./Ultimate.py --spec ../../sv-benchmarks/c/properties/unreach-call.prp --file ../../sv-benchmarks/c/ssh/s3_clnt.blast.01_false-unreach-call.i.cil.c --full-output --architecture 32bit -------------------------------------------------------------------------------- Checking for ERROR reachability Using default analysis Version aa418289 Calling Ultimate with: java -Dosgi.configuration.area=/tmp/vcloud-vcloud-master/worker/working_dir_21ce33b1-1901-46d0-92d7-0f8a6adbdd6c/bin-2019/uautomizer/data/config -Xmx12G -Xms1G -jar /tmp/vcloud-vcloud-master/worker/working_dir_21ce33b1-1901-46d0-92d7-0f8a6adbdd6c/bin-2019/uautomizer/plugins/org.eclipse.equinox.launcher_1.3.100.v20150511-1540.jar -data @noDefault -ultimatedata /tmp/vcloud-vcloud-master/worker/working_dir_21ce33b1-1901-46d0-92d7-0f8a6adbdd6c/bin-2019/uautomizer/data -tc /tmp/vcloud-vcloud-master/worker/working_dir_21ce33b1-1901-46d0-92d7-0f8a6adbdd6c/bin-2019/uautomizer/config/AutomizerReach.xml -i ../../sv-benchmarks/c/ssh/s3_clnt.blast.01_false-unreach-call.i.cil.c -s /tmp/vcloud-vcloud-master/worker/working_dir_21ce33b1-1901-46d0-92d7-0f8a6adbdd6c/bin-2019/uautomizer/config/svcomp-Reach-32bit-Automizer_Default.epf --cacsl2boogietranslator.entry.function main --witnessprinter.witness.directory /tmp/vcloud-vcloud-master/worker/working_dir_21ce33b1-1901-46d0-92d7-0f8a6adbdd6c/bin-2019/uautomizer --witnessprinter.witness.filename witness.graphml --witnessprinter.write.witness.besides.input.file false --witnessprinter.graph.data.specification CHECK( init(main()), LTL(G ! call(__VERIFIER_error())) ) --witnessprinter.graph.data.producer Automizer --witnessprinter.graph.data.architecture 32bit --witnessprinter.graph.data.programhash 9b2fdeede7b1203b845c20c562beaee69c29ce3b ................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... Execution finished normally Using bit-precise analysis Retrying with bit-precise analysis Calling Ultimate with: java -Dosgi.configuration.area=/tmp/vcloud-vcloud-master/worker/working_dir_21ce33b1-1901-46d0-92d7-0f8a6adbdd6c/bin-2019/uautomizer/data/config -Xmx12G -Xms1G -jar /tmp/vcloud-vcloud-master/worker/working_dir_21ce33b1-1901-46d0-92d7-0f8a6adbdd6c/bin-2019/uautomizer/plugins/org.eclipse.equinox.launcher_1.3.100.v20150511-1540.jar -data @noDefault -ultimatedata /tmp/vcloud-vcloud-master/worker/working_dir_21ce33b1-1901-46d0-92d7-0f8a6adbdd6c/bin-2019/uautomizer/data -tc /tmp/vcloud-vcloud-master/worker/working_dir_21ce33b1-1901-46d0-92d7-0f8a6adbdd6c/bin-2019/uautomizer/config/AutomizerReach.xml -i ../../sv-benchmarks/c/ssh/s3_clnt.blast.01_false-unreach-call.i.cil.c -s /tmp/vcloud-vcloud-master/worker/working_dir_21ce33b1-1901-46d0-92d7-0f8a6adbdd6c/bin-2019/uautomizer/config/svcomp-Reach-32bit-Automizer_Bitvector.epf --cacsl2boogietranslator.entry.function main --witnessprinter.witness.directory /tmp/vcloud-vcloud-master/worker/working_dir_21ce33b1-1901-46d0-92d7-0f8a6adbdd6c/bin-2019/uautomizer --witnessprinter.witness.filename witness.graphml --witnessprinter.write.witness.besides.input.file false --witnessprinter.graph.data.specification CHECK( init(main()), LTL(G ! call(__VERIFIER_error())) ) --witnessprinter.graph.data.producer Automizer --witnessprinter.graph.data.architecture 32bit --witnessprinter.graph.data.programhash 9b2fdeede7b1203b845c20c562beaee69c29ce3b ................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... Execution finished normally Writing output log to file Ultimate.log Writing human readable error path to file UltimateCounterExample.errorpath Result: FALSE --- Real Ultimate output --- This is Ultimate 0.1.23-aa41828 [2018-11-23 07:46:42,684 INFO L170 SettingsManager]: Resetting all preferences to default values... [2018-11-23 07:46:42,685 INFO L174 SettingsManager]: Resetting UltimateCore preferences to default values [2018-11-23 07:46:42,692 INFO L177 SettingsManager]: Ultimate Commandline Interface provides no preferences, ignoring... [2018-11-23 07:46:42,693 INFO L174 SettingsManager]: Resetting Boogie Preprocessor preferences to default values [2018-11-23 07:46:42,693 INFO L174 SettingsManager]: Resetting Boogie Procedure Inliner preferences to default values [2018-11-23 07:46:42,694 INFO L174 SettingsManager]: Resetting Abstract Interpretation preferences to default values [2018-11-23 07:46:42,695 INFO L174 SettingsManager]: Resetting LassoRanker preferences to default values [2018-11-23 07:46:42,696 INFO L174 SettingsManager]: Resetting Reaching Definitions preferences to default values [2018-11-23 07:46:42,697 INFO L174 SettingsManager]: Resetting SyntaxChecker preferences to default values [2018-11-23 07:46:42,697 INFO L177 SettingsManager]: Büchi Program Product provides no preferences, ignoring... [2018-11-23 07:46:42,697 INFO L174 SettingsManager]: Resetting LTL2Aut preferences to default values [2018-11-23 07:46:42,698 INFO L174 SettingsManager]: Resetting PEA to Boogie preferences to default values [2018-11-23 07:46:42,699 INFO L174 SettingsManager]: Resetting BlockEncodingV2 preferences to default values [2018-11-23 07:46:42,699 INFO L174 SettingsManager]: Resetting ChcToBoogie preferences to default values [2018-11-23 07:46:42,700 INFO L174 SettingsManager]: Resetting AutomataScriptInterpreter preferences to default values [2018-11-23 07:46:42,700 INFO L174 SettingsManager]: Resetting BuchiAutomizer preferences to default values [2018-11-23 07:46:42,702 INFO L174 SettingsManager]: Resetting CACSL2BoogieTranslator preferences to default values [2018-11-23 07:46:42,703 INFO L174 SettingsManager]: Resetting CodeCheck preferences to default values [2018-11-23 07:46:42,704 INFO L174 SettingsManager]: Resetting InvariantSynthesis preferences to default values [2018-11-23 07:46:42,705 INFO L174 SettingsManager]: Resetting RCFGBuilder preferences to default values [2018-11-23 07:46:42,705 INFO L174 SettingsManager]: Resetting TraceAbstraction preferences to default values [2018-11-23 07:46:42,707 INFO L177 SettingsManager]: TraceAbstractionConcurrent provides no preferences, ignoring... [2018-11-23 07:46:42,707 INFO L177 SettingsManager]: TraceAbstractionWithAFAs provides no preferences, ignoring... [2018-11-23 07:46:42,707 INFO L174 SettingsManager]: Resetting TreeAutomizer preferences to default values [2018-11-23 07:46:42,708 INFO L174 SettingsManager]: Resetting IcfgTransformer preferences to default values [2018-11-23 07:46:42,709 INFO L174 SettingsManager]: Resetting Boogie Printer preferences to default values [2018-11-23 07:46:42,709 INFO L174 SettingsManager]: Resetting ReqPrinter preferences to default values [2018-11-23 07:46:42,710 INFO L174 SettingsManager]: Resetting Witness Printer preferences to default values [2018-11-23 07:46:42,711 INFO L177 SettingsManager]: Boogie PL CUP Parser provides no preferences, ignoring... [2018-11-23 07:46:42,711 INFO L174 SettingsManager]: Resetting CDTParser preferences to default values [2018-11-23 07:46:42,711 INFO L177 SettingsManager]: AutomataScriptParser provides no preferences, ignoring... [2018-11-23 07:46:42,711 INFO L177 SettingsManager]: ReqParser provides no preferences, ignoring... [2018-11-23 07:46:42,712 INFO L174 SettingsManager]: Resetting SmtParser preferences to default values [2018-11-23 07:46:42,712 INFO L174 SettingsManager]: Resetting Witness Parser preferences to default values [2018-11-23 07:46:42,713 INFO L181 SettingsManager]: Finished resetting all preferences to default values... [2018-11-23 07:46:42,713 INFO L98 SettingsManager]: Beginning loading settings from /tmp/vcloud-vcloud-master/worker/working_dir_21ce33b1-1901-46d0-92d7-0f8a6adbdd6c/bin-2019/uautomizer/config/svcomp-Reach-32bit-Automizer_Default.epf [2018-11-23 07:46:42,723 INFO L110 SettingsManager]: Loading preferences was successful [2018-11-23 07:46:42,723 INFO L112 SettingsManager]: Preferences different from defaults after loading the file: [2018-11-23 07:46:42,723 INFO L131 SettingsManager]: Preferences of Boogie Procedure Inliner differ from their defaults: [2018-11-23 07:46:42,723 INFO L133 SettingsManager]: * ... calls to implemented procedures=ONLY_FOR_CONCURRENT_PROGRAMS [2018-11-23 07:46:42,724 INFO L131 SettingsManager]: Preferences of BlockEncodingV2 differ from their defaults: [2018-11-23 07:46:42,724 INFO L133 SettingsManager]: * Create parallel compositions if possible=false [2018-11-23 07:46:42,724 INFO L133 SettingsManager]: * Use SBE=true [2018-11-23 07:46:42,724 INFO L131 SettingsManager]: Preferences of CACSL2BoogieTranslator differ from their defaults: [2018-11-23 07:46:42,724 INFO L133 SettingsManager]: * sizeof long=4 [2018-11-23 07:46:42,725 INFO L133 SettingsManager]: * Overapproximate operations on floating types=true [2018-11-23 07:46:42,725 INFO L133 SettingsManager]: * sizeof POINTER=4 [2018-11-23 07:46:42,725 INFO L133 SettingsManager]: * Check division by zero=IGNORE [2018-11-23 07:46:42,725 INFO L133 SettingsManager]: * Pointer to allocated memory at dereference=IGNORE [2018-11-23 07:46:42,725 INFO L133 SettingsManager]: * If two pointers are subtracted or compared they have the same base address=IGNORE [2018-11-23 07:46:42,725 INFO L133 SettingsManager]: * Check array bounds for arrays that are off heap=IGNORE [2018-11-23 07:46:42,725 INFO L133 SettingsManager]: * sizeof long double=12 [2018-11-23 07:46:42,725 INFO L133 SettingsManager]: * Check if freed pointer was valid=false [2018-11-23 07:46:42,725 INFO L133 SettingsManager]: * Use constant arrays=true [2018-11-23 07:46:42,726 INFO L133 SettingsManager]: * Pointer base address is valid at dereference=IGNORE [2018-11-23 07:46:42,726 INFO L131 SettingsManager]: Preferences of RCFGBuilder differ from their defaults: [2018-11-23 07:46:42,726 INFO L133 SettingsManager]: * Size of a code block=SequenceOfStatements [2018-11-23 07:46:42,726 INFO L133 SettingsManager]: * To the following directory=./dump/ [2018-11-23 07:46:42,726 INFO L133 SettingsManager]: * SMT solver=External_DefaultMode [2018-11-23 07:46:42,726 INFO L133 SettingsManager]: * Command for external solver=z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in -t:2000 [2018-11-23 07:46:42,726 INFO L131 SettingsManager]: Preferences of TraceAbstraction differ from their defaults: [2018-11-23 07:46:42,726 INFO L133 SettingsManager]: * Compute Interpolants along a Counterexample=FPandBP [2018-11-23 07:46:42,727 INFO L133 SettingsManager]: * Positions where we compute the Hoare Annotation=LoopsAndPotentialCycles [2018-11-23 07:46:42,727 INFO L133 SettingsManager]: * Trace refinement strategy=CAMEL [2018-11-23 07:46:42,727 INFO L133 SettingsManager]: * SMT solver=External_ModelsAndUnsatCoreMode [2018-11-23 07:46:42,727 INFO L133 SettingsManager]: * Command for external solver=z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in [2018-11-23 07:46:42,727 INFO L133 SettingsManager]: * Compute Hoare Annotation of negated interpolant automaton, abstraction and CFG=true Applying setting for plugin de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator: Entry function -> main Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Witness directory -> /tmp/vcloud-vcloud-master/worker/working_dir_21ce33b1-1901-46d0-92d7-0f8a6adbdd6c/bin-2019/uautomizer Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Witness filename -> witness.graphml Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Write witness besides input file -> false Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Graph data specification -> CHECK( init(main()), LTL(G ! call(__VERIFIER_error())) ) Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Graph data producer -> Automizer Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Graph data architecture -> 32bit Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Graph data programhash -> 9b2fdeede7b1203b845c20c562beaee69c29ce3b [2018-11-23 07:46:42,751 INFO L81 nceAwareModelManager]: Repository-Root is: /tmp [2018-11-23 07:46:42,760 INFO L258 ainManager$Toolchain]: [Toolchain 1]: Applicable parser(s) successfully (re)initialized [2018-11-23 07:46:42,762 INFO L214 ainManager$Toolchain]: [Toolchain 1]: Toolchain selected. [2018-11-23 07:46:42,763 INFO L271 PluginConnector]: Initializing CDTParser... [2018-11-23 07:46:42,764 INFO L276 PluginConnector]: CDTParser initialized [2018-11-23 07:46:42,764 INFO L418 ainManager$Toolchain]: [Toolchain 1]: Parsing single file: /tmp/vcloud-vcloud-master/worker/working_dir_21ce33b1-1901-46d0-92d7-0f8a6adbdd6c/bin-2019/uautomizer/../../sv-benchmarks/c/ssh/s3_clnt.blast.01_false-unreach-call.i.cil.c [2018-11-23 07:46:42,803 INFO L221 CDTParser]: Created temporary CDT project at /tmp/vcloud-vcloud-master/worker/working_dir_21ce33b1-1901-46d0-92d7-0f8a6adbdd6c/bin-2019/uautomizer/data/96152a5c2/eff289e7c764495f938d99d1fa5a9291/FLAGa07b601a8 [2018-11-23 07:46:43,253 INFO L307 CDTParser]: Found 1 translation units. [2018-11-23 07:46:43,253 INFO L161 CDTParser]: Scanning /tmp/vcloud-vcloud-master/worker/working_dir_21ce33b1-1901-46d0-92d7-0f8a6adbdd6c/sv-benchmarks/c/ssh/s3_clnt.blast.01_false-unreach-call.i.cil.c [2018-11-23 07:46:43,265 INFO L355 CDTParser]: About to delete temporary CDT project at /tmp/vcloud-vcloud-master/worker/working_dir_21ce33b1-1901-46d0-92d7-0f8a6adbdd6c/bin-2019/uautomizer/data/96152a5c2/eff289e7c764495f938d99d1fa5a9291/FLAGa07b601a8 [2018-11-23 07:46:43,276 INFO L363 CDTParser]: Successfully deleted /tmp/vcloud-vcloud-master/worker/working_dir_21ce33b1-1901-46d0-92d7-0f8a6adbdd6c/bin-2019/uautomizer/data/96152a5c2/eff289e7c764495f938d99d1fa5a9291 [2018-11-23 07:46:43,278 INFO L296 ainManager$Toolchain]: ####################### [Toolchain 1] ####################### [2018-11-23 07:46:43,280 INFO L131 ToolchainWalker]: Walking toolchain with 6 elements. [2018-11-23 07:46:43,280 INFO L113 PluginConnector]: ------------------------CACSL2BoogieTranslator---------------------------- [2018-11-23 07:46:43,280 INFO L271 PluginConnector]: Initializing CACSL2BoogieTranslator... [2018-11-23 07:46:43,283 INFO L276 PluginConnector]: CACSL2BoogieTranslator initialized [2018-11-23 07:46:43,284 INFO L185 PluginConnector]: Executing the observer ACSLObjectContainerObserver from plugin CACSL2BoogieTranslator for "CDTParser AST 23.11 07:46:43" (1/1) ... [2018-11-23 07:46:43,286 INFO L205 PluginConnector]: Invalid model from CACSL2BoogieTranslator for observer de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator.ACSLObjectContainerObserver@34c28d62 and model type de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 23.11 07:46:43, skipping insertion in model container [2018-11-23 07:46:43,286 INFO L185 PluginConnector]: Executing the observer CACSL2BoogieTranslatorObserver from plugin CACSL2BoogieTranslator for "CDTParser AST 23.11 07:46:43" (1/1) ... [2018-11-23 07:46:43,292 INFO L145 MainTranslator]: Starting translation in SV-COMP mode [2018-11-23 07:46:43,335 INFO L176 MainTranslator]: Built tables and reachable declarations [2018-11-23 07:46:43,632 INFO L201 PostProcessor]: Analyzing one entry point: main [2018-11-23 07:46:43,641 INFO L191 MainTranslator]: Completed pre-run [2018-11-23 07:46:43,711 INFO L201 PostProcessor]: Analyzing one entry point: main [2018-11-23 07:46:43,728 INFO L195 MainTranslator]: Completed translation [2018-11-23 07:46:43,728 INFO L202 PluginConnector]: Adding new model de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 23.11 07:46:43 WrapperNode [2018-11-23 07:46:43,728 INFO L132 PluginConnector]: ------------------------ END CACSL2BoogieTranslator---------------------------- [2018-11-23 07:46:43,729 INFO L113 PluginConnector]: ------------------------Boogie Procedure Inliner---------------------------- [2018-11-23 07:46:43,729 INFO L271 PluginConnector]: Initializing Boogie Procedure Inliner... [2018-11-23 07:46:43,729 INFO L276 PluginConnector]: Boogie Procedure Inliner initialized [2018-11-23 07:46:43,734 INFO L185 PluginConnector]: Executing the observer TypeChecker from plugin Boogie Procedure Inliner for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 23.11 07:46:43" (1/1) ... [2018-11-23 07:46:43,749 INFO L185 PluginConnector]: Executing the observer Inliner from plugin Boogie Procedure Inliner for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 23.11 07:46:43" (1/1) ... [2018-11-23 07:46:43,757 INFO L132 PluginConnector]: ------------------------ END Boogie Procedure Inliner---------------------------- [2018-11-23 07:46:43,757 INFO L113 PluginConnector]: ------------------------Boogie Preprocessor---------------------------- [2018-11-23 07:46:43,757 INFO L271 PluginConnector]: Initializing Boogie Preprocessor... [2018-11-23 07:46:43,757 INFO L276 PluginConnector]: Boogie Preprocessor initialized [2018-11-23 07:46:43,763 INFO L185 PluginConnector]: Executing the observer EnsureBoogieModelObserver from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 23.11 07:46:43" (1/1) ... [2018-11-23 07:46:43,764 INFO L185 PluginConnector]: Executing the observer TypeChecker from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 23.11 07:46:43" (1/1) ... [2018-11-23 07:46:43,771 INFO L185 PluginConnector]: Executing the observer ConstExpander from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 23.11 07:46:43" (1/1) ... [2018-11-23 07:46:43,771 INFO L185 PluginConnector]: Executing the observer StructExpander from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 23.11 07:46:43" (1/1) ... [2018-11-23 07:46:43,807 INFO L185 PluginConnector]: Executing the observer UnstructureCode from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 23.11 07:46:43" (1/1) ... [2018-11-23 07:46:43,814 INFO L185 PluginConnector]: Executing the observer FunctionInliner from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 23.11 07:46:43" (1/1) ... [2018-11-23 07:46:43,816 INFO L185 PluginConnector]: Executing the observer BoogieSymbolTableConstructor from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 23.11 07:46:43" (1/1) ... [2018-11-23 07:46:43,820 INFO L132 PluginConnector]: ------------------------ END Boogie Preprocessor---------------------------- [2018-11-23 07:46:43,820 INFO L113 PluginConnector]: ------------------------RCFGBuilder---------------------------- [2018-11-23 07:46:43,820 INFO L271 PluginConnector]: Initializing RCFGBuilder... [2018-11-23 07:46:43,820 INFO L276 PluginConnector]: RCFGBuilder initialized [2018-11-23 07:46:43,821 INFO L185 PluginConnector]: Executing the observer RCFGBuilderObserver from plugin RCFGBuilder for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 23.11 07:46:43" (1/1) ... No working directory specified, using /tmp/vcloud-vcloud-master/worker/working_dir_21ce33b1-1901-46d0-92d7-0f8a6adbdd6c/bin-2019/uautomizer/z3 Starting monitored process 1 with z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in -t:2000 (exit command is (exit), workingDir is null) Waiting until toolchain timeout for monitored process 1 with z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in -t:2000 [2018-11-23 07:46:43,864 INFO L130 BoogieDeclarations]: Found specification of procedure write~init~$Pointer$ [2018-11-23 07:46:43,864 INFO L130 BoogieDeclarations]: Found specification of procedure main [2018-11-23 07:46:43,865 INFO L138 BoogieDeclarations]: Found implementation of procedure main [2018-11-23 07:46:43,865 INFO L130 BoogieDeclarations]: Found specification of procedure write~$Pointer$ [2018-11-23 07:46:43,865 INFO L130 BoogieDeclarations]: Found specification of procedure write~int [2018-11-23 07:46:43,865 INFO L130 BoogieDeclarations]: Found specification of procedure #Ultimate.alloc [2018-11-23 07:46:43,865 INFO L130 BoogieDeclarations]: Found specification of procedure read~int [2018-11-23 07:46:43,865 INFO L130 BoogieDeclarations]: Found specification of procedure read~$Pointer$ [2018-11-23 07:46:43,866 INFO L130 BoogieDeclarations]: Found specification of procedure write~init~int [2018-11-23 07:46:43,866 INFO L130 BoogieDeclarations]: Found specification of procedure ULTIMATE.init [2018-11-23 07:46:43,866 INFO L138 BoogieDeclarations]: Found implementation of procedure ULTIMATE.init [2018-11-23 07:46:43,866 INFO L130 BoogieDeclarations]: Found specification of procedure ssl3_connect [2018-11-23 07:46:43,866 INFO L138 BoogieDeclarations]: Found implementation of procedure ssl3_connect [2018-11-23 07:46:43,866 INFO L130 BoogieDeclarations]: Found specification of procedure ULTIMATE.start [2018-11-23 07:46:43,866 INFO L138 BoogieDeclarations]: Found implementation of procedure ULTIMATE.start [2018-11-23 07:46:44,042 WARN L640 $ProcedureCfgBuilder]: Two Gotos in a row! There was dead code [2018-11-23 07:46:44,042 WARN L605 $ProcedureCfgBuilder]: Label in the middle of a codeblock. [2018-11-23 07:46:44,460 INFO L275 CfgBuilder]: Using the 1 location(s) as analysis (start of procedure ULTIMATE.start) [2018-11-23 07:46:44,460 INFO L280 CfgBuilder]: Removed 1 assue(true) statements. [2018-11-23 07:46:44,460 INFO L202 PluginConnector]: Adding new model de.uni_freiburg.informatik.ultimate.plugins.generator.rcfgbuilder CFG 23.11 07:46:44 BoogieIcfgContainer [2018-11-23 07:46:44,460 INFO L132 PluginConnector]: ------------------------ END RCFGBuilder---------------------------- [2018-11-23 07:46:44,461 INFO L113 PluginConnector]: ------------------------TraceAbstraction---------------------------- [2018-11-23 07:46:44,461 INFO L271 PluginConnector]: Initializing TraceAbstraction... [2018-11-23 07:46:44,463 INFO L276 PluginConnector]: TraceAbstraction initialized [2018-11-23 07:46:44,463 INFO L185 PluginConnector]: Executing the observer TraceAbstractionObserver from plugin TraceAbstraction for "CDTParser AST 23.11 07:46:43" (1/3) ... [2018-11-23 07:46:44,464 INFO L205 PluginConnector]: Invalid model from TraceAbstraction for observer de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction.TraceAbstractionObserver@10f0832 and model type de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction AST 23.11 07:46:44, skipping insertion in model container [2018-11-23 07:46:44,464 INFO L185 PluginConnector]: Executing the observer TraceAbstractionObserver from plugin TraceAbstraction for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 23.11 07:46:43" (2/3) ... [2018-11-23 07:46:44,464 INFO L205 PluginConnector]: Invalid model from TraceAbstraction for observer de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction.TraceAbstractionObserver@10f0832 and model type de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction AST 23.11 07:46:44, skipping insertion in model container [2018-11-23 07:46:44,464 INFO L185 PluginConnector]: Executing the observer TraceAbstractionObserver from plugin TraceAbstraction for "de.uni_freiburg.informatik.ultimate.plugins.generator.rcfgbuilder CFG 23.11 07:46:44" (3/3) ... [2018-11-23 07:46:44,466 INFO L112 eAbstractionObserver]: Analyzing ICFG s3_clnt.blast.01_false-unreach-call.i.cil.c [2018-11-23 07:46:44,474 INFO L156 ceAbstractionStarter]: Automizer settings: Hoare:true NWA Interpolation:FPandBP Determinization: PREDICATE_ABSTRACTION [2018-11-23 07:46:44,480 INFO L168 ceAbstractionStarter]: Appying trace abstraction to program that has 1 error locations. [2018-11-23 07:46:44,493 INFO L257 AbstractCegarLoop]: Starting to check reachability of 1 error locations. [2018-11-23 07:46:44,518 INFO L133 ementStrategyFactory]: Using default assertion order modulation [2018-11-23 07:46:44,518 INFO L382 AbstractCegarLoop]: Interprodecural is true [2018-11-23 07:46:44,518 INFO L383 AbstractCegarLoop]: Hoare is true [2018-11-23 07:46:44,518 INFO L384 AbstractCegarLoop]: Compute interpolants for FPandBP [2018-11-23 07:46:44,518 INFO L385 AbstractCegarLoop]: Backedges is STRAIGHT_LINE [2018-11-23 07:46:44,518 INFO L386 AbstractCegarLoop]: Determinization is PREDICATE_ABSTRACTION [2018-11-23 07:46:44,519 INFO L387 AbstractCegarLoop]: Difference is false [2018-11-23 07:46:44,519 INFO L388 AbstractCegarLoop]: Minimize is MINIMIZE_SEVPA [2018-11-23 07:46:44,519 INFO L393 AbstractCegarLoop]: ======== Iteration 0==of CEGAR loop == AllErrorsAtOnce======== [2018-11-23 07:46:44,533 INFO L276 IsEmpty]: Start isEmpty. Operand 140 states. [2018-11-23 07:46:44,539 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 31 [2018-11-23 07:46:44,539 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 07:46:44,540 INFO L402 BasicCegarLoop]: trace histogram [1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 07:46:44,542 INFO L423 AbstractCegarLoop]: === Iteration 1 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 07:46:44,546 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 07:46:44,546 INFO L82 PathProgramCache]: Analyzing trace with hash -1513562951, now seen corresponding path program 1 times [2018-11-23 07:46:44,548 INFO L223 ckRefinementStrategy]: Switched to mode SMTINTERPOL_TREE_INTERPOLANTS [2018-11-23 07:46:44,548 INFO L69 tionRefinementEngine]: Using refinement strategy CamelRefinementStrategy [2018-11-23 07:46:44,584 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 07:46:44,584 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 07:46:44,584 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 07:46:44,652 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 07:46:44,738 INFO L134 CoverageAnalysis]: Checked inductivity of 0 backedges. 0 proven. 0 refuted. 0 times theorem prover too weak. 0 trivial. 0 not checked. [2018-11-23 07:46:44,740 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 07:46:44,740 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [3] imperfect sequences [] total 3 [2018-11-23 07:46:44,743 INFO L459 AbstractCegarLoop]: Interpolant automaton has 3 states [2018-11-23 07:46:44,754 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 3 interpolants. [2018-11-23 07:46:44,755 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=3, Invalid=3, Unknown=0, NotChecked=0, Total=6 [2018-11-23 07:46:44,757 INFO L87 Difference]: Start difference. First operand 140 states. Second operand 3 states. [2018-11-23 07:46:44,836 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 07:46:44,836 INFO L93 Difference]: Finished difference Result 385 states and 637 transitions. [2018-11-23 07:46:44,837 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 3 states. [2018-11-23 07:46:44,838 INFO L78 Accepts]: Start accepts. Automaton has 3 states. Word has length 30 [2018-11-23 07:46:44,838 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 07:46:44,849 INFO L225 Difference]: With dead ends: 385 [2018-11-23 07:46:44,849 INFO L226 Difference]: Without dead ends: 223 [2018-11-23 07:46:44,852 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 3 GetRequests, 2 SyntacticMatches, 0 SemanticMatches, 1 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=3, Invalid=3, Unknown=0, NotChecked=0, Total=6 [2018-11-23 07:46:44,866 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 223 states. [2018-11-23 07:46:44,888 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 223 to 223. [2018-11-23 07:46:44,889 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 223 states. [2018-11-23 07:46:44,892 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 223 states to 223 states and 327 transitions. [2018-11-23 07:46:44,893 INFO L78 Accepts]: Start accepts. Automaton has 223 states and 327 transitions. Word has length 30 [2018-11-23 07:46:44,893 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 07:46:44,893 INFO L480 AbstractCegarLoop]: Abstraction has 223 states and 327 transitions. [2018-11-23 07:46:44,893 INFO L481 AbstractCegarLoop]: Interpolant automaton has 3 states. [2018-11-23 07:46:44,894 INFO L276 IsEmpty]: Start isEmpty. Operand 223 states and 327 transitions. [2018-11-23 07:46:44,895 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 46 [2018-11-23 07:46:44,895 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 07:46:44,895 INFO L402 BasicCegarLoop]: trace histogram [2, 2, 2, 2, 2, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 07:46:44,896 INFO L423 AbstractCegarLoop]: === Iteration 2 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 07:46:44,896 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 07:46:44,896 INFO L82 PathProgramCache]: Analyzing trace with hash -959560751, now seen corresponding path program 1 times [2018-11-23 07:46:44,896 INFO L223 ckRefinementStrategy]: Switched to mode SMTINTERPOL_TREE_INTERPOLANTS [2018-11-23 07:46:44,896 INFO L69 tionRefinementEngine]: Using refinement strategy CamelRefinementStrategy [2018-11-23 07:46:44,897 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 07:46:44,898 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 07:46:44,898 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 07:46:44,927 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 07:46:44,981 INFO L134 CoverageAnalysis]: Checked inductivity of 8 backedges. 8 proven. 0 refuted. 0 times theorem prover too weak. 0 trivial. 0 not checked. [2018-11-23 07:46:44,982 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 07:46:44,982 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [3] imperfect sequences [] total 3 [2018-11-23 07:46:44,983 INFO L459 AbstractCegarLoop]: Interpolant automaton has 3 states [2018-11-23 07:46:44,983 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 3 interpolants. [2018-11-23 07:46:44,983 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=3, Invalid=3, Unknown=0, NotChecked=0, Total=6 [2018-11-23 07:46:44,983 INFO L87 Difference]: Start difference. First operand 223 states and 327 transitions. Second operand 3 states. [2018-11-23 07:46:45,024 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 07:46:45,025 INFO L93 Difference]: Finished difference Result 432 states and 642 transitions. [2018-11-23 07:46:45,025 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 3 states. [2018-11-23 07:46:45,025 INFO L78 Accepts]: Start accepts. Automaton has 3 states. Word has length 45 [2018-11-23 07:46:45,025 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 07:46:45,027 INFO L225 Difference]: With dead ends: 432 [2018-11-23 07:46:45,027 INFO L226 Difference]: Without dead ends: 325 [2018-11-23 07:46:45,028 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 3 GetRequests, 2 SyntacticMatches, 0 SemanticMatches, 1 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=3, Invalid=3, Unknown=0, NotChecked=0, Total=6 [2018-11-23 07:46:45,029 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 325 states. [2018-11-23 07:46:45,046 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 325 to 325. [2018-11-23 07:46:45,046 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 325 states. [2018-11-23 07:46:45,047 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 325 states to 325 states and 476 transitions. [2018-11-23 07:46:45,047 INFO L78 Accepts]: Start accepts. Automaton has 325 states and 476 transitions. Word has length 45 [2018-11-23 07:46:45,048 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 07:46:45,048 INFO L480 AbstractCegarLoop]: Abstraction has 325 states and 476 transitions. [2018-11-23 07:46:45,048 INFO L481 AbstractCegarLoop]: Interpolant automaton has 3 states. [2018-11-23 07:46:45,048 INFO L276 IsEmpty]: Start isEmpty. Operand 325 states and 476 transitions. [2018-11-23 07:46:45,050 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 64 [2018-11-23 07:46:45,050 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 07:46:45,051 INFO L402 BasicCegarLoop]: trace histogram [3, 3, 3, 3, 3, 3, 3, 2, 2, 2, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 07:46:45,051 INFO L423 AbstractCegarLoop]: === Iteration 3 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 07:46:45,051 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 07:46:45,051 INFO L82 PathProgramCache]: Analyzing trace with hash -1822634295, now seen corresponding path program 1 times [2018-11-23 07:46:45,051 INFO L223 ckRefinementStrategy]: Switched to mode SMTINTERPOL_TREE_INTERPOLANTS [2018-11-23 07:46:45,051 INFO L69 tionRefinementEngine]: Using refinement strategy CamelRefinementStrategy [2018-11-23 07:46:45,053 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 07:46:45,053 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 07:46:45,053 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 07:46:45,083 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 07:46:45,172 INFO L134 CoverageAnalysis]: Checked inductivity of 29 backedges. 21 proven. 0 refuted. 0 times theorem prover too weak. 8 trivial. 0 not checked. [2018-11-23 07:46:45,173 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 07:46:45,173 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [4] imperfect sequences [] total 4 [2018-11-23 07:46:45,174 INFO L459 AbstractCegarLoop]: Interpolant automaton has 4 states [2018-11-23 07:46:45,174 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 4 interpolants. [2018-11-23 07:46:45,174 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=5, Invalid=7, Unknown=0, NotChecked=0, Total=12 [2018-11-23 07:46:45,174 INFO L87 Difference]: Start difference. First operand 325 states and 476 transitions. Second operand 4 states. [2018-11-23 07:46:45,552 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 07:46:45,552 INFO L93 Difference]: Finished difference Result 825 states and 1216 transitions. [2018-11-23 07:46:45,553 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 4 states. [2018-11-23 07:46:45,553 INFO L78 Accepts]: Start accepts. Automaton has 4 states. Word has length 63 [2018-11-23 07:46:45,553 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 07:46:45,555 INFO L225 Difference]: With dead ends: 825 [2018-11-23 07:46:45,555 INFO L226 Difference]: Without dead ends: 513 [2018-11-23 07:46:45,556 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 6 GetRequests, 2 SyntacticMatches, 1 SemanticMatches, 3 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=9, Invalid=11, Unknown=0, NotChecked=0, Total=20 [2018-11-23 07:46:45,557 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 513 states. [2018-11-23 07:46:45,571 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 513 to 375. [2018-11-23 07:46:45,571 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 375 states. [2018-11-23 07:46:45,573 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 375 states to 375 states and 562 transitions. [2018-11-23 07:46:45,573 INFO L78 Accepts]: Start accepts. Automaton has 375 states and 562 transitions. Word has length 63 [2018-11-23 07:46:45,573 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 07:46:45,573 INFO L480 AbstractCegarLoop]: Abstraction has 375 states and 562 transitions. [2018-11-23 07:46:45,573 INFO L481 AbstractCegarLoop]: Interpolant automaton has 4 states. [2018-11-23 07:46:45,573 INFO L276 IsEmpty]: Start isEmpty. Operand 375 states and 562 transitions. [2018-11-23 07:46:45,575 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 64 [2018-11-23 07:46:45,575 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 07:46:45,576 INFO L402 BasicCegarLoop]: trace histogram [3, 3, 3, 3, 3, 3, 3, 2, 2, 2, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 07:46:45,577 INFO L423 AbstractCegarLoop]: === Iteration 4 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 07:46:45,578 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 07:46:45,578 INFO L82 PathProgramCache]: Analyzing trace with hash -1956647801, now seen corresponding path program 1 times [2018-11-23 07:46:45,578 INFO L223 ckRefinementStrategy]: Switched to mode SMTINTERPOL_TREE_INTERPOLANTS [2018-11-23 07:46:45,578 INFO L69 tionRefinementEngine]: Using refinement strategy CamelRefinementStrategy [2018-11-23 07:46:45,579 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 07:46:45,579 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 07:46:45,579 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 07:46:45,595 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 07:46:45,655 INFO L134 CoverageAnalysis]: Checked inductivity of 29 backedges. 21 proven. 0 refuted. 0 times theorem prover too weak. 8 trivial. 0 not checked. [2018-11-23 07:46:45,655 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 07:46:45,655 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [4] imperfect sequences [] total 4 [2018-11-23 07:46:45,656 INFO L459 AbstractCegarLoop]: Interpolant automaton has 4 states [2018-11-23 07:46:45,656 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 4 interpolants. [2018-11-23 07:46:45,656 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=5, Invalid=7, Unknown=0, NotChecked=0, Total=12 [2018-11-23 07:46:45,656 INFO L87 Difference]: Start difference. First operand 375 states and 562 transitions. Second operand 4 states. [2018-11-23 07:46:45,857 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 07:46:45,857 INFO L93 Difference]: Finished difference Result 821 states and 1232 transitions. [2018-11-23 07:46:45,858 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 4 states. [2018-11-23 07:46:45,858 INFO L78 Accepts]: Start accepts. Automaton has 4 states. Word has length 63 [2018-11-23 07:46:45,859 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 07:46:45,860 INFO L225 Difference]: With dead ends: 821 [2018-11-23 07:46:45,860 INFO L226 Difference]: Without dead ends: 459 [2018-11-23 07:46:45,860 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 6 GetRequests, 2 SyntacticMatches, 1 SemanticMatches, 3 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=9, Invalid=11, Unknown=0, NotChecked=0, Total=20 [2018-11-23 07:46:45,861 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 459 states. [2018-11-23 07:46:45,869 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 459 to 415. [2018-11-23 07:46:45,869 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 415 states. [2018-11-23 07:46:45,870 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 415 states to 415 states and 630 transitions. [2018-11-23 07:46:45,871 INFO L78 Accepts]: Start accepts. Automaton has 415 states and 630 transitions. Word has length 63 [2018-11-23 07:46:45,871 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 07:46:45,871 INFO L480 AbstractCegarLoop]: Abstraction has 415 states and 630 transitions. [2018-11-23 07:46:45,871 INFO L481 AbstractCegarLoop]: Interpolant automaton has 4 states. [2018-11-23 07:46:45,871 INFO L276 IsEmpty]: Start isEmpty. Operand 415 states and 630 transitions. [2018-11-23 07:46:45,872 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 65 [2018-11-23 07:46:45,872 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 07:46:45,873 INFO L402 BasicCegarLoop]: trace histogram [3, 3, 3, 3, 3, 3, 3, 2, 2, 2, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 07:46:45,873 INFO L423 AbstractCegarLoop]: === Iteration 5 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 07:46:45,873 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 07:46:45,873 INFO L82 PathProgramCache]: Analyzing trace with hash -671506196, now seen corresponding path program 1 times [2018-11-23 07:46:45,873 INFO L223 ckRefinementStrategy]: Switched to mode SMTINTERPOL_TREE_INTERPOLANTS [2018-11-23 07:46:45,873 INFO L69 tionRefinementEngine]: Using refinement strategy CamelRefinementStrategy [2018-11-23 07:46:45,874 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 07:46:45,874 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 07:46:45,874 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 07:46:45,888 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 07:46:45,927 INFO L134 CoverageAnalysis]: Checked inductivity of 29 backedges. 21 proven. 0 refuted. 0 times theorem prover too weak. 8 trivial. 0 not checked. [2018-11-23 07:46:45,927 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 07:46:45,927 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [4] imperfect sequences [] total 4 [2018-11-23 07:46:45,927 INFO L459 AbstractCegarLoop]: Interpolant automaton has 4 states [2018-11-23 07:46:45,927 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 4 interpolants. [2018-11-23 07:46:45,927 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=5, Invalid=7, Unknown=0, NotChecked=0, Total=12 [2018-11-23 07:46:45,928 INFO L87 Difference]: Start difference. First operand 415 states and 630 transitions. Second operand 4 states. [2018-11-23 07:46:46,165 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 07:46:46,165 INFO L93 Difference]: Finished difference Result 949 states and 1429 transitions. [2018-11-23 07:46:46,166 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 4 states. [2018-11-23 07:46:46,167 INFO L78 Accepts]: Start accepts. Automaton has 4 states. Word has length 64 [2018-11-23 07:46:46,167 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 07:46:46,168 INFO L225 Difference]: With dead ends: 949 [2018-11-23 07:46:46,168 INFO L226 Difference]: Without dead ends: 547 [2018-11-23 07:46:46,169 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 6 GetRequests, 2 SyntacticMatches, 1 SemanticMatches, 3 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=9, Invalid=11, Unknown=0, NotChecked=0, Total=20 [2018-11-23 07:46:46,170 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 547 states. [2018-11-23 07:46:46,176 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 547 to 417. [2018-11-23 07:46:46,176 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 417 states. [2018-11-23 07:46:46,177 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 417 states to 417 states and 632 transitions. [2018-11-23 07:46:46,177 INFO L78 Accepts]: Start accepts. Automaton has 417 states and 632 transitions. Word has length 64 [2018-11-23 07:46:46,178 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 07:46:46,178 INFO L480 AbstractCegarLoop]: Abstraction has 417 states and 632 transitions. [2018-11-23 07:46:46,178 INFO L481 AbstractCegarLoop]: Interpolant automaton has 4 states. [2018-11-23 07:46:46,178 INFO L276 IsEmpty]: Start isEmpty. Operand 417 states and 632 transitions. [2018-11-23 07:46:46,179 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 66 [2018-11-23 07:46:46,179 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 07:46:46,179 INFO L402 BasicCegarLoop]: trace histogram [3, 3, 3, 3, 3, 3, 3, 2, 2, 2, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 07:46:46,179 INFO L423 AbstractCegarLoop]: === Iteration 6 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 07:46:46,179 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 07:46:46,180 INFO L82 PathProgramCache]: Analyzing trace with hash 653887364, now seen corresponding path program 1 times [2018-11-23 07:46:46,180 INFO L223 ckRefinementStrategy]: Switched to mode SMTINTERPOL_TREE_INTERPOLANTS [2018-11-23 07:46:46,180 INFO L69 tionRefinementEngine]: Using refinement strategy CamelRefinementStrategy [2018-11-23 07:46:46,180 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 07:46:46,180 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 07:46:46,181 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 07:46:46,193 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 07:46:46,223 INFO L134 CoverageAnalysis]: Checked inductivity of 29 backedges. 21 proven. 0 refuted. 0 times theorem prover too weak. 8 trivial. 0 not checked. [2018-11-23 07:46:46,223 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 07:46:46,223 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [4] imperfect sequences [] total 4 [2018-11-23 07:46:46,224 INFO L459 AbstractCegarLoop]: Interpolant automaton has 4 states [2018-11-23 07:46:46,224 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 4 interpolants. [2018-11-23 07:46:46,224 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=5, Invalid=7, Unknown=0, NotChecked=0, Total=12 [2018-11-23 07:46:46,224 INFO L87 Difference]: Start difference. First operand 417 states and 632 transitions. Second operand 4 states. [2018-11-23 07:46:46,455 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 07:46:46,455 INFO L93 Difference]: Finished difference Result 951 states and 1429 transitions. [2018-11-23 07:46:46,455 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 4 states. [2018-11-23 07:46:46,455 INFO L78 Accepts]: Start accepts. Automaton has 4 states. Word has length 65 [2018-11-23 07:46:46,456 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 07:46:46,457 INFO L225 Difference]: With dead ends: 951 [2018-11-23 07:46:46,457 INFO L226 Difference]: Without dead ends: 547 [2018-11-23 07:46:46,458 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 6 GetRequests, 2 SyntacticMatches, 1 SemanticMatches, 3 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=9, Invalid=11, Unknown=0, NotChecked=0, Total=20 [2018-11-23 07:46:46,459 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 547 states. [2018-11-23 07:46:46,465 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 547 to 419. [2018-11-23 07:46:46,465 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 419 states. [2018-11-23 07:46:46,466 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 419 states to 419 states and 634 transitions. [2018-11-23 07:46:46,467 INFO L78 Accepts]: Start accepts. Automaton has 419 states and 634 transitions. Word has length 65 [2018-11-23 07:46:46,467 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 07:46:46,467 INFO L480 AbstractCegarLoop]: Abstraction has 419 states and 634 transitions. [2018-11-23 07:46:46,467 INFO L481 AbstractCegarLoop]: Interpolant automaton has 4 states. [2018-11-23 07:46:46,467 INFO L276 IsEmpty]: Start isEmpty. Operand 419 states and 634 transitions. [2018-11-23 07:46:46,468 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 67 [2018-11-23 07:46:46,468 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 07:46:46,468 INFO L402 BasicCegarLoop]: trace histogram [3, 3, 3, 3, 3, 3, 3, 2, 2, 2, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 07:46:46,468 INFO L423 AbstractCegarLoop]: === Iteration 7 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 07:46:46,469 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 07:46:46,469 INFO L82 PathProgramCache]: Analyzing trace with hash -1208805305, now seen corresponding path program 1 times [2018-11-23 07:46:46,469 INFO L223 ckRefinementStrategy]: Switched to mode SMTINTERPOL_TREE_INTERPOLANTS [2018-11-23 07:46:46,469 INFO L69 tionRefinementEngine]: Using refinement strategy CamelRefinementStrategy [2018-11-23 07:46:46,470 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 07:46:46,470 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 07:46:46,470 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 07:46:46,483 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 07:46:46,512 INFO L134 CoverageAnalysis]: Checked inductivity of 29 backedges. 21 proven. 0 refuted. 0 times theorem prover too weak. 8 trivial. 0 not checked. [2018-11-23 07:46:46,512 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 07:46:46,512 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [4] imperfect sequences [] total 4 [2018-11-23 07:46:46,513 INFO L459 AbstractCegarLoop]: Interpolant automaton has 4 states [2018-11-23 07:46:46,513 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 4 interpolants. [2018-11-23 07:46:46,513 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=5, Invalid=7, Unknown=0, NotChecked=0, Total=12 [2018-11-23 07:46:46,513 INFO L87 Difference]: Start difference. First operand 419 states and 634 transitions. Second operand 4 states. [2018-11-23 07:46:46,770 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 07:46:46,770 INFO L93 Difference]: Finished difference Result 943 states and 1417 transitions. [2018-11-23 07:46:46,771 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 4 states. [2018-11-23 07:46:46,771 INFO L78 Accepts]: Start accepts. Automaton has 4 states. Word has length 66 [2018-11-23 07:46:46,771 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 07:46:46,772 INFO L225 Difference]: With dead ends: 943 [2018-11-23 07:46:46,773 INFO L226 Difference]: Without dead ends: 537 [2018-11-23 07:46:46,773 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 6 GetRequests, 2 SyntacticMatches, 1 SemanticMatches, 3 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=9, Invalid=11, Unknown=0, NotChecked=0, Total=20 [2018-11-23 07:46:46,774 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 537 states. [2018-11-23 07:46:46,780 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 537 to 421. [2018-11-23 07:46:46,780 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 421 states. [2018-11-23 07:46:46,781 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 421 states to 421 states and 636 transitions. [2018-11-23 07:46:46,781 INFO L78 Accepts]: Start accepts. Automaton has 421 states and 636 transitions. Word has length 66 [2018-11-23 07:46:46,782 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 07:46:46,782 INFO L480 AbstractCegarLoop]: Abstraction has 421 states and 636 transitions. [2018-11-23 07:46:46,782 INFO L481 AbstractCegarLoop]: Interpolant automaton has 4 states. [2018-11-23 07:46:46,782 INFO L276 IsEmpty]: Start isEmpty. Operand 421 states and 636 transitions. [2018-11-23 07:46:46,783 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 79 [2018-11-23 07:46:46,783 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 07:46:46,783 INFO L402 BasicCegarLoop]: trace histogram [4, 4, 3, 3, 3, 3, 3, 3, 3, 3, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 07:46:46,783 INFO L423 AbstractCegarLoop]: === Iteration 8 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 07:46:46,783 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 07:46:46,783 INFO L82 PathProgramCache]: Analyzing trace with hash -784316286, now seen corresponding path program 1 times [2018-11-23 07:46:46,783 INFO L223 ckRefinementStrategy]: Switched to mode SMTINTERPOL_TREE_INTERPOLANTS [2018-11-23 07:46:46,784 INFO L69 tionRefinementEngine]: Using refinement strategy CamelRefinementStrategy [2018-11-23 07:46:46,784 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 07:46:46,785 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 07:46:46,785 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 07:46:46,797 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 07:46:46,855 INFO L134 CoverageAnalysis]: Checked inductivity of 44 backedges. 36 proven. 0 refuted. 0 times theorem prover too weak. 8 trivial. 0 not checked. [2018-11-23 07:46:46,855 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 07:46:46,855 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [4] imperfect sequences [] total 4 [2018-11-23 07:46:46,855 INFO L459 AbstractCegarLoop]: Interpolant automaton has 4 states [2018-11-23 07:46:46,855 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 4 interpolants. [2018-11-23 07:46:46,855 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=5, Invalid=7, Unknown=0, NotChecked=0, Total=12 [2018-11-23 07:46:46,856 INFO L87 Difference]: Start difference. First operand 421 states and 636 transitions. Second operand 4 states. [2018-11-23 07:46:47,183 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 07:46:47,184 INFO L93 Difference]: Finished difference Result 943 states and 1415 transitions. [2018-11-23 07:46:47,184 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 4 states. [2018-11-23 07:46:47,184 INFO L78 Accepts]: Start accepts. Automaton has 4 states. Word has length 78 [2018-11-23 07:46:47,184 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 07:46:47,186 INFO L225 Difference]: With dead ends: 943 [2018-11-23 07:46:47,186 INFO L226 Difference]: Without dead ends: 535 [2018-11-23 07:46:47,187 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 7 GetRequests, 2 SyntacticMatches, 2 SemanticMatches, 3 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=9, Invalid=11, Unknown=0, NotChecked=0, Total=20 [2018-11-23 07:46:47,187 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 535 states. [2018-11-23 07:46:47,198 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 535 to 421. [2018-11-23 07:46:47,199 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 421 states. [2018-11-23 07:46:47,200 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 421 states to 421 states and 634 transitions. [2018-11-23 07:46:47,200 INFO L78 Accepts]: Start accepts. Automaton has 421 states and 634 transitions. Word has length 78 [2018-11-23 07:46:47,200 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 07:46:47,200 INFO L480 AbstractCegarLoop]: Abstraction has 421 states and 634 transitions. [2018-11-23 07:46:47,200 INFO L481 AbstractCegarLoop]: Interpolant automaton has 4 states. [2018-11-23 07:46:47,201 INFO L276 IsEmpty]: Start isEmpty. Operand 421 states and 634 transitions. [2018-11-23 07:46:47,201 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 79 [2018-11-23 07:46:47,202 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 07:46:47,202 INFO L402 BasicCegarLoop]: trace histogram [4, 4, 4, 3, 3, 3, 3, 3, 3, 3, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 07:46:47,202 INFO L423 AbstractCegarLoop]: === Iteration 9 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 07:46:47,202 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 07:46:47,202 INFO L82 PathProgramCache]: Analyzing trace with hash -802971744, now seen corresponding path program 1 times [2018-11-23 07:46:47,202 INFO L223 ckRefinementStrategy]: Switched to mode SMTINTERPOL_TREE_INTERPOLANTS [2018-11-23 07:46:47,202 INFO L69 tionRefinementEngine]: Using refinement strategy CamelRefinementStrategy [2018-11-23 07:46:47,203 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 07:46:47,203 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 07:46:47,203 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 07:46:47,217 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 07:46:47,252 INFO L134 CoverageAnalysis]: Checked inductivity of 47 backedges. 39 proven. 0 refuted. 0 times theorem prover too weak. 8 trivial. 0 not checked. [2018-11-23 07:46:47,252 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 07:46:47,253 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [4] imperfect sequences [] total 4 [2018-11-23 07:46:47,253 INFO L459 AbstractCegarLoop]: Interpolant automaton has 4 states [2018-11-23 07:46:47,253 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 4 interpolants. [2018-11-23 07:46:47,253 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=5, Invalid=7, Unknown=0, NotChecked=0, Total=12 [2018-11-23 07:46:47,253 INFO L87 Difference]: Start difference. First operand 421 states and 634 transitions. Second operand 4 states. [2018-11-23 07:46:47,554 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 07:46:47,555 INFO L93 Difference]: Finished difference Result 943 states and 1411 transitions. [2018-11-23 07:46:47,555 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 4 states. [2018-11-23 07:46:47,555 INFO L78 Accepts]: Start accepts. Automaton has 4 states. Word has length 78 [2018-11-23 07:46:47,556 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 07:46:47,557 INFO L225 Difference]: With dead ends: 943 [2018-11-23 07:46:47,557 INFO L226 Difference]: Without dead ends: 535 [2018-11-23 07:46:47,558 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 7 GetRequests, 2 SyntacticMatches, 2 SemanticMatches, 3 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=9, Invalid=11, Unknown=0, NotChecked=0, Total=20 [2018-11-23 07:46:47,558 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 535 states. [2018-11-23 07:46:47,568 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 535 to 421. [2018-11-23 07:46:47,568 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 421 states. [2018-11-23 07:46:47,570 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 421 states to 421 states and 632 transitions. [2018-11-23 07:46:47,570 INFO L78 Accepts]: Start accepts. Automaton has 421 states and 632 transitions. Word has length 78 [2018-11-23 07:46:47,570 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 07:46:47,570 INFO L480 AbstractCegarLoop]: Abstraction has 421 states and 632 transitions. [2018-11-23 07:46:47,570 INFO L481 AbstractCegarLoop]: Interpolant automaton has 4 states. [2018-11-23 07:46:47,570 INFO L276 IsEmpty]: Start isEmpty. Operand 421 states and 632 transitions. [2018-11-23 07:46:47,571 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 79 [2018-11-23 07:46:47,571 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 07:46:47,571 INFO L402 BasicCegarLoop]: trace histogram [4, 4, 4, 4, 4, 4, 4, 3, 3, 3, 2, 2, 2, 2, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 07:46:47,572 INFO L423 AbstractCegarLoop]: === Iteration 10 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 07:46:47,572 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 07:46:47,572 INFO L82 PathProgramCache]: Analyzing trace with hash -1508472381, now seen corresponding path program 1 times [2018-11-23 07:46:47,572 INFO L223 ckRefinementStrategy]: Switched to mode SMTINTERPOL_TREE_INTERPOLANTS [2018-11-23 07:46:47,572 INFO L69 tionRefinementEngine]: Using refinement strategy CamelRefinementStrategy [2018-11-23 07:46:47,573 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 07:46:47,573 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 07:46:47,573 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 07:46:47,585 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 07:46:47,619 INFO L134 CoverageAnalysis]: Checked inductivity of 63 backedges. 55 proven. 0 refuted. 0 times theorem prover too weak. 8 trivial. 0 not checked. [2018-11-23 07:46:47,619 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 07:46:47,619 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [4] imperfect sequences [] total 4 [2018-11-23 07:46:47,619 INFO L459 AbstractCegarLoop]: Interpolant automaton has 4 states [2018-11-23 07:46:47,619 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 4 interpolants. [2018-11-23 07:46:47,619 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=5, Invalid=7, Unknown=0, NotChecked=0, Total=12 [2018-11-23 07:46:47,620 INFO L87 Difference]: Start difference. First operand 421 states and 632 transitions. Second operand 4 states. [2018-11-23 07:46:47,923 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 07:46:47,923 INFO L93 Difference]: Finished difference Result 794 states and 1181 transitions. [2018-11-23 07:46:47,924 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 4 states. [2018-11-23 07:46:47,924 INFO L78 Accepts]: Start accepts. Automaton has 4 states. Word has length 78 [2018-11-23 07:46:47,924 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 07:46:47,926 INFO L225 Difference]: With dead ends: 794 [2018-11-23 07:46:47,926 INFO L226 Difference]: Without dead ends: 535 [2018-11-23 07:46:47,927 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 7 GetRequests, 2 SyntacticMatches, 2 SemanticMatches, 3 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=9, Invalid=11, Unknown=0, NotChecked=0, Total=20 [2018-11-23 07:46:47,927 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 535 states. [2018-11-23 07:46:47,937 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 535 to 421. [2018-11-23 07:46:47,937 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 421 states. [2018-11-23 07:46:47,939 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 421 states to 421 states and 630 transitions. [2018-11-23 07:46:47,939 INFO L78 Accepts]: Start accepts. Automaton has 421 states and 630 transitions. Word has length 78 [2018-11-23 07:46:47,939 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 07:46:47,939 INFO L480 AbstractCegarLoop]: Abstraction has 421 states and 630 transitions. [2018-11-23 07:46:47,939 INFO L481 AbstractCegarLoop]: Interpolant automaton has 4 states. [2018-11-23 07:46:47,939 INFO L276 IsEmpty]: Start isEmpty. Operand 421 states and 630 transitions. [2018-11-23 07:46:47,940 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 79 [2018-11-23 07:46:47,940 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 07:46:47,940 INFO L402 BasicCegarLoop]: trace histogram [4, 4, 3, 3, 3, 3, 3, 3, 3, 3, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 07:46:47,941 INFO L423 AbstractCegarLoop]: === Iteration 11 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 07:46:47,941 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 07:46:47,941 INFO L82 PathProgramCache]: Analyzing trace with hash 1665283844, now seen corresponding path program 1 times [2018-11-23 07:46:47,941 INFO L223 ckRefinementStrategy]: Switched to mode SMTINTERPOL_TREE_INTERPOLANTS [2018-11-23 07:46:47,941 INFO L69 tionRefinementEngine]: Using refinement strategy CamelRefinementStrategy [2018-11-23 07:46:47,942 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 07:46:47,942 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 07:46:47,942 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 07:46:47,955 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 07:46:47,987 INFO L134 CoverageAnalysis]: Checked inductivity of 44 backedges. 36 proven. 0 refuted. 0 times theorem prover too weak. 8 trivial. 0 not checked. [2018-11-23 07:46:47,987 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 07:46:47,987 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [4] imperfect sequences [] total 4 [2018-11-23 07:46:47,987 INFO L459 AbstractCegarLoop]: Interpolant automaton has 4 states [2018-11-23 07:46:47,987 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 4 interpolants. [2018-11-23 07:46:47,987 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=5, Invalid=7, Unknown=0, NotChecked=0, Total=12 [2018-11-23 07:46:47,988 INFO L87 Difference]: Start difference. First operand 421 states and 630 transitions. Second operand 4 states. [2018-11-23 07:46:48,190 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 07:46:48,190 INFO L93 Difference]: Finished difference Result 871 states and 1296 transitions. [2018-11-23 07:46:48,191 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 4 states. [2018-11-23 07:46:48,191 INFO L78 Accepts]: Start accepts. Automaton has 4 states. Word has length 78 [2018-11-23 07:46:48,191 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 07:46:48,193 INFO L225 Difference]: With dead ends: 871 [2018-11-23 07:46:48,193 INFO L226 Difference]: Without dead ends: 463 [2018-11-23 07:46:48,194 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 7 GetRequests, 2 SyntacticMatches, 2 SemanticMatches, 3 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=9, Invalid=11, Unknown=0, NotChecked=0, Total=20 [2018-11-23 07:46:48,194 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 463 states. [2018-11-23 07:46:48,204 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 463 to 421. [2018-11-23 07:46:48,204 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 421 states. [2018-11-23 07:46:48,206 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 421 states to 421 states and 628 transitions. [2018-11-23 07:46:48,206 INFO L78 Accepts]: Start accepts. Automaton has 421 states and 628 transitions. Word has length 78 [2018-11-23 07:46:48,206 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 07:46:48,206 INFO L480 AbstractCegarLoop]: Abstraction has 421 states and 628 transitions. [2018-11-23 07:46:48,206 INFO L481 AbstractCegarLoop]: Interpolant automaton has 4 states. [2018-11-23 07:46:48,206 INFO L276 IsEmpty]: Start isEmpty. Operand 421 states and 628 transitions. [2018-11-23 07:46:48,207 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 79 [2018-11-23 07:46:48,207 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 07:46:48,207 INFO L402 BasicCegarLoop]: trace histogram [4, 4, 4, 3, 3, 3, 3, 3, 3, 3, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 07:46:48,207 INFO L423 AbstractCegarLoop]: === Iteration 12 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 07:46:48,208 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 07:46:48,208 INFO L82 PathProgramCache]: Analyzing trace with hash 1646628386, now seen corresponding path program 1 times [2018-11-23 07:46:48,208 INFO L223 ckRefinementStrategy]: Switched to mode SMTINTERPOL_TREE_INTERPOLANTS [2018-11-23 07:46:48,208 INFO L69 tionRefinementEngine]: Using refinement strategy CamelRefinementStrategy [2018-11-23 07:46:48,209 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 07:46:48,209 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 07:46:48,209 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 07:46:48,221 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 07:46:48,274 INFO L134 CoverageAnalysis]: Checked inductivity of 47 backedges. 39 proven. 0 refuted. 0 times theorem prover too weak. 8 trivial. 0 not checked. [2018-11-23 07:46:48,274 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 07:46:48,275 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [4] imperfect sequences [] total 4 [2018-11-23 07:46:48,275 INFO L459 AbstractCegarLoop]: Interpolant automaton has 4 states [2018-11-23 07:46:48,275 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 4 interpolants. [2018-11-23 07:46:48,275 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=5, Invalid=7, Unknown=0, NotChecked=0, Total=12 [2018-11-23 07:46:48,275 INFO L87 Difference]: Start difference. First operand 421 states and 628 transitions. Second operand 4 states. [2018-11-23 07:46:48,489 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 07:46:48,489 INFO L93 Difference]: Finished difference Result 871 states and 1292 transitions. [2018-11-23 07:46:48,490 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 4 states. [2018-11-23 07:46:48,490 INFO L78 Accepts]: Start accepts. Automaton has 4 states. Word has length 78 [2018-11-23 07:46:48,490 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 07:46:48,491 INFO L225 Difference]: With dead ends: 871 [2018-11-23 07:46:48,491 INFO L226 Difference]: Without dead ends: 463 [2018-11-23 07:46:48,492 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 7 GetRequests, 2 SyntacticMatches, 2 SemanticMatches, 3 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=9, Invalid=11, Unknown=0, NotChecked=0, Total=20 [2018-11-23 07:46:48,493 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 463 states. [2018-11-23 07:46:48,503 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 463 to 421. [2018-11-23 07:46:48,503 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 421 states. [2018-11-23 07:46:48,505 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 421 states to 421 states and 626 transitions. [2018-11-23 07:46:48,505 INFO L78 Accepts]: Start accepts. Automaton has 421 states and 626 transitions. Word has length 78 [2018-11-23 07:46:48,505 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 07:46:48,505 INFO L480 AbstractCegarLoop]: Abstraction has 421 states and 626 transitions. [2018-11-23 07:46:48,505 INFO L481 AbstractCegarLoop]: Interpolant automaton has 4 states. [2018-11-23 07:46:48,505 INFO L276 IsEmpty]: Start isEmpty. Operand 421 states and 626 transitions. [2018-11-23 07:46:48,506 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 79 [2018-11-23 07:46:48,506 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 07:46:48,506 INFO L402 BasicCegarLoop]: trace histogram [4, 4, 4, 4, 4, 4, 4, 3, 3, 3, 2, 2, 2, 2, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 07:46:48,507 INFO L423 AbstractCegarLoop]: === Iteration 13 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 07:46:48,507 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 07:46:48,507 INFO L82 PathProgramCache]: Analyzing trace with hash 941127749, now seen corresponding path program 1 times [2018-11-23 07:46:48,507 INFO L223 ckRefinementStrategy]: Switched to mode SMTINTERPOL_TREE_INTERPOLANTS [2018-11-23 07:46:48,507 INFO L69 tionRefinementEngine]: Using refinement strategy CamelRefinementStrategy [2018-11-23 07:46:48,508 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 07:46:48,508 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 07:46:48,508 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 07:46:48,538 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 07:46:48,571 INFO L134 CoverageAnalysis]: Checked inductivity of 63 backedges. 55 proven. 0 refuted. 0 times theorem prover too weak. 8 trivial. 0 not checked. [2018-11-23 07:46:48,571 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 07:46:48,571 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [4] imperfect sequences [] total 4 [2018-11-23 07:46:48,572 INFO L459 AbstractCegarLoop]: Interpolant automaton has 4 states [2018-11-23 07:46:48,572 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 4 interpolants. [2018-11-23 07:46:48,572 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=5, Invalid=7, Unknown=0, NotChecked=0, Total=12 [2018-11-23 07:46:48,572 INFO L87 Difference]: Start difference. First operand 421 states and 626 transitions. Second operand 4 states. [2018-11-23 07:46:48,777 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 07:46:48,777 INFO L93 Difference]: Finished difference Result 722 states and 1065 transitions. [2018-11-23 07:46:48,778 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 4 states. [2018-11-23 07:46:48,778 INFO L78 Accepts]: Start accepts. Automaton has 4 states. Word has length 78 [2018-11-23 07:46:48,778 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 07:46:48,780 INFO L225 Difference]: With dead ends: 722 [2018-11-23 07:46:48,780 INFO L226 Difference]: Without dead ends: 463 [2018-11-23 07:46:48,780 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 7 GetRequests, 2 SyntacticMatches, 2 SemanticMatches, 3 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=9, Invalid=11, Unknown=0, NotChecked=0, Total=20 [2018-11-23 07:46:48,781 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 463 states. [2018-11-23 07:46:48,791 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 463 to 421. [2018-11-23 07:46:48,791 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 421 states. [2018-11-23 07:46:48,792 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 421 states to 421 states and 624 transitions. [2018-11-23 07:46:48,793 INFO L78 Accepts]: Start accepts. Automaton has 421 states and 624 transitions. Word has length 78 [2018-11-23 07:46:48,793 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 07:46:48,793 INFO L480 AbstractCegarLoop]: Abstraction has 421 states and 624 transitions. [2018-11-23 07:46:48,793 INFO L481 AbstractCegarLoop]: Interpolant automaton has 4 states. [2018-11-23 07:46:48,793 INFO L276 IsEmpty]: Start isEmpty. Operand 421 states and 624 transitions. [2018-11-23 07:46:48,794 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 80 [2018-11-23 07:46:48,794 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 07:46:48,794 INFO L402 BasicCegarLoop]: trace histogram [4, 4, 4, 4, 3, 3, 3, 3, 3, 3, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 07:46:48,794 INFO L423 AbstractCegarLoop]: === Iteration 14 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 07:46:48,794 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 07:46:48,795 INFO L82 PathProgramCache]: Analyzing trace with hash -1290131619, now seen corresponding path program 1 times [2018-11-23 07:46:48,795 INFO L223 ckRefinementStrategy]: Switched to mode SMTINTERPOL_TREE_INTERPOLANTS [2018-11-23 07:46:48,795 INFO L69 tionRefinementEngine]: Using refinement strategy CamelRefinementStrategy [2018-11-23 07:46:48,795 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 07:46:48,796 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 07:46:48,796 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 07:46:48,808 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 07:46:48,839 INFO L134 CoverageAnalysis]: Checked inductivity of 50 backedges. 42 proven. 0 refuted. 0 times theorem prover too weak. 8 trivial. 0 not checked. [2018-11-23 07:46:48,840 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 07:46:48,840 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [4] imperfect sequences [] total 4 [2018-11-23 07:46:48,840 INFO L459 AbstractCegarLoop]: Interpolant automaton has 4 states [2018-11-23 07:46:48,840 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 4 interpolants. [2018-11-23 07:46:48,840 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=5, Invalid=7, Unknown=0, NotChecked=0, Total=12 [2018-11-23 07:46:48,840 INFO L87 Difference]: Start difference. First operand 421 states and 624 transitions. Second operand 4 states. [2018-11-23 07:46:49,126 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 07:46:49,126 INFO L93 Difference]: Finished difference Result 943 states and 1391 transitions. [2018-11-23 07:46:49,127 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 4 states. [2018-11-23 07:46:49,127 INFO L78 Accepts]: Start accepts. Automaton has 4 states. Word has length 79 [2018-11-23 07:46:49,127 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 07:46:49,129 INFO L225 Difference]: With dead ends: 943 [2018-11-23 07:46:49,129 INFO L226 Difference]: Without dead ends: 535 [2018-11-23 07:46:49,130 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 7 GetRequests, 2 SyntacticMatches, 2 SemanticMatches, 3 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=9, Invalid=11, Unknown=0, NotChecked=0, Total=20 [2018-11-23 07:46:49,130 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 535 states. [2018-11-23 07:46:49,141 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 535 to 421. [2018-11-23 07:46:49,142 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 421 states. [2018-11-23 07:46:49,143 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 421 states to 421 states and 622 transitions. [2018-11-23 07:46:49,143 INFO L78 Accepts]: Start accepts. Automaton has 421 states and 622 transitions. Word has length 79 [2018-11-23 07:46:49,143 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 07:46:49,143 INFO L480 AbstractCegarLoop]: Abstraction has 421 states and 622 transitions. [2018-11-23 07:46:49,143 INFO L481 AbstractCegarLoop]: Interpolant automaton has 4 states. [2018-11-23 07:46:49,143 INFO L276 IsEmpty]: Start isEmpty. Operand 421 states and 622 transitions. [2018-11-23 07:46:49,144 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 80 [2018-11-23 07:46:49,144 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 07:46:49,144 INFO L402 BasicCegarLoop]: trace histogram [4, 4, 4, 4, 4, 4, 4, 3, 3, 3, 3, 2, 2, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 07:46:49,145 INFO L423 AbstractCegarLoop]: === Iteration 15 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 07:46:49,145 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 07:46:49,145 INFO L82 PathProgramCache]: Analyzing trace with hash 765876928, now seen corresponding path program 1 times [2018-11-23 07:46:49,145 INFO L223 ckRefinementStrategy]: Switched to mode SMTINTERPOL_TREE_INTERPOLANTS [2018-11-23 07:46:49,145 INFO L69 tionRefinementEngine]: Using refinement strategy CamelRefinementStrategy [2018-11-23 07:46:49,146 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 07:46:49,146 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 07:46:49,146 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 07:46:49,159 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 07:46:49,200 INFO L134 CoverageAnalysis]: Checked inductivity of 65 backedges. 57 proven. 0 refuted. 0 times theorem prover too weak. 8 trivial. 0 not checked. [2018-11-23 07:46:49,200 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 07:46:49,201 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [4] imperfect sequences [] total 4 [2018-11-23 07:46:49,201 INFO L459 AbstractCegarLoop]: Interpolant automaton has 4 states [2018-11-23 07:46:49,201 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 4 interpolants. [2018-11-23 07:46:49,201 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=5, Invalid=7, Unknown=0, NotChecked=0, Total=12 [2018-11-23 07:46:49,201 INFO L87 Difference]: Start difference. First operand 421 states and 622 transitions. Second operand 4 states. [2018-11-23 07:46:49,443 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 07:46:49,443 INFO L93 Difference]: Finished difference Result 788 states and 1159 transitions. [2018-11-23 07:46:49,443 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 4 states. [2018-11-23 07:46:49,443 INFO L78 Accepts]: Start accepts. Automaton has 4 states. Word has length 79 [2018-11-23 07:46:49,444 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 07:46:49,445 INFO L225 Difference]: With dead ends: 788 [2018-11-23 07:46:49,445 INFO L226 Difference]: Without dead ends: 529 [2018-11-23 07:46:49,445 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 7 GetRequests, 2 SyntacticMatches, 2 SemanticMatches, 3 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=9, Invalid=11, Unknown=0, NotChecked=0, Total=20 [2018-11-23 07:46:49,446 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 529 states. [2018-11-23 07:46:49,454 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 529 to 421. [2018-11-23 07:46:49,454 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 421 states. [2018-11-23 07:46:49,455 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 421 states to 421 states and 620 transitions. [2018-11-23 07:46:49,455 INFO L78 Accepts]: Start accepts. Automaton has 421 states and 620 transitions. Word has length 79 [2018-11-23 07:46:49,455 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 07:46:49,455 INFO L480 AbstractCegarLoop]: Abstraction has 421 states and 620 transitions. [2018-11-23 07:46:49,456 INFO L481 AbstractCegarLoop]: Interpolant automaton has 4 states. [2018-11-23 07:46:49,456 INFO L276 IsEmpty]: Start isEmpty. Operand 421 states and 620 transitions. [2018-11-23 07:46:49,456 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 80 [2018-11-23 07:46:49,457 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 07:46:49,457 INFO L402 BasicCegarLoop]: trace histogram [4, 4, 4, 4, 3, 3, 3, 3, 3, 3, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 07:46:49,457 INFO L423 AbstractCegarLoop]: === Iteration 16 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 07:46:49,457 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 07:46:49,457 INFO L82 PathProgramCache]: Analyzing trace with hash 1633028379, now seen corresponding path program 1 times [2018-11-23 07:46:49,457 INFO L223 ckRefinementStrategy]: Switched to mode SMTINTERPOL_TREE_INTERPOLANTS [2018-11-23 07:46:49,457 INFO L69 tionRefinementEngine]: Using refinement strategy CamelRefinementStrategy [2018-11-23 07:46:49,458 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 07:46:49,458 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 07:46:49,458 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 07:46:49,468 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 07:46:49,491 INFO L134 CoverageAnalysis]: Checked inductivity of 50 backedges. 42 proven. 0 refuted. 0 times theorem prover too weak. 8 trivial. 0 not checked. [2018-11-23 07:46:49,491 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 07:46:49,491 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [4] imperfect sequences [] total 4 [2018-11-23 07:46:49,491 INFO L459 AbstractCegarLoop]: Interpolant automaton has 4 states [2018-11-23 07:46:49,491 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 4 interpolants. [2018-11-23 07:46:49,491 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=5, Invalid=7, Unknown=0, NotChecked=0, Total=12 [2018-11-23 07:46:49,491 INFO L87 Difference]: Start difference. First operand 421 states and 620 transitions. Second operand 4 states. [2018-11-23 07:46:49,632 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 07:46:49,633 INFO L93 Difference]: Finished difference Result 871 states and 1276 transitions. [2018-11-23 07:46:49,633 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 4 states. [2018-11-23 07:46:49,633 INFO L78 Accepts]: Start accepts. Automaton has 4 states. Word has length 79 [2018-11-23 07:46:49,633 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 07:46:49,634 INFO L225 Difference]: With dead ends: 871 [2018-11-23 07:46:49,634 INFO L226 Difference]: Without dead ends: 463 [2018-11-23 07:46:49,635 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 7 GetRequests, 2 SyntacticMatches, 2 SemanticMatches, 3 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=9, Invalid=11, Unknown=0, NotChecked=0, Total=20 [2018-11-23 07:46:49,635 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 463 states. [2018-11-23 07:46:49,642 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 463 to 421. [2018-11-23 07:46:49,642 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 421 states. [2018-11-23 07:46:49,643 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 421 states to 421 states and 618 transitions. [2018-11-23 07:46:49,643 INFO L78 Accepts]: Start accepts. Automaton has 421 states and 618 transitions. Word has length 79 [2018-11-23 07:46:49,643 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 07:46:49,643 INFO L480 AbstractCegarLoop]: Abstraction has 421 states and 618 transitions. [2018-11-23 07:46:49,643 INFO L481 AbstractCegarLoop]: Interpolant automaton has 4 states. [2018-11-23 07:46:49,643 INFO L276 IsEmpty]: Start isEmpty. Operand 421 states and 618 transitions. [2018-11-23 07:46:49,644 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 80 [2018-11-23 07:46:49,644 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 07:46:49,644 INFO L402 BasicCegarLoop]: trace histogram [4, 4, 4, 4, 4, 4, 4, 3, 3, 3, 3, 2, 2, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 07:46:49,645 INFO L423 AbstractCegarLoop]: === Iteration 17 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 07:46:49,645 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 07:46:49,645 INFO L82 PathProgramCache]: Analyzing trace with hash -605930370, now seen corresponding path program 1 times [2018-11-23 07:46:49,645 INFO L223 ckRefinementStrategy]: Switched to mode SMTINTERPOL_TREE_INTERPOLANTS [2018-11-23 07:46:49,645 INFO L69 tionRefinementEngine]: Using refinement strategy CamelRefinementStrategy [2018-11-23 07:46:49,646 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 07:46:49,646 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 07:46:49,646 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 07:46:49,654 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 07:46:49,676 INFO L134 CoverageAnalysis]: Checked inductivity of 65 backedges. 57 proven. 0 refuted. 0 times theorem prover too weak. 8 trivial. 0 not checked. [2018-11-23 07:46:49,676 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 07:46:49,676 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [4] imperfect sequences [] total 4 [2018-11-23 07:46:49,677 INFO L459 AbstractCegarLoop]: Interpolant automaton has 4 states [2018-11-23 07:46:49,677 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 4 interpolants. [2018-11-23 07:46:49,677 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=5, Invalid=7, Unknown=0, NotChecked=0, Total=12 [2018-11-23 07:46:49,677 INFO L87 Difference]: Start difference. First operand 421 states and 618 transitions. Second operand 4 states. [2018-11-23 07:46:49,814 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 07:46:49,814 INFO L93 Difference]: Finished difference Result 716 states and 1046 transitions. [2018-11-23 07:46:49,816 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 4 states. [2018-11-23 07:46:49,816 INFO L78 Accepts]: Start accepts. Automaton has 4 states. Word has length 79 [2018-11-23 07:46:49,816 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 07:46:49,817 INFO L225 Difference]: With dead ends: 716 [2018-11-23 07:46:49,817 INFO L226 Difference]: Without dead ends: 457 [2018-11-23 07:46:49,818 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 7 GetRequests, 2 SyntacticMatches, 2 SemanticMatches, 3 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=9, Invalid=11, Unknown=0, NotChecked=0, Total=20 [2018-11-23 07:46:49,818 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 457 states. [2018-11-23 07:46:49,825 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 457 to 421. [2018-11-23 07:46:49,825 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 421 states. [2018-11-23 07:46:49,826 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 421 states to 421 states and 616 transitions. [2018-11-23 07:46:49,826 INFO L78 Accepts]: Start accepts. Automaton has 421 states and 616 transitions. Word has length 79 [2018-11-23 07:46:49,826 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 07:46:49,826 INFO L480 AbstractCegarLoop]: Abstraction has 421 states and 616 transitions. [2018-11-23 07:46:49,826 INFO L481 AbstractCegarLoop]: Interpolant automaton has 4 states. [2018-11-23 07:46:49,826 INFO L276 IsEmpty]: Start isEmpty. Operand 421 states and 616 transitions. [2018-11-23 07:46:49,827 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 81 [2018-11-23 07:46:49,827 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 07:46:49,827 INFO L402 BasicCegarLoop]: trace histogram [4, 4, 4, 4, 4, 3, 3, 3, 3, 3, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 07:46:49,828 INFO L423 AbstractCegarLoop]: === Iteration 18 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 07:46:49,828 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 07:46:49,828 INFO L82 PathProgramCache]: Analyzing trace with hash -1753186171, now seen corresponding path program 1 times [2018-11-23 07:46:49,828 INFO L223 ckRefinementStrategy]: Switched to mode SMTINTERPOL_TREE_INTERPOLANTS [2018-11-23 07:46:49,828 INFO L69 tionRefinementEngine]: Using refinement strategy CamelRefinementStrategy [2018-11-23 07:46:49,829 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 07:46:49,829 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 07:46:49,829 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 07:46:49,851 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 07:46:49,874 INFO L134 CoverageAnalysis]: Checked inductivity of 53 backedges. 45 proven. 0 refuted. 0 times theorem prover too weak. 8 trivial. 0 not checked. [2018-11-23 07:46:49,874 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 07:46:49,875 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [4] imperfect sequences [] total 4 [2018-11-23 07:46:49,875 INFO L459 AbstractCegarLoop]: Interpolant automaton has 4 states [2018-11-23 07:46:49,875 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 4 interpolants. [2018-11-23 07:46:49,875 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=5, Invalid=7, Unknown=0, NotChecked=0, Total=12 [2018-11-23 07:46:49,875 INFO L87 Difference]: Start difference. First operand 421 states and 616 transitions. Second operand 4 states. [2018-11-23 07:46:50,073 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 07:46:50,073 INFO L93 Difference]: Finished difference Result 937 states and 1368 transitions. [2018-11-23 07:46:50,074 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 4 states. [2018-11-23 07:46:50,074 INFO L78 Accepts]: Start accepts. Automaton has 4 states. Word has length 80 [2018-11-23 07:46:50,074 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 07:46:50,075 INFO L225 Difference]: With dead ends: 937 [2018-11-23 07:46:50,075 INFO L226 Difference]: Without dead ends: 529 [2018-11-23 07:46:50,076 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 7 GetRequests, 2 SyntacticMatches, 2 SemanticMatches, 3 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=9, Invalid=11, Unknown=0, NotChecked=0, Total=20 [2018-11-23 07:46:50,077 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 529 states. [2018-11-23 07:46:50,083 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 529 to 421. [2018-11-23 07:46:50,083 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 421 states. [2018-11-23 07:46:50,084 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 421 states to 421 states and 614 transitions. [2018-11-23 07:46:50,084 INFO L78 Accepts]: Start accepts. Automaton has 421 states and 614 transitions. Word has length 80 [2018-11-23 07:46:50,084 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 07:46:50,084 INFO L480 AbstractCegarLoop]: Abstraction has 421 states and 614 transitions. [2018-11-23 07:46:50,084 INFO L481 AbstractCegarLoop]: Interpolant automaton has 4 states. [2018-11-23 07:46:50,084 INFO L276 IsEmpty]: Start isEmpty. Operand 421 states and 614 transitions. [2018-11-23 07:46:50,085 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 81 [2018-11-23 07:46:50,085 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 07:46:50,086 INFO L402 BasicCegarLoop]: trace histogram [4, 4, 4, 4, 4, 3, 3, 3, 3, 3, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 07:46:50,086 INFO L423 AbstractCegarLoop]: === Iteration 19 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 07:46:50,086 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 07:46:50,086 INFO L82 PathProgramCache]: Analyzing trace with hash -1329539449, now seen corresponding path program 1 times [2018-11-23 07:46:50,086 INFO L223 ckRefinementStrategy]: Switched to mode SMTINTERPOL_TREE_INTERPOLANTS [2018-11-23 07:46:50,086 INFO L69 tionRefinementEngine]: Using refinement strategy CamelRefinementStrategy [2018-11-23 07:46:50,087 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 07:46:50,087 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 07:46:50,087 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 07:46:50,095 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 07:46:50,119 INFO L134 CoverageAnalysis]: Checked inductivity of 53 backedges. 45 proven. 0 refuted. 0 times theorem prover too weak. 8 trivial. 0 not checked. [2018-11-23 07:46:50,119 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 07:46:50,119 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [4] imperfect sequences [] total 4 [2018-11-23 07:46:50,120 INFO L459 AbstractCegarLoop]: Interpolant automaton has 4 states [2018-11-23 07:46:50,120 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 4 interpolants. [2018-11-23 07:46:50,120 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=5, Invalid=7, Unknown=0, NotChecked=0, Total=12 [2018-11-23 07:46:50,120 INFO L87 Difference]: Start difference. First operand 421 states and 614 transitions. Second operand 4 states. [2018-11-23 07:46:50,278 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 07:46:50,278 INFO L93 Difference]: Finished difference Result 865 states and 1257 transitions. [2018-11-23 07:46:50,285 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 4 states. [2018-11-23 07:46:50,285 INFO L78 Accepts]: Start accepts. Automaton has 4 states. Word has length 80 [2018-11-23 07:46:50,286 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 07:46:50,287 INFO L225 Difference]: With dead ends: 865 [2018-11-23 07:46:50,287 INFO L226 Difference]: Without dead ends: 457 [2018-11-23 07:46:50,288 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 7 GetRequests, 2 SyntacticMatches, 2 SemanticMatches, 3 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=9, Invalid=11, Unknown=0, NotChecked=0, Total=20 [2018-11-23 07:46:50,288 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 457 states. [2018-11-23 07:46:50,299 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 457 to 421. [2018-11-23 07:46:50,300 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 421 states. [2018-11-23 07:46:50,300 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 421 states to 421 states and 612 transitions. [2018-11-23 07:46:50,301 INFO L78 Accepts]: Start accepts. Automaton has 421 states and 612 transitions. Word has length 80 [2018-11-23 07:46:50,301 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 07:46:50,301 INFO L480 AbstractCegarLoop]: Abstraction has 421 states and 612 transitions. [2018-11-23 07:46:50,301 INFO L481 AbstractCegarLoop]: Interpolant automaton has 4 states. [2018-11-23 07:46:50,301 INFO L276 IsEmpty]: Start isEmpty. Operand 421 states and 612 transitions. [2018-11-23 07:46:50,302 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 82 [2018-11-23 07:46:50,302 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 07:46:50,302 INFO L402 BasicCegarLoop]: trace histogram [4, 4, 4, 4, 4, 4, 3, 3, 3, 3, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 07:46:50,302 INFO L423 AbstractCegarLoop]: === Iteration 20 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 07:46:50,302 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 07:46:50,303 INFO L82 PathProgramCache]: Analyzing trace with hash -1468975710, now seen corresponding path program 1 times [2018-11-23 07:46:50,303 INFO L223 ckRefinementStrategy]: Switched to mode SMTINTERPOL_TREE_INTERPOLANTS [2018-11-23 07:46:50,303 INFO L69 tionRefinementEngine]: Using refinement strategy CamelRefinementStrategy [2018-11-23 07:46:50,303 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 07:46:50,304 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 07:46:50,304 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 07:46:50,315 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 07:46:50,364 INFO L134 CoverageAnalysis]: Checked inductivity of 56 backedges. 48 proven. 0 refuted. 0 times theorem prover too weak. 8 trivial. 0 not checked. [2018-11-23 07:46:50,364 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 07:46:50,364 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [4] imperfect sequences [] total 4 [2018-11-23 07:46:50,364 INFO L459 AbstractCegarLoop]: Interpolant automaton has 4 states [2018-11-23 07:46:50,364 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 4 interpolants. [2018-11-23 07:46:50,364 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=5, Invalid=7, Unknown=0, NotChecked=0, Total=12 [2018-11-23 07:46:50,365 INFO L87 Difference]: Start difference. First operand 421 states and 612 transitions. Second operand 4 states. [2018-11-23 07:46:50,580 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 07:46:50,580 INFO L93 Difference]: Finished difference Result 919 states and 1338 transitions. [2018-11-23 07:46:50,581 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 4 states. [2018-11-23 07:46:50,581 INFO L78 Accepts]: Start accepts. Automaton has 4 states. Word has length 81 [2018-11-23 07:46:50,581 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 07:46:50,582 INFO L225 Difference]: With dead ends: 919 [2018-11-23 07:46:50,582 INFO L226 Difference]: Without dead ends: 511 [2018-11-23 07:46:50,583 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 7 GetRequests, 2 SyntacticMatches, 2 SemanticMatches, 3 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=9, Invalid=11, Unknown=0, NotChecked=0, Total=20 [2018-11-23 07:46:50,583 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 511 states. [2018-11-23 07:46:50,594 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 511 to 421. [2018-11-23 07:46:50,594 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 421 states. [2018-11-23 07:46:50,595 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 421 states to 421 states and 610 transitions. [2018-11-23 07:46:50,595 INFO L78 Accepts]: Start accepts. Automaton has 421 states and 610 transitions. Word has length 81 [2018-11-23 07:46:50,595 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 07:46:50,595 INFO L480 AbstractCegarLoop]: Abstraction has 421 states and 610 transitions. [2018-11-23 07:46:50,595 INFO L481 AbstractCegarLoop]: Interpolant automaton has 4 states. [2018-11-23 07:46:50,595 INFO L276 IsEmpty]: Start isEmpty. Operand 421 states and 610 transitions. [2018-11-23 07:46:50,596 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 82 [2018-11-23 07:46:50,596 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 07:46:50,597 INFO L402 BasicCegarLoop]: trace histogram [4, 4, 4, 4, 4, 4, 4, 3, 3, 3, 3, 3, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 07:46:50,597 INFO L423 AbstractCegarLoop]: === Iteration 21 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 07:46:50,597 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 07:46:50,597 INFO L82 PathProgramCache]: Analyzing trace with hash 1134564595, now seen corresponding path program 1 times [2018-11-23 07:46:50,597 INFO L223 ckRefinementStrategy]: Switched to mode SMTINTERPOL_TREE_INTERPOLANTS [2018-11-23 07:46:50,597 INFO L69 tionRefinementEngine]: Using refinement strategy CamelRefinementStrategy [2018-11-23 07:46:50,598 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 07:46:50,598 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 07:46:50,598 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 07:46:50,608 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 07:46:50,657 INFO L134 CoverageAnalysis]: Checked inductivity of 65 backedges. 57 proven. 0 refuted. 0 times theorem prover too weak. 8 trivial. 