlag=2, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4384, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1334] s->init_num = 0 VAL [={0:1}, blastFlag=2, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4384, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1602] EXPR s->s3 [L1602] EXPR (s->s3)->tmp.reuse_message VAL [={0:1}, (s->s3)->tmp.reuse_message=4400, blastFlag=2, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->s3={33554433:-796}, skip=0, SSLv3_client_data={33554434:0}, state=4384, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1602] COND FALSE !(! (s->s3)->tmp.reuse_message) [L1631] skip = 0 VAL [={0:1}, blastFlag=2, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4384, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1130] COND TRUE 1 VAL [={0:1}, blastFlag=2, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4384, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1132] EXPR s->state [L1132] state = s->state [L1133] EXPR s->state VAL [={0:1}, blastFlag=2, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4400, skip=0, SSLv3_client_data={33554434:0}, state=4400, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1133] COND FALSE !(s->state == 12292) [L1136] EXPR s->state VAL [={0:1}, blastFlag=2, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4400, skip=0, SSLv3_client_data={33554434:0}, state=4400, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1136] COND FALSE !(s->state == 16384) [L1139] EXPR s->state VAL [={0:1}, blastFlag=2, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4400, skip=0, SSLv3_client_data={33554434:0}, state=4400, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1139] COND FALSE !(s->state == 4096) [L1142] EXPR s->state VAL [={0:1}, blastFlag=2, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4400, skip=0, SSLv3_client_data={33554434:0}, state=4400, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1142] COND FALSE !(s->state == 20480) [L1145] EXPR s->state VAL [={0:1}, blastFlag=2, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4400, skip=0, SSLv3_client_data={33554434:0}, state=4400, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1145] COND FALSE !(s->state == 4099) [L1148] EXPR s->state VAL [={0:1}, blastFlag=2, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4400, skip=0, SSLv3_client_data={33554434:0}, state=4400, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1148] COND FALSE !(s->state == 4368) [L1151] EXPR s->state VAL [={0:1}, blastFlag=2, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4400, skip=0, SSLv3_client_data={33554434:0}, state=4400, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1151] COND FALSE !(s->state == 4369) [L1154] EXPR s->state VAL [={0:1}, blastFlag=2, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4400, skip=0, SSLv3_client_data={33554434:0}, state=4400, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1154] COND FALSE !(s->state == 4384) [L1157] EXPR s->state VAL [={0:1}, blastFlag=2, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4400, skip=0, SSLv3_client_data={33554434:0}, state=4400, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1157] COND FALSE !(s->state == 4385) [L1160] EXPR s->state VAL [={0:1}, blastFlag=2, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4400, skip=0, SSLv3_client_data={33554434:0}, state=4400, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1160] COND TRUE s->state == 4400 [L1338] EXPR s->s3 [L1338] EXPR (s->s3)->tmp.new_cipher [L1338] EXPR ((s->s3)->tmp.new_cipher)->algorithms VAL [={0:1}, ((s->s3)->tmp.new_cipher)->algorithms=0, (s->s3)->tmp.new_cipher={33554433:52}, blastFlag=2, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->s3={33554433:-796}, skip=0, SSLv3_client_data={33554434:0}, state=4400, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1338] COND FALSE !(((s->s3)->tmp.new_cipher)->algorithms & 256UL) [L1341] ret = __VERIFIER_nondet_int() [L1342] COND TRUE blastFlag == 2 [L1343] blastFlag = 3 VAL [={0:1}, blastFlag=3, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4400, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1347] COND FALSE !(ret <= 0) VAL [={0:1}, blastFlag=3, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4400, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1353] s->state = 4416 [L1354] s->init_num = 0 VAL [={0:1}, blastFlag=3, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4400, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1602] EXPR s->s3 [L1602] EXPR (s->s3)->tmp.reuse_message VAL [={0:1}, (s->s3)->tmp.reuse_message=4416, blastFlag=3, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->s3={33554433:-796}, skip=0, SSLv3_client_data={33554434:0}, state=4400, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1602] COND FALSE !(! (s->s3)->tmp.reuse_message) [L1631] skip = 0 VAL [={0:1}, blastFlag=3, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4400, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1130] COND TRUE 1 VAL [={0:1}, blastFlag=3, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4400, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1132] EXPR s->state [L1132] state = s->state [L1133] EXPR s->state VAL [={0:1}, blastFlag=3, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4416, skip=0, SSLv3_client_data={33554434:0}, state=4416, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1133] COND FALSE !(s->state == 12292) [L1136] EXPR s->state VAL [={0:1}, blastFlag=3, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4416, skip=0, SSLv3_client_data={33554434:0}, state=4416, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1136] COND FALSE !(s->state == 16384) [L1139] EXPR s->state VAL [={0:1}, blastFlag=3, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4416, skip=0, SSLv3_client_data={33554434:0}, state=4416, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1139] COND FALSE !(s->state == 4096) [L1142] EXPR s->state VAL [={0:1}, blastFlag=3, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4416, skip=0, SSLv3_client_data={33554434:0}, state=4416, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1142] COND FALSE !(s->state == 20480) [L1145] EXPR s->state VAL [={0:1}, blastFlag=3, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4416, skip=0, SSLv3_client_data={33554434:0}, state=4416, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1145] COND FALSE !(s->state == 4099) [L1148] EXPR s->state VAL [={0:1}, blastFlag=3, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4416, skip=0, SSLv3_client_data={33554434:0}, state=4416, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1148] COND FALSE !(s->state == 4368) [L1151] EXPR s->state VAL [={0:1}, blastFlag=3, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4416, skip=0, SSLv3_client_data={33554434:0}, state=4416, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1151] COND FALSE !(s->state == 4369) [L1154] EXPR s->state VAL [={0:1}, blastFlag=3, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4416, skip=0, SSLv3_client_data={33554434:0}, state=4416, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1154] COND FALSE !(s->state == 4384) [L1157] EXPR s->state VAL [={0:1}, blastFlag=3, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4416, skip=0, SSLv3_client_data={33554434:0}, state=4416, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1157] COND FALSE !(s->state == 4385) [L1160] EXPR s->state VAL [={0:1}, blastFlag=3, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4416, skip=0, SSLv3_client_data={33554434:0}, state=4416, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1160] COND FALSE !(s->state == 4400) [L1163] EXPR s->state VAL [={0:1}, blastFlag=3, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4416, skip=0, SSLv3_client_data={33554434:0}, state=4416, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1163] COND FALSE !(s->state == 4401) [L1166] EXPR s->state VAL [={0:1}, blastFlag=3, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4416, skip=0, SSLv3_client_data={33554434:0}, state=4416, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1166] COND TRUE s->state == 4416 [L1358] ret = __VERIFIER_nondet_int() [L1359] COND TRUE blastFlag == 3 [L1360] blastFlag = 4 VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4416, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1364] COND FALSE !(ret <= 0) [L1369] s->state = 4432 [L1370] s->init_num = 0 VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4416, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1371] COND FALSE !(! tmp___6) VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4416, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1602] EXPR s->s3 [L1602] EXPR (s->s3)->tmp.reuse_message VAL [={0:1}, (s->s3)->tmp.reuse_message=4432, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->s3={33554433:-796}, skip=0, SSLv3_client_data={33554434:0}, state=4416, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1602] COND FALSE !(! (s->s3)->tmp.reuse_message) [L1631] skip = 0 VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4416, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1130] COND TRUE 1 VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4416, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1132] EXPR s->state [L1132] state = s->state [L1133] EXPR s->state VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4432, skip=0, SSLv3_client_data={33554434:0}, state=4432, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1133] COND FALSE !(s->state == 12292) [L1136] EXPR s->state VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4432, skip=0, SSLv3_client_data={33554434:0}, state=4432, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1136] COND FALSE !(s->state == 16384) [L1139] EXPR s->state VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4432, skip=0, SSLv3_client_data={33554434:0}, state=4432, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1139] COND FALSE !