0 not checked. [2018-11-23 07:46:50,657 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 07:46:50,657 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [4] imperfect sequences [] total 4 [2018-11-23 07:46:50,657 INFO L459 AbstractCegarLoop]: Interpolant automaton has 4 states [2018-11-23 07:46:50,658 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 4 interpolants. [2018-11-23 07:46:50,658 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=5, Invalid=7, Unknown=0, NotChecked=0, Total=12 [2018-11-23 07:46:50,658 INFO L87 Difference]: Start difference. First operand 421 states and 610 transitions. Second operand 4 states. [2018-11-23 07:46:50,899 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 07:46:50,899 INFO L93 Difference]: Finished difference Result 919 states and 1334 transitions. [2018-11-23 07:46:50,899 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 4 states. [2018-11-23 07:46:50,899 INFO L78 Accepts]: Start accepts. Automaton has 4 states. Word has length 81 [2018-11-23 07:46:50,900 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 07:46:50,901 INFO L225 Difference]: With dead ends: 919 [2018-11-23 07:46:50,901 INFO L226 Difference]: Without dead ends: 511 [2018-11-23 07:46:50,902 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 6 GetRequests, 2 SyntacticMatches, 1 SemanticMatches, 3 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=9, Invalid=11, Unknown=0, NotChecked=0, Total=20 [2018-11-23 07:46:50,902 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 511 states. [2018-11-23 07:46:50,912 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 511 to 421. [2018-11-23 07:46:50,913 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 421 states. [2018-11-23 07:46:50,913 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 421 states to 421 states and 608 transitions. [2018-11-23 07:46:50,914 INFO L78 Accepts]: Start accepts. Automaton has 421 states and 608 transitions. Word has length 81 [2018-11-23 07:46:50,914 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 07:46:50,914 INFO L480 AbstractCegarLoop]: Abstraction has 421 states and 608 transitions. [2018-11-23 07:46:50,914 INFO L481 AbstractCegarLoop]: Interpolant automaton has 4 states. [2018-11-23 07:46:50,914 INFO L276 IsEmpty]: Start isEmpty. Operand 421 states and 608 transitions. [2018-11-23 07:46:50,915 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 82 [2018-11-23 07:46:50,915 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 07:46:50,915 INFO L402 BasicCegarLoop]: trace histogram [4, 4, 4, 4, 4, 4, 3, 3, 3, 3, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 07:46:50,915 INFO L423 AbstractCegarLoop]: === Iteration 22 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 07:46:50,915 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 07:46:50,916 INFO L82 PathProgramCache]: Analyzing trace with hash -1220829216, now seen corresponding path program 1 times [2018-11-23 07:46:50,916 INFO L223 ckRefinementStrategy]: Switched to mode SMTINTERPOL_TREE_INTERPOLANTS [2018-11-23 07:46:50,916 INFO L69 tionRefinementEngine]: Using refinement strategy CamelRefinementStrategy [2018-11-23 07:46:50,917 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 07:46:50,917 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 07:46:50,917 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 07:46:50,928 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 07:46:50,975 INFO L134 CoverageAnalysis]: Checked inductivity of 56 backedges. 48 proven. 0 refuted. 0 times theorem prover too weak. 8 trivial. 0 not checked. [2018-11-23 07:46:50,975 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 07:46:50,975 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [4] imperfect sequences [] total 4 [2018-11-23 07:46:50,975 INFO L459 AbstractCegarLoop]: Interpolant automaton has 4 states [2018-11-23 07:46:50,976 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 4 interpolants. [2018-11-23 07:46:50,976 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=5, Invalid=7, Unknown=0, NotChecked=0, Total=12 [2018-11-23 07:46:50,976 INFO L87 Difference]: Start difference. First operand 421 states and 608 transitions. Second operand 4 states. [2018-11-23 07:46:51,128 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 07:46:51,128 INFO L93 Difference]: Finished difference Result 847 states and 1223 transitions. [2018-11-23 07:46:51,129 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 4 states. [2018-11-23 07:46:51,129 INFO L78 Accepts]: Start accepts. Automaton has 4 states. Word has length 81 [2018-11-23 07:46:51,130 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 07:46:51,131 INFO L225 Difference]: With dead ends: 847 [2018-11-23 07:46:51,131 INFO L226 Difference]: Without dead ends: 439 [2018-11-23 07:46:51,131 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 7 GetRequests, 2 SyntacticMatches, 2 SemanticMatches, 3 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=9, Invalid=11, Unknown=0, NotChecked=0, Total=20 [2018-11-23 07:46:51,132 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 439 states. [2018-11-23 07:46:51,143 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 439 to 421. [2018-11-23 07:46:51,143 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 421 states. [2018-11-23 07:46:51,144 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 421 states to 421 states and 606 transitions. [2018-11-23 07:46:51,144 INFO L78 Accepts]: Start accepts. Automaton has 421 states and 606 transitions. Word has length 81 [2018-11-23 07:46:51,144 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 07:46:51,144 INFO L480 AbstractCegarLoop]: Abstraction has 421 states and 606 transitions. [2018-11-23 07:46:51,144 INFO L481 AbstractCegarLoop]: Interpolant automaton has 4 states. [2018-11-23 07:46:51,144 INFO L276 IsEmpty]: Start isEmpty. Operand 421 states and 606 transitions. [2018-11-23 07:46:51,145 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 82 [2018-11-23 07:46:51,145 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 07:46:51,145 INFO L402 BasicCegarLoop]: trace histogram [4, 4, 4, 4, 4, 4, 4, 3, 3, 3, 3, 3, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 07:46:51,145 INFO L423 AbstractCegarLoop]: === Iteration 23 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 07:46:51,145 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 07:46:51,146 INFO L82 PathProgramCache]: Analyzing trace with hash 1382711089, now seen corresponding path program 1 times [2018-11-23 07:46:51,146 INFO L223 ckRefinementStrategy]: Switched to mode SMTINTERPOL_TREE_INTERPOLANTS [2018-11-23 07:46:51,146 INFO L69 tionRefinementEngine]: Using refinement strategy CamelRefinementStrategy [2018-11-23 07:46:51,146 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 07:46:51,146 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 07:46:51,147 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 07:46:51,159 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 07:46:51,212 INFO L134 CoverageAnalysis]: Checked inductivity of 65 backedges. 42 proven. 0 refuted. 0 times theorem prover too weak. 23 trivial. 0 not checked. [2018-11-23 07:46:51,212 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 07:46:51,212 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [3] imperfect sequences [] total 3 [2018-11-23 07:46:51,213 INFO L459 AbstractCegarLoop]: Interpolant automaton has 3 states [2018-11-23 07:46:51,213 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 3 interpolants. [2018-11-23 07:46:51,213 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=3, Invalid=3, Unknown=0, NotChecked=0, Total=6 [2018-11-23 07:46:51,213 INFO L87 Difference]: Start difference. First operand 421 states and 606 transitions. Second operand 3 states. [2018-11-23 07:46:51,266 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 07:46:51,266 INFO L93 Difference]: Finished difference Result 831 states and 1204 transitions. [2018-11-23 07:46:51,267 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 3 states. [2018-11-23 07:46:51,267 INFO L78 Accepts]: Start accepts. Automaton has 3 states. Word has length 81 [2018-11-23 07:46:51,267 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 07:46:51,268 INFO L225 Difference]: With dead ends: 831 [2018-11-23 07:46:51,269 INFO L226 Difference]: Without dead ends: 574 [2018-11-23 07:46:51,270 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 3 GetRequests, 2 SyntacticMatches, 0 SemanticMatches, 1 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=3, Invalid=3, Unknown=0, NotChecked=0, Total=6 [2018-11-23 07:46:51,271 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 574 states. [2018-11-23 07:46:51,285 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 574 to 574. [2018-11-23 07:46:51,286 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 574 states. [2018-11-23 07:46:51,287 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 574 states to 574 states and 827 transitions. [2018-11-23 07:46:51,287 INFO L78 Accepts]: Start accepts. Automaton has 574 states and 827 transitions. Word has length 81 [2018-11-23 07:46:51,287 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 07:46:51,288 INFO L480 AbstractCegarLoop]: Abstraction has 574 states and 827 transitions. [2018-11-23 07:46:51,288 INFO L481 AbstractCegarLoop]: Interpolant automaton has 3 states. [2018-11-23 07:46:51,288 INFO L276 IsEmpty]: Start isEmpty. Operand 574 states and 827 transitions. [2018-11-23 07:46:51,289 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 84 [2018-11-23 07:46:51,289 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 07:46:51,289 INFO L402 BasicCegarLoop]: trace histogram [4, 4, 4, 4, 4, 4, 4, 3, 3, 3, 3, 3, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 07:46:51,289 INFO L423 AbstractCegarLoop]: === Iteration 24 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 07:46:51,289 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 07:46:51,290 INFO L82 PathProgramCache]: Analyzing trace with hash 1024261319, now seen corresponding path program 1 times [2018-11-23 07:46:51,290 INFO L223 ckRefinementStrategy]: Switched to mode SMTINTERPOL_TREE_INTERPOLANTS [2018-11-23 07:46:51,290 INFO L69 tionRefinementEngine]: Using refinement strategy CamelRefinementStrategy [2018-11-23 07:46:51,290 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 07:46:51,291 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 07:46:51,291 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 07:46:51,303 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 07:46:51,327 INFO L134 CoverageAnalysis]: Checked inductivity of 65 backedges. 36 proven. 0 refuted. 0 times theorem prover too weak. 29 trivial. 0 not checked. [2018-11-23 07:46:51,328 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 07:46:51,328 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [3] imperfect sequences [] total 3 [2018-11-23 07:46:51,328 INFO L459 AbstractCegarLoop]: Interpolant automaton has 3 states [2018-11-23 07:46:51,328 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 3 interpolants. [2018-11-23 07:46:51,328 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=3, Invalid=3, Unknown=0, NotChecked=0, Total=6 [2018-11-23 07:46:51,329 INFO L87 Difference]: Start difference. First operand 574 states and 827 transitions. Second operand 3 states. [2018-11-23 07:46:51,360 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 07:46:51,360 INFO L93 Difference]: Finished difference Result 729 states and 1052 transitions. [2018-11-23 07:46:51,360 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 3 states. [2018-11-23 07:46:51,361 INFO L78 Accepts]: Start accepts. Automaton has 3 states. Word has length 83 [2018-11-23 07:46:51,361 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 07:46:51,363 INFO L225 Difference]: With dead ends: 729 [2018-11-23 07:46:51,363 INFO L226 Difference]: Without dead ends: 727 [2018-11-23 07:46:51,363 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 3 GetRequests, 2 SyntacticMatches, 0 SemanticMatches, 1 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=3, Invalid=3, Unknown=0, NotChecked=0, Total=6 [2018-11-23 07:46:51,364 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 727 states. [2018-11-23 07:46:51,390 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 727 to 727. [2018-11-23 07:46:51,390 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 727 states. [2018-11-23 07:46:51,392 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 727 states to 727 states and 1049 transitions. [2018-11-23 07:46:51,392 INFO L78 Accepts]: Start accepts. Automaton has 727 states and 1049 transitions. Word has length 83 [2018-11-23 07:46:51,392 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 07:46:51,392 INFO L480 AbstractCegarLoop]: Abstraction has 727 states and 1049 transitions. [2018-11-23 07:46:51,392 INFO L481 AbstractCegarLoop]: Interpolant automaton has 3 states. [2018-11-23 07:46:51,392 INFO L276 IsEmpty]: Start isEmpty. Operand 727 states and 1049 transitions. [2018-11-23 07:46:51,393 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 105 [2018-11-23 07:46:51,394 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 07:46:51,394 INFO L402 BasicCegarLoop]: trace histogram [5, 5, 5, 5, 5, 5, 5, 4, 4, 4, 4, 4, 3, 3, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 07:46:51,394 INFO L423 AbstractCegarLoop]: === Iteration 25 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 07:46:51,394 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 07:46:51,394 INFO L82 PathProgramCache]: Analyzing trace with hash 934069236, now seen corresponding path program 1 times [2018-11-23 07:46:51,394 INFO L223 ckRefinementStrategy]: Switched to mode SMTINTERPOL_TREE_INTERPOLANTS [2018-11-23 07:46:51,394 INFO L69 tionRefinementEngine]: Using refinement strategy CamelRefinementStrategy [2018-11-23 07:46:51,395 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 07:46:51,395 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 07:46:51,395 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 07:46:51,407 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 07:46:51,454 INFO L134 CoverageAnalysis]: Checked inductivity of 118 backedges. 53 proven. 0 refuted. 0 times theorem prover too weak. 65 trivial. 0 not checked. [2018-11-23 07:46:51,454 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 07:46:51,454 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [3] imperfect sequences [] total 3 [2018-11-23 07:46:51,454 INFO L459 AbstractCegarLoop]: Interpolant automaton has 3 states [2018-11-23 07:46:51,454 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 3 interpolants. [2018-11-23 07:46:51,455 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=3, Invalid=3, Unknown=0, NotChecked=0, Total=6 [2018-11-23 07:46:51,455 INFO L87 Difference]: Start difference. First operand 727 states and 1049 transitions. Second operand 3 states. [2018-11-23 07:46:51,485 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 07:46:51,485 INFO L93 Difference]: Finished difference Result 729 states and 1050 transitions. [2018-11-23 07:46:51,486 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 3 states. [2018-11-23 07:46:51,486 INFO L78 Accepts]: Start accepts. Automaton has 3 states. Word has length 104 [2018-11-23 07:46:51,486 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 07:46:51,488 INFO L225 Difference]: With dead ends: 729 [2018-11-23 07:46:51,488 INFO L226 Difference]: Without dead ends: 727 [2018-11-23 07:46:51,488 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 3 GetRequests, 2 SyntacticMatches, 0 SemanticMatches, 1 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=3, Invalid=3, Unknown=0, NotChecked=0, Total=6 [2018-11-23 07:46:51,489 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 727 states. [2018-11-23 07:46:51,503 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 727 to 727. [2018-11-23 07:46:51,504 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 727 states. [2018-11-23 07:46:51,505 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 727 states to 727 states and 1048 transitions. [2018-11-23 07:46:51,505 INFO L78 Accepts]: Start accepts. Automaton has 727 states and 1048 transitions. Word has length 104 [2018-11-23 07:46:51,506 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 07:46:51,506 INFO L480 AbstractCegarLoop]: Abstraction has 727 states and 1048 transitions. [2018-11-23 07:46:51,506 INFO L481 AbstractCegarLoop]: Interpolant automaton has 3 states. [2018-11-23 07:46:51,506 INFO L276 IsEmpty]: Start isEmpty. Operand 727 states and 1048 transitions. [2018-11-23 07:46:51,508 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 107 [2018-11-23 07:46:51,508 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 07:46:51,508 INFO L402 BasicCegarLoop]: trace histogram [5, 5, 5, 5, 5, 5, 5, 4, 4, 4, 4, 4, 3, 3, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 07:46:51,508 INFO L423 AbstractCegarLoop]: === Iteration 26 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 07:46:51,508 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 07:46:51,508 INFO L82 PathProgramCache]: Analyzing trace with hash -148840977, now seen corresponding path program 1 times [2018-11-23 07:46:51,508 INFO L223 ckRefinementStrategy]: Switched to mode SMTINTERPOL_TREE_INTERPOLANTS [2018-11-23 07:46:51,508 INFO L69 tionRefinementEngine]: Using refinement strategy CamelRefinementStrategy [2018-11-23 07:46:51,509 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 07:46:51,509 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 07:46:51,509 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 07:46:51,525 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 07:46:51,571 INFO L134 CoverageAnalysis]: Checked inductivity of 118 backedges. 53 proven. 0 refuted. 0 times theorem prover too weak. 65 trivial. 0 not checked. [2018-11-23 07:46:51,571 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 07:46:51,571 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [4] imperfect sequences [] total 4 [2018-11-23 07:46:51,572 INFO L459 AbstractCegarLoop]: Interpolant automaton has 4 states [2018-11-23 07:46:51,572 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 4 interpolants. [2018-11-23 07:46:51,572 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=5, Invalid=7, Unknown=0, NotChecked=0, Total=12 [2018-11-23 07:46:51,572 INFO L87 Difference]: Start difference. First operand 727 states and 1048 transitions. Second operand 4 states. [2018-11-23 07:46:51,818 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 07:46:51,818 INFO L93 Difference]: Finished difference Result 1698 states and 2461 transitions. [2018-11-23 07:46:51,819 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 4 states. [2018-11-23 07:46:51,819 INFO L78 Accepts]: Start accepts. Automaton has 4 states. Word has length 106 [2018-11-23 07:46:51,819 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 07:46:51,821 INFO L225 Difference]: With dead ends: 1698 [2018-11-23 07:46:51,821 INFO L226 Difference]: Without dead ends: 984 [2018-11-23 07:46:51,822 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 6 GetRequests, 2 SyntacticMatches, 1 SemanticMatches, 3 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=9, Invalid=11, Unknown=0, NotChecked=0, Total=20 [2018-11-23 07:46:51,823 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 984 states. [2018-11-23 07:46:51,842 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 984 to 847. [2018-11-23 07:46:51,842 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 847 states. [2018-11-23 07:46:51,844 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 847 states to 847 states and 1258 transitions. [2018-11-23 07:46:51,844 INFO L78 Accepts]: Start accepts. Automaton has 847 states and 1258 transitions. Word has length 106 [2018-11-23 07:46:51,844 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 07:46:51,844 INFO L480 AbstractCegarLoop]: Abstraction has 847 states and 1258 transitions. [2018-11-23 07:46:51,844 INFO L481 AbstractCegarLoop]: Interpolant automaton has 4 states. [2018-11-23 07:46:51,844 INFO L276 IsEmpty]: Start isEmpty. Operand 847 states and 1258 transitions. [2018-11-23 07:46:51,846 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 122 [2018-11-23 07:46:51,846 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 07:46:51,846 INFO L402 BasicCegarLoop]: trace histogram [6, 6, 5, 5, 5, 5, 5, 5, 5, 5, 4, 4, 3, 3, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 07:46:51,846 INFO L423 AbstractCegarLoop]: === Iteration 27 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 07:46:51,846 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 07:46:51,847 INFO L82 PathProgramCache]: Analyzing trace with hash -1084285646, now seen corresponding path program 1 times [2018-11-23 07:46:51,847 INFO L223 ckRefinementStrategy]: Switched to mode SMTINTERPOL_TREE_INTERPOLANTS [2018-11-23 07:46:51,847 INFO L69 tionRefinementEngine]: Using refinement strategy CamelRefinementStrategy [2018-11-23 07:46:51,848 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 07:46:51,848 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 07:46:51,848 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 07:46:51,864 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 07:46:51,904 INFO L134 CoverageAnalysis]: Checked inductivity of 145 backedges. 80 proven. 0 refuted. 0 times theorem prover too weak. 65 trivial. 0 not checked. [2018-11-23 07:46:51,905 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 07:46:51,905 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [4] imperfect sequences [] total 4 [2018-11-23 07:46:51,905 INFO L459 AbstractCegarLoop]: Interpolant automaton has 4 states [2018-11-23 07:46:51,905 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 4 interpolants. [2018-11-23 07:46:51,905 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=5, Invalid=7, Unknown=0, NotChecked=0, Total=12 [2018-11-23 07:46:51,906 INFO L87 Difference]: Start difference. First operand 847 states and 1258 transitions. Second operand 4 states. [2018-11-23 07:46:52,142 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 07:46:52,142 INFO L93 Difference]: Finished difference Result 1813 states and 2661 transitions. [2018-11-23 07:46:52,143 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 4 states. [2018-11-23 07:46:52,143 INFO L78 Accepts]: Start accepts. Automaton has 4 states. Word has length 121 [2018-11-23 07:46:52,144 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 07:46:52,146 INFO L225 Difference]: With dead ends: 1813 [2018-11-23 07:46:52,146 INFO L226 Difference]: Without dead ends: 979 [2018-11-23 07:46:52,147 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 6 GetRequests, 2 SyntacticMatches, 1 SemanticMatches, 3 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=9, Invalid=11, Unknown=0, NotChecked=0, Total=20 [2018-11-23 07:46:52,148 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 979 states. [2018-11-23 07:46:52,166 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 979 to 847. [2018-11-23 07:46:52,166 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 847 states. [2018-11-23 07:46:52,168 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 847 states to 847 states and 1253 transitions. [2018-11-23 07:46:52,168 INFO L78 Accepts]: Start accepts. Automaton has 847 states and 1253 transitions. Word has length 121 [2018-11-23 07:46:52,168 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 07:46:52,168 INFO L480 AbstractCegarLoop]: Abstraction has 847 states and 1253 transitions. [2018-11-23 07:46:52,168 INFO L481 AbstractCegarLoop]: Interpolant automaton has 4 states. [2018-11-23 07:46:52,168 INFO L276 IsEmpty]: Start isEmpty. Operand 847 states and 1253 transitions. [2018-11-23 07:46:52,170 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 122 [2018-11-23 07:46:52,170 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 07:46:52,170 INFO L402 BasicCegarLoop]: trace histogram [6, 6, 6, 5, 5, 5, 5, 5, 5, 5, 4, 4, 3, 3, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 07:46:52,170 INFO L423 AbstractCegarLoop]: === Iteration 28 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 07:46:52,170 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 07:46:52,170 INFO L82 PathProgramCache]: Analyzing trace with hash -1832311600, now seen corresponding path program 1 times [2018-11-23 07:46:52,171 INFO L223 ckRefinementStrategy]: Switched to mode SMTINTERPOL_TREE_INTERPOLANTS [2018-11-23 07:46:52,171 INFO L69 tionRefinementEngine]: Using refinement strategy CamelRefinementStrategy [2018-11-23 07:46:52,171 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 07:46:52,172 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 07:46:52,172 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 07:46:52,186 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 07:46:52,220 INFO L134 CoverageAnalysis]: Checked inductivity of 150 backedges. 85 proven. 0 refuted. 0 times theorem prover too weak. 65 trivial. 0 not checked. [2018-11-23 07:46:52,221 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 07:46:52,221 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [4] imperfect sequences [] total 4 [2018-11-23 07:46:52,221 INFO L459 AbstractCegarLoop]: Interpolant automaton has 4 states [2018-11-23 07:46:52,221 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 4 interpolants. [2018-11-23 07:46:52,221 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=5, Invalid=7, Unknown=0, NotChecked=0, Total=12 [2018-11-23 07:46:52,221 INFO L87 Difference]: Start difference. First operand 847 states and 1253 transitions. Second operand 4 states. [2018-11-23 07:46:52,416 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 07:46:52,417 INFO L93 Difference]: Finished difference Result 1813 states and 2651 transitions. [2018-11-23 07:46:52,417 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 4 states. [2018-11-23 07:46:52,417 INFO L78 Accepts]: Start accepts. Automaton has 4 states. Word has length 121 [2018-11-23 07:46:52,418 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 07:46:52,419 INFO L225 Difference]: With dead ends: 1813 [2018-11-23 07:46:52,419 INFO L226 Difference]: Without dead ends: 979 [2018-11-23 07:46:52,420 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 6 GetRequests, 2 SyntacticMatches, 1 SemanticMatches, 3 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=9, Invalid=11, Unknown=0, NotChecked=0, Total=20 [2018-11-23 07:46:52,421 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 979 states. [2018-11-23 07:46:52,433 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 979 to 847. [2018-11-23 07:46:52,433 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 847 states. [2018-11-23 07:46:52,434 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 847 states to 847 states and 1248 transitions. [2018-11-23 07:46:52,435 INFO L78 Accepts]: Start accepts. Automaton has 847 states and 1248 transitions. Word has length 121 [2018-11-23 07:46:52,435 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 07:46:52,435 INFO L480 AbstractCegarLoop]: Abstraction has 847 states and 1248 transitions. [2018-11-23 07:46:52,435 INFO L481 AbstractCegarLoop]: Interpolant automaton has 4 states. [2018-11-23 07:46:52,435 INFO L276 IsEmpty]: Start isEmpty. Operand 847 states and 1248 transitions. [2018-11-23 07:46:52,436 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 122 [2018-11-23 07:46:52,436 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 07:46:52,436 INFO L402 BasicCegarLoop]: trace histogram [6, 6, 6, 6, 6, 6, 6, 5, 5, 5, 4, 4, 3, 3, 2, 2, 2, 2, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 07:46:52,437 INFO L423 AbstractCegarLoop]: === Iteration 29 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 07:46:52,437 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 07:46:52,437 INFO L82 PathProgramCache]: Analyzing trace with hash -1213590989, now seen corresponding path program 1 times [2018-11-23 07:46:52,437 INFO L223 ckRefinementStrategy]: Switched to mode SMTINTERPOL_TREE_INTERPOLANTS [2018-11-23 07:46:52,437 INFO L69 tionRefinementEngine]: Using refinement strategy CamelRefinementStrategy [2018-11-23 07:46:52,438 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 07:46:52,438 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 07:46:52,438 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 07:46:52,447 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 07:46:52,474 INFO L134 CoverageAnalysis]: Checked inductivity of 174 backedges. 65 proven. 0 refuted. 0 times theorem prover too weak. 109 trivial. 0 not checked. [2018-11-23 07:46:52,474 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 07:46:52,474 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [4] imperfect sequences [] total 4 [2018-11-23 07:46:52,474 INFO L459 AbstractCegarLoop]: Interpolant automaton has 4 states [2018-11-23 07:46:52,475 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 4 interpolants. [2018-11-23 07:46:52,475 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=5, Invalid=7, Unknown=0, NotChecked=0, Total=12 [2018-11-23 07:46:52,475 INFO L87 Difference]: Start difference. First operand 847 states and 1248 transitions. Second operand 4 states. [2018-11-23 07:46:52,619 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 07:46:52,619 INFO L93 Difference]: Finished difference Result 1644 states and 2431 transitions. [2018-11-23 07:46:52,620 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 4 states. [2018-11-23 07:46:52,620 INFO L78 Accepts]: Start accepts. Automaton has 4 states. Word has length 121 [2018-11-23 07:46:52,620 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 07:46:52,623 INFO L225 Difference]: With dead ends: 1644 [2018-11-23 07:46:52,623 INFO L226 Difference]: Without dead ends: 985 [2018-11-23 07:46:52,624 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 6 GetRequests, 2 SyntacticMatches, 1 SemanticMatches, 3 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=9, Invalid=11, Unknown=0, NotChecked=0, Total=20 [2018-11-23 07:46:52,625 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 985 states. [2018-11-23 07:46:52,645 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 985 to 919. [2018-11-23 07:46:52,645 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 919 states. [2018-11-23 07:46:52,647 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 919 states to 919 states and 1368 transitions. [2018-11-23 07:46:52,647 INFO L78 Accepts]: Start accepts. Automaton has 919 states and 1368 transitions. Word has length 121 [2018-11-23 07:46:52,647 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 07:46:52,647 INFO L480 AbstractCegarLoop]: Abstraction has 919 states and 1368 transitions. [2018-11-23 07:46:52,647 INFO L481 AbstractCegarLoop]: Interpolant automaton has 4 states. [2018-11-23 07:46:52,647 INFO L276 IsEmpty]: Start isEmpty. Operand 919 states and 1368 transitions. [2018-11-23 07:46:52,649 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 123 [2018-11-23 07:46:52,649 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 07:46:52,649 INFO L402 BasicCegarLoop]: trace histogram [6, 6, 6, 6, 5, 5, 5, 5, 5, 5, 4, 4, 3, 3, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 07:46:52,649 INFO L423 AbstractCegarLoop]: === Iteration 30 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 07:46:52,649 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 07:46:52,650 INFO L82 PathProgramCache]: Analyzing trace with hash -1233245309, now seen corresponding path program 1 times [2018-11-23 07:46:52,650 INFO L223 ckRefinementStrategy]: Switched to mode SMTINTERPOL_TREE_INTERPOLANTS [2018-11-23 07:46:52,650 INFO L69 tionRefinementEngine]: Using refinement strategy CamelRefinementStrategy [2018-11-23 07:46:52,650 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 07:46:52,650 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 07:46:52,651 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 07:46:52,665 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 07:46:52,738 INFO L134 CoverageAnalysis]: Checked inductivity of 155 backedges. 90 proven. 0 refuted. 0 times theorem prover too weak. 65 trivial. 0 not checked. [2018-11-23 07:46:52,738 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 07:46:52,738 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [4] imperfect sequences [] total 4 [2018-11-23 07:46:52,738 INFO L459 AbstractCegarLoop]: Interpolant automaton has 4 states [2018-11-23 07:46:52,739 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 4 interpolants. [2018-11-23 07:46:52,739 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=5, Invalid=7, Unknown=0, NotChecked=0, Total=12 [2018-11-23 07:46:52,739 INFO L87 Difference]: Start difference. First operand 919 states and 1368 transitions. Second operand 4 states. [2018-11-23 07:46:52,903 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 07:46:52,903 INFO L93 Difference]: Finished difference Result 1957 states and 2881 transitions. [2018-11-23 07:46:52,904 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 4 states. [2018-11-23 07:46:52,904 INFO L78 Accepts]: Start accepts. Automaton has 4 states. Word has length 122 [2018-11-23 07:46:52,904 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 07:46:52,905 INFO L225 Difference]: With dead ends: 1957 [2018-11-23 07:46:52,905 INFO L226 Difference]: Without dead ends: 1051 [2018-11-23 07:46:52,906 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 6 GetRequests, 2 SyntacticMatches, 1 SemanticMatches, 3 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=9, Invalid=11, Unknown=0, NotChecked=0, Total=20 [2018-11-23 07:46:52,907 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 1051 states. [2018-11-23 07:46:52,930 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 1051 to 919. [2018-11-23 07:46:52,930 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 919 states. [2018-11-23 07:46:52,931 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 919 states to 919 states and 1363 transitions. [2018-11-23 07:46:52,931 INFO L78 Accepts]: Start accepts. Automaton has 919 states and 1363 transitions. Word has length 122 [2018-11-23 07:46:52,932 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 07:46:52,932 INFO L480 AbstractCegarLoop]: Abstraction has 919 states and 1363 transitions. [2018-11-23 07:46:52,932 INFO L481 AbstractCegarLoop]: Interpolant automaton has 4 states. [2018-11-23 07:46:52,932 INFO L276 IsEmpty]: Start isEmpty. Operand 919 states and 1363 transitions. [2018-11-23 07:46:52,933 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 124 [2018-11-23 07:46:52,933 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 07:46:52,934 INFO L402 BasicCegarLoop]: trace histogram [6, 6, 6, 6, 6, 5, 5, 5, 5, 5, 4, 4, 3, 3, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 07:46:52,934 INFO L423 AbstractCegarLoop]: === Iteration 31 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 07:46:52,934 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 07:46:52,934 INFO L82 PathProgramCache]: Analyzing trace with hash 2124457781, now seen corresponding path program 1 times [2018-11-23 07:46:52,934 INFO L223 ckRefinementStrategy]: Switched to mode SMTINTERPOL_TREE_INTERPOLANTS [2018-11-23 07:46:52,934 INFO L69 tionRefinementEngine]: Using refinement strategy CamelRefinementStrategy [2018-11-23 07:46:52,935 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 07:46:52,935 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 07:46:52,935 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 07:46:52,950 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 07:46:52,996 INFO L134 CoverageAnalysis]: Checked inductivity of 160 backedges. 95 proven. 0 refuted. 0 times theorem prover too weak. 65 trivial. 0 not checked. [2018-11-23 07:46:52,997 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 07:46:52,997 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [4] imperfect sequences [] total 4 [2018-11-23 07:46:52,997 INFO L459 AbstractCegarLoop]: Interpolant automaton has 4 states [2018-11-23 07:46:52,997 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 4 interpolants. [2018-11-23 07:46:52,997 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=5, Invalid=7, Unknown=0, NotChecked=0, Total=12 [2018-11-23 07:46:52,998 INFO L87 Difference]: Start difference. First operand 919 states and 1363 transitions. Second operand 4 states. [2018-11-23 07:46:53,153 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 07:46:53,153 INFO L93 Difference]: Finished difference Result 1957 states and 2871 transitions. [2018-11-23 07:46:53,153 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 4 states. [2018-11-23 07:46:53,154 INFO L78 Accepts]: Start accepts. Automaton has 4 states. Word has length 123 [2018-11-23 07:46:53,154 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 07:46:53,155 INFO L225 Difference]: With dead ends: 1957 [2018-11-23 07:46:53,155 INFO L226 Difference]: Without dead ends: 1051 [2018-11-23 07:46:53,156 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 6 GetRequests, 2 SyntacticMatches, 1 SemanticMatches, 3 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=9, Invalid=11, Unknown=0, NotChecked=0, Total=20 [2018-11-23 07:46:53,157 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 1051 states. [2018-11-23 07:46:53,170 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 1051 to 919. [2018-11-23 07:46:53,170 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 919 states. [2018-11-23 07:46:53,171 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 919 states to 919 states and 1358 transitions. [2018-11-23 07:46:53,171 INFO L78 Accepts]: Start accepts. Automaton has 919 states and 1358 transitions. Word has length 123 [2018-11-23 07:46:53,171 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 07:46:53,171 INFO L480 AbstractCegarLoop]: Abstraction has 919 states and 1358 transitions. [2018-11-23 07:46:53,171 INFO L481 AbstractCegarLoop]: Interpolant automaton has 4 states. [2018-11-23 07:46:53,172 INFO L276 IsEmpty]: Start isEmpty. Operand 919 states and 1358 transitions. [2018-11-23 07:46:53,173 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 125 [2018-11-23 07:46:53,173 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 07:46:53,173 INFO L402 BasicCegarLoop]: trace histogram [6, 6, 6, 6, 6, 6, 5, 5, 5, 5, 4, 4, 3, 3, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 07:46:53,173 INFO L423 AbstractCegarLoop]: === Iteration 32 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 07:46:53,173 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 07:46:53,173 INFO L82 PathProgramCache]: Analyzing trace with hash 805588424, now seen corresponding path program 1 times [2018-11-23 07:46:53,174 INFO L223 ckRefinementStrategy]: Switched to mode SMTINTERPOL_TREE_INTERPOLANTS [2018-11-23 07:46:53,174 INFO L69 tionRefinementEngine]: Using refinement strategy CamelRefinementStrategy [2018-11-23 07:46:53,174 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 07:46:53,174 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 07:46:53,174 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 07:46:53,185 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 07:46:53,208 INFO L134 CoverageAnalysis]: Checked inductivity of 165 backedges. 100 proven. 0 refuted. 0 times theorem prover too weak. 65 trivial. 0 not checked. [2018-11-23 07:46:53,208 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 07:46:53,208 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [4] imperfect sequences [] total 4 [2018-11-23 07:46:53,209 INFO L459 AbstractCegarLoop]: Interpolant automaton has 4 states [2018-11-23 07:46:53,209 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 4 interpolants. [2018-11-23 07:46:53,209 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=5, Invalid=7, Unknown=0, NotChecked=0, Total=12 [2018-11-23 07:46:53,209 INFO L87 Difference]: Start difference. First operand 919 states and 1358 transitions. Second operand 4 states. [2018-11-23 07:46:53,350 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 07:46:53,350 INFO L93 Difference]: Finished difference Result 1912 states and 2806 transitions. [2018-11-23 07:46:53,350 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 4 states. [2018-11-23 07:46:53,351 INFO L78 Accepts]: Start accepts. Automaton has 4 states. Word has length 124 [2018-11-23 07:46:53,351 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 07:46:53,353 INFO L225 Difference]: With dead ends: 1912 [2018-11-23 07:46:53,353 INFO L226 Difference]: Without dead ends: 1006 [2018-11-23 07:46:53,354 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 6 GetRequests, 2 SyntacticMatches, 1 SemanticMatches, 3 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=9, Invalid=11, Unknown=0, NotChecked=0, Total=20 [2018-11-23 07:46:53,355 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 1006 states. [2018-11-23 07:46:53,376 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 1006 to 919. [2018-11-23 07:46:53,376 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 919 states. [2018-11-23 07:46:53,378 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 919 states to 919 states and 1353 transitions. [2018-11-23 07:46:53,378 INFO L78 Accepts]: Start accepts. Automaton has 919 states and 1353 transitions. Word has length 124 [2018-11-23 07:46:53,378 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 07:46:53,378 INFO L480 AbstractCegarLoop]: Abstraction has 919 states and 1353 transitions. [2018-11-23 07:46:53,378 INFO L481 AbstractCegarLoop]: Interpolant automaton has 4 states. [2018-11-23 07:46:53,378 INFO L276 IsEmpty]: Start isEmpty. Operand 919 states and 1353 transitions. [2018-11-23 07:46:53,380 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 125 [2018-11-23 07:46:53,380 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 07:46:53,380 INFO L402 BasicCegarLoop]: trace histogram [6, 6, 6, 6, 6, 6, 6, 5, 5, 5, 5, 5, 4, 4, 2, 2, 2, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 07:46:53,380 INFO L423 AbstractCegarLoop]: === Iteration 33 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 07:46:53,380 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 07:46:53,380 INFO L82 PathProgramCache]: Analyzing trace with hash -1158112039, now seen corresponding path program 1 times [2018-11-23 07:46:53,380 INFO L223 ckRefinementStrategy]: Switched to mode SMTINTERPOL_TREE_INTERPOLANTS [2018-11-23 07:46:53,381 INFO L69 tionRefinementEngine]: Using refinement strategy CamelRefinementStrategy [2018-11-23 07:46:53,382 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 07:46:53,382 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 07:46:53,382 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 07:46:53,395 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 07:46:53,457 INFO L134 CoverageAnalysis]: Checked inductivity of 187 backedges. 68 proven. 0 refuted. 0 times theorem prover too weak. 119 trivial. 0 not checked. [2018-11-23 07:46:53,457 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 07:46:53,457 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [4] imperfect sequences [] total 4 [2018-11-23 07:46:53,458 INFO L459 AbstractCegarLoop]: Interpolant automaton has 4 states [2018-11-23 07:46:53,458 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 4 interpolants. [2018-11-23 07:46:53,458 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=5, Invalid=7, Unknown=0, NotChecked=0, Total=12 [2018-11-23 07:46:53,458 INFO L87 Difference]: Start difference. First operand 919 states and 1353 transitions. Second operand 4 states. [2018-11-23 07:46:53,604 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 07:46:53,604 INFO L93 Difference]: Finished difference Result 2057 states and 3036 transitions. [2018-11-23 07:46:53,604 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 4 states. [2018-11-23 07:46:53,604 INFO L78 Accepts]: Start accepts. Automaton has 4 states. Word has length 124 [2018-11-23 07:46:53,605 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 07:46:53,606 INFO L225 Difference]: With dead ends: 2057 [2018-11-23 07:46:53,606 INFO L226 Difference]: Without dead ends: 1151 [2018-11-23 07:46:53,607 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 6 GetRequests, 2 SyntacticMatches, 1 SemanticMatches, 3 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=9, Invalid=11, Unknown=0, NotChecked=0, Total=20 [2018-11-23 07:46:53,608 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 1151 states. [2018-11-23 07:46:53,625 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 1151 to 1029. [2018-11-23 07:46:53,625 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 1029 states. [2018-11-23 07:46:53,626 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 1029 states to 1029 states and 1543 transitions. [2018-11-23 07:46:53,626 INFO L78 Accepts]: Start accepts. Automaton has 1029 states and 1543 transitions. Word has length 124 [2018-11-23 07:46:53,626 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 07:46:53,626 INFO L480 AbstractCegarLoop]: Abstraction has 1029 states and 1543 transitions. [2018-11-23 07:46:53,626 INFO L481 AbstractCegarLoop]: Interpolant automaton has 4 states. [2018-11-23 07:46:53,626 INFO L276 IsEmpty]: Start isEmpty. Operand 1029 states and 1543 transitions. [2018-11-23 07:46:53,627 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 129 [2018-11-23 07:46:53,627 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 07:46:53,627 INFO L402 BasicCegarLoop]: trace histogram [6, 6, 6, 6, 6, 6, 6, 5, 5, 5, 5, 5, 4, 4, 3, 3, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 07:46:53,627 INFO L423 AbstractCegarLoop]: === Iteration 34 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 07:46:53,627 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 07:46:53,627 INFO L82 PathProgramCache]: Analyzing trace with hash -421436053, now seen corresponding path program 1 times [2018-11-23 07:46:53,627 INFO L223 ckRefinementStrategy]: Switched to mode SMTINTERPOL_TREE_INTERPOLANTS [2018-11-23 07:46:53,627 INFO L69 tionRefinementEngine]: Using refinement strategy CamelRefinementStrategy [2018-11-23 07:46:53,628 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 07:46:53,628 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 07:46:53,628 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 07:46:53,643 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 07:46:53,712 INFO L134 CoverageAnalysis]: Checked inductivity of 190 backedges. 40 proven. 0 refuted. 0 times theorem prover too weak. 150 trivial. 0 not checked. [2018-11-23 07:46:53,712 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 07:46:53,712 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [6] imperfect sequences [] total 6 [2018-11-23 07:46:53,713 INFO L459 AbstractCegarLoop]: Interpolant automaton has 6 states [2018-11-23 07:46:53,713 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 6 interpolants. [2018-11-23 07:46:53,713 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=11, Invalid=19, Unknown=0, NotChecked=0, Total=30 [2018-11-23 07:46:53,713 INFO L87 Difference]: Start difference. First operand 1029 states and 1543 transitions. Second operand 6 states. [2018-11-23 07:46:53,988 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 07:46:53,988 INFO L93 Difference]: Finished difference Result 1934 states and 2904 transitions. [2018-11-23 07:46:53,989 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 6 states. [2018-11-23 07:46:53,989 INFO L78 Accepts]: Start accepts. Automaton has 6 states. Word has length 128 [2018-11-23 07:46:53,989 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 07:46:53,991 INFO L225 Difference]: With dead ends: 1934 [2018-11-23 07:46:53,991 INFO L226 Difference]: Without dead ends: 1113 [2018-11-23 07:46:53,992 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 10 GetRequests, 2 SyntacticMatches, 2 SemanticMatches, 6 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 1 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=23, Invalid=33, Unknown=0, NotChecked=0, Total=56 [2018-11-23 07:46:53,993 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 1113 states. [2018-11-23 07:46:54,011 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 1113 to 1037. [2018-11-23 07:46:54,011 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 1037 states. [2018-11-23 07:46:54,012 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 1037 states to 1037 states and 1556 transitions. [2018-11-23 07:46:54,012 INFO L78 Accepts]: Start accepts. Automaton has 1037 states and 1556 transitions. Word has length 128 [2018-11-23 07:46:54,012 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 07:46:54,013 INFO L480 AbstractCegarLoop]: Abstraction has 1037 states and 1556 transitions. [2018-11-23 07:46:54,013 INFO L481 AbstractCegarLoop]: Interpolant automaton has 6 states. [2018-11-23 07:46:54,013 INFO L276 IsEmpty]: Start isEmpty. Operand 1037 states and 1556 transitions. [2018-11-23 07:46:54,014 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 130 [2018-11-23 07:46:54,014 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 07:46:54,015 INFO L402 BasicCegarLoop]: trace histogram [6, 6, 6, 6, 6, 6, 6, 6, 5, 5, 5, 5, 4, 4, 3, 3, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 07:46:54,015 INFO L423 AbstractCegarLoop]: === Iteration 35 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 07:46:54,015 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 07:46:54,015 INFO L82 PathProgramCache]: Analyzing trace with hash -527506, now seen corresponding path program 1 times [2018-11-23 07:46:54,015 INFO L223 ckRefinementStrategy]: Switched to mode SMTINTERPOL_TREE_INTERPOLANTS [2018-11-23 07:46:54,015 INFO L69 tionRefinementEngine]: Using refinement strategy CamelRefinementStrategy [2018-11-23 07:46:54,017 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 07:46:54,018 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 07:46:54,018 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 07:46:54,034 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 07:46:54,103 INFO L134 CoverageAnalysis]: Checked inductivity of 195 backedges. 45 proven. 0 refuted. 0 times theorem prover too weak. 150 trivial. 0 not checked. [2018-11-23 07:46:54,103 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 07:46:54,103 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [6] imperfect sequences [] total 6 [2018-11-23 07:46:54,103 INFO L459 AbstractCegarLoop]: Interpolant automaton has 6 states [2018-11-23 07:46:54,104 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 6 interpolants. [2018-11-23 07:46:54,104 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=11, Invalid=19, Unknown=0, NotChecked=0, Total=30 [2018-11-23 07:46:54,104 INFO L87 Difference]: Start difference. First operand 1037 states and 1556 transitions. Second operand 6 states. [2018-11-23 07:46:54,348 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 07:46:54,348 INFO L93 Difference]: Finished difference Result 1931 states and 2900 transitions. [2018-11-23 07:46:54,348 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 6 states. [2018-11-23 07:46:54,348 INFO L78 Accepts]: Start accepts. Automaton has 6 states. Word has length 129 [2018-11-23 07:46:54,348 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 07:46:54,350 INFO L225 Difference]: With dead ends: 1931 [2018-11-23 07:46:54,350 INFO L226 Difference]: Without dead ends: 1110 [2018-11-23 07:46:54,351 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 10 GetRequests, 2 SyntacticMatches, 2 SemanticMatches, 6 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 1 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=23, Invalid=33, Unknown=0, NotChecked=0, Total=56 [2018-11-23 07:46:54,351 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 1110 states. [2018-11-23 07:46:54,365 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 1110 to 1038. [2018-11-23 07:46:54,365 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 1038 states. [2018-11-23 07:46:54,366 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 1038 states to 1038 states and 1557 transitions. [2018-11-23 07:46:54,366 INFO L78 Accepts]: Start accepts. Automaton has 1038 states and 1557 transitions. Word has length 129 [2018-11-23 07:46:54,367 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 07:46:54,367 INFO L480 AbstractCegarLoop]: Abstraction has 1038 states and 1557 transitions. [2018-11-23 07:46:54,367 INFO L481 AbstractCegarLoop]: Interpolant automaton has 6 states. [2018-11-23 07:46:54,367 INFO L276 IsEmpty]: Start isEmpty. Operand 1038 states and 1557 transitions. [2018-11-23 07:46:54,368 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 144 [2018-11-23 07:46:54,368 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 07:46:54,368 INFO L402 BasicCegarLoop]: trace histogram [7, 7, 6, 6, 6, 6, 6, 6, 6, 6, 5, 5, 4, 4, 3, 3, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 07:46:54,368 INFO L423 AbstractCegarLoop]: === Iteration 36 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 07:46:54,368 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 07:46:54,369 INFO L82 PathProgramCache]: Analyzing trace with hash 1528997636, now seen corresponding path program 1 times [2018-11-23 07:46:54,369 INFO L223 ckRefinementStrategy]: Switched to mode SMTINTERPOL_TREE_INTERPOLANTS [2018-11-23 07:46:54,369 INFO L69 tionRefinementEngine]: Using refinement strategy CamelRefinementStrategy [2018-11-23 07:46:54,369 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 07:46:54,370 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 07:46:54,370 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 07:46:54,494 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is sat [2018-11-23 07:46:54,578 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is sat [2018-11-23 07:46:54,616 INFO L469 BasicCegarLoop]: Counterexample might be feasible ----- class de.uni_freiburg.informatik.ultimate.plugins.generator.rcfgbuilder.RCFGBacktranslator [?] CALL call ULTIMATE.init(); VAL [|#NULL.base|=20507, |#NULL.offset|=20535, |old(#NULL.base)|=20507, |old(#NULL.offset)|=20535, |old(~#SSLv3_client_data~0.base)|=20492, |old(~#SSLv3_client_data~0.offset)|=20488, |old(~init~0)|=20541, |~#SSLv3_client_data~0.base|=20492, |~#SSLv3_client_data~0.offset|=20488, ~init~0=20541] [?] #NULL.base, #NULL.offset := 0, 0;#valid := #valid[0 := 0];~init~0 := 1;call ~#SSLv3_client_data~0.base, ~#SSLv3_client_data~0.offset := #Ultimate.alloc(100);call write~init~int(0, ~#SSLv3_client_data~0.base, ~#SSLv3_client_data~0.offset, 4);call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 4 + ~#SSLv3_client_data~0.offset, 4);call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 8 + ~#SSLv3_client_data~0.offset, 4);call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 12 + ~#SSLv3_client_data~0.offset, 4);call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 16 + ~#SSLv3_client_data~0.offset, 4);call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 20 + ~#SSLv3_client_data~0.offset, 4);call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 24 + ~#SSLv3_client_data~0.offset, 4);call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 28 + ~#SSLv3_client_data~0.offset, 4);call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 32 + ~#SSLv3_client_data~0.offset, 4);call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 36 + ~#SSLv3_client_data~0.offset, 4);call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 40 + ~#SSLv3_client_data~0.offset, 4);call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 44 + ~#SSLv3_client_data~0.offset, 4);call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 48 + ~#SSLv3_client_data~0.offset, 4);call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 52 + ~#SSLv3_client_data~0.offset, 4);call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 56 + ~#SSLv3_client_data~0.offset, 4);call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 60 + ~#SSLv3_client_data~0.offset, 4);call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 64 + ~#SSLv3_client_data~0.offset, 4);call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 68 + ~#SSLv3_client_data~0.offset, 4);call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 72 + ~#SSLv3_client_data~0.offset, 4);call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 76 + ~#SSLv3_client_data~0.offset, 4);call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 80 + ~#SSLv3_client_data~0.offset, 4);call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 84 + ~#SSLv3_client_data~0.offset, 4);call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 88 + ~#SSLv3_client_data~0.offset, 4);call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 92 + ~#SSLv3_client_data~0.offset, 4);call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 96 + ~#SSLv3_client_data~0.offset, 4); VAL [|#NULL.base|=0, |#NULL.offset|=0, |old(#NULL.base)|=20507, |old(#NULL.offset)|=20535, |old(~#SSLv3_client_data~0.base)|=20492, |old(~#SSLv3_client_data~0.offset)|=20488, |old(~init~0)|=20541, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume true; VAL [|#NULL.base|=0, |#NULL.offset|=0, |old(#NULL.base)|=20507, |old(#NULL.offset)|=20535, |old(~#SSLv3_client_data~0.base)|=20492, |old(~#SSLv3_client_data~0.offset)|=20488, |old(~init~0)|=20541, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] RET #542#return; VAL [|#NULL.base|=0, |#NULL.offset|=0, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] CALL call #t~ret139 := main(); VAL [|#NULL.base|=0, |#NULL.offset|=0, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] call #t~malloc3.base, #t~malloc3.offset := #Ultimate.alloc(248);~s~0.base, ~s~0.offset := #t~malloc3.base, #t~malloc3.offset;call #t~malloc4.base, #t~malloc4.offset := #Ultimate.alloc(899);call write~$Pointer$(#t~malloc4.base, #t~malloc4.offset, ~s~0.base, 84 + ~s~0.offset, 4);call #t~malloc5.base, #t~malloc5.offset := #Ultimate.alloc(232);call write~$Pointer$(#t~malloc5.base, #t~malloc5.offset, ~s~0.base, 204 + ~s~0.offset, 4);call #t~malloc6.base, #t~malloc6.offset := #Ultimate.alloc(200);call write~$Pointer$(#t~malloc6.base, #t~malloc6.offset, ~s~0.base, 176 + ~s~0.offset, 4);call write~int(12292, ~s~0.base, 52 + ~s~0.offset, 4);assume -2147483648 <= #t~nondet7 && #t~nondet7 <= 2147483647;call write~int(#t~nondet7, ~s~0.base, ~s~0.offset, 4);havoc #t~nondet7; VAL [main_~s~0.base=20501, main_~s~0.offset=0, |#NULL.base|=0, |#NULL.offset|=0, |main_#t~malloc3.base|=20501, |main_#t~malloc3.offset|=0, |main_#t~malloc4.base|=20506, |main_#t~malloc4.offset|=0, |main_#t~malloc5.base|=20521, |main_#t~malloc5.offset|=0, |main_#t~malloc6.base|=20484, |main_#t~malloc6.offset|=0, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] CALL call #t~ret8 := ssl3_connect(~s~0.base, ~s~0.offset); VAL [|#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] ~s.base, ~s.offset := #in~s.base, #in~s.offset;~buf~0.base, ~buf~0.offset := #t~nondet9.base, #t~nondet9.offset;havoc #t~nondet9.base, #t~nondet9.offset;havoc ~tmp~2;havoc ~l~0;havoc ~num1~0;havoc ~cb~0.base, ~cb~0.offset;havoc ~ret~0;havoc ~new_state~0;havoc ~state~0;havoc ~skip~0;~tmp___0~1.base, ~tmp___0~1.offset := #t~nondet10.base, #t~nondet10.offset;havoc #t~nondet10.base, #t~nondet10.offset;assume -2147483648 <= #t~nondet11 && #t~nondet11 <= 2147483647;~tmp___1~0 := #t~nondet11;havoc #t~nondet11;assume -2147483648 <= #t~nondet12 && #t~nondet12 <= 2147483647;~tmp___2~0 := #t~nondet12;havoc #t~nondet12;havoc ~tmp___3~0;havoc ~tmp___4~0;havoc ~tmp___5~0;havoc ~tmp___6~0;havoc ~tmp___7~0;havoc ~tmp___8~0;havoc ~tmp___9~0;havoc ~blastFlag~0;~blastFlag~0 := 0;assume -2147483648 <= #t~nondet13 && #t~nondet13 <= 2147483647;call write~int(#t~nondet13, ~s.base, 92 + ~s.offset, 4);havoc #t~nondet13;call write~int(12292, ~s.base, 52 + ~s.offset, 4);assume -2147483648 <= #t~nondet14 && #t~nondet14 <= 2147483647;~tmp~2 := #t~nondet14;havoc #t~nondet14;~cb~0.base, ~cb~0.offset := 0, 0;~ret~0 := -1;~skip~0 := 0;call write~int(0, ~tmp___0~1.base, ~tmp___0~1.offset, 4);call #t~mem15.base, #t~mem15.offset := read~$Pointer$(~s.base, 192 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=0, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=0, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=(- 1), ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem15.base|=1, |ssl3_connect_#t~mem15.offset|=0, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume 0 != (#t~mem15.base + #t~mem15.offset) % 4294967296;havoc #t~mem15.base, #t~mem15.offset;call #t~mem16.base, #t~mem16.offset := read~$Pointer$(~s.base, 192 + ~s.offset, 4);~cb~0.base, ~cb~0.offset := #t~mem16.base, #t~mem16.offset;havoc #t~mem16.base, #t~mem16.offset; VAL [ssl3_connect_~blastFlag~0=0, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=(- 1), ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] call #t~mem21 := read~int(~s.base, 28 + ~s.offset, 4);call write~int(1 + #t~mem21, ~s.base, 28 + ~s.offset, 4);havoc #t~mem21; VAL [ssl3_connect_~blastFlag~0=0, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=(- 1), ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(0 != ~bitwiseAnd(~tmp___1~0, 12288)); VAL [ssl3_connect_~blastFlag~0=0, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=(- 1), ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !false; VAL [ssl3_connect_~blastFlag~0=0, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=(- 1), ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] call #t~mem22 := read~int(~s.base, 52 + ~s.offset, 4);~state~0 := #t~mem22;havoc #t~mem22;call #t~mem23 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=0, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=(- 1), ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=12292, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem23|=12292, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume 12292 == #t~mem23;havoc #t~mem23; VAL [ssl3_connect_~blastFlag~0=0, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=(- 1), ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=12292, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] call write~int(1, ~s.base, 40 + ~s.offset, 4);call write~int(4096, ~s.base, 52 + ~s.offset, 4);call #t~mem56.base, #t~mem56.offset := read~$Pointer$(~s.base, 204 + ~s.offset, 4);call #t~mem57 := read~int(#t~mem56.base, 64 + #t~mem56.offset, 4);call write~int(1 + #t~mem57, #t~mem56.base, 64 + #t~mem56.offset, 4);havoc #t~mem56.base, #t~mem56.offset;havoc #t~mem57; VAL [ssl3_connect_~blastFlag~0=0, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=(- 1), ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=12292, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] call write~int(0, ~s.base, 36 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=0, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=(- 1), ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=12292, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume 0 != (~cb~0.base + ~cb~0.offset) % 4294967296; VAL [ssl3_connect_~blastFlag~0=0, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=(- 1), ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=12292, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] call #t~mem58 := read~int(~s.base, ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=0, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=(- 1), ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=12292, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem58|=0, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(768 != ~bitwiseAnd(#t~mem58, 65280));havoc #t~mem58;call write~int(4096, ~s.base, 4 + ~s.offset, 4);call #t~mem59.base, #t~mem59.offset := read~$Pointer$(~s.base, 60 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=0, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=(- 1), ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=12292, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem59.base|=(- 1), |ssl3_connect_#t~mem59.offset|=2, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(0 == (#t~mem59.base + #t~mem59.offset) % 4294967296);havoc #t~mem59.base, #t~mem59.offset; VAL [ssl3_connect_~blastFlag~0=0, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=(- 1), ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=12292, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume -2147483648 <= #t~nondet61 && #t~nondet61 <= 2147483647;~tmp___4~0 := #t~nondet61;havoc #t~nondet61; VAL [ssl3_connect_~blastFlag~0=0, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=(- 1), ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=12292, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(0 == ~tmp___4~0);assume -2147483648 <= #t~nondet62 && #t~nondet62 <= 2147483647;~tmp___5~0 := #t~nondet62;havoc #t~nondet62; VAL [ssl3_connect_~blastFlag~0=0, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=(- 1), ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=12292, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(0 == ~tmp___5~0);call write~int(4368, ~s.base, 52 + ~s.offset, 4);call #t~mem63.base, #t~mem63.offset := read~$Pointer$(~s.base, 204 + ~s.offset, 4);call #t~mem64 := read~int(#t~mem63.base, 60 + #t~mem63.offset, 4);call write~int(1 + #t~mem64, #t~mem63.base, 60 + #t~mem63.offset, 4);havoc #t~mem63.base, #t~mem63.offset;havoc #t~mem64;call write~int(0, ~s.base, 64 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=0, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=(- 1), ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=12292, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] call #t~mem128.base, #t~mem128.offset := read~$Pointer$(~s.base, 84 + ~s.offset, 4);call #t~mem129 := read~int(#t~mem128.base, 848 + #t~mem128.offset, 4); VAL [ssl3_connect_~blastFlag~0=0, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=(- 1), ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=12292, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem128.base|=20506, |ssl3_connect_#t~mem128.offset|=0, |ssl3_connect_#t~mem129|=20542, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(0 == #t~mem129);havoc #t~mem128.base, #t~mem128.offset;havoc #t~mem129; VAL [ssl3_connect_~blastFlag~0=0, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=(- 1), ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=12292, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] ~skip~0 := 0; VAL [ssl3_connect_~blastFlag~0=0, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=(- 1), ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=12292, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !false; VAL [ssl3_connect_~blastFlag~0=0, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=(- 1), ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=12292, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] call #t~mem22 := read~int(~s.base, 52 + ~s.offset, 4);~state~0 := #t~mem22;havoc #t~mem22;call #t~mem23 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=0, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=(- 1), ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4368, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem23|=4368, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(12292 == #t~mem23);havoc #t~mem23;call #t~mem24 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=0, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=(- 1), ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4368, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem24|=4368, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(16384 == #t~mem24);havoc #t~mem24;call #t~mem25 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=0, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=(- 1), ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4368, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem25|=4368, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4096 == #t~mem25);havoc #t~mem25;call #t~mem26 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=0, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=(- 1), ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4368, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem26|=4368, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(20480 == #t~mem26);havoc #t~mem26;call #t~mem27 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=0, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=(- 1), ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4368, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem27|=4368, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4099 == #t~mem27);havoc #t~mem27;call #t~mem28 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=0, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=(- 1), ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4368, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem28|=4368, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume 4368 == #t~mem28;havoc #t~mem28; VAL [ssl3_connect_~blastFlag~0=0, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=(- 1), ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4368, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] call write~int(0, ~s.base, 48 + ~s.offset, 4);assume -2147483648 <= #t~nondet65 && #t~nondet65 <= 2147483647;~ret~0 := #t~nondet65;havoc #t~nondet65; VAL [ssl3_connect_~blastFlag~0=0, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4368, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume 0 == ~blastFlag~0;~blastFlag~0 := 1; VAL [ssl3_connect_~blastFlag~0=1, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4368, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(~ret~0 <= 0);call write~int(4384, ~s.base, 52 + ~s.offset, 4);call write~int(0, ~s.base, 64 + ~s.offset, 4);call #t~mem66.base, #t~mem66.offset := read~$Pointer$(~s.base, 20 + ~s.offset, 4);call #t~mem67.base, #t~mem67.offset := read~$Pointer$(~s.base, 16 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=1, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4368, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem66.base|=0, |ssl3_connect_#t~mem66.offset|=1, |ssl3_connect_#t~mem67.base|=0, |ssl3_connect_#t~mem67.offset|=0, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume (#t~mem66.base + #t~mem66.offset) % 4294967296 != (#t~mem67.base + #t~mem67.offset) % 4294967296;havoc #t~mem66.base, #t~mem66.offset;havoc #t~mem67.base, #t~mem67.offset; VAL [ssl3_connect_~blastFlag~0=1, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4368, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] call #t~mem128.base, #t~mem128.offset := read~$Pointer$(~s.base, 84 + ~s.offset, 4);call #t~mem129 := read~int(#t~mem128.base, 848 + #t~mem128.offset, 4); VAL [ssl3_connect_~blastFlag~0=1, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4368, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem128.base|=20506, |ssl3_connect_#t~mem128.offset|=0, |ssl3_connect_#t~mem129|=20542, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(0 == #t~mem129);havoc #t~mem128.base, #t~mem128.offset;havoc #t~mem129; VAL [ssl3_connect_~blastFlag~0=1, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4368, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] ~skip~0 := 0; VAL [ssl3_connect_~blastFlag~0=1, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4368, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !false; VAL [ssl3_connect_~blastFlag~0=1, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4368, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] call #t~mem22 := read~int(~s.base, 52 + ~s.offset, 4);~state~0 := #t~mem22;havoc #t~mem22;call #t~mem23 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=1, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4384, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem23|=4384, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(12292 == #t~mem23);havoc #t~mem23;call #t~mem24 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=1, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4384, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem24|=4384, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(16384 == #t~mem24);havoc #t~mem24;call #t~mem25 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=1, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4384, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem25|=4384, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4096 == #t~mem25);havoc #t~mem25;call #t~mem26 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=1, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4384, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem26|=4384, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(20480 == #t~mem26);havoc #t~mem26;call #t~mem27 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=1, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4384, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem27|=4384, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4099 == #t~mem27);havoc #t~mem27;call #t~mem28 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=1, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4384, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem28|=4384, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4368 == #t~mem28);havoc #t~mem28;call #t~mem29 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=1, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4384, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem29|=4384, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4369 == #t~mem29);havoc #t~mem29;call #t~mem30 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=1, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4384, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem30|=4384, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume 4384 == #t~mem30;havoc #t~mem30; VAL [ssl3_connect_~blastFlag~0=1, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4384, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume -2147483648 <= #t~nondet68 && #t~nondet68 <= 2147483647;~ret~0 := #t~nondet68;havoc #t~nondet68; VAL [ssl3_connect_~blastFlag~0=1, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4384, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume 1 == ~blastFlag~0;~blastFlag~0 := 2; VAL [ssl3_connect_~blastFlag~0=2, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4384, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(~ret~0 <= 0);call #t~mem69 := read~int(~s.base, 92 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=2, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4384, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem69|=0, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(0 != #t~mem69);havoc #t~mem69;call write~int(4400, ~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=2, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4384, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] call write~int(0, ~s.base, 64 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=2, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4384, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] call #t~mem128.base, #t~mem128.offset := read~$Pointer$(~s.base, 84 + ~s.offset, 4);call #t~mem129 := read~int(#t~mem128.base, 848 + #t~mem128.offset, 4); VAL [ssl3_connect_~blastFlag~0=2, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4384, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem128.base|=20506, |ssl3_connect_#t~mem128.offset|=0, |ssl3_connect_#t~mem129|=20542, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(0 == #t~mem129);havoc #t~mem128.base, #t~mem128.offset;havoc #t~mem129; VAL [ssl3_connect_~blastFlag~0=2, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4384, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] ~skip~0 := 0; VAL [ssl3_connect_~blastFlag~0=2, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4384, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !false; VAL [ssl3_connect_~blastFlag~0=2, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4384, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] call #t~mem22 := read~int(~s.base, 52 + ~s.offset, 4);~state~0 := #t~mem22;havoc #t~mem22;call #t~mem23 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=2, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4400, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem23|=4400, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(12292 == #t~mem23);havoc #t~mem23;call #t~mem24 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=2, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4400, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem24|=4400, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(16384 == #t~mem24);havoc #t~mem24;call #t~mem25 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=2, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4400, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem25|=4400, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4096 == #t~mem25);havoc #t~mem25;call #t~mem26 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=2, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4400, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem26|=4400, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(20480 == #t~mem26);havoc #t~mem26;call #t~mem27 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=2, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4400, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem27|=4400, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4099 == #t~mem27);havoc #t~mem27;call #t~mem28 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=2, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4400, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem28|=4400, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4368 == #t~mem28);havoc #t~mem28;call #t~mem29 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=2, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4400, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem29|=4400, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4369 == #t~mem29);havoc #t~mem29;call #t~mem30 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=2, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4400, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem30|=4400, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4384 == #t~mem30);havoc #t~mem30;call #t~mem31 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=2, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4400, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem31|=4400, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4385 == #t~mem31);havoc #t~mem31;call #t~mem32 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=2, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4400, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem32|=4400, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume 4400 == #t~mem32;havoc #t~mem32; VAL [ssl3_connect_~blastFlag~0=2, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4400, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] call #t~mem70.base, #t~mem70.offset := read~$Pointer$(~s.base, 84 + ~s.offset, 4);call #t~mem71.base, #t~mem71.offset := read~$Pointer$(#t~mem70.base, 836 + #t~mem70.offset, 4);call #t~mem72 := read~int(#t~mem71.base, 12 + #t~mem71.offset, 4); VAL [ssl3_connect_~blastFlag~0=2, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=1, ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4400, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem70.base|=20506, |ssl3_connect_#t~mem70.offset|=0, |ssl3_connect_#t~mem71.base|=20502, |ssl3_connect_#t~mem71.offset|=0, |ssl3_connect_#t~mem72|=20537, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(0 != ~bitwiseAnd(#t~mem72, 256) % 4294967296);havoc #t~mem71.base, #t~mem71.offset;havoc #t~mem70.base, #t~mem70.offset;havoc #t~mem72;assume -2147483648 <= #t~nondet73 && #t~nondet73 <= 2147483647;~ret~0 := #t~nondet73;havoc #t~nondet73; VAL [ssl3_connect_~blastFlag~0=2, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=5, ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4400, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume 2 == ~blastFlag~0;~blastFlag~0 := 3; VAL [ssl3_connect_~blastFlag~0=3, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=5, ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4400, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(~ret~0 <= 0); VAL [ssl3_connect_~blastFlag~0=3, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=5, ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4400, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] call write~int(4416, ~s.base, 52 + ~s.offset, 4);call write~int(0, ~s.base, 64 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=3, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=5, ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4400, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] call #t~mem128.base, #t~mem128.offset := read~$Pointer$(~s.base, 84 + ~s.offset, 4);call #t~mem129 := read~int(#t~mem128.base, 848 + #t~mem128.offset, 4); VAL [ssl3_connect_~blastFlag~0=3, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=5, ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4400, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem128.base|=20506, |ssl3_connect_#t~mem128.offset|=0, |ssl3_connect_#t~mem129|=20542, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(0 == #t~mem129);havoc #t~mem128.base, #t~mem128.offset;havoc #t~mem129; VAL [ssl3_connect_~blastFlag~0=3, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=5, ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4400, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] ~skip~0 := 0; VAL [ssl3_connect_~blastFlag~0=3, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=5, ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4400, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !false; VAL [ssl3_connect_~blastFlag~0=3, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=5, ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4400, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] call #t~mem22 := read~int(~s.base, 52 + ~s.offset, 4);~state~0 := #t~mem22;havoc #t~mem22;call #t~mem23 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=3, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=5, ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4416, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem23|=4416, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(12292 == #t~mem23);havoc #t~mem23;call #t~mem24 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=3, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=5, ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4416, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem24|=4416, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(16384 == #t~mem24);havoc #t~mem24;call #t~mem25 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=3, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=5, ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4416, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem25|=4416, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4096 == #t~mem25);havoc #t~mem25;call #t~mem26 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=3, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=5, ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4416, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem26|=4416, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(20480 == #t~mem26);havoc #t~mem26;call #t~mem27 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=3, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=5, ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4416, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem27|=4416, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4099 == #t~mem27);havoc #t~mem27;call #t~mem28 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=3, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=5, ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4416, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem28|=4416, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4368 == #t~mem28);havoc #t~mem28;call #t~mem29 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=3, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=5, ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4416, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem29|=4416, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4369 == #t~mem29);havoc #t~mem29;call #t~mem30 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=3, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=5, ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4416, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem30|=4416, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4384 == #t~mem30);havoc #t~mem30;call #t~mem31 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=3, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=5, ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4416, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem31|=4416, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4385 == #t~mem31);havoc #t~mem31;call #t~mem32 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=3, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=5, ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4416, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem32|=4416, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4400 == #t~mem32);havoc #t~mem32;call #t~mem33 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=3, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=5, ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4416, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem33|=4416, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4401 == #t~mem33);havoc #t~mem33;call #t~mem34 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=3, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=5, ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4416, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem34|=4416, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume 4416 == #t~mem34;havoc #t~mem34; VAL [ssl3_connect_~blastFlag~0=3, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=5, ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4416, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume -2147483648 <= #t~nondet74 && #t~nondet74 <= 2147483647;~ret~0 := #t~nondet74;havoc #t~nondet74; VAL [ssl3_connect_~blastFlag~0=3, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=6, ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4416, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume 3 == ~blastFlag~0;~blastFlag~0 := 4; VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=6, ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4416, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(~ret~0 <= 0);call write~int(4432, ~s.base, 52 + ~s.offset, 4);call write~int(0, ~s.base, 64 + ~s.offset, 4);assume -2147483648 <= #t~nondet75 && #t~nondet75 <= 2147483647;~tmp___6~0 := #t~nondet75;havoc #t~nondet75; VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=6, ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4416, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(0 == ~tmp___6~0); VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=6, ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4416, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] call #t~mem128.base, #t~mem128.offset := read~$Pointer$(~s.base, 84 + ~s.offset, 4);call #t~mem129 := read~int(#t~mem128.base, 848 + #t~mem128.offset, 4); VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=6, ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4416, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem128.base|=20506, |ssl3_connect_#t~mem128.offset|=0, |ssl3_connect_#t~mem129|=20542, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(0 == #t~mem129);havoc #t~mem128.base, #t~mem128.offset;havoc #t~mem129; VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=6, ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4416, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] ~skip~0 := 0; VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=6, ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4416, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !false; VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=6, ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4416, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] call #t~mem22 := read~int(~s.base, 52 + ~s.offset, 4);~state~0 := #t~mem22;havoc #t~mem22;call #t~mem23 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=6, ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4432, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem23|=4432, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(12292 == #t~mem23);havoc #t~mem23;call #t~mem24 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=6, ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4432, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem24|=4432, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(16384 == #t~mem24);havoc #t~mem24;call #t~mem25 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=6, ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4432, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem25|=4432, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4096 == #t~mem25);havoc #t~mem25;call #t~mem26 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=6, ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4432, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem26|=4432, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(20480 == #t~mem26);havoc #t~mem26;call #t~mem27 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=6, ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4432, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem27|=4432, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4099 == #t~mem27);havoc #t~mem27;call #t~mem28 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=6, ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4432, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem28|=4432, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4368 == #t~mem28);havoc #t~mem28;call #t~mem29 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=6, ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4432, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem29|=4432, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4369 == #t~mem29);havoc #t~mem29;call #t~mem30 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=6, ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4432, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem30|=4432, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4384 == #t~mem30);havoc #t~mem30;call #t~mem31 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=6, ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4432, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem31|=4432, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4385 == #t~mem31);havoc #t~mem31;call #t~mem32 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=6, ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4432, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem32|=4432, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4400 == #t~mem32);havoc #t~mem32;call #t~mem33 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=6, ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4432, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem33|=4432, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4401 == #t~mem33);havoc #t~mem33;call #t~mem34 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=6, ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4432, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem34|=4432, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4416 == #t~mem34);havoc #t~mem34;call #t~mem35 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=6, ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4432, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem35|=4432, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4417 == #t~mem35);havoc #t~mem35;call #t~mem36 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=6, ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4432, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem36|=4432, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume 4432 == #t~mem36;havoc #t~mem36; VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=6, ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4432, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume -2147483648 <= #t~nondet76 && #t~nondet76 <= 2147483647;~ret~0 := #t~nondet76;havoc #t~nondet76; VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=7, ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4432, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(5 == ~blastFlag~0); VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=7, ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4432, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(~ret~0 <= 0);call write~int(4448, ~s.base, 52 + ~s.offset, 4);call write~int(0, ~s.base, 64 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=7, ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4432, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] call #t~mem128.base, #t~mem128.offset := read~$Pointer$(~s.base, 84 + ~s.offset, 4);call #t~mem129 := read~int(#t~mem128.base, 848 + #t~mem128.offset, 4); VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=7, ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4432, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem128.base|=20506, |ssl3_connect_#t~mem128.offset|=0, |ssl3_connect_#t~mem129|=20542, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(0 == #t~mem129);havoc #t~mem128.base, #t~mem128.offset;havoc #t~mem129; VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=7, ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4432, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] ~skip~0 := 0; VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=7, ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4432, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !false; VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=7, ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4432, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] call #t~mem22 := read~int(~s.base, 52 + ~s.offset, 4);~state~0 := #t~mem22;havoc #t~mem22;call #t~mem23 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=7, ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4448, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem23|=4448, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(12292 == #t~mem23);havoc #t~mem23;call #t~mem24 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=7, ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4448, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem24|=4448, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(16384 == #t~mem24);havoc #t~mem24;call #t~mem25 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=7, ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4448, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem25|=4448, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4096 == #t~mem25);havoc #t~mem25;call #t~mem26 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=7, ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4448, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem26|=4448, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(20480 == #t~mem26);havoc #t~mem26;call #t~mem27 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=7, ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4448, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem27|=4448, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4099 == #t~mem27);havoc #t~mem27;call #t~mem28 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=7, ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4448, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem28|=4448, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4368 == #t~mem28);havoc #t~mem28;call #t~mem29 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=7, ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4448, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem29|=4448, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4369 == #t~mem29);havoc #t~mem29;call #t~mem30 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=7, ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4448, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem30|=4448, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4384 == #t~mem30);havoc #t~mem30;call #t~mem31 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=7, ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4448, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem31|=4448, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4385 == #t~mem31);havoc #t~mem31;call #t~mem32 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=7, ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4448, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem32|=4448, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4400 == #t~mem32);havoc #t~mem32;call #t~mem33 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=7, ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4448, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem33|=4448, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4401 == #t~mem33);havoc #t~mem33;call #t~mem34 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=7, ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4448, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem34|=4448, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4416 == #t~mem34);havoc #t~mem34;call #t~mem35 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=7, ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4448, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem35|=4448, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4417 == #t~mem35);havoc #t~mem35;call #t~mem36 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=7, ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4448, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem36|=4448, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4432 == #t~mem36);havoc #t~mem36;call #t~mem37 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=7, ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4448, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem37|=4448, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !(4433 == #t~mem37);havoc #t~mem37;call #t~mem38 := read~int(~s.base, 52 + ~s.offset, 4); VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=7, ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4448, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |ssl3_connect_#t~mem38|=4448, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume 4448 == #t~mem38;havoc #t~mem38; VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=7, ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4448, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume -2147483648 <= #t~nondet77 && #t~nondet77 <= 2147483647;~ret~0 := #t~nondet77;havoc #t~nondet77; VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=0, ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4448, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume 4 == ~blastFlag~0; VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=0, ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4448, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] assume !false; VAL [ssl3_connect_~blastFlag~0=4, ssl3_connect_~buf~0.base=20511, ssl3_connect_~buf~0.offset=20517, ssl3_connect_~cb~0.base=1, ssl3_connect_~cb~0.offset=0, ssl3_connect_~ret~0=0, ssl3_connect_~s.base=20501, ssl3_connect_~s.offset=0, ssl3_connect_~skip~0=0, ssl3_connect_~state~0=4448, ssl3_connect_~tmp___0~1.base=20501, ssl3_connect_~tmp___0~1.offset=204, ssl3_connect_~tmp___1~0=0, ssl3_connect_~tmp___2~0=0, ssl3_connect_~tmp___4~0=1, ssl3_connect_~tmp___5~0=1, ssl3_connect_~tmp___6~0=1, ssl3_connect_~tmp~2=0, |#NULL.base|=0, |#NULL.offset|=0, |ssl3_connect_#in~s.base|=20501, |ssl3_connect_#in~s.offset|=0, |~#SSLv3_client_data~0.base|=20494, |~#SSLv3_client_data~0.offset|=0, ~init~0=1] [?] CALL call ULTIMATE.init(); VAL [#NULL.base=20507, #NULL.offset=20535, old(#NULL.base)=20507, old(#NULL.offset)=20535, old(~#SSLv3_client_data~0.base)=20492, old(~#SSLv3_client_data~0.offset)=20488, old(~init~0)=20541, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=20488, ~init~0=20541] [?] #NULL.base, #NULL.offset := 0, 0; [?] #valid := #valid[0 := 0]; [L1042] ~init~0 := 1; [L1043] call ~#SSLv3_client_data~0.base, ~#SSLv3_client_data~0.offset := #Ultimate.alloc(100); [L1043] call write~init~int(0, ~#SSLv3_client_data~0.base, ~#SSLv3_client_data~0.offset, 4); [L1043] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 4 + ~#SSLv3_client_data~0.offset, 4); [L1043] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 8 + ~#SSLv3_client_data~0.offset, 4); [L1043] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 12 + ~#SSLv3_client_data~0.offset, 4); [L1043] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 16 + ~#SSLv3_client_data~0.offset, 4); [L1043] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 20 + ~#SSLv3_client_data~0.offset, 4); [L1043] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 24 + ~#SSLv3_client_data~0.offset, 4); [L1043] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 28 + ~#SSLv3_client_data~0.offset, 4); [L1043] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 32 + ~#SSLv3_client_data~0.offset, 4); [L1043] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 36 + ~#SSLv3_client_data~0.offset, 4); [L1043] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 40 + ~#SSLv3_client_data~0.offset, 4); [L1043] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 44 + ~#SSLv3_client_data~0.offset, 4); [L1043] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 48 + ~#SSLv3_client_data~0.offset, 4); [L1043] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 52 + ~#SSLv3_client_data~0.offset, 4); [L1043] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 56 + ~#SSLv3_client_data~0.offset, 4); [L1043] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 60 + ~#SSLv3_client_data~0.offset, 4); [L1043] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 64 + ~#SSLv3_client_data~0.offset, 4); [L1043] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 68 + ~#SSLv3_client_data~0.offset, 4); [L1043] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 72 + ~#SSLv3_client_data~0.offset, 4); [L1043] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 76 + ~#SSLv3_client_data~0.offset, 4); [L1043] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 80 + ~#SSLv3_client_data~0.offset, 4); [L1043] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 84 + ~#SSLv3_client_data~0.offset, 4); [L1043] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 88 + ~#SSLv3_client_data~0.offset, 4); [L1043] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 92 + ~#SSLv3_client_data~0.offset, 4); [L1043] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 96 + ~#SSLv3_client_data~0.offset, 4); VAL [#NULL.base=0, #NULL.offset=0, old(#NULL.base)=20507, old(#NULL.offset)=20535, old(~#SSLv3_client_data~0.base)=20492, old(~#SSLv3_client_data~0.offset)=20488, old(~init~0)=20541, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~init~0=1] [?] ensures true; VAL [#NULL.base=0, #NULL.offset=0, old(#NULL.base)=20507, old(#NULL.offset)=20535, old(~#SSLv3_client_data~0.base)=20492, old(~#SSLv3_client_data~0.offset)=20488, old(~init~0)=20541, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~init~0=1] [?] RET call ULTIMATE.init(); VAL [#NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~init~0=1] [?] CALL call #t~ret139 := main(); VAL [#NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~init~0=1] [L1065] call #t~malloc3.base, #t~malloc3.offset := #Ultimate.alloc(248); [L1065] ~s~0.base, ~s~0.offset := #t~malloc3.base, #t~malloc3.offset; [L1069] call #t~malloc4.base, #t~malloc4.offset := #Ultimate.alloc(899); [L1069] call write~$Pointer$(#t~malloc4.base, #t~malloc4.offset, ~s~0.base, 84 + ~s~0.offset, 4); [L1070] call #t~malloc5.base, #t~malloc5.offset := #Ultimate.alloc(232); [L1070] call write~$Pointer$(#t~malloc5.base, #t~malloc5.offset, ~s~0.base, 204 + ~s~0.offset, 4); [L1071] call #t~malloc6.base, #t~malloc6.offset := #Ultimate.alloc(200); [L1071] call write~$Pointer$(#t~malloc6.base, #t~malloc6.offset, ~s~0.base, 176 + ~s~0.offset, 4); [L1072] call write~int(12292, ~s~0.base, 52 + ~s~0.offset, 4); [L1073] assume -2147483648 <= #t~nondet7 && #t~nondet7 <= 2147483647; [L1073] call write~int(#t~nondet7, ~s~0.base, ~s~0.offset, 4); [L1073] havoc #t~nondet7; VAL [#NULL.base=0, #NULL.offset=0, #t~malloc3.base=20501, #t~malloc3.offset=0, #t~malloc4.base=20506, #t~malloc4.offset=0, #t~malloc5.base=20521, #t~malloc5.offset=0, #t~malloc6.base=20484, #t~malloc6.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~init~0=1, ~s~0.base=20501, ~s~0.offset=0] [L1074] CALL call #t~ret8 := ssl3_connect(~s~0.base, ~s~0.offset); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~init~0=1] [L1079-L1648] ~s.base, ~s.offset := #in~s.base, #in~s.offset; [L1080] ~buf~0.base, ~buf~0.offset := #t~nondet9.base, #t~nondet9.offset; [L1080] havoc #t~nondet9.base, #t~nondet9.offset; [L1081] havoc ~tmp~2; [L1082] havoc ~l~0; [L1083] havoc ~num1~0; [L1084] havoc ~cb~0.base, ~cb~0.offset; [L1085] havoc ~ret~0; [L1086] havoc ~new_state~0; [L1087] havoc ~state~0; [L1088] havoc ~skip~0; [L1089] ~tmp___0~1.base, ~tmp___0~1.offset := #t~nondet10.base, #t~nondet10.offset; [L1089] havoc #t~nondet10.base, #t~nondet10.offset; [L1090] assume -2147483648 <= #t~nondet11 && #t~nondet11 <= 2147483647; [L1090] ~tmp___1~0 := #t~nondet11; [L1090] havoc #t~nondet11; [L1091] assume -2147483648 <= #t~nondet12 && #t~nondet12 <= 2147483647; [L1091] ~tmp___2~0 := #t~nondet12; [L1091] havoc #t~nondet12; [L1092] havoc ~tmp___3~0; [L1093] havoc ~tmp___4~0; [L1094] havoc ~tmp___5~0; [L1095] havoc ~tmp___6~0; [L1096] havoc ~tmp___7~0; [L1097] havoc ~tmp___8~0; [L1098] havoc ~tmp___9~0; [L1100] havoc ~blastFlag~0; [L1103] ~blastFlag~0 := 0; [L1104] assume -2147483648 <= #t~nondet13 && #t~nondet13 <= 2147483647; [L1104] call write~int(#t~nondet13, ~s.base, 92 + ~s.offset, 4); [L1104] havoc #t~nondet13; [L1105] call write~int(12292, ~s.base, 52 + ~s.offset, 4); [L1106] assume -2147483648 <= #t~nondet14 && #t~nondet14 <= 2147483647; [L1106] ~tmp~2 := #t~nondet14; [L1106] havoc #t~nondet14; [L1107] ~cb~0.base, ~cb~0.offset := 0, 0; [L1108] ~ret~0 := -1; [L1109] ~skip~0 := 0; [L1110] call write~int(0, ~tmp___0~1.base, ~tmp___0~1.offset, 4); [L1111] call #t~mem15.base, #t~mem15.offset := read~$Pointer$(~s.base, 192 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem15.base=1, #t~mem15.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=0, ~cb~0.offset=0, ~init~0=1, ~ret~0=-1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1111-L1119] assume 0 != (#t~mem15.base + #t~mem15.offset) % 4294967296; [L1111] havoc #t~mem15.base, #t~mem15.offset; [L1112] call #t~mem16.base, #t~mem16.offset := read~$Pointer$(~s.base, 192 + ~s.offset, 4); [L1112] ~cb~0.base, ~cb~0.offset := #t~mem16.base, #t~mem16.offset; [L1112] havoc #t~mem16.base, #t~mem16.offset; VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=-1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1120] call #t~mem21 := read~int(~s.base, 28 + ~s.offset, 4); [L1120] call write~int(1 + #t~mem21, ~s.base, 28 + ~s.offset, 4); [L1120] havoc #t~mem21; VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=-1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1121-L1129] assume !(0 != ~bitwiseAnd(~tmp___1~0, 12288)); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=-1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1131-L1635] assume !false; VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=-1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1133] call #t~mem22 := read~int(~s.base, 52 + ~s.offset, 4); [L1133] ~state~0 := #t~mem22; [L1133] havoc #t~mem22; [L1134] call #t~mem23 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem23=12292, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=-1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1134-L1604] assume 12292 == #t~mem23; [L1134] havoc #t~mem23; VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=-1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1237] call write~int(1, ~s.base, 40 + ~s.offset, 4); [L1238] call write~int(4096, ~s.base, 52 + ~s.offset, 4); [L1239] call #t~mem56.base, #t~mem56.offset := read~$Pointer$(~s.base, 204 + ~s.offset, 4); [L1239] call #t~mem57 := read~int(#t~mem56.base, 64 + #t~mem56.offset, 4); [L1239] call write~int(1 + #t~mem57, #t~mem56.base, 64 + #t~mem56.offset, 4); [L1239] havoc #t~mem56.base, #t~mem56.offset; [L1239] havoc #t~mem57; VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=-1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1244] call write~int(0, ~s.base, 36 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=-1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1245-L1249] assume 0 != (~cb~0.base + ~cb~0.offset) % 4294967296; VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=-1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1250] call #t~mem58 := read~int(~s.base, ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem58=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=-1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1250-L1255] assume !(768 != ~bitwiseAnd(#t~mem58, 65280)); [L1250] havoc #t~mem58; [L1256] call write~int(4096, ~s.base, 4 + ~s.offset, 4); [L1257] call #t~mem59.base, #t~mem59.offset := read~$Pointer$(~s.base, 60 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem59.base=-1, #t~mem59.offset=2, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=-1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1257-L1268] assume !(0 == (#t~mem59.base + #t~mem59.offset) % 4294967296); [L1257] havoc #t~mem59.base, #t~mem59.offset; VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=-1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1269] assume -2147483648 <= #t~nondet61 && #t~nondet61 <= 2147483647; [L1269] ~tmp___4~0 := #t~nondet61; [L1269] havoc #t~nondet61; VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=-1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp~2=0] [L1270-L1275] assume !(0 == ~tmp___4~0); [L1276] assume -2147483648 <= #t~nondet62 && #t~nondet62 <= 2147483647; [L1276] ~tmp___5~0 := #t~nondet62; [L1276] havoc #t~nondet62; VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=-1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1277-L1282] assume !(0 == ~tmp___5~0); [L1283] call write~int(4368, ~s.base, 52 + ~s.offset, 4); [L1284] call #t~mem63.base, #t~mem63.offset := read~$Pointer$(~s.base, 204 + ~s.offset, 4); [L1284] call #t~mem64 := read~int(#t~mem63.base, 60 + #t~mem63.offset, 4); [L1284] call write~int(1 + #t~mem64, #t~mem63.base, 60 + #t~mem63.offset, 4); [L1284] havoc #t~mem63.base, #t~mem63.offset; [L1284] havoc #t~mem64; [L1285] call write~int(0, ~s.base, 64 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=-1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1605] call #t~mem128.base, #t~mem128.offset := read~$Pointer$(~s.base, 84 + ~s.offset, 4); [L1605] call #t~mem129 := read~int(#t~mem128.base, 848 + #t~mem128.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem128.base=20506, #t~mem128.offset=0, #t~mem129=20542, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=-1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1605-L1633] assume !(0 == #t~mem129); [L1605] havoc #t~mem128.base, #t~mem128.offset; [L1605] havoc #t~mem129; VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=-1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1634] ~skip~0 := 0; VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=-1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1131-L1635] assume !false; VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=-1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1133] call #t~mem22 := read~int(~s.base, 52 + ~s.offset, 4); [L1133] ~state~0 := #t~mem22; [L1133] havoc #t~mem22; [L1134] call #t~mem23 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem23=4368, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=-1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1134-L1604] assume !(12292 == #t~mem23); [L1134] havoc #t~mem23; [L1137] call #t~mem24 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem24=4368, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=-1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1137-L1603] assume !(16384 == #t~mem24); [L1137] havoc #t~mem24; [L1140] call #t~mem25 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem25=4368, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=-1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1140-L1602] assume !(4096 == #t~mem25); [L1140] havoc #t~mem25; [L1143] call #t~mem26 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem26=4368, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=-1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1143-L1601] assume !(20480 == #t~mem26); [L1143] havoc #t~mem26; [L1146] call #t~mem27 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem27=4368, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=-1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1146-L1600] assume !(4099 == #t~mem27); [L1146] havoc #t~mem27; [L1149] call #t~mem28 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem28=4368, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=-1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1149-L1599] assume 4368 == #t~mem28; [L1149] havoc #t~mem28; VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=-1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1289] call write~int(0, ~s.base, 48 + ~s.offset, 4); [L1290] assume -2147483648 <= #t~nondet65 && #t~nondet65 <= 2147483647; [L1290] ~ret~0 := #t~nondet65; [L1290] havoc #t~nondet65; VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1291-L1295] assume 0 == ~blastFlag~0; [L1292] ~blastFlag~0 := 1; VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=1, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1296-L1300] assume !(~ret~0 <= 0); [L1301] call write~int(4384, ~s.base, 52 + ~s.offset, 4); [L1302] call write~int(0, ~s.base, 64 + ~s.offset, 4); [L1303] call #t~mem66.base, #t~mem66.offset := read~$Pointer$(~s.base, 20 + ~s.offset, 4); [L1303] call #t~mem67.base, #t~mem67.offset := read~$Pointer$(~s.base, 16 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem66.base=0, #t~mem66.offset=1, #t~mem67.base=0, #t~mem67.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=1, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1303-L1307] assume (#t~mem66.base + #t~mem66.offset) % 4294967296 != (#t~mem67.base + #t~mem67.offset) % 4294967296; [L1303] havoc #t~mem66.base, #t~mem66.offset; [L1303] havoc #t~mem67.base, #t~mem67.offset; VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=1, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1605] call #t~mem128.base, #t~mem128.offset := read~$Pointer$(~s.base, 84 + ~s.offset, 4); [L1605] call #t~mem129 := read~int(#t~mem128.base, 848 + #t~mem128.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem128.base=20506, #t~mem128.offset=0, #t~mem129=20542, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=1, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1605-L1633] assume !(0 == #t~mem129); [L1605] havoc #t~mem128.base, #t~mem128.offset; [L1605] havoc #t~mem129; VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=1, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1634] ~skip~0 := 0; VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=1, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1131-L1635] assume !false; VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=1, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1133] call #t~mem22 := read~int(~s.base, 52 + ~s.offset, 4); [L1133] ~state~0 := #t~mem22; [L1133] havoc #t~mem22; [L1134] call #t~mem23 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem23=4384, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=1, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1134-L1604] assume !(12292 == #t~mem23); [L1134] havoc #t~mem23; [L1137] call #t~mem24 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem24=4384, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=1, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1137-L1603] assume !(16384 == #t~mem24); [L1137] havoc #t~mem24; [L1140] call #t~mem25 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem25=4384, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=1, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1140-L1602] assume !(4096 == #t~mem25); [L1140] havoc #t~mem25; [L1143] call #t~mem26 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem26=4384, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=1, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1143-L1601] assume !(20480 == #t~mem26); [L1143] havoc #t~mem26; [L1146] call #t~mem27 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem27=4384, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=1, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1146-L1600] assume !(4099 == #t~mem27); [L1146] havoc #t~mem27; [L1149] call #t~mem28 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem28=4384, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=1, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1149-L1599] assume !(4368 == #t~mem28); [L1149] havoc #t~mem28; [L1152] call #t~mem29 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem29=4384, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=1, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1152-L1598] assume !(4369 == #t~mem29); [L1152] havoc #t~mem29; [L1155] call #t~mem30 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem30=4384, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=1, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1155-L1597] assume 4384 == #t~mem30; [L1155] havoc #t~mem30; VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=1, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1311] assume -2147483648 <= #t~nondet68 && #t~nondet68 <= 2147483647; [L1311] ~ret~0 := #t~nondet68; [L1311] havoc #t~nondet68; VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=1, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1312-L1316] assume 1 == ~blastFlag~0; [L1313] ~blastFlag~0 := 2; VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1317-L1321] assume !(~ret~0 <= 0); [L1322] call #t~mem69 := read~int(~s.base, 92 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem69=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1322-L1326] assume !(0 != #t~mem69); [L1322] havoc #t~mem69; [L1325] call write~int(4400, ~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1327] call write~int(0, ~s.base, 64 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1605] call #t~mem128.base, #t~mem128.offset := read~$Pointer$(~s.base, 84 + ~s.offset, 4); [L1605] call #t~mem129 := read~int(#t~mem128.base, 848 + #t~mem128.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem128.base=20506, #t~mem128.offset=0, #t~mem129=20542, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1605-L1633] assume !(0 == #t~mem129); [L1605] havoc #t~mem128.base, #t~mem128.offset; [L1605] havoc #t~mem129; VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1634] ~skip~0 := 0; VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1131-L1635] assume !false; VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1133] call #t~mem22 := read~int(~s.base, 52 + ~s.offset, 4); [L1133] ~state~0 := #t~mem22; [L1133] havoc #t~mem22; [L1134] call #t~mem23 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem23=4400, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1134-L1604] assume !(12292 == #t~mem23); [L1134] havoc #t~mem23; [L1137] call #t~mem24 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem24=4400, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1137-L1603] assume !(16384 == #t~mem24); [L1137] havoc #t~mem24; [L1140] call #t~mem25 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem25=4400, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1140-L1602] assume !(4096 == #t~mem25); [L1140] havoc #t~mem25; [L1143] call #t~mem26 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem26=4400, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1143-L1601] assume !(20480 == #t~mem26); [L1143] havoc #t~mem26; [L1146] call #t~mem27 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem27=4400, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1146-L1600] assume !(4099 == #t~mem27); [L1146] havoc #t~mem27; [L1149] call #t~mem28 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem28=4400, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1149-L1599] assume !(4368 == #t~mem28); [L1149] havoc #t~mem28; [L1152] call #t~mem29 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem29=4400, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1152-L1598] assume !(4369 == #t~mem29); [L1152] havoc #t~mem29; [L1155] call #t~mem30 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem30=4400, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1155-L1597] assume !(4384 == #t~mem30); [L1155] havoc #t~mem30; [L1158] call #t~mem31 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem31=4400, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1158-L1596] assume !(4385 == #t~mem31); [L1158] havoc #t~mem31; [L1161] call #t~mem32 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem32=4400, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1161-L1595] assume 4400 == #t~mem32; [L1161] havoc #t~mem32; VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1331] call #t~mem70.base, #t~mem70.offset := read~$Pointer$(~s.base, 84 + ~s.offset, 4); [L1331] call #t~mem71.base, #t~mem71.offset := read~$Pointer$(#t~mem70.base, 836 + #t~mem70.offset, 4); [L1331] call #t~mem72 := read~int(#t~mem71.base, 12 + #t~mem71.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem70.base=20506, #t~mem70.offset=0, #t~mem71.base=20502, #t~mem71.offset=0, #t~mem72=20537, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1331-L1345] assume !(0 != ~bitwiseAnd(#t~mem72, 256) % 4294967296); [L1331] havoc #t~mem71.base, #t~mem71.offset; [L1331] havoc #t~mem70.base, #t~mem70.offset; [L1331] havoc #t~mem72; [L1334] assume -2147483648 <= #t~nondet73 && #t~nondet73 <= 2147483647; [L1334] ~ret~0 := #t~nondet73; [L1334] havoc #t~nondet73; VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=5, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1335-L1339] assume 2 == ~blastFlag~0; [L1336] ~blastFlag~0 := 3; VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=5, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1340-L1344] assume !(~ret~0 <= 0); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=5, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1346] call write~int(4416, ~s.base, 52 + ~s.offset, 4); [L1347] call write~int(0, ~s.base, 64 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=5, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1605] call #t~mem128.base, #t~mem128.offset := read~$Pointer$(~s.base, 84 + ~s.offset, 4); [L1605] call #t~mem129 := read~int(#t~mem128.base, 848 + #t~mem128.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem128.base=20506, #t~mem128.offset=0, #t~mem129=20542, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=5, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1605-L1633] assume !(0 == #t~mem129); [L1605] havoc #t~mem128.base, #t~mem128.offset; [L1605] havoc #t~mem129; VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=5, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1634] ~skip~0 := 0; VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=5, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1131-L1635] assume !false; VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=5, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1133] call #t~mem22 := read~int(~s.base, 52 + ~s.offset, 4); [L1133] ~state~0 := #t~mem22; [L1133] havoc #t~mem22; [L1134] call #t~mem23 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem23=4416, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=5, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1134-L1604] assume !(12292 == #t~mem23); [L1134] havoc #t~mem23; [L1137] call #t~mem24 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem24=4416, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=5, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1137-L1603] assume !(16384 == #t~mem24); [L1137] havoc #t~mem24; [L1140] call #t~mem25 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem25=4416, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=5, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1140-L1602] assume !(4096 == #t~mem25); [L1140] havoc #t~mem25; [L1143] call #t~mem26 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem26=4416, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=5, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1143-L1601] assume !(20480 == #t~mem26); [L1143] havoc #t~mem26; [L1146] call #t~mem27 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem27=4416, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=5, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1146-L1600] assume !(4099 == #t~mem27); [L1146] havoc #t~mem27; [L1149] call #t~mem28 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem28=4416, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=5, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1149-L1599] assume !(4368 == #t~mem28); [L1149] havoc #t~mem28; [L1152] call #t~mem29 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem29=4416, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=5, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1152-L1598] assume !(4369 == #t~mem29); [L1152] havoc #t~mem29; [L1155] call #t~mem30 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem30=4416, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=5, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1155-L1597] assume !(4384 == #t~mem30); [L1155] havoc #t~mem30; [L1158] call #t~mem31 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem31=4416, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=5, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1158-L1596] assume !(4385 == #t~mem31); [L1158] havoc #t~mem31; [L1161] call #t~mem32 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem32=4416, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=5, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1161-L1595] assume !(4400 == #t~mem32); [L1161] havoc #t~mem32; [L1164] call #t~mem33 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem33=4416, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=5, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1164-L1594] assume !(4401 == #t~mem33); [L1164] havoc #t~mem33; [L1167] call #t~mem34 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem34=4416, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=5, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1167-L1593] assume 4416 == #t~mem34; [L1167] havoc #t~mem34; VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=5, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1351] assume -2147483648 <= #t~nondet74 && #t~nondet74 <= 2147483647; [L1351] ~ret~0 := #t~nondet74; [L1351] havoc #t~nondet74; VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=6, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1352-L1356] assume 3 == ~blastFlag~0; [L1353] ~blastFlag~0 := 4; VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=6, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1357-L1361] assume !(~ret~0 <= 0); [L1362] call write~int(4432, ~s.base, 52 + ~s.offset, 4); [L1363] call write~int(0, ~s.base, 64 + ~s.offset, 4); [L1364] assume -2147483648 <= #t~nondet75 && #t~nondet75 <= 2147483647; [L1364] ~tmp___6~0 := #t~nondet75; [L1364] havoc #t~nondet75; VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=6, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1365-L1370] assume !(0 == ~tmp___6~0); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=6, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1605] call #t~mem128.base, #t~mem128.offset := read~$Pointer$(~s.base, 84 + ~s.offset, 4); [L1605] call #t~mem129 := read~int(#t~mem128.base, 848 + #t~mem128.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem128.base=20506, #t~mem128.offset=0, #t~mem129=20542, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=6, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1605-L1633] assume !(0 == #t~mem129); [L1605] havoc #t~mem128.base, #t~mem128.offset; [L1605] havoc #t~mem129; VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=6, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1634] ~skip~0 := 0; VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=6, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1131-L1635] assume !false; VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=6, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1133] call #t~mem22 := read~int(~s.base, 52 + ~s.offset, 4); [L1133] ~state~0 := #t~mem22; [L1133] havoc #t~mem22; [L1134] call #t~mem23 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem23=4432, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=6, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1134-L1604] assume !(12292 == #t~mem23); [L1134] havoc #t~mem23; [L1137] call #t~mem24 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem24=4432, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=6, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1137-L1603] assume !(16384 == #t~mem24); [L1137] havoc #t~mem24; [L1140] call #t~mem25 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem25=4432, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=6, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1140-L1602] assume !(4096 == #t~mem25); [L1140] havoc #t~mem25; [L1143] call #t~mem26 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem26=4432, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=6, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1143-L1601] assume !(20480 == #t~mem26); [L1143] havoc #t~mem26; [L1146] call #t~mem27 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem27=4432, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=6, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1146-L1600] assume !(4099 == #t~mem27); [L1146] havoc #t~mem27; [L1149] call #t~mem28 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem28=4432, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=6, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1149-L1599] assume !(4368 == #t~mem28); [L1149] havoc #t~mem28; [L1152] call #t~mem29 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem29=4432, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=6, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1152-L1598] assume !(4369 == #t~mem29); [L1152] havoc #t~mem29; [L1155] call #t~mem30 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem30=4432, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=6, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1155-L1597] assume !(4384 == #t~mem30); [L1155] havoc #t~mem30; [L1158] call #t~mem31 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem31=4432, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=6, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1158-L1596] assume !(4385 == #t~mem31); [L1158] havoc #t~mem31; [L1161] call #t~mem32 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem32=4432, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=6, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1161-L1595] assume !(4400 == #t~mem32); [L1161] havoc #t~mem32; [L1164] call #t~mem33 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem33=4432, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=6, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1164-L1594] assume !(4401 == #t~mem33); [L1164] havoc #t~mem33; [L1167] call #t~mem34 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem34=4432, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=6, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1167-L1593] assume !(4416 == #t~mem34); [L1167] havoc #t~mem34; [L1170] call #t~mem35 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem35=4432, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=6, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1170-L1592] assume !(4417 == #t~mem35); [L1170] havoc #t~mem35; [L1173] call #t~mem36 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem36=4432, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=6, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1173-L1591] assume 4432 == #t~mem36; [L1173] havoc #t~mem36; VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=6, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1374] assume -2147483648 <= #t~nondet76 && #t~nondet76 <= 2147483647; [L1374] ~ret~0 := #t~nondet76; [L1374] havoc #t~nondet76; VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=7, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1375-L1379] assume !(5 == ~blastFlag~0); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=7, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1380-L1384] assume !(~ret~0 <= 0); [L1385] call write~int(4448, ~s.base, 52 + ~s.offset, 4); [L1386] call write~int(0, ~s.base, 64 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=7, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1605] call #t~mem128.base, #t~mem128.offset := read~$Pointer$(~s.base, 84 + ~s.offset, 4); [L1605] call #t~mem129 := read~int(#t~mem128.base, 848 + #t~mem128.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem128.base=20506, #t~mem128.offset=0, #t~mem129=20542, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=7, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1605-L1633] assume !(0 == #t~mem129); [L1605] havoc #t~mem128.base, #t~mem128.offset; [L1605] havoc #t~mem129; VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=7, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1634] ~skip~0 := 0; VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=7, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1131-L1635] assume !false; VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=7, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1133] call #t~mem22 := read~int(~s.base, 52 + ~s.offset, 4); [L1133] ~state~0 := #t~mem22; [L1133] havoc #t~mem22; [L1134] call #t~mem23 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem23=4448, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=7, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1134-L1604] assume !(12292 == #t~mem23); [L1134] havoc #t~mem23; [L1137] call #t~mem24 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem24=4448, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=7, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1137-L1603] assume !(16384 == #t~mem24); [L1137] havoc #t~mem24; [L1140] call #t~mem25 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem25=4448, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=7, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1140-L1602] assume !(4096 == #t~mem25); [L1140] havoc #t~mem25; [L1143] call #t~mem26 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem26=4448, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=7, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1143-L1601] assume !(20480 == #t~mem26); [L1143] havoc #t~mem26; [L1146] call #t~mem27 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem27=4448, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=7, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1146-L1600] assume !(4099 == #t~mem27); [L1146] havoc #t~mem27; [L1149] call #t~mem28 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem28=4448, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=7, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1149-L1599] assume !(4368 == #t~mem28); [L1149] havoc #t~mem28; [L1152] call #t~mem29 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem29=4448, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=7, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1152-L1598] assume !(4369 == #t~mem29); [L1152] havoc #t~mem29; [L1155] call #t~mem30 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem30=4448, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=7, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1155-L1597] assume !(4384 == #t~mem30); [L1155] havoc #t~mem30; [L1158] call #t~mem31 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem31=4448, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=7, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1158-L1596] assume !(4385 == #t~mem31); [L1158] havoc #t~mem31; [L1161] call #t~mem32 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem32=4448, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=7, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1161-L1595] assume !(4400 == #t~mem32); [L1161] havoc #t~mem32; [L1164] call #t~mem33 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem33=4448, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=7, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1164-L1594] assume !(4401 == #t~mem33); [L1164] havoc #t~mem33; [L1167] call #t~mem34 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem34=4448, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=7, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1167-L1593] assume !(4416 == #t~mem34); [L1167] havoc #t~mem34; [L1170] call #t~mem35 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem35=4448, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=7, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1170-L1592] assume !(4417 == #t~mem35); [L1170] havoc #t~mem35; [L1173] call #t~mem36 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem36=4448, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=7, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1173-L1591] assume !(4432 == #t~mem36); [L1173] havoc #t~mem36; [L1176] call #t~mem37 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem37=4448, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=7, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1176-L1590] assume !(4433 == #t~mem37); [L1176] havoc #t~mem37; [L1179] call #t~mem38 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem38=4448, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=7, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1179-L1589] assume 4448 == #t~mem38; [L1179] havoc #t~mem38; VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=7, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1390] assume -2147483648 <= #t~nondet77 && #t~nondet77 <= 2147483647; [L1390] ~ret~0 := #t~nondet77; [L1390] havoc #t~nondet77; VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=0, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1391-L1395] assume 4 == ~blastFlag~0; VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=0, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1646] assert false; VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=0, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] ----- ----- class de.uni_freiburg.informatik.ultimate.boogie.preprocessor.BoogiePreprocessorBacktranslator [?] CALL call ULTIMATE.init(); VAL [#NULL.base=20507, #NULL.offset=20535, old(#NULL.base)=20507, old(#NULL.offset)=20535, old(~#SSLv3_client_data~0.base)=20492, old(~#SSLv3_client_data~0.offset)=20488, old(~init~0)=20541, ~#SSLv3_client_data~0.base=20492, ~#SSLv3_client_data~0.offset=20488, ~init~0=20541] [?] #NULL.base, #NULL.offset := 0, 0; [?] #valid := #valid[0 := 0]; [L1042] ~init~0 := 1; [L1043] call ~#SSLv3_client_data~0.base, ~#SSLv3_client_data~0.offset := #Ultimate.alloc(100); [L1043] call write~init~int(0, ~#SSLv3_client_data~0.base, ~#SSLv3_client_data~0.offset, 4); [L1043] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 4 + ~#SSLv3_client_data~0.offset, 4); [L1043] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 8 + ~#SSLv3_client_data~0.offset, 4); [L1043] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 12 + ~#SSLv3_client_data~0.offset, 4); [L1043] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 16 + ~#SSLv3_client_data~0.offset, 4); [L1043] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 20 + ~#SSLv3_client_data~0.offset, 4); [L1043] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 24 + ~#SSLv3_client_data~0.offset, 4); [L1043] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 28 + ~#SSLv3_client_data~0.offset, 4); [L1043] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 32 + ~#SSLv3_client_data~0.offset, 4); [L1043] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 36 + ~#SSLv3_client_data~0.offset, 4); [L1043] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 40 + ~#SSLv3_client_data~0.offset, 4); [L1043] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 44 + ~#SSLv3_client_data~0.offset, 4); [L1043] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 48 + ~#SSLv3_client_data~0.offset, 4); [L1043] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 52 + ~#SSLv3_client_data~0.offset, 4); [L1043] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 56 + ~#SSLv3_client_data~0.offset, 4); [L1043] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 60 + ~#SSLv3_client_data~0.offset, 4); [L1043] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 64 + ~#SSLv3_client_data~0.offset, 4); [L1043] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 68 + ~#SSLv3_client_data~0.offset, 4); [L1043] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 72 + ~#SSLv3_client_data~0.offset, 4); [L1043] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 76 + ~#SSLv3_client_data~0.offset, 4); [L1043] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 80 + ~#SSLv3_client_data~0.offset, 4); [L1043] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 84 + ~#SSLv3_client_data~0.offset, 4); [L1043] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 88 + ~#SSLv3_client_data~0.offset, 4); [L1043] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 92 + ~#SSLv3_client_data~0.offset, 4); [L1043] call write~init~$Pointer$(0, 0, ~#SSLv3_client_data~0.base, 96 + ~#SSLv3_client_data~0.offset, 4); VAL [#NULL.base=0, #NULL.offset=0, old(#NULL.base)=20507, old(#NULL.offset)=20535, old(~#SSLv3_client_data~0.base)=20492, old(~#SSLv3_client_data~0.offset)=20488, old(~init~0)=20541, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~init~0=1] [?] ensures true; VAL [#NULL.base=0, #NULL.offset=0, old(#NULL.base)=20507, old(#NULL.offset)=20535, old(~#SSLv3_client_data~0.base)=20492, old(~#SSLv3_client_data~0.offset)=20488, old(~init~0)=20541, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~init~0=1] [?] RET call ULTIMATE.init(); VAL [#NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~init~0=1] [?] CALL call #t~ret139 := main(); VAL [#NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~init~0=1] [L1065] call #t~malloc3.base, #t~malloc3.offset := #Ultimate.alloc(248); [L1065] ~s~0.base, ~s~0.offset := #t~malloc3.base, #t~malloc3.offset; [L1069] call #t~malloc4.base, #t~malloc4.offset := #Ultimate.alloc(899); [L1069] call write~$Pointer$(#t~malloc4.base, #t~malloc4.offset, ~s~0.base, 84 + ~s~0.offset, 4); [L1070] call #t~malloc5.base, #t~malloc5.offset := #Ultimate.alloc(232); [L1070] call write~$Pointer$(#t~malloc5.base, #t~malloc5.offset, ~s~0.base, 204 + ~s~0.offset, 4); [L1071] call #t~malloc6.base, #t~malloc6.offset := #Ultimate.alloc(200); [L1071] call write~$Pointer$(#t~malloc6.base, #t~malloc6.offset, ~s~0.base, 176 + ~s~0.offset, 4); [L1072] call write~int(12292, ~s~0.base, 52 + ~s~0.offset, 4); [L1073] assume -2147483648 <= #t~nondet7 && #t~nondet7 <= 2147483647; [L1073] call write~int(#t~nondet7, ~s~0.base, ~s~0.offset, 4); [L1073] havoc #t~nondet7; VAL [#NULL.base=0, #NULL.offset=0, #t~malloc3.base=20501, #t~malloc3.offset=0, #t~malloc4.base=20506, #t~malloc4.offset=0, #t~malloc5.base=20521, #t~malloc5.offset=0, #t~malloc6.base=20484, #t~malloc6.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~init~0=1, ~s~0.base=20501, ~s~0.offset=0] [L1074] CALL call #t~ret8 := ssl3_connect(~s~0.base, ~s~0.offset); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~init~0=1] [L1079-L1648] ~s.base, ~s.offset := #in~s.base, #in~s.offset; [L1080] ~buf~0.base, ~buf~0.offset := #t~nondet9.base, #t~nondet9.offset; [L1080] havoc #t~nondet9.base, #t~nondet9.offset; [L1081] havoc ~tmp~2; [L1082] havoc ~l~0; [L1083] havoc ~num1~0; [L1084] havoc ~cb~0.base, ~cb~0.offset; [L1085] havoc ~ret~0; [L1086] havoc ~new_state~0; [L1087] havoc ~state~0; [L1088] havoc ~skip~0; [L1089] ~tmp___0~1.base, ~tmp___0~1.offset := #t~nondet10.base, #t~nondet10.offset; [L1089] havoc #t~nondet10.base, #t~nondet10.offset; [L1090] assume -2147483648 <= #t~nondet11 && #t~nondet11 <= 2147483647; [L1090] ~tmp___1~0 := #t~nondet11; [L1090] havoc #t~nondet11; [L1091] assume -2147483648 <= #t~nondet12 && #t~nondet12 <= 2147483647; [L1091] ~tmp___2~0 := #t~nondet12; [L1091] havoc #t~nondet12; [L1092] havoc ~tmp___3~0; [L1093] havoc ~tmp___4~0; [L1094] havoc ~tmp___5~0; [L1095] havoc ~tmp___6~0; [L1096] havoc ~tmp___7~0; [L1097] havoc ~tmp___8~0; [L1098] havoc ~tmp___9~0; [L1100] havoc ~blastFlag~0; [L1103] ~blastFlag~0 := 0; [L1104] assume -2147483648 <= #t~nondet13 && #t~nondet13 <= 2147483647; [L1104] call write~int(#t~nondet13, ~s.base, 92 + ~s.offset, 4); [L1104] havoc #t~nondet13; [L1105] call write~int(12292, ~s.base, 52 + ~s.offset, 4); [L1106] assume -2147483648 <= #t~nondet14 && #t~nondet14 <= 2147483647; [L1106] ~tmp~2 := #t~nondet14; [L1106] havoc #t~nondet14; [L1107] ~cb~0.base, ~cb~0.offset := 0, 0; [L1108] ~ret~0 := -1; [L1109] ~skip~0 := 0; [L1110] call write~int(0, ~tmp___0~1.base, ~tmp___0~1.offset, 4); [L1111] call #t~mem15.base, #t~mem15.offset := read~$Pointer$(~s.base, 192 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem15.base=1, #t~mem15.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=0, ~cb~0.offset=0, ~init~0=1, ~ret~0=-1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1111-L1119] assume 0 != (#t~mem15.base + #t~mem15.offset) % 4294967296; [L1111] havoc #t~mem15.base, #t~mem15.offset; [L1112] call #t~mem16.base, #t~mem16.offset := read~$Pointer$(~s.base, 192 + ~s.offset, 4); [L1112] ~cb~0.base, ~cb~0.offset := #t~mem16.base, #t~mem16.offset; [L1112] havoc #t~mem16.base, #t~mem16.offset; VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=-1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1120] call #t~mem21 := read~int(~s.base, 28 + ~s.offset, 4); [L1120] call write~int(1 + #t~mem21, ~s.base, 28 + ~s.offset, 4); [L1120] havoc #t~mem21; VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=-1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1121-L1129] assume !(0 != ~bitwiseAnd(~tmp___1~0, 12288)); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=-1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1131-L1635] assume !false; VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=-1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1133] call #t~mem22 := read~int(~s.base, 52 + ~s.offset, 4); [L1133] ~state~0 := #t~mem22; [L1133] havoc #t~mem22; [L1134] call #t~mem23 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem23=12292, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=-1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1134-L1604] assume 12292 == #t~mem23; [L1134] havoc #t~mem23; VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=-1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1237] call write~int(1, ~s.base, 40 + ~s.offset, 4); [L1238] call write~int(4096, ~s.base, 52 + ~s.offset, 4); [L1239] call #t~mem56.base, #t~mem56.offset := read~$Pointer$(~s.base, 204 + ~s.offset, 4); [L1239] call #t~mem57 := read~int(#t~mem56.base, 64 + #t~mem56.offset, 4); [L1239] call write~int(1 + #t~mem57, #t~mem56.base, 64 + #t~mem56.offset, 4); [L1239] havoc #t~mem56.base, #t~mem56.offset; [L1239] havoc #t~mem57; VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=-1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1244] call write~int(0, ~s.base, 36 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=-1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1245-L1249] assume 0 != (~cb~0.base + ~cb~0.offset) % 4294967296; VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=-1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1250] call #t~mem58 := read~int(~s.base, ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem58=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=-1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1250-L1255] assume !(768 != ~bitwiseAnd(#t~mem58, 65280)); [L1250] havoc #t~mem58; [L1256] call write~int(4096, ~s.base, 4 + ~s.offset, 4); [L1257] call #t~mem59.base, #t~mem59.offset := read~$Pointer$(~s.base, 60 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem59.base=-1, #t~mem59.offset=2, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=-1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1257-L1268] assume !(0 == (#t~mem59.base + #t~mem59.offset) % 4294967296); [L1257] havoc #t~mem59.base, #t~mem59.offset; VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=-1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1269] assume -2147483648 <= #t~nondet61 && #t~nondet61 <= 2147483647; [L1269] ~tmp___4~0 := #t~nondet61; [L1269] havoc #t~nondet61; VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=-1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp~2=0] [L1270-L1275] assume !(0 == ~tmp___4~0); [L1276] assume -2147483648 <= #t~nondet62 && #t~nondet62 <= 2147483647; [L1276] ~tmp___5~0 := #t~nondet62; [L1276] havoc #t~nondet62; VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=-1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1277-L1282] assume !(0 == ~tmp___5~0); [L1283] call write~int(4368, ~s.base, 52 + ~s.offset, 4); [L1284] call #t~mem63.base, #t~mem63.offset := read~$Pointer$(~s.base, 204 + ~s.offset, 4); [L1284] call #t~mem64 := read~int(#t~mem63.base, 60 + #t~mem63.offset, 4); [L1284] call write~int(1 + #t~mem64, #t~mem63.base, 60 + #t~mem63.offset, 4); [L1284] havoc #t~mem63.base, #t~mem63.offset; [L1284] havoc #t~mem64; [L1285] call write~int(0, ~s.base, 64 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=-1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1605] call #t~mem128.base, #t~mem128.offset := read~$Pointer$(~s.base, 84 + ~s.offset, 4); [L1605] call #t~mem129 := read~int(#t~mem128.base, 848 + #t~mem128.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem128.base=20506, #t~mem128.offset=0, #t~mem129=20542, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=-1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1605-L1633] assume !(0 == #t~mem129); [L1605] havoc #t~mem128.base, #t~mem128.offset; [L1605] havoc #t~mem129; VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=-1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1634] ~skip~0 := 0; VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=-1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1131-L1635] assume !false; VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=-1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1133] call #t~mem22 := read~int(~s.base, 52 + ~s.offset, 4); [L1133] ~state~0 := #t~mem22; [L1133] havoc #t~mem22; [L1134] call #t~mem23 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem23=4368, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=-1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1134-L1604] assume !(12292 == #t~mem23); [L1134] havoc #t~mem23; [L1137] call #t~mem24 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem24=4368, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=-1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1137-L1603] assume !(16384 == #t~mem24); [L1137] havoc #t~mem24; [L1140] call #t~mem25 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem25=4368, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=-1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1140-L1602] assume !(4096 == #t~mem25); [L1140] havoc #t~mem25; [L1143] call #t~mem26 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem26=4368, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=-1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1143-L1601] assume !(20480 == #t~mem26); [L1143] havoc #t~mem26; [L1146] call #t~mem27 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem27=4368, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=-1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1146-L1600] assume !(4099 == #t~mem27); [L1146] havoc #t~mem27; [L1149] call #t~mem28 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem28=4368, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=-1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1149-L1599] assume 4368 == #t~mem28; [L1149] havoc #t~mem28; VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=-1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1289] call write~int(0, ~s.base, 48 + ~s.offset, 4); [L1290] assume -2147483648 <= #t~nondet65 && #t~nondet65 <= 2147483647; [L1290] ~ret~0 := #t~nondet65; [L1290] havoc #t~nondet65; VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=0, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1291-L1295] assume 0 == ~blastFlag~0; [L1292] ~blastFlag~0 := 1; VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=1, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1296-L1300] assume !(~ret~0 <= 0); [L1301] call write~int(4384, ~s.base, 52 + ~s.offset, 4); [L1302] call write~int(0, ~s.base, 64 + ~s.offset, 4); [L1303] call #t~mem66.base, #t~mem66.offset := read~$Pointer$(~s.base, 20 + ~s.offset, 4); [L1303] call #t~mem67.base, #t~mem67.offset := read~$Pointer$(~s.base, 16 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem66.base=0, #t~mem66.offset=1, #t~mem67.base=0, #t~mem67.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=1, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1303-L1307] assume (#t~mem66.base + #t~mem66.offset) % 4294967296 != (#t~mem67.base + #t~mem67.offset) % 4294967296; [L1303] havoc #t~mem66.base, #t~mem66.offset; [L1303] havoc #t~mem67.base, #t~mem67.offset; VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=1, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1605] call #t~mem128.base, #t~mem128.offset := read~$Pointer$(~s.base, 84 + ~s.offset, 4); [L1605] call #t~mem129 := read~int(#t~mem128.base, 848 + #t~mem128.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem128.base=20506, #t~mem128.offset=0, #t~mem129=20542, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=1, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1605-L1633] assume !(0 == #t~mem129); [L1605] havoc #t~mem128.base, #t~mem128.offset; [L1605] havoc #t~mem129; VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=1, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1634] ~skip~0 := 0; VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=1, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1131-L1635] assume !false; VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=1, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1133] call #t~mem22 := read~int(~s.base, 52 + ~s.offset, 4); [L1133] ~state~0 := #t~mem22; [L1133] havoc #t~mem22; [L1134] call #t~mem23 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem23=4384, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=1, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1134-L1604] assume !(12292 == #t~mem23); [L1134] havoc #t~mem23; [L1137] call #t~mem24 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem24=4384, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=1, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1137-L1603] assume !(16384 == #t~mem24); [L1137] havoc #t~mem24; [L1140] call #t~mem25 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem25=4384, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=1, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1140-L1602] assume !(4096 == #t~mem25); [L1140] havoc #t~mem25; [L1143] call #t~mem26 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem26=4384, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=1, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1143-L1601] assume !(20480 == #t~mem26); [L1143] havoc #t~mem26; [L1146] call #t~mem27 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem27=4384, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=1, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1146-L1600] assume !(4099 == #t~mem27); [L1146] havoc #t~mem27; [L1149] call #t~mem28 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem28=4384, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=1, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1149-L1599] assume !(4368 == #t~mem28); [L1149] havoc #t~mem28; [L1152] call #t~mem29 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem29=4384, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=1, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1152-L1598] assume !(4369 == #t~mem29); [L1152] havoc #t~mem29; [L1155] call #t~mem30 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem30=4384, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=1, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1155-L1597] assume 4384 == #t~mem30; [L1155] havoc #t~mem30; VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=1, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1311] assume -2147483648 <= #t~nondet68 && #t~nondet68 <= 2147483647; [L1311] ~ret~0 := #t~nondet68; [L1311] havoc #t~nondet68; VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=1, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1312-L1316] assume 1 == ~blastFlag~0; [L1313] ~blastFlag~0 := 2; VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1317-L1321] assume !(~ret~0 <= 0); [L1322] call #t~mem69 := read~int(~s.base, 92 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem69=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1322-L1326] assume !(0 != #t~mem69); [L1322] havoc #t~mem69; [L1325] call write~int(4400, ~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1327] call write~int(0, ~s.base, 64 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1605] call #t~mem128.base, #t~mem128.offset := read~$Pointer$(~s.base, 84 + ~s.offset, 4); [L1605] call #t~mem129 := read~int(#t~mem128.base, 848 + #t~mem128.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem128.base=20506, #t~mem128.offset=0, #t~mem129=20542, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1605-L1633] assume !(0 == #t~mem129); [L1605] havoc #t~mem128.base, #t~mem128.offset; [L1605] havoc #t~mem129; VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1634] ~skip~0 := 0; VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1131-L1635] assume !false; VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1133] call #t~mem22 := read~int(~s.base, 52 + ~s.offset, 4); [L1133] ~state~0 := #t~mem22; [L1133] havoc #t~mem22; [L1134] call #t~mem23 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem23=4400, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1134-L1604] assume !(12292 == #t~mem23); [L1134] havoc #t~mem23; [L1137] call #t~mem24 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem24=4400, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1137-L1603] assume !(16384 == #t~mem24); [L1137] havoc #t~mem24; [L1140] call #t~mem25 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem25=4400, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1140-L1602] assume !(4096 == #t~mem25); [L1140] havoc #t~mem25; [L1143] call #t~mem26 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem26=4400, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1143-L1601] assume !(20480 == #t~mem26); [L1143] havoc #t~mem26; [L1146] call #t~mem27 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem27=4400, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1146-L1600] assume !(4099 == #t~mem27); [L1146] havoc #t~mem27; [L1149] call #t~mem28 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem28=4400, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1149-L1599] assume !(4368 == #t~mem28); [L1149] havoc #t~mem28; [L1152] call #t~mem29 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem29=4400, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1152-L1598] assume !(4369 == #t~mem29); [L1152] havoc #t~mem29; [L1155] call #t~mem30 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem30=4400, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1155-L1597] assume !(4384 == #t~mem30); [L1155] havoc #t~mem30; [L1158] call #t~mem31 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem31=4400, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1158-L1596] assume !(4385 == #t~mem31); [L1158] havoc #t~mem31; [L1161] call #t~mem32 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem32=4400, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1161-L1595] assume 4400 == #t~mem32; [L1161] havoc #t~mem32; VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1331] call #t~mem70.base, #t~mem70.offset := read~$Pointer$(~s.base, 84 + ~s.offset, 4); [L1331] call #t~mem71.base, #t~mem71.offset := read~$Pointer$(#t~mem70.base, 836 + #t~mem70.offset, 4); [L1331] call #t~mem72 := read~int(#t~mem71.base, 12 + #t~mem71.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem70.base=20506, #t~mem70.offset=0, #t~mem71.base=20502, #t~mem71.offset=0, #t~mem72=20537, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=1, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1331-L1345] assume !(0 != ~bitwiseAnd(#t~mem72, 256) % 4294967296); [L1331] havoc #t~mem71.base, #t~mem71.offset; [L1331] havoc #t~mem70.base, #t~mem70.offset; [L1331] havoc #t~mem72; [L1334] assume -2147483648 <= #t~nondet73 && #t~nondet73 <= 2147483647; [L1334] ~ret~0 := #t~nondet73; [L1334] havoc #t~nondet73; VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=2, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=5, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1335-L1339] assume 2 == ~blastFlag~0; [L1336] ~blastFlag~0 := 3; VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=5, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1340-L1344] assume !(~ret~0 <= 0); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=5, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1346] call write~int(4416, ~s.base, 52 + ~s.offset, 4); [L1347] call write~int(0, ~s.base, 64 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=5, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1605] call #t~mem128.base, #t~mem128.offset := read~$Pointer$(~s.base, 84 + ~s.offset, 4); [L1605] call #t~mem129 := read~int(#t~mem128.base, 848 + #t~mem128.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem128.base=20506, #t~mem128.offset=0, #t~mem129=20542, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=5, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1605-L1633] assume !(0 == #t~mem129); [L1605] havoc #t~mem128.base, #t~mem128.offset; [L1605] havoc #t~mem129; VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=5, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1634] ~skip~0 := 0; VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=5, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1131-L1635] assume !false; VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=5, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1133] call #t~mem22 := read~int(~s.base, 52 + ~s.offset, 4); [L1133] ~state~0 := #t~mem22; [L1133] havoc #t~mem22; [L1134] call #t~mem23 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem23=4416, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=5, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1134-L1604] assume !(12292 == #t~mem23); [L1134] havoc #t~mem23; [L1137] call #t~mem24 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem24=4416, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=5, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1137-L1603] assume !(16384 == #t~mem24); [L1137] havoc #t~mem24; [L1140] call #t~mem25 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem25=4416, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=5, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1140-L1602] assume !(4096 == #t~mem25); [L1140] havoc #t~mem25; [L1143] call #t~mem26 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem26=4416, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=5, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1143-L1601] assume !(20480 == #t~mem26); [L1143] havoc #t~mem26; [L1146] call #t~mem27 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem27=4416, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=5, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1146-L1600] assume !(4099 == #t~mem27); [L1146] havoc #t~mem27; [L1149] call #t~mem28 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem28=4416, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=5, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1149-L1599] assume !(4368 == #t~mem28); [L1149] havoc #t~mem28; [L1152] call #t~mem29 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem29=4416, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=5, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1152-L1598] assume !(4369 == #t~mem29); [L1152] havoc #t~mem29; [L1155] call #t~mem30 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem30=4416, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=5, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1155-L1597] assume !(4384 == #t~mem30); [L1155] havoc #t~mem30; [L1158] call #t~mem31 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem31=4416, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=5, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1158-L1596] assume !(4385 == #t~mem31); [L1158] havoc #t~mem31; [L1161] call #t~mem32 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem32=4416, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=5, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1161-L1595] assume !(4400 == #t~mem32); [L1161] havoc #t~mem32; [L1164] call #t~mem33 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem33=4416, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=5, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1164-L1594] assume !(4401 == #t~mem33); [L1164] havoc #t~mem33; [L1167] call #t~mem34 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem34=4416, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=5, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1167-L1593] assume 4416 == #t~mem34; [L1167] havoc #t~mem34; VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=5, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1351] assume -2147483648 <= #t~nondet74 && #t~nondet74 <= 2147483647; [L1351] ~ret~0 := #t~nondet74; [L1351] havoc #t~nondet74; VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=3, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=6, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1352-L1356] assume 3 == ~blastFlag~0; [L1353] ~blastFlag~0 := 4; VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=6, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1357-L1361] assume !(~ret~0 <= 0); [L1362] call write~int(4432, ~s.base, 52 + ~s.offset, 4); [L1363] call write~int(0, ~s.base, 64 + ~s.offset, 4); [L1364] assume -2147483648 <= #t~nondet75 && #t~nondet75 <= 2147483647; [L1364] ~tmp___6~0 := #t~nondet75; [L1364] havoc #t~nondet75; VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=6, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1365-L1370] assume !(0 == ~tmp___6~0); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=6, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1605] call #t~mem128.base, #t~mem128.offset := read~$Pointer$(~s.base, 84 + ~s.offset, 4); [L1605] call #t~mem129 := read~int(#t~mem128.base, 848 + #t~mem128.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem128.base=20506, #t~mem128.offset=0, #t~mem129=20542, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=6, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1605-L1633] assume !(0 == #t~mem129); [L1605] havoc #t~mem128.base, #t~mem128.offset; [L1605] havoc #t~mem129; VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=6, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1634] ~skip~0 := 0; VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=6, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1131-L1635] assume !false; VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=6, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1133] call #t~mem22 := read~int(~s.base, 52 + ~s.offset, 4); [L1133] ~state~0 := #t~mem22; [L1133] havoc #t~mem22; [L1134] call #t~mem23 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem23=4432, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=6, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1134-L1604] assume !(12292 == #t~mem23); [L1134] havoc #t~mem23; [L1137] call #t~mem24 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem24=4432, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=6, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1137-L1603] assume !(16384 == #t~mem24); [L1137] havoc #t~mem24; [L1140] call #t~mem25 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem25=4432, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=6, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1140-L1602] assume !(4096 == #t~mem25); [L1140] havoc #t~mem25; [L1143] call #t~mem26 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem26=4432, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=6, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1143-L1601] assume !(20480 == #t~mem26); [L1143] havoc #t~mem26; [L1146] call #t~mem27 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem27=4432, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=6, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1146-L1600] assume !(4099 == #t~mem27); [L1146] havoc #t~mem27; [L1149] call #t~mem28 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem28=4432, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=6, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1149-L1599] assume !(4368 == #t~mem28); [L1149] havoc #t~mem28; [L1152] call #t~mem29 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem29=4432, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=6, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1152-L1598] assume !(4369 == #t~mem29); [L1152] havoc #t~mem29; [L1155] call #t~mem30 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem30=4432, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=6, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1155-L1597] assume !(4384 == #t~mem30); [L1155] havoc #t~mem30; [L1158] call #t~mem31 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem31=4432, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=6, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1158-L1596] assume !(4385 == #t~mem31); [L1158] havoc #t~mem31; [L1161] call #t~mem32 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem32=4432, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=6, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1161-L1595] assume !(4400 == #t~mem32); [L1161] havoc #t~mem32; [L1164] call #t~mem33 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem33=4432, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=6, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1164-L1594] assume !(4401 == #t~mem33); [L1164] havoc #t~mem33; [L1167] call #t~mem34 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem34=4432, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=6, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1167-L1593] assume !(4416 == #t~mem34); [L1167] havoc #t~mem34; [L1170] call #t~mem35 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem35=4432, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=6, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1170-L1592] assume !(4417 == #t~mem35); [L1170] havoc #t~mem35; [L1173] call #t~mem36 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem36=4432, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=6, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1173-L1591] assume 4432 == #t~mem36; [L1173] havoc #t~mem36; VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=6, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1374] assume -2147483648 <= #t~nondet76 && #t~nondet76 <= 2147483647; [L1374] ~ret~0 := #t~nondet76; [L1374] havoc #t~nondet76; VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=7, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1375-L1379] assume !(5 == ~blastFlag~0); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=7, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1380-L1384] assume !(~ret~0 <= 0); [L1385] call write~int(4448, ~s.base, 52 + ~s.offset, 4); [L1386] call write~int(0, ~s.base, 64 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=7, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1605] call #t~mem128.base, #t~mem128.offset := read~$Pointer$(~s.base, 84 + ~s.offset, 4); [L1605] call #t~mem129 := read~int(#t~mem128.base, 848 + #t~mem128.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem128.base=20506, #t~mem128.offset=0, #t~mem129=20542, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=7, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1605-L1633] assume !(0 == #t~mem129); [L1605] havoc #t~mem128.base, #t~mem128.offset; [L1605] havoc #t~mem129; VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=7, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1634] ~skip~0 := 0; VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=7, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1131-L1635] assume !false; VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=7, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1133] call #t~mem22 := read~int(~s.base, 52 + ~s.offset, 4); [L1133] ~state~0 := #t~mem22; [L1133] havoc #t~mem22; [L1134] call #t~mem23 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem23=4448, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=7, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1134-L1604] assume !(12292 == #t~mem23); [L1134] havoc #t~mem23; [L1137] call #t~mem24 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem24=4448, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=7, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1137-L1603] assume !(16384 == #t~mem24); [L1137] havoc #t~mem24; [L1140] call #t~mem25 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem25=4448, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=7, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1140-L1602] assume !(4096 == #t~mem25); [L1140] havoc #t~mem25; [L1143] call #t~mem26 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem26=4448, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=7, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1143-L1601] assume !(20480 == #t~mem26); [L1143] havoc #t~mem26; [L1146] call #t~mem27 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem27=4448, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=7, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1146-L1600] assume !(4099 == #t~mem27); [L1146] havoc #t~mem27; [L1149] call #t~mem28 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem28=4448, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=7, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1149-L1599] assume !(4368 == #t~mem28); [L1149] havoc #t~mem28; [L1152] call #t~mem29 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem29=4448, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=7, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1152-L1598] assume !(4369 == #t~mem29); [L1152] havoc #t~mem29; [L1155] call #t~mem30 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem30=4448, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=7, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1155-L1597] assume !(4384 == #t~mem30); [L1155] havoc #t~mem30; [L1158] call #t~mem31 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem31=4448, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=7, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1158-L1596] assume !(4385 == #t~mem31); [L1158] havoc #t~mem31; [L1161] call #t~mem32 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem32=4448, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=7, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1161-L1595] assume !(4400 == #t~mem32); [L1161] havoc #t~mem32; [L1164] call #t~mem33 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem33=4448, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=7, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1164-L1594] assume !(4401 == #t~mem33); [L1164] havoc #t~mem33; [L1167] call #t~mem34 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem34=4448, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=7, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1167-L1593] assume !(4416 == #t~mem34); [L1167] havoc #t~mem34; [L1170] call #t~mem35 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem35=4448, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=7, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1170-L1592] assume !(4417 == #t~mem35); [L1170] havoc #t~mem35; [L1173] call #t~mem36 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem36=4448, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=7, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1173-L1591] assume !(4432 == #t~mem36); [L1173] havoc #t~mem36; [L1176] call #t~mem37 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem37=4448, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=7, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1176-L1590] assume !(4433 == #t~mem37); [L1176] havoc #t~mem37; [L1179] call #t~mem38 := read~int(~s.base, 52 + ~s.offset, 4); VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem38=4448, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=7, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1179-L1589] assume 4448 == #t~mem38; [L1179] havoc #t~mem38; VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=7, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1390] assume -2147483648 <= #t~nondet77 && #t~nondet77 <= 2147483647; [L1390] ~ret~0 := #t~nondet77; [L1390] havoc #t~nondet77; VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=0, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1391-L1395] assume 4 == ~blastFlag~0; VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=0, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1646] assert false; VAL [#in~s.base=20501, #in~s.offset=0, #NULL.base=0, #NULL.offset=0, ~#SSLv3_client_data~0.base=20494, ~#SSLv3_client_data~0.offset=0, ~blastFlag~0=4, ~buf~0.base=20511, ~buf~0.offset=20517, ~cb~0.base=1, ~cb~0.offset=0, ~init~0=1, ~ret~0=0, ~s.base=20501, ~s.offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1.base=20501, ~tmp___0~1.offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [?] CALL call ULTIMATE.init(); VAL [#NULL!base=20507, #NULL!offset=20535, old(#NULL!base)=20507, old(#NULL!offset)=20535, old(~#SSLv3_client_data~0!base)=20492, old(~#SSLv3_client_data~0!offset)=20488, old(~init~0)=20541, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=20488, ~init~0=20541] [?] #NULL := { base: 0, offset: 0 }; [?] #valid[0] := 0; [L1042] ~init~0 := 1; [L1043] FCALL call ~#SSLv3_client_data~0 := #Ultimate.alloc(100); [L1043] FCALL call write~init~int(0, { base: ~#SSLv3_client_data~0!base, offset: ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 4 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 8 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 12 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 16 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 20 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 24 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 28 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 32 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 36 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 40 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 44 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 48 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 52 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 56 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 60 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 64 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 68 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 72 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 76 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 80 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 84 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 88 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 92 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 96 + ~#SSLv3_client_data~0!offset }, 4); VAL [#NULL!base=0, #NULL!offset=0, old(#NULL!base)=20507, old(#NULL!offset)=20535, old(~#SSLv3_client_data~0!base)=20492, old(~#SSLv3_client_data~0!offset)=20488, old(~init~0)=20541, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~init~0=1] [?] RET call ULTIMATE.init(); VAL [#NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~init~0=1] [?] CALL call #t~ret139 := main(); VAL [#NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~init~0=1] [L1065] FCALL call #t~malloc3 := #Ultimate.alloc(248); [L1065] ~s~0 := #t~malloc3; [L1069] FCALL call #t~malloc4 := #Ultimate.alloc(899); [L1069] FCALL call write~$Pointer$(#t~malloc4, { base: ~s~0!base, offset: 84 + ~s~0!offset }, 4); [L1070] FCALL call #t~malloc5 := #Ultimate.alloc(232); [L1070] FCALL call write~$Pointer$(#t~malloc5, { base: ~s~0!base, offset: 204 + ~s~0!offset }, 4); [L1071] FCALL call #t~malloc6 := #Ultimate.alloc(200); [L1071] FCALL call write~$Pointer$(#t~malloc6, { base: ~s~0!base, offset: 176 + ~s~0!offset }, 4); [L1072] FCALL call write~int(12292, { base: ~s~0!base, offset: 52 + ~s~0!offset }, 4); [L1073] assume -2147483648 <= #t~nondet7 && #t~nondet7 <= 2147483647; [L1073] FCALL call write~int(#t~nondet7, { base: ~s~0!base, offset: ~s~0!offset }, 4); [L1073] havoc #t~nondet7; VAL [#NULL!base=0, #NULL!offset=0, #t~malloc3!base=20501, #t~malloc3!offset=0, #t~malloc4!base=20506, #t~malloc4!offset=0, #t~malloc5!base=20521, #t~malloc5!offset=0, #t~malloc6!base=20484, #t~malloc6!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~init~0=1, ~s~0!base=20501, ~s~0!offset=0] [L1074] CALL call #t~ret8 := ssl3_connect(~s~0); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~init~0=1] [L1079-L1648] ~s := #in~s; [L1080] ~buf~0 := #t~nondet9; [L1080] havoc #t~nondet9; [L1081] havoc ~tmp~2; [L1082] havoc ~l~0; [L1083] havoc ~num1~0; [L1084] havoc ~cb~0; [L1085] havoc ~ret~0; [L1086] havoc ~new_state~0; [L1087] havoc ~state~0; [L1088] havoc ~skip~0; [L1089] ~tmp___0~1 := #t~nondet10; [L1089] havoc #t~nondet10; [L1090] assume -2147483648 <= #t~nondet11 && #t~nondet11 <= 2147483647; [L1090] ~tmp___1~0 := #t~nondet11; [L1090] havoc #t~nondet11; [L1091] assume -2147483648 <= #t~nondet12 && #t~nondet12 <= 2147483647; [L1091] ~tmp___2~0 := #t~nondet12; [L1091] havoc #t~nondet12; [L1092] havoc ~tmp___3~0; [L1093] havoc ~tmp___4~0; [L1094] havoc ~tmp___5~0; [L1095] havoc ~tmp___6~0; [L1096] havoc ~tmp___7~0; [L1097] havoc ~tmp___8~0; [L1098] havoc ~tmp___9~0; [L1100] havoc ~blastFlag~0; [L1103] ~blastFlag~0 := 0; [L1104] assume -2147483648 <= #t~nondet13 && #t~nondet13 <= 2147483647; [L1104] FCALL call write~int(#t~nondet13, { base: ~s!base, offset: 92 + ~s!offset }, 4); [L1104] havoc #t~nondet13; [L1105] FCALL call write~int(12292, { base: ~s!base, offset: 52 + ~s!offset }, 4); [L1106] assume -2147483648 <= #t~nondet14 && #t~nondet14 <= 2147483647; [L1106] ~tmp~2 := #t~nondet14; [L1106] havoc #t~nondet14; [L1107] ~cb~0 := { base: 0, offset: 0 }; [L1108] ~ret~0 := -1; [L1109] ~skip~0 := 0; [L1110] FCALL call write~int(0, ~tmp___0~1, 4); [L1111] FCALL call #t~mem15 := read~$Pointer$({ base: ~s!base, offset: 192 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem15!base=1, #t~mem15!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=0, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1111] COND TRUE 0 != (#t~mem15!base + #t~mem15!offset) % 4294967296 [L1111] havoc #t~mem15; [L1112] FCALL call #t~mem16 := read~$Pointer$({ base: ~s!base, offset: 192 + ~s!offset }, 4); [L1112] ~cb~0 := #t~mem16; [L1112] havoc #t~mem16; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1120] FCALL call #t~mem21 := read~int({ base: ~s!base, offset: 28 + ~s!offset }, 4); [L1120] FCALL call write~int(1 + #t~mem21, { base: ~s!base, offset: 28 + ~s!offset }, 4); [L1120] havoc #t~mem21; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1121-L1129] COND FALSE !(0 != ~bitwiseAnd(~tmp___1~0, 12288)) VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1131-L1635] COND FALSE !(false) VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1133] FCALL call #t~mem22 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); [L1133] ~state~0 := #t~mem22; [L1133] havoc #t~mem22; [L1134] FCALL call #t~mem23 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem23=12292, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1134] COND TRUE 12292 == #t~mem23 [L1134] havoc #t~mem23; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1237] FCALL call write~int(1, { base: ~s!base, offset: 40 + ~s!offset }, 4); [L1238] FCALL call write~int(4096, { base: ~s!base, offset: 52 + ~s!offset }, 4); [L1239] FCALL call #t~mem56 := read~$Pointer$({ base: ~s!base, offset: 204 + ~s!offset }, 4); [L1239] FCALL call #t~mem57 := read~int({ base: #t~mem56!base, offset: 64 + #t~mem56!offset }, 4); [L1239] FCALL call write~int(1 + #t~mem57, { base: #t~mem56!base, offset: 64 + #t~mem56!offset }, 4); [L1239] havoc #t~mem56; [L1239] havoc #t~mem57; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1244] FCALL call write~int(0, { base: ~s!base, offset: 36 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1245] COND TRUE 0 != (~cb~0!base + ~cb~0!offset) % 4294967296 VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1250] FCALL call #t~mem58 := read~int({ base: ~s!base, offset: ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem58=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1250] COND FALSE !(768 != ~bitwiseAnd(#t~mem58, 65280)) [L1250] havoc #t~mem58; [L1256] FCALL call write~int(4096, { base: ~s!base, offset: 4 + ~s!offset }, 4); [L1257] FCALL call #t~mem59 := read~$Pointer$({ base: ~s!base, offset: 60 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem59!base=-1, #t~mem59!offset=2, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1257] COND FALSE !(0 == (#t~mem59!base + #t~mem59!offset) % 4294967296) [L1257] havoc #t~mem59; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1269] assume -2147483648 <= #t~nondet61 && #t~nondet61 <= 2147483647; [L1269] ~tmp___4~0 := #t~nondet61; [L1269] havoc #t~nondet61; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp~2=0] [L1270] COND FALSE !(0 == ~tmp___4~0) [L1276] assume -2147483648 <= #t~nondet62 && #t~nondet62 <= 2147483647; [L1276] ~tmp___5~0 := #t~nondet62; [L1276] havoc #t~nondet62; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1277] COND FALSE !(0 == ~tmp___5~0) [L1283] FCALL call write~int(4368, { base: ~s!base, offset: 52 + ~s!offset }, 4); [L1284] FCALL call #t~mem63 := read~$Pointer$({ base: ~s!base, offset: 204 + ~s!offset }, 4); [L1284] FCALL call #t~mem64 := read~int({ base: #t~mem63!base, offset: 60 + #t~mem63!offset }, 4); [L1284] FCALL call write~int(1 + #t~mem64, { base: #t~mem63!base, offset: 60 + #t~mem63!offset }, 4); [L1284] havoc #t~mem63; [L1284] havoc #t~mem64; [L1285] FCALL call write~int(0, { base: ~s!base, offset: 64 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1605] FCALL call #t~mem128 := read~$Pointer$({ base: ~s!base, offset: 84 + ~s!offset }, 4); [L1605] FCALL call #t~mem129 := read~int({ base: #t~mem128!base, offset: 848 + #t~mem128!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem128!base=20506, #t~mem128!offset=0, #t~mem129=20542, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1605] COND FALSE !(0 == #t~mem129) [L1605] havoc #t~mem128; [L1605] havoc #t~mem129; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1634] ~skip~0 := 0; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1131-L1635] COND FALSE !(false) VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1133] FCALL call #t~mem22 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); [L1133] ~state~0 := #t~mem22; [L1133] havoc #t~mem22; [L1134] FCALL call #t~mem23 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem23=4368, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1134] COND FALSE !(12292 == #t~mem23) [L1134] havoc #t~mem23; [L1137] FCALL call #t~mem24 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem24=4368, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1137] COND FALSE !(16384 == #t~mem24) [L1137] havoc #t~mem24; [L1140] FCALL call #t~mem25 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem25=4368, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1140] COND FALSE !(4096 == #t~mem25) [L1140] havoc #t~mem25; [L1143] FCALL call #t~mem26 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem26=4368, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1143] COND FALSE !(20480 == #t~mem26) [L1143] havoc #t~mem26; [L1146] FCALL call #t~mem27 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem27=4368, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1146] COND FALSE !(4099 == #t~mem27) [L1146] havoc #t~mem27; [L1149] FCALL call #t~mem28 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem28=4368, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1149] COND TRUE 4368 == #t~mem28 [L1149] havoc #t~mem28; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1289] FCALL call write~int(0, { base: ~s!base, offset: 48 + ~s!offset }, 4); [L1290] assume -2147483648 <= #t~nondet65 && #t~nondet65 <= 2147483647; [L1290] ~ret~0 := #t~nondet65; [L1290] havoc #t~nondet65; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1291] COND TRUE 0 == ~blastFlag~0 [L1292] ~blastFlag~0 := 1; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1296] COND FALSE !(~ret~0 <= 0) [L1301] FCALL call write~int(4384, { base: ~s!base, offset: 52 + ~s!offset }, 4); [L1302] FCALL call write~int(0, { base: ~s!base, offset: 64 + ~s!offset }, 4); [L1303] FCALL call #t~mem66 := read~$Pointer$({ base: ~s!base, offset: 20 + ~s!offset }, 4); [L1303] FCALL call #t~mem67 := read~$Pointer$({ base: ~s!base, offset: 16 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem66!base=0, #t~mem66!offset=1, #t~mem67!base=0, #t~mem67!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1303] COND TRUE (#t~mem66!base + #t~mem66!offset) % 4294967296 != (#t~mem67!base + #t~mem67!offset) % 4294967296 [L1303] havoc #t~mem66; [L1303] havoc #t~mem67; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1605] FCALL call #t~mem128 := read~$Pointer$({ base: ~s!base, offset: 84 + ~s!offset }, 4); [L1605] FCALL call #t~mem129 := read~int({ base: #t~mem128!base, offset: 848 + #t~mem128!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem128!base=20506, #t~mem128!offset=0, #t~mem129=20542, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1605] COND FALSE !(0 == #t~mem129) [L1605] havoc #t~mem128; [L1605] havoc #t~mem129; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1634] ~skip~0 := 0; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1131-L1635] COND FALSE !(false) VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1133] FCALL call #t~mem22 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); [L1133] ~state~0 := #t~mem22; [L1133] havoc #t~mem22; [L1134] FCALL call #t~mem23 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem23=4384, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1134] COND FALSE !(12292 == #t~mem23) [L1134] havoc #t~mem23; [L1137] FCALL call #t~mem24 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem24=4384, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1137] COND FALSE !(16384 == #t~mem24) [L1137] havoc #t~mem24; [L1140] FCALL call #t~mem25 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem25=4384, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1140] COND FALSE !(4096 == #t~mem25) [L1140] havoc #t~mem25; [L1143] FCALL call #t~mem26 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem26=4384, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1143] COND FALSE !(20480 == #t~mem26) [L1143] havoc #t~mem26; [L1146] FCALL call #t~mem27 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem27=4384, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1146] COND FALSE !(4099 == #t~mem27) [L1146] havoc #t~mem27; [L1149] FCALL call #t~mem28 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem28=4384, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1149] COND FALSE !(4368 == #t~mem28) [L1149] havoc #t~mem28; [L1152] FCALL call #t~mem29 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem29=4384, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1152] COND FALSE !(4369 == #t~mem29) [L1152] havoc #t~mem29; [L1155] FCALL call #t~mem30 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem30=4384, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1155] COND TRUE 4384 == #t~mem30 [L1155] havoc #t~mem30; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1311] assume -2147483648 <= #t~nondet68 && #t~nondet68 <= 2147483647; [L1311] ~ret~0 := #t~nondet68; [L1311] havoc #t~nondet68; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1312] COND TRUE 1 == ~blastFlag~0 [L1313] ~blastFlag~0 := 2; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1317] COND FALSE !(~ret~0 <= 0) [L1322] FCALL call #t~mem69 := read~int({ base: ~s!base, offset: 92 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem69=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1322-L1326] COND FALSE !(0 != #t~mem69) [L1322] havoc #t~mem69; [L1325] FCALL call write~int(4400, { base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1327] FCALL call write~int(0, { base: ~s!base, offset: 64 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1605] FCALL call #t~mem128 := read~$Pointer$({ base: ~s!base, offset: 84 + ~s!offset }, 4); [L1605] FCALL call #t~mem129 := read~int({ base: #t~mem128!base, offset: 848 + #t~mem128!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem128!base=20506, #t~mem128!offset=0, #t~mem129=20542, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1605] COND FALSE !(0 == #t~mem129) [L1605] havoc #t~mem128; [L1605] havoc #t~mem129; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1634] ~skip~0 := 0; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1131-L1635] COND FALSE !(false) VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1133] FCALL call #t~mem22 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); [L1133] ~state~0 := #t~mem22; [L1133] havoc #t~mem22; [L1134] FCALL call #t~mem23 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem23=4400, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1134] COND FALSE !(12292 == #t~mem23) [L1134] havoc #t~mem23; [L1137] FCALL call #t~mem24 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem24=4400, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1137] COND FALSE !(16384 == #t~mem24) [L1137] havoc #t~mem24; [L1140] FCALL call #t~mem25 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem25=4400, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1140] COND FALSE !(4096 == #t~mem25) [L1140] havoc #t~mem25; [L1143] FCALL call #t~mem26 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem26=4400, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1143] COND FALSE !(20480 == #t~mem26) [L1143] havoc #t~mem26; [L1146] FCALL call #t~mem27 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem27=4400, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1146] COND FALSE !