(s->state == 4096) [L1142] EXPR s->state VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4432, skip=0, SSLv3_client_data={33554434:0}, state=4432, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1142] COND FALSE !(s->state == 20480) [L1145] EXPR s->state VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4432, skip=0, SSLv3_client_data={33554434:0}, state=4432, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1145] COND FALSE !(s->state == 4099) [L1148] EXPR s->state VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4432, skip=0, SSLv3_client_data={33554434:0}, state=4432, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1148] COND FALSE !(s->state == 4368) [L1151] EXPR s->state VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4432, skip=0, SSLv3_client_data={33554434:0}, state=4432, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1151] COND FALSE !(s->state == 4369) [L1154] EXPR s->state VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4432, skip=0, SSLv3_client_data={33554434:0}, state=4432, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1154] COND FALSE !(s->state == 4384) [L1157] EXPR s->state VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4432, skip=0, SSLv3_client_data={33554434:0}, state=4432, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1157] COND FALSE !(s->state == 4385) [L1160] EXPR s->state VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4432, skip=0, SSLv3_client_data={33554434:0}, state=4432, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1160] COND FALSE !(s->state == 4400) [L1163] EXPR s->state VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4432, skip=0, SSLv3_client_data={33554434:0}, state=4432, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1163] COND FALSE !(s->state == 4401) [L1166] EXPR s->state VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4432, skip=0, SSLv3_client_data={33554434:0}, state=4432, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1166] COND FALSE !(s->state == 4416) [L1169] EXPR s->state VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4432, skip=0, SSLv3_client_data={33554434:0}, state=4432, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1169] COND FALSE !(s->state == 4417) [L1172] EXPR s->state VAL [={0:1}, blastFlag=4, init=1, ret=1073741824, s={33554433:0}, s={33554433:0}, s->state=4432, skip=0, SSLv3_client_data={33554434:0}, state=4432, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1172] COND TRUE s->state == 4432 [L1380] ret = __VERIFIER_nondet_int() [L1381] COND TRUE blastFlag == 4 VAL [={0:1}, blastFlag=4, init=1, ret=0, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4432, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] [L1643] __VERIFIER_error() VAL [={0:1}, blastFlag=4, init=1, ret=0, s={33554433:0}, s={33554433:0}, skip=0, SSLv3_client_data={33554434:0}, state=4432, tmp=0, tmp___0={33554433:204}, tmp___1=0, tmp___2=0, tmp___3=0, tmp___4=1, tmp___5=1, tmp___6=1, tmp___7=0, tmp___8=0, tmp___9=0] - StatisticsResult: Ultimate Automizer benchmark data CFG has 4 procedures, 140 locations, 1 error locations. UNSAFE Result, 189.1s OverallTime, 8 OverallIterations, 6 TraceHistogramMax, 149.3s AutomataDifference, 0.0s DeadEndRemovalTime, 0.0s HoareAnnotationTime, HoareTripleCheckerStatistics: 1566 SDtfs, 1759 SDslu, 2289 SDs, 0 SdLazy, 1685 SolverSat, 104 SolverUnsat, 4 SolverUnknown, 0 SolverNotchecked, 51.6s Time, PredicateUnifierStatistics: 0 DeclaredPredicates, 555 GetRequests, 517 SyntacticMatches, 0 SemanticMatches, 38 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 23 ImplicationChecksByTransitivity, 2.9s Time, 0.0s BasicInterpolantAutomatonTime, BiggestAbstraction: size=614occurred in iteration=7, traceCheckStatistics: No data available, InterpolantConsolidationStatistics: No data available, PathInvariantsStatistics: No data available, 0/0 InterpolantCoveringCapability, TotalInterpolationStatistics: No data available, 0.0s AbstIntTime, 0 AbstIntIterations, 0 AbstIntStrong, NaN AbsIntWeakeningRatio, NaN AbsIntAvgWeakeningVarsNumRemoved, NaN AbsIntAvgWeakenedConjuncts, 0.0s DumpTime, AutomataMinimizationStatistics: 3.1s AutomataMinimizationTime, 7 MinimizatonAttempts, 434 StatesRemovedByMinimization, 3 NontrivialMinimizations, HoareAnnotationStatistics: No data available, RefinementEngineStatistics: TraceCheckStatistics: 0.2s SsaConstructionTime, 16.8s SatisfiabilityAnalysisTime, 13.2s InterpolantComputationTime, 666 NumberOfCodeBlocks, 666 NumberOfCodeBlocksAsserted, 8 NumberOfCheckSat, 541 ConstructedInterpolants, 12 QuantifiedInterpolants, 224861 SizeOfPredicates, 25 NumberOfNonLiveVariables, 2030 ConjunctsInSsa, 40 ConjunctsInUnsatCore, 7 InterpolantComputations, 7 PerfectInterpolantSequences, 487/487 InterpolantCoveringCapability, InvariantSynthesisStatistics: No data available, InterpolantConsolidationStatistics: No data available, ReuseStatistics: No data available RESULT: Ultimate proved your program to be incorrect! Received shutdown request...