(4099 == #t~mem27) [L1146] havoc #t~mem27; [L1149] FCALL call #t~mem28 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem28=4400, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1149] COND FALSE !(4368 == #t~mem28) [L1149] havoc #t~mem28; [L1152] FCALL call #t~mem29 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem29=4400, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1152] COND FALSE !(4369 == #t~mem29) [L1152] havoc #t~mem29; [L1155] FCALL call #t~mem30 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem30=4400, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1155] COND FALSE !(4384 == #t~mem30) [L1155] havoc #t~mem30; [L1158] FCALL call #t~mem31 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem31=4400, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1158] COND FALSE !(4385 == #t~mem31) [L1158] havoc #t~mem31; [L1161] FCALL call #t~mem32 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem32=4400, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1161] COND TRUE 4400 == #t~mem32 [L1161] havoc #t~mem32; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1331] FCALL call #t~mem70 := read~$Pointer$({ base: ~s!base, offset: 84 + ~s!offset }, 4); [L1331] FCALL call #t~mem71 := read~$Pointer$({ base: #t~mem70!base, offset: 836 + #t~mem70!offset }, 4); [L1331] FCALL call #t~mem72 := read~int({ base: #t~mem71!base, offset: 12 + #t~mem71!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem70!base=20506, #t~mem70!offset=0, #t~mem71!base=20502, #t~mem71!offset=0, #t~mem72=20537, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1331-L1345] COND FALSE !(0 != ~bitwiseAnd(#t~mem72, 256) % 4294967296) [L1331] havoc #t~mem71; [L1331] havoc #t~mem70; [L1331] havoc #t~mem72; [L1334] assume -2147483648 <= #t~nondet73 && #t~nondet73 <= 2147483647; [L1334] ~ret~0 := #t~nondet73; [L1334] havoc #t~nondet73; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=5, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1335] COND TRUE 2 == ~blastFlag~0 [L1336] ~blastFlag~0 := 3; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=5, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1340] COND FALSE !(~ret~0 <= 0) VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=5, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1346] FCALL call write~int(4416, { base: ~s!base, offset: 52 + ~s!offset }, 4); [L1347] FCALL call write~int(0, { base: ~s!base, offset: 64 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=5, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1605] FCALL call #t~mem128 := read~$Pointer$({ base: ~s!base, offset: 84 + ~s!offset }, 4); [L1605] FCALL call #t~mem129 := read~int({ base: #t~mem128!base, offset: 848 + #t~mem128!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem128!base=20506, #t~mem128!offset=0, #t~mem129=20542, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=5, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1605] COND FALSE !(0 == #t~mem129) [L1605] havoc #t~mem128; [L1605] havoc #t~mem129; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=5, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1634] ~skip~0 := 0; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=5, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1131-L1635] COND FALSE !(false) VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=5, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1133] FCALL call #t~mem22 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); [L1133] ~state~0 := #t~mem22; [L1133] havoc #t~mem22; [L1134] FCALL call #t~mem23 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem23=4416, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=5, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1134] COND FALSE !(12292 == #t~mem23) [L1134] havoc #t~mem23; [L1137] FCALL call #t~mem24 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem24=4416, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=5, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1137] COND FALSE !(16384 == #t~mem24) [L1137] havoc #t~mem24; [L1140] FCALL call #t~mem25 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem25=4416, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=5, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1140] COND FALSE !(4096 == #t~mem25) [L1140] havoc #t~mem25; [L1143] FCALL call #t~mem26 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem26=4416, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=5, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1143] COND FALSE !(20480 == #t~mem26) [L1143] havoc #t~mem26; [L1146] FCALL call #t~mem27 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem27=4416, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=5, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1146] COND FALSE !(4099 == #t~mem27) [L1146] havoc #t~mem27; [L1149] FCALL call #t~mem28 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem28=4416, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=5, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1149] COND FALSE !(4368 == #t~mem28) [L1149] havoc #t~mem28; [L1152] FCALL call #t~mem29 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem29=4416, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=5, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1152] COND FALSE !(4369 == #t~mem29) [L1152] havoc #t~mem29; [L1155] FCALL call #t~mem30 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem30=4416, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=5, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1155] COND FALSE !(4384 == #t~mem30) [L1155] havoc #t~mem30; [L1158] FCALL call #t~mem31 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem31=4416, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=5, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1158] COND FALSE !(4385 == #t~mem31) [L1158] havoc #t~mem31; [L1161] FCALL call #t~mem32 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem32=4416, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=5, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1161] COND FALSE !(4400 == #t~mem32) [L1161] havoc #t~mem32; [L1164] FCALL call #t~mem33 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem33=4416, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=5, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1164] COND FALSE !(4401 == #t~mem33) [L1164] havoc #t~mem33; [L1167] FCALL call #t~mem34 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem34=4416, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=5, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1167] COND TRUE 4416 == #t~mem34 [L1167] havoc #t~mem34; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=5, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1351] assume -2147483648 <= #t~nondet74 && #t~nondet74 <= 2147483647; [L1351] ~ret~0 := #t~nondet74; [L1351] havoc #t~nondet74; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=6, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1352] COND TRUE 3 == ~blastFlag~0 [L1353] ~blastFlag~0 := 4; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=6, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1357] COND FALSE !(~ret~0 <= 0) [L1362] FCALL call write~int(4432, { base: ~s!base, offset: 52 + ~s!offset }, 4); [L1363] FCALL call write~int(0, { base: ~s!base, offset: 64 + ~s!offset }, 4); [L1364] assume -2147483648 <= #t~nondet75 && #t~nondet75 <= 2147483647; [L1364] ~tmp___6~0 := #t~nondet75; [L1364] havoc #t~nondet75; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=6, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1365] COND FALSE !(0 == ~tmp___6~0) VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=6, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1605] FCALL call #t~mem128 := read~$Pointer$({ base: ~s!base, offset: 84 + ~s!offset }, 4); [L1605] FCALL call #t~mem129 := read~int({ base: #t~mem128!base, offset: 848 + #t~mem128!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem128!base=20506, #t~mem128!offset=0, #t~mem129=20542, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=6, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1605] COND FALSE !(0 == #t~mem129) [L1605] havoc #t~mem128; [L1605] havoc #t~mem129; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=6, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1634] ~skip~0 := 0; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=6, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1131-L1635] COND FALSE !(false) VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=6, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1133] FCALL call #t~mem22 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); [L1133] ~state~0 := #t~mem22; [L1133] havoc #t~mem22; [L1134] FCALL call #t~mem23 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem23=4432, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=6, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1134] COND FALSE !(12292 == #t~mem23) [L1134] havoc #t~mem23; [L1137] FCALL call #t~mem24 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem24=4432, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=6, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1137] COND FALSE !(16384 == #t~mem24) [L1137] havoc #t~mem24; [L1140] FCALL call #t~mem25 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem25=4432, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=6, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1140] COND FALSE !(4096 == #t~mem25) [L1140] havoc #t~mem25; [L1143] FCALL call #t~mem26 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem26=4432, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=6, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1143] COND FALSE !(20480 == #t~mem26) [L1143] havoc #t~mem26; [L1146] FCALL call #t~mem27 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem27=4432, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=6, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1146] COND FALSE !(4099 == #t~mem27) [L1146] havoc #t~mem27; [L1149] FCALL call #t~mem28 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem28=4432, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=6, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1149] COND FALSE !(4368 == #t~mem28) [L1149] havoc #t~mem28; [L1152] FCALL call #t~mem29 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem29=4432, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=6, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1152] COND FALSE !(4369 == #t~mem29) [L1152] havoc #t~mem29; [L1155] FCALL call #t~mem30 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem30=4432, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=6, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1155] COND FALSE !(4384 == #t~mem30) [L1155] havoc #t~mem30; [L1158] FCALL call #t~mem31 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem31=4432, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=6, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1158] COND FALSE !(4385 == #t~mem31) [L1158] havoc #t~mem31; [L1161] FCALL call #t~mem32 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem32=4432, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=6, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1161] COND FALSE !(4400 == #t~mem32) [L1161] havoc #t~mem32; [L1164] FCALL call #t~mem33 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem33=4432, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=6, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1164] COND FALSE !(4401 == #t~mem33) [L1164] havoc #t~mem33; [L1167] FCALL call #t~mem34 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem34=4432, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=6, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1167] COND FALSE !(4416 == #t~mem34) [L1167] havoc #t~mem34; [L1170] FCALL call #t~mem35 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem35=4432, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=6, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1170] COND FALSE !(4417 == #t~mem35) [L1170] havoc #t~mem35; [L1173] FCALL call #t~mem36 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem36=4432, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=6, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1173] COND TRUE 4432 == #t~mem36 [L1173] havoc #t~mem36; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=6, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1374] assume -2147483648 <= #t~nondet76 && #t~nondet76 <= 2147483647; [L1374] ~ret~0 := #t~nondet76; [L1374] havoc #t~nondet76; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1375] COND FALSE !(5 == ~blastFlag~0) VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1380] COND FALSE !(~ret~0 <= 0) [L1385] FCALL call write~int(4448, { base: ~s!base, offset: 52 + ~s!offset }, 4); [L1386] FCALL call write~int(0, { base: ~s!base, offset: 64 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1605] FCALL call #t~mem128 := read~$Pointer$({ base: ~s!base, offset: 84 + ~s!offset }, 4); [L1605] FCALL call #t~mem129 := read~int({ base: #t~mem128!base, offset: 848 + #t~mem128!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem128!base=20506, #t~mem128!offset=0, #t~mem129=20542, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1605] COND FALSE !(0 == #t~mem129) [L1605] havoc #t~mem128; [L1605] havoc #t~mem129; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1634] ~skip~0 := 0; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1131-L1635] COND FALSE !(false) VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1133] FCALL call #t~mem22 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); [L1133] ~state~0 := #t~mem22; [L1133] havoc #t~mem22; [L1134] FCALL call #t~mem23 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem23=4448, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1134] COND FALSE !(12292 == #t~mem23) [L1134] havoc #t~mem23; [L1137] FCALL call #t~mem24 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem24=4448, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1137] COND FALSE !(16384 == #t~mem24) [L1137] havoc #t~mem24; [L1140] FCALL call #t~mem25 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem25=4448, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1140] COND FALSE !(4096 == #t~mem25) [L1140] havoc #t~mem25; [L1143] FCALL call #t~mem26 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem26=4448, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1143] COND FALSE !(20480 == #t~mem26) [L1143] havoc #t~mem26; [L1146] FCALL call #t~mem27 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem27=4448, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1146] COND FALSE !(4099 == #t~mem27) [L1146] havoc #t~mem27; [L1149] FCALL call #t~mem28 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem28=4448, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1149] COND FALSE !(4368 == #t~mem28) [L1149] havoc #t~mem28; [L1152] FCALL call #t~mem29 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem29=4448, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1152] COND FALSE !(4369 == #t~mem29) [L1152] havoc #t~mem29; [L1155] FCALL call #t~mem30 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem30=4448, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1155] COND FALSE !(4384 == #t~mem30) [L1155] havoc #t~mem30; [L1158] FCALL call #t~mem31 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem31=4448, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1158] COND FALSE !(4385 == #t~mem31) [L1158] havoc #t~mem31; [L1161] FCALL call #t~mem32 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem32=4448, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1161] COND FALSE !(4400 == #t~mem32) [L1161] havoc #t~mem32; [L1164] FCALL call #t~mem33 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem33=4448, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1164] COND FALSE !(4401 == #t~mem33) [L1164] havoc #t~mem33; [L1167] FCALL call #t~mem34 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem34=4448, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1167] COND FALSE !(4416 == #t~mem34) [L1167] havoc #t~mem34; [L1170] FCALL call #t~mem35 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem35=4448, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1170] COND FALSE !(4417 == #t~mem35) [L1170] havoc #t~mem35; [L1173] FCALL call #t~mem36 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem36=4448, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1173] COND FALSE !(4432 == #t~mem36) [L1173] havoc #t~mem36; [L1176] FCALL call #t~mem37 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem37=4448, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1176] COND FALSE !(4433 == #t~mem37) [L1176] havoc #t~mem37; [L1179] FCALL call #t~mem38 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem38=4448, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1179] COND TRUE 4448 == #t~mem38 [L1179] havoc #t~mem38; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1390] assume -2147483648 <= #t~nondet77 && #t~nondet77 <= 2147483647; [L1390] ~ret~0 := #t~nondet77; [L1390] havoc #t~nondet77; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=0, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1391] COND TRUE 4 == ~blastFlag~0 VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=0, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1646] assert false; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=0, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] ----- ----- class de.uni_freiburg.informatik.ultimate.boogie.procedureinliner.backtranslation.InlinerBacktranslator [?] CALL call ULTIMATE.init(); VAL [#NULL!base=20507, #NULL!offset=20535, old(#NULL!base)=20507, old(#NULL!offset)=20535, old(~#SSLv3_client_data~0!base)=20492, old(~#SSLv3_client_data~0!offset)=20488, old(~init~0)=20541, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=20488, ~init~0=20541] [?] #NULL := { base: 0, offset: 0 }; [?] #valid[0] := 0; [L1042] ~init~0 := 1; [L1043] FCALL call ~#SSLv3_client_data~0 := #Ultimate.alloc(100); [L1043] FCALL call write~init~int(0, { base: ~#SSLv3_client_data~0!base, offset: ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 4 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 8 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 12 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 16 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 20 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 24 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 28 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 32 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 36 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 40 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 44 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 48 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 52 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 56 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 60 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 64 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 68 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 72 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 76 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 80 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 84 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 88 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 92 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 96 + ~#SSLv3_client_data~0!offset }, 4); VAL [#NULL!base=0, #NULL!offset=0, old(#NULL!base)=20507, old(#NULL!offset)=20535, old(~#SSLv3_client_data~0!base)=20492, old(~#SSLv3_client_data~0!offset)=20488, old(~init~0)=20541, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~init~0=1] [?] RET call ULTIMATE.init(); VAL [#NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~init~0=1] [?] CALL call #t~ret139 := main(); VAL [#NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~init~0=1] [L1065] FCALL call #t~malloc3 := #Ultimate.alloc(248); [L1065] ~s~0 := #t~malloc3; [L1069] FCALL call #t~malloc4 := #Ultimate.alloc(899); [L1069] FCALL call write~$Pointer$(#t~malloc4, { base: ~s~0!base, offset: 84 + ~s~0!offset }, 4); [L1070] FCALL call #t~malloc5 := #Ultimate.alloc(232); [L1070] FCALL call write~$Pointer$(#t~malloc5, { base: ~s~0!base, offset: 204 + ~s~0!offset }, 4); [L1071] FCALL call #t~malloc6 := #Ultimate.alloc(200); [L1071] FCALL call write~$Pointer$(#t~malloc6, { base: ~s~0!base, offset: 176 + ~s~0!offset }, 4); [L1072] FCALL call write~int(12292, { base: ~s~0!base, offset: 52 + ~s~0!offset }, 4); [L1073] assume -2147483648 <= #t~nondet7 && #t~nondet7 <= 2147483647; [L1073] FCALL call write~int(#t~nondet7, { base: ~s~0!base, offset: ~s~0!offset }, 4); [L1073] havoc #t~nondet7; VAL [#NULL!base=0, #NULL!offset=0, #t~malloc3!base=20501, #t~malloc3!offset=0, #t~malloc4!base=20506, #t~malloc4!offset=0, #t~malloc5!base=20521, #t~malloc5!offset=0, #t~malloc6!base=20484, #t~malloc6!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~init~0=1, ~s~0!base=20501, ~s~0!offset=0] [L1074] CALL call #t~ret8 := ssl3_connect(~s~0); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~init~0=1] [L1079-L1648] ~s := #in~s; [L1080] ~buf~0 := #t~nondet9; [L1080] havoc #t~nondet9; [L1081] havoc ~tmp~2; [L1082] havoc ~l~0; [L1083] havoc ~num1~0; [L1084] havoc ~cb~0; [L1085] havoc ~ret~0; [L1086] havoc ~new_state~0; [L1087] havoc ~state~0; [L1088] havoc ~skip~0; [L1089] ~tmp___0~1 := #t~nondet10; [L1089] havoc #t~nondet10; [L1090] assume -2147483648 <= #t~nondet11 && #t~nondet11 <= 2147483647; [L1090] ~tmp___1~0 := #t~nondet11; [L1090] havoc #t~nondet11; [L1091] assume -2147483648 <= #t~nondet12 && #t~nondet12 <= 2147483647; [L1091] ~tmp___2~0 := #t~nondet12; [L1091] havoc #t~nondet12; [L1092] havoc ~tmp___3~0; [L1093] havoc ~tmp___4~0; [L1094] havoc ~tmp___5~0; [L1095] havoc ~tmp___6~0; [L1096] havoc ~tmp___7~0; [L1097] havoc ~tmp___8~0; [L1098] havoc ~tmp___9~0; [L1100] havoc ~blastFlag~0; [L1103] ~blastFlag~0 := 0; [L1104] assume -2147483648 <= #t~nondet13 && #t~nondet13 <= 2147483647; [L1104] FCALL call write~int(#t~nondet13, { base: ~s!base, offset: 92 + ~s!offset }, 4); [L1104] havoc #t~nondet13; [L1105] FCALL call write~int(12292, { base: ~s!base, offset: 52 + ~s!offset }, 4); [L1106] assume -2147483648 <= #t~nondet14 && #t~nondet14 <= 2147483647; [L1106] ~tmp~2 := #t~nondet14; [L1106] havoc #t~nondet14; [L1107] ~cb~0 := { base: 0, offset: 0 }; [L1108] ~ret~0 := -1; [L1109] ~skip~0 := 0; [L1110] FCALL call write~int(0, ~tmp___0~1, 4); [L1111] FCALL call #t~mem15 := read~$Pointer$({ base: ~s!base, offset: 192 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem15!base=1, #t~mem15!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=0, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1111] COND TRUE 0 != (#t~mem15!base + #t~mem15!offset) % 4294967296 [L1111] havoc #t~mem15; [L1112] FCALL call #t~mem16 := read~$Pointer$({ base: ~s!base, offset: 192 + ~s!offset }, 4); [L1112] ~cb~0 := #t~mem16; [L1112] havoc #t~mem16; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1120] FCALL call #t~mem21 := read~int({ base: ~s!base, offset: 28 + ~s!offset }, 4); [L1120] FCALL call write~int(1 + #t~mem21, { base: ~s!base, offset: 28 + ~s!offset }, 4); [L1120] havoc #t~mem21; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1121-L1129] COND FALSE !(0 != ~bitwiseAnd(~tmp___1~0, 12288)) VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1131-L1635] COND FALSE !(false) VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1133] FCALL call #t~mem22 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); [L1133] ~state~0 := #t~mem22; [L1133] havoc #t~mem22; [L1134] FCALL call #t~mem23 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem23=12292, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1134] COND TRUE 12292 == #t~mem23 [L1134] havoc #t~mem23; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1237] FCALL call write~int(1, { base: ~s!base, offset: 40 + ~s!offset }, 4); [L1238] FCALL call write~int(4096, { base: ~s!base, offset: 52 + ~s!offset }, 4); [L1239] FCALL call #t~mem56 := read~$Pointer$({ base: ~s!base, offset: 204 + ~s!offset }, 4); [L1239] FCALL call #t~mem57 := read~int({ base: #t~mem56!base, offset: 64 + #t~mem56!offset }, 4); [L1239] FCALL call write~int(1 + #t~mem57, { base: #t~mem56!base, offset: 64 + #t~mem56!offset }, 4); [L1239] havoc #t~mem56; [L1239] havoc #t~mem57; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1244] FCALL call write~int(0, { base: ~s!base, offset: 36 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1245] COND TRUE 0 != (~cb~0!base + ~cb~0!offset) % 4294967296 VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1250] FCALL call #t~mem58 := read~int({ base: ~s!base, offset: ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem58=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1250] COND FALSE !(768 != ~bitwiseAnd(#t~mem58, 65280)) [L1250] havoc #t~mem58; [L1256] FCALL call write~int(4096, { base: ~s!base, offset: 4 + ~s!offset }, 4); [L1257] FCALL call #t~mem59 := read~$Pointer$({ base: ~s!base, offset: 60 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem59!base=-1, #t~mem59!offset=2, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1257] COND FALSE !(0 == (#t~mem59!base + #t~mem59!offset) % 4294967296) [L1257] havoc #t~mem59; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1269] assume -2147483648 <= #t~nondet61 && #t~nondet61 <= 2147483647; [L1269] ~tmp___4~0 := #t~nondet61; [L1269] havoc #t~nondet61; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp~2=0] [L1270] COND FALSE !(0 == ~tmp___4~0) [L1276] assume -2147483648 <= #t~nondet62 && #t~nondet62 <= 2147483647; [L1276] ~tmp___5~0 := #t~nondet62; [L1276] havoc #t~nondet62; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1277] COND FALSE !(0 == ~tmp___5~0) [L1283] FCALL call write~int(4368, { base: ~s!base, offset: 52 + ~s!offset }, 4); [L1284] FCALL call #t~mem63 := read~$Pointer$({ base: ~s!base, offset: 204 + ~s!offset }, 4); [L1284] FCALL call #t~mem64 := read~int({ base: #t~mem63!base, offset: 60 + #t~mem63!offset }, 4); [L1284] FCALL call write~int(1 + #t~mem64, { base: #t~mem63!base, offset: 60 + #t~mem63!offset }, 4); [L1284] havoc #t~mem63; [L1284] havoc #t~mem64; [L1285] FCALL call write~int(0, { base: ~s!base, offset: 64 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1605] FCALL call #t~mem128 := read~$Pointer$({ base: ~s!base, offset: 84 + ~s!offset }, 4); [L1605] FCALL call #t~mem129 := read~int({ base: #t~mem128!base, offset: 848 + #t~mem128!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem128!base=20506, #t~mem128!offset=0, #t~mem129=20542, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1605] COND FALSE !(0 == #t~mem129) [L1605] havoc #t~mem128; [L1605] havoc #t~mem129; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1634] ~skip~0 := 0; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1131-L1635] COND FALSE !(false) VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1133] FCALL call #t~mem22 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); [L1133] ~state~0 := #t~mem22; [L1133] havoc #t~mem22; [L1134] FCALL call #t~mem23 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem23=4368, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1134] COND FALSE !(12292 == #t~mem23) [L1134] havoc #t~mem23; [L1137] FCALL call #t~mem24 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem24=4368, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1137] COND FALSE !(16384 == #t~mem24) [L1137] havoc #t~mem24; [L1140] FCALL call #t~mem25 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem25=4368, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1140] COND FALSE !(4096 == #t~mem25) [L1140] havoc #t~mem25; [L1143] FCALL call #t~mem26 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem26=4368, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1143] COND FALSE !(20480 == #t~mem26) [L1143] havoc #t~mem26; [L1146] FCALL call #t~mem27 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem27=4368, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1146] COND FALSE !(4099 == #t~mem27) [L1146] havoc #t~mem27; [L1149] FCALL call #t~mem28 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem28=4368, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1149] COND TRUE 4368 == #t~mem28 [L1149] havoc #t~mem28; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1289] FCALL call write~int(0, { base: ~s!base, offset: 48 + ~s!offset }, 4); [L1290] assume -2147483648 <= #t~nondet65 && #t~nondet65 <= 2147483647; [L1290] ~ret~0 := #t~nondet65; [L1290] havoc #t~nondet65; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1291] COND TRUE 0 == ~blastFlag~0 [L1292] ~blastFlag~0 := 1; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1296] COND FALSE !(~ret~0 <= 0) [L1301] FCALL call write~int(4384, { base: ~s!base, offset: 52 + ~s!offset }, 4); [L1302] FCALL call write~int(0, { base: ~s!base, offset: 64 + ~s!offset }, 4); [L1303] FCALL call #t~mem66 := read~$Pointer$({ base: ~s!base, offset: 20 + ~s!offset }, 4); [L1303] FCALL call #t~mem67 := read~$Pointer$({ base: ~s!base, offset: 16 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem66!base=0, #t~mem66!offset=1, #t~mem67!base=0, #t~mem67!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1303] COND TRUE (#t~mem66!base + #t~mem66!offset) % 4294967296 != (#t~mem67!base + #t~mem67!offset) % 4294967296 [L1303] havoc #t~mem66; [L1303] havoc #t~mem67; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1605] FCALL call #t~mem128 := read~$Pointer$({ base: ~s!base, offset: 84 + ~s!offset }, 4); [L1605] FCALL call #t~mem129 := read~int({ base: #t~mem128!base, offset: 848 + #t~mem128!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem128!base=20506, #t~mem128!offset=0, #t~mem129=20542, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1605] COND FALSE !(0 == #t~mem129) [L1605] havoc #t~mem128; [L1605] havoc #t~mem129; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1634] ~skip~0 := 0; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1131-L1635] COND FALSE !(false) VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1133] FCALL call #t~mem22 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); [L1133] ~state~0 := #t~mem22; [L1133] havoc #t~mem22; [L1134] FCALL call #t~mem23 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem23=4384, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1134] COND FALSE !(12292 == #t~mem23) [L1134] havoc #t~mem23; [L1137] FCALL call #t~mem24 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem24=4384, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1137] COND FALSE !(16384 == #t~mem24) [L1137] havoc #t~mem24; [L1140] FCALL call #t~mem25 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem25=4384, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1140] COND FALSE !(4096 == #t~mem25) [L1140] havoc #t~mem25; [L1143] FCALL call #t~mem26 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem26=4384, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1143] COND FALSE !(20480 == #t~mem26) [L1143] havoc #t~mem26; [L1146] FCALL call #t~mem27 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem27=4384, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1146] COND FALSE !(4099 == #t~mem27) [L1146] havoc #t~mem27; [L1149] FCALL call #t~mem28 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem28=4384, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1149] COND FALSE !(4368 == #t~mem28) [L1149] havoc #t~mem28; [L1152] FCALL call #t~mem29 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem29=4384, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1152] COND FALSE !(4369 == #t~mem29) [L1152] havoc #t~mem29; [L1155] FCALL call #t~mem30 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem30=4384, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1155] COND TRUE 4384 == #t~mem30 [L1155] havoc #t~mem30; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1311] assume -2147483648 <= #t~nondet68 && #t~nondet68 <= 2147483647; [L1311] ~ret~0 := #t~nondet68; [L1311] havoc #t~nondet68; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1312] COND TRUE 1 == ~blastFlag~0 [L1313] ~blastFlag~0 := 2; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1317] COND FALSE !(~ret~0 <= 0) [L1322] FCALL call #t~mem69 := read~int({ base: ~s!base, offset: 92 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem69=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1322-L1326] COND FALSE !(0 != #t~mem69) [L1322] havoc #t~mem69; [L1325] FCALL call write~int(4400, { base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1327] FCALL call write~int(0, { base: ~s!base, offset: 64 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1605] FCALL call #t~mem128 := read~$Pointer$({ base: ~s!base, offset: 84 + ~s!offset }, 4); [L1605] FCALL call #t~mem129 := read~int({ base: #t~mem128!base, offset: 848 + #t~mem128!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem128!base=20506, #t~mem128!offset=0, #t~mem129=20542, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1605] COND FALSE !(0 == #t~mem129) [L1605] havoc #t~mem128; [L1605] havoc #t~mem129; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1634] ~skip~0 := 0; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1131-L1635] COND FALSE !(false) VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1133] FCALL call #t~mem22 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); [L1133] ~state~0 := #t~mem22; [L1133] havoc #t~mem22; [L1134] FCALL call #t~mem23 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem23=4400, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1134] COND FALSE !(12292 == #t~mem23) [L1134] havoc #t~mem23; [L1137] FCALL call #t~mem24 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem24=4400, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1137] COND FALSE !(16384 == #t~mem24) [L1137] havoc #t~mem24; [L1140] FCALL call #t~mem25 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem25=4400, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1140] COND FALSE !(4096 == #t~mem25) [L1140] havoc #t~mem25; [L1143] FCALL call #t~mem26 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem26=4400, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1143] COND FALSE !(20480 == #t~mem26) [L1143] havoc #t~mem26; [L1146] FCALL call #t~mem27 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem27=4400, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1146] COND FALSE !(4099 == #t~mem27) [L1146] havoc #t~mem27; [L1149] FCALL call #t~mem28 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem28=4400, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1149] COND FALSE !(4368 == #t~mem28) [L1149] havoc #t~mem28; [L1152] FCALL call #t~mem29 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem29=4400, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1152] COND FALSE !(4369 == #t~mem29) [L1152] havoc #t~mem29; [L1155] FCALL call #t~mem30 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem30=4400, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1155] COND FALSE !(4384 == #t~mem30) [L1155] havoc #t~mem30; [L1158] FCALL call #t~mem31 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem31=4400, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1158] COND FALSE !(4385 == #t~mem31) [L1158] havoc #t~mem31; [L1161] FCALL call #t~mem32 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem32=4400, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1161] COND TRUE 4400 == #t~mem32 [L1161] havoc #t~mem32; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1331] FCALL call #t~mem70 := read~$Pointer$({ base: ~s!base, offset: 84 + ~s!offset }, 4); [L1331] FCALL call #t~mem71 := read~$Pointer$({ base: #t~mem70!base, offset: 836 + #t~mem70!offset }, 4); [L1331] FCALL call #t~mem72 := read~int({ base: #t~mem71!base, offset: 12 + #t~mem71!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem70!base=20506, #t~mem70!offset=0, #t~mem71!base=20502, #t~mem71!offset=0, #t~mem72=20537, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1331-L1345] COND FALSE !(0 != ~bitwiseAnd(#t~mem72, 256) % 4294967296) [L1331] havoc #t~mem71; [L1331] havoc #t~mem70; [L1331] havoc #t~mem72; [L1334] assume -2147483648 <= #t~nondet73 && #t~nondet73 <= 2147483647; [L1334] ~ret~0 := #t~nondet73; [L1334] havoc #t~nondet73; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=5, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1335] COND TRUE 2 == ~blastFlag~0 [L1336] ~blastFlag~0 := 3; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=5, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1340] COND FALSE !(~ret~0 <= 0) VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=5, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1346] FCALL call write~int(4416, { base: ~s!base, offset: 52 + ~s!offset }, 4); [L1347] FCALL call write~int(0, { base: ~s!base, offset: 64 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=5, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1605] FCALL call #t~mem128 := read~$Pointer$({ base: ~s!base, offset: 84 + ~s!offset }, 4); [L1605] FCALL call #t~mem129 := read~int({ base: #t~mem128!base, offset: 848 + #t~mem128!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem128!base=20506, #t~mem128!offset=0, #t~mem129=20542, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=5, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1605] COND FALSE !(0 == #t~mem129) [L1605] havoc #t~mem128; [L1605] havoc #t~mem129; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=5, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1634] ~skip~0 := 0; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=5, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1131-L1635] COND FALSE !(false) VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=5, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1133] FCALL call #t~mem22 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); [L1133] ~state~0 := #t~mem22; [L1133] havoc #t~mem22; [L1134] FCALL call #t~mem23 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem23=4416, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=5, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1134] COND FALSE !(12292 == #t~mem23) [L1134] havoc #t~mem23; [L1137] FCALL call #t~mem24 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem24=4416, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=5, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1137] COND FALSE !(16384 == #t~mem24) [L1137] havoc #t~mem24; [L1140] FCALL call #t~mem25 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem25=4416, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=5, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1140] COND FALSE !(4096 == #t~mem25) [L1140] havoc #t~mem25; [L1143] FCALL call #t~mem26 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem26=4416, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=5, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1143] COND FALSE !(20480 == #t~mem26) [L1143] havoc #t~mem26; [L1146] FCALL call #t~mem27 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem27=4416, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=5, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1146] COND FALSE !(4099 == #t~mem27) [L1146] havoc #t~mem27; [L1149] FCALL call #t~mem28 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem28=4416, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=5, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1149] COND FALSE !(4368 == #t~mem28) [L1149] havoc #t~mem28; [L1152] FCALL call #t~mem29 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem29=4416, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=5, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1152] COND FALSE !(4369 == #t~mem29) [L1152] havoc #t~mem29; [L1155] FCALL call #t~mem30 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem30=4416, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=5, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1155] COND FALSE !(4384 == #t~mem30) [L1155] havoc #t~mem30; [L1158] FCALL call #t~mem31 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem31=4416, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=5, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1158] COND FALSE !(4385 == #t~mem31) [L1158] havoc #t~mem31; [L1161] FCALL call #t~mem32 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem32=4416, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=5, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1161] COND FALSE !(4400 == #t~mem32) [L1161] havoc #t~mem32; [L1164] FCALL call #t~mem33 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem33=4416, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=5, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1164] COND FALSE !(4401 == #t~mem33) [L1164] havoc #t~mem33; [L1167] FCALL call #t~mem34 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem34=4416, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=5, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1167] COND TRUE 4416 == #t~mem34 [L1167] havoc #t~mem34; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=5, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1351] assume -2147483648 <= #t~nondet74 && #t~nondet74 <= 2147483647; [L1351] ~ret~0 := #t~nondet74; [L1351] havoc #t~nondet74; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=6, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1352] COND TRUE 3 == ~blastFlag~0 [L1353] ~blastFlag~0 := 4; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=6, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1357] COND FALSE !(~ret~0 <= 0) [L1362] FCALL call write~int(4432, { base: ~s!base, offset: 52 + ~s!offset }, 4); [L1363] FCALL call write~int(0, { base: ~s!base, offset: 64 + ~s!offset }, 4); [L1364] assume -2147483648 <= #t~nondet75 && #t~nondet75 <= 2147483647; [L1364] ~tmp___6~0 := #t~nondet75; [L1364] havoc #t~nondet75; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=6, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1365] COND FALSE !(0 == ~tmp___6~0) VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=6, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1605] FCALL call #t~mem128 := read~$Pointer$({ base: ~s!base, offset: 84 + ~s!offset }, 4); [L1605] FCALL call #t~mem129 := read~int({ base: #t~mem128!base, offset: 848 + #t~mem128!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem128!base=20506, #t~mem128!offset=0, #t~mem129=20542, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=6, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1605] COND FALSE !(0 == #t~mem129) [L1605] havoc #t~mem128; [L1605] havoc #t~mem129; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=6, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1634] ~skip~0 := 0; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=6, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1131-L1635] COND FALSE !(false) VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=6, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1133] FCALL call #t~mem22 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); [L1133] ~state~0 := #t~mem22; [L1133] havoc #t~mem22; [L1134] FCALL call #t~mem23 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem23=4432, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=6, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1134] COND FALSE !(12292 == #t~mem23) [L1134] havoc #t~mem23; [L1137] FCALL call #t~mem24 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem24=4432, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=6, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1137] COND FALSE !(16384 == #t~mem24) [L1137] havoc #t~mem24; [L1140] FCALL call #t~mem25 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem25=4432, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=6, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1140] COND FALSE !(4096 == #t~mem25) [L1140] havoc #t~mem25; [L1143] FCALL call #t~mem26 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem26=4432, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=6, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1143] COND FALSE !(20480 == #t~mem26) [L1143] havoc #t~mem26; [L1146] FCALL call #t~mem27 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem27=4432, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=6, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1146] COND FALSE !(4099 == #t~mem27) [L1146] havoc #t~mem27; [L1149] FCALL call #t~mem28 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem28=4432, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=6, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1149] COND FALSE !(4368 == #t~mem28) [L1149] havoc #t~mem28; [L1152] FCALL call #t~mem29 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem29=4432, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=6, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1152] COND FALSE !(4369 == #t~mem29) [L1152] havoc #t~mem29; [L1155] FCALL call #t~mem30 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem30=4432, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=6, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1155] COND FALSE !(4384 == #t~mem30) [L1155] havoc #t~mem30; [L1158] FCALL call #t~mem31 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem31=4432, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=6, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1158] COND FALSE !(4385 == #t~mem31) [L1158] havoc #t~mem31; [L1161] FCALL call #t~mem32 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem32=4432, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=6, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1161] COND FALSE !(4400 == #t~mem32) [L1161] havoc #t~mem32; [L1164] FCALL call #t~mem33 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem33=4432, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=6, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1164] COND FALSE !(4401 == #t~mem33) [L1164] havoc #t~mem33; [L1167] FCALL call #t~mem34 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem34=4432, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=6, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1167] COND FALSE !(4416 == #t~mem34) [L1167] havoc #t~mem34; [L1170] FCALL call #t~mem35 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem35=4432, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=6, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1170] COND FALSE !(4417 == #t~mem35) [L1170] havoc #t~mem35; [L1173] FCALL call #t~mem36 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem36=4432, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=6, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1173] COND TRUE 4432 == #t~mem36 [L1173] havoc #t~mem36; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=6, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1374] assume -2147483648 <= #t~nondet76 && #t~nondet76 <= 2147483647; [L1374] ~ret~0 := #t~nondet76; [L1374] havoc #t~nondet76; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1375] COND FALSE !(5 == ~blastFlag~0) VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1380] COND FALSE !(~ret~0 <= 0) [L1385] FCALL call write~int(4448, { base: ~s!base, offset: 52 + ~s!offset }, 4); [L1386] FCALL call write~int(0, { base: ~s!base, offset: 64 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1605] FCALL call #t~mem128 := read~$Pointer$({ base: ~s!base, offset: 84 + ~s!offset }, 4); [L1605] FCALL call #t~mem129 := read~int({ base: #t~mem128!base, offset: 848 + #t~mem128!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem128!base=20506, #t~mem128!offset=0, #t~mem129=20542, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1605] COND FALSE !(0 == #t~mem129) [L1605] havoc #t~mem128; [L1605] havoc #t~mem129; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1634] ~skip~0 := 0; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1131-L1635] COND FALSE !(false) VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1133] FCALL call #t~mem22 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); [L1133] ~state~0 := #t~mem22; [L1133] havoc #t~mem22; [L1134] FCALL call #t~mem23 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem23=4448, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1134] COND FALSE !(12292 == #t~mem23) [L1134] havoc #t~mem23; [L1137] FCALL call #t~mem24 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem24=4448, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1137] COND FALSE !(16384 == #t~mem24) [L1137] havoc #t~mem24; [L1140] FCALL call #t~mem25 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem25=4448, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1140] COND FALSE !(4096 == #t~mem25) [L1140] havoc #t~mem25; [L1143] FCALL call #t~mem26 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem26=4448, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1143] COND FALSE !(20480 == #t~mem26) [L1143] havoc #t~mem26; [L1146] FCALL call #t~mem27 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem27=4448, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1146] COND FALSE !(4099 == #t~mem27) [L1146] havoc #t~mem27; [L1149] FCALL call #t~mem28 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem28=4448, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1149] COND FALSE !(4368 == #t~mem28) [L1149] havoc #t~mem28; [L1152] FCALL call #t~mem29 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem29=4448, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1152] COND FALSE !(4369 == #t~mem29) [L1152] havoc #t~mem29; [L1155] FCALL call #t~mem30 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem30=4448, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1155] COND FALSE !(4384 == #t~mem30) [L1155] havoc #t~mem30; [L1158] FCALL call #t~mem31 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem31=4448, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1158] COND FALSE !(4385 == #t~mem31) [L1158] havoc #t~mem31; [L1161] FCALL call #t~mem32 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem32=4448, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1161] COND FALSE !(4400 == #t~mem32) [L1161] havoc #t~mem32; [L1164] FCALL call #t~mem33 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem33=4448, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1164] COND FALSE !(4401 == #t~mem33) [L1164] havoc #t~mem33; [L1167] FCALL call #t~mem34 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem34=4448, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1167] COND FALSE !(4416 == #t~mem34) [L1167] havoc #t~mem34; [L1170] FCALL call #t~mem35 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem35=4448, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1170] COND FALSE !(4417 == #t~mem35) [L1170] havoc #t~mem35; [L1173] FCALL call #t~mem36 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem36=4448, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1173] COND FALSE !(4432 == #t~mem36) [L1173] havoc #t~mem36; [L1176] FCALL call #t~mem37 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem37=4448, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1176] COND FALSE !(4433 == #t~mem37) [L1176] havoc #t~mem37; [L1179] FCALL call #t~mem38 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem38=4448, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1179] COND TRUE 4448 == #t~mem38 [L1179] havoc #t~mem38; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1390] assume -2147483648 <= #t~nondet77 && #t~nondet77 <= 2147483647; [L1390] ~ret~0 := #t~nondet77; [L1390] havoc #t~nondet77; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=0, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1391] COND TRUE 4 == ~blastFlag~0 VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=0, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1646] assert false; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=0, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [?] CALL call ULTIMATE.init(); VAL [#NULL!base=20507, #NULL!offset=20535, old(#NULL!base)=20507, old(#NULL!offset)=20535, old(~#SSLv3_client_data~0!base)=20492, old(~#SSLv3_client_data~0!offset)=20488, old(~init~0)=20541, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=20488, ~init~0=20541] [?] #NULL := { base: 0, offset: 0 }; [?] #valid[0] := 0; [L1042] ~init~0 := 1; [L1043] FCALL call ~#SSLv3_client_data~0 := #Ultimate.alloc(100); [L1043] FCALL call write~init~int(0, { base: ~#SSLv3_client_data~0!base, offset: ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 4 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 8 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 12 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 16 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 20 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 24 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 28 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 32 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 36 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 40 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 44 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 48 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 52 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 56 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 60 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 64 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 68 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 72 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 76 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 80 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 84 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 88 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 92 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 96 + ~#SSLv3_client_data~0!offset }, 4); VAL [#NULL!base=0, #NULL!offset=0, old(#NULL!base)=20507, old(#NULL!offset)=20535, old(~#SSLv3_client_data~0!base)=20492, old(~#SSLv3_client_data~0!offset)=20488, old(~init~0)=20541, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~init~0=1] [?] RET call ULTIMATE.init(); VAL [#NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~init~0=1] [?] CALL call #t~ret139 := main(); VAL [#NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~init~0=1] [L1065] FCALL call #t~malloc3 := #Ultimate.alloc(248); [L1065] ~s~0 := #t~malloc3; [L1069] FCALL call #t~malloc4 := #Ultimate.alloc(899); [L1069] FCALL call write~$Pointer$(#t~malloc4, { base: ~s~0!base, offset: 84 + ~s~0!offset }, 4); [L1070] FCALL call #t~malloc5 := #Ultimate.alloc(232); [L1070] FCALL call write~$Pointer$(#t~malloc5, { base: ~s~0!base, offset: 204 + ~s~0!offset }, 4); [L1071] FCALL call #t~malloc6 := #Ultimate.alloc(200); [L1071] FCALL call write~$Pointer$(#t~malloc6, { base: ~s~0!base, offset: 176 + ~s~0!offset }, 4); [L1072] FCALL call write~int(12292, { base: ~s~0!base, offset: 52 + ~s~0!offset }, 4); [L1073] assume -2147483648 <= #t~nondet7 && #t~nondet7 <= 2147483647; [L1073] FCALL call write~int(#t~nondet7, { base: ~s~0!base, offset: ~s~0!offset }, 4); [L1073] havoc #t~nondet7; VAL [#NULL!base=0, #NULL!offset=0, #t~malloc3!base=20501, #t~malloc3!offset=0, #t~malloc4!base=20506, #t~malloc4!offset=0, #t~malloc5!base=20521, #t~malloc5!offset=0, #t~malloc6!base=20484, #t~malloc6!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~init~0=1, ~s~0!base=20501, ~s~0!offset=0] [L1074] CALL call #t~ret8 := ssl3_connect(~s~0); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~init~0=1] [L1079-L1648] ~s := #in~s; [L1080] ~buf~0 := #t~nondet9; [L1080] havoc #t~nondet9; [L1081] havoc ~tmp~2; [L1082] havoc ~l~0; [L1083] havoc ~num1~0; [L1084] havoc ~cb~0; [L1085] havoc ~ret~0; [L1086] havoc ~new_state~0; [L1087] havoc ~state~0; [L1088] havoc ~skip~0; [L1089] ~tmp___0~1 := #t~nondet10; [L1089] havoc #t~nondet10; [L1090] assume -2147483648 <= #t~nondet11 && #t~nondet11 <= 2147483647; [L1090] ~tmp___1~0 := #t~nondet11; [L1090] havoc #t~nondet11; [L1091] assume -2147483648 <= #t~nondet12 && #t~nondet12 <= 2147483647; [L1091] ~tmp___2~0 := #t~nondet12; [L1091] havoc #t~nondet12; [L1092] havoc ~tmp___3~0; [L1093] havoc ~tmp___4~0; [L1094] havoc ~tmp___5~0; [L1095] havoc ~tmp___6~0; [L1096] havoc ~tmp___7~0; [L1097] havoc ~tmp___8~0; [L1098] havoc ~tmp___9~0; [L1100] havoc ~blastFlag~0; [L1103] ~blastFlag~0 := 0; [L1104] assume -2147483648 <= #t~nondet13 && #t~nondet13 <= 2147483647; [L1104] FCALL call write~int(#t~nondet13, { base: ~s!base, offset: 92 + ~s!offset }, 4); [L1104] havoc #t~nondet13; [L1105] FCALL call write~int(12292, { base: ~s!base, offset: 52 + ~s!offset }, 4); [L1106] assume -2147483648 <= #t~nondet14 && #t~nondet14 <= 2147483647; [L1106] ~tmp~2 := #t~nondet14; [L1106] havoc #t~nondet14; [L1107] ~cb~0 := { base: 0, offset: 0 }; [L1108] ~ret~0 := -1; [L1109] ~skip~0 := 0; [L1110] FCALL call write~int(0, ~tmp___0~1, 4); [L1111] FCALL call #t~mem15 := read~$Pointer$({ base: ~s!base, offset: 192 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem15!base=1, #t~mem15!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=0, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1111] COND TRUE 0 != (#t~mem15!base + #t~mem15!offset) % 4294967296 [L1111] havoc #t~mem15; [L1112] FCALL call #t~mem16 := read~$Pointer$({ base: ~s!base, offset: 192 + ~s!offset }, 4); [L1112] ~cb~0 := #t~mem16; [L1112] havoc #t~mem16; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1120] FCALL call #t~mem21 := read~int({ base: ~s!base, offset: 28 + ~s!offset }, 4); [L1120] FCALL call write~int(1 + #t~mem21, { base: ~s!base, offset: 28 + ~s!offset }, 4); [L1120] havoc #t~mem21; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1121-L1129] COND FALSE !(0 != ~bitwiseAnd(~tmp___1~0, 12288)) VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1131-L1635] COND FALSE !(false) VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1133] FCALL call #t~mem22 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); [L1133] ~state~0 := #t~mem22; [L1133] havoc #t~mem22; [L1134] FCALL call #t~mem23 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem23=12292, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1134] COND TRUE 12292 == #t~mem23 [L1134] havoc #t~mem23; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1237] FCALL call write~int(1, { base: ~s!base, offset: 40 + ~s!offset }, 4); [L1238] FCALL call write~int(4096, { base: ~s!base, offset: 52 + ~s!offset }, 4); [L1239] FCALL call #t~mem56 := read~$Pointer$({ base: ~s!base, offset: 204 + ~s!offset }, 4); [L1239] FCALL call #t~mem57 := read~int({ base: #t~mem56!base, offset: 64 + #t~mem56!offset }, 4); [L1239] FCALL call write~int(1 + #t~mem57, { base: #t~mem56!base, offset: 64 + #t~mem56!offset }, 4); [L1239] havoc #t~mem56; [L1239] havoc #t~mem57; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1244] FCALL call write~int(0, { base: ~s!base, offset: 36 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1245] COND TRUE 0 != (~cb~0!base + ~cb~0!offset) % 4294967296 VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1250] FCALL call #t~mem58 := read~int({ base: ~s!base, offset: ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem58=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1250] COND FALSE !(768 != ~bitwiseAnd(#t~mem58, 65280)) [L1250] havoc #t~mem58; [L1256] FCALL call write~int(4096, { base: ~s!base, offset: 4 + ~s!offset }, 4); [L1257] FCALL call #t~mem59 := read~$Pointer$({ base: ~s!base, offset: 60 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem59!base=-1, #t~mem59!offset=2, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1257] COND FALSE !(0 == (#t~mem59!base + #t~mem59!offset) % 4294967296) [L1257] havoc #t~mem59; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1269] assume -2147483648 <= #t~nondet61 && #t~nondet61 <= 2147483647; [L1269] ~tmp___4~0 := #t~nondet61; [L1269] havoc #t~nondet61; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp~2=0] [L1270] COND FALSE !(0 == ~tmp___4~0) [L1276] assume -2147483648 <= #t~nondet62 && #t~nondet62 <= 2147483647; [L1276] ~tmp___5~0 := #t~nondet62; [L1276] havoc #t~nondet62; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1277] COND FALSE !(0 == ~tmp___5~0) [L1283] FCALL call write~int(4368, { base: ~s!base, offset: 52 + ~s!offset }, 4); [L1284] FCALL call #t~mem63 := read~$Pointer$({ base: ~s!base, offset: 204 + ~s!offset }, 4); [L1284] FCALL call #t~mem64 := read~int({ base: #t~mem63!base, offset: 60 + #t~mem63!offset }, 4); [L1284] FCALL call write~int(1 + #t~mem64, { base: #t~mem63!base, offset: 60 + #t~mem63!offset }, 4); [L1284] havoc #t~mem63; [L1284] havoc #t~mem64; [L1285] FCALL call write~int(0, { base: ~s!base, offset: 64 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1605] FCALL call #t~mem128 := read~$Pointer$({ base: ~s!base, offset: 84 + ~s!offset }, 4); [L1605] FCALL call #t~mem129 := read~int({ base: #t~mem128!base, offset: 848 + #t~mem128!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem128!base=20506, #t~mem128!offset=0, #t~mem129=20542, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1605] COND FALSE !(0 == #t~mem129) [L1605] havoc #t~mem128; [L1605] havoc #t~mem129; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1634] ~skip~0 := 0; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1131-L1635] COND FALSE !(false) VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1133] FCALL call #t~mem22 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); [L1133] ~state~0 := #t~mem22; [L1133] havoc #t~mem22; [L1134] FCALL call #t~mem23 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem23=4368, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1134] COND FALSE !(12292 == #t~mem23) [L1134] havoc #t~mem23; [L1137] FCALL call #t~mem24 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem24=4368, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1137] COND FALSE !(16384 == #t~mem24) [L1137] havoc #t~mem24; [L1140] FCALL call #t~mem25 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem25=4368, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1140] COND FALSE !(4096 == #t~mem25) [L1140] havoc #t~mem25; [L1143] FCALL call #t~mem26 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem26=4368, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1143] COND FALSE !(20480 == #t~mem26) [L1143] havoc #t~mem26; [L1146] FCALL call #t~mem27 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem27=4368, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1146] COND FALSE !(4099 == #t~mem27) [L1146] havoc #t~mem27; [L1149] FCALL call #t~mem28 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem28=4368, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1149] COND TRUE 4368 == #t~mem28 [L1149] havoc #t~mem28; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1289] FCALL call write~int(0, { base: ~s!base, offset: 48 + ~s!offset }, 4); [L1290] assume -2147483648 <= #t~nondet65 && #t~nondet65 <= 2147483647; [L1290] ~ret~0 := #t~nondet65; [L1290] havoc #t~nondet65; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1291] COND TRUE 0 == ~blastFlag~0 [L1292] ~blastFlag~0 := 1; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1296] COND FALSE !(~ret~0 <= 0) [L1301] FCALL call write~int(4384, { base: ~s!base, offset: 52 + ~s!offset }, 4); [L1302] FCALL call write~int(0, { base: ~s!base, offset: 64 + ~s!offset }, 4); [L1303] FCALL call #t~mem66 := read~$Pointer$({ base: ~s!base, offset: 20 + ~s!offset }, 4); [L1303] FCALL call #t~mem67 := read~$Pointer$({ base: ~s!base, offset: 16 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem66!base=0, #t~mem66!offset=1, #t~mem67!base=0, #t~mem67!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1303] COND TRUE (#t~mem66!base + #t~mem66!offset) % 4294967296 != (#t~mem67!base + #t~mem67!offset) % 4294967296 [L1303] havoc #t~mem66; [L1303] havoc #t~mem67; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1605] FCALL call #t~mem128 := read~$Pointer$({ base: ~s!base, offset: 84 + ~s!offset }, 4); [L1605] FCALL call #t~mem129 := read~int({ base: #t~mem128!base, offset: 848 + #t~mem128!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem128!base=20506, #t~mem128!offset=0, #t~mem129=20542, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1605] COND FALSE !(0 == #t~mem129) [L1605] havoc #t~mem128; [L1605] havoc #t~mem129; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1634] ~skip~0 := 0; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1131-L1635] COND FALSE !(false) VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1133] FCALL call #t~mem22 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); [L1133] ~state~0 := #t~mem22; [L1133] havoc #t~mem22; [L1134] FCALL call #t~mem23 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem23=4384, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1134] COND FALSE !(12292 == #t~mem23) [L1134] havoc #t~mem23; [L1137] FCALL call #t~mem24 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem24=4384, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1137] COND FALSE !(16384 == #t~mem24) [L1137] havoc #t~mem24; [L1140] FCALL call #t~mem25 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem25=4384, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1140] COND FALSE !(4096 == #t~mem25) [L1140] havoc #t~mem25; [L1143] FCALL call #t~mem26 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem26=4384, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1143] COND FALSE !(20480 == #t~mem26) [L1143] havoc #t~mem26; [L1146] FCALL call #t~mem27 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem27=4384, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1146] COND FALSE !(4099 == #t~mem27) [L1146] havoc #t~mem27; [L1149] FCALL call #t~mem28 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem28=4384, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1149] COND FALSE !(4368 == #t~mem28) [L1149] havoc #t~mem28; [L1152] FCALL call #t~mem29 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem29=4384, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1152] COND FALSE !(4369 == #t~mem29) [L1152] havoc #t~mem29; [L1155] FCALL call #t~mem30 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem30=4384, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1155] COND TRUE 4384 == #t~mem30 [L1155] havoc #t~mem30; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1311] assume -2147483648 <= #t~nondet68 && #t~nondet68 <= 2147483647; [L1311] ~ret~0 := #t~nondet68; [L1311] havoc #t~nondet68; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1312] COND TRUE 1 == ~blastFlag~0 [L1313] ~blastFlag~0 := 2; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1317] COND FALSE !(~ret~0 <= 0) [L1322] FCALL call #t~mem69 := read~int({ base: ~s!base, offset: 92 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem69=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1322-L1326] COND FALSE !(0 != #t~mem69) [L1322] havoc #t~mem69; [L1325] FCALL call write~int(4400, { base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1327] FCALL call write~int(0, { base: ~s!base, offset: 64 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1605] FCALL call #t~mem128 := read~$Pointer$({ base: ~s!base, offset: 84 + ~s!offset }, 4); [L1605] FCALL call #t~mem129 := read~int({ base: #t~mem128!base, offset: 848 + #t~mem128!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem128!base=20506, #t~mem128!offset=0, #t~mem129=20542, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1605] COND FALSE !(0 == #t~mem129) [L1605] havoc #t~mem128; [L1605] havoc #t~mem129; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1634] ~skip~0 := 0; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1131-L1635] COND FALSE !(false) VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1133] FCALL call #t~mem22 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); [L1133] ~state~0 := #t~mem22; [L1133] havoc #t~mem22; [L1134] FCALL call #t~mem23 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem23=4400, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1134] COND FALSE !(12292 == #t~mem23) [L1134] havoc #t~mem23; [L1137] FCALL call #t~mem24 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem24=4400, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1137] COND FALSE !(16384 == #t~mem24) [L1137] havoc #t~mem24; [L1140] FCALL call #t~mem25 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem25=4400, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1140] COND FALSE !(4096 == #t~mem25) [L1140] havoc #t~mem25; [L1143] FCALL call #t~mem26 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem26=4400, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1143] COND FALSE !(20480 == #t~mem26) [L1143] havoc #t~mem26; [L1146] FCALL call #t~mem27 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem27=4400, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1146] COND FALSE !(4099 == #t~mem27) [L1146] havoc #t~mem27; [L1149] FCALL call #t~mem28 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem28=4400, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1149] COND FALSE !(4368 == #t~mem28) [L1149] havoc #t~mem28; [L1152] FCALL call #t~mem29 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem29=4400, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1152] COND FALSE !(4369 == #t~mem29) [L1152] havoc #t~mem29; [L1155] FCALL call #t~mem30 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem30=4400, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1155] COND FALSE !(4384 == #t~mem30) [L1155] havoc #t~mem30; [L1158] FCALL call #t~mem31 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem31=4400, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1158] COND FALSE !(4385 == #t~mem31) [L1158] havoc #t~mem31; [L1161] FCALL call #t~mem32 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem32=4400, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1161] COND TRUE 4400 == #t~mem32 [L1161] havoc #t~mem32; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1331] FCALL call #t~mem70 := read~$Pointer$({ base: ~s!base, offset: 84 + ~s!offset }, 4); [L1331] FCALL call #t~mem71 := read~$Pointer$({ base: #t~mem70!base, offset: 836 + #t~mem70!offset }, 4); [L1331] FCALL call #t~mem72 := read~int({ base: #t~mem71!base, offset: 12 + #t~mem71!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem70!base=20506, #t~mem70!offset=0, #t~mem71!base=20502, #t~mem71!offset=0, #t~mem72=20537, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1331-L1345] COND FALSE !(0 != ~bitwiseAnd(#t~mem72, 256) % 4294967296) [L1331] havoc #t~mem71; [L1331] havoc #t~mem70; [L1331] havoc #t~mem72; [L1334] assume -2147483648 <= #t~nondet73 && #t~nondet73 <= 2147483647; [L1334] ~ret~0 := #t~nondet73; [L1334] havoc #t~nondet73; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=5, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1335] COND TRUE 2 == ~blastFlag~0 [L1336] ~blastFlag~0 := 3; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=5, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1340] COND FALSE !(~ret~0 <= 0) VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=5, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1346] FCALL call write~int(4416, { base: ~s!base, offset: 52 + ~s!offset }, 4); [L1347] FCALL call write~int(0, { base: ~s!base, offset: 64 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=5, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1605] FCALL call #t~mem128 := read~$Pointer$({ base: ~s!base, offset: 84 + ~s!offset }, 4); [L1605] FCALL call #t~mem129 := read~int({ base: #t~mem128!base, offset: 848 + #t~mem128!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem128!base=20506, #t~mem128!offset=0, #t~mem129=20542, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=5, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1605] COND FALSE !(0 == #t~mem129) [L1605] havoc #t~mem128; [L1605] havoc #t~mem129; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=5, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1634] ~skip~0 := 0; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=5, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1131-L1635] COND FALSE !(false) VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=5, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1133] FCALL call #t~mem22 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); [L1133] ~state~0 := #t~mem22; [L1133] havoc #t~mem22; [L1134] FCALL call #t~mem23 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem23=4416, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=5, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1134] COND FALSE !(12292 == #t~mem23) [L1134] havoc #t~mem23; [L1137] FCALL call #t~mem24 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem24=4416, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=5, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1137] COND FALSE !(16384 == #t~mem24) [L1137] havoc #t~mem24; [L1140] FCALL call #t~mem25 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem25=4416, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=5, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1140] COND FALSE !(4096 == #t~mem25) [L1140] havoc #t~mem25; [L1143] FCALL call #t~mem26 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem26=4416, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=5, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1143] COND FALSE !(20480 == #t~mem26) [L1143] havoc #t~mem26; [L1146] FCALL call #t~mem27 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem27=4416, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=5, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1146] COND FALSE !(4099 == #t~mem27) [L1146] havoc #t~mem27; [L1149] FCALL call #t~mem28 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem28=4416, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=5, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1149] COND FALSE !(4368 == #t~mem28) [L1149] havoc #t~mem28; [L1152] FCALL call #t~mem29 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem29=4416, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=5, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1152] COND FALSE !(4369 == #t~mem29) [L1152] havoc #t~mem29; [L1155] FCALL call #t~mem30 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem30=4416, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=5, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1155] COND FALSE !(4384 == #t~mem30) [L1155] havoc #t~mem30; [L1158] FCALL call #t~mem31 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem31=4416, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=5, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1158] COND FALSE !(4385 == #t~mem31) [L1158] havoc #t~mem31; [L1161] FCALL call #t~mem32 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem32=4416, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=5, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1161] COND FALSE !(4400 == #t~mem32) [L1161] havoc #t~mem32; [L1164] FCALL call #t~mem33 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem33=4416, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=5, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1164] COND FALSE !(4401 == #t~mem33) [L1164] havoc #t~mem33; [L1167] FCALL call #t~mem34 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem34=4416, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=5, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1167] COND TRUE 4416 == #t~mem34 [L1167] havoc #t~mem34; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=5, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1351] assume -2147483648 <= #t~nondet74 && #t~nondet74 <= 2147483647; [L1351] ~ret~0 := #t~nondet74; [L1351] havoc #t~nondet74; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=6, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1352] COND TRUE 3 == ~blastFlag~0 [L1353] ~blastFlag~0 := 4; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=6, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1357] COND FALSE !(~ret~0 <= 0) [L1362] FCALL call write~int(4432, { base: ~s!base, offset: 52 + ~s!offset }, 4); [L1363] FCALL call write~int(0, { base: ~s!base, offset: 64 + ~s!offset }, 4); [L1364] assume -2147483648 <= #t~nondet75 && #t~nondet75 <= 2147483647; [L1364] ~tmp___6~0 := #t~nondet75; [L1364] havoc #t~nondet75; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=6, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1365] COND FALSE !(0 == ~tmp___6~0) VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=6, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1605] FCALL call #t~mem128 := read~$Pointer$({ base: ~s!base, offset: 84 + ~s!offset }, 4); [L1605] FCALL call #t~mem129 := read~int({ base: #t~mem128!base, offset: 848 + #t~mem128!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem128!base=20506, #t~mem128!offset=0, #t~mem129=20542, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=6, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1605] COND FALSE !(0 == #t~mem129) [L1605] havoc #t~mem128; [L1605] havoc #t~mem129; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=6, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1634] ~skip~0 := 0; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=6, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1131-L1635] COND FALSE !(false) VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=6, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1133] FCALL call #t~mem22 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); [L1133] ~state~0 := #t~mem22; [L1133] havoc #t~mem22; [L1134] FCALL call #t~mem23 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem23=4432, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=6, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1134] COND FALSE !(12292 == #t~mem23) [L1134] havoc #t~mem23; [L1137] FCALL call #t~mem24 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem24=4432, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=6, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1137] COND FALSE !(16384 == #t~mem24) [L1137] havoc #t~mem24; [L1140] FCALL call #t~mem25 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem25=4432, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=6, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1140] COND FALSE !(4096 == #t~mem25) [L1140] havoc #t~mem25; [L1143] FCALL call #t~mem26 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem26=4432, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=6, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1143] COND FALSE !(20480 == #t~mem26) [L1143] havoc #t~mem26; [L1146] FCALL call #t~mem27 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem27=4432, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=6, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1146] COND FALSE !(4099 == #t~mem27) [L1146] havoc #t~mem27; [L1149] FCALL call #t~mem28 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem28=4432, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=6, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1149] COND FALSE !(4368 == #t~mem28) [L1149] havoc #t~mem28; [L1152] FCALL call #t~mem29 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem29=4432, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=6, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1152] COND FALSE !(4369 == #t~mem29) [L1152] havoc #t~mem29; [L1155] FCALL call #t~mem30 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem30=4432, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=6, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1155] COND FALSE !(4384 == #t~mem30) [L1155] havoc #t~mem30; [L1158] FCALL call #t~mem31 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem31=4432, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=6, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1158] COND FALSE !(4385 == #t~mem31) [L1158] havoc #t~mem31; [L1161] FCALL call #t~mem32 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem32=4432, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=6, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1161] COND FALSE !(4400 == #t~mem32) [L1161] havoc #t~mem32; [L1164] FCALL call #t~mem33 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem33=4432, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=6, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1164] COND FALSE !(4401 == #t~mem33) [L1164] havoc #t~mem33; [L1167] FCALL call #t~mem34 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem34=4432, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=6, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1167] COND FALSE !(4416 == #t~mem34) [L1167] havoc #t~mem34; [L1170] FCALL call #t~mem35 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem35=4432, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=6, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1170] COND FALSE !(4417 == #t~mem35) [L1170] havoc #t~mem35; [L1173] FCALL call #t~mem36 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem36=4432, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=6, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1173] COND TRUE 4432 == #t~mem36 [L1173] havoc #t~mem36; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=6, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1374] assume -2147483648 <= #t~nondet76 && #t~nondet76 <= 2147483647; [L1374] ~ret~0 := #t~nondet76; [L1374] havoc #t~nondet76; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1375] COND FALSE !(5 == ~blastFlag~0) VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1380] COND FALSE !(~ret~0 <= 0) [L1385] FCALL call write~int(4448, { base: ~s!base, offset: 52 + ~s!offset }, 4); [L1386] FCALL call write~int(0, { base: ~s!base, offset: 64 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1605] FCALL call #t~mem128 := read~$Pointer$({ base: ~s!base, offset: 84 + ~s!offset }, 4); [L1605] FCALL call #t~mem129 := read~int({ base: #t~mem128!base, offset: 848 + #t~mem128!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem128!base=20506, #t~mem128!offset=0, #t~mem129=20542, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1605] COND FALSE !(0 == #t~mem129) [L1605] havoc #t~mem128; [L1605] havoc #t~mem129; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1634] ~skip~0 := 0; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1131-L1635] COND FALSE !(false) VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1133] FCALL call #t~mem22 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); [L1133] ~state~0 := #t~mem22; [L1133] havoc #t~mem22; [L1134] FCALL call #t~mem23 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem23=4448, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1134] COND FALSE !(12292 == #t~mem23) [L1134] havoc #t~mem23; [L1137] FCALL call #t~mem24 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem24=4448, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1137] COND FALSE !(16384 == #t~mem24) [L1137] havoc #t~mem24; [L1140] FCALL call #t~mem25 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem25=4448, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1140] COND FALSE !(4096 == #t~mem25) [L1140] havoc #t~mem25; [L1143] FCALL call #t~mem26 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem26=4448, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1143] COND FALSE !(20480 == #t~mem26) [L1143] havoc #t~mem26; [L1146] FCALL call #t~mem27 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem27=4448, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1146] COND FALSE !(4099 == #t~mem27) [L1146] havoc #t~mem27; [L1149] FCALL call #t~mem28 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem28=4448, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1149] COND FALSE !(4368 == #t~mem28) [L1149] havoc #t~mem28; [L1152] FCALL call #t~mem29 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem29=4448, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1152] COND FALSE !(4369 == #t~mem29) [L1152] havoc #t~mem29; [L1155] FCALL call #t~mem30 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem30=4448, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1155] COND FALSE !(4384 == #t~mem30) [L1155] havoc #t~mem30; [L1158] FCALL call #t~mem31 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem31=4448, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1158] COND FALSE !(4385 == #t~mem31) [L1158] havoc #t~mem31; [L1161] FCALL call #t~mem32 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem32=4448, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1161] COND FALSE !(4400 == #t~mem32) [L1161] havoc #t~mem32; [L1164] FCALL call #t~mem33 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem33=4448, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1164] COND FALSE !(4401 == #t~mem33) [L1164] havoc #t~mem33; [L1167] FCALL call #t~mem34 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem34=4448, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1167] COND FALSE !(4416 == #t~mem34) [L1167] havoc #t~mem34; [L1170] FCALL call #t~mem35 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem35=4448, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1170] COND FALSE !(4417 == #t~mem35) [L1170] havoc #t~mem35; [L1173] FCALL call #t~mem36 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem36=4448, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1173] COND FALSE !(4432 == #t~mem36) [L1173] havoc #t~mem36; [L1176] FCALL call #t~mem37 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem37=4448, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1176] COND FALSE !(4433 == #t~mem37) [L1176] havoc #t~mem37; [L1179] FCALL call #t~mem38 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem38=4448, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1179] COND TRUE 4448 == #t~mem38 [L1179] havoc #t~mem38; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1390] assume -2147483648 <= #t~nondet77 && #t~nondet77 <= 2147483647; [L1390] ~ret~0 := #t~nondet77; [L1390] havoc #t~nondet77; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=0, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1391] COND TRUE 4 == ~blastFlag~0 VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=0, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1646] assert false; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=0, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] ----- [2018-11-23 07:46:56,264 WARN L1272 BoogieBacktranslator]: Unfinished Backtranslation: IntegerLiteral 20492 could not be translated for associated CType STRUCT~~ssl_method_st?version~INT?ssl_new~*((*~SSL~0 ) : INT)?ssl_clear~*((*~SSL~0 ) : VOID)?ssl_free~*((*~SSL~0 ) : VOID)?ssl_accept~*((*~SSL~0 ) : INT)?ssl_connect~*((*~SSL~0 ) : INT)?ssl_read~*((*~SSL~0 *VOID INT ) : INT)?ssl_peek~*((*~SSL~0 *VOID INT ) : INT)?ssl_write~*((*~SSL~0 *VOID INT ) : INT)?ssl_shutdown~*((*~SSL~0 ) : INT)?ssl_renegotiate~*((*~SSL~0 ) : INT)?ssl_renegotiate_check~*((*~SSL~0 ) : INT)?ssl_ctrl~*((*~SSL~0 INT LONG *CHAR ) : LONG)?ssl_ctx_ctrl~*((*~SSL_CTX~0 INT LONG *CHAR ) : LONG)?get_cipher_by_char~*((*UCHAR ) : *~SSL_CIPHER~0)?put_cipher_by_char~*((*~SSL_CIPHER~0 *UCHAR ) : INT)?ssl_pending~*((*~SSL~0 ) : INT)?num_ciphers~*(() : INT)?get_cipher~*((UINT ) : *~SSL_CIPHER~0)?get_ssl_method~*((INT ) : *ssl_method_st)?get_timeout~*(() : LONG)?ssl3_enc~*ssl3_enc_method?ssl_version~*(() : INT)?ssl_callback_ctrl~*((*~SSL~0 INT *(() : VOID) ) : LONG)?ssl_ctx_callback_ctrl~*((*~SSL_CTX~0 INT *(() : VOID) ) : LONG)# [2018-11-23 07:46:56,280 WARN L1272 BoogieBacktranslator]: Unfinished Backtranslation: IntegerLiteral 20488 could not be translated for associated CType STRUCT~~ssl_method_st?version~INT?ssl_new~*((*~SSL~0 ) : INT)?ssl_clear~*((*~SSL~0 ) : VOID)?ssl_free~*((*~SSL~0 ) : VOID)?ssl_accept~*((*~SSL~0 ) : INT)?ssl_connect~*((*~SSL~0 ) : INT)?ssl_read~*((*~SSL~0 *VOID INT ) : INT)?ssl_peek~*((*~SSL~0 *VOID INT ) : INT)?ssl_write~*((*~SSL~0 *VOID INT ) : INT)?ssl_shutdown~*((*~SSL~0 ) : INT)?ssl_renegotiate~*((*~SSL~0 ) : INT)?ssl_renegotiate_check~*((*~SSL~0 ) : INT)?ssl_ctrl~*((*~SSL~0 INT LONG *CHAR ) : LONG)?ssl_ctx_ctrl~*((*~SSL_CTX~0 INT LONG *CHAR ) : LONG)?get_cipher_by_char~*((*UCHAR ) : *~SSL_CIPHER~0)?put_cipher_by_char~*((*~SSL_CIPHER~0 *UCHAR ) : INT)?ssl_pending~*((*~SSL~0 ) : INT)?num_ciphers~*(() : INT)?get_cipher~*((UINT ) : *~SSL_CIPHER~0)?get_ssl_method~*((INT ) : *ssl_method_st)?get_timeout~*(() : LONG)?ssl3_enc~*ssl3_enc_method?ssl_version~*(() : INT)?ssl_callback_ctrl~*((*~SSL~0 INT *(() : VOID) ) : LONG)?ssl_ctx_callback_ctrl~*((*~SSL_CTX~0 INT *(() : VOID) ) : LONG)# ----- class de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator.CACSL2BoogieBacktranslator [?] CALL call ULTIMATE.init(); VAL [#NULL!base=20507, #NULL!offset=20535, old(#NULL!base)=20507, old(#NULL!offset)=20535, old(~#SSLv3_client_data~0!base)=20492, old(~#SSLv3_client_data~0!offset)=20488, old(~init~0)=20541, ~#SSLv3_client_data~0!base=20492, ~#SSLv3_client_data~0!offset=20488, ~init~0=20541] [?] #NULL := { base: 0, offset: 0 }; [?] #valid[0] := 0; [L1042] ~init~0 := 1; [L1043] FCALL call ~#SSLv3_client_data~0 := #Ultimate.alloc(100); [L1043] FCALL call write~init~int(0, { base: ~#SSLv3_client_data~0!base, offset: ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 4 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 8 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 12 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 16 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 20 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 24 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 28 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 32 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 36 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 40 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 44 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 48 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 52 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 56 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 60 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 64 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 68 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 72 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 76 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 80 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 84 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 88 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 92 + ~#SSLv3_client_data~0!offset }, 4); [L1043] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#SSLv3_client_data~0!base, offset: 96 + ~#SSLv3_client_data~0!offset }, 4); VAL [#NULL!base=0, #NULL!offset=0, old(#NULL!base)=20507, old(#NULL!offset)=20535, old(~#SSLv3_client_data~0!base)=20492, old(~#SSLv3_client_data~0!offset)=20488, old(~init~0)=20541, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~init~0=1] [?] RET call ULTIMATE.init(); VAL [#NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~init~0=1] [?] CALL call #t~ret139 := main(); VAL [#NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~init~0=1] [L1065] FCALL call #t~malloc3 := #Ultimate.alloc(248); [L1065] ~s~0 := #t~malloc3; [L1069] FCALL call #t~malloc4 := #Ultimate.alloc(899); [L1069] FCALL call write~$Pointer$(#t~malloc4, { base: ~s~0!base, offset: 84 + ~s~0!offset }, 4); [L1070] FCALL call #t~malloc5 := #Ultimate.alloc(232); [L1070] FCALL call write~$Pointer$(#t~malloc5, { base: ~s~0!base, offset: 204 + ~s~0!offset }, 4); [L1071] FCALL call #t~malloc6 := #Ultimate.alloc(200); [L1071] FCALL call write~$Pointer$(#t~malloc6, { base: ~s~0!base, offset: 176 + ~s~0!offset }, 4); [L1072] FCALL call write~int(12292, { base: ~s~0!base, offset: 52 + ~s~0!offset }, 4); [L1073] assume -2147483648 <= #t~nondet7 && #t~nondet7 <= 2147483647; [L1073] FCALL call write~int(#t~nondet7, { base: ~s~0!base, offset: ~s~0!offset }, 4); [L1073] havoc #t~nondet7; VAL [#NULL!base=0, #NULL!offset=0, #t~malloc3!base=20501, #t~malloc3!offset=0, #t~malloc4!base=20506, #t~malloc4!offset=0, #t~malloc5!base=20521, #t~malloc5!offset=0, #t~malloc6!base=20484, #t~malloc6!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~init~0=1, ~s~0!base=20501, ~s~0!offset=0] [L1074] CALL call #t~ret8 := ssl3_connect(~s~0); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~init~0=1] [L1079-L1648] ~s := #in~s; [L1080] ~buf~0 := #t~nondet9; [L1080] havoc #t~nondet9; [L1081] havoc ~tmp~2; [L1082] havoc ~l~0; [L1083] havoc ~num1~0; [L1084] havoc ~cb~0; [L1085] havoc ~ret~0; [L1086] havoc ~new_state~0; [L1087] havoc ~state~0; [L1088] havoc ~skip~0; [L1089] ~tmp___0~1 := #t~nondet10; [L1089] havoc #t~nondet10; [L1090] assume -2147483648 <= #t~nondet11 && #t~nondet11 <= 2147483647; [L1090] ~tmp___1~0 := #t~nondet11; [L1090] havoc #t~nondet11; [L1091] assume -2147483648 <= #t~nondet12 && #t~nondet12 <= 2147483647; [L1091] ~tmp___2~0 := #t~nondet12; [L1091] havoc #t~nondet12; [L1092] havoc ~tmp___3~0; [L1093] havoc ~tmp___4~0; [L1094] havoc ~tmp___5~0; [L1095] havoc ~tmp___6~0; [L1096] havoc ~tmp___7~0; [L1097] havoc ~tmp___8~0; [L1098] havoc ~tmp___9~0; [L1100] havoc ~blastFlag~0; [L1103] ~blastFlag~0 := 0; [L1104] assume -2147483648 <= #t~nondet13 && #t~nondet13 <= 2147483647; [L1104] FCALL call write~int(#t~nondet13, { base: ~s!base, offset: 92 + ~s!offset }, 4); [L1104] havoc #t~nondet13; [L1105] FCALL call write~int(12292, { base: ~s!base, offset: 52 + ~s!offset }, 4); [L1106] assume -2147483648 <= #t~nondet14 && #t~nondet14 <= 2147483647; [L1106] ~tmp~2 := #t~nondet14; [L1106] havoc #t~nondet14; [L1107] ~cb~0 := { base: 0, offset: 0 }; [L1108] ~ret~0 := -1; [L1109] ~skip~0 := 0; [L1110] FCALL call write~int(0, ~tmp___0~1, 4); [L1111] FCALL call #t~mem15 := read~$Pointer$({ base: ~s!base, offset: 192 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem15!base=1, #t~mem15!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=0, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1111] COND TRUE 0 != (#t~mem15!base + #t~mem15!offset) % 4294967296 [L1111] havoc #t~mem15; [L1112] FCALL call #t~mem16 := read~$Pointer$({ base: ~s!base, offset: 192 + ~s!offset }, 4); [L1112] ~cb~0 := #t~mem16; [L1112] havoc #t~mem16; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1120] FCALL call #t~mem21 := read~int({ base: ~s!base, offset: 28 + ~s!offset }, 4); [L1120] FCALL call write~int(1 + #t~mem21, { base: ~s!base, offset: 28 + ~s!offset }, 4); [L1120] havoc #t~mem21; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1121-L1129] COND FALSE !(0 != ~bitwiseAnd(~tmp___1~0, 12288)) VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1131-L1635] COND FALSE !(false) VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1133] FCALL call #t~mem22 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); [L1133] ~state~0 := #t~mem22; [L1133] havoc #t~mem22; [L1134] FCALL call #t~mem23 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem23=12292, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1134] COND TRUE 12292 == #t~mem23 [L1134] havoc #t~mem23; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1237] FCALL call write~int(1, { base: ~s!base, offset: 40 + ~s!offset }, 4); [L1238] FCALL call write~int(4096, { base: ~s!base, offset: 52 + ~s!offset }, 4); [L1239] FCALL call #t~mem56 := read~$Pointer$({ base: ~s!base, offset: 204 + ~s!offset }, 4); [L1239] FCALL call #t~mem57 := read~int({ base: #t~mem56!base, offset: 64 + #t~mem56!offset }, 4); [L1239] FCALL call write~int(1 + #t~mem57, { base: #t~mem56!base, offset: 64 + #t~mem56!offset }, 4); [L1239] havoc #t~mem56; [L1239] havoc #t~mem57; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1244] FCALL call write~int(0, { base: ~s!base, offset: 36 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1245] COND TRUE 0 != (~cb~0!base + ~cb~0!offset) % 4294967296 VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1250] FCALL call #t~mem58 := read~int({ base: ~s!base, offset: ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem58=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1250] COND FALSE !(768 != ~bitwiseAnd(#t~mem58, 65280)) [L1250] havoc #t~mem58; [L1256] FCALL call write~int(4096, { base: ~s!base, offset: 4 + ~s!offset }, 4); [L1257] FCALL call #t~mem59 := read~$Pointer$({ base: ~s!base, offset: 60 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem59!base=-1, #t~mem59!offset=2, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1257] COND FALSE !(0 == (#t~mem59!base + #t~mem59!offset) % 4294967296) [L1257] havoc #t~mem59; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp~2=0] [L1269] assume -2147483648 <= #t~nondet61 && #t~nondet61 <= 2147483647; [L1269] ~tmp___4~0 := #t~nondet61; [L1269] havoc #t~nondet61; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp~2=0] [L1270] COND FALSE !(0 == ~tmp___4~0) [L1276] assume -2147483648 <= #t~nondet62 && #t~nondet62 <= 2147483647; [L1276] ~tmp___5~0 := #t~nondet62; [L1276] havoc #t~nondet62; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1277] COND FALSE !(0 == ~tmp___5~0) [L1283] FCALL call write~int(4368, { base: ~s!base, offset: 52 + ~s!offset }, 4); [L1284] FCALL call #t~mem63 := read~$Pointer$({ base: ~s!base, offset: 204 + ~s!offset }, 4); [L1284] FCALL call #t~mem64 := read~int({ base: #t~mem63!base, offset: 60 + #t~mem63!offset }, 4); [L1284] FCALL call write~int(1 + #t~mem64, { base: #t~mem63!base, offset: 60 + #t~mem63!offset }, 4); [L1284] havoc #t~mem63; [L1284] havoc #t~mem64; [L1285] FCALL call write~int(0, { base: ~s!base, offset: 64 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1605] FCALL call #t~mem128 := read~$Pointer$({ base: ~s!base, offset: 84 + ~s!offset }, 4); [L1605] FCALL call #t~mem129 := read~int({ base: #t~mem128!base, offset: 848 + #t~mem128!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem128!base=20506, #t~mem128!offset=0, #t~mem129=20542, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1605] COND FALSE !(0 == #t~mem129) [L1605] havoc #t~mem128; [L1605] havoc #t~mem129; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1634] ~skip~0 := 0; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1131-L1635] COND FALSE !(false) VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=12292, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1133] FCALL call #t~mem22 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); [L1133] ~state~0 := #t~mem22; [L1133] havoc #t~mem22; [L1134] FCALL call #t~mem23 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem23=4368, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1134] COND FALSE !(12292 == #t~mem23) [L1134] havoc #t~mem23; [L1137] FCALL call #t~mem24 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem24=4368, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1137] COND FALSE !(16384 == #t~mem24) [L1137] havoc #t~mem24; [L1140] FCALL call #t~mem25 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem25=4368, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1140] COND FALSE !(4096 == #t~mem25) [L1140] havoc #t~mem25; [L1143] FCALL call #t~mem26 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem26=4368, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1143] COND FALSE !(20480 == #t~mem26) [L1143] havoc #t~mem26; [L1146] FCALL call #t~mem27 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem27=4368, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1146] COND FALSE !(4099 == #t~mem27) [L1146] havoc #t~mem27; [L1149] FCALL call #t~mem28 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem28=4368, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1149] COND TRUE 4368 == #t~mem28 [L1149] havoc #t~mem28; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=-1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1289] FCALL call write~int(0, { base: ~s!base, offset: 48 + ~s!offset }, 4); [L1290] assume -2147483648 <= #t~nondet65 && #t~nondet65 <= 2147483647; [L1290] ~ret~0 := #t~nondet65; [L1290] havoc #t~nondet65; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=0, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1291] COND TRUE 0 == ~blastFlag~0 [L1292] ~blastFlag~0 := 1; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1296] COND FALSE !(~ret~0 <= 0) [L1301] FCALL call write~int(4384, { base: ~s!base, offset: 52 + ~s!offset }, 4); [L1302] FCALL call write~int(0, { base: ~s!base, offset: 64 + ~s!offset }, 4); [L1303] FCALL call #t~mem66 := read~$Pointer$({ base: ~s!base, offset: 20 + ~s!offset }, 4); [L1303] FCALL call #t~mem67 := read~$Pointer$({ base: ~s!base, offset: 16 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem66!base=0, #t~mem66!offset=1, #t~mem67!base=0, #t~mem67!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1303] COND TRUE (#t~mem66!base + #t~mem66!offset) % 4294967296 != (#t~mem67!base + #t~mem67!offset) % 4294967296 [L1303] havoc #t~mem66; [L1303] havoc #t~mem67; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1605] FCALL call #t~mem128 := read~$Pointer$({ base: ~s!base, offset: 84 + ~s!offset }, 4); [L1605] FCALL call #t~mem129 := read~int({ base: #t~mem128!base, offset: 848 + #t~mem128!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem128!base=20506, #t~mem128!offset=0, #t~mem129=20542, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1605] COND FALSE !(0 == #t~mem129) [L1605] havoc #t~mem128; [L1605] havoc #t~mem129; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1634] ~skip~0 := 0; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1131-L1635] COND FALSE !(false) VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4368, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1133] FCALL call #t~mem22 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); [L1133] ~state~0 := #t~mem22; [L1133] havoc #t~mem22; [L1134] FCALL call #t~mem23 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem23=4384, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1134] COND FALSE !(12292 == #t~mem23) [L1134] havoc #t~mem23; [L1137] FCALL call #t~mem24 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem24=4384, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1137] COND FALSE !(16384 == #t~mem24) [L1137] havoc #t~mem24; [L1140] FCALL call #t~mem25 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem25=4384, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1140] COND FALSE !(4096 == #t~mem25) [L1140] havoc #t~mem25; [L1143] FCALL call #t~mem26 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem26=4384, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1143] COND FALSE !(20480 == #t~mem26) [L1143] havoc #t~mem26; [L1146] FCALL call #t~mem27 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem27=4384, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1146] COND FALSE !(4099 == #t~mem27) [L1146] havoc #t~mem27; [L1149] FCALL call #t~mem28 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem28=4384, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1149] COND FALSE !(4368 == #t~mem28) [L1149] havoc #t~mem28; [L1152] FCALL call #t~mem29 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem29=4384, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1152] COND FALSE !(4369 == #t~mem29) [L1152] havoc #t~mem29; [L1155] FCALL call #t~mem30 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem30=4384, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1155] COND TRUE 4384 == #t~mem30 [L1155] havoc #t~mem30; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1311] assume -2147483648 <= #t~nondet68 && #t~nondet68 <= 2147483647; [L1311] ~ret~0 := #t~nondet68; [L1311] havoc #t~nondet68; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=1, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1312] COND TRUE 1 == ~blastFlag~0 [L1313] ~blastFlag~0 := 2; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1317] COND FALSE !(~ret~0 <= 0) [L1322] FCALL call #t~mem69 := read~int({ base: ~s!base, offset: 92 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem69=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1322-L1326] COND FALSE !(0 != #t~mem69) [L1322] havoc #t~mem69; [L1325] FCALL call write~int(4400, { base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1327] FCALL call write~int(0, { base: ~s!base, offset: 64 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1605] FCALL call #t~mem128 := read~$Pointer$({ base: ~s!base, offset: 84 + ~s!offset }, 4); [L1605] FCALL call #t~mem129 := read~int({ base: #t~mem128!base, offset: 848 + #t~mem128!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem128!base=20506, #t~mem128!offset=0, #t~mem129=20542, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1605] COND FALSE !(0 == #t~mem129) [L1605] havoc #t~mem128; [L1605] havoc #t~mem129; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1634] ~skip~0 := 0; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1131-L1635] COND FALSE !(false) VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4384, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1133] FCALL call #t~mem22 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); [L1133] ~state~0 := #t~mem22; [L1133] havoc #t~mem22; [L1134] FCALL call #t~mem23 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem23=4400, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1134] COND FALSE !(12292 == #t~mem23) [L1134] havoc #t~mem23; [L1137] FCALL call #t~mem24 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem24=4400, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1137] COND FALSE !(16384 == #t~mem24) [L1137] havoc #t~mem24; [L1140] FCALL call #t~mem25 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem25=4400, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1140] COND FALSE !(4096 == #t~mem25) [L1140] havoc #t~mem25; [L1143] FCALL call #t~mem26 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem26=4400, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1143] COND FALSE !(20480 == #t~mem26) [L1143] havoc #t~mem26; [L1146] FCALL call #t~mem27 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem27=4400, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1146] COND FALSE !(4099 == #t~mem27) [L1146] havoc #t~mem27; [L1149] FCALL call #t~mem28 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem28=4400, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1149] COND FALSE !(4368 == #t~mem28) [L1149] havoc #t~mem28; [L1152] FCALL call #t~mem29 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem29=4400, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1152] COND FALSE !(4369 == #t~mem29) [L1152] havoc #t~mem29; [L1155] FCALL call #t~mem30 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem30=4400, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1155] COND FALSE !(4384 == #t~mem30) [L1155] havoc #t~mem30; [L1158] FCALL call #t~mem31 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem31=4400, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1158] COND FALSE !(4385 == #t~mem31) [L1158] havoc #t~mem31; [L1161] FCALL call #t~mem32 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem32=4400, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1161] COND TRUE 4400 == #t~mem32 [L1161] havoc #t~mem32; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1331] FCALL call #t~mem70 := read~$Pointer$({ base: ~s!base, offset: 84 + ~s!offset }, 4); [L1331] FCALL call #t~mem71 := read~$Pointer$({ base: #t~mem70!base, offset: 836 + #t~mem70!offset }, 4); [L1331] FCALL call #t~mem72 := read~int({ base: #t~mem71!base, offset: 12 + #t~mem71!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem70!base=20506, #t~mem70!offset=0, #t~mem71!base=20502, #t~mem71!offset=0, #t~mem72=20537, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=1, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1331-L1345] COND FALSE !(0 != ~bitwiseAnd(#t~mem72, 256) % 4294967296) [L1331] havoc #t~mem71; [L1331] havoc #t~mem70; [L1331] havoc #t~mem72; [L1334] assume -2147483648 <= #t~nondet73 && #t~nondet73 <= 2147483647; [L1334] ~ret~0 := #t~nondet73; [L1334] havoc #t~nondet73; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=2, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=5, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1335] COND TRUE 2 == ~blastFlag~0 [L1336] ~blastFlag~0 := 3; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=5, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1340] COND FALSE !(~ret~0 <= 0) VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=5, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1346] FCALL call write~int(4416, { base: ~s!base, offset: 52 + ~s!offset }, 4); [L1347] FCALL call write~int(0, { base: ~s!base, offset: 64 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=5, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1605] FCALL call #t~mem128 := read~$Pointer$({ base: ~s!base, offset: 84 + ~s!offset }, 4); [L1605] FCALL call #t~mem129 := read~int({ base: #t~mem128!base, offset: 848 + #t~mem128!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem128!base=20506, #t~mem128!offset=0, #t~mem129=20542, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=5, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1605] COND FALSE !(0 == #t~mem129) [L1605] havoc #t~mem128; [L1605] havoc #t~mem129; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=5, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1634] ~skip~0 := 0; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=5, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1131-L1635] COND FALSE !(false) VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=5, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4400, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1133] FCALL call #t~mem22 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); [L1133] ~state~0 := #t~mem22; [L1133] havoc #t~mem22; [L1134] FCALL call #t~mem23 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem23=4416, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=5, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1134] COND FALSE !(12292 == #t~mem23) [L1134] havoc #t~mem23; [L1137] FCALL call #t~mem24 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem24=4416, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=5, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1137] COND FALSE !(16384 == #t~mem24) [L1137] havoc #t~mem24; [L1140] FCALL call #t~mem25 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem25=4416, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=5, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1140] COND FALSE !(4096 == #t~mem25) [L1140] havoc #t~mem25; [L1143] FCALL call #t~mem26 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem26=4416, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=5, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1143] COND FALSE !(20480 == #t~mem26) [L1143] havoc #t~mem26; [L1146] FCALL call #t~mem27 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem27=4416, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=5, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1146] COND FALSE !(4099 == #t~mem27) [L1146] havoc #t~mem27; [L1149] FCALL call #t~mem28 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem28=4416, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=5, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1149] COND FALSE !(4368 == #t~mem28) [L1149] havoc #t~mem28; [L1152] FCALL call #t~mem29 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem29=4416, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=5, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1152] COND FALSE !(4369 == #t~mem29) [L1152] havoc #t~mem29; [L1155] FCALL call #t~mem30 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem30=4416, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=5, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1155] COND FALSE !(4384 == #t~mem30) [L1155] havoc #t~mem30; [L1158] FCALL call #t~mem31 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem31=4416, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=5, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1158] COND FALSE !(4385 == #t~mem31) [L1158] havoc #t~mem31; [L1161] FCALL call #t~mem32 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem32=4416, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=5, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1161] COND FALSE !(4400 == #t~mem32) [L1161] havoc #t~mem32; [L1164] FCALL call #t~mem33 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem33=4416, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=5, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1164] COND FALSE !(4401 == #t~mem33) [L1164] havoc #t~mem33; [L1167] FCALL call #t~mem34 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem34=4416, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=5, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1167] COND TRUE 4416 == #t~mem34 [L1167] havoc #t~mem34; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=5, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1351] assume -2147483648 <= #t~nondet74 && #t~nondet74 <= 2147483647; [L1351] ~ret~0 := #t~nondet74; [L1351] havoc #t~nondet74; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=3, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=6, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1352] COND TRUE 3 == ~blastFlag~0 [L1353] ~blastFlag~0 := 4; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=6, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp~2=0] [L1357] COND FALSE !(~ret~0 <= 0) [L1362] FCALL call write~int(4432, { base: ~s!base, offset: 52 + ~s!offset }, 4); [L1363] FCALL call write~int(0, { base: ~s!base, offset: 64 + ~s!offset }, 4); [L1364] assume -2147483648 <= #t~nondet75 && #t~nondet75 <= 2147483647; [L1364] ~tmp___6~0 := #t~nondet75; [L1364] havoc #t~nondet75; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=6, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1365] COND FALSE !(0 == ~tmp___6~0) VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=6, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1605] FCALL call #t~mem128 := read~$Pointer$({ base: ~s!base, offset: 84 + ~s!offset }, 4); [L1605] FCALL call #t~mem129 := read~int({ base: #t~mem128!base, offset: 848 + #t~mem128!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem128!base=20506, #t~mem128!offset=0, #t~mem129=20542, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=6, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1605] COND FALSE !(0 == #t~mem129) [L1605] havoc #t~mem128; [L1605] havoc #t~mem129; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=6, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1634] ~skip~0 := 0; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=6, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1131-L1635] COND FALSE !(false) VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=6, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4416, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1133] FCALL call #t~mem22 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); [L1133] ~state~0 := #t~mem22; [L1133] havoc #t~mem22; [L1134] FCALL call #t~mem23 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem23=4432, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=6, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1134] COND FALSE !(12292 == #t~mem23) [L1134] havoc #t~mem23; [L1137] FCALL call #t~mem24 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem24=4432, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=6, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1137] COND FALSE !(16384 == #t~mem24) [L1137] havoc #t~mem24; [L1140] FCALL call #t~mem25 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem25=4432, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=6, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1140] COND FALSE !(4096 == #t~mem25) [L1140] havoc #t~mem25; [L1143] FCALL call #t~mem26 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem26=4432, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=6, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1143] COND FALSE !(20480 == #t~mem26) [L1143] havoc #t~mem26; [L1146] FCALL call #t~mem27 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem27=4432, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=6, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1146] COND FALSE !(4099 == #t~mem27) [L1146] havoc #t~mem27; [L1149] FCALL call #t~mem28 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem28=4432, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=6, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1149] COND FALSE !(4368 == #t~mem28) [L1149] havoc #t~mem28; [L1152] FCALL call #t~mem29 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem29=4432, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=6, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1152] COND FALSE !(4369 == #t~mem29) [L1152] havoc #t~mem29; [L1155] FCALL call #t~mem30 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem30=4432, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=6, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1155] COND FALSE !(4384 == #t~mem30) [L1155] havoc #t~mem30; [L1158] FCALL call #t~mem31 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem31=4432, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=6, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1158] COND FALSE !(4385 == #t~mem31) [L1158] havoc #t~mem31; [L1161] FCALL call #t~mem32 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem32=4432, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=6, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1161] COND FALSE !(4400 == #t~mem32) [L1161] havoc #t~mem32; [L1164] FCALL call #t~mem33 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem33=4432, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=6, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1164] COND FALSE !(4401 == #t~mem33) [L1164] havoc #t~mem33; [L1167] FCALL call #t~mem34 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem34=4432, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=6, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1167] COND FALSE !(4416 == #t~mem34) [L1167] havoc #t~mem34; [L1170] FCALL call #t~mem35 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem35=4432, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=6, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1170] COND FALSE !(4417 == #t~mem35) [L1170] havoc #t~mem35; [L1173] FCALL call #t~mem36 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem36=4432, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=6, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1173] COND TRUE 4432 == #t~mem36 [L1173] havoc #t~mem36; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=6, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1374] assume -2147483648 <= #t~nondet76 && #t~nondet76 <= 2147483647; [L1374] ~ret~0 := #t~nondet76; [L1374] havoc #t~nondet76; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1375] COND FALSE !(5 == ~blastFlag~0) VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1380] COND FALSE !(~ret~0 <= 0) [L1385] FCALL call write~int(4448, { base: ~s!base, offset: 52 + ~s!offset }, 4); [L1386] FCALL call write~int(0, { base: ~s!base, offset: 64 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1605] FCALL call #t~mem128 := read~$Pointer$({ base: ~s!base, offset: 84 + ~s!offset }, 4); [L1605] FCALL call #t~mem129 := read~int({ base: #t~mem128!base, offset: 848 + #t~mem128!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem128!base=20506, #t~mem128!offset=0, #t~mem129=20542, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1605] COND FALSE !(0 == #t~mem129) [L1605] havoc #t~mem128; [L1605] havoc #t~mem129; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1634] ~skip~0 := 0; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1131-L1635] COND FALSE !(false) VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4432, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1133] FCALL call #t~mem22 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); [L1133] ~state~0 := #t~mem22; [L1133] havoc #t~mem22; [L1134] FCALL call #t~mem23 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem23=4448, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1134] COND FALSE !(12292 == #t~mem23) [L1134] havoc #t~mem23; [L1137] FCALL call #t~mem24 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem24=4448, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1137] COND FALSE !(16384 == #t~mem24) [L1137] havoc #t~mem24; [L1140] FCALL call #t~mem25 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem25=4448, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1140] COND FALSE !(4096 == #t~mem25) [L1140] havoc #t~mem25; [L1143] FCALL call #t~mem26 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem26=4448, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1143] COND FALSE !(20480 == #t~mem26) [L1143] havoc #t~mem26; [L1146] FCALL call #t~mem27 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem27=4448, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1146] COND FALSE !(4099 == #t~mem27) [L1146] havoc #t~mem27; [L1149] FCALL call #t~mem28 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem28=4448, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1149] COND FALSE !(4368 == #t~mem28) [L1149] havoc #t~mem28; [L1152] FCALL call #t~mem29 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem29=4448, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1152] COND FALSE !(4369 == #t~mem29) [L1152] havoc #t~mem29; [L1155] FCALL call #t~mem30 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem30=4448, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1155] COND FALSE !(4384 == #t~mem30) [L1155] havoc #t~mem30; [L1158] FCALL call #t~mem31 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem31=4448, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1158] COND FALSE !(4385 == #t~mem31) [L1158] havoc #t~mem31; [L1161] FCALL call #t~mem32 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem32=4448, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1161] COND FALSE !(4400 == #t~mem32) [L1161] havoc #t~mem32; [L1164] FCALL call #t~mem33 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem33=4448, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1164] COND FALSE !(4401 == #t~mem33) [L1164] havoc #t~mem33; [L1167] FCALL call #t~mem34 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem34=4448, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1167] COND FALSE !(4416 == #t~mem34) [L1167] havoc #t~mem34; [L1170] FCALL call #t~mem35 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem35=4448, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1170] COND FALSE !(4417 == #t~mem35) [L1170] havoc #t~mem35; [L1173] FCALL call #t~mem36 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem36=4448, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1173] COND FALSE !(4432 == #t~mem36) [L1173] havoc #t~mem36; [L1176] FCALL call #t~mem37 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem37=4448, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1176] COND FALSE !(4433 == #t~mem37) [L1176] havoc #t~mem37; [L1179] FCALL call #t~mem38 := read~int({ base: ~s!base, offset: 52 + ~s!offset }, 4); VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem38=4448, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1179] COND TRUE 4448 == #t~mem38 [L1179] havoc #t~mem38; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=7, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1390] assume -2147483648 <= #t~nondet77 && #t~nondet77 <= 2147483647; [L1390] ~ret~0 := #t~nondet77; [L1390] havoc #t~nondet77; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=0, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1391] COND TRUE 4 == ~blastFlag~0 VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=0, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1646] assert false; VAL [#in~s!base=20501, #in~s!offset=0, #NULL!base=0, #NULL!offset=0, ~#SSLv3_client_data~0!base=20494, ~#SSLv3_client_data~0!offset=0, ~blastFlag~0=4, ~buf~0!base=20511, ~buf~0!offset=20517, ~cb~0!base=1, ~cb~0!offset=0, ~init~0=1, ~ret~0=0, ~s!base=20501, ~s!offset=0, ~skip~0=0, ~state~0=4448, ~tmp___0~1!base=20501, ~tmp___0~1!offset=204, ~tmp___1~0=0, ~tmp___2~0=0, ~tmp___4~0=1, ~tmp___5~0=1, ~tmp___6~0=1, ~tmp~2=0] [L1042] static int init = 1; [L1043] static SSL_METHOD SSLv3_client_data ; VAL [\old(init)=20541, \old(SSLv3_client_data)=null, \old(SSLv3_client_data)=null, init=1, SSLv3_client_data={20494:0}] [L1065] SSL *s = (SSL*)malloc(sizeof(SSL)) ; [L1069] s->s3 = malloc(sizeof(struct ssl3_state_st)) [L1070] s->ctx = malloc(sizeof(SSL_CTX)) [L1071] s->session = malloc(sizeof(SSL_SESSION)) [L1072] s->state = 12292 [L1073] s->version = __VERIFIER_nondet_int() [L1074] CALL ssl3_connect(s) VAL [init=1, s={20501:0}, SSLv3_client_data={20494:0}] [L1080] BUF_MEM *buf = __VERIFIER_nondet_pointer() ; [L1081] unsigned long tmp ; [L1082] unsigned long l ; [L1083] long num1 ; [L1084] void (*cb)() ; [L1085] int ret ; [L1086] int new_state ; [L1087] int state ; [L1088] int skip ; [L1089] int *tmp___0 = __VERIFIER_nondet_pointer() ; [L1090] int tmp___1 = __VERIFIER_nondet_int() ; [L1091] int tmp___2 = __VERIFIER_nondet_int() ; [L1092] int tmp___3 ; [L1093] int tmp___4 ; [L1094] int tmp___5 ; [L1095] int tmp___6 ; [L1096] int tmp___7 ; [L1097] int tmp___8 ; [L1098] long tmp___9 ; [L1100] int blastFlag ; [L1103] blastFlag = 0 [L1104] s->hit=__VERIFIER_nondet_int () [L1105] s->state = 12292 [L1106] tmp = __VERIFIER_nondet_int() [L1107] cb = (void (*)())((void *)0) [L1108] ret = -1 [L1109] skip = 0 [L1110] *tmp___0 = 0 [L1111] EXPR s->info_callback VAL [={0:0}, blastFlag=0, buf={20511:20517}, init=1, ret=-1, s={20501:0}, s={20501:0}, s->info_callback={1:0}, skip=0, SSLv3_client_data={20494:0}, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0] [L1111] COND TRUE (unsigned long )s->info_callback != (unsigned long )((void *)0) [L1112] EXPR s->info_callback [L1112] cb = s->info_callback [L1120] EXPR s->in_handshake [L1120] s->in_handshake += 1 [L1121] COND FALSE !(tmp___1 & 12288) VAL [={1:0}, blastFlag=0, buf={20511:20517}, init=1, ret=-1, s={20501:0}, s={20501:0}, skip=0, SSLv3_client_data={20494:0}, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0] [L1131] COND TRUE 1 VAL [={1:0}, blastFlag=0, buf={20511:20517}, init=1, ret=-1, s={20501:0}, s={20501:0}, skip=0, SSLv3_client_data={20494:0}, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0] [L1133] EXPR s->state [L1133] state = s->state [L1134] EXPR s->state VAL [={1:0}, blastFlag=0, buf={20511:20517}, init=1, ret=-1, s={20501:0}, s={20501:0}, s->state=12292, skip=0, SSLv3_client_data={20494:0}, state=12292, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0] [L1134] COND TRUE s->state == 12292 [L1237] s->new_session = 1 [L1238] s->state = 4096 [L1239] EXPR s->ctx [L1239] EXPR (s->ctx)->stats.sess_connect_renegotiate [L1239] (s->ctx)->stats.sess_connect_renegotiate += 1 [L1244] s->server = 0 VAL [={1:0}, blastFlag=0, buf={20511:20517}, init=1, ret=-1, s={20501:0}, s={20501:0}, skip=0, SSLv3_client_data={20494:0}, state=12292, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0] [L1245] COND TRUE (unsigned long )cb != (unsigned long )((void *)0) VAL [={1:0}, blastFlag=0, buf={20511:20517}, init=1, ret=-1, s={20501:0}, s={20501:0}, skip=0, SSLv3_client_data={20494:0}, state=12292, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0] [L1250] EXPR s->version VAL [={1:0}, blastFlag=0, buf={20511:20517}, init=1, ret=-1, s={20501:0}, s={20501:0}, s->version=0, skip=0, SSLv3_client_data={20494:0}, state=12292, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0] [L1250] COND FALSE !((s->version & 65280) != 768) [L1256] s->type = 4096 [L1257] EXPR s->init_buf VAL [={1:0}, blastFlag=0, buf={20511:20517}, init=1, ret=-1, s={20501:0}, s={20501:0}, s->init_buf={-1:2}, skip=0, SSLv3_client_data={20494:0}, state=12292, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0] [L1257] COND FALSE !((unsigned long )s->init_buf == (unsigned long )((void *)0)) [L1269] tmp___4 = __VERIFIER_nondet_int() [L1270] COND FALSE !(! tmp___4) [L1276] tmp___5 = __VERIFIER_nondet_int() [L1277] COND FALSE !(! tmp___5) [L1283] s->state = 4368 [L1284] EXPR s->ctx [L1284] EXPR (s->ctx)->stats.sess_connect [L1284] (s->ctx)->stats.sess_connect += 1 [L1285] s->init_num = 0 VAL [={1:0}, blastFlag=0, buf={20511:20517}, init=1, ret=-1, s={20501:0}, s={20501:0}, skip=0, SSLv3_client_data={20494:0}, state=12292, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1605] EXPR s->s3 [L1605] EXPR (s->s3)->tmp.reuse_message VAL [={1:0}, (s->s3)->tmp.reuse_message=20542, blastFlag=0, buf={20511:20517}, init=1, ret=-1, s={20501:0}, s={20501:0}, s->s3={20506:0}, skip=0, SSLv3_client_data={20494:0}, state=12292, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1605] COND FALSE !(! (s->s3)->tmp.reuse_message) [L1634] skip = 0 VAL [={1:0}, blastFlag=0, buf={20511:20517}, init=1, ret=-1, s={20501:0}, s={20501:0}, skip=0, SSLv3_client_data={20494:0}, state=12292, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1131] COND TRUE 1 VAL [={1:0}, blastFlag=0, buf={20511:20517}, init=1, ret=-1, s={20501:0}, s={20501:0}, skip=0, SSLv3_client_data={20494:0}, state=12292, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1133] EXPR s->state [L1133] state = s->state [L1134] EXPR s->state VAL [={1:0}, blastFlag=0, buf={20511:20517}, init=1, ret=-1, s={20501:0}, s={20501:0}, s->state=4368, skip=0, SSLv3_client_data={20494:0}, state=4368, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1134] COND FALSE !(s->state == 12292) [L1137] EXPR s->state VAL [={1:0}, blastFlag=0, buf={20511:20517}, init=1, ret=-1, s={20501:0}, s={20501:0}, s->state=4368, skip=0, SSLv3_client_data={20494:0}, state=4368, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1137] COND FALSE !(s->state == 16384) [L1140] EXPR s->state VAL [={1:0}, blastFlag=0, buf={20511:20517}, init=1, ret=-1, s={20501:0}, s={20501:0}, s->state=4368, skip=0, SSLv3_client_data={20494:0}, state=4368, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1140] COND FALSE !(s->state == 4096) [L1143] EXPR s->state VAL [={1:0}, blastFlag=0, buf={20511:20517}, init=1, ret=-1, s={20501:0}, s={20501:0}, s->state=4368, skip=0, SSLv3_client_data={20494:0}, state=4368, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1143] COND FALSE !(s->state == 20480) [L1146] EXPR s->state VAL [={1:0}, blastFlag=0, buf={20511:20517}, init=1, ret=-1, s={20501:0}, s={20501:0}, s->state=4368, skip=0, SSLv3_client_data={20494:0}, state=4368, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1146] COND FALSE !(s->state == 4099) [L1149] EXPR s->state VAL [={1:0}, blastFlag=0, buf={20511:20517}, init=1, ret=-1, s={20501:0}, s={20501:0}, s->state=4368, skip=0, SSLv3_client_data={20494:0}, state=4368, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1149] COND TRUE s->state == 4368 [L1289] s->shutdown = 0 [L1290] ret = __VERIFIER_nondet_int() [L1291] COND TRUE blastFlag == 0 [L1292] blastFlag = 1 VAL [={1:0}, blastFlag=1, buf={20511:20517}, init=1, ret=1, s={20501:0}, s={20501:0}, skip=0, SSLv3_client_data={20494:0}, state=4368, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1296] COND FALSE !(ret <= 0) [L1301] s->state = 4384 [L1302] s->init_num = 0 [L1303] EXPR s->bbio [L1303] EXPR s->wbio VAL [={1:0}, blastFlag=1, buf={20511:20517}, init=1, ret=1, s={20501:0}, s={20501:0}, s->bbio={0:1}, s->wbio={0:0}, skip=0, SSLv3_client_data={20494:0}, state=4368, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1303] COND TRUE (unsigned long )s->bbio != (unsigned long )s->wbio [L1605] EXPR s->s3 [L1605] EXPR (s->s3)->tmp.reuse_message VAL [={1:0}, (s->s3)->tmp.reuse_message=20542, blastFlag=1, buf={20511:20517}, init=1, ret=1, s={20501:0}, s={20501:0}, s->s3={20506:0}, skip=0, SSLv3_client_data={20494:0}, state=4368, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1605] COND FALSE !(! (s->s3)->tmp.reuse_message) [L1634] skip = 0 VAL [={1:0}, blastFlag=1, buf={20511:20517}, init=1, ret=1, s={20501:0}, s={20501:0}, skip=0, SSLv3_client_data={20494:0}, state=4368, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1131] COND TRUE 1 VAL [={1:0}, blastFlag=1, buf={20511:20517}, init=1, ret=1, s={20501:0}, s={20501:0}, skip=0, SSLv3_client_data={20494:0}, state=4368, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1133] EXPR s->state [L1133] state = s->state [L1134] EXPR s->state VAL [={1:0}, blastFlag=1, buf={20511:20517}, init=1, ret=1, s={20501:0}, s={20501:0}, s->state=4384, skip=0, SSLv3_client_data={20494:0}, state=4384, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1134] COND FALSE !(s->state == 12292) [L1137] EXPR s->state VAL [={1:0}, blastFlag=1, buf={20511:20517}, init=1, ret=1, s={20501:0}, s={20501:0}, s->state=4384, skip=0, SSLv3_client_data={20494:0}, state=4384, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1137] COND FALSE !(s->state == 16384) [L1140] EXPR s->state VAL [={1:0}, blastFlag=1, buf={20511:20517}, init=1, ret=1, s={20501:0}, s={20501:0}, s->state=4384, skip=0, SSLv3_client_data={20494:0}, state=4384, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1140] COND FALSE !(s->state == 4096) [L1143] EXPR s->state VAL [={1:0}, blastFlag=1, buf={20511:20517}, init=1, ret=1, s={20501:0}, s={20501:0}, s->state=4384, skip=0, SSLv3_client_data={20494:0}, state=4384, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1143] COND FALSE !(s->state == 20480) [L1146] EXPR s->state VAL [={1:0}, blastFlag=1, buf={20511:20517}, init=1, ret=1, s={20501:0}, s={20501:0}, s->state=4384, skip=0, SSLv3_client_data={20494:0}, state=4384, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1146] COND FALSE !(s->state == 4099) [L1149] EXPR s->state VAL [={1:0}, blastFlag=1, buf={20511:20517}, init=1, ret=1, s={20501:0}, s={20501:0}, s->state=4384, skip=0, SSLv3_client_data={20494:0}, state=4384, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1149] COND FALSE !(s->state == 4368) [L1152] EXPR s->state VAL [={1:0}, blastFlag=1, buf={20511:20517}, init=1, ret=1, s={20501:0}, s={20501:0}, s->state=4384, skip=0, SSLv3_client_data={20494:0}, state=4384, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1152] COND FALSE !(s->state == 4369) [L1155] EXPR s->state VAL [={1:0}, blastFlag=1, buf={20511:20517}, init=1, ret=1, s={20501:0}, s={20501:0}, s->state=4384, skip=0, SSLv3_client_data={20494:0}, state=4384, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1155] COND TRUE s->state == 4384 [L1311] ret = __VERIFIER_nondet_int() [L1312] COND TRUE blastFlag == 1 [L1313] blastFlag = 2 VAL [={1:0}, blastFlag=2, buf={20511:20517}, init=1, ret=1, s={20501:0}, s={20501:0}, skip=0, SSLv3_client_data={20494:0}, state=4384, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1317] COND FALSE !(ret <= 0) [L1322] s->hit VAL [={1:0}, blastFlag=2, buf={20511:20517}, init=1, ret=1, s={20501:0}, s={20501:0}, s->hit=0, skip=0, SSLv3_client_data={20494:0}, state=4384, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1322] COND FALSE !(s->hit) [L1325] s->state = 4400 VAL [={1:0}, blastFlag=2, buf={20511:20517}, init=1, ret=1, s={20501:0}, s={20501:0}, skip=0, SSLv3_client_data={20494:0}, state=4384, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1327] s->init_num = 0 VAL [={1:0}, blastFlag=2, buf={20511:20517}, init=1, ret=1, s={20501:0}, s={20501:0}, skip=0, SSLv3_client_data={20494:0}, state=4384, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1605] EXPR s->s3 [L1605] EXPR (s->s3)->tmp.reuse_message VAL [={1:0}, (s->s3)->tmp.reuse_message=20542, blastFlag=2, buf={20511:20517}, init=1, ret=1, s={20501:0}, s={20501:0}, s->s3={20506:0}, skip=0, SSLv3_client_data={20494:0}, state=4384, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1605] COND FALSE !(! (s->s3)->tmp.reuse_message) [L1634] skip = 0 VAL [={1:0}, blastFlag=2, buf={20511:20517}, init=1, ret=1, s={20501:0}, s={20501:0}, skip=0, SSLv3_client_data={20494:0}, state=4384, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1131] COND TRUE 1 VAL [={1:0}, blastFlag=2, buf={20511:20517}, init=1, ret=1, s={20501:0}, s={20501:0}, skip=0, SSLv3_client_data={20494:0}, state=4384, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1133] EXPR s->state [L1133] state = s->state [L1134] EXPR s->state VAL [={1:0}, blastFlag=2, buf={20511:20517}, init=1, ret=1, s={20501:0}, s={20501:0}, s->state=4400, skip=0, SSLv3_client_data={20494:0}, state=4400, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1134] COND FALSE !(s->state == 12292) [L1137] EXPR s->state VAL [={1:0}, blastFlag=2, buf={20511:20517}, init=1, ret=1, s={20501:0}, s={20501:0}, s->state=4400, skip=0, SSLv3_client_data={20494:0}, state=4400, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1137] COND FALSE !(s->state == 16384) [L1140] EXPR s->state VAL [={1:0}, blastFlag=2, buf={20511:20517}, init=1, ret=1, s={20501:0}, s={20501:0}, s->state=4400, skip=0, SSLv3_client_data={20494:0}, state=4400, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1140] COND FALSE !(s->state == 4096) [L1143] EXPR s->state VAL [={1:0}, blastFlag=2, buf={20511:20517}, init=1, ret=1, s={20501:0}, s={20501:0}, s->state=4400, skip=0, SSLv3_client_data={20494:0}, state=4400, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1143] COND FALSE !(s->state == 20480) [L1146] EXPR s->state VAL [={1:0}, blastFlag=2, buf={20511:20517}, init=1, ret=1, s={20501:0}, s={20501:0}, s->state=4400, skip=0, SSLv3_client_data={20494:0}, state=4400, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1146] COND FALSE !(s->state == 4099) [L1149] EXPR s->state VAL [={1:0}, blastFlag=2, buf={20511:20517}, init=1, ret=1, s={20501:0}, s={20501:0}, s->state=4400, skip=0, SSLv3_client_data={20494:0}, state=4400, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1149] COND FALSE !(s->state == 4368) [L1152] EXPR s->state VAL [={1:0}, blastFlag=2, buf={20511:20517}, init=1, ret=1, s={20501:0}, s={20501:0}, s->state=4400, skip=0, SSLv3_client_data={20494:0}, state=4400, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1152] COND FALSE !(s->state == 4369) [L1155] EXPR s->state VAL [={1:0}, blastFlag=2, buf={20511:20517}, init=1, ret=1, s={20501:0}, s={20501:0}, s->state=4400, skip=0, SSLv3_client_data={20494:0}, state=4400, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1155] COND FALSE !(s->state == 4384) [L1158] EXPR s->state VAL [={1:0}, blastFlag=2, buf={20511:20517}, init=1, ret=1, s={20501:0}, s={20501:0}, s->state=4400, skip=0, SSLv3_client_data={20494:0}, state=4400, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1158] COND FALSE !(s->state == 4385) [L1161] EXPR s->state VAL [={1:0}, blastFlag=2, buf={20511:20517}, init=1, ret=1, s={20501:0}, s={20501:0}, s->state=4400, skip=0, SSLv3_client_data={20494:0}, state=4400, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1161] COND TRUE s->state == 4400 [L1331] EXPR s->s3 [L1331] EXPR (s->s3)->tmp.new_cipher [L1331] EXPR ((s->s3)->tmp.new_cipher)->algorithms VAL [={1:0}, ((s->s3)->tmp.new_cipher)->algorithms=20537, (s->s3)->tmp.new_cipher={20502:0}, blastFlag=2, buf={20511:20517}, init=1, ret=1, s={20501:0}, s={20501:0}, s->s3={20506:0}, skip=0, SSLv3_client_data={20494:0}, state=4400, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1331] COND FALSE !(((s->s3)->tmp.new_cipher)->algorithms & 256UL) [L1334] ret = __VERIFIER_nondet_int() [L1335] COND TRUE blastFlag == 2 [L1336] blastFlag = 3 VAL [={1:0}, blastFlag=3, buf={20511:20517}, init=1, ret=5, s={20501:0}, s={20501:0}, skip=0, SSLv3_client_data={20494:0}, state=4400, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1340] COND FALSE !(ret <= 0) VAL [={1:0}, blastFlag=3, buf={20511:20517}, init=1, ret=5, s={20501:0}, s={20501:0}, skip=0, SSLv3_client_data={20494:0}, state=4400, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1346] s->state = 4416 [L1347] s->init_num = 0 VAL [={1:0}, blastFlag=3, buf={20511:20517}, init=1, ret=5, s={20501:0}, s={20501:0}, skip=0, SSLv3_client_data={20494:0}, state=4400, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1605] EXPR s->s3 [L1605] EXPR (s->s3)->tmp.reuse_message VAL [={1:0}, (s->s3)->tmp.reuse_message=20542, blastFlag=3, buf={20511:20517}, init=1, ret=5, s={20501:0}, s={20501:0}, s->s3={20506:0}, skip=0, SSLv3_client_data={20494:0}, state=4400, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1605] COND FALSE !(! (s->s3)->tmp.reuse_message) [L1634] skip = 0 VAL [={1:0}, blastFlag=3, buf={20511:20517}, init=1, ret=5, s={20501:0}, s={20501:0}, skip=0, SSLv3_client_data={20494:0}, state=4400, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1131] COND TRUE 1 VAL [={1:0}, blastFlag=3, buf={20511:20517}, init=1, ret=5, s={20501:0}, s={20501:0}, skip=0, SSLv3_client_data={20494:0}, state=4400, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1133] EXPR s->state [L1133] state = s->state [L1134] EXPR s->state VAL [={1:0}, blastFlag=3, buf={20511:20517}, init=1, ret=5, s={20501:0}, s={20501:0}, s->state=4416, skip=0, SSLv3_client_data={20494:0}, state=4416, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1134] COND FALSE !(s->state == 12292) [L1137] EXPR s->state VAL [={1:0}, blastFlag=3, buf={20511:20517}, init=1, ret=5, s={20501:0}, s={20501:0}, s->state=4416, skip=0, SSLv3_client_data={20494:0}, state=4416, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1137] COND FALSE !(s->state == 16384) [L1140] EXPR s->state VAL [={1:0}, blastFlag=3, buf={20511:20517}, init=1, ret=5, s={20501:0}, s={20501:0}, s->state=4416, skip=0, SSLv3_client_data={20494:0}, state=4416, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1140] COND FALSE !(s->state == 4096) [L1143] EXPR s->state VAL [={1:0}, blastFlag=3, buf={20511:20517}, init=1, ret=5, s={20501:0}, s={20501:0}, s->state=4416, skip=0, SSLv3_client_data={20494:0}, state=4416, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1143] COND FALSE !(s->state == 20480) [L1146] EXPR s->state VAL [={1:0}, blastFlag=3, buf={20511:20517}, init=1, ret=5, s={20501:0}, s={20501:0}, s->state=4416, skip=0, SSLv3_client_data={20494:0}, state=4416, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1146] COND FALSE !(s->state == 4099) [L1149] EXPR s->state VAL [={1:0}, blastFlag=3, buf={20511:20517}, init=1, ret=5, s={20501:0}, s={20501:0}, s->state=4416, skip=0, SSLv3_client_data={20494:0}, state=4416, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1149] COND FALSE !(s->state == 4368) [L1152] EXPR s->state VAL [={1:0}, blastFlag=3, buf={20511:20517}, init=1, ret=5, s={20501:0}, s={20501:0}, s->state=4416, skip=0, SSLv3_client_data={20494:0}, state=4416, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1152] COND FALSE !(s->state == 4369) [L1155] EXPR s->state VAL [={1:0}, blastFlag=3, buf={20511:20517}, init=1, ret=5, s={20501:0}, s={20501:0}, s->state=4416, skip=0, SSLv3_client_data={20494:0}, state=4416, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1155] COND FALSE !(s->state == 4384) [L1158] EXPR s->state VAL [={1:0}, blastFlag=3, buf={20511:20517}, init=1, ret=5, s={20501:0}, s={20501:0}, s->state=4416, skip=0, SSLv3_client_data={20494:0}, state=4416, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1158] COND FALSE !(s->state == 4385) [L1161] EXPR s->state VAL [={1:0}, blastFlag=3, buf={20511:20517}, init=1, ret=5, s={20501:0}, s={20501:0}, s->state=4416, skip=0, SSLv3_client_data={20494:0}, state=4416, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1161] COND FALSE !(s->state == 4400) [L1164] EXPR s->state VAL [={1:0}, blastFlag=3, buf={20511:20517}, init=1, ret=5, s={20501:0}, s={20501:0}, s->state=4416, skip=0, SSLv3_client_data={20494:0}, state=4416, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1164] COND FALSE !(s->state == 4401) [L1167] EXPR s->state VAL [={1:0}, blastFlag=3, buf={20511:20517}, init=1, ret=5, s={20501:0}, s={20501:0}, s->state=4416, skip=0, SSLv3_client_data={20494:0}, state=4416, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1167] COND TRUE s->state == 4416 [L1351] ret = __VERIFIER_nondet_int() [L1352] COND TRUE blastFlag == 3 [L1353] blastFlag = 4 VAL [={1:0}, blastFlag=4, buf={20511:20517}, init=1, ret=6, s={20501:0}, s={20501:0}, skip=0, SSLv3_client_data={20494:0}, state=4416, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1357] COND FALSE !(ret <= 0) [L1362] s->state = 4432 [L1363] s->init_num = 0 [L1364] tmp___6 = __VERIFIER_nondet_int() [L1365] COND FALSE !(! tmp___6) VAL [={1:0}, blastFlag=4, buf={20511:20517}, init=1, ret=6, s={20501:0}, s={20501:0}, skip=0, SSLv3_client_data={20494:0}, state=4416, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1605] EXPR s->s3 [L1605] EXPR (s->s3)->tmp.reuse_message VAL [={1:0}, (s->s3)->tmp.reuse_message=20542, blastFlag=4, buf={20511:20517}, init=1, ret=6, s={20501:0}, s={20501:0}, s->s3={20506:0}, skip=0, SSLv3_client_data={20494:0}, state=4416, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1605] COND FALSE !(! (s->s3)->tmp.reuse_message) [L1634] skip = 0 VAL [={1:0}, blastFlag=4, buf={20511:20517}, init=1, ret=6, s={20501:0}, s={20501:0}, skip=0, SSLv3_client_data={20494:0}, state=4416, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1131] COND TRUE 1 VAL [={1:0}, blastFlag=4, buf={20511:20517}, init=1, ret=6, s={20501:0}, s={20501:0}, skip=0, SSLv3_client_data={20494:0}, state=4416, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1133] EXPR s->state [L1133] state = s->state [L1134] EXPR s->state VAL [={1:0}, blastFlag=4, buf={20511:20517}, init=1, ret=6, s={20501:0}, s={20501:0}, s->state=4432, skip=0, SSLv3_client_data={20494:0}, state=4432, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1134] COND FALSE !(s->state == 12292) [L1137] EXPR s->state VAL [={1:0}, blastFlag=4, buf={20511:20517}, init=1, ret=6, s={20501:0}, s={20501:0}, s->state=4432, skip=0, SSLv3_client_data={20494:0}, state=4432, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1137] COND FALSE !(s->state == 16384) [L1140] EXPR s->state VAL [={1:0}, blastFlag=4, buf={20511:20517}, init=1, ret=6, s={20501:0}, s={20501:0}, s->state=4432, skip=0, SSLv3_client_data={20494:0}, state=4432, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1140] COND FALSE !(s->state == 4096) [L1143] EXPR s->state VAL [={1:0}, blastFlag=4, buf={20511:20517}, init=1, ret=6, s={20501:0}, s={20501:0}, s->state=4432, skip=0, SSLv3_client_data={20494:0}, state=4432, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1143] COND FALSE !(s->state == 20480) [L1146] EXPR s->state VAL [={1:0}, blastFlag=4, buf={20511:20517}, init=1, ret=6, s={20501:0}, s={20501:0}, s->state=4432, skip=0, SSLv3_client_data={20494:0}, state=4432, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1146] COND FALSE !(s->state == 4099) [L1149] EXPR s->state VAL [={1:0}, blastFlag=4, buf={20511:20517}, init=1, ret=6, s={20501:0}, s={20501:0}, s->state=4432, skip=0, SSLv3_client_data={20494:0}, state=4432, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1149] COND FALSE !(s->state == 4368) [L1152] EXPR s->state VAL [={1:0}, blastFlag=4, buf={20511:20517}, init=1, ret=6, s={20501:0}, s={20501:0}, s->state=4432, skip=0, SSLv3_client_data={20494:0}, state=4432, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1152] COND FALSE !(s->state == 4369) [L1155] EXPR s->state VAL [={1:0}, blastFlag=4, buf={20511:20517}, init=1, ret=6, s={20501:0}, s={20501:0}, s->state=4432, skip=0, SSLv3_client_data={20494:0}, state=4432, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1155] COND FALSE !(s->state == 4384) [L1158] EXPR s->state VAL [={1:0}, blastFlag=4, buf={20511:20517}, init=1, ret=6, s={20501:0}, s={20501:0}, s->state=4432, skip=0, SSLv3_client_data={20494:0}, state=4432, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1158] COND FALSE !(s->state == 4385) [L1161] EXPR s->state VAL [={1:0}, blastFlag=4, buf={20511:20517}, init=1, ret=6, s={20501:0}, s={20501:0}, s->state=4432, skip=0, SSLv3_client_data={20494:0}, state=4432, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1161] COND FALSE !(s->state == 4400) [L1164] EXPR s->state VAL [={1:0}, blastFlag=4, buf={20511:20517}, init=1, ret=6, s={20501:0}, s={20501:0}, s->state=4432, skip=0, SSLv3_client_data={20494:0}, state=4432, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1164] COND FALSE !(s->state == 4401) [L1167] EXPR s->state VAL [={1:0}, blastFlag=4, buf={20511:20517}, init=1, ret=6, s={20501:0}, s={20501:0}, s->state=4432, skip=0, SSLv3_client_data={20494:0}, state=4432, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1167] COND FALSE !(s->state == 4416) [L1170] EXPR s->state VAL [={1:0}, blastFlag=4, buf={20511:20517}, init=1, ret=6, s={20501:0}, s={20501:0}, s->state=4432, skip=0, SSLv3_client_data={20494:0}, state=4432, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1170] COND FALSE !(s->state == 4417) [L1173] EXPR s->state VAL [={1:0}, blastFlag=4, buf={20511:20517}, init=1, ret=6, s={20501:0}, s={20501:0}, s->state=4432, skip=0, SSLv3_client_data={20494:0}, state=4432, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1173] COND TRUE s->state == 4432 [L1374] ret = __VERIFIER_nondet_int() [L1375] COND FALSE !(blastFlag == 5) VAL [={1:0}, blastFlag=4, buf={20511:20517}, init=1, ret=7, s={20501:0}, s={20501:0}, skip=0, SSLv3_client_data={20494:0}, state=4432, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1380] COND FALSE !(ret <= 0) [L1385] s->state = 4448 [L1386] s->init_num = 0 VAL [={1:0}, blastFlag=4, buf={20511:20517}, init=1, ret=7, s={20501:0}, s={20501:0}, skip=0, SSLv3_client_data={20494:0}, state=4432, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1605] EXPR s->s3 [L1605] EXPR (s->s3)->tmp.reuse_message VAL [={1:0}, (s->s3)->tmp.reuse_message=20542, blastFlag=4, buf={20511:20517}, init=1, ret=7, s={20501:0}, s={20501:0}, s->s3={20506:0}, skip=0, SSLv3_client_data={20494:0}, state=4432, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1605] COND FALSE !(! (s->s3)->tmp.reuse_message) [L1634] skip = 0 VAL [={1:0}, blastFlag=4, buf={20511:20517}, init=1, ret=7, s={20501:0}, s={20501:0}, skip=0, SSLv3_client_data={20494:0}, state=4432, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1131] COND TRUE 1 VAL [={1:0}, blastFlag=4, buf={20511:20517}, init=1, ret=7, s={20501:0}, s={20501:0}, skip=0, SSLv3_client_data={20494:0}, state=4432, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1133] EXPR s->state [L1133] state = s->state [L1134] EXPR s->state VAL [={1:0}, blastFlag=4, buf={20511:20517}, init=1, ret=7, s={20501:0}, s={20501:0}, s->state=4448, skip=0, SSLv3_client_data={20494:0}, state=4448, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1134] COND FALSE !(s->state == 12292) [L1137] EXPR s->state VAL [={1:0}, blastFlag=4, buf={20511:20517}, init=1, ret=7, s={20501:0}, s={20501:0}, s->state=4448, skip=0, SSLv3_client_data={20494:0}, state=4448, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1137] COND FALSE !(s->state == 16384) [L1140] EXPR s->state VAL [={1:0}, blastFlag=4, buf={20511:20517}, init=1, ret=7, s={20501:0}, s={20501:0}, s->state=4448, skip=0, SSLv3_client_data={20494:0}, state=4448, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1140] COND FALSE !(s->state == 4096) [L1143] EXPR s->state VAL [={1:0}, blastFlag=4, buf={20511:20517}, init=1, ret=7, s={20501:0}, s={20501:0}, s->state=4448, skip=0, SSLv3_client_data={20494:0}, state=4448, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1143] COND FALSE !(s->state == 20480) [L1146] EXPR s->state VAL [={1:0}, blastFlag=4, buf={20511:20517}, init=1, ret=7, s={20501:0}, s={20501:0}, s->state=4448, skip=0, SSLv3_client_data={20494:0}, state=4448, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1146] COND FALSE !(s->state == 4099) [L1149] EXPR s->state VAL [={1:0}, blastFlag=4, buf={20511:20517}, init=1, ret=7, s={20501:0}, s={20501:0}, s->state=4448, skip=0, SSLv3_client_data={20494:0}, state=4448, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1149] COND FALSE !(s->state == 4368) [L1152] EXPR s->state VAL [={1:0}, blastFlag=4, buf={20511:20517}, init=1, ret=7, s={20501:0}, s={20501:0}, s->state=4448, skip=0, SSLv3_client_data={20494:0}, state=4448, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1152] COND FALSE !(s->state == 4369) [L1155] EXPR s->state VAL [={1:0}, blastFlag=4, buf={20511:20517}, init=1, ret=7, s={20501:0}, s={20501:0}, s->state=4448, skip=0, SSLv3_client_data={20494:0}, state=4448, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1155] COND FALSE !(s->state == 4384) [L1158] EXPR s->state VAL [={1:0}, blastFlag=4, buf={20511:20517}, init=1, ret=7, s={20501:0}, s={20501:0}, s->state=4448, skip=0, SSLv3_client_data={20494:0}, state=4448, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1158] COND FALSE !(s->state == 4385) [L1161] EXPR s->state VAL [={1:0}, blastFlag=4, buf={20511:20517}, init=1, ret=7, s={20501:0}, s={20501:0}, s->state=4448, skip=0, SSLv3_client_data={20494:0}, state=4448, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1161] COND FALSE !(s->state == 4400) [L1164] EXPR s->state VAL [={1:0}, blastFlag=4, buf={20511:20517}, init=1, ret=7, s={20501:0}, s={20501:0}, s->state=4448, skip=0, SSLv3_client_data={20494:0}, state=4448, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1164] COND FALSE !(s->state == 4401) [L1167] EXPR s->state VAL [={1:0}, blastFlag=4, buf={20511:20517}, init=1, ret=7, s={20501:0}, s={20501:0}, s->state=4448, skip=0, SSLv3_client_data={20494:0}, state=4448, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1167] COND FALSE !(s->state == 4416) [L1170] EXPR s->state VAL [={1:0}, blastFlag=4, buf={20511:20517}, init=1, ret=7, s={20501:0}, s={20501:0}, s->state=4448, skip=0, SSLv3_client_data={20494:0}, state=4448, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1170] COND FALSE !(s->state == 4417) [L1173] EXPR s->state VAL [={1:0}, blastFlag=4, buf={20511:20517}, init=1, ret=7, s={20501:0}, s={20501:0}, s->state=4448, skip=0, SSLv3_client_data={20494:0}, state=4448, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1173] COND FALSE !(s->state == 4432) [L1176] EXPR s->state VAL [={1:0}, blastFlag=4, buf={20511:20517}, init=1, ret=7, s={20501:0}, s={20501:0}, s->state=4448, skip=0, SSLv3_client_data={20494:0}, state=4448, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1176] COND FALSE !(s->state == 4433) [L1179] EXPR s->state VAL [={1:0}, blastFlag=4, buf={20511:20517}, init=1, ret=7, s={20501:0}, s={20501:0}, s->state=4448, skip=0, SSLv3_client_data={20494:0}, state=4448, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1179] COND TRUE s->state == 4448 [L1390] ret = __VERIFIER_nondet_int() [L1391] COND TRUE blastFlag == 4 VAL [={1:0}, blastFlag=4, buf={20511:20517}, init=1, ret=0, s={20501:0}, s={20501:0}, skip=0, SSLv3_client_data={20494:0}, state=4448, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1646] __VERIFIER_error() VAL [={1:0}, blastFlag=4, buf={20511:20517}, init=1, ret=0, s={20501:0}, s={20501:0}, skip=0, SSLv3_client_data={20494:0}, state=4448, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] ----- [2018-11-23 07:46:57,068 INFO L202 PluginConnector]: Adding new model de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction CFG 23.11 07:46:57 BoogieIcfgContainer [2018-11-23 07:46:57,068 INFO L132 PluginConnector]: ------------------------ END TraceAbstraction---------------------------- [2018-11-23 07:46:57,069 INFO L113 PluginConnector]: ------------------------Witness Printer---------------------------- [2018-11-23 07:46:57,069 INFO L271 PluginConnector]: Initializing Witness Printer... [2018-11-23 07:46:57,069 INFO L276 PluginConnector]: Witness Printer initialized [2018-11-23 07:46:57,069 INFO L185 PluginConnector]: Executing the observer RCFGCatcher from plugin Witness Printer for "de.uni_freiburg.informatik.ultimate.plugins.generator.rcfgbuilder CFG 23.11 07:46:44" (3/4) ... [2018-11-23 07:46:57,072 INFO L147 WitnessPrinter]: No result that supports witness generation found [2018-11-23 07:46:57,072 INFO L132 PluginConnector]: ------------------------ END Witness Printer---------------------------- [2018-11-23 07:46:57,073 INFO L168 Benchmark]: Toolchain (without parser) took 13793.93 ms. Allocated memory was 1.0 GB in the beginning and 1.4 GB in the end (delta: 339.7 MB). Free memory was 956.6 MB in the beginning and 1.0 GB in the end (delta: -50.1 MB). Peak memory consumption was 289.6 MB. Max. memory is 11.5 GB. [2018-11-23 07:46:57,074 INFO L168 Benchmark]: CDTParser took 0.10 ms. Allocated memory is still 1.0 GB. Free memory is still 985.6 MB. There was no memory consumed. Max. memory is 11.5 GB. [2018-11-23 07:46:57,074 INFO L168 Benchmark]: CACSL2BoogieTranslator took 448.31 ms. Allocated memory was 1.0 GB in the beginning and 1.2 GB in the end (delta: 139.5 MB). Free memory was 956.6 MB in the beginning and 1.1 GB in the end (delta: -167.1 MB). Peak memory consumption was 43.8 MB. Max. memory is 11.5 GB. [2018-11-23 07:46:57,075 INFO L168 Benchmark]: Boogie Procedure Inliner took 28.18 ms. Allocated memory is still 1.2 GB. Free memory was 1.1 GB in the beginning and 1.1 GB in the end (delta: 2.7 MB). Peak memory consumption was 2.7 MB. Max. memory is 11.5 GB. [2018-11-23 07:46:57,075 INFO L168 Benchmark]: Boogie Preprocessor took 62.68 ms. Allocated memory is still 1.2 GB. Free memory was 1.1 GB in the beginning and 1.1 GB in the end (delta: 6.4 MB). Peak memory consumption was 6.4 MB. Max. memory is 11.5 GB. [2018-11-23 07:46:57,075 INFO L168 Benchmark]: RCFGBuilder took 640.26 ms. Allocated memory is still 1.2 GB. Free memory was 1.1 GB in the beginning and 1.0 GB in the end (delta: 81.6 MB). Peak memory consumption was 81.6 MB. Max. memory is 11.5 GB. [2018-11-23 07:46:57,076 INFO L168 Benchmark]: TraceAbstraction took 12607.46 ms. Allocated memory was 1.2 GB in the beginning and 1.4 GB in the end (delta: 200.3 MB). Free memory was 1.0 GB in the beginning and 1.0 GB in the end (delta: 26.4 MB). Peak memory consumption was 226.6 MB. Max. memory is 11.5 GB. [2018-11-23 07:46:57,076 INFO L168 Benchmark]: Witness Printer took 3.67 ms. Allocated memory is still 1.4 GB. Free memory is still 1.0 GB. There was no memory consumed. Max. memory is 11.5 GB. [2018-11-23 07:46:57,078 INFO L336 ainManager$Toolchain]: ####################### End [Toolchain 1] ####################### --- Results --- * Results from de.uni_freiburg.informatik.ultimate.core: - StatisticsResult: Toolchain Benchmarks Benchmark results are: * CDTParser took 0.10 ms. Allocated memory is still 1.0 GB. Free memory is still 985.6 MB. There was no memory consumed. Max. memory is 11.5 GB. * CACSL2BoogieTranslator took 448.31 ms. Allocated memory was 1.0 GB in the beginning and 1.2 GB in the end (delta: 139.5 MB). Free memory was 956.6 MB in the beginning and 1.1 GB in the end (delta: -167.1 MB). Peak memory consumption was 43.8 MB. Max. memory is 11.5 GB. * Boogie Procedure Inliner took 28.18 ms. Allocated memory is still 1.2 GB. Free memory was 1.1 GB in the beginning and 1.1 GB in the end (delta: 2.7 MB). Peak memory consumption was 2.7 MB. Max. memory is 11.5 GB. * Boogie Preprocessor took 62.68 ms. Allocated memory is still 1.2 GB. Free memory was 1.1 GB in the beginning and 1.1 GB in the end (delta: 6.4 MB). Peak memory consumption was 6.4 MB. Max. memory is 11.5 GB. * RCFGBuilder took 640.26 ms. Allocated memory is still 1.2 GB. Free memory was 1.1 GB in the beginning and 1.0 GB in the end (delta: 81.6 MB). Peak memory consumption was 81.6 MB. Max. memory is 11.5 GB. * TraceAbstraction took 12607.46 ms. Allocated memory was 1.2 GB in the beginning and 1.4 GB in the end (delta: 200.3 MB). Free memory was 1.0 GB in the beginning and 1.0 GB in the end (delta: 26.4 MB). Peak memory consumption was 226.6 MB. Max. memory is 11.5 GB. * Witness Printer took 3.67 ms. Allocated memory is still 1.4 GB. Free memory is still 1.0 GB. There was no memory consumed. Max. memory is 11.5 GB. * Results from de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator: - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: IntegerLiteral 20492 could not be translated for associated CType STRUCT~~ssl_method_st?version~INT?ssl_new~*((*~SSL~0 ) : INT)?ssl_clear~*((*~SSL~0 ) : VOID)?ssl_free~*((*~SSL~0 ) : VOID)?ssl_accept~*((*~SSL~0 ) : INT)?ssl_connect~*((*~SSL~0 ) : INT)?ssl_read~*((*~SSL~0 *VOID INT ) : INT)?ssl_peek~*((*~SSL~0 *VOID INT ) : INT)?ssl_write~*((*~SSL~0 *VOID INT ) : INT)?ssl_shutdown~*((*~SSL~0 ) : INT)?ssl_renegotiate~*((*~SSL~0 ) : INT)?ssl_renegotiate_check~*((*~SSL~0 ) : INT)?ssl_ctrl~*((*~SSL~0 INT LONG *CHAR ) : LONG)?ssl_ctx_ctrl~*((*~SSL_CTX~0 INT LONG *CHAR ) : LONG)?get_cipher_by_char~*((*UCHAR ) : *~SSL_CIPHER~0)?put_cipher_by_char~*((*~SSL_CIPHER~0 *UCHAR ) : INT)?ssl_pending~*((*~SSL~0 ) : INT)?num_ciphers~*(() : INT)?get_cipher~*((UINT ) : *~SSL_CIPHER~0)?get_ssl_method~*((INT ) : *ssl_method_st)?get_timeout~*(() : LONG)?ssl3_enc~*ssl3_enc_method?ssl_version~*(() : INT)?ssl_callback_ctrl~*((*~SSL~0 INT *(() : VOID) ) : LONG)?ssl_ctx_callback_ctrl~*((*~SSL_CTX~0 INT *(() : VOID) ) : LONG)# - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: IntegerLiteral 20488 could not be translated for associated CType STRUCT~~ssl_method_st?version~INT?ssl_new~*((*~SSL~0 ) : INT)?ssl_clear~*((*~SSL~0 ) : VOID)?ssl_free~*((*~SSL~0 ) : VOID)?ssl_accept~*((*~SSL~0 ) : INT)?ssl_connect~*((*~SSL~0 ) : INT)?ssl_read~*((*~SSL~0 *VOID INT ) : INT)?ssl_peek~*((*~SSL~0 *VOID INT ) : INT)?ssl_write~*((*~SSL~0 *VOID INT ) : INT)?ssl_shutdown~*((*~SSL~0 ) : INT)?ssl_renegotiate~*((*~SSL~0 ) : INT)?ssl_renegotiate_check~*((*~SSL~0 ) : INT)?ssl_ctrl~*((*~SSL~0 INT LONG *CHAR ) : LONG)?ssl_ctx_ctrl~*((*~SSL_CTX~0 INT LONG *CHAR ) : LONG)?get_cipher_by_char~*((*UCHAR ) : *~SSL_CIPHER~0)?put_cipher_by_char~*((*~SSL_CIPHER~0 *UCHAR ) : INT)?ssl_pending~*((*~SSL~0 ) : INT)?num_ciphers~*(() : INT)?get_cipher~*((UINT ) : *~SSL_CIPHER~0)?get_ssl_method~*((INT ) : *ssl_method_st)?get_timeout~*(() : LONG)?ssl3_enc~*ssl3_enc_method?ssl_version~*(() : INT)?ssl_callback_ctrl~*((*~SSL~0 INT *(() : VOID) ) : LONG)?ssl_ctx_callback_ctrl~*((*~SSL_CTX~0 INT *(() : VOID) ) : LONG)# * Results from de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction: - UnprovableResult [Line: 1646]: Unable to prove that call of __VERIFIER_error() unreachable Unable to prove that call of __VERIFIER_error() unreachable Reason: overapproximation of bitwiseAnd at line 1331. Possible FailurePath: [L1042] static int init = 1; [L1043] static SSL_METHOD SSLv3_client_data ; VAL [\old(init)=20541, \old(SSLv3_client_data)=null, \old(SSLv3_client_data)=null, init=1, SSLv3_client_data={20494:0}] [L1065] SSL *s = (SSL*)malloc(sizeof(SSL)) ; [L1069] s->s3 = malloc(sizeof(struct ssl3_state_st)) [L1070] s->ctx = malloc(sizeof(SSL_CTX)) [L1071] s->session = malloc(sizeof(SSL_SESSION)) [L1072] s->state = 12292 [L1073] s->version = __VERIFIER_nondet_int() [L1074] CALL ssl3_connect(s) VAL [init=1, s={20501:0}, SSLv3_client_data={20494:0}] [L1080] BUF_MEM *buf = __VERIFIER_nondet_pointer() ; [L1081] unsigned long tmp ; [L1082] unsigned long l ; [L1083] long num1 ; [L1084] void (*cb)() ; [L1085] int ret ; [L1086] int new_state ; [L1087] int state ; [L1088] int skip ; [L1089] int *tmp___0 = __VERIFIER_nondet_pointer() ; [L1090] int tmp___1 = __VERIFIER_nondet_int() ; [L1091] int tmp___2 = __VERIFIER_nondet_int() ; [L1092] int tmp___3 ; [L1093] int tmp___4 ; [L1094] int tmp___5 ; [L1095] int tmp___6 ; [L1096] int tmp___7 ; [L1097] int tmp___8 ; [L1098] long tmp___9 ; [L1100] int blastFlag ; [L1103] blastFlag = 0 [L1104] s->hit=__VERIFIER_nondet_int () [L1105] s->state = 12292 [L1106] tmp = __VERIFIER_nondet_int() [L1107] cb = (void (*)())((void *)0) [L1108] ret = -1 [L1109] skip = 0 [L1110] *tmp___0 = 0 [L1111] EXPR s->info_callback VAL [={0:0}, blastFlag=0, buf={20511:20517}, init=1, ret=-1, s={20501:0}, s={20501:0}, s->info_callback={1:0}, skip=0, SSLv3_client_data={20494:0}, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0] [L1111] COND TRUE (unsigned long )s->info_callback != (unsigned long )((void *)0) [L1112] EXPR s->info_callback [L1112] cb = s->info_callback [L1120] EXPR s->in_handshake [L1120] s->in_handshake += 1 [L1121] COND FALSE !(tmp___1 & 12288) VAL [={1:0}, blastFlag=0, buf={20511:20517}, init=1, ret=-1, s={20501:0}, s={20501:0}, skip=0, SSLv3_client_data={20494:0}, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0] [L1131] COND TRUE 1 VAL [={1:0}, blastFlag=0, buf={20511:20517}, init=1, ret=-1, s={20501:0}, s={20501:0}, skip=0, SSLv3_client_data={20494:0}, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0] [L1133] EXPR s->state [L1133] state = s->state [L1134] EXPR s->state VAL [={1:0}, blastFlag=0, buf={20511:20517}, init=1, ret=-1, s={20501:0}, s={20501:0}, s->state=12292, skip=0, SSLv3_client_data={20494:0}, state=12292, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0] [L1134] COND TRUE s->state == 12292 [L1237] s->new_session = 1 [L1238] s->state = 4096 [L1239] EXPR s->ctx [L1239] EXPR (s->ctx)->stats.sess_connect_renegotiate [L1239] (s->ctx)->stats.sess_connect_renegotiate += 1 [L1244] s->server = 0 VAL [={1:0}, blastFlag=0, buf={20511:20517}, init=1, ret=-1, s={20501:0}, s={20501:0}, skip=0, SSLv3_client_data={20494:0}, state=12292, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0] [L1245] COND TRUE (unsigned long )cb != (unsigned long )((void *)0) VAL [={1:0}, blastFlag=0, buf={20511:20517}, init=1, ret=-1, s={20501:0}, s={20501:0}, skip=0, SSLv3_client_data={20494:0}, state=12292, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0] [L1250] EXPR s->version VAL [={1:0}, blastFlag=0, buf={20511:20517}, init=1, ret=-1, s={20501:0}, s={20501:0}, s->version=0, skip=0, SSLv3_client_data={20494:0}, state=12292, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0] [L1250] COND FALSE !((s->version & 65280) != 768) [L1256] s->type = 4096 [L1257] EXPR s->init_buf VAL [={1:0}, blastFlag=0, buf={20511:20517}, init=1, ret=-1, s={20501:0}, s={20501:0}, s->init_buf={-1:2}, skip=0, SSLv3_client_data={20494:0}, state=12292, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0] [L1257] COND FALSE !((unsigned long )s->init_buf == (unsigned long )((void *)0)) [L1269] tmp___4 = __VERIFIER_nondet_int() [L1270] COND FALSE !(! tmp___4) [L1276] tmp___5 = __VERIFIER_nondet_int() [L1277] COND FALSE !(! tmp___5) [L1283] s->state = 4368 [L1284] EXPR s->ctx [L1284] EXPR (s->ctx)->stats.sess_connect [L1284] (s->ctx)->stats.sess_connect += 1 [L1285] s->init_num = 0 VAL [={1:0}, blastFlag=0, buf={20511:20517}, init=1, ret=-1, s={20501:0}, s={20501:0}, skip=0, SSLv3_client_data={20494:0}, state=12292, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1605] EXPR s->s3 [L1605] EXPR (s->s3)->tmp.reuse_message VAL [={1:0}, (s->s3)->tmp.reuse_message=20542, blastFlag=0, buf={20511:20517}, init=1, ret=-1, s={20501:0}, s={20501:0}, s->s3={20506:0}, skip=0, SSLv3_client_data={20494:0}, state=12292, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1605] COND FALSE !(! (s->s3)->tmp.reuse_message) [L1634] skip = 0 VAL [={1:0}, blastFlag=0, buf={20511:20517}, init=1, ret=-1, s={20501:0}, s={20501:0}, skip=0, SSLv3_client_data={20494:0}, state=12292, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1131] COND TRUE 1 VAL [={1:0}, blastFlag=0, buf={20511:20517}, init=1, ret=-1, s={20501:0}, s={20501:0}, skip=0, SSLv3_client_data={20494:0}, state=12292, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1133] EXPR s->state [L1133] state = s->state [L1134] EXPR s->state VAL [={1:0}, blastFlag=0, buf={20511:20517}, init=1, ret=-1, s={20501:0}, s={20501:0}, s->state=4368, skip=0, SSLv3_client_data={20494:0}, state=4368, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1134] COND FALSE !(s->state == 12292) [L1137] EXPR s->state VAL [={1:0}, blastFlag=0, buf={20511:20517}, init=1, ret=-1, s={20501:0}, s={20501:0}, s->state=4368, skip=0, SSLv3_client_data={20494:0}, state=4368, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1137] COND FALSE !(s->state == 16384) [L1140] EXPR s->state VAL [={1:0}, blastFlag=0, buf={20511:20517}, init=1, ret=-1, s={20501:0}, s={20501:0}, s->state=4368, skip=0, SSLv3_client_data={20494:0}, state=4368, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1140] COND FALSE !(s->state == 4096) [L1143] EXPR s->state VAL [={1:0}, blastFlag=0, buf={20511:20517}, init=1, ret=-1, s={20501:0}, s={20501:0}, s->state=4368, skip=0, SSLv3_client_data={20494:0}, state=4368, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1143] COND FALSE !(s->state == 20480) [L1146] EXPR s->state VAL [={1:0}, blastFlag=0, buf={20511:20517}, init=1, ret=-1, s={20501:0}, s={20501:0}, s->state=4368, skip=0, SSLv3_client_data={20494:0}, state=4368, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1146] COND FALSE !(s->state == 4099) [L1149] EXPR s->state VAL [={1:0}, blastFlag=0, buf={20511:20517}, init=1, ret=-1, s={20501:0}, s={20501:0}, s->state=4368, skip=0, SSLv3_client_data={20494:0}, state=4368, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1149] COND TRUE s->state == 4368 [L1289] s->shutdown = 0 [L1290] ret = __VERIFIER_nondet_int() [L1291] COND TRUE blastFlag == 0 [L1292] blastFlag = 1 VAL [={1:0}, blastFlag=1, buf={20511:20517}, init=1, ret=1, s={20501:0}, s={20501:0}, skip=0, SSLv3_client_data={20494:0}, state=4368, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1296] COND FALSE !(ret <= 0) [L1301] s->state = 4384 [L1302] s->init_num = 0 [L1303] EXPR s->bbio [L1303] EXPR s->wbio VAL [={1:0}, blastFlag=1, buf={20511:20517}, init=1, ret=1, s={20501:0}, s={20501:0}, s->bbio={0:1}, s->wbio={0:0}, skip=0, SSLv3_client_data={20494:0}, state=4368, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1303] COND TRUE (unsigned long )s->bbio != (unsigned long )s->wbio [L1605] EXPR s->s3 [L1605] EXPR (s->s3)->tmp.reuse_message VAL [={1:0}, (s->s3)->tmp.reuse_message=20542, blastFlag=1, buf={20511:20517}, init=1, ret=1, s={20501:0}, s={20501:0}, s->s3={20506:0}, skip=0, SSLv3_client_data={20494:0}, state=4368, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1605] COND FALSE !(! (s->s3)->tmp.reuse_message) [L1634] skip = 0 VAL [={1:0}, blastFlag=1, buf={20511:20517}, init=1, ret=1, s={20501:0}, s={20501:0}, skip=0, SSLv3_client_data={20494:0}, state=4368, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1131] COND TRUE 1 VAL [={1:0}, blastFlag=1, buf={20511:20517}, init=1, ret=1, s={20501:0}, s={20501:0}, skip=0, SSLv3_client_data={20494:0}, state=4368, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1133] EXPR s->state [L1133] state = s->state [L1134] EXPR s->state VAL [={1:0}, blastFlag=1, buf={20511:20517}, init=1, ret=1, s={20501:0}, s={20501:0}, s->state=4384, skip=0, SSLv3_client_data={20494:0}, state=4384, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1134] COND FALSE !(s->state == 12292) [L1137] EXPR s->state VAL [={1:0}, blastFlag=1, buf={20511:20517}, init=1, ret=1, s={20501:0}, s={20501:0}, s->state=4384, skip=0, SSLv3_client_data={20494:0}, state=4384, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1137] COND FALSE !(s->state == 16384) [L1140] EXPR s->state VAL [={1:0}, blastFlag=1, buf={20511:20517}, init=1, ret=1, s={20501:0}, s={20501:0}, s->state=4384, skip=0, SSLv3_client_data={20494:0}, state=4384, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1140] COND FALSE !(s->state == 4096) [L1143] EXPR s->state VAL [={1:0}, blastFlag=1, buf={20511:20517}, init=1, ret=1, s={20501:0}, s={20501:0}, s->state=4384, skip=0, SSLv3_client_data={20494:0}, state=4384, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1143] COND FALSE !(s->state == 20480) [L1146] EXPR s->state VAL [={1:0}, blastFlag=1, buf={20511:20517}, init=1, ret=1, s={20501:0}, s={20501:0}, s->state=4384, skip=0, SSLv3_client_data={20494:0}, state=4384, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1146] COND FALSE !(s->state == 4099) [L1149] EXPR s->state VAL [={1:0}, blastFlag=1, buf={20511:20517}, init=1, ret=1, s={20501:0}, s={20501:0}, s->state=4384, skip=0, SSLv3_client_data={20494:0}, state=4384, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1149] COND FALSE !(s->state == 4368) [L1152] EXPR s->state VAL [={1:0}, blastFlag=1, buf={20511:20517}, init=1, ret=1, s={20501:0}, s={20501:0}, s->state=4384, skip=0, SSLv3_client_data={20494:0}, state=4384, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1152] COND FALSE !(s->state == 4369) [L1155] EXPR s->state VAL [={1:0}, blastFlag=1, buf={20511:20517}, init=1, ret=1, s={20501:0}, s={20501:0}, s->state=4384, skip=0, SSLv3_client_data={20494:0}, state=4384, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1155] COND TRUE s->state == 4384 [L1311] ret = __VERIFIER_nondet_int() [L1312] COND TRUE blastFlag == 1 [L1313] blastFlag = 2 VAL [={1:0}, blastFlag=2, buf={20511:20517}, init=1, ret=1, s={20501:0}, s={20501:0}, skip=0, SSLv3_client_data={20494:0}, state=4384, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1317] COND FALSE !(ret <= 0) [L1322] s->hit VAL [={1:0}, blastFlag=2, buf={20511:20517}, init=1, ret=1, s={20501:0}, s={20501:0}, s->hit=0, skip=0, SSLv3_client_data={20494:0}, state=4384, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1322] COND FALSE !(s->hit) [L1325] s->state = 4400 VAL [={1:0}, blastFlag=2, buf={20511:20517}, init=1, ret=1, s={20501:0}, s={20501:0}, skip=0, SSLv3_client_data={20494:0}, state=4384, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1327] s->init_num = 0 VAL [={1:0}, blastFlag=2, buf={20511:20517}, init=1, ret=1, s={20501:0}, s={20501:0}, skip=0, SSLv3_client_data={20494:0}, state=4384, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1605] EXPR s->s3 [L1605] EXPR (s->s3)->tmp.reuse_message VAL [={1:0}, (s->s3)->tmp.reuse_message=20542, blastFlag=2, buf={20511:20517}, init=1, ret=1, s={20501:0}, s={20501:0}, s->s3={20506:0}, skip=0, SSLv3_client_data={20494:0}, state=4384, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1605] COND FALSE !(! (s->s3)->tmp.reuse_message) [L1634] skip = 0 VAL [={1:0}, blastFlag=2, buf={20511:20517}, init=1, ret=1, s={20501:0}, s={20501:0}, skip=0, SSLv3_client_data={20494:0}, state=4384, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1131] COND TRUE 1 VAL [={1:0}, blastFlag=2, buf={20511:20517}, init=1, ret=1, s={20501:0}, s={20501:0}, skip=0, SSLv3_client_data={20494:0}, state=4384, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1133] EXPR s->state [L1133] state = s->state [L1134] EXPR s->state VAL [={1:0}, blastFlag=2, buf={20511:20517}, init=1, ret=1, s={20501:0}, s={20501:0}, s->state=4400, skip=0, SSLv3_client_data={20494:0}, state=4400, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1134] COND FALSE !(s->state == 12292) [L1137] EXPR s->state VAL [={1:0}, blastFlag=2, buf={20511:20517}, init=1, ret=1, s={20501:0}, s={20501:0}, s->state=4400, skip=0, SSLv3_client_data={20494:0}, state=4400, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1137] COND FALSE !(s->state == 16384) [L1140] EXPR s->state VAL [={1:0}, blastFlag=2, buf={20511:20517}, init=1, ret=1, s={20501:0}, s={20501:0}, s->state=4400, skip=0, SSLv3_client_data={20494:0}, state=4400, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1140] COND FALSE !(s->state == 4096) [L1143] EXPR s->state VAL [={1:0}, blastFlag=2, buf={20511:20517}, init=1, ret=1, s={20501:0}, s={20501:0}, s->state=4400, skip=0, SSLv3_client_data={20494:0}, state=4400, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1143] COND FALSE !(s->state == 20480) [L1146] EXPR s->state VAL [={1:0}, blastFlag=2, buf={20511:20517}, init=1, ret=1, s={20501:0}, s={20501:0}, s->state=4400, skip=0, SSLv3_client_data={20494:0}, state=4400, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1146] COND FALSE !(s->state == 4099) [L1149] EXPR s->state VAL [={1:0}, blastFlag=2, buf={20511:20517}, init=1, ret=1, s={20501:0}, s={20501:0}, s->state=4400, skip=0, SSLv3_client_data={20494:0}, state=4400, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1149] COND FALSE !(s->state == 4368) [L1152] EXPR s->state VAL [={1:0}, blastFlag=2, buf={20511:20517}, init=1, ret=1, s={20501:0}, s={20501:0}, s->state=4400, skip=0, SSLv3_client_data={20494:0}, state=4400, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1152] COND FALSE !(s->state == 4369) [L1155] EXPR s->state VAL [={1:0}, blastFlag=2, buf={20511:20517}, init=1, ret=1, s={20501:0}, s={20501:0}, s->state=4400, skip=0, SSLv3_client_data={20494:0}, state=4400, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1155] COND FALSE !(s->state == 4384) [L1158] EXPR s->state VAL [={1:0}, blastFlag=2, buf={20511:20517}, init=1, ret=1, s={20501:0}, s={20501:0}, s->state=4400, skip=0, SSLv3_client_data={20494:0}, state=4400, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1158] COND FALSE !(s->state == 4385) [L1161] EXPR s->state VAL [={1:0}, blastFlag=2, buf={20511:20517}, init=1, ret=1, s={20501:0}, s={20501:0}, s->state=4400, skip=0, SSLv3_client_data={20494:0}, state=4400, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1161] COND TRUE s->state == 4400 [L1331] EXPR s->s3 [L1331] EXPR (s->s3)->tmp.new_cipher [L1331] EXPR ((s->s3)->tmp.new_cipher)->algorithms VAL [={1:0}, ((s->s3)->tmp.new_cipher)->algorithms=20537, (s->s3)->tmp.new_cipher={20502:0}, blastFlag=2, buf={20511:20517}, init=1, ret=1, s={20501:0}, s={20501:0}, s->s3={20506:0}, skip=0, SSLv3_client_data={20494:0}, state=4400, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1331] COND FALSE !(((s->s3)->tmp.new_cipher)->algorithms & 256UL) [L1334] ret = __VERIFIER_nondet_int() [L1335] COND TRUE blastFlag == 2 [L1336] blastFlag = 3 VAL [={1:0}, blastFlag=3, buf={20511:20517}, init=1, ret=5, s={20501:0}, s={20501:0}, skip=0, SSLv3_client_data={20494:0}, state=4400, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1340] COND FALSE !(ret <= 0) VAL [={1:0}, blastFlag=3, buf={20511:20517}, init=1, ret=5, s={20501:0}, s={20501:0}, skip=0, SSLv3_client_data={20494:0}, state=4400, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1346] s->state = 4416 [L1347] s->init_num = 0 VAL [={1:0}, blastFlag=3, buf={20511:20517}, init=1, ret=5, s={20501:0}, s={20501:0}, skip=0, SSLv3_client_data={20494:0}, state=4400, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1605] EXPR s->s3 [L1605] EXPR (s->s3)->tmp.reuse_message VAL [={1:0}, (s->s3)->tmp.reuse_message=20542, blastFlag=3, buf={20511:20517}, init=1, ret=5, s={20501:0}, s={20501:0}, s->s3={20506:0}, skip=0, SSLv3_client_data={20494:0}, state=4400, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1605] COND FALSE !(! (s->s3)->tmp.reuse_message) [L1634] skip = 0 VAL [={1:0}, blastFlag=3, buf={20511:20517}, init=1, ret=5, s={20501:0}, s={20501:0}, skip=0, SSLv3_client_data={20494:0}, state=4400, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1131] COND TRUE 1 VAL [={1:0}, blastFlag=3, buf={20511:20517}, init=1, ret=5, s={20501:0}, s={20501:0}, skip=0, SSLv3_client_data={20494:0}, state=4400, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1133] EXPR s->state [L1133] state = s->state [L1134] EXPR s->state VAL [={1:0}, blastFlag=3, buf={20511:20517}, init=1, ret=5, s={20501:0}, s={20501:0}, s->state=4416, skip=0, SSLv3_client_data={20494:0}, state=4416, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1134] COND FALSE !(s->state == 12292) [L1137] EXPR s->state VAL [={1:0}, blastFlag=3, buf={20511:20517}, init=1, ret=5, s={20501:0}, s={20501:0}, s->state=4416, skip=0, SSLv3_client_data={20494:0}, state=4416, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1137] COND FALSE !(s->state == 16384) [L1140] EXPR s->state VAL [={1:0}, blastFlag=3, buf={20511:20517}, init=1, ret=5, s={20501:0}, s={20501:0}, s->state=4416, skip=0, SSLv3_client_data={20494:0}, state=4416, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1140] COND FALSE !(s->state == 4096) [L1143] EXPR s->state VAL [={1:0}, blastFlag=3, buf={20511:20517}, init=1, ret=5, s={20501:0}, s={20501:0}, s->state=4416, skip=0, SSLv3_client_data={20494:0}, state=4416, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1143] COND FALSE !(s->state == 20480) [L1146] EXPR s->state VAL [={1:0}, blastFlag=3, buf={20511:20517}, init=1, ret=5, s={20501:0}, s={20501:0}, s->state=4416, skip=0, SSLv3_client_data={20494:0}, state=4416, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1146] COND FALSE !(s->state == 4099) [L1149] EXPR s->state VAL [={1:0}, blastFlag=3, buf={20511:20517}, init=1, ret=5, s={20501:0}, s={20501:0}, s->state=4416, skip=0, SSLv3_client_data={20494:0}, state=4416, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1149] COND FALSE !(s->state == 4368) [L1152] EXPR s->state VAL [={1:0}, blastFlag=3, buf={20511:20517}, init=1, ret=5, s={20501:0}, s={20501:0}, s->state=4416, skip=0, SSLv3_client_data={20494:0}, state=4416, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1152] COND FALSE !(s->state == 4369) [L1155] EXPR s->state VAL [={1:0}, blastFlag=3, buf={20511:20517}, init=1, ret=5, s={20501:0}, s={20501:0}, s->state=4416, skip=0, SSLv3_client_data={20494:0}, state=4416, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1155] COND FALSE !(s->state == 4384) [L1158] EXPR s->state VAL [={1:0}, blastFlag=3, buf={20511:20517}, init=1, ret=5, s={20501:0}, s={20501:0}, s->state=4416, skip=0, SSLv3_client_data={20494:0}, state=4416, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1158] COND FALSE !(s->state == 4385) [L1161] EXPR s->state VAL [={1:0}, blastFlag=3, buf={20511:20517}, init=1, ret=5, s={20501:0}, s={20501:0}, s->state=4416, skip=0, SSLv3_client_data={20494:0}, state=4416, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1161] COND FALSE !(s->state == 4400) [L1164] EXPR s->state VAL [={1:0}, blastFlag=3, buf={20511:20517}, init=1, ret=5, s={20501:0}, s={20501:0}, s->state=4416, skip=0, SSLv3_client_data={20494:0}, state=4416, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1164] COND FALSE !(s->state == 4401) [L1167] EXPR s->state VAL [={1:0}, blastFlag=3, buf={20511:20517}, init=1, ret=5, s={20501:0}, s={20501:0}, s->state=4416, skip=0, SSLv3_client_data={20494:0}, state=4416, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1167] COND TRUE s->state == 4416 [L1351] ret = __VERIFIER_nondet_int() [L1352] COND TRUE blastFlag == 3 [L1353] blastFlag = 4 VAL [={1:0}, blastFlag=4, buf={20511:20517}, init=1, ret=6, s={20501:0}, s={20501:0}, skip=0, SSLv3_client_data={20494:0}, state=4416, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1357] COND FALSE !(ret <= 0) [L1362] s->state = 4432 [L1363] s->init_num = 0 [L1364] tmp___6 = __VERIFIER_nondet_int() [L1365] COND FALSE !(! tmp___6) VAL [={1:0}, blastFlag=4, buf={20511:20517}, init=1, ret=6, s={20501:0}, s={20501:0}, skip=0, SSLv3_client_data={20494:0}, state=4416, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1605] EXPR s->s3 [L1605] EXPR (s->s3)->tmp.reuse_message VAL [={1:0}, (s->s3)->tmp.reuse_message=20542, blastFlag=4, buf={20511:20517}, init=1, ret=6, s={20501:0}, s={20501:0}, s->s3={20506:0}, skip=0, SSLv3_client_data={20494:0}, state=4416, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1605] COND FALSE !(! (s->s3)->tmp.reuse_message) [L1634] skip = 0 VAL [={1:0}, blastFlag=4, buf={20511:20517}, init=1, ret=6, s={20501:0}, s={20501:0}, skip=0, SSLv3_client_data={20494:0}, state=4416, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1131] COND TRUE 1 VAL [={1:0}, blastFlag=4, buf={20511:20517}, init=1, ret=6, s={20501:0}, s={20501:0}, skip=0, SSLv3_client_data={20494:0}, state=4416, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1133] EXPR s->state [L1133] state = s->state [L1134] EXPR s->state VAL [={1:0}, blastFlag=4, buf={20511:20517}, init=1, ret=6, s={20501:0}, s={20501:0}, s->state=4432, skip=0, SSLv3_client_data={20494:0}, state=4432, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1134] COND FALSE !(s->state == 12292) [L1137] EXPR s->state VAL [={1:0}, blastFlag=4, buf={20511:20517}, init=1, ret=6, s={20501:0}, s={20501:0}, s->state=4432, skip=0, SSLv3_client_data={20494:0}, state=4432, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1137] COND FALSE !(s->state == 16384) [L1140] EXPR s->state VAL [={1:0}, blastFlag=4, buf={20511:20517}, init=1, ret=6, s={20501:0}, s={20501:0}, s->state=4432, skip=0, SSLv3_client_data={20494:0}, state=4432, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1140] COND FALSE !(s->state == 4096) [L1143] EXPR s->state VAL [={1:0}, blastFlag=4, buf={20511:20517}, init=1, ret=6, s={20501:0}, s={20501:0}, s->state=4432, skip=0, SSLv3_client_data={20494:0}, state=4432, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1143] COND FALSE !(s->state == 20480) [L1146] EXPR s->state VAL [={1:0}, blastFlag=4, buf={20511:20517}, init=1, ret=6, s={20501:0}, s={20501:0}, s->state=4432, skip=0, SSLv3_client_data={20494:0}, state=4432, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1146] COND FALSE !(s->state == 4099) [L1149] EXPR s->state VAL [={1:0}, blastFlag=4, buf={20511:20517}, init=1, ret=6, s={20501:0}, s={20501:0}, s->state=4432, skip=0, SSLv3_client_data={20494:0}, state=4432, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1149] COND FALSE !(s->state == 4368) [L1152] EXPR s->state VAL [={1:0}, blastFlag=4, buf={20511:20517}, init=1, ret=6, s={20501:0}, s={20501:0}, s->state=4432, skip=0, SSLv3_client_data={20494:0}, state=4432, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1152] COND FALSE !(s->state == 4369) [L1155] EXPR s->state VAL [={1:0}, blastFlag=4, buf={20511:20517}, init=1, ret=6, s={20501:0}, s={20501:0}, s->state=4432, skip=0, SSLv3_client_data={20494:0}, state=4432, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1155] COND FALSE !(s->state == 4384) [L1158] EXPR s->state VAL [={1:0}, blastFlag=4, buf={20511:20517}, init=1, ret=6, s={20501:0}, s={20501:0}, s->state=4432, skip=0, SSLv3_client_data={20494:0}, state=4432, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1158] COND FALSE !(s->state == 4385) [L1161] EXPR s->state VAL [={1:0}, blastFlag=4, buf={20511:20517}, init=1, ret=6, s={20501:0}, s={20501:0}, s->state=4432, skip=0, SSLv3_client_data={20494:0}, state=4432, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1161] COND FALSE !(s->state == 4400) [L1164] EXPR s->state VAL [={1:0}, blastFlag=4, buf={20511:20517}, init=1, ret=6, s={20501:0}, s={20501:0}, s->state=4432, skip=0, SSLv3_client_data={20494:0}, state=4432, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1164] COND FALSE !(s->state == 4401) [L1167] EXPR s->state VAL [={1:0}, blastFlag=4, buf={20511:20517}, init=1, ret=6, s={20501:0}, s={20501:0}, s->state=4432, skip=0, SSLv3_client_data={20494:0}, state=4432, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1167] COND FALSE !(s->state == 4416) [L1170] EXPR s->state VAL [={1:0}, blastFlag=4, buf={20511:20517}, init=1, ret=6, s={20501:0}, s={20501:0}, s->state=4432, skip=0, SSLv3_client_data={20494:0}, state=4432, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1170] COND FALSE !(s->state == 4417) [L1173] EXPR s->state VAL [={1:0}, blastFlag=4, buf={20511:20517}, init=1, ret=6, s={20501:0}, s={20501:0}, s->state=4432, skip=0, SSLv3_client_data={20494:0}, state=4432, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1173] COND TRUE s->state == 4432 [L1374] ret = __VERIFIER_nondet_int() [L1375] COND FALSE !(blastFlag == 5) VAL [={1:0}, blastFlag=4, buf={20511:20517}, init=1, ret=7, s={20501:0}, s={20501:0}, skip=0, SSLv3_client_data={20494:0}, state=4432, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1380] COND FALSE !(ret <= 0) [L1385] s->state = 4448 [L1386] s->init_num = 0 VAL [={1:0}, blastFlag=4, buf={20511:20517}, init=1, ret=7, s={20501:0}, s={20501:0}, skip=0, SSLv3_client_data={20494:0}, state=4432, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1605] EXPR s->s3 [L1605] EXPR (s->s3)->tmp.reuse_message VAL [={1:0}, (s->s3)->tmp.reuse_message=20542, blastFlag=4, buf={20511:20517}, init=1, ret=7, s={20501:0}, s={20501:0}, s->s3={20506:0}, skip=0, SSLv3_client_data={20494:0}, state=4432, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1605] COND FALSE !(! (s->s3)->tmp.reuse_message) [L1634] skip = 0 VAL [={1:0}, blastFlag=4, buf={20511:20517}, init=1, ret=7, s={20501:0}, s={20501:0}, skip=0, SSLv3_client_data={20494:0}, state=4432, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1131] COND TRUE 1 VAL [={1:0}, blastFlag=4, buf={20511:20517}, init=1, ret=7, s={20501:0}, s={20501:0}, skip=0, SSLv3_client_data={20494:0}, state=4432, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1133] EXPR s->state [L1133] state = s->state [L1134] EXPR s->state VAL [={1:0}, blastFlag=4, buf={20511:20517}, init=1, ret=7, s={20501:0}, s={20501:0}, s->state=4448, skip=0, SSLv3_client_data={20494:0}, state=4448, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1134] COND FALSE !(s->state == 12292) [L1137] EXPR s->state VAL [={1:0}, blastFlag=4, buf={20511:20517}, init=1, ret=7, s={20501:0}, s={20501:0}, s->state=4448, skip=0, SSLv3_client_data={20494:0}, state=4448, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1137] COND FALSE !(s->state == 16384) [L1140] EXPR s->state VAL [={1:0}, blastFlag=4, buf={20511:20517}, init=1, ret=7, s={20501:0}, s={20501:0}, s->state=4448, skip=0, SSLv3_client_data={20494:0}, state=4448, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1140] COND FALSE !(s->state == 4096) [L1143] EXPR s->state VAL [={1:0}, blastFlag=4, buf={20511:20517}, init=1, ret=7, s={20501:0}, s={20501:0}, s->state=4448, skip=0, SSLv3_client_data={20494:0}, state=4448, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1143] COND FALSE !(s->state == 20480) [L1146] EXPR s->state VAL [={1:0}, blastFlag=4, buf={20511:20517}, init=1, ret=7, s={20501:0}, s={20501:0}, s->state=4448, skip=0, SSLv3_client_data={20494:0}, state=4448, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1146] COND FALSE !(s->state == 4099) [L1149] EXPR s->state VAL [={1:0}, blastFlag=4, buf={20511:20517}, init=1, ret=7, s={20501:0}, s={20501:0}, s->state=4448, skip=0, SSLv3_client_data={20494:0}, state=4448, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1149] COND FALSE !(s->state == 4368) [L1152] EXPR s->state VAL [={1:0}, blastFlag=4, buf={20511:20517}, init=1, ret=7, s={20501:0}, s={20501:0}, s->state=4448, skip=0, SSLv3_client_data={20494:0}, state=4448, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1152] COND FALSE !(s->state == 4369) [L1155] EXPR s->state VAL [={1:0}, blastFlag=4, buf={20511:20517}, init=1, ret=7, s={20501:0}, s={20501:0}, s->state=4448, skip=0, SSLv3_client_data={20494:0}, state=4448, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1155] COND FALSE !(s->state == 4384) [L1158] EXPR s->state VAL [={1:0}, blastFlag=4, buf={20511:20517}, init=1, ret=7, s={20501:0}, s={20501:0}, s->state=4448, skip=0, SSLv3_client_data={20494:0}, state=4448, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1158] COND FALSE !(s->state == 4385) [L1161] EXPR s->state VAL [={1:0}, blastFlag=4, buf={20511:20517}, init=1, ret=7, s={20501:0}, s={20501:0}, s->state=4448, skip=0, SSLv3_client_data={20494:0}, state=4448, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1161] COND FALSE !(s->state == 4400) [L1164] EXPR s->state VAL [={1:0}, blastFlag=4, buf={20511:20517}, init=1, ret=7, s={20501:0}, s={20501:0}, s->state=4448, skip=0, SSLv3_client_data={20494:0}, state=4448, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1164] COND FALSE !(s->state == 4401) [L1167] EXPR s->state VAL [={1:0}, blastFlag=4, buf={20511:20517}, init=1, ret=7, s={20501:0}, s={20501:0}, s->state=4448, skip=0, SSLv3_client_data={20494:0}, state=4448, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1167] COND FALSE !(s->state == 4416) [L1170] EXPR s->state VAL [={1:0}, blastFlag=4, buf={20511:20517}, init=1, ret=7, s={20501:0}, s={20501:0}, s->state=4448, skip=0, SSLv3_client_data={20494:0}, state=4448, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1170] COND FALSE !(s->state == 4417) [L1173] EXPR s->state VAL [={1:0}, blastFlag=4, buf={20511:20517}, init=1, ret=7, s={20501:0}, s={20501:0}, s->state=4448, skip=0, SSLv3_client_data={20494:0}, state=4448, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1173] COND FALSE !(s->state == 4432) [L1176] EXPR s->state VAL [={1:0}, blastFlag=4, buf={20511:20517}, init=1, ret=7, s={20501:0}, s={20501:0}, s->state=4448, skip=0, SSLv3_client_data={20494:0}, state=4448, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1176] COND FALSE !(s->state == 4433) [L1179] EXPR s->state VAL [={1:0}, blastFlag=4, buf={20511:20517}, init=1, ret=7, s={20501:0}, s={20501:0}, s->state=4448, skip=0, SSLv3_client_data={20494:0}, state=4448, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1179] COND TRUE s->state == 4448 [L1390] ret = __VERIFIER_nondet_int() [L1391] COND TRUE blastFlag == 4 VAL [={1:0}, blastFlag=4, buf={20511:20517}, init=1, ret=0, s={20501:0}, s={20501:0}, skip=0, SSLv3_client_data={20494:0}, state=4448, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1646] __VERIFIER_error() VAL [={1:0}, blastFlag=4, buf={20511:20517}, init=1, ret=0, s={20501:0}, s={20501:0}, skip=0, SSLv3_client_data={20494:0}, state=4448, tmp=0, tmp___0={20501:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] - StatisticsResult: Ultimate Automizer benchmark data CFG has 4 procedures, 142 locations, 1 error locations. UNSAFE Result, 12.5s OverallTime, 36 OverallIterations, 7 TraceHistogramMax, 6.9s AutomataDifference, 0.0s DeadEndRemovalTime, 0.0s HoareAnnotationTime, HoareTripleCheckerStatistics: 7485 SDtfs, 3047 SDslu, 9993 SDs, 0 SdLazy, 5723 SolverSat, 243 SolverUnsat, 0 SolverUnknown, 0 SolverNotchecked, 5.1s Time, PredicateUnifierStatistics: 0 DeclaredPredicates, 217 GetRequests, 70 SyntacticMatches, 46 SemanticMatches, 101 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 2 ImplicationChecksByTransitivity, 0.7s Time, 0.0s BasicInterpolantAutomatonTime, BiggestAbstraction: size=1038occurred in iteration=35, traceCheckStatistics: No data available, InterpolantConsolidationStatistics: No data available, PathInvariantsStatistics: No data available, 0/0 InterpolantCoveringCapability, TotalInterpolationStatistics: No data available, 0.0s AbstIntTime, 0 AbstIntIterations, 0 AbstIntStrong, NaN AbsIntWeakeningRatio, NaN AbsIntAvgWeakeningVarsNumRemoved, NaN AbsIntAvgWeakenedConjuncts, 0.0s DumpTime, AutomataMinimizationStatistics: 0.5s AutomataMinimizationTime, 35 MinimizatonAttempts, 2754 StatesRemovedByMinimization, 30 NontrivialMinimizations, HoareAnnotationStatistics: No data available, RefinementEngineStatistics: TraceCheckStatistics: 0.1s SsaConstructionTime, 0.5s SatisfiabilityAnalysisTime, 1.3s InterpolantComputationTime, 3213 NumberOfCodeBlocks, 3213 NumberOfCodeBlocksAsserted, 36 NumberOfCheckSat, 3035 ConstructedInterpolants, 0 QuantifiedInterpolants, 683183 SizeOfPredicates, 0 NumberOfNonLiveVariables, 0 ConjunctsInSsa, 0 ConjunctsInUnsatCore, 35 InterpolantComputations, 35 PerfectInterpolantSequences, 2861/2861 InterpolantCoveringCapability, InvariantSynthesisStatistics: No data available, InterpolantConsolidationStatistics: No data available, ReuseStatistics: No data available RESULT: Ultimate could not prove your program: unable to determine feasibility of some traces Received shutdown request... ### Bit-precise run ### This is Ultimate 0.1.23-aa41828 [2018-11-23 07:46:59,128 INFO L170 SettingsManager]: Resetting all preferences to default values... [2018-11-23 07:46:59,130 INFO L174 SettingsManager]: Resetting UltimateCore preferences to default values [2018-11-23 07:46:59,138 INFO L177 SettingsManager]: Ultimate Commandline Interface provides no preferences, ignoring... [2018-11-23 07:46:59,138 INFO L174 SettingsManager]: Resetting Boogie Preprocessor preferences to default values [2018-11-23 07:46:59,139 INFO L174 SettingsManager]: Resetting Boogie Procedure Inliner preferences to default values [2018-11-23 07:46:59,140 INFO L174 SettingsManager]: Resetting Abstract Interpretation preferences to default values [2018-11-23 07:46:59,141 INFO L174 SettingsManager]: Resetting LassoRanker preferences to default values [2018-11-23 07:46:59,142 INFO L174 SettingsManager]: Resetting Reaching Definitions preferences to default values [2018-11-23 07:46:59,143 INFO L174 SettingsManager]: Resetting SyntaxChecker preferences to default values [2018-11-23 07:46:59,143 INFO L177 SettingsManager]: Büchi Program Product provides no preferences, ignoring... [2018-11-23 07:46:59,144 INFO L174 SettingsManager]: Resetting LTL2Aut preferences to default values [2018-11-23 07:46:59,144 INFO L174 SettingsManager]: Resetting PEA to Boogie preferences to default values [2018-11-23 07:46:59,145 INFO L174 SettingsManager]: Resetting BlockEncodingV2 preferences to default values [2018-11-23 07:46:59,146 INFO L174 SettingsManager]: Resetting ChcToBoogie preferences to default values [2018-11-23 07:46:59,146 INFO L174 SettingsManager]: Resetting AutomataScriptInterpreter preferences to default values [2018-11-23 07:46:59,147 INFO L174 SettingsManager]: Resetting BuchiAutomizer preferences to default values [2018-11-23 07:46:59,148 INFO L174 SettingsManager]: Resetting CACSL2BoogieTranslator preferences to default values [2018-11-23 07:46:59,150 INFO L174 SettingsManager]: Resetting CodeCheck preferences to default values [2018-11-23 07:46:59,151 INFO L174 SettingsManager]: Resetting InvariantSynthesis preferences to default values [2018-11-23 07:46:59,152 INFO L174 SettingsManager]: Resetting RCFGBuilder preferences to default values [2018-11-23 07:46:59,152 INFO L174 SettingsManager]: Resetting TraceAbstraction preferences to default values [2018-11-23 07:46:59,154 INFO L177 SettingsManager]: TraceAbstractionConcurrent provides no preferences, ignoring... [2018-11-23 07:46:59,155 INFO L177 SettingsManager]: TraceAbstractionWithAFAs provides no preferences, ignoring... [2018-11-23 07:46:59,155 INFO L174 SettingsManager]: Resetting TreeAutomizer preferences to default values [2018-11-23 07:46:59,155 INFO L174 SettingsManager]: Resetting IcfgTransformer preferences to default values [2018-11-23 07:46:59,156 INFO L174 SettingsManager]: Resetting Boogie Printer preferences to default values [2018-11-23 07:46:59,156 INFO L174 SettingsManager]: Resetting ReqPrinter preferences to default values [2018-11-23 07:46:59,158 INFO L174 SettingsManager]: Resetting Witness Printer preferences to default values [2018-11-23 07:46:59,158 INFO L177 SettingsManager]: Boogie PL CUP Parser provides no preferences, ignoring... [2018-11-23 07:46:59,159 INFO L174 SettingsManager]: Resetting CDTParser preferences to default values [2018-11-23 07:46:59,159 INFO L177 SettingsManager]: AutomataScriptParser provides no preferences, ignoring... [2018-11-23 07:46:59,159 INFO L177 SettingsManager]: ReqParser provides no preferences, ignoring... [2018-11-23 07:46:59,159 INFO L174 SettingsManager]: Resetting SmtParser preferences to default values [2018-11-23 07:46:59,160 INFO L174 SettingsManager]: Resetting Witness Parser preferences to default values [2018-11-23 07:46:59,160 INFO L181 SettingsManager]: Finished resetting all preferences to default values... [2018-11-23 07:46:59,161 INFO L98 SettingsManager]: Beginning loading settings from /tmp/vcloud-vcloud-master/worker/working_dir_21ce33b1-1901-46d0-92d7-0f8a6adbdd6c/bin-2019/uautomizer/config/svcomp-Reach-32bit-Automizer_Bitvector.epf [2018-11-23 07:46:59,171 INFO L110 SettingsManager]: Loading preferences was successful [2018-11-23 07:46:59,171 INFO L112 SettingsManager]: Preferences different from defaults after loading the file: [2018-11-23 07:46:59,172 INFO L131 SettingsManager]: Preferences of Boogie Procedure Inliner differ from their defaults: [2018-11-23 07:46:59,172 INFO L133 SettingsManager]: * ... calls to implemented procedures=ONLY_FOR_CONCURRENT_PROGRAMS [2018-11-23 07:46:59,172 INFO L131 SettingsManager]: Preferences of BlockEncodingV2 differ from their defaults: [2018-11-23 07:46:59,172 INFO L133 SettingsManager]: * Create parallel compositions if possible=false [2018-11-23 07:46:59,173 INFO L133 SettingsManager]: * Use SBE=true [2018-11-23 07:46:59,173 INFO L131 SettingsManager]: Preferences of CACSL2BoogieTranslator differ from their defaults: [2018-11-23 07:46:59,173 INFO L133 SettingsManager]: * sizeof long=4 [2018-11-23 07:46:59,174 INFO L133 SettingsManager]: * sizeof POINTER=4 [2018-11-23 07:46:59,174 INFO L133 SettingsManager]: * Check division by zero=IGNORE [2018-11-23 07:46:59,174 INFO L133 SettingsManager]: * Pointer to allocated memory at dereference=IGNORE [2018-11-23 07:46:59,174 INFO L133 SettingsManager]: * If two pointers are subtracted or compared they have the same base address=IGNORE [2018-11-23 07:46:59,174 INFO L133 SettingsManager]: * Check array bounds for arrays that are off heap=IGNORE [2018-11-23 07:46:59,174 INFO L133 SettingsManager]: * Use bitvectors instead of ints=true [2018-11-23 07:46:59,174 INFO L133 SettingsManager]: * Memory model=HoenickeLindenmann_4ByteResolution [2018-11-23 07:46:59,175 INFO L133 SettingsManager]: * sizeof long double=12 [2018-11-23 07:46:59,175 INFO L133 SettingsManager]: * Check if freed pointer was valid=false [2018-11-23 07:46:59,175 INFO L133 SettingsManager]: * Use constant arrays=true [2018-11-23 07:46:59,175 INFO L133 SettingsManager]: * Pointer base address is valid at dereference=IGNORE [2018-11-23 07:46:59,175 INFO L131 SettingsManager]: Preferences of RCFGBuilder differ from their defaults: [2018-11-23 07:46:59,175 INFO L133 SettingsManager]: * Size of a code block=SequenceOfStatements [2018-11-23 07:46:59,175 INFO L133 SettingsManager]: * To the following directory=./dump/ [2018-11-23 07:46:59,175 INFO L133 SettingsManager]: * SMT solver=External_DefaultMode [2018-11-23 07:46:59,176 INFO L133 SettingsManager]: * Command for external solver=z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in -t:2000 [2018-11-23 07:46:59,176 INFO L131 SettingsManager]: Preferences of TraceAbstraction differ from their defaults: [2018-11-23 07:46:59,176 INFO L133 SettingsManager]: * Compute Interpolants along a Counterexample=FPandBP [2018-11-23 07:46:59,176 INFO L133 SettingsManager]: * Positions where we compute the Hoare Annotation=LoopsAndPotentialCycles [2018-11-23 07:46:59,176 INFO L133 SettingsManager]: * Trace refinement strategy=WOLF [2018-11-23 07:46:59,176 INFO L133 SettingsManager]: * SMT solver=External_ModelsAndUnsatCoreMode [2018-11-23 07:46:59,176 INFO L133 SettingsManager]: * Command for external solver=cvc4nyu --tear-down-incremental --rewrite-divk --print-success --lang smt [2018-11-23 07:46:59,176 INFO L133 SettingsManager]: * Logic for external solver=AUFBV [2018-11-23 07:46:59,176 INFO L133 SettingsManager]: * Compute Hoare Annotation of negated interpolant automaton, abstraction and CFG=true Applying setting for plugin de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator: Entry function -> main Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Witness directory -> /tmp/vcloud-vcloud-master/worker/working_dir_21ce33b1-1901-46d0-92d7-0f8a6adbdd6c/bin-2019/uautomizer Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Witness filename -> witness.graphml Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Write witness besides input file -> false Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Graph data specification -> CHECK( init(main()), LTL(G ! call(__VERIFIER_error())) ) Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Graph data producer -> Automizer Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Graph data architecture -> 32bit Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Graph data programhash -> 9b2fdeede7b1203b845c20c562beaee69c29ce3b [2018-11-23 07:46:59,207 INFO L81 nceAwareModelManager]: Repository-Root is: /tmp [2018-11-23 07:46:59,215 INFO L258 ainManager$Toolchain]: [Toolchain 1]: Applicable parser(s) successfully (re)initialized [2018-11-23 07:46:59,218 INFO L214 ainManager$Toolchain]: [Toolchain 1]: Toolchain selected. [2018-11-23 07:46:59,219 INFO L271 PluginConnector]: Initializing CDTParser... [2018-11-23 07:46:59,219 INFO L276 PluginConnector]: CDTParser initialized [2018-11-23 07:46:59,220 INFO L418 ainManager$Toolchain]: [Toolchain 1]: Parsing single file: /tmp/vcloud-vcloud-master/worker/working_dir_21ce33b1-1901-46d0-92d7-0f8a6adbdd6c/bin-2019/uautomizer/../../sv-benchmarks/c/ssh/s3_clnt.blast.01_false-unreach-call.i.cil.c [2018-11-23 07:46:59,263 INFO L221 CDTParser]: Created temporary CDT project at /tmp/vcloud-vcloud-master/worker/working_dir_21ce33b1-1901-46d0-92d7-0f8a6adbdd6c/bin-2019/uautomizer/data/c3ea977c5/94da1ba7744444beae16d2c1b5d0e9e4/FLAGd40ff3d30 [2018-11-23 07:46:59,715 INFO L307 CDTParser]: Found 1 translation units. [2018-11-23 07:46:59,716 INFO L161 CDTParser]: Scanning /tmp/vcloud-vcloud-master/worker/working_dir_21ce33b1-1901-46d0-92d7-0f8a6adbdd6c/sv-benchmarks/c/ssh/s3_clnt.blast.01_false-unreach-call.i.cil.c [2018-11-23 07:46:59,727 INFO L355 CDTParser]: About to delete temporary CDT project at /tmp/vcloud-vcloud-master/worker/working_dir_21ce33b1-1901-46d0-92d7-0f8a6adbdd6c/bin-2019/uautomizer/data/c3ea977c5/94da1ba7744444beae16d2c1b5d0e9e4/FLAGd40ff3d30 [2018-11-23 07:46:59,735 INFO L363 CDTParser]: Successfully deleted /tmp/vcloud-vcloud-master/worker/working_dir_21ce33b1-1901-46d0-92d7-0f8a6adbdd6c/bin-2019/uautomizer/data/c3ea977c5/94da1ba7744444beae16d2c1b5d0e9e4 [2018-11-23 07:46:59,738 INFO L296 ainManager$Toolchain]: ####################### [Toolchain 1] ####################### [2018-11-23 07:46:59,738 INFO L131 ToolchainWalker]: Walking toolchain with 6 elements. [2018-11-23 07:46:59,739 INFO L113 PluginConnector]: ------------------------CACSL2BoogieTranslator---------------------------- [2018-11-23 07:46:59,739 INFO L271 PluginConnector]: Initializing CACSL2BoogieTranslator... [2018-11-23 07:46:59,741 INFO L276 PluginConnector]: CACSL2BoogieTranslator initialized [2018-11-23 07:46:59,741 INFO L185 PluginConnector]: Executing the observer ACSLObjectContainerObserver from plugin CACSL2BoogieTranslator for "CDTParser AST 23.11 07:46:59" (1/1) ... [2018-11-23 07:46:59,743 INFO L205 PluginConnector]: Invalid model from CACSL2BoogieTranslator for observer de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator.ACSLObjectContainerObserver@4e6fd5c8 and model type de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 23.11 07:46:59, skipping insertion in model container [2018-11-23 07:46:59,743 INFO L185 PluginConnector]: Executing the observer CACSL2BoogieTranslatorObserver from plugin CACSL2BoogieTranslator for "CDTParser AST 23.11 07:46:59" (1/1) ... [2018-11-23 07:46:59,749 INFO L145 MainTranslator]: Starting translation in SV-COMP mode [2018-11-23 07:46:59,786 INFO L176 MainTranslator]: Built tables and reachable declarations [2018-11-23 07:47:00,067 INFO L201 PostProcessor]: Analyzing one entry point: main [2018-11-23 07:47:00,077 INFO L191 MainTranslator]: Completed pre-run [2018-11-23 07:47:00,199 INFO L201 PostProcessor]: Analyzing one entry point: main [2018-11-23 07:47:00,216 INFO L195 MainTranslator]: Completed translation [2018-11-23 07:47:00,216 INFO L202 PluginConnector]: Adding new model de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 23.11 07:47:00 WrapperNode [2018-11-23 07:47:00,216 INFO L132 PluginConnector]: ------------------------ END CACSL2BoogieTranslator---------------------------- [2018-11-23 07:47:00,217 INFO L113 PluginConnector]: ------------------------Boogie Procedure Inliner---------------------------- [2018-11-23 07:47:00,217 INFO L271 PluginConnector]: Initializing Boogie Procedure Inliner... [2018-11-23 07:47:00,218 INFO L276 PluginConnector]: Boogie Procedure Inliner initialized [2018-11-23 07:47:00,224 INFO L185 PluginConnector]: Executing the observer TypeChecker from plugin Boogie Procedure Inliner for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 23.11 07:47:00" (1/1) ... [2018-11-23 07:47:00,244 INFO L185 PluginConnector]: Executing the observer Inliner from plugin Boogie Procedure Inliner for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 23.11 07:47:00" (1/1) ... [2018-11-23 07:47:00,252 INFO L132 PluginConnector]: ------------------------ END Boogie Procedure Inliner---------------------------- [2018-11-23 07:47:00,252 INFO L113 PluginConnector]: ------------------------Boogie Preprocessor---------------------------- [2018-11-23 07:47:00,252 INFO L271 PluginConnector]: Initializing Boogie Preprocessor... [2018-11-23 07:47:00,252 INFO L276 PluginConnector]: Boogie Preprocessor initialized [2018-11-23 07:47:00,260 INFO L185 PluginConnector]: Executing the observer EnsureBoogieModelObserver from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 23.11 07:47:00" (1/1) ... [2018-11-23 07:47:00,260 INFO L185 PluginConnector]: Executing the observer TypeChecker from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 23.11 07:47:00" (1/1) ... [2018-11-23 07:47:00,266 INFO L185 PluginConnector]: Executing the observer ConstExpander from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 23.11 07:47:00" (1/1) ... [2018-11-23 07:47:00,266 INFO L185 PluginConnector]: Executing the observer StructExpander from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 23.11 07:47:00" (1/1) ... [2018-11-23 07:47:00,300 INFO L185 PluginConnector]: Executing the observer UnstructureCode from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 23.11 07:47:00" (1/1) ... [2018-11-23 07:47:00,307 INFO L185 PluginConnector]: Executing the observer FunctionInliner from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 23.11 07:47:00" (1/1) ... [2018-11-23 07:47:00,310 INFO L185 PluginConnector]: Executing the observer BoogieSymbolTableConstructor from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 23.11 07:47:00" (1/1) ... [2018-11-23 07:47:00,313 INFO L132 PluginConnector]: ------------------------ END Boogie Preprocessor---------------------------- [2018-11-23 07:47:00,314 INFO L113 PluginConnector]: ------------------------RCFGBuilder---------------------------- [2018-11-23 07:47:00,314 INFO L271 PluginConnector]: Initializing RCFGBuilder... [2018-11-23 07:47:00,314 INFO L276 PluginConnector]: RCFGBuilder initialized [2018-11-23 07:47:00,315 INFO L185 PluginConnector]: Executing the observer RCFGBuilderObserver from plugin RCFGBuilder for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 23.11 07:47:00" (1/1) ... No working directory specified, using /tmp/vcloud-vcloud-master/worker/working_dir_21ce33b1-1901-46d0-92d7-0f8a6adbdd6c/bin-2019/uautomizer/z3 Starting monitored process 1 with z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in -t:2000 (exit command is (exit), workingDir is null) Waiting until toolchain timeout for monitored process 1 with z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in -t:2000 [2018-11-23 07:47:00,362 INFO L130 BoogieDeclarations]: Found specification of procedure write~init~$Pointer$ [2018-11-23 07:47:00,362 INFO L130 BoogieDeclarations]: Found specification of procedure main [2018-11-23 07:47:00,362 INFO L138 BoogieDeclarations]: Found implementation of procedure main [2018-11-23 07:47:00,363 INFO L130 BoogieDeclarations]: Found specification of procedure write~init~intINTTYPE4 [2018-11-23 07:47:00,363 INFO L130 BoogieDeclarations]: Found specification of procedure write~$Pointer$ [2018-11-23 07:47:00,363 INFO L130 BoogieDeclarations]: Found specification of procedure #Ultimate.alloc [2018-11-23 07:47:00,363 INFO L130 BoogieDeclarations]: Found specification of procedure read~intINTTYPE4 [2018-11-23 07:47:00,363 INFO L130 BoogieDeclarations]: Found specification of procedure read~$Pointer$ [2018-11-23 07:47:00,363 INFO L130 BoogieDeclarations]: Found specification of procedure ULTIMATE.init [2018-11-23 07:47:00,363 INFO L138 BoogieDeclarations]: Found implementation of procedure ULTIMATE.init [2018-11-23 07:47:00,363 INFO L130 BoogieDeclarations]: Found specification of procedure ssl3_connect [2018-11-23 07:47:00,364 INFO L138 BoogieDeclarations]: Found implementation of procedure ssl3_connect [2018-11-23 07:47:00,364 INFO L130 BoogieDeclarations]: Found specification of procedure ULTIMATE.start [2018-11-23 07:47:00,364 INFO L138 BoogieDeclarations]: Found implementation of procedure ULTIMATE.start [2018-11-23 07:47:00,365 INFO L130 BoogieDeclarations]: Found specification of procedure write~intINTTYPE4 [2018-11-23 07:47:00,558 WARN L640 $ProcedureCfgBuilder]: Two Gotos in a row! There was dead code [2018-11-23 07:47:00,558 WARN L605 $ProcedureCfgBuilder]: Label in the middle of a codeblock. [2018-11-23 07:47:02,462 INFO L275 CfgBuilder]: Using the 1 location(s) as analysis (start of procedure ULTIMATE.start) [2018-11-23 07:47:02,463 INFO L280 CfgBuilder]: Removed 1 assue(true) statements. [2018-11-23 07:47:02,463 INFO L202 PluginConnector]: Adding new model de.uni_freiburg.informatik.ultimate.plugins.generator.rcfgbuilder CFG 23.11 07:47:02 BoogieIcfgContainer [2018-11-23 07:47:02,463 INFO L132 PluginConnector]: ------------------------ END RCFGBuilder---------------------------- [2018-11-23 07:47:02,464 INFO L113 PluginConnector]: ------------------------TraceAbstraction---------------------------- [2018-11-23 07:47:02,464 INFO L271 PluginConnector]: Initializing TraceAbstraction... [2018-11-23 07:47:02,466 INFO L276 PluginConnector]: TraceAbstraction initialized [2018-11-23 07:47:02,466 INFO L185 PluginConnector]: Executing the observer TraceAbstractionObserver from plugin TraceAbstraction for "CDTParser AST 23.11 07:46:59" (1/3) ... [2018-11-23 07:47:02,467 INFO L205 PluginConnector]: Invalid model from TraceAbstraction for observer de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction.TraceAbstractionObserver@23808c53 and model type de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction AST 23.11 07:47:02, skipping insertion in model container [2018-11-23 07:47:02,467 INFO L185 PluginConnector]: Executing the observer TraceAbstractionObserver from plugin TraceAbstraction for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 23.11 07:47:00" (2/3) ... [2018-11-23 07:47:02,467 INFO L205 PluginConnector]: Invalid model from TraceAbstraction for observer de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction.TraceAbstractionObserver@23808c53 and model type de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction AST 23.11 07:47:02, skipping insertion in model container [2018-11-23 07:47:02,467 INFO L185 PluginConnector]: Executing the observer TraceAbstractionObserver from plugin TraceAbstraction for "de.uni_freiburg.informatik.ultimate.plugins.generator.rcfgbuilder CFG 23.11 07:47:02" (3/3) ... [2018-11-23 07:47:02,469 INFO L112 eAbstractionObserver]: Analyzing ICFG s3_clnt.blast.01_false-unreach-call.i.cil.c [2018-11-23 07:47:02,474 INFO L156 ceAbstractionStarter]: Automizer settings: Hoare:true NWA Interpolation:FPandBP Determinization: PREDICATE_ABSTRACTION [2018-11-23 07:47:02,479 INFO L168 ceAbstractionStarter]: Appying trace abstraction to program that has 1 error locations. [2018-11-23 07:47:02,487 INFO L257 AbstractCegarLoop]: Starting to check reachability of 1 error locations. [2018-11-23 07:47:02,506 INFO L133 ementStrategyFactory]: Using default assertion order modulation [2018-11-23 07:47:02,506 INFO L382 AbstractCegarLoop]: Interprodecural is true [2018-11-23 07:47:02,507 INFO L383 AbstractCegarLoop]: Hoare is true [2018-11-23 07:47:02,507 INFO L384 AbstractCegarLoop]: Compute interpolants for FPandBP [2018-11-23 07:47:02,507 INFO L385 AbstractCegarLoop]: Backedges is STRAIGHT_LINE [2018-11-23 07:47:02,507 INFO L386 AbstractCegarLoop]: Determinization is PREDICATE_ABSTRACTION [2018-11-23 07:47:02,507 INFO L387 AbstractCegarLoop]: Difference is false [2018-11-23 07:47:02,507 INFO L388 AbstractCegarLoop]: Minimize is MINIMIZE_SEVPA [2018-11-23 07:47:02,507 INFO L393 AbstractCegarLoop]: ======== Iteration 0==of CEGAR loop == AllErrorsAtOnce======== [2018-11-23 07:47:02,522 INFO L276 IsEmpty]: Start isEmpty. Operand 140 states. [2018-11-23 07:47:02,527 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 31 [2018-11-23 07:47:02,527 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 07:47:02,528 INFO L402 BasicCegarLoop]: trace histogram [1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 07:47:02,529 INFO L423 AbstractCegarLoop]: === Iteration 1 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 07:47:02,532 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 07:47:02,532 INFO L82 PathProgramCache]: Analyzing trace with hash -1513562951, now seen corresponding path program 1 times [2018-11-23 07:47:02,536 INFO L223 ckRefinementStrategy]: Switched to mode CVC4_FPBP [2018-11-23 07:47:02,536 INFO L69 tionRefinementEngine]: Using refinement strategy WolfRefinementStrategy No working directory specified, using /tmp/vcloud-vcloud-master/worker/working_dir_21ce33b1-1901-46d0-92d7-0f8a6adbdd6c/bin-2019/uautomizer/cvc4nyu Starting monitored process 2 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk (exit command is (exit), workingDir is null) Waiting until toolchain timeout for monitored process 2 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk [2018-11-23 07:47:02,557 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 07:47:02,620 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 07:47:02,628 INFO L273 TraceCheckSpWp]: Computing forward predicates... [2018-11-23 07:47:02,652 INFO L134 CoverageAnalysis]: Checked inductivity of 0 backedges. 0 proven. 0 refuted. 0 times theorem prover too weak. 0 trivial. 0 not checked. [2018-11-23 07:47:02,652 INFO L312 TraceCheckSpWp]: Omiting computation of backward sequence because forward sequence was already perfect [2018-11-23 07:47:02,658 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 07:47:02,659 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [3] imperfect sequences [] total 3 [2018-11-23 07:47:02,661 INFO L459 AbstractCegarLoop]: Interpolant automaton has 3 states [2018-11-23 07:47:02,669 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 3 interpolants. [2018-11-23 07:47:02,669 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=3, Invalid=3, Unknown=0, NotChecked=0, Total=6 [2018-11-23 07:47:02,670 INFO L87 Difference]: Start difference. First operand 140 states. Second operand 3 states. [2018-11-23 07:47:02,753 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 07:47:02,754 INFO L93 Difference]: Finished difference Result 385 states and 637 transitions. [2018-11-23 07:47:02,754 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 3 states. [2018-11-23 07:47:02,755 INFO L78 Accepts]: Start accepts. Automaton has 3 states. Word has length 30 [2018-11-23 07:47:02,756 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 07:47:02,766 INFO L225 Difference]: With dead ends: 385 [2018-11-23 07:47:02,766 INFO L226 Difference]: Without dead ends: 223 [2018-11-23 07:47:02,769 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 29 GetRequests, 28 SyntacticMatches, 0 SemanticMatches, 1 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=3, Invalid=3, Unknown=0, NotChecked=0, Total=6 [2018-11-23 07:47:02,787 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 223 states. [2018-11-23 07:47:02,812 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 223 to 223. [2018-11-23 07:47:02,813 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 223 states. [2018-11-23 07:47:02,816 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 223 states to 223 states and 327 transitions. [2018-11-23 07:47:02,817 INFO L78 Accepts]: Start accepts. Automaton has 223 states and 327 transitions. Word has length 30 [2018-11-23 07:47:02,817 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 07:47:02,817 INFO L480 AbstractCegarLoop]: Abstraction has 223 states and 327 transitions. [2018-11-23 07:47:02,817 INFO L481 AbstractCegarLoop]: Interpolant automaton has 3 states. [2018-11-23 07:47:02,818 INFO L276 IsEmpty]: Start isEmpty. Operand 223 states and 327 transitions. [2018-11-23 07:47:02,819 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 46 [2018-11-23 07:47:02,819 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 07:47:02,819 INFO L402 BasicCegarLoop]: trace histogram [2, 2, 2, 2, 2, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 07:47:02,819 INFO L423 AbstractCegarLoop]: === Iteration 2 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 07:47:02,820 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 07:47:02,820 INFO L82 PathProgramCache]: Analyzing trace with hash -959560751, now seen corresponding path program 1 times [2018-11-23 07:47:02,820 INFO L223 ckRefinementStrategy]: Switched to mode CVC4_FPBP [2018-11-23 07:47:02,821 INFO L69 tionRefinementEngine]: Using refinement strategy WolfRefinementStrategy No working directory specified, using /tmp/vcloud-vcloud-master/worker/working_dir_21ce33b1-1901-46d0-92d7-0f8a6adbdd6c/bin-2019/uautomizer/cvc4nyu Starting monitored process 3 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk (exit command is (exit), workingDir is null) Waiting until toolchain timeout for monitored process 3 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk [2018-11-23 07:47:02,839 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 07:47:02,898 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 07:47:02,903 INFO L273 TraceCheckSpWp]: Computing forward predicates... [2018-11-23 07:47:02,922 INFO L134 CoverageAnalysis]: Checked inductivity of 8 backedges. 8 proven. 0 refuted. 0 times theorem prover too weak. 0 trivial. 0 not checked. [2018-11-23 07:47:02,922 INFO L312 TraceCheckSpWp]: Omiting computation of backward sequence because forward sequence was already perfect [2018-11-23 07:47:02,924 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 07:47:02,924 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [3] imperfect sequences [] total 3 [2018-11-23 07:47:02,926 INFO L459 AbstractCegarLoop]: Interpolant automaton has 3 states [2018-11-23 07:47:02,926 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 3 interpolants. [2018-11-23 07:47:02,926 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=3, Invalid=3, Unknown=0, NotChecked=0, Total=6 [2018-11-23 07:47:02,926 INFO L87 Difference]: Start difference. First operand 223 states and 327 transitions. Second operand 3 states. [2018-11-23 07:47:03,050 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 07:47:03,050 INFO L93 Difference]: Finished difference Result 432 states and 642 transitions. [2018-11-23 07:47:03,051 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 3 states. [2018-11-23 07:47:03,051 INFO L78 Accepts]: Start accepts. Automaton has 3 states. Word has length 45 [2018-11-23 07:47:03,051 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 07:47:03,053 INFO L225 Difference]: With dead ends: 432 [2018-11-23 07:47:03,053 INFO L226 Difference]: Without dead ends: 325 [2018-11-23 07:47:03,054 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 44 GetRequests, 43 SyntacticMatches, 0 SemanticMatches, 1 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=3, Invalid=3, Unknown=0, NotChecked=0, Total=6 [2018-11-23 07:47:03,055 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 325 states. [2018-11-23 07:47:03,070 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 325 to 325. [2018-11-23 07:47:03,070 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 325 states. [2018-11-23 07:47:03,072 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 325 states to 325 states and 476 transitions. [2018-11-23 07:47:03,072 INFO L78 Accepts]: Start accepts. Automaton has 325 states and 476 transitions. Word has length 45 [2018-11-23 07:47:03,072 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 07:47:03,073 INFO L480 AbstractCegarLoop]: Abstraction has 325 states and 476 transitions. [2018-11-23 07:47:03,073 INFO L481 AbstractCegarLoop]: Interpolant automaton has 3 states. [2018-11-23 07:47:03,073 INFO L276 IsEmpty]: Start isEmpty. Operand 325 states and 476 transitions. [2018-11-23 07:47:03,075 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 64 [2018-11-23 07:47:03,075 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 07:47:03,075 INFO L402 BasicCegarLoop]: trace histogram [3, 3, 3, 3, 3, 3, 3, 2, 2, 2, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 07:47:03,076 INFO L423 AbstractCegarLoop]: === Iteration 3 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 07:47:03,076 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 07:47:03,076 INFO L82 PathProgramCache]: Analyzing trace with hash -1822634295, now seen corresponding path program 1 times [2018-11-23 07:47:03,077 INFO L223 ckRefinementStrategy]: Switched to mode CVC4_FPBP [2018-11-23 07:47:03,077 INFO L69 tionRefinementEngine]: Using refinement strategy WolfRefinementStrategy No working directory specified, using /tmp/vcloud-vcloud-master/worker/working_dir_21ce33b1-1901-46d0-92d7-0f8a6adbdd6c/bin-2019/uautomizer/cvc4nyu Starting monitored process 4 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk (exit command is (exit), workingDir is null) Waiting until toolchain timeout for monitored process 4 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk [2018-11-23 07:47:03,101 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 07:47:03,189 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 07:47:03,196 INFO L273 TraceCheckSpWp]: Computing forward predicates... [2018-11-23 07:47:03,210 INFO L134 CoverageAnalysis]: Checked inductivity of 29 backedges. 21 proven. 0 refuted. 0 times theorem prover too weak. 8 trivial. 0 not checked. [2018-11-23 07:47:03,210 INFO L312 TraceCheckSpWp]: Omiting computation of backward sequence because forward sequence was already perfect [2018-11-23 07:47:03,212 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 07:47:03,213 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [3] imperfect sequences [] total 3 [2018-11-23 07:47:03,213 INFO L459 AbstractCegarLoop]: Interpolant automaton has 3 states [2018-11-23 07:47:03,213 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 3 interpolants. [2018-11-23 07:47:03,213 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=3, Invalid=3, Unknown=0, NotChecked=0, Total=6 [2018-11-23 07:47:03,214 INFO L87 Difference]: Start difference. First operand 325 states and 476 transitions. Second operand 3 states. [2018-11-23 07:47:03,338 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 07:47:03,339 INFO L93 Difference]: Finished difference Result 638 states and 943 transitions. [2018-11-23 07:47:03,339 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 3 states. [2018-11-23 07:47:03,339 INFO L78 Accepts]: Start accepts. Automaton has 3 states. Word has length 63 [2018-11-23 07:47:03,340 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 07:47:03,341 INFO L225 Difference]: With dead ends: 638 [2018-11-23 07:47:03,342 INFO L226 Difference]: Without dead ends: 429 [2018-11-23 07:47:03,343 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 62 GetRequests, 61 SyntacticMatches, 0 SemanticMatches, 1 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=3, Invalid=3, Unknown=0, NotChecked=0, Total=6 [2018-11-23 07:47:03,343 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 429 states. [2018-11-23 07:47:03,358 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 429 to 429. [2018-11-23 07:47:03,358 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 429 states. [2018-11-23 07:47:03,360 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 429 states to 429 states and 628 transitions. [2018-11-23 07:47:03,360 INFO L78 Accepts]: Start accepts. Automaton has 429 states and 628 transitions. Word has length 63 [2018-11-23 07:47:03,360 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 07:47:03,360 INFO L480 AbstractCegarLoop]: Abstraction has 429 states and 628 transitions. [2018-11-23 07:47:03,361 INFO L481 AbstractCegarLoop]: Interpolant automaton has 3 states. [2018-11-23 07:47:03,361 INFO L276 IsEmpty]: Start isEmpty. Operand 429 states and 628 transitions. [2018-11-23 07:47:03,363 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 84 [2018-11-23 07:47:03,363 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 07:47:03,363 INFO L402 BasicCegarLoop]: trace histogram [4, 4, 4, 4, 4, 4, 4, 3, 3, 3, 3, 3, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 07:47:03,363 INFO L423 AbstractCegarLoop]: === Iteration 4 === [ssl3_connectErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 07:47:03,363 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 07:47:03,364 INFO L82 PathProgramCache]: Analyzing trace with hash -1221318135, now seen corresponding path program 1 times [2018-11-23 07:47:03,364 INFO L223 ckRefinementStrategy]: Switched to mode CVC4_FPBP [2018-11-23 07:47:03,364 INFO L69 tionRefinementEngine]: Using refinement strategy WolfRefinementStrategy No working directory specified, using /tmp/vcloud-vcloud-master/worker/working_dir_21ce33b1-1901-46d0-92d7-0f8a6adbdd6c/bin-2019/uautomizer/cvc4nyu Starting monitored process 5 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk (exit command is (exit), workingDir is null) Waiting until toolchain timeout for monitored process 5 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk [2018-11-23 07:47:03,386 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 07:47:03,492 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 07:47:03,499 INFO L273 TraceCheckSpWp]: Computing forward predicates... [2018-11-23 07:47:03,532 INFO L134 CoverageAnalysis]: Checked inductivity of 65 backedges. 36 proven. 0 refuted. 0 times theorem prover too weak. 29 trivial. 0 not checked. [2018-11-23 07:47:03,532 INFO L312 TraceCheckSpWp]: Omiting computation of backward sequence because forward sequence was already perfect [2018-11-23 07:47:03,534 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 07:47:03,535 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [3] imperfect sequences [] total 3 WARNING: YOUR LOGFILE WAS TOO LONG, SOME LINES IN THE MIDDLE WERE REMOVED. [L1137] havoc #t~mem24; [L1140] FCALL call #t~mem25 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem25=4432bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1140] COND FALSE !(4096bv32 == #t~mem25) [L1140] havoc #t~mem25; [L1143] FCALL call #t~mem26 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem26=4432bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1143] COND FALSE !(20480bv32 == #t~mem26) [L1143] havoc #t~mem26; [L1146] FCALL call #t~mem27 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem27=4432bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1146] COND FALSE !(4099bv32 == #t~mem27) [L1146] havoc #t~mem27; [L1149] FCALL call #t~mem28 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem28=4432bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1149] COND FALSE !(4368bv32 == #t~mem28) [L1149] havoc #t~mem28; [L1152] FCALL call #t~mem29 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem29=4432bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1152] COND FALSE !(4369bv32 == #t~mem29) [L1152] havoc #t~mem29; [L1155] FCALL call #t~mem30 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem30=4432bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1155] COND FALSE !(4384bv32 == #t~mem30) [L1155] havoc #t~mem30; [L1158] FCALL call #t~mem31 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem31=4432bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1158] COND FALSE !(4385bv32 == #t~mem31) [L1158] havoc #t~mem31; [L1161] FCALL call #t~mem32 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem32=4432bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1161] COND FALSE !(4400bv32 == #t~mem32) [L1161] havoc #t~mem32; [L1164] FCALL call #t~mem33 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem33=4432bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1164] COND FALSE !(4401bv32 == #t~mem33) [L1164] havoc #t~mem33; [L1167] FCALL call #t~mem34 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem34=4432bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1167] COND FALSE !(4416bv32 == #t~mem34) [L1167] havoc #t~mem34; [L1170] FCALL call #t~mem35 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem35=4432bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1170] COND FALSE !(4417bv32 == #t~mem35) [L1170] havoc #t~mem35; [L1173] FCALL call #t~mem36 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem36=4432bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1173] COND TRUE 4432bv32 == #t~mem36 [L1173] havoc #t~mem36; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1374] ~ret~0 := #t~nondet76; [L1374] havoc #t~nondet76; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1375] COND FALSE !(5bv32 == ~blastFlag~0) VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1380] COND FALSE !(~bvsle32(~ret~0, 0bv32)) [L1385] FCALL call write~intINTTYPE4(4448bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1386] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(64bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1605] FCALL call #t~mem128 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(84bv32, ~s!offset) }, 4bv32); [L1605] FCALL call #t~mem129 := read~intINTTYPE4({ base: #t~mem128!base, offset: ~bvadd32(848bv32, #t~mem128!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem128!base=268435457bv32, #t~mem128!offset=4294966500bv32, #t~mem129=4448bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1605] COND FALSE !(0bv32 == #t~mem129) [L1605] havoc #t~mem129; [L1605] havoc #t~mem128; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1634] ~skip~0 := 0bv32; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1131-L1635] COND FALSE !(false) VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1133] FCALL call #t~mem22 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1133] ~state~0 := #t~mem22; [L1133] havoc #t~mem22; [L1134] FCALL call #t~mem23 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem23=4448bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1134] COND FALSE !(12292bv32 == #t~mem23) [L1134] havoc #t~mem23; [L1137] FCALL call #t~mem24 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem24=4448bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1137] COND FALSE !(16384bv32 == #t~mem24) [L1137] havoc #t~mem24; [L1140] FCALL call #t~mem25 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem25=4448bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1140] COND FALSE !(4096bv32 == #t~mem25) [L1140] havoc #t~mem25; [L1143] FCALL call #t~mem26 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem26=4448bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1143] COND FALSE !(20480bv32 == #t~mem26) [L1143] havoc #t~mem26; [L1146] FCALL call #t~mem27 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem27=4448bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1146] COND FALSE !(4099bv32 == #t~mem27) [L1146] havoc #t~mem27; [L1149] FCALL call #t~mem28 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem28=4448bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1149] COND FALSE !(4368bv32 == #t~mem28) [L1149] havoc #t~mem28; [L1152] FCALL call #t~mem29 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem29=4448bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1152] COND FALSE !(4369bv32 == #t~mem29) [L1152] havoc #t~mem29; [L1155] FCALL call #t~mem30 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem30=4448bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1155] COND FALSE !(4384bv32 == #t~mem30) [L1155] havoc #t~mem30; [L1158] FCALL call #t~mem31 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem31=4448bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1158] COND FALSE !(4385bv32 == #t~mem31) [L1158] havoc #t~mem31; [L1161] FCALL call #t~mem32 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem32=4448bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1161] COND FALSE !(4400bv32 == #t~mem32) [L1161] havoc #t~mem32; [L1164] FCALL call #t~mem33 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem33=4448bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1164] COND FALSE !(4401bv32 == #t~mem33) [L1164] havoc #t~mem33; [L1167] FCALL call #t~mem34 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem34=4448bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1167] COND FALSE !(4416bv32 == #t~mem34) [L1167] havoc #t~mem34; [L1170] FCALL call #t~mem35 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem35=4448bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1170] COND FALSE !(4417bv32 == #t~mem35) [L1170] havoc #t~mem35; [L1173] FCALL call #t~mem36 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem36=4448bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1173] COND FALSE !(4432bv32 == #t~mem36) [L1173] havoc #t~mem36; [L1176] FCALL call #t~mem37 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem37=4448bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1176] COND FALSE !(4433bv32 == #t~mem37) [L1176] havoc #t~mem37; [L1179] FCALL call #t~mem38 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem38=4448bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1179] COND TRUE 4448bv32 == #t~mem38 [L1179] havoc #t~mem38; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1390] ~ret~0 := #t~nondet77; [L1390] havoc #t~nondet77; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=0bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1391] COND TRUE 4bv32 == ~blastFlag~0 VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=0bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1646] assert false; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=0bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1042] static int init = 1; [L1043] static SSL_METHOD SSLv3_client_data ; VAL [\old(init)=0, \old(SSLv3_client_data)=null, \old(SSLv3_client_data)=null, init=1, SSLv3_client_data={268435458:0}] [L1065] SSL *s = (SSL*)malloc(sizeof(SSL)) ; [L1069] s->s3 = malloc(sizeof(struct ssl3_state_st)) [L1070] s->ctx = malloc(sizeof(SSL_CTX)) [L1071] s->session = malloc(sizeof(SSL_SESSION)) [L1072] s->state = 12292 [L1073] s->version = __VERIFIER_nondet_int() [L1074] CALL ssl3_connect(s) VAL [init=1, s={268435457:0}, SSLv3_client_data={268435458:0}] [L1080] BUF_MEM *buf = __VERIFIER_nondet_pointer() ; [L1081] unsigned long tmp ; [L1082] unsigned long l ; [L1083] long num1 ; [L1084] void (*cb)() ; [L1085] int ret ; [L1086] int new_state ; [L1087] int state ; [L1088] int skip ; [L1089] int *tmp___0 = __VERIFIER_nondet_pointer() ; [L1090] int tmp___1 = __VERIFIER_nondet_int() ; [L1091] int tmp___2 = __VERIFIER_nondet_int() ; [L1092] int tmp___3 ; [L1093] int tmp___4 ; [L1094] int tmp___5 ; [L1095] int tmp___6 ; [L1096] int tmp___7 ; [L1097] int tmp___8 ; [L1098] long tmp___9 ; [L1100] int blastFlag ; [L1103] blastFlag = 0 [L1104] s->hit=__VERIFIER_nondet_int () [L1105] s->state = 12292 [L1106] tmp = __VERIFIER_nondet_int() [L1107] cb = (void (*)())((void *)0) [L1108] ret = -1 [L1109] skip = 0 [L1110] *tmp___0 = 0 [L1111] EXPR s->info_callback VAL [={0:0}, blastFlag=0, buf={0:0}, init=1, ret=4294967295, s={268435457:0}, s={268435457:0}, s->info_callback={33028:-2147450700}, skip=0, SSLv3_client_data={268435458:0}, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0] [L1111] COND TRUE (unsigned long )s->info_callback != (unsigned long )((void *)0) [L1112] EXPR s->info_callback [L1112] cb = s->info_callback [L1120] EXPR s->in_handshake [L1120] s->in_handshake += 1 [L1121] COND FALSE !(tmp___1 & 12288) VAL [={33028:-2147450700}, blastFlag=0, buf={0:0}, init=1, ret=4294967295, s={268435457:0}, s={268435457:0}, skip=0, SSLv3_client_data={268435458:0}, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0] [L1131] COND TRUE 1 VAL [={33028:-2147450700}, blastFlag=0, buf={0:0}, init=1, ret=4294967295, s={268435457:0}, s={268435457:0}, skip=0, SSLv3_client_data={268435458:0}, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0] [L1133] EXPR s->state [L1133] state = s->state [L1134] EXPR s->state VAL [={33028:-2147450700}, blastFlag=0, buf={0:0}, init=1, ret=4294967295, s={268435457:0}, s={268435457:0}, s->state=12292, skip=0, SSLv3_client_data={268435458:0}, state=12292, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0] [L1134] COND TRUE s->state == 12292 [L1237] s->new_session = 1 [L1238] s->state = 4096 [L1239] EXPR s->ctx [L1239] EXPR (s->ctx)->stats.sess_connect_renegotiate [L1239] (s->ctx)->stats.sess_connect_renegotiate += 1 [L1244] s->server = 0 VAL [={33028:-2147450700}, blastFlag=0, buf={0:0}, init=1, ret=4294967295, s={268435457:0}, s={268435457:0}, skip=0, SSLv3_client_data={268435458:0}, state=12292, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0] [L1245] COND TRUE (unsigned long )cb != (unsigned long )((void *)0) VAL [={33028:-2147450700}, blastFlag=0, buf={0:0}, init=1, ret=4294967295, s={268435457:0}, s={268435457:0}, skip=0, SSLv3_client_data={268435458:0}, state=12292, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0] [L1250] EXPR s->version VAL [={33028:-2147450700}, blastFlag=0, buf={0:0}, init=1, ret=4294967295, s={268435457:0}, s={268435457:0}, s->version=768, skip=0, SSLv3_client_data={268435458:0}, state=12292, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0] [L1250] COND FALSE !((s->version & 65280) != 768) [L1256] s->type = 4096 [L1257] EXPR s->init_buf VAL [={33028:-2147450700}, blastFlag=0, buf={0:0}, init=1, ret=4294967295, s={268435457:0}, s={268435457:0}, s->init_buf={0:1}, skip=0, SSLv3_client_data={268435458:0}, state=12292, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0] [L1257] COND FALSE !((unsigned long )s->init_buf == (unsigned long )((void *)0)) [L1269] tmp___4 = __VERIFIER_nondet_int() [L1270] COND FALSE !(! tmp___4) [L1276] tmp___5 = __VERIFIER_nondet_int() [L1277] COND FALSE !(! tmp___5) [L1283] s->state = 4368 [L1284] EXPR s->ctx [L1284] EXPR (s->ctx)->stats.sess_connect [L1284] (s->ctx)->stats.sess_connect += 1 [L1285] s->init_num = 0 VAL [={33028:-2147450700}, blastFlag=0, buf={0:0}, init=1, ret=4294967295, s={268435457:0}, s={268435457:0}, skip=0, SSLv3_client_data={268435458:0}, state=12292, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1605] EXPR s->s3 [L1605] EXPR (s->s3)->tmp.reuse_message VAL [={33028:-2147450700}, (s->s3)->tmp.reuse_message=4368, blastFlag=0, buf={0:0}, init=1, ret=4294967295, s={268435457:0}, s={268435457:0}, s->s3={268435457:-796}, skip=0, SSLv3_client_data={268435458:0}, state=12292, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1605] COND FALSE !(! (s->s3)->tmp.reuse_message) [L1634] skip = 0 VAL [={33028:-2147450700}, blastFlag=0, buf={0:0}, init=1, ret=4294967295, s={268435457:0}, s={268435457:0}, skip=0, SSLv3_client_data={268435458:0}, state=12292, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1131] COND TRUE 1 VAL [={33028:-2147450700}, blastFlag=0, buf={0:0}, init=1, ret=4294967295, s={268435457:0}, s={268435457:0}, skip=0, SSLv3_client_data={268435458:0}, state=12292, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1133] EXPR s->state [L1133] state = s->state [L1134] EXPR s->state VAL [={33028:-2147450700}, blastFlag=0, buf={0:0}, init=1, ret=4294967295, s={268435457:0}, s={268435457:0}, s->state=4368, skip=0, SSLv3_client_data={268435458:0}, state=4368, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1134] COND FALSE !(s->state == 12292) [L1137] EXPR s->state VAL [={33028:-2147450700}, blastFlag=0, buf={0:0}, init=1, ret=4294967295, s={268435457:0}, s={268435457:0}, s->state=4368, skip=0, SSLv3_client_data={268435458:0}, state=4368, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1137] COND FALSE !(s->state == 16384) [L1140] EXPR s->state VAL [={33028:-2147450700}, blastFlag=0, buf={0:0}, init=1, ret=4294967295, s={268435457:0}, s={268435457:0}, s->state=4368, skip=0, SSLv3_client_data={268435458:0}, state=4368, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1140] COND FALSE !(s->state == 4096) [L1143] EXPR s->state VAL [={33028:-2147450700}, blastFlag=0, buf={0:0}, init=1, ret=4294967295, s={268435457:0}, s={268435457:0}, s->state=4368, skip=0, SSLv3_client_data={268435458:0}, state=4368, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1143] COND FALSE !(s->state == 20480) [L1146] EXPR s->state VAL [={33028:-2147450700}, blastFlag=0, buf={0:0}, init=1, ret=4294967295, s={268435457:0}, s={268435457:0}, s->state=4368, skip=0, SSLv3_client_data={268435458:0}, state=4368, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1146] COND FALSE !(s->state == 4099) [L1149] EXPR s->state VAL [={33028:-2147450700}, blastFlag=0, buf={0:0}, init=1, ret=4294967295, s={268435457:0}, s={268435457:0}, s->state=4368, skip=0, SSLv3_client_data={268435458:0}, state=4368, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1149] COND TRUE s->state == 4368 [L1289] s->shutdown = 0 [L1290] ret = __VERIFIER_nondet_int() [L1291] COND TRUE blastFlag == 0 [L1292] blastFlag = 1 VAL [={33028:-2147450700}, blastFlag=1, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, skip=0, SSLv3_client_data={268435458:0}, state=4368, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1296] COND FALSE !(ret <= 0) [L1301] s->state = 4384 [L1302] s->init_num = 0 [L1303] EXPR s->bbio [L1303] EXPR s->wbio VAL [={33028:-2147450700}, blastFlag=1, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->bbio={0:1}, s->wbio={0:0}, skip=0, SSLv3_client_data={268435458:0}, state=4368, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1303] COND TRUE (unsigned long )s->bbio != (unsigned long )s->wbio [L1605] EXPR s->s3 [L1605] EXPR (s->s3)->tmp.reuse_message VAL [={33028:-2147450700}, (s->s3)->tmp.reuse_message=4384, blastFlag=1, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->s3={268435457:-796}, skip=0, SSLv3_client_data={268435458:0}, state=4368, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1605] COND FALSE !(! (s->s3)->tmp.reuse_message) [L1634] skip = 0 VAL [={33028:-2147450700}, blastFlag=1, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, skip=0, SSLv3_client_data={268435458:0}, state=4368, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1131] COND TRUE 1 VAL [={33028:-2147450700}, blastFlag=1, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, skip=0, SSLv3_client_data={268435458:0}, state=4368, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1133] EXPR s->state [L1133] state = s->state [L1134] EXPR s->state VAL [={33028:-2147450700}, blastFlag=1, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4384, skip=0, SSLv3_client_data={268435458:0}, state=4384, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1134] COND FALSE !(s->state == 12292) [L1137] EXPR s->state VAL [={33028:-2147450700}, blastFlag=1, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4384, skip=0, SSLv3_client_data={268435458:0}, state=4384, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1137] COND FALSE !(s->state == 16384) [L1140] EXPR s->state VAL [={33028:-2147450700}, blastFlag=1, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4384, skip=0, SSLv3_client_data={268435458:0}, state=4384, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1140] COND FALSE !(s->state == 4096) [L1143] EXPR s->state VAL [={33028:-2147450700}, blastFlag=1, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4384, skip=0, SSLv3_client_data={268435458:0}, state=4384, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1143] COND FALSE !(s->state == 20480) [L1146] EXPR s->state VAL [={33028:-2147450700}, blastFlag=1, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4384, skip=0, SSLv3_client_data={268435458:0}, state=4384, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1146] COND FALSE !(s->state == 4099) [L1149] EXPR s->state VAL [={33028:-2147450700}, blastFlag=1, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4384, skip=0, SSLv3_client_data={268435458:0}, state=4384, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1149] COND FALSE !(s->state == 4368) [L1152] EXPR s->state VAL [={33028:-2147450700}, blastFlag=1, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4384, skip=0, SSLv3_client_data={268435458:0}, state=4384, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1152] COND FALSE !(s->state == 4369) [L1155] EXPR s->state VAL [={33028:-2147450700}, blastFlag=1, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4384, skip=0, SSLv3_client_data={268435458:0}, state=4384, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1155] COND TRUE s->state == 4384 [L1311] ret = __VERIFIER_nondet_int() [L1312] COND TRUE blastFlag == 1 [L1313] blastFlag = 2 VAL [={33028:-2147450700}, blastFlag=2, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, skip=0, SSLv3_client_data={268435458:0}, state=4384, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1317] COND FALSE !(ret <= 0) [L1322] s->hit VAL [={33028:-2147450700}, blastFlag=2, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->hit=0, skip=0, SSLv3_client_data={268435458:0}, state=4384, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1322] COND FALSE !(s->hit) [L1325] s->state = 4400 VAL [={33028:-2147450700}, blastFlag=2, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, skip=0, SSLv3_client_data={268435458:0}, state=4384, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1327] s->init_num = 0 VAL [={33028:-2147450700}, blastFlag=2, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, skip=0, SSLv3_client_data={268435458:0}, state=4384, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1605] EXPR s->s3 [L1605] EXPR (s->s3)->tmp.reuse_message VAL [={33028:-2147450700}, (s->s3)->tmp.reuse_message=4400, blastFlag=2, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->s3={268435457:-796}, skip=0, SSLv3_client_data={268435458:0}, state=4384, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1605] COND FALSE !(! (s->s3)->tmp.reuse_message) [L1634] skip = 0 VAL [={33028:-2147450700}, blastFlag=2, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, skip=0, SSLv3_client_data={268435458:0}, state=4384, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1131] COND TRUE 1 VAL [={33028:-2147450700}, blastFlag=2, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, skip=0, SSLv3_client_data={268435458:0}, state=4384, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1133] EXPR s->state [L1133] state = s->state [L1134] EXPR s->state VAL [={33028:-2147450700}, blastFlag=2, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4400, skip=0, SSLv3_client_data={268435458:0}, state=4400, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1134] COND FALSE !(s->state == 12292) [L1137] EXPR s->state VAL [={33028:-2147450700}, blastFlag=2, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4400, skip=0, SSLv3_client_data={268435458:0}, state=4400, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1137] COND FALSE !(s->state == 16384) [L1140] EXPR s->state VAL [={33028:-2147450700}, blastFlag=2, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4400, skip=0, SSLv3_client_data={268435458:0}, state=4400, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1140] COND FALSE !(s->state == 4096) [L1143] EXPR s->state VAL [={33028:-2147450700}, blastFlag=2, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4400, skip=0, SSLv3_client_data={268435458:0}, state=4400, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1143] COND FALSE !(s->state == 20480) [L1146] EXPR s->state VAL [={33028:-2147450700}, blastFlag=2, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4400, skip=0, SSLv3_client_data={268435458:0}, state=4400, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1146] COND FALSE !(s->state == 4099) [L1149] EXPR s->state VAL [={33028:-2147450700}, blastFlag=2, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4400, skip=0, SSLv3_client_data={268435458:0}, state=4400, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1149] COND FALSE !(s->state == 4368) [L1152] EXPR s->state VAL [={33028:-2147450700}, blastFlag=2, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4400, skip=0, SSLv3_client_data={268435458:0}, state=4400, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1152] COND FALSE !(s->state == 4369) [L1155] EXPR s->state VAL [={33028:-2147450700}, blastFlag=2, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4400, skip=0, SSLv3_client_data={268435458:0}, state=4400, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1155] COND FALSE !(s->state == 4384) [L1158] EXPR s->state VAL [={33028:-2147450700}, blastFlag=2, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4400, skip=0, SSLv3_client_data={268435458:0}, state=4400, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1158] COND FALSE !(s->state == 4385) [L1161] EXPR s->state VAL [={33028:-2147450700}, blastFlag=2, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4400, skip=0, SSLv3_client_data={268435458:0}, state=4400, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1161] COND TRUE s->state == 4400 [L1331] EXPR s->s3 [L1331] EXPR (s->s3)->tmp.new_cipher [L1331] EXPR ((s->s3)->tmp.new_cipher)->algorithms VAL [={33028:-2147450700}, ((s->s3)->tmp.new_cipher)->algorithms=0, (s->s3)->tmp.new_cipher={268435457:52}, blastFlag=2, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->s3={268435457:-796}, skip=0, SSLv3_client_data={268435458:0}, state=4400, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1331] COND FALSE !(((s->s3)->tmp.new_cipher)->algorithms & 256UL) [L1334] ret = __VERIFIER_nondet_int() [L1335] COND TRUE blastFlag == 2 [L1336] blastFlag = 3 VAL [={33028:-2147450700}, blastFlag=3, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, skip=0, SSLv3_client_data={268435458:0}, state=4400, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1340] COND FALSE !(ret <= 0) VAL [={33028:-2147450700}, blastFlag=3, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, skip=0, SSLv3_client_data={268435458:0}, state=4400, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1346] s->state = 4416 [L1347] s->init_num = 0 VAL [={33028:-2147450700}, blastFlag=3, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, skip=0, SSLv3_client_data={268435458:0}, state=4400, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1605] EXPR s->s3 [L1605] EXPR (s->s3)->tmp.reuse_message VAL [={33028:-2147450700}, (s->s3)->tmp.reuse_message=4416, blastFlag=3, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->s3={268435457:-796}, skip=0, SSLv3_client_data={268435458:0}, state=4400, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1605] COND FALSE !(! (s->s3)->tmp.reuse_message) [L1634] skip = 0 VAL [={33028:-2147450700}, blastFlag=3, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, skip=0, SSLv3_client_data={268435458:0}, state=4400, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1131] COND TRUE 1 VAL [={33028:-2147450700}, blastFlag=3, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, skip=0, SSLv3_client_data={268435458:0}, state=4400, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1133] EXPR s->state [L1133] state = s->state [L1134] EXPR s->state VAL [={33028:-2147450700}, blastFlag=3, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4416, skip=0, SSLv3_client_data={268435458:0}, state=4416, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1134] COND FALSE !(s->state == 12292) [L1137] EXPR s->state VAL [={33028:-2147450700}, blastFlag=3, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4416, skip=0, SSLv3_client_data={268435458:0}, state=4416, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1137] COND FALSE !(s->state == 16384) [L1140] EXPR s->state VAL [={33028:-2147450700}, blastFlag=3, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4416, skip=0, SSLv3_client_data={268435458:0}, state=4416, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1140] COND FALSE !(s->state == 4096) [L1143] EXPR s->state VAL [={33028:-2147450700}, blastFlag=3, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4416, skip=0, SSLv3_client_data={268435458:0}, state=4416, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1143] COND FALSE !(s->state == 20480) [L1146] EXPR s->state VAL [={33028:-2147450700}, blastFlag=3, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4416, skip=0, SSLv3_client_data={268435458:0}, state=4416, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1146] COND FALSE !(s->state == 4099) [L1149] EXPR s->state VAL [={33028:-2147450700}, blastFlag=3, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4416, skip=0, SSLv3_client_data={268435458:0}, state=4416, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1149] COND FALSE !(s->state == 4368) [L1152] EXPR s->state VAL [={33028:-2147450700}, blastFlag=3, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4416, skip=0, SSLv3_client_data={268435458:0}, state=4416, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1152] COND FALSE !(s->state == 4369) [L1155] EXPR s->state VAL [={33028:-2147450700}, blastFlag=3, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4416, skip=0, SSLv3_client_data={268435458:0}, state=4416, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1155] COND FALSE !(s->state == 4384) [L1158] EXPR s->state VAL [={33028:-2147450700}, blastFlag=3, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4416, skip=0, SSLv3_client_data={268435458:0}, state=4416, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1158] COND FALSE !(s->state == 4385) [L1161] EXPR s->state VAL [={33028:-2147450700}, blastFlag=3, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4416, skip=0, SSLv3_client_data={268435458:0}, state=4416, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1161] COND FALSE !(s->state == 4400) [L1164] EXPR s->state VAL [={33028:-2147450700}, blastFlag=3, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4416, skip=0, SSLv3_client_data={268435458:0}, state=4416, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1164] COND FALSE !(s->state == 4401) [L1167] EXPR s->state VAL [={33028:-2147450700}, blastFlag=3, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4416, skip=0, SSLv3_client_data={268435458:0}, state=4416, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1167] COND TRUE s->state == 4416 [L1351] ret = __VERIFIER_nondet_int() [L1352] COND TRUE blastFlag == 3 [L1353] blastFlag = 4 VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, skip=0, SSLv3_client_data={268435458:0}, state=4416, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1357] COND FALSE !(ret <= 0) [L1362] s->state = 4432 [L1363] s->init_num = 0 [L1364] tmp___6 = __VERIFIER_nondet_int() [L1365] COND FALSE !(! tmp___6) VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, skip=0, SSLv3_client_data={268435458:0}, state=4416, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1605] EXPR s->s3 [L1605] EXPR (s->s3)->tmp.reuse_message VAL [={33028:-2147450700}, (s->s3)->tmp.reuse_message=4432, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->s3={268435457:-796}, skip=0, SSLv3_client_data={268435458:0}, state=4416, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1605] COND FALSE !(! (s->s3)->tmp.reuse_message) [L1634] skip = 0 VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, skip=0, SSLv3_client_data={268435458:0}, state=4416, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1131] COND TRUE 1 VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, skip=0, SSLv3_client_data={268435458:0}, state=4416, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1133] EXPR s->state [L1133] state = s->state [L1134] EXPR s->state VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4432, skip=0, SSLv3_client_data={268435458:0}, state=4432, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1134] COND FALSE !(s->state == 12292) [L1137] EXPR s->state VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4432, skip=0, SSLv3_client_data={268435458:0}, state=4432, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1137] COND FALSE !(s->state == 16384) [L1140] EXPR s->state VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4432, skip=0, SSLv3_client_data={268435458:0}, state=4432, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1140] COND FALSE !(s->state == 4096) [L1143] EXPR s->state VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4432, skip=0, SSLv3_client_data={268435458:0}, state=4432, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1143] COND FALSE !(s->state == 20480) [L1146] EXPR s->state VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4432, skip=0, SSLv3_client_data={268435458:0}, state=4432, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1146] COND FALSE !(s->state == 4099) [L1149] EXPR s->state VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4432, skip=0, SSLv3_client_data={268435458:0}, state=4432, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1149] COND FALSE !(s->state == 4368) [L1152] EXPR s->state VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4432, skip=0, SSLv3_client_data={268435458:0}, state=4432, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1152] COND FALSE !(s->state == 4369) [L1155] EXPR s->state VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4432, skip=0, SSLv3_client_data={268435458:0}, state=4432, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1155] COND FALSE !(s->state == 4384) [L1158] EXPR s->state VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4432, skip=0, SSLv3_client_data={268435458:0}, state=4432, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1158] COND FALSE !(s->state == 4385) [L1161] EXPR s->state VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4432, skip=0, SSLv3_client_data={268435458:0}, state=4432, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1161] COND FALSE !(s->state == 4400) [L1164] EXPR s->state VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4432, skip=0, SSLv3_client_data={268435458:0}, state=4432, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1164] COND FALSE !(s->state == 4401) [L1167] EXPR s->state VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4432, skip=0, SSLv3_client_data={268435458:0}, state=4432, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1167] COND FALSE !(s->state == 4416) [L1170] EXPR s->state VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4432, skip=0, SSLv3_client_data={268435458:0}, state=4432, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1170] COND FALSE !(s->state == 4417) [L1173] EXPR s->state VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4432, skip=0, SSLv3_client_data={268435458:0}, state=4432, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1173] COND TRUE s->state == 4432 [L1374] ret = __VERIFIER_nondet_int() [L1375] COND FALSE !(blastFlag == 5) VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, skip=0, SSLv3_client_data={268435458:0}, state=4432, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1380] COND FALSE !(ret <= 0) [L1385] s->state = 4448 [L1386] s->init_num = 0 VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, skip=0, SSLv3_client_data={268435458:0}, state=4432, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1605] EXPR s->s3 [L1605] EXPR (s->s3)->tmp.reuse_message VAL [={33028:-2147450700}, (s->s3)->tmp.reuse_message=4448, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->s3={268435457:-796}, skip=0, SSLv3_client_data={268435458:0}, state=4432, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1605] COND FALSE !(! (s->s3)->tmp.reuse_message) [L1634] skip = 0 VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, skip=0, SSLv3_client_data={268435458:0}, state=4432, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1131] COND TRUE 1 VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, skip=0, SSLv3_client_data={268435458:0}, state=4432, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1133] EXPR s->state [L1133] state = s->state [L1134] EXPR s->state VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4448, skip=0, SSLv3_client_data={268435458:0}, state=4448, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1134] COND FALSE !(s->state == 12292) [L1137] EXPR s->state VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4448, skip=0, SSLv3_client_data={268435458:0}, state=4448, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1137] COND FALSE !(s->state == 16384) [L1140] EXPR s->state VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4448, skip=0, SSLv3_client_data={268435458:0}, state=4448, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1140] COND FALSE !(s->state == 4096) [L1143] EXPR s->state VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4448, skip=0, SSLv3_client_data={268435458:0}, state=4448, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1143] COND FALSE !(s->state == 20480) [L1146] EXPR s->state VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4448, skip=0, SSLv3_client_data={268435458:0}, state=4448, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1146] COND FALSE !(s->state == 4099) [L1149] EXPR s->state VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4448, skip=0, SSLv3_client_data={268435458:0}, state=4448, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1149] COND FALSE !(s->state == 4368) [L1152] EXPR s->state VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4448, skip=0, SSLv3_client_data={268435458:0}, state=4448, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1152] COND FALSE !(s->state == 4369) [L1155] EXPR s->state VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4448, skip=0, SSLv3_client_data={268435458:0}, state=4448, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1155] COND FALSE !(s->state == 4384) [L1158] EXPR s->state VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4448, skip=0, SSLv3_client_data={268435458:0}, state=4448, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1158] COND FALSE !(s->state == 4385) [L1161] EXPR s->state VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4448, skip=0, SSLv3_client_data={268435458:0}, state=4448, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1161] COND FALSE !(s->state == 4400) [L1164] EXPR s->state VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4448, skip=0, SSLv3_client_data={268435458:0}, state=4448, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1164] COND FALSE !(s->state == 4401) [L1167] EXPR s->state VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4448, skip=0, SSLv3_client_data={268435458:0}, state=4448, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1167] COND FALSE !(s->state == 4416) [L1170] EXPR s->state VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4448, skip=0, SSLv3_client_data={268435458:0}, state=4448, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1170] COND FALSE !(s->state == 4417) [L1173] EXPR s->state VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4448, skip=0, SSLv3_client_data={268435458:0}, state=4448, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1173] COND FALSE !(s->state == 4432) [L1176] EXPR s->state VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4448, skip=0, SSLv3_client_data={268435458:0}, state=4448, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1176] COND FALSE !(s->state == 4433) [L1179] EXPR s->state VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4448, skip=0, SSLv3_client_data={268435458:0}, state=4448, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1179] COND TRUE s->state == 4448 [L1390] ret = __VERIFIER_nondet_int() [L1391] COND TRUE blastFlag == 4 VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=0, s={268435457:0}, s={268435457:0}, skip=0, SSLv3_client_data={268435458:0}, state=4448, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1646] __VERIFIER_error() VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=0, s={268435457:0}, s={268435457:0}, skip=0, SSLv3_client_data={268435458:0}, state=4448, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] ----- [2018-11-23 07:50:50,100 INFO L202 PluginConnector]: Adding new model de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction CFG 23.11 07:50:50 BoogieIcfgContainer [2018-11-23 07:50:50,120 INFO L132 PluginConnector]: ------------------------ END TraceAbstraction---------------------------- [2018-11-23 07:50:50,121 INFO L113 PluginConnector]: ------------------------Witness Printer---------------------------- [2018-11-23 07:50:50,121 INFO L271 PluginConnector]: Initializing Witness Printer... [2018-11-23 07:50:50,121 INFO L276 PluginConnector]: Witness Printer initialized [2018-11-23 07:50:50,121 INFO L185 PluginConnector]: Executing the observer RCFGCatcher from plugin Witness Printer for "de.uni_freiburg.informatik.ultimate.plugins.generator.rcfgbuilder CFG 23.11 07:47:02" (3/4) ... [2018-11-23 07:50:50,123 INFO L138 WitnessPrinter]: Generating witness for reachability counterexample ----- class de.uni_freiburg.informatik.ultimate.plugins.generator.rcfgbuilder.RCFGBacktranslator [?] CALL call ULTIMATE.init(); VAL [|#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |old(#NULL.base)|=(_ bv0 32), |old(#NULL.offset)|=(_ bv0 32), |old(~#SSLv3_client_data~0.base)|=(_ bv0 32), |old(~#SSLv3_client_data~0.offset)|=(_ bv0 32), |old(~init~0)|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv0 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv0 32)] [?] #NULL.base, #NULL.offset := 0bv32, 0bv32;#valid := #valid[0bv32 := 0bv1];~init~0 := 1bv32;call ~#SSLv3_client_data~0.base, ~#SSLv3_client_data~0.offset := #Ultimate.alloc(100bv32);call write~init~intINTTYPE4(0bv32, ~#SSLv3_client_data~0.base, ~#SSLv3_client_data~0.offset, 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(4bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(8bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(12bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(16bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(20bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(24bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(28bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(32bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(36bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(40bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(44bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(48bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(52bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(56bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(60bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(64bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(68bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(72bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(76bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(80bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(84bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(88bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(92bv32, ~#SSLv3_client_data~0.offset), 4bv32);call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(96bv32, ~#SSLv3_client_data~0.offset), 4bv32); VAL [|#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |old(#NULL.base)|=(_ bv0 32), |old(#NULL.offset)|=(_ bv0 32), |old(~#SSLv3_client_data~0.base)|=(_ bv0 32), |old(~#SSLv3_client_data~0.offset)|=(_ bv0 32), |old(~init~0)|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume true; VAL [|#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |old(#NULL.base)|=(_ bv0 32), |old(#NULL.offset)|=(_ bv0 32), |old(~#SSLv3_client_data~0.base)|=(_ bv0 32), |old(~#SSLv3_client_data~0.offset)|=(_ bv0 32), |old(~init~0)|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] RET #542#return; VAL [|#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] CALL call #t~ret139 := main(); VAL [|#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] call #t~malloc3.base, #t~malloc3.offset := #Ultimate.alloc(248bv32);~s~0.base, ~s~0.offset := #t~malloc3.base, #t~malloc3.offset;call #t~malloc4.base, #t~malloc4.offset := #Ultimate.alloc(899bv32);call write~$Pointer$(#t~malloc4.base, #t~malloc4.offset, ~s~0.base, ~bvadd32(84bv32, ~s~0.offset), 4bv32);call #t~malloc5.base, #t~malloc5.offset := #Ultimate.alloc(232bv32);call write~$Pointer$(#t~malloc5.base, #t~malloc5.offset, ~s~0.base, ~bvadd32(204bv32, ~s~0.offset), 4bv32);call #t~malloc6.base, #t~malloc6.offset := #Ultimate.alloc(200bv32);call write~$Pointer$(#t~malloc6.base, #t~malloc6.offset, ~s~0.base, ~bvadd32(176bv32, ~s~0.offset), 4bv32);call write~intINTTYPE4(12292bv32, ~s~0.base, ~bvadd32(52bv32, ~s~0.offset), 4bv32);call write~intINTTYPE4(#t~nondet7, ~s~0.base, ~s~0.offset, 4bv32);havoc #t~nondet7; VAL [main_~s~0.base=(_ bv268435457 32), main_~s~0.offset=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |main_#t~malloc3.base|=(_ bv268435457 32), |main_#t~malloc3.offset|=(_ bv0 32), |main_#t~malloc4.base|=(_ bv2147483650 32), |main_#t~malloc4.offset|=(_ bv0 32), |main_#t~malloc5.base|=(_ bv3 32), |main_#t~malloc5.offset|=(_ bv0 32), |main_#t~malloc6.base|=(_ bv2 32), |main_#t~malloc6.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] CALL call #t~ret8 := ssl3_connect(~s~0.base, ~s~0.offset); VAL [|#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] ~s.base, ~s.offset := #in~s.base, #in~s.offset;~buf~0.base, ~buf~0.offset := #t~nondet9.base, #t~nondet9.offset;havoc #t~nondet9.base, #t~nondet9.offset;havoc ~tmp~2;havoc ~l~0;havoc ~num1~0;havoc ~cb~0.base, ~cb~0.offset;havoc ~ret~0;havoc ~new_state~0;havoc ~state~0;havoc ~skip~0;~tmp___0~1.base, ~tmp___0~1.offset := #t~nondet10.base, #t~nondet10.offset;havoc #t~nondet10.base, #t~nondet10.offset;~tmp___1~0 := #t~nondet11;havoc #t~nondet11;~tmp___2~0 := #t~nondet12;havoc #t~nondet12;havoc ~tmp___3~0;havoc ~tmp___4~0;havoc ~tmp___5~0;havoc ~tmp___6~0;havoc ~tmp___7~0;havoc ~tmp___8~0;havoc ~tmp___9~0;havoc ~blastFlag~0;~blastFlag~0 := 0bv32;call write~intINTTYPE4(#t~nondet13, ~s.base, ~bvadd32(92bv32, ~s.offset), 4bv32);havoc #t~nondet13;call write~intINTTYPE4(12292bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32);~tmp~2 := #t~nondet14;havoc #t~nondet14;~cb~0.base, ~cb~0.offset := 0bv32, 0bv32;~ret~0 := 4294967295bv32;~skip~0 := 0bv32;call write~intINTTYPE4(0bv32, ~tmp___0~1.base, ~tmp___0~1.offset, 4bv32);call #t~mem15.base, #t~mem15.offset := read~$Pointer$(~s.base, ~bvadd32(192bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv0 32), ssl3_connect_~cb~0.offset=(_ bv0 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem15.base|=(_ bv33028 32), |ssl3_connect_#t~mem15.offset|=(_ bv2147516596 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume 0bv32 != ~bvadd32(#t~mem15.base, #t~mem15.offset);havoc #t~mem15.base, #t~mem15.offset;call #t~mem16.base, #t~mem16.offset := read~$Pointer$(~s.base, ~bvadd32(192bv32, ~s.offset), 4bv32);~cb~0.base, ~cb~0.offset := #t~mem16.base, #t~mem16.offset;havoc #t~mem16.base, #t~mem16.offset; VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] call #t~mem21 := read~intINTTYPE4(~s.base, ~bvadd32(28bv32, ~s.offset), 4bv32);call write~intINTTYPE4(~bvadd32(1bv32, #t~mem21), ~s.base, ~bvadd32(28bv32, ~s.offset), 4bv32);havoc #t~mem21; VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(0bv32 != ~bvand32(12288bv32, ~tmp___1~0)); VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !false; VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] call #t~mem22 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32);~state~0 := #t~mem22;havoc #t~mem22;call #t~mem23 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv12292 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem23|=(_ bv12292 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume 12292bv32 == #t~mem23;havoc #t~mem23; VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv12292 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] call write~intINTTYPE4(1bv32, ~s.base, ~bvadd32(40bv32, ~s.offset), 4bv32);call write~intINTTYPE4(4096bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32);call #t~mem56.base, #t~mem56.offset := read~$Pointer$(~s.base, ~bvadd32(204bv32, ~s.offset), 4bv32);call #t~mem57 := read~intINTTYPE4(#t~mem56.base, ~bvadd32(64bv32, #t~mem56.offset), 4bv32);call write~intINTTYPE4(~bvadd32(1bv32, #t~mem57), #t~mem56.base, ~bvadd32(64bv32, #t~mem56.offset), 4bv32);havoc #t~mem57;havoc #t~mem56.base, #t~mem56.offset; VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv12292 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(36bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv12292 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume 0bv32 != ~bvadd32(~cb~0.base, ~cb~0.offset); VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv12292 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] call #t~mem58 := read~intINTTYPE4(~s.base, ~s.offset, 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv12292 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem58|=(_ bv768 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(768bv32 != ~bvand32(65280bv32, #t~mem58));havoc #t~mem58;call write~intINTTYPE4(4096bv32, ~s.base, ~bvadd32(4bv32, ~s.offset), 4bv32);call #t~mem59.base, #t~mem59.offset := read~$Pointer$(~s.base, ~bvadd32(60bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv12292 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem59.base|=(_ bv0 32), |ssl3_connect_#t~mem59.offset|=(_ bv1 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(0bv32 == ~bvadd32(#t~mem59.base, #t~mem59.offset));havoc #t~mem59.base, #t~mem59.offset; VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv12292 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] ~tmp___4~0 := #t~nondet61;havoc #t~nondet61; VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv12292 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(0bv32 == ~tmp___4~0);~tmp___5~0 := #t~nondet62;havoc #t~nondet62; VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv12292 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(0bv32 == ~tmp___5~0);call write~intINTTYPE4(4368bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32);call #t~mem63.base, #t~mem63.offset := read~$Pointer$(~s.base, ~bvadd32(204bv32, ~s.offset), 4bv32);call #t~mem64 := read~intINTTYPE4(#t~mem63.base, ~bvadd32(60bv32, #t~mem63.offset), 4bv32);call write~intINTTYPE4(~bvadd32(1bv32, #t~mem64), #t~mem63.base, ~bvadd32(60bv32, #t~mem63.offset), 4bv32);havoc #t~mem64;havoc #t~mem63.base, #t~mem63.offset;call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(64bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv12292 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] call #t~mem128.base, #t~mem128.offset := read~$Pointer$(~s.base, ~bvadd32(84bv32, ~s.offset), 4bv32);call #t~mem129 := read~intINTTYPE4(#t~mem128.base, ~bvadd32(848bv32, #t~mem128.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv12292 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem128.base|=(_ bv268435457 32), |ssl3_connect_#t~mem128.offset|=(_ bv4294966500 32), |ssl3_connect_#t~mem129|=(_ bv4368 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(0bv32 == #t~mem129);havoc #t~mem129;havoc #t~mem128.base, #t~mem128.offset; VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv12292 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] ~skip~0 := 0bv32; VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv12292 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !false; VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv12292 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] call #t~mem22 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32);~state~0 := #t~mem22;havoc #t~mem22;call #t~mem23 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4368 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem23|=(_ bv4368 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(12292bv32 == #t~mem23);havoc #t~mem23;call #t~mem24 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4368 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem24|=(_ bv4368 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(16384bv32 == #t~mem24);havoc #t~mem24;call #t~mem25 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4368 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem25|=(_ bv4368 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4096bv32 == #t~mem25);havoc #t~mem25;call #t~mem26 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4368 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem26|=(_ bv4368 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(20480bv32 == #t~mem26);havoc #t~mem26;call #t~mem27 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4368 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem27|=(_ bv4368 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4099bv32 == #t~mem27);havoc #t~mem27;call #t~mem28 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4368 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem28|=(_ bv4368 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume 4368bv32 == #t~mem28;havoc #t~mem28; VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv4294967295 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4368 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(48bv32, ~s.offset), 4bv32);~ret~0 := #t~nondet65;havoc #t~nondet65; VAL [ssl3_connect_~blastFlag~0=(_ bv0 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4368 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume 0bv32 == ~blastFlag~0;~blastFlag~0 := 1bv32; VAL [ssl3_connect_~blastFlag~0=(_ bv1 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4368 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !~bvsle32(~ret~0, 0bv32);call write~intINTTYPE4(4384bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32);call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(64bv32, ~s.offset), 4bv32);call #t~mem66.base, #t~mem66.offset := read~$Pointer$(~s.base, ~bvadd32(20bv32, ~s.offset), 4bv32);call #t~mem67.base, #t~mem67.offset := read~$Pointer$(~s.base, ~bvadd32(16bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv1 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4368 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem66.base|=(_ bv0 32), |ssl3_connect_#t~mem66.offset|=(_ bv1 32), |ssl3_connect_#t~mem67.base|=(_ bv0 32), |ssl3_connect_#t~mem67.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume ~bvadd32(#t~mem66.base, #t~mem66.offset) != ~bvadd32(#t~mem67.base, #t~mem67.offset);havoc #t~mem66.base, #t~mem66.offset;havoc #t~mem67.base, #t~mem67.offset; VAL [ssl3_connect_~blastFlag~0=(_ bv1 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4368 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] call #t~mem128.base, #t~mem128.offset := read~$Pointer$(~s.base, ~bvadd32(84bv32, ~s.offset), 4bv32);call #t~mem129 := read~intINTTYPE4(#t~mem128.base, ~bvadd32(848bv32, #t~mem128.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv1 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4368 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem128.base|=(_ bv268435457 32), |ssl3_connect_#t~mem128.offset|=(_ bv4294966500 32), |ssl3_connect_#t~mem129|=(_ bv4384 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(0bv32 == #t~mem129);havoc #t~mem129;havoc #t~mem128.base, #t~mem128.offset; VAL [ssl3_connect_~blastFlag~0=(_ bv1 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4368 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] ~skip~0 := 0bv32; VAL [ssl3_connect_~blastFlag~0=(_ bv1 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4368 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !false; VAL [ssl3_connect_~blastFlag~0=(_ bv1 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4368 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] call #t~mem22 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32);~state~0 := #t~mem22;havoc #t~mem22;call #t~mem23 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv1 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4384 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem23|=(_ bv4384 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(12292bv32 == #t~mem23);havoc #t~mem23;call #t~mem24 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv1 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4384 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem24|=(_ bv4384 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(16384bv32 == #t~mem24);havoc #t~mem24;call #t~mem25 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv1 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4384 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem25|=(_ bv4384 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4096bv32 == #t~mem25);havoc #t~mem25;call #t~mem26 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv1 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4384 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem26|=(_ bv4384 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(20480bv32 == #t~mem26);havoc #t~mem26;call #t~mem27 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv1 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4384 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem27|=(_ bv4384 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4099bv32 == #t~mem27);havoc #t~mem27;call #t~mem28 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv1 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4384 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem28|=(_ bv4384 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4368bv32 == #t~mem28);havoc #t~mem28;call #t~mem29 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv1 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4384 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem29|=(_ bv4384 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4369bv32 == #t~mem29);havoc #t~mem29;call #t~mem30 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv1 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4384 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem30|=(_ bv4384 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume 4384bv32 == #t~mem30;havoc #t~mem30; VAL [ssl3_connect_~blastFlag~0=(_ bv1 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4384 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] ~ret~0 := #t~nondet68;havoc #t~nondet68; VAL [ssl3_connect_~blastFlag~0=(_ bv1 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4384 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume 1bv32 == ~blastFlag~0;~blastFlag~0 := 2bv32; VAL [ssl3_connect_~blastFlag~0=(_ bv2 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4384 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !~bvsle32(~ret~0, 0bv32);call #t~mem69 := read~intINTTYPE4(~s.base, ~bvadd32(92bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv2 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4384 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem69|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(0bv32 != #t~mem69);havoc #t~mem69;call write~intINTTYPE4(4400bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv2 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4384 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(64bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv2 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4384 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] call #t~mem128.base, #t~mem128.offset := read~$Pointer$(~s.base, ~bvadd32(84bv32, ~s.offset), 4bv32);call #t~mem129 := read~intINTTYPE4(#t~mem128.base, ~bvadd32(848bv32, #t~mem128.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv2 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4384 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem128.base|=(_ bv268435457 32), |ssl3_connect_#t~mem128.offset|=(_ bv4294966500 32), |ssl3_connect_#t~mem129|=(_ bv4400 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(0bv32 == #t~mem129);havoc #t~mem129;havoc #t~mem128.base, #t~mem128.offset; VAL [ssl3_connect_~blastFlag~0=(_ bv2 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4384 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] ~skip~0 := 0bv32; VAL [ssl3_connect_~blastFlag~0=(_ bv2 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4384 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !false; VAL [ssl3_connect_~blastFlag~0=(_ bv2 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4384 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] call #t~mem22 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32);~state~0 := #t~mem22;havoc #t~mem22;call #t~mem23 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv2 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4400 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem23|=(_ bv4400 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(12292bv32 == #t~mem23);havoc #t~mem23;call #t~mem24 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv2 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4400 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem24|=(_ bv4400 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(16384bv32 == #t~mem24);havoc #t~mem24;call #t~mem25 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv2 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4400 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem25|=(_ bv4400 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4096bv32 == #t~mem25);havoc #t~mem25;call #t~mem26 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv2 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4400 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem26|=(_ bv4400 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(20480bv32 == #t~mem26);havoc #t~mem26;call #t~mem27 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv2 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4400 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem27|=(_ bv4400 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4099bv32 == #t~mem27);havoc #t~mem27;call #t~mem28 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv2 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4400 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem28|=(_ bv4400 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4368bv32 == #t~mem28);havoc #t~mem28;call #t~mem29 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv2 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4400 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem29|=(_ bv4400 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4369bv32 == #t~mem29);havoc #t~mem29;call #t~mem30 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv2 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4400 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem30|=(_ bv4400 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4384bv32 == #t~mem30);havoc #t~mem30;call #t~mem31 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv2 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4400 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem31|=(_ bv4400 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4385bv32 == #t~mem31);havoc #t~mem31;call #t~mem32 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv2 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4400 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem32|=(_ bv4400 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume 4400bv32 == #t~mem32;havoc #t~mem32; VAL [ssl3_connect_~blastFlag~0=(_ bv2 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4400 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] call #t~mem70.base, #t~mem70.offset := read~$Pointer$(~s.base, ~bvadd32(84bv32, ~s.offset), 4bv32);call #t~mem71.base, #t~mem71.offset := read~$Pointer$(#t~mem70.base, ~bvadd32(836bv32, #t~mem70.offset), 4bv32);call #t~mem72 := read~intINTTYPE4(#t~mem71.base, ~bvadd32(12bv32, #t~mem71.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv2 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4400 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem70.base|=(_ bv268435457 32), |ssl3_connect_#t~mem70.offset|=(_ bv4294966500 32), |ssl3_connect_#t~mem71.base|=(_ bv268435457 32), |ssl3_connect_#t~mem71.offset|=(_ bv52 32), |ssl3_connect_#t~mem72|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(0bv32 != ~bvand32(256bv32, #t~mem72));havoc #t~mem71.base, #t~mem71.offset;havoc #t~mem70.base, #t~mem70.offset;havoc #t~mem72;~ret~0 := #t~nondet73;havoc #t~nondet73; VAL [ssl3_connect_~blastFlag~0=(_ bv2 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4400 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume 2bv32 == ~blastFlag~0;~blastFlag~0 := 3bv32; VAL [ssl3_connect_~blastFlag~0=(_ bv3 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4400 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !~bvsle32(~ret~0, 0bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv3 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4400 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] call write~intINTTYPE4(4416bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32);call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(64bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv3 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4400 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] call #t~mem128.base, #t~mem128.offset := read~$Pointer$(~s.base, ~bvadd32(84bv32, ~s.offset), 4bv32);call #t~mem129 := read~intINTTYPE4(#t~mem128.base, ~bvadd32(848bv32, #t~mem128.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv3 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4400 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem128.base|=(_ bv268435457 32), |ssl3_connect_#t~mem128.offset|=(_ bv4294966500 32), |ssl3_connect_#t~mem129|=(_ bv4416 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(0bv32 == #t~mem129);havoc #t~mem129;havoc #t~mem128.base, #t~mem128.offset; VAL [ssl3_connect_~blastFlag~0=(_ bv3 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4400 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] ~skip~0 := 0bv32; VAL [ssl3_connect_~blastFlag~0=(_ bv3 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4400 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !false; VAL [ssl3_connect_~blastFlag~0=(_ bv3 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4400 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] call #t~mem22 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32);~state~0 := #t~mem22;havoc #t~mem22;call #t~mem23 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv3 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4416 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem23|=(_ bv4416 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(12292bv32 == #t~mem23);havoc #t~mem23;call #t~mem24 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv3 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4416 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem24|=(_ bv4416 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(16384bv32 == #t~mem24);havoc #t~mem24;call #t~mem25 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv3 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4416 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem25|=(_ bv4416 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4096bv32 == #t~mem25);havoc #t~mem25;call #t~mem26 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv3 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4416 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem26|=(_ bv4416 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(20480bv32 == #t~mem26);havoc #t~mem26;call #t~mem27 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv3 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4416 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem27|=(_ bv4416 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4099bv32 == #t~mem27);havoc #t~mem27;call #t~mem28 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv3 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4416 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem28|=(_ bv4416 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4368bv32 == #t~mem28);havoc #t~mem28;call #t~mem29 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv3 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4416 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem29|=(_ bv4416 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4369bv32 == #t~mem29);havoc #t~mem29;call #t~mem30 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv3 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4416 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem30|=(_ bv4416 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4384bv32 == #t~mem30);havoc #t~mem30;call #t~mem31 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv3 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4416 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem31|=(_ bv4416 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4385bv32 == #t~mem31);havoc #t~mem31;call #t~mem32 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv3 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4416 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem32|=(_ bv4416 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4400bv32 == #t~mem32);havoc #t~mem32;call #t~mem33 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv3 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4416 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem33|=(_ bv4416 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4401bv32 == #t~mem33);havoc #t~mem33;call #t~mem34 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv3 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4416 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem34|=(_ bv4416 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume 4416bv32 == #t~mem34;havoc #t~mem34; VAL [ssl3_connect_~blastFlag~0=(_ bv3 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4416 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] ~ret~0 := #t~nondet74;havoc #t~nondet74; VAL [ssl3_connect_~blastFlag~0=(_ bv3 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4416 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume 3bv32 == ~blastFlag~0;~blastFlag~0 := 4bv32; VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4416 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !~bvsle32(~ret~0, 0bv32);call write~intINTTYPE4(4432bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32);call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(64bv32, ~s.offset), 4bv32);~tmp___6~0 := #t~nondet75;havoc #t~nondet75; VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4416 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(0bv32 == ~tmp___6~0); VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4416 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] call #t~mem128.base, #t~mem128.offset := read~$Pointer$(~s.base, ~bvadd32(84bv32, ~s.offset), 4bv32);call #t~mem129 := read~intINTTYPE4(#t~mem128.base, ~bvadd32(848bv32, #t~mem128.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4416 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem128.base|=(_ bv268435457 32), |ssl3_connect_#t~mem128.offset|=(_ bv4294966500 32), |ssl3_connect_#t~mem129|=(_ bv4432 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(0bv32 == #t~mem129);havoc #t~mem129;havoc #t~mem128.base, #t~mem128.offset; VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4416 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] ~skip~0 := 0bv32; VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4416 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !false; VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4416 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] call #t~mem22 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32);~state~0 := #t~mem22;havoc #t~mem22;call #t~mem23 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4432 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem23|=(_ bv4432 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(12292bv32 == #t~mem23);havoc #t~mem23;call #t~mem24 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4432 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem24|=(_ bv4432 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(16384bv32 == #t~mem24);havoc #t~mem24;call #t~mem25 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4432 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem25|=(_ bv4432 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4096bv32 == #t~mem25);havoc #t~mem25;call #t~mem26 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4432 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem26|=(_ bv4432 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(20480bv32 == #t~mem26);havoc #t~mem26;call #t~mem27 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4432 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem27|=(_ bv4432 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4099bv32 == #t~mem27);havoc #t~mem27;call #t~mem28 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4432 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem28|=(_ bv4432 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4368bv32 == #t~mem28);havoc #t~mem28;call #t~mem29 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4432 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem29|=(_ bv4432 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4369bv32 == #t~mem29);havoc #t~mem29;call #t~mem30 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4432 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem30|=(_ bv4432 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4384bv32 == #t~mem30);havoc #t~mem30;call #t~mem31 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4432 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem31|=(_ bv4432 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4385bv32 == #t~mem31);havoc #t~mem31;call #t~mem32 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4432 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem32|=(_ bv4432 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4400bv32 == #t~mem32);havoc #t~mem32;call #t~mem33 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4432 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem33|=(_ bv4432 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4401bv32 == #t~mem33);havoc #t~mem33;call #t~mem34 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4432 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem34|=(_ bv4432 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4416bv32 == #t~mem34);havoc #t~mem34;call #t~mem35 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4432 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem35|=(_ bv4432 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4417bv32 == #t~mem35);havoc #t~mem35;call #t~mem36 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4432 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem36|=(_ bv4432 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume 4432bv32 == #t~mem36;havoc #t~mem36; VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4432 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] ~ret~0 := #t~nondet76;havoc #t~nondet76; VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4432 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(5bv32 == ~blastFlag~0); VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4432 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !~bvsle32(~ret~0, 0bv32);call write~intINTTYPE4(4448bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32);call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(64bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4432 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] call #t~mem128.base, #t~mem128.offset := read~$Pointer$(~s.base, ~bvadd32(84bv32, ~s.offset), 4bv32);call #t~mem129 := read~intINTTYPE4(#t~mem128.base, ~bvadd32(848bv32, #t~mem128.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4432 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem128.base|=(_ bv268435457 32), |ssl3_connect_#t~mem128.offset|=(_ bv4294966500 32), |ssl3_connect_#t~mem129|=(_ bv4448 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(0bv32 == #t~mem129);havoc #t~mem129;havoc #t~mem128.base, #t~mem128.offset; VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4432 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] ~skip~0 := 0bv32; VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4432 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !false; VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4432 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] call #t~mem22 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32);~state~0 := #t~mem22;havoc #t~mem22;call #t~mem23 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4448 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem23|=(_ bv4448 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(12292bv32 == #t~mem23);havoc #t~mem23;call #t~mem24 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4448 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem24|=(_ bv4448 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(16384bv32 == #t~mem24);havoc #t~mem24;call #t~mem25 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4448 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem25|=(_ bv4448 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4096bv32 == #t~mem25);havoc #t~mem25;call #t~mem26 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4448 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem26|=(_ bv4448 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(20480bv32 == #t~mem26);havoc #t~mem26;call #t~mem27 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4448 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem27|=(_ bv4448 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4099bv32 == #t~mem27);havoc #t~mem27;call #t~mem28 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4448 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem28|=(_ bv4448 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4368bv32 == #t~mem28);havoc #t~mem28;call #t~mem29 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4448 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem29|=(_ bv4448 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4369bv32 == #t~mem29);havoc #t~mem29;call #t~mem30 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4448 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem30|=(_ bv4448 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4384bv32 == #t~mem30);havoc #t~mem30;call #t~mem31 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4448 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem31|=(_ bv4448 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4385bv32 == #t~mem31);havoc #t~mem31;call #t~mem32 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4448 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem32|=(_ bv4448 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4400bv32 == #t~mem32);havoc #t~mem32;call #t~mem33 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4448 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem33|=(_ bv4448 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4401bv32 == #t~mem33);havoc #t~mem33;call #t~mem34 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4448 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem34|=(_ bv4448 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4416bv32 == #t~mem34);havoc #t~mem34;call #t~mem35 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4448 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem35|=(_ bv4448 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4417bv32 == #t~mem35);havoc #t~mem35;call #t~mem36 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4448 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem36|=(_ bv4448 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4432bv32 == #t~mem36);havoc #t~mem36;call #t~mem37 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4448 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem37|=(_ bv4448 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !(4433bv32 == #t~mem37);havoc #t~mem37;call #t~mem38 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4448 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |ssl3_connect_#t~mem38|=(_ bv4448 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume 4448bv32 == #t~mem38;havoc #t~mem38; VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv1073741824 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4448 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] ~ret~0 := #t~nondet77;havoc #t~nondet77; VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv0 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4448 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume 4bv32 == ~blastFlag~0; VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv0 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4448 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] assume !false; VAL [ssl3_connect_~blastFlag~0=(_ bv4 32), ssl3_connect_~buf~0.base=(_ bv0 32), ssl3_connect_~buf~0.offset=(_ bv0 32), ssl3_connect_~cb~0.base=(_ bv33028 32), ssl3_connect_~cb~0.offset=(_ bv2147516596 32), ssl3_connect_~ret~0=(_ bv0 32), ssl3_connect_~s.base=(_ bv268435457 32), ssl3_connect_~s.offset=(_ bv0 32), ssl3_connect_~skip~0=(_ bv0 32), ssl3_connect_~state~0=(_ bv4448 32), ssl3_connect_~tmp___0~1.base=(_ bv268435457 32), ssl3_connect_~tmp___0~1.offset=(_ bv204 32), ssl3_connect_~tmp___1~0=(_ bv0 32), ssl3_connect_~tmp___2~0=(_ bv0 32), ssl3_connect_~tmp___4~0=(_ bv1 32), ssl3_connect_~tmp___5~0=(_ bv1 32), ssl3_connect_~tmp___6~0=(_ bv1 32), ssl3_connect_~tmp~2=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |ssl3_connect_#in~s.base|=(_ bv268435457 32), |ssl3_connect_#in~s.offset|=(_ bv0 32), |~#SSLv3_client_data~0.base|=(_ bv268435458 32), |~#SSLv3_client_data~0.offset|=(_ bv0 32), ~init~0=(_ bv1 32)] [?] CALL call ULTIMATE.init(); VAL [#NULL.base=0bv32, #NULL.offset=0bv32, old(#NULL.base)=0bv32, old(#NULL.offset)=0bv32, old(~#SSLv3_client_data~0.base)=0bv32, old(~#SSLv3_client_data~0.offset)=0bv32, old(~init~0)=0bv32, ~#SSLv3_client_data~0.base=0bv32, ~#SSLv3_client_data~0.offset=0bv32, ~init~0=0bv32] [?] #NULL.base, #NULL.offset := 0bv32, 0bv32; [?] #valid := #valid[0bv32 := 0bv1]; [L1042] ~init~0 := 1bv32; [L1043] call ~#SSLv3_client_data~0.base, ~#SSLv3_client_data~0.offset := #Ultimate.alloc(100bv32); [L1043] call write~init~intINTTYPE4(0bv32, ~#SSLv3_client_data~0.base, ~#SSLv3_client_data~0.offset, 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(4bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(8bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(12bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(16bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(20bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(24bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(28bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(32bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(36bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(40bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(44bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(48bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(52bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(56bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(60bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(64bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(68bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(72bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(76bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(80bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(84bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(88bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(92bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(96bv32, ~#SSLv3_client_data~0.offset), 4bv32); VAL [#NULL.base=0bv32, #NULL.offset=0bv32, old(#NULL.base)=0bv32, old(#NULL.offset)=0bv32, old(~#SSLv3_client_data~0.base)=0bv32, old(~#SSLv3_client_data~0.offset)=0bv32, old(~init~0)=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~init~0=1bv32] [?] ensures true; VAL [#NULL.base=0bv32, #NULL.offset=0bv32, old(#NULL.base)=0bv32, old(#NULL.offset)=0bv32, old(~#SSLv3_client_data~0.base)=0bv32, old(~#SSLv3_client_data~0.offset)=0bv32, old(~init~0)=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~init~0=1bv32] [?] RET call ULTIMATE.init(); VAL [#NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~init~0=1bv32] [?] CALL call #t~ret139 := main(); VAL [#NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~init~0=1bv32] [L1065] call #t~malloc3.base, #t~malloc3.offset := #Ultimate.alloc(248bv32); [L1065] ~s~0.base, ~s~0.offset := #t~malloc3.base, #t~malloc3.offset; [L1069] call #t~malloc4.base, #t~malloc4.offset := #Ultimate.alloc(899bv32); [L1069] call write~$Pointer$(#t~malloc4.base, #t~malloc4.offset, ~s~0.base, ~bvadd32(84bv32, ~s~0.offset), 4bv32); [L1070] call #t~malloc5.base, #t~malloc5.offset := #Ultimate.alloc(232bv32); [L1070] call write~$Pointer$(#t~malloc5.base, #t~malloc5.offset, ~s~0.base, ~bvadd32(204bv32, ~s~0.offset), 4bv32); [L1071] call #t~malloc6.base, #t~malloc6.offset := #Ultimate.alloc(200bv32); [L1071] call write~$Pointer$(#t~malloc6.base, #t~malloc6.offset, ~s~0.base, ~bvadd32(176bv32, ~s~0.offset), 4bv32); [L1072] call write~intINTTYPE4(12292bv32, ~s~0.base, ~bvadd32(52bv32, ~s~0.offset), 4bv32); [L1073] call write~intINTTYPE4(#t~nondet7, ~s~0.base, ~s~0.offset, 4bv32); [L1073] havoc #t~nondet7; VAL [#NULL.base=0bv32, #NULL.offset=0bv32, #t~malloc3.base=268435457bv32, #t~malloc3.offset=0bv32, #t~malloc4.base=2147483650bv32, #t~malloc4.offset=0bv32, #t~malloc5.base=3bv32, #t~malloc5.offset=0bv32, #t~malloc6.base=2bv32, #t~malloc6.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~init~0=1bv32, ~s~0.base=268435457bv32, ~s~0.offset=0bv32] [L1074] CALL call #t~ret8 := ssl3_connect(~s~0.base, ~s~0.offset); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~init~0=1bv32] [L1079-L1648] ~s.base, ~s.offset := #in~s.base, #in~s.offset; [L1080] ~buf~0.base, ~buf~0.offset := #t~nondet9.base, #t~nondet9.offset; [L1080] havoc #t~nondet9.base, #t~nondet9.offset; [L1081] havoc ~tmp~2; [L1082] havoc ~l~0; [L1083] havoc ~num1~0; [L1084] havoc ~cb~0.base, ~cb~0.offset; [L1085] havoc ~ret~0; [L1086] havoc ~new_state~0; [L1087] havoc ~state~0; [L1088] havoc ~skip~0; [L1089] ~tmp___0~1.base, ~tmp___0~1.offset := #t~nondet10.base, #t~nondet10.offset; [L1089] havoc #t~nondet10.base, #t~nondet10.offset; [L1090] ~tmp___1~0 := #t~nondet11; [L1090] havoc #t~nondet11; [L1091] ~tmp___2~0 := #t~nondet12; [L1091] havoc #t~nondet12; [L1092] havoc ~tmp___3~0; [L1093] havoc ~tmp___4~0; [L1094] havoc ~tmp___5~0; [L1095] havoc ~tmp___6~0; [L1096] havoc ~tmp___7~0; [L1097] havoc ~tmp___8~0; [L1098] havoc ~tmp___9~0; [L1100] havoc ~blastFlag~0; [L1103] ~blastFlag~0 := 0bv32; [L1104] call write~intINTTYPE4(#t~nondet13, ~s.base, ~bvadd32(92bv32, ~s.offset), 4bv32); [L1104] havoc #t~nondet13; [L1105] call write~intINTTYPE4(12292bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); [L1106] ~tmp~2 := #t~nondet14; [L1106] havoc #t~nondet14; [L1107] ~cb~0.base, ~cb~0.offset := 0bv32, 0bv32; [L1108] ~ret~0 := 4294967295bv32; [L1109] ~skip~0 := 0bv32; [L1110] call write~intINTTYPE4(0bv32, ~tmp___0~1.base, ~tmp___0~1.offset, 4bv32); [L1111] call #t~mem15.base, #t~mem15.offset := read~$Pointer$(~s.base, ~bvadd32(192bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem15.base=33028bv32, #t~mem15.offset=2147516596bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=0bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp~2=0bv32] [L1111-L1119] assume 0bv32 != ~bvadd32(#t~mem15.base, #t~mem15.offset); [L1111] havoc #t~mem15.base, #t~mem15.offset; [L1112] call #t~mem16.base, #t~mem16.offset := read~$Pointer$(~s.base, ~bvadd32(192bv32, ~s.offset), 4bv32); [L1112] ~cb~0.base, ~cb~0.offset := #t~mem16.base, #t~mem16.offset; [L1112] havoc #t~mem16.base, #t~mem16.offset; VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp~2=0bv32] [L1120] call #t~mem21 := read~intINTTYPE4(~s.base, ~bvadd32(28bv32, ~s.offset), 4bv32); [L1120] call write~intINTTYPE4(~bvadd32(1bv32, #t~mem21), ~s.base, ~bvadd32(28bv32, ~s.offset), 4bv32); [L1120] havoc #t~mem21; VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp~2=0bv32] [L1121-L1129] assume !(0bv32 != ~bvand32(12288bv32, ~tmp___1~0)); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp~2=0bv32] [L1131-L1635] assume !false; VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp~2=0bv32] [L1133] call #t~mem22 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); [L1133] ~state~0 := #t~mem22; [L1133] havoc #t~mem22; [L1134] call #t~mem23 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem23=12292bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp~2=0bv32] [L1134-L1604] assume 12292bv32 == #t~mem23; [L1134] havoc #t~mem23; VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp~2=0bv32] [L1237] call write~intINTTYPE4(1bv32, ~s.base, ~bvadd32(40bv32, ~s.offset), 4bv32); [L1238] call write~intINTTYPE4(4096bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); [L1239] call #t~mem56.base, #t~mem56.offset := read~$Pointer$(~s.base, ~bvadd32(204bv32, ~s.offset), 4bv32); [L1239] call #t~mem57 := read~intINTTYPE4(#t~mem56.base, ~bvadd32(64bv32, #t~mem56.offset), 4bv32); [L1239] call write~intINTTYPE4(~bvadd32(1bv32, #t~mem57), #t~mem56.base, ~bvadd32(64bv32, #t~mem56.offset), 4bv32); [L1239] havoc #t~mem57; [L1239] havoc #t~mem56.base, #t~mem56.offset; VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp~2=0bv32] [L1244] call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(36bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp~2=0bv32] [L1245-L1249] assume 0bv32 != ~bvadd32(~cb~0.base, ~cb~0.offset); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp~2=0bv32] [L1250] call #t~mem58 := read~intINTTYPE4(~s.base, ~s.offset, 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem58=768bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp~2=0bv32] [L1250-L1255] assume !(768bv32 != ~bvand32(65280bv32, #t~mem58)); [L1250] havoc #t~mem58; [L1256] call write~intINTTYPE4(4096bv32, ~s.base, ~bvadd32(4bv32, ~s.offset), 4bv32); [L1257] call #t~mem59.base, #t~mem59.offset := read~$Pointer$(~s.base, ~bvadd32(60bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem59.base=0bv32, #t~mem59.offset=1bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp~2=0bv32] [L1257-L1268] assume !(0bv32 == ~bvadd32(#t~mem59.base, #t~mem59.offset)); [L1257] havoc #t~mem59.base, #t~mem59.offset; VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp~2=0bv32] [L1269] ~tmp___4~0 := #t~nondet61; [L1269] havoc #t~nondet61; VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp~2=0bv32] [L1270-L1275] assume !(0bv32 == ~tmp___4~0); [L1276] ~tmp___5~0 := #t~nondet62; [L1276] havoc #t~nondet62; VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1277-L1282] assume !(0bv32 == ~tmp___5~0); [L1283] call write~intINTTYPE4(4368bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); [L1284] call #t~mem63.base, #t~mem63.offset := read~$Pointer$(~s.base, ~bvadd32(204bv32, ~s.offset), 4bv32); [L1284] call #t~mem64 := read~intINTTYPE4(#t~mem63.base, ~bvadd32(60bv32, #t~mem63.offset), 4bv32); [L1284] call write~intINTTYPE4(~bvadd32(1bv32, #t~mem64), #t~mem63.base, ~bvadd32(60bv32, #t~mem63.offset), 4bv32); [L1284] havoc #t~mem64; [L1284] havoc #t~mem63.base, #t~mem63.offset; [L1285] call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(64bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1605] call #t~mem128.base, #t~mem128.offset := read~$Pointer$(~s.base, ~bvadd32(84bv32, ~s.offset), 4bv32); [L1605] call #t~mem129 := read~intINTTYPE4(#t~mem128.base, ~bvadd32(848bv32, #t~mem128.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem128.base=268435457bv32, #t~mem128.offset=4294966500bv32, #t~mem129=4368bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1605-L1633] assume !(0bv32 == #t~mem129); [L1605] havoc #t~mem129; [L1605] havoc #t~mem128.base, #t~mem128.offset; VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1634] ~skip~0 := 0bv32; VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1131-L1635] assume !false; VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1133] call #t~mem22 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); [L1133] ~state~0 := #t~mem22; [L1133] havoc #t~mem22; [L1134] call #t~mem23 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem23=4368bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1134-L1604] assume !(12292bv32 == #t~mem23); [L1134] havoc #t~mem23; [L1137] call #t~mem24 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem24=4368bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1137-L1603] assume !(16384bv32 == #t~mem24); [L1137] havoc #t~mem24; [L1140] call #t~mem25 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem25=4368bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1140-L1602] assume !(4096bv32 == #t~mem25); [L1140] havoc #t~mem25; [L1143] call #t~mem26 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem26=4368bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1143-L1601] assume !(20480bv32 == #t~mem26); [L1143] havoc #t~mem26; [L1146] call #t~mem27 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem27=4368bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1146-L1600] assume !(4099bv32 == #t~mem27); [L1146] havoc #t~mem27; [L1149] call #t~mem28 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem28=4368bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1149-L1599] assume 4368bv32 == #t~mem28; [L1149] havoc #t~mem28; VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1289] call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(48bv32, ~s.offset), 4bv32); [L1290] ~ret~0 := #t~nondet65; [L1290] havoc #t~nondet65; VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1291-L1295] assume 0bv32 == ~blastFlag~0; [L1292] ~blastFlag~0 := 1bv32; VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1296-L1300] assume !~bvsle32(~ret~0, 0bv32); [L1301] call write~intINTTYPE4(4384bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); [L1302] call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(64bv32, ~s.offset), 4bv32); [L1303] call #t~mem66.base, #t~mem66.offset := read~$Pointer$(~s.base, ~bvadd32(20bv32, ~s.offset), 4bv32); [L1303] call #t~mem67.base, #t~mem67.offset := read~$Pointer$(~s.base, ~bvadd32(16bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem66.base=0bv32, #t~mem66.offset=1bv32, #t~mem67.base=0bv32, #t~mem67.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1303-L1307] assume ~bvadd32(#t~mem66.base, #t~mem66.offset) != ~bvadd32(#t~mem67.base, #t~mem67.offset); [L1303] havoc #t~mem66.base, #t~mem66.offset; [L1303] havoc #t~mem67.base, #t~mem67.offset; VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1605] call #t~mem128.base, #t~mem128.offset := read~$Pointer$(~s.base, ~bvadd32(84bv32, ~s.offset), 4bv32); [L1605] call #t~mem129 := read~intINTTYPE4(#t~mem128.base, ~bvadd32(848bv32, #t~mem128.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem128.base=268435457bv32, #t~mem128.offset=4294966500bv32, #t~mem129=4384bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1605-L1633] assume !(0bv32 == #t~mem129); [L1605] havoc #t~mem129; [L1605] havoc #t~mem128.base, #t~mem128.offset; VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1634] ~skip~0 := 0bv32; VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1131-L1635] assume !false; VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1133] call #t~mem22 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); [L1133] ~state~0 := #t~mem22; [L1133] havoc #t~mem22; [L1134] call #t~mem23 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem23=4384bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1134-L1604] assume !(12292bv32 == #t~mem23); [L1134] havoc #t~mem23; [L1137] call #t~mem24 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem24=4384bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1137-L1603] assume !(16384bv32 == #t~mem24); [L1137] havoc #t~mem24; [L1140] call #t~mem25 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem25=4384bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1140-L1602] assume !(4096bv32 == #t~mem25); [L1140] havoc #t~mem25; [L1143] call #t~mem26 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem26=4384bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1143-L1601] assume !(20480bv32 == #t~mem26); [L1143] havoc #t~mem26; [L1146] call #t~mem27 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem27=4384bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1146-L1600] assume !(4099bv32 == #t~mem27); [L1146] havoc #t~mem27; [L1149] call #t~mem28 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem28=4384bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1149-L1599] assume !(4368bv32 == #t~mem28); [L1149] havoc #t~mem28; [L1152] call #t~mem29 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem29=4384bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1152-L1598] assume !(4369bv32 == #t~mem29); [L1152] havoc #t~mem29; [L1155] call #t~mem30 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem30=4384bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1155-L1597] assume 4384bv32 == #t~mem30; [L1155] havoc #t~mem30; VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1311] ~ret~0 := #t~nondet68; [L1311] havoc #t~nondet68; VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1312-L1316] assume 1bv32 == ~blastFlag~0; [L1313] ~blastFlag~0 := 2bv32; VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1317-L1321] assume !~bvsle32(~ret~0, 0bv32); [L1322] call #t~mem69 := read~intINTTYPE4(~s.base, ~bvadd32(92bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem69=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1322-L1326] assume !(0bv32 != #t~mem69); [L1322] havoc #t~mem69; [L1325] call write~intINTTYPE4(4400bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1327] call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(64bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1605] call #t~mem128.base, #t~mem128.offset := read~$Pointer$(~s.base, ~bvadd32(84bv32, ~s.offset), 4bv32); [L1605] call #t~mem129 := read~intINTTYPE4(#t~mem128.base, ~bvadd32(848bv32, #t~mem128.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem128.base=268435457bv32, #t~mem128.offset=4294966500bv32, #t~mem129=4400bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1605-L1633] assume !(0bv32 == #t~mem129); [L1605] havoc #t~mem129; [L1605] havoc #t~mem128.base, #t~mem128.offset; VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1634] ~skip~0 := 0bv32; VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1131-L1635] assume !false; VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1133] call #t~mem22 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); [L1133] ~state~0 := #t~mem22; [L1133] havoc #t~mem22; [L1134] call #t~mem23 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem23=4400bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1134-L1604] assume !(12292bv32 == #t~mem23); [L1134] havoc #t~mem23; [L1137] call #t~mem24 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem24=4400bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1137-L1603] assume !(16384bv32 == #t~mem24); [L1137] havoc #t~mem24; [L1140] call #t~mem25 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem25=4400bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1140-L1602] assume !(4096bv32 == #t~mem25); [L1140] havoc #t~mem25; [L1143] call #t~mem26 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem26=4400bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1143-L1601] assume !(20480bv32 == #t~mem26); [L1143] havoc #t~mem26; [L1146] call #t~mem27 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem27=4400bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1146-L1600] assume !(4099bv32 == #t~mem27); [L1146] havoc #t~mem27; [L1149] call #t~mem28 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem28=4400bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1149-L1599] assume !(4368bv32 == #t~mem28); [L1149] havoc #t~mem28; [L1152] call #t~mem29 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem29=4400bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1152-L1598] assume !(4369bv32 == #t~mem29); [L1152] havoc #t~mem29; [L1155] call #t~mem30 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem30=4400bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1155-L1597] assume !(4384bv32 == #t~mem30); [L1155] havoc #t~mem30; [L1158] call #t~mem31 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem31=4400bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1158-L1596] assume !(4385bv32 == #t~mem31); [L1158] havoc #t~mem31; [L1161] call #t~mem32 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem32=4400bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1161-L1595] assume 4400bv32 == #t~mem32; [L1161] havoc #t~mem32; VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1331] call #t~mem70.base, #t~mem70.offset := read~$Pointer$(~s.base, ~bvadd32(84bv32, ~s.offset), 4bv32); [L1331] call #t~mem71.base, #t~mem71.offset := read~$Pointer$(#t~mem70.base, ~bvadd32(836bv32, #t~mem70.offset), 4bv32); [L1331] call #t~mem72 := read~intINTTYPE4(#t~mem71.base, ~bvadd32(12bv32, #t~mem71.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem70.base=268435457bv32, #t~mem70.offset=4294966500bv32, #t~mem71.base=268435457bv32, #t~mem71.offset=52bv32, #t~mem72=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1331-L1345] assume !(0bv32 != ~bvand32(256bv32, #t~mem72)); [L1331] havoc #t~mem71.base, #t~mem71.offset; [L1331] havoc #t~mem70.base, #t~mem70.offset; [L1331] havoc #t~mem72; [L1334] ~ret~0 := #t~nondet73; [L1334] havoc #t~nondet73; VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1335-L1339] assume 2bv32 == ~blastFlag~0; [L1336] ~blastFlag~0 := 3bv32; VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1340-L1344] assume !~bvsle32(~ret~0, 0bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1346] call write~intINTTYPE4(4416bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); [L1347] call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(64bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1605] call #t~mem128.base, #t~mem128.offset := read~$Pointer$(~s.base, ~bvadd32(84bv32, ~s.offset), 4bv32); [L1605] call #t~mem129 := read~intINTTYPE4(#t~mem128.base, ~bvadd32(848bv32, #t~mem128.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem128.base=268435457bv32, #t~mem128.offset=4294966500bv32, #t~mem129=4416bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1605-L1633] assume !(0bv32 == #t~mem129); [L1605] havoc #t~mem129; [L1605] havoc #t~mem128.base, #t~mem128.offset; VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1634] ~skip~0 := 0bv32; VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1131-L1635] assume !false; VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1133] call #t~mem22 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); [L1133] ~state~0 := #t~mem22; [L1133] havoc #t~mem22; [L1134] call #t~mem23 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem23=4416bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1134-L1604] assume !(12292bv32 == #t~mem23); [L1134] havoc #t~mem23; [L1137] call #t~mem24 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem24=4416bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1137-L1603] assume !(16384bv32 == #t~mem24); [L1137] havoc #t~mem24; [L1140] call #t~mem25 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem25=4416bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1140-L1602] assume !(4096bv32 == #t~mem25); [L1140] havoc #t~mem25; [L1143] call #t~mem26 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem26=4416bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1143-L1601] assume !(20480bv32 == #t~mem26); [L1143] havoc #t~mem26; [L1146] call #t~mem27 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem27=4416bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1146-L1600] assume !(4099bv32 == #t~mem27); [L1146] havoc #t~mem27; [L1149] call #t~mem28 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem28=4416bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1149-L1599] assume !(4368bv32 == #t~mem28); [L1149] havoc #t~mem28; [L1152] call #t~mem29 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem29=4416bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1152-L1598] assume !(4369bv32 == #t~mem29); [L1152] havoc #t~mem29; [L1155] call #t~mem30 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem30=4416bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1155-L1597] assume !(4384bv32 == #t~mem30); [L1155] havoc #t~mem30; [L1158] call #t~mem31 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem31=4416bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1158-L1596] assume !(4385bv32 == #t~mem31); [L1158] havoc #t~mem31; [L1161] call #t~mem32 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem32=4416bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1161-L1595] assume !(4400bv32 == #t~mem32); [L1161] havoc #t~mem32; [L1164] call #t~mem33 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem33=4416bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1164-L1594] assume !(4401bv32 == #t~mem33); [L1164] havoc #t~mem33; [L1167] call #t~mem34 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem34=4416bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1167-L1593] assume 4416bv32 == #t~mem34; [L1167] havoc #t~mem34; VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1351] ~ret~0 := #t~nondet74; [L1351] havoc #t~nondet74; VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1352-L1356] assume 3bv32 == ~blastFlag~0; [L1353] ~blastFlag~0 := 4bv32; VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1357-L1361] assume !~bvsle32(~ret~0, 0bv32); [L1362] call write~intINTTYPE4(4432bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); [L1363] call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(64bv32, ~s.offset), 4bv32); [L1364] ~tmp___6~0 := #t~nondet75; [L1364] havoc #t~nondet75; VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1365-L1370] assume !(0bv32 == ~tmp___6~0); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1605] call #t~mem128.base, #t~mem128.offset := read~$Pointer$(~s.base, ~bvadd32(84bv32, ~s.offset), 4bv32); [L1605] call #t~mem129 := read~intINTTYPE4(#t~mem128.base, ~bvadd32(848bv32, #t~mem128.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem128.base=268435457bv32, #t~mem128.offset=4294966500bv32, #t~mem129=4432bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1605-L1633] assume !(0bv32 == #t~mem129); [L1605] havoc #t~mem129; [L1605] havoc #t~mem128.base, #t~mem128.offset; VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1634] ~skip~0 := 0bv32; VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1131-L1635] assume !false; VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1133] call #t~mem22 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); [L1133] ~state~0 := #t~mem22; [L1133] havoc #t~mem22; [L1134] call #t~mem23 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem23=4432bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1134-L1604] assume !(12292bv32 == #t~mem23); [L1134] havoc #t~mem23; [L1137] call #t~mem24 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem24=4432bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1137-L1603] assume !(16384bv32 == #t~mem24); [L1137] havoc #t~mem24; [L1140] call #t~mem25 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem25=4432bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1140-L1602] assume !(4096bv32 == #t~mem25); [L1140] havoc #t~mem25; [L1143] call #t~mem26 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem26=4432bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1143-L1601] assume !(20480bv32 == #t~mem26); [L1143] havoc #t~mem26; [L1146] call #t~mem27 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem27=4432bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1146-L1600] assume !(4099bv32 == #t~mem27); [L1146] havoc #t~mem27; [L1149] call #t~mem28 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem28=4432bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1149-L1599] assume !(4368bv32 == #t~mem28); [L1149] havoc #t~mem28; [L1152] call #t~mem29 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem29=4432bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1152-L1598] assume !(4369bv32 == #t~mem29); [L1152] havoc #t~mem29; [L1155] call #t~mem30 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem30=4432bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1155-L1597] assume !(4384bv32 == #t~mem30); [L1155] havoc #t~mem30; [L1158] call #t~mem31 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem31=4432bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1158-L1596] assume !(4385bv32 == #t~mem31); [L1158] havoc #t~mem31; [L1161] call #t~mem32 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem32=4432bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1161-L1595] assume !(4400bv32 == #t~mem32); [L1161] havoc #t~mem32; [L1164] call #t~mem33 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem33=4432bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1164-L1594] assume !(4401bv32 == #t~mem33); [L1164] havoc #t~mem33; [L1167] call #t~mem34 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem34=4432bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1167-L1593] assume !(4416bv32 == #t~mem34); [L1167] havoc #t~mem34; [L1170] call #t~mem35 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem35=4432bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1170-L1592] assume !(4417bv32 == #t~mem35); [L1170] havoc #t~mem35; [L1173] call #t~mem36 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem36=4432bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1173-L1591] assume 4432bv32 == #t~mem36; [L1173] havoc #t~mem36; VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1374] ~ret~0 := #t~nondet76; [L1374] havoc #t~nondet76; VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1375-L1379] assume !(5bv32 == ~blastFlag~0); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1380-L1384] assume !~bvsle32(~ret~0, 0bv32); [L1385] call write~intINTTYPE4(4448bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); [L1386] call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(64bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1605] call #t~mem128.base, #t~mem128.offset := read~$Pointer$(~s.base, ~bvadd32(84bv32, ~s.offset), 4bv32); [L1605] call #t~mem129 := read~intINTTYPE4(#t~mem128.base, ~bvadd32(848bv32, #t~mem128.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem128.base=268435457bv32, #t~mem128.offset=4294966500bv32, #t~mem129=4448bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1605-L1633] assume !(0bv32 == #t~mem129); [L1605] havoc #t~mem129; [L1605] havoc #t~mem128.base, #t~mem128.offset; VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1634] ~skip~0 := 0bv32; VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1131-L1635] assume !false; VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1133] call #t~mem22 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); [L1133] ~state~0 := #t~mem22; [L1133] havoc #t~mem22; [L1134] call #t~mem23 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem23=4448bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1134-L1604] assume !(12292bv32 == #t~mem23); [L1134] havoc #t~mem23; [L1137] call #t~mem24 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem24=4448bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1137-L1603] assume !(16384bv32 == #t~mem24); [L1137] havoc #t~mem24; [L1140] call #t~mem25 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem25=4448bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1140-L1602] assume !(4096bv32 == #t~mem25); [L1140] havoc #t~mem25; [L1143] call #t~mem26 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem26=4448bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1143-L1601] assume !(20480bv32 == #t~mem26); [L1143] havoc #t~mem26; [L1146] call #t~mem27 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem27=4448bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1146-L1600] assume !(4099bv32 == #t~mem27); [L1146] havoc #t~mem27; [L1149] call #t~mem28 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem28=4448bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1149-L1599] assume !(4368bv32 == #t~mem28); [L1149] havoc #t~mem28; [L1152] call #t~mem29 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem29=4448bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1152-L1598] assume !(4369bv32 == #t~mem29); [L1152] havoc #t~mem29; [L1155] call #t~mem30 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem30=4448bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1155-L1597] assume !(4384bv32 == #t~mem30); [L1155] havoc #t~mem30; [L1158] call #t~mem31 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem31=4448bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1158-L1596] assume !(4385bv32 == #t~mem31); [L1158] havoc #t~mem31; [L1161] call #t~mem32 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem32=4448bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1161-L1595] assume !(4400bv32 == #t~mem32); [L1161] havoc #t~mem32; [L1164] call #t~mem33 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem33=4448bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1164-L1594] assume !(4401bv32 == #t~mem33); [L1164] havoc #t~mem33; [L1167] call #t~mem34 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem34=4448bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1167-L1593] assume !(4416bv32 == #t~mem34); [L1167] havoc #t~mem34; [L1170] call #t~mem35 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem35=4448bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1170-L1592] assume !(4417bv32 == #t~mem35); [L1170] havoc #t~mem35; [L1173] call #t~mem36 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem36=4448bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1173-L1591] assume !(4432bv32 == #t~mem36); [L1173] havoc #t~mem36; [L1176] call #t~mem37 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem37=4448bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1176-L1590] assume !(4433bv32 == #t~mem37); [L1176] havoc #t~mem37; [L1179] call #t~mem38 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem38=4448bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1179-L1589] assume 4448bv32 == #t~mem38; [L1179] havoc #t~mem38; VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1390] ~ret~0 := #t~nondet77; [L1390] havoc #t~nondet77; VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=0bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1391-L1395] assume 4bv32 == ~blastFlag~0; VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=0bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1646] assert false; VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=0bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] ----- ----- class de.uni_freiburg.informatik.ultimate.boogie.preprocessor.BoogiePreprocessorBacktranslator [?] CALL call ULTIMATE.init(); VAL [#NULL.base=0bv32, #NULL.offset=0bv32, old(#NULL.base)=0bv32, old(#NULL.offset)=0bv32, old(~#SSLv3_client_data~0.base)=0bv32, old(~#SSLv3_client_data~0.offset)=0bv32, old(~init~0)=0bv32, ~#SSLv3_client_data~0.base=0bv32, ~#SSLv3_client_data~0.offset=0bv32, ~init~0=0bv32] [?] #NULL.base, #NULL.offset := 0bv32, 0bv32; [?] #valid := #valid[0bv32 := 0bv1]; [L1042] ~init~0 := 1bv32; [L1043] call ~#SSLv3_client_data~0.base, ~#SSLv3_client_data~0.offset := #Ultimate.alloc(100bv32); [L1043] call write~init~intINTTYPE4(0bv32, ~#SSLv3_client_data~0.base, ~#SSLv3_client_data~0.offset, 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(4bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(8bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(12bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(16bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(20bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(24bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(28bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(32bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(36bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(40bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(44bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(48bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(52bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(56bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(60bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(64bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(68bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(72bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(76bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(80bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(84bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(88bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(92bv32, ~#SSLv3_client_data~0.offset), 4bv32); [L1043] call write~init~$Pointer$(0bv32, 0bv32, ~#SSLv3_client_data~0.base, ~bvadd32(96bv32, ~#SSLv3_client_data~0.offset), 4bv32); VAL [#NULL.base=0bv32, #NULL.offset=0bv32, old(#NULL.base)=0bv32, old(#NULL.offset)=0bv32, old(~#SSLv3_client_data~0.base)=0bv32, old(~#SSLv3_client_data~0.offset)=0bv32, old(~init~0)=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~init~0=1bv32] [?] ensures true; VAL [#NULL.base=0bv32, #NULL.offset=0bv32, old(#NULL.base)=0bv32, old(#NULL.offset)=0bv32, old(~#SSLv3_client_data~0.base)=0bv32, old(~#SSLv3_client_data~0.offset)=0bv32, old(~init~0)=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~init~0=1bv32] [?] RET call ULTIMATE.init(); VAL [#NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~init~0=1bv32] [?] CALL call #t~ret139 := main(); VAL [#NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~init~0=1bv32] [L1065] call #t~malloc3.base, #t~malloc3.offset := #Ultimate.alloc(248bv32); [L1065] ~s~0.base, ~s~0.offset := #t~malloc3.base, #t~malloc3.offset; [L1069] call #t~malloc4.base, #t~malloc4.offset := #Ultimate.alloc(899bv32); [L1069] call write~$Pointer$(#t~malloc4.base, #t~malloc4.offset, ~s~0.base, ~bvadd32(84bv32, ~s~0.offset), 4bv32); [L1070] call #t~malloc5.base, #t~malloc5.offset := #Ultimate.alloc(232bv32); [L1070] call write~$Pointer$(#t~malloc5.base, #t~malloc5.offset, ~s~0.base, ~bvadd32(204bv32, ~s~0.offset), 4bv32); [L1071] call #t~malloc6.base, #t~malloc6.offset := #Ultimate.alloc(200bv32); [L1071] call write~$Pointer$(#t~malloc6.base, #t~malloc6.offset, ~s~0.base, ~bvadd32(176bv32, ~s~0.offset), 4bv32); [L1072] call write~intINTTYPE4(12292bv32, ~s~0.base, ~bvadd32(52bv32, ~s~0.offset), 4bv32); [L1073] call write~intINTTYPE4(#t~nondet7, ~s~0.base, ~s~0.offset, 4bv32); [L1073] havoc #t~nondet7; VAL [#NULL.base=0bv32, #NULL.offset=0bv32, #t~malloc3.base=268435457bv32, #t~malloc3.offset=0bv32, #t~malloc4.base=2147483650bv32, #t~malloc4.offset=0bv32, #t~malloc5.base=3bv32, #t~malloc5.offset=0bv32, #t~malloc6.base=2bv32, #t~malloc6.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~init~0=1bv32, ~s~0.base=268435457bv32, ~s~0.offset=0bv32] [L1074] CALL call #t~ret8 := ssl3_connect(~s~0.base, ~s~0.offset); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~init~0=1bv32] [L1079-L1648] ~s.base, ~s.offset := #in~s.base, #in~s.offset; [L1080] ~buf~0.base, ~buf~0.offset := #t~nondet9.base, #t~nondet9.offset; [L1080] havoc #t~nondet9.base, #t~nondet9.offset; [L1081] havoc ~tmp~2; [L1082] havoc ~l~0; [L1083] havoc ~num1~0; [L1084] havoc ~cb~0.base, ~cb~0.offset; [L1085] havoc ~ret~0; [L1086] havoc ~new_state~0; [L1087] havoc ~state~0; [L1088] havoc ~skip~0; [L1089] ~tmp___0~1.base, ~tmp___0~1.offset := #t~nondet10.base, #t~nondet10.offset; [L1089] havoc #t~nondet10.base, #t~nondet10.offset; [L1090] ~tmp___1~0 := #t~nondet11; [L1090] havoc #t~nondet11; [L1091] ~tmp___2~0 := #t~nondet12; [L1091] havoc #t~nondet12; [L1092] havoc ~tmp___3~0; [L1093] havoc ~tmp___4~0; [L1094] havoc ~tmp___5~0; [L1095] havoc ~tmp___6~0; [L1096] havoc ~tmp___7~0; [L1097] havoc ~tmp___8~0; [L1098] havoc ~tmp___9~0; [L1100] havoc ~blastFlag~0; [L1103] ~blastFlag~0 := 0bv32; [L1104] call write~intINTTYPE4(#t~nondet13, ~s.base, ~bvadd32(92bv32, ~s.offset), 4bv32); [L1104] havoc #t~nondet13; [L1105] call write~intINTTYPE4(12292bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); [L1106] ~tmp~2 := #t~nondet14; [L1106] havoc #t~nondet14; [L1107] ~cb~0.base, ~cb~0.offset := 0bv32, 0bv32; [L1108] ~ret~0 := 4294967295bv32; [L1109] ~skip~0 := 0bv32; [L1110] call write~intINTTYPE4(0bv32, ~tmp___0~1.base, ~tmp___0~1.offset, 4bv32); [L1111] call #t~mem15.base, #t~mem15.offset := read~$Pointer$(~s.base, ~bvadd32(192bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem15.base=33028bv32, #t~mem15.offset=2147516596bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=0bv32, ~cb~0.offset=0bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp~2=0bv32] [L1111-L1119] assume 0bv32 != ~bvadd32(#t~mem15.base, #t~mem15.offset); [L1111] havoc #t~mem15.base, #t~mem15.offset; [L1112] call #t~mem16.base, #t~mem16.offset := read~$Pointer$(~s.base, ~bvadd32(192bv32, ~s.offset), 4bv32); [L1112] ~cb~0.base, ~cb~0.offset := #t~mem16.base, #t~mem16.offset; [L1112] havoc #t~mem16.base, #t~mem16.offset; VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp~2=0bv32] [L1120] call #t~mem21 := read~intINTTYPE4(~s.base, ~bvadd32(28bv32, ~s.offset), 4bv32); [L1120] call write~intINTTYPE4(~bvadd32(1bv32, #t~mem21), ~s.base, ~bvadd32(28bv32, ~s.offset), 4bv32); [L1120] havoc #t~mem21; VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp~2=0bv32] [L1121-L1129] assume !(0bv32 != ~bvand32(12288bv32, ~tmp___1~0)); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp~2=0bv32] [L1131-L1635] assume !false; VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp~2=0bv32] [L1133] call #t~mem22 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); [L1133] ~state~0 := #t~mem22; [L1133] havoc #t~mem22; [L1134] call #t~mem23 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem23=12292bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp~2=0bv32] [L1134-L1604] assume 12292bv32 == #t~mem23; [L1134] havoc #t~mem23; VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp~2=0bv32] [L1237] call write~intINTTYPE4(1bv32, ~s.base, ~bvadd32(40bv32, ~s.offset), 4bv32); [L1238] call write~intINTTYPE4(4096bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); [L1239] call #t~mem56.base, #t~mem56.offset := read~$Pointer$(~s.base, ~bvadd32(204bv32, ~s.offset), 4bv32); [L1239] call #t~mem57 := read~intINTTYPE4(#t~mem56.base, ~bvadd32(64bv32, #t~mem56.offset), 4bv32); [L1239] call write~intINTTYPE4(~bvadd32(1bv32, #t~mem57), #t~mem56.base, ~bvadd32(64bv32, #t~mem56.offset), 4bv32); [L1239] havoc #t~mem57; [L1239] havoc #t~mem56.base, #t~mem56.offset; VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp~2=0bv32] [L1244] call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(36bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp~2=0bv32] [L1245-L1249] assume 0bv32 != ~bvadd32(~cb~0.base, ~cb~0.offset); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp~2=0bv32] [L1250] call #t~mem58 := read~intINTTYPE4(~s.base, ~s.offset, 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem58=768bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp~2=0bv32] [L1250-L1255] assume !(768bv32 != ~bvand32(65280bv32, #t~mem58)); [L1250] havoc #t~mem58; [L1256] call write~intINTTYPE4(4096bv32, ~s.base, ~bvadd32(4bv32, ~s.offset), 4bv32); [L1257] call #t~mem59.base, #t~mem59.offset := read~$Pointer$(~s.base, ~bvadd32(60bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem59.base=0bv32, #t~mem59.offset=1bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp~2=0bv32] [L1257-L1268] assume !(0bv32 == ~bvadd32(#t~mem59.base, #t~mem59.offset)); [L1257] havoc #t~mem59.base, #t~mem59.offset; VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp~2=0bv32] [L1269] ~tmp___4~0 := #t~nondet61; [L1269] havoc #t~nondet61; VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp~2=0bv32] [L1270-L1275] assume !(0bv32 == ~tmp___4~0); [L1276] ~tmp___5~0 := #t~nondet62; [L1276] havoc #t~nondet62; VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1277-L1282] assume !(0bv32 == ~tmp___5~0); [L1283] call write~intINTTYPE4(4368bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); [L1284] call #t~mem63.base, #t~mem63.offset := read~$Pointer$(~s.base, ~bvadd32(204bv32, ~s.offset), 4bv32); [L1284] call #t~mem64 := read~intINTTYPE4(#t~mem63.base, ~bvadd32(60bv32, #t~mem63.offset), 4bv32); [L1284] call write~intINTTYPE4(~bvadd32(1bv32, #t~mem64), #t~mem63.base, ~bvadd32(60bv32, #t~mem63.offset), 4bv32); [L1284] havoc #t~mem64; [L1284] havoc #t~mem63.base, #t~mem63.offset; [L1285] call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(64bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1605] call #t~mem128.base, #t~mem128.offset := read~$Pointer$(~s.base, ~bvadd32(84bv32, ~s.offset), 4bv32); [L1605] call #t~mem129 := read~intINTTYPE4(#t~mem128.base, ~bvadd32(848bv32, #t~mem128.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem128.base=268435457bv32, #t~mem128.offset=4294966500bv32, #t~mem129=4368bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1605-L1633] assume !(0bv32 == #t~mem129); [L1605] havoc #t~mem129; [L1605] havoc #t~mem128.base, #t~mem128.offset; VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1634] ~skip~0 := 0bv32; VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1131-L1635] assume !false; VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1133] call #t~mem22 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); [L1133] ~state~0 := #t~mem22; [L1133] havoc #t~mem22; [L1134] call #t~mem23 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem23=4368bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1134-L1604] assume !(12292bv32 == #t~mem23); [L1134] havoc #t~mem23; [L1137] call #t~mem24 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem24=4368bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1137-L1603] assume !(16384bv32 == #t~mem24); [L1137] havoc #t~mem24; [L1140] call #t~mem25 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem25=4368bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1140-L1602] assume !(4096bv32 == #t~mem25); [L1140] havoc #t~mem25; [L1143] call #t~mem26 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem26=4368bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1143-L1601] assume !(20480bv32 == #t~mem26); [L1143] havoc #t~mem26; [L1146] call #t~mem27 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem27=4368bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1146-L1600] assume !(4099bv32 == #t~mem27); [L1146] havoc #t~mem27; [L1149] call #t~mem28 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem28=4368bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1149-L1599] assume 4368bv32 == #t~mem28; [L1149] havoc #t~mem28; VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1289] call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(48bv32, ~s.offset), 4bv32); [L1290] ~ret~0 := #t~nondet65; [L1290] havoc #t~nondet65; VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=0bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1291-L1295] assume 0bv32 == ~blastFlag~0; [L1292] ~blastFlag~0 := 1bv32; VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1296-L1300] assume !~bvsle32(~ret~0, 0bv32); [L1301] call write~intINTTYPE4(4384bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); [L1302] call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(64bv32, ~s.offset), 4bv32); [L1303] call #t~mem66.base, #t~mem66.offset := read~$Pointer$(~s.base, ~bvadd32(20bv32, ~s.offset), 4bv32); [L1303] call #t~mem67.base, #t~mem67.offset := read~$Pointer$(~s.base, ~bvadd32(16bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem66.base=0bv32, #t~mem66.offset=1bv32, #t~mem67.base=0bv32, #t~mem67.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1303-L1307] assume ~bvadd32(#t~mem66.base, #t~mem66.offset) != ~bvadd32(#t~mem67.base, #t~mem67.offset); [L1303] havoc #t~mem66.base, #t~mem66.offset; [L1303] havoc #t~mem67.base, #t~mem67.offset; VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1605] call #t~mem128.base, #t~mem128.offset := read~$Pointer$(~s.base, ~bvadd32(84bv32, ~s.offset), 4bv32); [L1605] call #t~mem129 := read~intINTTYPE4(#t~mem128.base, ~bvadd32(848bv32, #t~mem128.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem128.base=268435457bv32, #t~mem128.offset=4294966500bv32, #t~mem129=4384bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1605-L1633] assume !(0bv32 == #t~mem129); [L1605] havoc #t~mem129; [L1605] havoc #t~mem128.base, #t~mem128.offset; VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1634] ~skip~0 := 0bv32; VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1131-L1635] assume !false; VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1133] call #t~mem22 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); [L1133] ~state~0 := #t~mem22; [L1133] havoc #t~mem22; [L1134] call #t~mem23 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem23=4384bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1134-L1604] assume !(12292bv32 == #t~mem23); [L1134] havoc #t~mem23; [L1137] call #t~mem24 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem24=4384bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1137-L1603] assume !(16384bv32 == #t~mem24); [L1137] havoc #t~mem24; [L1140] call #t~mem25 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem25=4384bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1140-L1602] assume !(4096bv32 == #t~mem25); [L1140] havoc #t~mem25; [L1143] call #t~mem26 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem26=4384bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1143-L1601] assume !(20480bv32 == #t~mem26); [L1143] havoc #t~mem26; [L1146] call #t~mem27 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem27=4384bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1146-L1600] assume !(4099bv32 == #t~mem27); [L1146] havoc #t~mem27; [L1149] call #t~mem28 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem28=4384bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1149-L1599] assume !(4368bv32 == #t~mem28); [L1149] havoc #t~mem28; [L1152] call #t~mem29 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem29=4384bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1152-L1598] assume !(4369bv32 == #t~mem29); [L1152] havoc #t~mem29; [L1155] call #t~mem30 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem30=4384bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1155-L1597] assume 4384bv32 == #t~mem30; [L1155] havoc #t~mem30; VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1311] ~ret~0 := #t~nondet68; [L1311] havoc #t~nondet68; VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=1bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1312-L1316] assume 1bv32 == ~blastFlag~0; [L1313] ~blastFlag~0 := 2bv32; VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1317-L1321] assume !~bvsle32(~ret~0, 0bv32); [L1322] call #t~mem69 := read~intINTTYPE4(~s.base, ~bvadd32(92bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem69=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1322-L1326] assume !(0bv32 != #t~mem69); [L1322] havoc #t~mem69; [L1325] call write~intINTTYPE4(4400bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1327] call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(64bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1605] call #t~mem128.base, #t~mem128.offset := read~$Pointer$(~s.base, ~bvadd32(84bv32, ~s.offset), 4bv32); [L1605] call #t~mem129 := read~intINTTYPE4(#t~mem128.base, ~bvadd32(848bv32, #t~mem128.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem128.base=268435457bv32, #t~mem128.offset=4294966500bv32, #t~mem129=4400bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1605-L1633] assume !(0bv32 == #t~mem129); [L1605] havoc #t~mem129; [L1605] havoc #t~mem128.base, #t~mem128.offset; VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1634] ~skip~0 := 0bv32; VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1131-L1635] assume !false; VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1133] call #t~mem22 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); [L1133] ~state~0 := #t~mem22; [L1133] havoc #t~mem22; [L1134] call #t~mem23 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem23=4400bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1134-L1604] assume !(12292bv32 == #t~mem23); [L1134] havoc #t~mem23; [L1137] call #t~mem24 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem24=4400bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1137-L1603] assume !(16384bv32 == #t~mem24); [L1137] havoc #t~mem24; [L1140] call #t~mem25 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem25=4400bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1140-L1602] assume !(4096bv32 == #t~mem25); [L1140] havoc #t~mem25; [L1143] call #t~mem26 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem26=4400bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1143-L1601] assume !(20480bv32 == #t~mem26); [L1143] havoc #t~mem26; [L1146] call #t~mem27 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem27=4400bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1146-L1600] assume !(4099bv32 == #t~mem27); [L1146] havoc #t~mem27; [L1149] call #t~mem28 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem28=4400bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1149-L1599] assume !(4368bv32 == #t~mem28); [L1149] havoc #t~mem28; [L1152] call #t~mem29 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem29=4400bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1152-L1598] assume !(4369bv32 == #t~mem29); [L1152] havoc #t~mem29; [L1155] call #t~mem30 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem30=4400bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1155-L1597] assume !(4384bv32 == #t~mem30); [L1155] havoc #t~mem30; [L1158] call #t~mem31 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem31=4400bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1158-L1596] assume !(4385bv32 == #t~mem31); [L1158] havoc #t~mem31; [L1161] call #t~mem32 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem32=4400bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1161-L1595] assume 4400bv32 == #t~mem32; [L1161] havoc #t~mem32; VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1331] call #t~mem70.base, #t~mem70.offset := read~$Pointer$(~s.base, ~bvadd32(84bv32, ~s.offset), 4bv32); [L1331] call #t~mem71.base, #t~mem71.offset := read~$Pointer$(#t~mem70.base, ~bvadd32(836bv32, #t~mem70.offset), 4bv32); [L1331] call #t~mem72 := read~intINTTYPE4(#t~mem71.base, ~bvadd32(12bv32, #t~mem71.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem70.base=268435457bv32, #t~mem70.offset=4294966500bv32, #t~mem71.base=268435457bv32, #t~mem71.offset=52bv32, #t~mem72=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1331-L1345] assume !(0bv32 != ~bvand32(256bv32, #t~mem72)); [L1331] havoc #t~mem71.base, #t~mem71.offset; [L1331] havoc #t~mem70.base, #t~mem70.offset; [L1331] havoc #t~mem72; [L1334] ~ret~0 := #t~nondet73; [L1334] havoc #t~nondet73; VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=2bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1335-L1339] assume 2bv32 == ~blastFlag~0; [L1336] ~blastFlag~0 := 3bv32; VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1340-L1344] assume !~bvsle32(~ret~0, 0bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1346] call write~intINTTYPE4(4416bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); [L1347] call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(64bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1605] call #t~mem128.base, #t~mem128.offset := read~$Pointer$(~s.base, ~bvadd32(84bv32, ~s.offset), 4bv32); [L1605] call #t~mem129 := read~intINTTYPE4(#t~mem128.base, ~bvadd32(848bv32, #t~mem128.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem128.base=268435457bv32, #t~mem128.offset=4294966500bv32, #t~mem129=4416bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1605-L1633] assume !(0bv32 == #t~mem129); [L1605] havoc #t~mem129; [L1605] havoc #t~mem128.base, #t~mem128.offset; VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1634] ~skip~0 := 0bv32; VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1131-L1635] assume !false; VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1133] call #t~mem22 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); [L1133] ~state~0 := #t~mem22; [L1133] havoc #t~mem22; [L1134] call #t~mem23 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem23=4416bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1134-L1604] assume !(12292bv32 == #t~mem23); [L1134] havoc #t~mem23; [L1137] call #t~mem24 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem24=4416bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1137-L1603] assume !(16384bv32 == #t~mem24); [L1137] havoc #t~mem24; [L1140] call #t~mem25 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem25=4416bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1140-L1602] assume !(4096bv32 == #t~mem25); [L1140] havoc #t~mem25; [L1143] call #t~mem26 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem26=4416bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1143-L1601] assume !(20480bv32 == #t~mem26); [L1143] havoc #t~mem26; [L1146] call #t~mem27 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem27=4416bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1146-L1600] assume !(4099bv32 == #t~mem27); [L1146] havoc #t~mem27; [L1149] call #t~mem28 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem28=4416bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1149-L1599] assume !(4368bv32 == #t~mem28); [L1149] havoc #t~mem28; [L1152] call #t~mem29 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem29=4416bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1152-L1598] assume !(4369bv32 == #t~mem29); [L1152] havoc #t~mem29; [L1155] call #t~mem30 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem30=4416bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1155-L1597] assume !(4384bv32 == #t~mem30); [L1155] havoc #t~mem30; [L1158] call #t~mem31 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem31=4416bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1158-L1596] assume !(4385bv32 == #t~mem31); [L1158] havoc #t~mem31; [L1161] call #t~mem32 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem32=4416bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1161-L1595] assume !(4400bv32 == #t~mem32); [L1161] havoc #t~mem32; [L1164] call #t~mem33 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem33=4416bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1164-L1594] assume !(4401bv32 == #t~mem33); [L1164] havoc #t~mem33; [L1167] call #t~mem34 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem34=4416bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1167-L1593] assume 4416bv32 == #t~mem34; [L1167] havoc #t~mem34; VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1351] ~ret~0 := #t~nondet74; [L1351] havoc #t~nondet74; VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=3bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1352-L1356] assume 3bv32 == ~blastFlag~0; [L1353] ~blastFlag~0 := 4bv32; VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1357-L1361] assume !~bvsle32(~ret~0, 0bv32); [L1362] call write~intINTTYPE4(4432bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); [L1363] call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(64bv32, ~s.offset), 4bv32); [L1364] ~tmp___6~0 := #t~nondet75; [L1364] havoc #t~nondet75; VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1365-L1370] assume !(0bv32 == ~tmp___6~0); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1605] call #t~mem128.base, #t~mem128.offset := read~$Pointer$(~s.base, ~bvadd32(84bv32, ~s.offset), 4bv32); [L1605] call #t~mem129 := read~intINTTYPE4(#t~mem128.base, ~bvadd32(848bv32, #t~mem128.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem128.base=268435457bv32, #t~mem128.offset=4294966500bv32, #t~mem129=4432bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1605-L1633] assume !(0bv32 == #t~mem129); [L1605] havoc #t~mem129; [L1605] havoc #t~mem128.base, #t~mem128.offset; VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1634] ~skip~0 := 0bv32; VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1131-L1635] assume !false; VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1133] call #t~mem22 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); [L1133] ~state~0 := #t~mem22; [L1133] havoc #t~mem22; [L1134] call #t~mem23 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem23=4432bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1134-L1604] assume !(12292bv32 == #t~mem23); [L1134] havoc #t~mem23; [L1137] call #t~mem24 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem24=4432bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1137-L1603] assume !(16384bv32 == #t~mem24); [L1137] havoc #t~mem24; [L1140] call #t~mem25 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem25=4432bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1140-L1602] assume !(4096bv32 == #t~mem25); [L1140] havoc #t~mem25; [L1143] call #t~mem26 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem26=4432bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1143-L1601] assume !(20480bv32 == #t~mem26); [L1143] havoc #t~mem26; [L1146] call #t~mem27 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem27=4432bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1146-L1600] assume !(4099bv32 == #t~mem27); [L1146] havoc #t~mem27; [L1149] call #t~mem28 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem28=4432bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1149-L1599] assume !(4368bv32 == #t~mem28); [L1149] havoc #t~mem28; [L1152] call #t~mem29 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem29=4432bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1152-L1598] assume !(4369bv32 == #t~mem29); [L1152] havoc #t~mem29; [L1155] call #t~mem30 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem30=4432bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1155-L1597] assume !(4384bv32 == #t~mem30); [L1155] havoc #t~mem30; [L1158] call #t~mem31 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem31=4432bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1158-L1596] assume !(4385bv32 == #t~mem31); [L1158] havoc #t~mem31; [L1161] call #t~mem32 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem32=4432bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1161-L1595] assume !(4400bv32 == #t~mem32); [L1161] havoc #t~mem32; [L1164] call #t~mem33 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem33=4432bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1164-L1594] assume !(4401bv32 == #t~mem33); [L1164] havoc #t~mem33; [L1167] call #t~mem34 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem34=4432bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1167-L1593] assume !(4416bv32 == #t~mem34); [L1167] havoc #t~mem34; [L1170] call #t~mem35 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem35=4432bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1170-L1592] assume !(4417bv32 == #t~mem35); [L1170] havoc #t~mem35; [L1173] call #t~mem36 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem36=4432bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1173-L1591] assume 4432bv32 == #t~mem36; [L1173] havoc #t~mem36; VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1374] ~ret~0 := #t~nondet76; [L1374] havoc #t~nondet76; VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1375-L1379] assume !(5bv32 == ~blastFlag~0); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1380-L1384] assume !~bvsle32(~ret~0, 0bv32); [L1385] call write~intINTTYPE4(4448bv32, ~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); [L1386] call write~intINTTYPE4(0bv32, ~s.base, ~bvadd32(64bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1605] call #t~mem128.base, #t~mem128.offset := read~$Pointer$(~s.base, ~bvadd32(84bv32, ~s.offset), 4bv32); [L1605] call #t~mem129 := read~intINTTYPE4(#t~mem128.base, ~bvadd32(848bv32, #t~mem128.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem128.base=268435457bv32, #t~mem128.offset=4294966500bv32, #t~mem129=4448bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1605-L1633] assume !(0bv32 == #t~mem129); [L1605] havoc #t~mem129; [L1605] havoc #t~mem128.base, #t~mem128.offset; VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1634] ~skip~0 := 0bv32; VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1131-L1635] assume !false; VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1133] call #t~mem22 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); [L1133] ~state~0 := #t~mem22; [L1133] havoc #t~mem22; [L1134] call #t~mem23 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem23=4448bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1134-L1604] assume !(12292bv32 == #t~mem23); [L1134] havoc #t~mem23; [L1137] call #t~mem24 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem24=4448bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1137-L1603] assume !(16384bv32 == #t~mem24); [L1137] havoc #t~mem24; [L1140] call #t~mem25 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem25=4448bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1140-L1602] assume !(4096bv32 == #t~mem25); [L1140] havoc #t~mem25; [L1143] call #t~mem26 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem26=4448bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1143-L1601] assume !(20480bv32 == #t~mem26); [L1143] havoc #t~mem26; [L1146] call #t~mem27 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem27=4448bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1146-L1600] assume !(4099bv32 == #t~mem27); [L1146] havoc #t~mem27; [L1149] call #t~mem28 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem28=4448bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1149-L1599] assume !(4368bv32 == #t~mem28); [L1149] havoc #t~mem28; [L1152] call #t~mem29 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem29=4448bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1152-L1598] assume !(4369bv32 == #t~mem29); [L1152] havoc #t~mem29; [L1155] call #t~mem30 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem30=4448bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1155-L1597] assume !(4384bv32 == #t~mem30); [L1155] havoc #t~mem30; [L1158] call #t~mem31 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem31=4448bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1158-L1596] assume !(4385bv32 == #t~mem31); [L1158] havoc #t~mem31; [L1161] call #t~mem32 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem32=4448bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1161-L1595] assume !(4400bv32 == #t~mem32); [L1161] havoc #t~mem32; [L1164] call #t~mem33 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem33=4448bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1164-L1594] assume !(4401bv32 == #t~mem33); [L1164] havoc #t~mem33; [L1167] call #t~mem34 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem34=4448bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1167-L1593] assume !(4416bv32 == #t~mem34); [L1167] havoc #t~mem34; [L1170] call #t~mem35 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem35=4448bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1170-L1592] assume !(4417bv32 == #t~mem35); [L1170] havoc #t~mem35; [L1173] call #t~mem36 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem36=4448bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1173-L1591] assume !(4432bv32 == #t~mem36); [L1173] havoc #t~mem36; [L1176] call #t~mem37 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem37=4448bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1176-L1590] assume !(4433bv32 == #t~mem37); [L1176] havoc #t~mem37; [L1179] call #t~mem38 := read~intINTTYPE4(~s.base, ~bvadd32(52bv32, ~s.offset), 4bv32); VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~mem38=4448bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1179-L1589] assume 4448bv32 == #t~mem38; [L1179] havoc #t~mem38; VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1390] ~ret~0 := #t~nondet77; [L1390] havoc #t~nondet77; VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=0bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1391-L1395] assume 4bv32 == ~blastFlag~0; VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=0bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1646] assert false; VAL [#in~s.base=268435457bv32, #in~s.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~#SSLv3_client_data~0.base=268435458bv32, ~#SSLv3_client_data~0.offset=0bv32, ~blastFlag~0=4bv32, ~buf~0.base=0bv32, ~buf~0.offset=0bv32, ~cb~0.base=33028bv32, ~cb~0.offset=2147516596bv32, ~init~0=1bv32, ~ret~0=0bv32, ~s.base=268435457bv32, ~s.offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1.base=268435457bv32, ~tmp___0~1.offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [?] CALL call ULTIMATE.init(); VAL [#NULL!base=0bv32, #NULL!offset=0bv32, old(#NULL!base)=0bv32, old(#NULL!offset)=0bv32, old(~#SSLv3_client_data~0!base)=0bv32, old(~#SSLv3_client_data~0!offset)=0bv32, old(~init~0)=0bv32, ~#SSLv3_client_data~0!base=0bv32, ~#SSLv3_client_data~0!offset=0bv32, ~init~0=0bv32] [?] #NULL := { base: 0bv32, offset: 0bv32 }; [?] #valid[0bv32] := 0bv1; [L1042] ~init~0 := 1bv32; [L1043] FCALL call ~#SSLv3_client_data~0 := #Ultimate.alloc(100bv32); [L1043] FCALL call write~init~intINTTYPE4(0bv32, { base: ~#SSLv3_client_data~0!base, offset: ~#SSLv3_client_data~0!offset }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(4bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(8bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(12bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(16bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(20bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(24bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(28bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(32bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(36bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(40bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(44bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(48bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(52bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(56bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(60bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(64bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(68bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(72bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(76bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(80bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(84bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(88bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(92bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(96bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); VAL [#NULL!base=0bv32, #NULL!offset=0bv32, old(#NULL!base)=0bv32, old(#NULL!offset)=0bv32, old(~#SSLv3_client_data~0!base)=0bv32, old(~#SSLv3_client_data~0!offset)=0bv32, old(~init~0)=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~init~0=1bv32] [?] RET call ULTIMATE.init(); VAL [#NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~init~0=1bv32] [?] CALL call #t~ret139 := main(); VAL [#NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~init~0=1bv32] [L1065] FCALL call #t~malloc3 := #Ultimate.alloc(248bv32); [L1065] ~s~0 := #t~malloc3; [L1069] FCALL call #t~malloc4 := #Ultimate.alloc(899bv32); [L1069] FCALL call write~$Pointer$(#t~malloc4, { base: ~s~0!base, offset: ~bvadd32(84bv32, ~s~0!offset) }, 4bv32); [L1070] FCALL call #t~malloc5 := #Ultimate.alloc(232bv32); [L1070] FCALL call write~$Pointer$(#t~malloc5, { base: ~s~0!base, offset: ~bvadd32(204bv32, ~s~0!offset) }, 4bv32); [L1071] FCALL call #t~malloc6 := #Ultimate.alloc(200bv32); [L1071] FCALL call write~$Pointer$(#t~malloc6, { base: ~s~0!base, offset: ~bvadd32(176bv32, ~s~0!offset) }, 4bv32); [L1072] FCALL call write~intINTTYPE4(12292bv32, { base: ~s~0!base, offset: ~bvadd32(52bv32, ~s~0!offset) }, 4bv32); [L1073] FCALL call write~intINTTYPE4(#t~nondet7, { base: ~s~0!base, offset: ~s~0!offset }, 4bv32); [L1073] havoc #t~nondet7; VAL [#NULL!base=0bv32, #NULL!offset=0bv32, #t~malloc3!base=268435457bv32, #t~malloc3!offset=0bv32, #t~malloc4!base=2147483650bv32, #t~malloc4!offset=0bv32, #t~malloc5!base=3bv32, #t~malloc5!offset=0bv32, #t~malloc6!base=2bv32, #t~malloc6!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~init~0=1bv32, ~s~0!base=268435457bv32, ~s~0!offset=0bv32] [L1074] CALL call #t~ret8 := ssl3_connect(~s~0); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~init~0=1bv32] [L1079-L1648] ~s := #in~s; [L1080] ~buf~0 := #t~nondet9; [L1080] havoc #t~nondet9; [L1081] havoc ~tmp~2; [L1082] havoc ~l~0; [L1083] havoc ~num1~0; [L1084] havoc ~cb~0; [L1085] havoc ~ret~0; [L1086] havoc ~new_state~0; [L1087] havoc ~state~0; [L1088] havoc ~skip~0; [L1089] ~tmp___0~1 := #t~nondet10; [L1089] havoc #t~nondet10; [L1090] ~tmp___1~0 := #t~nondet11; [L1090] havoc #t~nondet11; [L1091] ~tmp___2~0 := #t~nondet12; [L1091] havoc #t~nondet12; [L1092] havoc ~tmp___3~0; [L1093] havoc ~tmp___4~0; [L1094] havoc ~tmp___5~0; [L1095] havoc ~tmp___6~0; [L1096] havoc ~tmp___7~0; [L1097] havoc ~tmp___8~0; [L1098] havoc ~tmp___9~0; [L1100] havoc ~blastFlag~0; [L1103] ~blastFlag~0 := 0bv32; [L1104] FCALL call write~intINTTYPE4(#t~nondet13, { base: ~s!base, offset: ~bvadd32(92bv32, ~s!offset) }, 4bv32); [L1104] havoc #t~nondet13; [L1105] FCALL call write~intINTTYPE4(12292bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1106] ~tmp~2 := #t~nondet14; [L1106] havoc #t~nondet14; [L1107] ~cb~0 := { base: 0bv32, offset: 0bv32 }; [L1108] ~ret~0 := 4294967295bv32; [L1109] ~skip~0 := 0bv32; [L1110] FCALL call write~intINTTYPE4(0bv32, ~tmp___0~1, 4bv32); [L1111] FCALL call #t~mem15 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(192bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem15!base=33028bv32, #t~mem15!offset=2147516596bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=0bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp~2=0bv32] [L1111] COND TRUE 0bv32 != ~bvadd32(#t~mem15!base, #t~mem15!offset) [L1111] havoc #t~mem15; [L1112] FCALL call #t~mem16 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(192bv32, ~s!offset) }, 4bv32); [L1112] ~cb~0 := #t~mem16; [L1112] havoc #t~mem16; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp~2=0bv32] [L1120] FCALL call #t~mem21 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(28bv32, ~s!offset) }, 4bv32); [L1120] FCALL call write~intINTTYPE4(~bvadd32(1bv32, #t~mem21), { base: ~s!base, offset: ~bvadd32(28bv32, ~s!offset) }, 4bv32); [L1120] havoc #t~mem21; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp~2=0bv32] [L1121-L1129] COND FALSE !(0bv32 != ~bvand32(12288bv32, ~tmp___1~0)) VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp~2=0bv32] [L1131-L1635] COND FALSE !(false) VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp~2=0bv32] [L1133] FCALL call #t~mem22 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1133] ~state~0 := #t~mem22; [L1133] havoc #t~mem22; [L1134] FCALL call #t~mem23 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem23=12292bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp~2=0bv32] [L1134] COND TRUE 12292bv32 == #t~mem23 [L1134] havoc #t~mem23; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp~2=0bv32] [L1237] FCALL call write~intINTTYPE4(1bv32, { base: ~s!base, offset: ~bvadd32(40bv32, ~s!offset) }, 4bv32); [L1238] FCALL call write~intINTTYPE4(4096bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1239] FCALL call #t~mem56 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(204bv32, ~s!offset) }, 4bv32); [L1239] FCALL call #t~mem57 := read~intINTTYPE4({ base: #t~mem56!base, offset: ~bvadd32(64bv32, #t~mem56!offset) }, 4bv32); [L1239] FCALL call write~intINTTYPE4(~bvadd32(1bv32, #t~mem57), { base: #t~mem56!base, offset: ~bvadd32(64bv32, #t~mem56!offset) }, 4bv32); [L1239] havoc #t~mem57; [L1239] havoc #t~mem56; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp~2=0bv32] [L1244] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(36bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp~2=0bv32] [L1245] COND TRUE 0bv32 != ~bvadd32(~cb~0!base, ~cb~0!offset) VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp~2=0bv32] [L1250] FCALL call #t~mem58 := read~intINTTYPE4({ base: ~s!base, offset: ~s!offset }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem58=768bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp~2=0bv32] [L1250] COND FALSE !(768bv32 != ~bvand32(65280bv32, #t~mem58)) [L1250] havoc #t~mem58; [L1256] FCALL call write~intINTTYPE4(4096bv32, { base: ~s!base, offset: ~bvadd32(4bv32, ~s!offset) }, 4bv32); [L1257] FCALL call #t~mem59 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(60bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem59!base=0bv32, #t~mem59!offset=1bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp~2=0bv32] [L1257] COND FALSE !(0bv32 == ~bvadd32(#t~mem59!base, #t~mem59!offset)) [L1257] havoc #t~mem59; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp~2=0bv32] [L1269] ~tmp___4~0 := #t~nondet61; [L1269] havoc #t~nondet61; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp~2=0bv32] [L1270] COND FALSE !(0bv32 == ~tmp___4~0) [L1276] ~tmp___5~0 := #t~nondet62; [L1276] havoc #t~nondet62; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1277] COND FALSE !(0bv32 == ~tmp___5~0) [L1283] FCALL call write~intINTTYPE4(4368bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1284] FCALL call #t~mem63 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(204bv32, ~s!offset) }, 4bv32); [L1284] FCALL call #t~mem64 := read~intINTTYPE4({ base: #t~mem63!base, offset: ~bvadd32(60bv32, #t~mem63!offset) }, 4bv32); [L1284] FCALL call write~intINTTYPE4(~bvadd32(1bv32, #t~mem64), { base: #t~mem63!base, offset: ~bvadd32(60bv32, #t~mem63!offset) }, 4bv32); [L1284] havoc #t~mem64; [L1284] havoc #t~mem63; [L1285] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(64bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1605] FCALL call #t~mem128 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(84bv32, ~s!offset) }, 4bv32); [L1605] FCALL call #t~mem129 := read~intINTTYPE4({ base: #t~mem128!base, offset: ~bvadd32(848bv32, #t~mem128!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem128!base=268435457bv32, #t~mem128!offset=4294966500bv32, #t~mem129=4368bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1605] COND FALSE !(0bv32 == #t~mem129) [L1605] havoc #t~mem129; [L1605] havoc #t~mem128; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1634] ~skip~0 := 0bv32; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1131-L1635] COND FALSE !(false) VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1133] FCALL call #t~mem22 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1133] ~state~0 := #t~mem22; [L1133] havoc #t~mem22; [L1134] FCALL call #t~mem23 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem23=4368bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1134] COND FALSE !(12292bv32 == #t~mem23) [L1134] havoc #t~mem23; [L1137] FCALL call #t~mem24 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem24=4368bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1137] COND FALSE !(16384bv32 == #t~mem24) [L1137] havoc #t~mem24; [L1140] FCALL call #t~mem25 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem25=4368bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1140] COND FALSE !(4096bv32 == #t~mem25) [L1140] havoc #t~mem25; [L1143] FCALL call #t~mem26 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem26=4368bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1143] COND FALSE !(20480bv32 == #t~mem26) [L1143] havoc #t~mem26; [L1146] FCALL call #t~mem27 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem27=4368bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1146] COND FALSE !(4099bv32 == #t~mem27) [L1146] havoc #t~mem27; [L1149] FCALL call #t~mem28 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem28=4368bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1149] COND TRUE 4368bv32 == #t~mem28 [L1149] havoc #t~mem28; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1289] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(48bv32, ~s!offset) }, 4bv32); [L1290] ~ret~0 := #t~nondet65; [L1290] havoc #t~nondet65; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1291] COND TRUE 0bv32 == ~blastFlag~0 [L1292] ~blastFlag~0 := 1bv32; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1296] COND FALSE !(~bvsle32(~ret~0, 0bv32)) [L1301] FCALL call write~intINTTYPE4(4384bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1302] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(64bv32, ~s!offset) }, 4bv32); [L1303] FCALL call #t~mem66 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(20bv32, ~s!offset) }, 4bv32); [L1303] FCALL call #t~mem67 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(16bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem66!base=0bv32, #t~mem66!offset=1bv32, #t~mem67!base=0bv32, #t~mem67!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1303] COND TRUE ~bvadd32(#t~mem66!base, #t~mem66!offset) != ~bvadd32(#t~mem67!base, #t~mem67!offset) [L1303] havoc #t~mem66; [L1303] havoc #t~mem67; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1605] FCALL call #t~mem128 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(84bv32, ~s!offset) }, 4bv32); [L1605] FCALL call #t~mem129 := read~intINTTYPE4({ base: #t~mem128!base, offset: ~bvadd32(848bv32, #t~mem128!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem128!base=268435457bv32, #t~mem128!offset=4294966500bv32, #t~mem129=4384bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1605] COND FALSE !(0bv32 == #t~mem129) [L1605] havoc #t~mem129; [L1605] havoc #t~mem128; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1634] ~skip~0 := 0bv32; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1131-L1635] COND FALSE !(false) VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1133] FCALL call #t~mem22 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1133] ~state~0 := #t~mem22; [L1133] havoc #t~mem22; [L1134] FCALL call #t~mem23 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem23=4384bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1134] COND FALSE !(12292bv32 == #t~mem23) [L1134] havoc #t~mem23; [L1137] FCALL call #t~mem24 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem24=4384bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1137] COND FALSE !(16384bv32 == #t~mem24) [L1137] havoc #t~mem24; [L1140] FCALL call #t~mem25 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem25=4384bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1140] COND FALSE !(4096bv32 == #t~mem25) [L1140] havoc #t~mem25; [L1143] FCALL call #t~mem26 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem26=4384bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1143] COND FALSE !(20480bv32 == #t~mem26) [L1143] havoc #t~mem26; [L1146] FCALL call #t~mem27 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem27=4384bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1146] COND FALSE !(4099bv32 == #t~mem27) [L1146] havoc #t~mem27; [L1149] FCALL call #t~mem28 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem28=4384bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1149] COND FALSE !(4368bv32 == #t~mem28) [L1149] havoc #t~mem28; [L1152] FCALL call #t~mem29 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem29=4384bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1152] COND FALSE !(4369bv32 == #t~mem29) [L1152] havoc #t~mem29; [L1155] FCALL call #t~mem30 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem30=4384bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1155] COND TRUE 4384bv32 == #t~mem30 [L1155] havoc #t~mem30; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1311] ~ret~0 := #t~nondet68; [L1311] havoc #t~nondet68; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1312] COND TRUE 1bv32 == ~blastFlag~0 [L1313] ~blastFlag~0 := 2bv32; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1317] COND FALSE !(~bvsle32(~ret~0, 0bv32)) [L1322] FCALL call #t~mem69 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(92bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem69=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1322-L1326] COND FALSE !(0bv32 != #t~mem69) [L1322] havoc #t~mem69; [L1325] FCALL call write~intINTTYPE4(4400bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1327] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(64bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1605] FCALL call #t~mem128 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(84bv32, ~s!offset) }, 4bv32); [L1605] FCALL call #t~mem129 := read~intINTTYPE4({ base: #t~mem128!base, offset: ~bvadd32(848bv32, #t~mem128!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem128!base=268435457bv32, #t~mem128!offset=4294966500bv32, #t~mem129=4400bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1605] COND FALSE !(0bv32 == #t~mem129) [L1605] havoc #t~mem129; [L1605] havoc #t~mem128; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1634] ~skip~0 := 0bv32; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1131-L1635] COND FALSE !(false) VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1133] FCALL call #t~mem22 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1133] ~state~0 := #t~mem22; [L1133] havoc #t~mem22; [L1134] FCALL call #t~mem23 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem23=4400bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1134] COND FALSE !(12292bv32 == #t~mem23) [L1134] havoc #t~mem23; [L1137] FCALL call #t~mem24 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem24=4400bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1137] COND FALSE !(16384bv32 == #t~mem24) [L1137] havoc #t~mem24; [L1140] FCALL call #t~mem25 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem25=4400bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1140] COND FALSE !(4096bv32 == #t~mem25) [L1140] havoc #t~mem25; [L1143] FCALL call #t~mem26 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem26=4400bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1143] COND FALSE !(20480bv32 == #t~mem26) [L1143] havoc #t~mem26; [L1146] FCALL call #t~mem27 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem27=4400bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1146] COND FALSE !(4099bv32 == #t~mem27) [L1146] havoc #t~mem27; [L1149] FCALL call #t~mem28 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem28=4400bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1149] COND FALSE !(4368bv32 == #t~mem28) [L1149] havoc #t~mem28; [L1152] FCALL call #t~mem29 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem29=4400bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1152] COND FALSE !(4369bv32 == #t~mem29) [L1152] havoc #t~mem29; [L1155] FCALL call #t~mem30 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem30=4400bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1155] COND FALSE !(4384bv32 == #t~mem30) [L1155] havoc #t~mem30; [L1158] FCALL call #t~mem31 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem31=4400bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1158] COND FALSE !(4385bv32 == #t~mem31) [L1158] havoc #t~mem31; [L1161] FCALL call #t~mem32 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem32=4400bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1161] COND TRUE 4400bv32 == #t~mem32 [L1161] havoc #t~mem32; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1331] FCALL call #t~mem70 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(84bv32, ~s!offset) }, 4bv32); [L1331] FCALL call #t~mem71 := read~$Pointer$({ base: #t~mem70!base, offset: ~bvadd32(836bv32, #t~mem70!offset) }, 4bv32); [L1331] FCALL call #t~mem72 := read~intINTTYPE4({ base: #t~mem71!base, offset: ~bvadd32(12bv32, #t~mem71!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem70!base=268435457bv32, #t~mem70!offset=4294966500bv32, #t~mem71!base=268435457bv32, #t~mem71!offset=52bv32, #t~mem72=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1331-L1345] COND FALSE !(0bv32 != ~bvand32(256bv32, #t~mem72)) [L1331] havoc #t~mem71; [L1331] havoc #t~mem70; [L1331] havoc #t~mem72; [L1334] ~ret~0 := #t~nondet73; [L1334] havoc #t~nondet73; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1335] COND TRUE 2bv32 == ~blastFlag~0 [L1336] ~blastFlag~0 := 3bv32; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1340] COND FALSE !(~bvsle32(~ret~0, 0bv32)) VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1346] FCALL call write~intINTTYPE4(4416bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1347] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(64bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1605] FCALL call #t~mem128 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(84bv32, ~s!offset) }, 4bv32); [L1605] FCALL call #t~mem129 := read~intINTTYPE4({ base: #t~mem128!base, offset: ~bvadd32(848bv32, #t~mem128!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem128!base=268435457bv32, #t~mem128!offset=4294966500bv32, #t~mem129=4416bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1605] COND FALSE !(0bv32 == #t~mem129) [L1605] havoc #t~mem129; [L1605] havoc #t~mem128; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1634] ~skip~0 := 0bv32; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1131-L1635] COND FALSE !(false) VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1133] FCALL call #t~mem22 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1133] ~state~0 := #t~mem22; [L1133] havoc #t~mem22; [L1134] FCALL call #t~mem23 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem23=4416bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1134] COND FALSE !(12292bv32 == #t~mem23) [L1134] havoc #t~mem23; [L1137] FCALL call #t~mem24 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem24=4416bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1137] COND FALSE !(16384bv32 == #t~mem24) [L1137] havoc #t~mem24; [L1140] FCALL call #t~mem25 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem25=4416bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1140] COND FALSE !(4096bv32 == #t~mem25) [L1140] havoc #t~mem25; [L1143] FCALL call #t~mem26 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem26=4416bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1143] COND FALSE !(20480bv32 == #t~mem26) [L1143] havoc #t~mem26; [L1146] FCALL call #t~mem27 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem27=4416bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1146] COND FALSE !(4099bv32 == #t~mem27) [L1146] havoc #t~mem27; [L1149] FCALL call #t~mem28 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem28=4416bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1149] COND FALSE !(4368bv32 == #t~mem28) [L1149] havoc #t~mem28; [L1152] FCALL call #t~mem29 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem29=4416bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1152] COND FALSE !(4369bv32 == #t~mem29) [L1152] havoc #t~mem29; [L1155] FCALL call #t~mem30 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem30=4416bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1155] COND FALSE !(4384bv32 == #t~mem30) [L1155] havoc #t~mem30; [L1158] FCALL call #t~mem31 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem31=4416bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1158] COND FALSE !(4385bv32 == #t~mem31) [L1158] havoc #t~mem31; [L1161] FCALL call #t~mem32 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem32=4416bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1161] COND FALSE !(4400bv32 == #t~mem32) [L1161] havoc #t~mem32; [L1164] FCALL call #t~mem33 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem33=4416bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1164] COND FALSE !(4401bv32 == #t~mem33) [L1164] havoc #t~mem33; [L1167] FCALL call #t~mem34 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem34=4416bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1167] COND TRUE 4416bv32 == #t~mem34 [L1167] havoc #t~mem34; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1351] ~ret~0 := #t~nondet74; [L1351] havoc #t~nondet74; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1352] COND TRUE 3bv32 == ~blastFlag~0 [L1353] ~blastFlag~0 := 4bv32; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1357] COND FALSE !(~bvsle32(~ret~0, 0bv32)) [L1362] FCALL call write~intINTTYPE4(4432bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1363] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(64bv32, ~s!offset) }, 4bv32); [L1364] ~tmp___6~0 := #t~nondet75; [L1364] havoc #t~nondet75; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1365] COND FALSE !(0bv32 == ~tmp___6~0) VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1605] FCALL call #t~mem128 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(84bv32, ~s!offset) }, 4bv32); [L1605] FCALL call #t~mem129 := read~intINTTYPE4({ base: #t~mem128!base, offset: ~bvadd32(848bv32, #t~mem128!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem128!base=268435457bv32, #t~mem128!offset=4294966500bv32, #t~mem129=4432bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1605] COND FALSE !(0bv32 == #t~mem129) [L1605] havoc #t~mem129; [L1605] havoc #t~mem128; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1634] ~skip~0 := 0bv32; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1131-L1635] COND FALSE !(false) VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1133] FCALL call #t~mem22 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1133] ~state~0 := #t~mem22; [L1133] havoc #t~mem22; [L1134] FCALL call #t~mem23 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem23=4432bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1134] COND FALSE !(12292bv32 == #t~mem23) [L1134] havoc #t~mem23; [L1137] FCALL call #t~mem24 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem24=4432bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1137] COND FALSE !(16384bv32 == #t~mem24) [L1137] havoc #t~mem24; [L1140] FCALL call #t~mem25 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem25=4432bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1140] COND FALSE !(4096bv32 == #t~mem25) [L1140] havoc #t~mem25; [L1143] FCALL call #t~mem26 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem26=4432bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1143] COND FALSE !(20480bv32 == #t~mem26) [L1143] havoc #t~mem26; [L1146] FCALL call #t~mem27 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem27=4432bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1146] COND FALSE !(4099bv32 == #t~mem27) [L1146] havoc #t~mem27; [L1149] FCALL call #t~mem28 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem28=4432bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1149] COND FALSE !(4368bv32 == #t~mem28) [L1149] havoc #t~mem28; [L1152] FCALL call #t~mem29 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem29=4432bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1152] COND FALSE !(4369bv32 == #t~mem29) [L1152] havoc #t~mem29; [L1155] FCALL call #t~mem30 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem30=4432bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1155] COND FALSE !(4384bv32 == #t~mem30) [L1155] havoc #t~mem30; [L1158] FCALL call #t~mem31 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem31=4432bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1158] COND FALSE !(4385bv32 == #t~mem31) [L1158] havoc #t~mem31; [L1161] FCALL call #t~mem32 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem32=4432bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1161] COND FALSE !(4400bv32 == #t~mem32) [L1161] havoc #t~mem32; [L1164] FCALL call #t~mem33 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem33=4432bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1164] COND FALSE !(4401bv32 == #t~mem33) [L1164] havoc #t~mem33; [L1167] FCALL call #t~mem34 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem34=4432bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1167] COND FALSE !(4416bv32 == #t~mem34) [L1167] havoc #t~mem34; [L1170] FCALL call #t~mem35 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem35=4432bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1170] COND FALSE !(4417bv32 == #t~mem35) [L1170] havoc #t~mem35; [L1173] FCALL call #t~mem36 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem36=4432bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1173] COND TRUE 4432bv32 == #t~mem36 [L1173] havoc #t~mem36; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1374] ~ret~0 := #t~nondet76; [L1374] havoc #t~nondet76; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1375] COND FALSE !(5bv32 == ~blastFlag~0) VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1380] COND FALSE !(~bvsle32(~ret~0, 0bv32)) [L1385] FCALL call write~intINTTYPE4(4448bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1386] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(64bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1605] FCALL call #t~mem128 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(84bv32, ~s!offset) }, 4bv32); [L1605] FCALL call #t~mem129 := read~intINTTYPE4({ base: #t~mem128!base, offset: ~bvadd32(848bv32, #t~mem128!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem128!base=268435457bv32, #t~mem128!offset=4294966500bv32, #t~mem129=4448bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1605] COND FALSE !(0bv32 == #t~mem129) [L1605] havoc #t~mem129; [L1605] havoc #t~mem128; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1634] ~skip~0 := 0bv32; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1131-L1635] COND FALSE !(false) VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1133] FCALL call #t~mem22 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1133] ~state~0 := #t~mem22; [L1133] havoc #t~mem22; [L1134] FCALL call #t~mem23 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem23=4448bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1134] COND FALSE !(12292bv32 == #t~mem23) [L1134] havoc #t~mem23; [L1137] FCALL call #t~mem24 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem24=4448bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1137] COND FALSE !(16384bv32 == #t~mem24) [L1137] havoc #t~mem24; [L1140] FCALL call #t~mem25 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem25=4448bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1140] COND FALSE !(4096bv32 == #t~mem25) [L1140] havoc #t~mem25; [L1143] FCALL call #t~mem26 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem26=4448bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1143] COND FALSE !(20480bv32 == #t~mem26) [L1143] havoc #t~mem26; [L1146] FCALL call #t~mem27 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem27=4448bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1146] COND FALSE !(4099bv32 == #t~mem27) [L1146] havoc #t~mem27; [L1149] FCALL call #t~mem28 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem28=4448bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1149] COND FALSE !(4368bv32 == #t~mem28) [L1149] havoc #t~mem28; [L1152] FCALL call #t~mem29 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem29=4448bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1152] COND FALSE !(4369bv32 == #t~mem29) [L1152] havoc #t~mem29; [L1155] FCALL call #t~mem30 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem30=4448bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1155] COND FALSE !(4384bv32 == #t~mem30) [L1155] havoc #t~mem30; [L1158] FCALL call #t~mem31 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem31=4448bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1158] COND FALSE !(4385bv32 == #t~mem31) [L1158] havoc #t~mem31; [L1161] FCALL call #t~mem32 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem32=4448bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1161] COND FALSE !(4400bv32 == #t~mem32) [L1161] havoc #t~mem32; [L1164] FCALL call #t~mem33 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem33=4448bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1164] COND FALSE !(4401bv32 == #t~mem33) [L1164] havoc #t~mem33; [L1167] FCALL call #t~mem34 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem34=4448bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1167] COND FALSE !(4416bv32 == #t~mem34) [L1167] havoc #t~mem34; [L1170] FCALL call #t~mem35 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem35=4448bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1170] COND FALSE !(4417bv32 == #t~mem35) [L1170] havoc #t~mem35; [L1173] FCALL call #t~mem36 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem36=4448bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1173] COND FALSE !(4432bv32 == #t~mem36) [L1173] havoc #t~mem36; [L1176] FCALL call #t~mem37 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem37=4448bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1176] COND FALSE !(4433bv32 == #t~mem37) [L1176] havoc #t~mem37; [L1179] FCALL call #t~mem38 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem38=4448bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1179] COND TRUE 4448bv32 == #t~mem38 [L1179] havoc #t~mem38; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1390] ~ret~0 := #t~nondet77; [L1390] havoc #t~nondet77; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=0bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1391] COND TRUE 4bv32 == ~blastFlag~0 VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=0bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1646] assert false; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=0bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] ----- ----- class de.uni_freiburg.informatik.ultimate.boogie.procedureinliner.backtranslation.InlinerBacktranslator [?] CALL call ULTIMATE.init(); VAL [#NULL!base=0bv32, #NULL!offset=0bv32, old(#NULL!base)=0bv32, old(#NULL!offset)=0bv32, old(~#SSLv3_client_data~0!base)=0bv32, old(~#SSLv3_client_data~0!offset)=0bv32, old(~init~0)=0bv32, ~#SSLv3_client_data~0!base=0bv32, ~#SSLv3_client_data~0!offset=0bv32, ~init~0=0bv32] [?] #NULL := { base: 0bv32, offset: 0bv32 }; [?] #valid[0bv32] := 0bv1; [L1042] ~init~0 := 1bv32; [L1043] FCALL call ~#SSLv3_client_data~0 := #Ultimate.alloc(100bv32); [L1043] FCALL call write~init~intINTTYPE4(0bv32, { base: ~#SSLv3_client_data~0!base, offset: ~#SSLv3_client_data~0!offset }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(4bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(8bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(12bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(16bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(20bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(24bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(28bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(32bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(36bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(40bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(44bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(48bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(52bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(56bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(60bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(64bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(68bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(72bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(76bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(80bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(84bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(88bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(92bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(96bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); VAL [#NULL!base=0bv32, #NULL!offset=0bv32, old(#NULL!base)=0bv32, old(#NULL!offset)=0bv32, old(~#SSLv3_client_data~0!base)=0bv32, old(~#SSLv3_client_data~0!offset)=0bv32, old(~init~0)=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~init~0=1bv32] [?] RET call ULTIMATE.init(); VAL [#NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~init~0=1bv32] [?] CALL call #t~ret139 := main(); VAL [#NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~init~0=1bv32] [L1065] FCALL call #t~malloc3 := #Ultimate.alloc(248bv32); [L1065] ~s~0 := #t~malloc3; [L1069] FCALL call #t~malloc4 := #Ultimate.alloc(899bv32); [L1069] FCALL call write~$Pointer$(#t~malloc4, { base: ~s~0!base, offset: ~bvadd32(84bv32, ~s~0!offset) }, 4bv32); [L1070] FCALL call #t~malloc5 := #Ultimate.alloc(232bv32); [L1070] FCALL call write~$Pointer$(#t~malloc5, { base: ~s~0!base, offset: ~bvadd32(204bv32, ~s~0!offset) }, 4bv32); [L1071] FCALL call #t~malloc6 := #Ultimate.alloc(200bv32); [L1071] FCALL call write~$Pointer$(#t~malloc6, { base: ~s~0!base, offset: ~bvadd32(176bv32, ~s~0!offset) }, 4bv32); [L1072] FCALL call write~intINTTYPE4(12292bv32, { base: ~s~0!base, offset: ~bvadd32(52bv32, ~s~0!offset) }, 4bv32); [L1073] FCALL call write~intINTTYPE4(#t~nondet7, { base: ~s~0!base, offset: ~s~0!offset }, 4bv32); [L1073] havoc #t~nondet7; VAL [#NULL!base=0bv32, #NULL!offset=0bv32, #t~malloc3!base=268435457bv32, #t~malloc3!offset=0bv32, #t~malloc4!base=2147483650bv32, #t~malloc4!offset=0bv32, #t~malloc5!base=3bv32, #t~malloc5!offset=0bv32, #t~malloc6!base=2bv32, #t~malloc6!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~init~0=1bv32, ~s~0!base=268435457bv32, ~s~0!offset=0bv32] [L1074] CALL call #t~ret8 := ssl3_connect(~s~0); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~init~0=1bv32] [L1079-L1648] ~s := #in~s; [L1080] ~buf~0 := #t~nondet9; [L1080] havoc #t~nondet9; [L1081] havoc ~tmp~2; [L1082] havoc ~l~0; [L1083] havoc ~num1~0; [L1084] havoc ~cb~0; [L1085] havoc ~ret~0; [L1086] havoc ~new_state~0; [L1087] havoc ~state~0; [L1088] havoc ~skip~0; [L1089] ~tmp___0~1 := #t~nondet10; [L1089] havoc #t~nondet10; [L1090] ~tmp___1~0 := #t~nondet11; [L1090] havoc #t~nondet11; [L1091] ~tmp___2~0 := #t~nondet12; [L1091] havoc #t~nondet12; [L1092] havoc ~tmp___3~0; [L1093] havoc ~tmp___4~0; [L1094] havoc ~tmp___5~0; [L1095] havoc ~tmp___6~0; [L1096] havoc ~tmp___7~0; [L1097] havoc ~tmp___8~0; [L1098] havoc ~tmp___9~0; [L1100] havoc ~blastFlag~0; [L1103] ~blastFlag~0 := 0bv32; [L1104] FCALL call write~intINTTYPE4(#t~nondet13, { base: ~s!base, offset: ~bvadd32(92bv32, ~s!offset) }, 4bv32); [L1104] havoc #t~nondet13; [L1105] FCALL call write~intINTTYPE4(12292bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1106] ~tmp~2 := #t~nondet14; [L1106] havoc #t~nondet14; [L1107] ~cb~0 := { base: 0bv32, offset: 0bv32 }; [L1108] ~ret~0 := 4294967295bv32; [L1109] ~skip~0 := 0bv32; [L1110] FCALL call write~intINTTYPE4(0bv32, ~tmp___0~1, 4bv32); [L1111] FCALL call #t~mem15 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(192bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem15!base=33028bv32, #t~mem15!offset=2147516596bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=0bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp~2=0bv32] [L1111] COND TRUE 0bv32 != ~bvadd32(#t~mem15!base, #t~mem15!offset) [L1111] havoc #t~mem15; [L1112] FCALL call #t~mem16 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(192bv32, ~s!offset) }, 4bv32); [L1112] ~cb~0 := #t~mem16; [L1112] havoc #t~mem16; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp~2=0bv32] [L1120] FCALL call #t~mem21 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(28bv32, ~s!offset) }, 4bv32); [L1120] FCALL call write~intINTTYPE4(~bvadd32(1bv32, #t~mem21), { base: ~s!base, offset: ~bvadd32(28bv32, ~s!offset) }, 4bv32); [L1120] havoc #t~mem21; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp~2=0bv32] [L1121-L1129] COND FALSE !(0bv32 != ~bvand32(12288bv32, ~tmp___1~0)) VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp~2=0bv32] [L1131-L1635] COND FALSE !(false) VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp~2=0bv32] [L1133] FCALL call #t~mem22 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1133] ~state~0 := #t~mem22; [L1133] havoc #t~mem22; [L1134] FCALL call #t~mem23 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem23=12292bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp~2=0bv32] [L1134] COND TRUE 12292bv32 == #t~mem23 [L1134] havoc #t~mem23; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp~2=0bv32] [L1237] FCALL call write~intINTTYPE4(1bv32, { base: ~s!base, offset: ~bvadd32(40bv32, ~s!offset) }, 4bv32); [L1238] FCALL call write~intINTTYPE4(4096bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1239] FCALL call #t~mem56 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(204bv32, ~s!offset) }, 4bv32); [L1239] FCALL call #t~mem57 := read~intINTTYPE4({ base: #t~mem56!base, offset: ~bvadd32(64bv32, #t~mem56!offset) }, 4bv32); [L1239] FCALL call write~intINTTYPE4(~bvadd32(1bv32, #t~mem57), { base: #t~mem56!base, offset: ~bvadd32(64bv32, #t~mem56!offset) }, 4bv32); [L1239] havoc #t~mem57; [L1239] havoc #t~mem56; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp~2=0bv32] [L1244] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(36bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp~2=0bv32] [L1245] COND TRUE 0bv32 != ~bvadd32(~cb~0!base, ~cb~0!offset) VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp~2=0bv32] [L1250] FCALL call #t~mem58 := read~intINTTYPE4({ base: ~s!base, offset: ~s!offset }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem58=768bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp~2=0bv32] [L1250] COND FALSE !(768bv32 != ~bvand32(65280bv32, #t~mem58)) [L1250] havoc #t~mem58; [L1256] FCALL call write~intINTTYPE4(4096bv32, { base: ~s!base, offset: ~bvadd32(4bv32, ~s!offset) }, 4bv32); [L1257] FCALL call #t~mem59 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(60bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem59!base=0bv32, #t~mem59!offset=1bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp~2=0bv32] [L1257] COND FALSE !(0bv32 == ~bvadd32(#t~mem59!base, #t~mem59!offset)) [L1257] havoc #t~mem59; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp~2=0bv32] [L1269] ~tmp___4~0 := #t~nondet61; [L1269] havoc #t~nondet61; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp~2=0bv32] [L1270] COND FALSE !(0bv32 == ~tmp___4~0) [L1276] ~tmp___5~0 := #t~nondet62; [L1276] havoc #t~nondet62; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1277] COND FALSE !(0bv32 == ~tmp___5~0) [L1283] FCALL call write~intINTTYPE4(4368bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1284] FCALL call #t~mem63 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(204bv32, ~s!offset) }, 4bv32); [L1284] FCALL call #t~mem64 := read~intINTTYPE4({ base: #t~mem63!base, offset: ~bvadd32(60bv32, #t~mem63!offset) }, 4bv32); [L1284] FCALL call write~intINTTYPE4(~bvadd32(1bv32, #t~mem64), { base: #t~mem63!base, offset: ~bvadd32(60bv32, #t~mem63!offset) }, 4bv32); [L1284] havoc #t~mem64; [L1284] havoc #t~mem63; [L1285] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(64bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1605] FCALL call #t~mem128 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(84bv32, ~s!offset) }, 4bv32); [L1605] FCALL call #t~mem129 := read~intINTTYPE4({ base: #t~mem128!base, offset: ~bvadd32(848bv32, #t~mem128!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem128!base=268435457bv32, #t~mem128!offset=4294966500bv32, #t~mem129=4368bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1605] COND FALSE !(0bv32 == #t~mem129) [L1605] havoc #t~mem129; [L1605] havoc #t~mem128; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1634] ~skip~0 := 0bv32; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1131-L1635] COND FALSE !(false) VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1133] FCALL call #t~mem22 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1133] ~state~0 := #t~mem22; [L1133] havoc #t~mem22; [L1134] FCALL call #t~mem23 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem23=4368bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1134] COND FALSE !(12292bv32 == #t~mem23) [L1134] havoc #t~mem23; [L1137] FCALL call #t~mem24 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem24=4368bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1137] COND FALSE !(16384bv32 == #t~mem24) [L1137] havoc #t~mem24; [L1140] FCALL call #t~mem25 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem25=4368bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1140] COND FALSE !(4096bv32 == #t~mem25) [L1140] havoc #t~mem25; [L1143] FCALL call #t~mem26 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem26=4368bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1143] COND FALSE !(20480bv32 == #t~mem26) [L1143] havoc #t~mem26; [L1146] FCALL call #t~mem27 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem27=4368bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1146] COND FALSE !(4099bv32 == #t~mem27) [L1146] havoc #t~mem27; [L1149] FCALL call #t~mem28 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem28=4368bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1149] COND TRUE 4368bv32 == #t~mem28 [L1149] havoc #t~mem28; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1289] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(48bv32, ~s!offset) }, 4bv32); [L1290] ~ret~0 := #t~nondet65; [L1290] havoc #t~nondet65; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1291] COND TRUE 0bv32 == ~blastFlag~0 [L1292] ~blastFlag~0 := 1bv32; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1296] COND FALSE !(~bvsle32(~ret~0, 0bv32)) [L1301] FCALL call write~intINTTYPE4(4384bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1302] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(64bv32, ~s!offset) }, 4bv32); [L1303] FCALL call #t~mem66 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(20bv32, ~s!offset) }, 4bv32); [L1303] FCALL call #t~mem67 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(16bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem66!base=0bv32, #t~mem66!offset=1bv32, #t~mem67!base=0bv32, #t~mem67!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1303] COND TRUE ~bvadd32(#t~mem66!base, #t~mem66!offset) != ~bvadd32(#t~mem67!base, #t~mem67!offset) [L1303] havoc #t~mem66; [L1303] havoc #t~mem67; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1605] FCALL call #t~mem128 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(84bv32, ~s!offset) }, 4bv32); [L1605] FCALL call #t~mem129 := read~intINTTYPE4({ base: #t~mem128!base, offset: ~bvadd32(848bv32, #t~mem128!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem128!base=268435457bv32, #t~mem128!offset=4294966500bv32, #t~mem129=4384bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1605] COND FALSE !(0bv32 == #t~mem129) [L1605] havoc #t~mem129; [L1605] havoc #t~mem128; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1634] ~skip~0 := 0bv32; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1131-L1635] COND FALSE !(false) VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1133] FCALL call #t~mem22 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1133] ~state~0 := #t~mem22; [L1133] havoc #t~mem22; [L1134] FCALL call #t~mem23 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem23=4384bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1134] COND FALSE !(12292bv32 == #t~mem23) [L1134] havoc #t~mem23; [L1137] FCALL call #t~mem24 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem24=4384bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1137] COND FALSE !(16384bv32 == #t~mem24) [L1137] havoc #t~mem24; [L1140] FCALL call #t~mem25 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem25=4384bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1140] COND FALSE !(4096bv32 == #t~mem25) [L1140] havoc #t~mem25; [L1143] FCALL call #t~mem26 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem26=4384bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1143] COND FALSE !(20480bv32 == #t~mem26) [L1143] havoc #t~mem26; [L1146] FCALL call #t~mem27 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem27=4384bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1146] COND FALSE !(4099bv32 == #t~mem27) [L1146] havoc #t~mem27; [L1149] FCALL call #t~mem28 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem28=4384bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1149] COND FALSE !(4368bv32 == #t~mem28) [L1149] havoc #t~mem28; [L1152] FCALL call #t~mem29 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem29=4384bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1152] COND FALSE !(4369bv32 == #t~mem29) [L1152] havoc #t~mem29; [L1155] FCALL call #t~mem30 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem30=4384bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1155] COND TRUE 4384bv32 == #t~mem30 [L1155] havoc #t~mem30; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1311] ~ret~0 := #t~nondet68; [L1311] havoc #t~nondet68; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1312] COND TRUE 1bv32 == ~blastFlag~0 [L1313] ~blastFlag~0 := 2bv32; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1317] COND FALSE !(~bvsle32(~ret~0, 0bv32)) [L1322] FCALL call #t~mem69 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(92bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem69=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1322-L1326] COND FALSE !(0bv32 != #t~mem69) [L1322] havoc #t~mem69; [L1325] FCALL call write~intINTTYPE4(4400bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1327] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(64bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1605] FCALL call #t~mem128 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(84bv32, ~s!offset) }, 4bv32); [L1605] FCALL call #t~mem129 := read~intINTTYPE4({ base: #t~mem128!base, offset: ~bvadd32(848bv32, #t~mem128!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem128!base=268435457bv32, #t~mem128!offset=4294966500bv32, #t~mem129=4400bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1605] COND FALSE !(0bv32 == #t~mem129) [L1605] havoc #t~mem129; [L1605] havoc #t~mem128; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1634] ~skip~0 := 0bv32; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1131-L1635] COND FALSE !(false) VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1133] FCALL call #t~mem22 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1133] ~state~0 := #t~mem22; [L1133] havoc #t~mem22; [L1134] FCALL call #t~mem23 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem23=4400bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1134] COND FALSE !(12292bv32 == #t~mem23) [L1134] havoc #t~mem23; [L1137] FCALL call #t~mem24 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem24=4400bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1137] COND FALSE !(16384bv32 == #t~mem24) [L1137] havoc #t~mem24; [L1140] FCALL call #t~mem25 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem25=4400bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1140] COND FALSE !(4096bv32 == #t~mem25) [L1140] havoc #t~mem25; [L1143] FCALL call #t~mem26 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem26=4400bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1143] COND FALSE !(20480bv32 == #t~mem26) [L1143] havoc #t~mem26; [L1146] FCALL call #t~mem27 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem27=4400bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1146] COND FALSE !(4099bv32 == #t~mem27) [L1146] havoc #t~mem27; [L1149] FCALL call #t~mem28 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem28=4400bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1149] COND FALSE !(4368bv32 == #t~mem28) [L1149] havoc #t~mem28; [L1152] FCALL call #t~mem29 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem29=4400bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1152] COND FALSE !(4369bv32 == #t~mem29) [L1152] havoc #t~mem29; [L1155] FCALL call #t~mem30 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem30=4400bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1155] COND FALSE !(4384bv32 == #t~mem30) [L1155] havoc #t~mem30; [L1158] FCALL call #t~mem31 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem31=4400bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1158] COND FALSE !(4385bv32 == #t~mem31) [L1158] havoc #t~mem31; [L1161] FCALL call #t~mem32 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem32=4400bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1161] COND TRUE 4400bv32 == #t~mem32 [L1161] havoc #t~mem32; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1331] FCALL call #t~mem70 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(84bv32, ~s!offset) }, 4bv32); [L1331] FCALL call #t~mem71 := read~$Pointer$({ base: #t~mem70!base, offset: ~bvadd32(836bv32, #t~mem70!offset) }, 4bv32); [L1331] FCALL call #t~mem72 := read~intINTTYPE4({ base: #t~mem71!base, offset: ~bvadd32(12bv32, #t~mem71!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem70!base=268435457bv32, #t~mem70!offset=4294966500bv32, #t~mem71!base=268435457bv32, #t~mem71!offset=52bv32, #t~mem72=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1331-L1345] COND FALSE !(0bv32 != ~bvand32(256bv32, #t~mem72)) [L1331] havoc #t~mem71; [L1331] havoc #t~mem70; [L1331] havoc #t~mem72; [L1334] ~ret~0 := #t~nondet73; [L1334] havoc #t~nondet73; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1335] COND TRUE 2bv32 == ~blastFlag~0 [L1336] ~blastFlag~0 := 3bv32; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1340] COND FALSE !(~bvsle32(~ret~0, 0bv32)) VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1346] FCALL call write~intINTTYPE4(4416bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1347] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(64bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1605] FCALL call #t~mem128 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(84bv32, ~s!offset) }, 4bv32); [L1605] FCALL call #t~mem129 := read~intINTTYPE4({ base: #t~mem128!base, offset: ~bvadd32(848bv32, #t~mem128!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem128!base=268435457bv32, #t~mem128!offset=4294966500bv32, #t~mem129=4416bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1605] COND FALSE !(0bv32 == #t~mem129) [L1605] havoc #t~mem129; [L1605] havoc #t~mem128; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1634] ~skip~0 := 0bv32; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1131-L1635] COND FALSE !(false) VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1133] FCALL call #t~mem22 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1133] ~state~0 := #t~mem22; [L1133] havoc #t~mem22; [L1134] FCALL call #t~mem23 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem23=4416bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1134] COND FALSE !(12292bv32 == #t~mem23) [L1134] havoc #t~mem23; [L1137] FCALL call #t~mem24 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem24=4416bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1137] COND FALSE !(16384bv32 == #t~mem24) [L1137] havoc #t~mem24; [L1140] FCALL call #t~mem25 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem25=4416bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1140] COND FALSE !(4096bv32 == #t~mem25) [L1140] havoc #t~mem25; [L1143] FCALL call #t~mem26 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem26=4416bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1143] COND FALSE !(20480bv32 == #t~mem26) [L1143] havoc #t~mem26; [L1146] FCALL call #t~mem27 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem27=4416bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1146] COND FALSE !(4099bv32 == #t~mem27) [L1146] havoc #t~mem27; [L1149] FCALL call #t~mem28 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem28=4416bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1149] COND FALSE !(4368bv32 == #t~mem28) [L1149] havoc #t~mem28; [L1152] FCALL call #t~mem29 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem29=4416bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1152] COND FALSE !(4369bv32 == #t~mem29) [L1152] havoc #t~mem29; [L1155] FCALL call #t~mem30 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem30=4416bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1155] COND FALSE !(4384bv32 == #t~mem30) [L1155] havoc #t~mem30; [L1158] FCALL call #t~mem31 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem31=4416bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1158] COND FALSE !(4385bv32 == #t~mem31) [L1158] havoc #t~mem31; [L1161] FCALL call #t~mem32 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem32=4416bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1161] COND FALSE !(4400bv32 == #t~mem32) [L1161] havoc #t~mem32; [L1164] FCALL call #t~mem33 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem33=4416bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1164] COND FALSE !(4401bv32 == #t~mem33) [L1164] havoc #t~mem33; [L1167] FCALL call #t~mem34 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem34=4416bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1167] COND TRUE 4416bv32 == #t~mem34 [L1167] havoc #t~mem34; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1351] ~ret~0 := #t~nondet74; [L1351] havoc #t~nondet74; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1352] COND TRUE 3bv32 == ~blastFlag~0 [L1353] ~blastFlag~0 := 4bv32; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1357] COND FALSE !(~bvsle32(~ret~0, 0bv32)) [L1362] FCALL call write~intINTTYPE4(4432bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1363] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(64bv32, ~s!offset) }, 4bv32); [L1364] ~tmp___6~0 := #t~nondet75; [L1364] havoc #t~nondet75; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1365] COND FALSE !(0bv32 == ~tmp___6~0) VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1605] FCALL call #t~mem128 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(84bv32, ~s!offset) }, 4bv32); [L1605] FCALL call #t~mem129 := read~intINTTYPE4({ base: #t~mem128!base, offset: ~bvadd32(848bv32, #t~mem128!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem128!base=268435457bv32, #t~mem128!offset=4294966500bv32, #t~mem129=4432bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1605] COND FALSE !(0bv32 == #t~mem129) [L1605] havoc #t~mem129; [L1605] havoc #t~mem128; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1634] ~skip~0 := 0bv32; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1131-L1635] COND FALSE !(false) VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1133] FCALL call #t~mem22 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1133] ~state~0 := #t~mem22; [L1133] havoc #t~mem22; [L1134] FCALL call #t~mem23 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem23=4432bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1134] COND FALSE !(12292bv32 == #t~mem23) [L1134] havoc #t~mem23; [L1137] FCALL call #t~mem24 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem24=4432bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1137] COND FALSE !(16384bv32 == #t~mem24) [L1137] havoc #t~mem24; [L1140] FCALL call #t~mem25 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem25=4432bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1140] COND FALSE !(4096bv32 == #t~mem25) [L1140] havoc #t~mem25; [L1143] FCALL call #t~mem26 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem26=4432bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1143] COND FALSE !(20480bv32 == #t~mem26) [L1143] havoc #t~mem26; [L1146] FCALL call #t~mem27 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem27=4432bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1146] COND FALSE !(4099bv32 == #t~mem27) [L1146] havoc #t~mem27; [L1149] FCALL call #t~mem28 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem28=4432bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1149] COND FALSE !(4368bv32 == #t~mem28) [L1149] havoc #t~mem28; [L1152] FCALL call #t~mem29 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem29=4432bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1152] COND FALSE !(4369bv32 == #t~mem29) [L1152] havoc #t~mem29; [L1155] FCALL call #t~mem30 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem30=4432bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1155] COND FALSE !(4384bv32 == #t~mem30) [L1155] havoc #t~mem30; [L1158] FCALL call #t~mem31 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem31=4432bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1158] COND FALSE !(4385bv32 == #t~mem31) [L1158] havoc #t~mem31; [L1161] FCALL call #t~mem32 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem32=4432bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1161] COND FALSE !(4400bv32 == #t~mem32) [L1161] havoc #t~mem32; [L1164] FCALL call #t~mem33 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem33=4432bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1164] COND FALSE !(4401bv32 == #t~mem33) [L1164] havoc #t~mem33; [L1167] FCALL call #t~mem34 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem34=4432bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1167] COND FALSE !(4416bv32 == #t~mem34) [L1167] havoc #t~mem34; [L1170] FCALL call #t~mem35 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem35=4432bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1170] COND FALSE !(4417bv32 == #t~mem35) [L1170] havoc #t~mem35; [L1173] FCALL call #t~mem36 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem36=4432bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1173] COND TRUE 4432bv32 == #t~mem36 [L1173] havoc #t~mem36; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1374] ~ret~0 := #t~nondet76; [L1374] havoc #t~nondet76; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1375] COND FALSE !(5bv32 == ~blastFlag~0) VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1380] COND FALSE !(~bvsle32(~ret~0, 0bv32)) [L1385] FCALL call write~intINTTYPE4(4448bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1386] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(64bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1605] FCALL call #t~mem128 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(84bv32, ~s!offset) }, 4bv32); [L1605] FCALL call #t~mem129 := read~intINTTYPE4({ base: #t~mem128!base, offset: ~bvadd32(848bv32, #t~mem128!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem128!base=268435457bv32, #t~mem128!offset=4294966500bv32, #t~mem129=4448bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1605] COND FALSE !(0bv32 == #t~mem129) [L1605] havoc #t~mem129; [L1605] havoc #t~mem128; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1634] ~skip~0 := 0bv32; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1131-L1635] COND FALSE !(false) VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1133] FCALL call #t~mem22 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1133] ~state~0 := #t~mem22; [L1133] havoc #t~mem22; [L1134] FCALL call #t~mem23 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem23=4448bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1134] COND FALSE !(12292bv32 == #t~mem23) [L1134] havoc #t~mem23; [L1137] FCALL call #t~mem24 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem24=4448bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1137] COND FALSE !(16384bv32 == #t~mem24) [L1137] havoc #t~mem24; [L1140] FCALL call #t~mem25 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem25=4448bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1140] COND FALSE !(4096bv32 == #t~mem25) [L1140] havoc #t~mem25; [L1143] FCALL call #t~mem26 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem26=4448bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1143] COND FALSE !(20480bv32 == #t~mem26) [L1143] havoc #t~mem26; [L1146] FCALL call #t~mem27 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem27=4448bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1146] COND FALSE !(4099bv32 == #t~mem27) [L1146] havoc #t~mem27; [L1149] FCALL call #t~mem28 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem28=4448bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1149] COND FALSE !(4368bv32 == #t~mem28) [L1149] havoc #t~mem28; [L1152] FCALL call #t~mem29 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem29=4448bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1152] COND FALSE !(4369bv32 == #t~mem29) [L1152] havoc #t~mem29; [L1155] FCALL call #t~mem30 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem30=4448bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1155] COND FALSE !(4384bv32 == #t~mem30) [L1155] havoc #t~mem30; [L1158] FCALL call #t~mem31 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem31=4448bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1158] COND FALSE !(4385bv32 == #t~mem31) [L1158] havoc #t~mem31; [L1161] FCALL call #t~mem32 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem32=4448bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1161] COND FALSE !(4400bv32 == #t~mem32) [L1161] havoc #t~mem32; [L1164] FCALL call #t~mem33 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem33=4448bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1164] COND FALSE !(4401bv32 == #t~mem33) [L1164] havoc #t~mem33; [L1167] FCALL call #t~mem34 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem34=4448bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1167] COND FALSE !(4416bv32 == #t~mem34) [L1167] havoc #t~mem34; [L1170] FCALL call #t~mem35 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem35=4448bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1170] COND FALSE !(4417bv32 == #t~mem35) [L1170] havoc #t~mem35; [L1173] FCALL call #t~mem36 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem36=4448bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1173] COND FALSE !(4432bv32 == #t~mem36) [L1173] havoc #t~mem36; [L1176] FCALL call #t~mem37 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem37=4448bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1176] COND FALSE !(4433bv32 == #t~mem37) [L1176] havoc #t~mem37; [L1179] FCALL call #t~mem38 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem38=4448bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1179] COND TRUE 4448bv32 == #t~mem38 [L1179] havoc #t~mem38; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1390] ~ret~0 := #t~nondet77; [L1390] havoc #t~nondet77; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=0bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1391] COND TRUE 4bv32 == ~blastFlag~0 VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=0bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1646] assert false; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=0bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [?] CALL call ULTIMATE.init(); VAL [#NULL!base=0bv32, #NULL!offset=0bv32, old(#NULL!base)=0bv32, old(#NULL!offset)=0bv32, old(~#SSLv3_client_data~0!base)=0bv32, old(~#SSLv3_client_data~0!offset)=0bv32, old(~init~0)=0bv32, ~#SSLv3_client_data~0!base=0bv32, ~#SSLv3_client_data~0!offset=0bv32, ~init~0=0bv32] [?] #NULL := { base: 0bv32, offset: 0bv32 }; [?] #valid[0bv32] := 0bv1; [L1042] ~init~0 := 1bv32; [L1043] FCALL call ~#SSLv3_client_data~0 := #Ultimate.alloc(100bv32); [L1043] FCALL call write~init~intINTTYPE4(0bv32, { base: ~#SSLv3_client_data~0!base, offset: ~#SSLv3_client_data~0!offset }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(4bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(8bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(12bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(16bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(20bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(24bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(28bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(32bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(36bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(40bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(44bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(48bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(52bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(56bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(60bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(64bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(68bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(72bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(76bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(80bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(84bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(88bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(92bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(96bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); VAL [#NULL!base=0bv32, #NULL!offset=0bv32, old(#NULL!base)=0bv32, old(#NULL!offset)=0bv32, old(~#SSLv3_client_data~0!base)=0bv32, old(~#SSLv3_client_data~0!offset)=0bv32, old(~init~0)=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~init~0=1bv32] [?] RET call ULTIMATE.init(); VAL [#NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~init~0=1bv32] [?] CALL call #t~ret139 := main(); VAL [#NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~init~0=1bv32] [L1065] FCALL call #t~malloc3 := #Ultimate.alloc(248bv32); [L1065] ~s~0 := #t~malloc3; [L1069] FCALL call #t~malloc4 := #Ultimate.alloc(899bv32); [L1069] FCALL call write~$Pointer$(#t~malloc4, { base: ~s~0!base, offset: ~bvadd32(84bv32, ~s~0!offset) }, 4bv32); [L1070] FCALL call #t~malloc5 := #Ultimate.alloc(232bv32); [L1070] FCALL call write~$Pointer$(#t~malloc5, { base: ~s~0!base, offset: ~bvadd32(204bv32, ~s~0!offset) }, 4bv32); [L1071] FCALL call #t~malloc6 := #Ultimate.alloc(200bv32); [L1071] FCALL call write~$Pointer$(#t~malloc6, { base: ~s~0!base, offset: ~bvadd32(176bv32, ~s~0!offset) }, 4bv32); [L1072] FCALL call write~intINTTYPE4(12292bv32, { base: ~s~0!base, offset: ~bvadd32(52bv32, ~s~0!offset) }, 4bv32); [L1073] FCALL call write~intINTTYPE4(#t~nondet7, { base: ~s~0!base, offset: ~s~0!offset }, 4bv32); [L1073] havoc #t~nondet7; VAL [#NULL!base=0bv32, #NULL!offset=0bv32, #t~malloc3!base=268435457bv32, #t~malloc3!offset=0bv32, #t~malloc4!base=2147483650bv32, #t~malloc4!offset=0bv32, #t~malloc5!base=3bv32, #t~malloc5!offset=0bv32, #t~malloc6!base=2bv32, #t~malloc6!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~init~0=1bv32, ~s~0!base=268435457bv32, ~s~0!offset=0bv32] [L1074] CALL call #t~ret8 := ssl3_connect(~s~0); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~init~0=1bv32] [L1079-L1648] ~s := #in~s; [L1080] ~buf~0 := #t~nondet9; [L1080] havoc #t~nondet9; [L1081] havoc ~tmp~2; [L1082] havoc ~l~0; [L1083] havoc ~num1~0; [L1084] havoc ~cb~0; [L1085] havoc ~ret~0; [L1086] havoc ~new_state~0; [L1087] havoc ~state~0; [L1088] havoc ~skip~0; [L1089] ~tmp___0~1 := #t~nondet10; [L1089] havoc #t~nondet10; [L1090] ~tmp___1~0 := #t~nondet11; [L1090] havoc #t~nondet11; [L1091] ~tmp___2~0 := #t~nondet12; [L1091] havoc #t~nondet12; [L1092] havoc ~tmp___3~0; [L1093] havoc ~tmp___4~0; [L1094] havoc ~tmp___5~0; [L1095] havoc ~tmp___6~0; [L1096] havoc ~tmp___7~0; [L1097] havoc ~tmp___8~0; [L1098] havoc ~tmp___9~0; [L1100] havoc ~blastFlag~0; [L1103] ~blastFlag~0 := 0bv32; [L1104] FCALL call write~intINTTYPE4(#t~nondet13, { base: ~s!base, offset: ~bvadd32(92bv32, ~s!offset) }, 4bv32); [L1104] havoc #t~nondet13; [L1105] FCALL call write~intINTTYPE4(12292bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1106] ~tmp~2 := #t~nondet14; [L1106] havoc #t~nondet14; [L1107] ~cb~0 := { base: 0bv32, offset: 0bv32 }; [L1108] ~ret~0 := 4294967295bv32; [L1109] ~skip~0 := 0bv32; [L1110] FCALL call write~intINTTYPE4(0bv32, ~tmp___0~1, 4bv32); [L1111] FCALL call #t~mem15 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(192bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem15!base=33028bv32, #t~mem15!offset=2147516596bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=0bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp~2=0bv32] [L1111] COND TRUE 0bv32 != ~bvadd32(#t~mem15!base, #t~mem15!offset) [L1111] havoc #t~mem15; [L1112] FCALL call #t~mem16 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(192bv32, ~s!offset) }, 4bv32); [L1112] ~cb~0 := #t~mem16; [L1112] havoc #t~mem16; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp~2=0bv32] [L1120] FCALL call #t~mem21 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(28bv32, ~s!offset) }, 4bv32); [L1120] FCALL call write~intINTTYPE4(~bvadd32(1bv32, #t~mem21), { base: ~s!base, offset: ~bvadd32(28bv32, ~s!offset) }, 4bv32); [L1120] havoc #t~mem21; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp~2=0bv32] [L1121-L1129] COND FALSE !(0bv32 != ~bvand32(12288bv32, ~tmp___1~0)) VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp~2=0bv32] [L1131-L1635] COND FALSE !(false) VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp~2=0bv32] [L1133] FCALL call #t~mem22 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1133] ~state~0 := #t~mem22; [L1133] havoc #t~mem22; [L1134] FCALL call #t~mem23 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem23=12292bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp~2=0bv32] [L1134] COND TRUE 12292bv32 == #t~mem23 [L1134] havoc #t~mem23; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp~2=0bv32] [L1237] FCALL call write~intINTTYPE4(1bv32, { base: ~s!base, offset: ~bvadd32(40bv32, ~s!offset) }, 4bv32); [L1238] FCALL call write~intINTTYPE4(4096bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1239] FCALL call #t~mem56 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(204bv32, ~s!offset) }, 4bv32); [L1239] FCALL call #t~mem57 := read~intINTTYPE4({ base: #t~mem56!base, offset: ~bvadd32(64bv32, #t~mem56!offset) }, 4bv32); [L1239] FCALL call write~intINTTYPE4(~bvadd32(1bv32, #t~mem57), { base: #t~mem56!base, offset: ~bvadd32(64bv32, #t~mem56!offset) }, 4bv32); [L1239] havoc #t~mem57; [L1239] havoc #t~mem56; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp~2=0bv32] [L1244] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(36bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp~2=0bv32] [L1245] COND TRUE 0bv32 != ~bvadd32(~cb~0!base, ~cb~0!offset) VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp~2=0bv32] [L1250] FCALL call #t~mem58 := read~intINTTYPE4({ base: ~s!base, offset: ~s!offset }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem58=768bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp~2=0bv32] [L1250] COND FALSE !(768bv32 != ~bvand32(65280bv32, #t~mem58)) [L1250] havoc #t~mem58; [L1256] FCALL call write~intINTTYPE4(4096bv32, { base: ~s!base, offset: ~bvadd32(4bv32, ~s!offset) }, 4bv32); [L1257] FCALL call #t~mem59 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(60bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem59!base=0bv32, #t~mem59!offset=1bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp~2=0bv32] [L1257] COND FALSE !(0bv32 == ~bvadd32(#t~mem59!base, #t~mem59!offset)) [L1257] havoc #t~mem59; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp~2=0bv32] [L1269] ~tmp___4~0 := #t~nondet61; [L1269] havoc #t~nondet61; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp~2=0bv32] [L1270] COND FALSE !(0bv32 == ~tmp___4~0) [L1276] ~tmp___5~0 := #t~nondet62; [L1276] havoc #t~nondet62; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1277] COND FALSE !(0bv32 == ~tmp___5~0) [L1283] FCALL call write~intINTTYPE4(4368bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1284] FCALL call #t~mem63 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(204bv32, ~s!offset) }, 4bv32); [L1284] FCALL call #t~mem64 := read~intINTTYPE4({ base: #t~mem63!base, offset: ~bvadd32(60bv32, #t~mem63!offset) }, 4bv32); [L1284] FCALL call write~intINTTYPE4(~bvadd32(1bv32, #t~mem64), { base: #t~mem63!base, offset: ~bvadd32(60bv32, #t~mem63!offset) }, 4bv32); [L1284] havoc #t~mem64; [L1284] havoc #t~mem63; [L1285] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(64bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1605] FCALL call #t~mem128 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(84bv32, ~s!offset) }, 4bv32); [L1605] FCALL call #t~mem129 := read~intINTTYPE4({ base: #t~mem128!base, offset: ~bvadd32(848bv32, #t~mem128!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem128!base=268435457bv32, #t~mem128!offset=4294966500bv32, #t~mem129=4368bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1605] COND FALSE !(0bv32 == #t~mem129) [L1605] havoc #t~mem129; [L1605] havoc #t~mem128; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1634] ~skip~0 := 0bv32; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1131-L1635] COND FALSE !(false) VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1133] FCALL call #t~mem22 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1133] ~state~0 := #t~mem22; [L1133] havoc #t~mem22; [L1134] FCALL call #t~mem23 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem23=4368bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1134] COND FALSE !(12292bv32 == #t~mem23) [L1134] havoc #t~mem23; [L1137] FCALL call #t~mem24 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem24=4368bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1137] COND FALSE !(16384bv32 == #t~mem24) [L1137] havoc #t~mem24; [L1140] FCALL call #t~mem25 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem25=4368bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1140] COND FALSE !(4096bv32 == #t~mem25) [L1140] havoc #t~mem25; [L1143] FCALL call #t~mem26 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem26=4368bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1143] COND FALSE !(20480bv32 == #t~mem26) [L1143] havoc #t~mem26; [L1146] FCALL call #t~mem27 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem27=4368bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1146] COND FALSE !(4099bv32 == #t~mem27) [L1146] havoc #t~mem27; [L1149] FCALL call #t~mem28 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem28=4368bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1149] COND TRUE 4368bv32 == #t~mem28 [L1149] havoc #t~mem28; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1289] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(48bv32, ~s!offset) }, 4bv32); [L1290] ~ret~0 := #t~nondet65; [L1290] havoc #t~nondet65; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1291] COND TRUE 0bv32 == ~blastFlag~0 [L1292] ~blastFlag~0 := 1bv32; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1296] COND FALSE !(~bvsle32(~ret~0, 0bv32)) [L1301] FCALL call write~intINTTYPE4(4384bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1302] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(64bv32, ~s!offset) }, 4bv32); [L1303] FCALL call #t~mem66 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(20bv32, ~s!offset) }, 4bv32); [L1303] FCALL call #t~mem67 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(16bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem66!base=0bv32, #t~mem66!offset=1bv32, #t~mem67!base=0bv32, #t~mem67!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1303] COND TRUE ~bvadd32(#t~mem66!base, #t~mem66!offset) != ~bvadd32(#t~mem67!base, #t~mem67!offset) [L1303] havoc #t~mem66; [L1303] havoc #t~mem67; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1605] FCALL call #t~mem128 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(84bv32, ~s!offset) }, 4bv32); [L1605] FCALL call #t~mem129 := read~intINTTYPE4({ base: #t~mem128!base, offset: ~bvadd32(848bv32, #t~mem128!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem128!base=268435457bv32, #t~mem128!offset=4294966500bv32, #t~mem129=4384bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1605] COND FALSE !(0bv32 == #t~mem129) [L1605] havoc #t~mem129; [L1605] havoc #t~mem128; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1634] ~skip~0 := 0bv32; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1131-L1635] COND FALSE !(false) VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1133] FCALL call #t~mem22 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1133] ~state~0 := #t~mem22; [L1133] havoc #t~mem22; [L1134] FCALL call #t~mem23 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem23=4384bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1134] COND FALSE !(12292bv32 == #t~mem23) [L1134] havoc #t~mem23; [L1137] FCALL call #t~mem24 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem24=4384bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1137] COND FALSE !(16384bv32 == #t~mem24) [L1137] havoc #t~mem24; [L1140] FCALL call #t~mem25 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem25=4384bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1140] COND FALSE !(4096bv32 == #t~mem25) [L1140] havoc #t~mem25; [L1143] FCALL call #t~mem26 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem26=4384bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1143] COND FALSE !(20480bv32 == #t~mem26) [L1143] havoc #t~mem26; [L1146] FCALL call #t~mem27 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem27=4384bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1146] COND FALSE !(4099bv32 == #t~mem27) [L1146] havoc #t~mem27; [L1149] FCALL call #t~mem28 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem28=4384bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1149] COND FALSE !(4368bv32 == #t~mem28) [L1149] havoc #t~mem28; [L1152] FCALL call #t~mem29 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem29=4384bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1152] COND FALSE !(4369bv32 == #t~mem29) [L1152] havoc #t~mem29; [L1155] FCALL call #t~mem30 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem30=4384bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1155] COND TRUE 4384bv32 == #t~mem30 [L1155] havoc #t~mem30; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1311] ~ret~0 := #t~nondet68; [L1311] havoc #t~nondet68; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1312] COND TRUE 1bv32 == ~blastFlag~0 [L1313] ~blastFlag~0 := 2bv32; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1317] COND FALSE !(~bvsle32(~ret~0, 0bv32)) [L1322] FCALL call #t~mem69 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(92bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem69=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1322-L1326] COND FALSE !(0bv32 != #t~mem69) [L1322] havoc #t~mem69; [L1325] FCALL call write~intINTTYPE4(4400bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1327] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(64bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1605] FCALL call #t~mem128 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(84bv32, ~s!offset) }, 4bv32); [L1605] FCALL call #t~mem129 := read~intINTTYPE4({ base: #t~mem128!base, offset: ~bvadd32(848bv32, #t~mem128!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem128!base=268435457bv32, #t~mem128!offset=4294966500bv32, #t~mem129=4400bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1605] COND FALSE !(0bv32 == #t~mem129) [L1605] havoc #t~mem129; [L1605] havoc #t~mem128; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1634] ~skip~0 := 0bv32; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1131-L1635] COND FALSE !(false) VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1133] FCALL call #t~mem22 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1133] ~state~0 := #t~mem22; [L1133] havoc #t~mem22; [L1134] FCALL call #t~mem23 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem23=4400bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1134] COND FALSE !(12292bv32 == #t~mem23) [L1134] havoc #t~mem23; [L1137] FCALL call #t~mem24 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem24=4400bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1137] COND FALSE !(16384bv32 == #t~mem24) [L1137] havoc #t~mem24; [L1140] FCALL call #t~mem25 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem25=4400bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1140] COND FALSE !(4096bv32 == #t~mem25) [L1140] havoc #t~mem25; [L1143] FCALL call #t~mem26 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem26=4400bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1143] COND FALSE !(20480bv32 == #t~mem26) [L1143] havoc #t~mem26; [L1146] FCALL call #t~mem27 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem27=4400bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1146] COND FALSE !(4099bv32 == #t~mem27) [L1146] havoc #t~mem27; [L1149] FCALL call #t~mem28 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem28=4400bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1149] COND FALSE !(4368bv32 == #t~mem28) [L1149] havoc #t~mem28; [L1152] FCALL call #t~mem29 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem29=4400bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1152] COND FALSE !(4369bv32 == #t~mem29) [L1152] havoc #t~mem29; [L1155] FCALL call #t~mem30 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem30=4400bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1155] COND FALSE !(4384bv32 == #t~mem30) [L1155] havoc #t~mem30; [L1158] FCALL call #t~mem31 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem31=4400bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1158] COND FALSE !(4385bv32 == #t~mem31) [L1158] havoc #t~mem31; [L1161] FCALL call #t~mem32 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem32=4400bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1161] COND TRUE 4400bv32 == #t~mem32 [L1161] havoc #t~mem32; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1331] FCALL call #t~mem70 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(84bv32, ~s!offset) }, 4bv32); [L1331] FCALL call #t~mem71 := read~$Pointer$({ base: #t~mem70!base, offset: ~bvadd32(836bv32, #t~mem70!offset) }, 4bv32); [L1331] FCALL call #t~mem72 := read~intINTTYPE4({ base: #t~mem71!base, offset: ~bvadd32(12bv32, #t~mem71!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem70!base=268435457bv32, #t~mem70!offset=4294966500bv32, #t~mem71!base=268435457bv32, #t~mem71!offset=52bv32, #t~mem72=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1331-L1345] COND FALSE !(0bv32 != ~bvand32(256bv32, #t~mem72)) [L1331] havoc #t~mem71; [L1331] havoc #t~mem70; [L1331] havoc #t~mem72; [L1334] ~ret~0 := #t~nondet73; [L1334] havoc #t~nondet73; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1335] COND TRUE 2bv32 == ~blastFlag~0 [L1336] ~blastFlag~0 := 3bv32; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1340] COND FALSE !(~bvsle32(~ret~0, 0bv32)) VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1346] FCALL call write~intINTTYPE4(4416bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1347] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(64bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1605] FCALL call #t~mem128 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(84bv32, ~s!offset) }, 4bv32); [L1605] FCALL call #t~mem129 := read~intINTTYPE4({ base: #t~mem128!base, offset: ~bvadd32(848bv32, #t~mem128!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem128!base=268435457bv32, #t~mem128!offset=4294966500bv32, #t~mem129=4416bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1605] COND FALSE !(0bv32 == #t~mem129) [L1605] havoc #t~mem129; [L1605] havoc #t~mem128; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1634] ~skip~0 := 0bv32; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1131-L1635] COND FALSE !(false) VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1133] FCALL call #t~mem22 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1133] ~state~0 := #t~mem22; [L1133] havoc #t~mem22; [L1134] FCALL call #t~mem23 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem23=4416bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1134] COND FALSE !(12292bv32 == #t~mem23) [L1134] havoc #t~mem23; [L1137] FCALL call #t~mem24 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem24=4416bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1137] COND FALSE !(16384bv32 == #t~mem24) [L1137] havoc #t~mem24; [L1140] FCALL call #t~mem25 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem25=4416bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1140] COND FALSE !(4096bv32 == #t~mem25) [L1140] havoc #t~mem25; [L1143] FCALL call #t~mem26 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem26=4416bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1143] COND FALSE !(20480bv32 == #t~mem26) [L1143] havoc #t~mem26; [L1146] FCALL call #t~mem27 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem27=4416bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1146] COND FALSE !(4099bv32 == #t~mem27) [L1146] havoc #t~mem27; [L1149] FCALL call #t~mem28 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem28=4416bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1149] COND FALSE !(4368bv32 == #t~mem28) [L1149] havoc #t~mem28; [L1152] FCALL call #t~mem29 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem29=4416bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1152] COND FALSE !(4369bv32 == #t~mem29) [L1152] havoc #t~mem29; [L1155] FCALL call #t~mem30 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem30=4416bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1155] COND FALSE !(4384bv32 == #t~mem30) [L1155] havoc #t~mem30; [L1158] FCALL call #t~mem31 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem31=4416bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1158] COND FALSE !(4385bv32 == #t~mem31) [L1158] havoc #t~mem31; [L1161] FCALL call #t~mem32 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem32=4416bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1161] COND FALSE !(4400bv32 == #t~mem32) [L1161] havoc #t~mem32; [L1164] FCALL call #t~mem33 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem33=4416bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1164] COND FALSE !(4401bv32 == #t~mem33) [L1164] havoc #t~mem33; [L1167] FCALL call #t~mem34 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem34=4416bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1167] COND TRUE 4416bv32 == #t~mem34 [L1167] havoc #t~mem34; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1351] ~ret~0 := #t~nondet74; [L1351] havoc #t~nondet74; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1352] COND TRUE 3bv32 == ~blastFlag~0 [L1353] ~blastFlag~0 := 4bv32; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1357] COND FALSE !(~bvsle32(~ret~0, 0bv32)) [L1362] FCALL call write~intINTTYPE4(4432bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1363] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(64bv32, ~s!offset) }, 4bv32); [L1364] ~tmp___6~0 := #t~nondet75; [L1364] havoc #t~nondet75; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1365] COND FALSE !(0bv32 == ~tmp___6~0) VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1605] FCALL call #t~mem128 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(84bv32, ~s!offset) }, 4bv32); [L1605] FCALL call #t~mem129 := read~intINTTYPE4({ base: #t~mem128!base, offset: ~bvadd32(848bv32, #t~mem128!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem128!base=268435457bv32, #t~mem128!offset=4294966500bv32, #t~mem129=4432bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1605] COND FALSE !(0bv32 == #t~mem129) [L1605] havoc #t~mem129; [L1605] havoc #t~mem128; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1634] ~skip~0 := 0bv32; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1131-L1635] COND FALSE !(false) VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1133] FCALL call #t~mem22 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1133] ~state~0 := #t~mem22; [L1133] havoc #t~mem22; [L1134] FCALL call #t~mem23 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem23=4432bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1134] COND FALSE !(12292bv32 == #t~mem23) [L1134] havoc #t~mem23; [L1137] FCALL call #t~mem24 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem24=4432bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1137] COND FALSE !(16384bv32 == #t~mem24) [L1137] havoc #t~mem24; [L1140] FCALL call #t~mem25 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem25=4432bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1140] COND FALSE !(4096bv32 == #t~mem25) [L1140] havoc #t~mem25; [L1143] FCALL call #t~mem26 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem26=4432bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1143] COND FALSE !(20480bv32 == #t~mem26) [L1143] havoc #t~mem26; [L1146] FCALL call #t~mem27 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem27=4432bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1146] COND FALSE !(4099bv32 == #t~mem27) [L1146] havoc #t~mem27; [L1149] FCALL call #t~mem28 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem28=4432bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1149] COND FALSE !(4368bv32 == #t~mem28) [L1149] havoc #t~mem28; [L1152] FCALL call #t~mem29 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem29=4432bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1152] COND FALSE !(4369bv32 == #t~mem29) [L1152] havoc #t~mem29; [L1155] FCALL call #t~mem30 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem30=4432bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1155] COND FALSE !(4384bv32 == #t~mem30) [L1155] havoc #t~mem30; [L1158] FCALL call #t~mem31 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem31=4432bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1158] COND FALSE !(4385bv32 == #t~mem31) [L1158] havoc #t~mem31; [L1161] FCALL call #t~mem32 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem32=4432bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1161] COND FALSE !(4400bv32 == #t~mem32) [L1161] havoc #t~mem32; [L1164] FCALL call #t~mem33 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem33=4432bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1164] COND FALSE !(4401bv32 == #t~mem33) [L1164] havoc #t~mem33; [L1167] FCALL call #t~mem34 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem34=4432bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1167] COND FALSE !(4416bv32 == #t~mem34) [L1167] havoc #t~mem34; [L1170] FCALL call #t~mem35 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem35=4432bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1170] COND FALSE !(4417bv32 == #t~mem35) [L1170] havoc #t~mem35; [L1173] FCALL call #t~mem36 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem36=4432bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1173] COND TRUE 4432bv32 == #t~mem36 [L1173] havoc #t~mem36; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1374] ~ret~0 := #t~nondet76; [L1374] havoc #t~nondet76; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1375] COND FALSE !(5bv32 == ~blastFlag~0) VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1380] COND FALSE !(~bvsle32(~ret~0, 0bv32)) [L1385] FCALL call write~intINTTYPE4(4448bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1386] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(64bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1605] FCALL call #t~mem128 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(84bv32, ~s!offset) }, 4bv32); [L1605] FCALL call #t~mem129 := read~intINTTYPE4({ base: #t~mem128!base, offset: ~bvadd32(848bv32, #t~mem128!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem128!base=268435457bv32, #t~mem128!offset=4294966500bv32, #t~mem129=4448bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1605] COND FALSE !(0bv32 == #t~mem129) [L1605] havoc #t~mem129; [L1605] havoc #t~mem128; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1634] ~skip~0 := 0bv32; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1131-L1635] COND FALSE !(false) VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1133] FCALL call #t~mem22 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1133] ~state~0 := #t~mem22; [L1133] havoc #t~mem22; [L1134] FCALL call #t~mem23 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem23=4448bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1134] COND FALSE !(12292bv32 == #t~mem23) [L1134] havoc #t~mem23; [L1137] FCALL call #t~mem24 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem24=4448bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1137] COND FALSE !(16384bv32 == #t~mem24) [L1137] havoc #t~mem24; [L1140] FCALL call #t~mem25 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem25=4448bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1140] COND FALSE !(4096bv32 == #t~mem25) [L1140] havoc #t~mem25; [L1143] FCALL call #t~mem26 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem26=4448bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1143] COND FALSE !(20480bv32 == #t~mem26) [L1143] havoc #t~mem26; [L1146] FCALL call #t~mem27 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem27=4448bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1146] COND FALSE !(4099bv32 == #t~mem27) [L1146] havoc #t~mem27; [L1149] FCALL call #t~mem28 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem28=4448bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1149] COND FALSE !(4368bv32 == #t~mem28) [L1149] havoc #t~mem28; [L1152] FCALL call #t~mem29 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem29=4448bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1152] COND FALSE !(4369bv32 == #t~mem29) [L1152] havoc #t~mem29; [L1155] FCALL call #t~mem30 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem30=4448bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1155] COND FALSE !(4384bv32 == #t~mem30) [L1155] havoc #t~mem30; [L1158] FCALL call #t~mem31 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem31=4448bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1158] COND FALSE !(4385bv32 == #t~mem31) [L1158] havoc #t~mem31; [L1161] FCALL call #t~mem32 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem32=4448bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1161] COND FALSE !(4400bv32 == #t~mem32) [L1161] havoc #t~mem32; [L1164] FCALL call #t~mem33 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem33=4448bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1164] COND FALSE !(4401bv32 == #t~mem33) [L1164] havoc #t~mem33; [L1167] FCALL call #t~mem34 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem34=4448bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1167] COND FALSE !(4416bv32 == #t~mem34) [L1167] havoc #t~mem34; [L1170] FCALL call #t~mem35 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem35=4448bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1170] COND FALSE !(4417bv32 == #t~mem35) [L1170] havoc #t~mem35; [L1173] FCALL call #t~mem36 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem36=4448bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1173] COND FALSE !(4432bv32 == #t~mem36) [L1173] havoc #t~mem36; [L1176] FCALL call #t~mem37 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem37=4448bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1176] COND FALSE !(4433bv32 == #t~mem37) [L1176] havoc #t~mem37; [L1179] FCALL call #t~mem38 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem38=4448bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1179] COND TRUE 4448bv32 == #t~mem38 [L1179] havoc #t~mem38; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1390] ~ret~0 := #t~nondet77; [L1390] havoc #t~nondet77; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=0bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1391] COND TRUE 4bv32 == ~blastFlag~0 VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=0bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1646] assert false; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=0bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] ----- [2018-11-23 07:50:56,392 WARN L1272 BoogieBacktranslator]: Unfinished Backtranslation: BitvecLiteral 0bv32 could not be translated for associated CType STRUCT~~ssl_method_st?version~INT?ssl_new~*((*~SSL~0 ) : INT)?ssl_clear~*((*~SSL~0 ) : VOID)?ssl_free~*((*~SSL~0 ) : VOID)?ssl_accept~*((*~SSL~0 ) : INT)?ssl_connect~*((*~SSL~0 ) : INT)?ssl_read~*((*~SSL~0 *VOID INT ) : INT)?ssl_peek~*((*~SSL~0 *VOID INT ) : INT)?ssl_write~*((*~SSL~0 *VOID INT ) : INT)?ssl_shutdown~*((*~SSL~0 ) : INT)?ssl_renegotiate~*((*~SSL~0 ) : INT)?ssl_renegotiate_check~*((*~SSL~0 ) : INT)?ssl_ctrl~*((*~SSL~0 INT LONG *CHAR ) : LONG)?ssl_ctx_ctrl~*((*~SSL_CTX~0 INT LONG *CHAR ) : LONG)?get_cipher_by_char~*((*UCHAR ) : *~SSL_CIPHER~0)?put_cipher_by_char~*((*~SSL_CIPHER~0 *UCHAR ) : INT)?ssl_pending~*((*~SSL~0 ) : INT)?num_ciphers~*(() : INT)?get_cipher~*((UINT ) : *~SSL_CIPHER~0)?get_ssl_method~*((INT ) : *ssl_method_st)?get_timeout~*(() : LONG)?ssl3_enc~*ssl3_enc_method?ssl_version~*(() : INT)?ssl_callback_ctrl~*((*~SSL~0 INT *(() : VOID) ) : LONG)?ssl_ctx_callback_ctrl~*((*~SSL_CTX~0 INT *(() : VOID) ) : LONG)# [2018-11-23 07:50:56,449 WARN L1272 BoogieBacktranslator]: Unfinished Backtranslation: BitvecLiteral 0bv32 could not be translated for associated CType STRUCT~~ssl_method_st?version~INT?ssl_new~*((*~SSL~0 ) : INT)?ssl_clear~*((*~SSL~0 ) : VOID)?ssl_free~*((*~SSL~0 ) : VOID)?ssl_accept~*((*~SSL~0 ) : INT)?ssl_connect~*((*~SSL~0 ) : INT)?ssl_read~*((*~SSL~0 *VOID INT ) : INT)?ssl_peek~*((*~SSL~0 *VOID INT ) : INT)?ssl_write~*((*~SSL~0 *VOID INT ) : INT)?ssl_shutdown~*((*~SSL~0 ) : INT)?ssl_renegotiate~*((*~SSL~0 ) : INT)?ssl_renegotiate_check~*((*~SSL~0 ) : INT)?ssl_ctrl~*((*~SSL~0 INT LONG *CHAR ) : LONG)?ssl_ctx_ctrl~*((*~SSL_CTX~0 INT LONG *CHAR ) : LONG)?get_cipher_by_char~*((*UCHAR ) : *~SSL_CIPHER~0)?put_cipher_by_char~*((*~SSL_CIPHER~0 *UCHAR ) : INT)?ssl_pending~*((*~SSL~0 ) : INT)?num_ciphers~*(() : INT)?get_cipher~*((UINT ) : *~SSL_CIPHER~0)?get_ssl_method~*((INT ) : *ssl_method_st)?get_timeout~*(() : LONG)?ssl3_enc~*ssl3_enc_method?ssl_version~*(() : INT)?ssl_callback_ctrl~*((*~SSL~0 INT *(() : VOID) ) : LONG)?ssl_ctx_callback_ctrl~*((*~SSL_CTX~0 INT *(() : VOID) ) : LONG)# ----- class de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator.CACSL2BoogieBacktranslator [?] CALL call ULTIMATE.init(); VAL [#NULL!base=0bv32, #NULL!offset=0bv32, old(#NULL!base)=0bv32, old(#NULL!offset)=0bv32, old(~#SSLv3_client_data~0!base)=0bv32, old(~#SSLv3_client_data~0!offset)=0bv32, old(~init~0)=0bv32, ~#SSLv3_client_data~0!base=0bv32, ~#SSLv3_client_data~0!offset=0bv32, ~init~0=0bv32] [?] #NULL := { base: 0bv32, offset: 0bv32 }; [?] #valid[0bv32] := 0bv1; [L1042] ~init~0 := 1bv32; [L1043] FCALL call ~#SSLv3_client_data~0 := #Ultimate.alloc(100bv32); [L1043] FCALL call write~init~intINTTYPE4(0bv32, { base: ~#SSLv3_client_data~0!base, offset: ~#SSLv3_client_data~0!offset }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(4bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(8bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(12bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(16bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(20bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(24bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(28bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(32bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(36bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(40bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(44bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(48bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(52bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(56bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(60bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(64bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(68bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(72bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(76bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(80bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(84bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(88bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(92bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); [L1043] FCALL call write~init~$Pointer$({ base: 0bv32, offset: 0bv32 }, { base: ~#SSLv3_client_data~0!base, offset: ~bvadd32(96bv32, ~#SSLv3_client_data~0!offset) }, 4bv32); VAL [#NULL!base=0bv32, #NULL!offset=0bv32, old(#NULL!base)=0bv32, old(#NULL!offset)=0bv32, old(~#SSLv3_client_data~0!base)=0bv32, old(~#SSLv3_client_data~0!offset)=0bv32, old(~init~0)=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~init~0=1bv32] [?] RET call ULTIMATE.init(); VAL [#NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~init~0=1bv32] [?] CALL call #t~ret139 := main(); VAL [#NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~init~0=1bv32] [L1065] FCALL call #t~malloc3 := #Ultimate.alloc(248bv32); [L1065] ~s~0 := #t~malloc3; [L1069] FCALL call #t~malloc4 := #Ultimate.alloc(899bv32); [L1069] FCALL call write~$Pointer$(#t~malloc4, { base: ~s~0!base, offset: ~bvadd32(84bv32, ~s~0!offset) }, 4bv32); [L1070] FCALL call #t~malloc5 := #Ultimate.alloc(232bv32); [L1070] FCALL call write~$Pointer$(#t~malloc5, { base: ~s~0!base, offset: ~bvadd32(204bv32, ~s~0!offset) }, 4bv32); [L1071] FCALL call #t~malloc6 := #Ultimate.alloc(200bv32); [L1071] FCALL call write~$Pointer$(#t~malloc6, { base: ~s~0!base, offset: ~bvadd32(176bv32, ~s~0!offset) }, 4bv32); [L1072] FCALL call write~intINTTYPE4(12292bv32, { base: ~s~0!base, offset: ~bvadd32(52bv32, ~s~0!offset) }, 4bv32); [L1073] FCALL call write~intINTTYPE4(#t~nondet7, { base: ~s~0!base, offset: ~s~0!offset }, 4bv32); [L1073] havoc #t~nondet7; VAL [#NULL!base=0bv32, #NULL!offset=0bv32, #t~malloc3!base=268435457bv32, #t~malloc3!offset=0bv32, #t~malloc4!base=2147483650bv32, #t~malloc4!offset=0bv32, #t~malloc5!base=3bv32, #t~malloc5!offset=0bv32, #t~malloc6!base=2bv32, #t~malloc6!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~init~0=1bv32, ~s~0!base=268435457bv32, ~s~0!offset=0bv32] [L1074] CALL call #t~ret8 := ssl3_connect(~s~0); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~init~0=1bv32] [L1079-L1648] ~s := #in~s; [L1080] ~buf~0 := #t~nondet9; [L1080] havoc #t~nondet9; [L1081] havoc ~tmp~2; [L1082] havoc ~l~0; [L1083] havoc ~num1~0; [L1084] havoc ~cb~0; [L1085] havoc ~ret~0; [L1086] havoc ~new_state~0; [L1087] havoc ~state~0; [L1088] havoc ~skip~0; [L1089] ~tmp___0~1 := #t~nondet10; [L1089] havoc #t~nondet10; [L1090] ~tmp___1~0 := #t~nondet11; [L1090] havoc #t~nondet11; [L1091] ~tmp___2~0 := #t~nondet12; [L1091] havoc #t~nondet12; [L1092] havoc ~tmp___3~0; [L1093] havoc ~tmp___4~0; [L1094] havoc ~tmp___5~0; [L1095] havoc ~tmp___6~0; [L1096] havoc ~tmp___7~0; [L1097] havoc ~tmp___8~0; [L1098] havoc ~tmp___9~0; [L1100] havoc ~blastFlag~0; [L1103] ~blastFlag~0 := 0bv32; [L1104] FCALL call write~intINTTYPE4(#t~nondet13, { base: ~s!base, offset: ~bvadd32(92bv32, ~s!offset) }, 4bv32); [L1104] havoc #t~nondet13; [L1105] FCALL call write~intINTTYPE4(12292bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1106] ~tmp~2 := #t~nondet14; [L1106] havoc #t~nondet14; [L1107] ~cb~0 := { base: 0bv32, offset: 0bv32 }; [L1108] ~ret~0 := 4294967295bv32; [L1109] ~skip~0 := 0bv32; [L1110] FCALL call write~intINTTYPE4(0bv32, ~tmp___0~1, 4bv32); [L1111] FCALL call #t~mem15 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(192bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem15!base=33028bv32, #t~mem15!offset=2147516596bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=0bv32, ~cb~0!offset=0bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp~2=0bv32] [L1111] COND TRUE 0bv32 != ~bvadd32(#t~mem15!base, #t~mem15!offset) [L1111] havoc #t~mem15; [L1112] FCALL call #t~mem16 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(192bv32, ~s!offset) }, 4bv32); [L1112] ~cb~0 := #t~mem16; [L1112] havoc #t~mem16; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp~2=0bv32] [L1120] FCALL call #t~mem21 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(28bv32, ~s!offset) }, 4bv32); [L1120] FCALL call write~intINTTYPE4(~bvadd32(1bv32, #t~mem21), { base: ~s!base, offset: ~bvadd32(28bv32, ~s!offset) }, 4bv32); [L1120] havoc #t~mem21; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp~2=0bv32] [L1121-L1129] COND FALSE !(0bv32 != ~bvand32(12288bv32, ~tmp___1~0)) VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp~2=0bv32] [L1131-L1635] COND FALSE !(false) VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp~2=0bv32] [L1133] FCALL call #t~mem22 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1133] ~state~0 := #t~mem22; [L1133] havoc #t~mem22; [L1134] FCALL call #t~mem23 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem23=12292bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp~2=0bv32] [L1134] COND TRUE 12292bv32 == #t~mem23 [L1134] havoc #t~mem23; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp~2=0bv32] [L1237] FCALL call write~intINTTYPE4(1bv32, { base: ~s!base, offset: ~bvadd32(40bv32, ~s!offset) }, 4bv32); [L1238] FCALL call write~intINTTYPE4(4096bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1239] FCALL call #t~mem56 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(204bv32, ~s!offset) }, 4bv32); [L1239] FCALL call #t~mem57 := read~intINTTYPE4({ base: #t~mem56!base, offset: ~bvadd32(64bv32, #t~mem56!offset) }, 4bv32); [L1239] FCALL call write~intINTTYPE4(~bvadd32(1bv32, #t~mem57), { base: #t~mem56!base, offset: ~bvadd32(64bv32, #t~mem56!offset) }, 4bv32); [L1239] havoc #t~mem57; [L1239] havoc #t~mem56; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp~2=0bv32] [L1244] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(36bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp~2=0bv32] [L1245] COND TRUE 0bv32 != ~bvadd32(~cb~0!base, ~cb~0!offset) VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp~2=0bv32] [L1250] FCALL call #t~mem58 := read~intINTTYPE4({ base: ~s!base, offset: ~s!offset }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem58=768bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp~2=0bv32] [L1250] COND FALSE !(768bv32 != ~bvand32(65280bv32, #t~mem58)) [L1250] havoc #t~mem58; [L1256] FCALL call write~intINTTYPE4(4096bv32, { base: ~s!base, offset: ~bvadd32(4bv32, ~s!offset) }, 4bv32); [L1257] FCALL call #t~mem59 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(60bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem59!base=0bv32, #t~mem59!offset=1bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp~2=0bv32] [L1257] COND FALSE !(0bv32 == ~bvadd32(#t~mem59!base, #t~mem59!offset)) [L1257] havoc #t~mem59; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp~2=0bv32] [L1269] ~tmp___4~0 := #t~nondet61; [L1269] havoc #t~nondet61; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp~2=0bv32] [L1270] COND FALSE !(0bv32 == ~tmp___4~0) [L1276] ~tmp___5~0 := #t~nondet62; [L1276] havoc #t~nondet62; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1277] COND FALSE !(0bv32 == ~tmp___5~0) [L1283] FCALL call write~intINTTYPE4(4368bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1284] FCALL call #t~mem63 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(204bv32, ~s!offset) }, 4bv32); [L1284] FCALL call #t~mem64 := read~intINTTYPE4({ base: #t~mem63!base, offset: ~bvadd32(60bv32, #t~mem63!offset) }, 4bv32); [L1284] FCALL call write~intINTTYPE4(~bvadd32(1bv32, #t~mem64), { base: #t~mem63!base, offset: ~bvadd32(60bv32, #t~mem63!offset) }, 4bv32); [L1284] havoc #t~mem64; [L1284] havoc #t~mem63; [L1285] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(64bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1605] FCALL call #t~mem128 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(84bv32, ~s!offset) }, 4bv32); [L1605] FCALL call #t~mem129 := read~intINTTYPE4({ base: #t~mem128!base, offset: ~bvadd32(848bv32, #t~mem128!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem128!base=268435457bv32, #t~mem128!offset=4294966500bv32, #t~mem129=4368bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1605] COND FALSE !(0bv32 == #t~mem129) [L1605] havoc #t~mem129; [L1605] havoc #t~mem128; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1634] ~skip~0 := 0bv32; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1131-L1635] COND FALSE !(false) VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=12292bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1133] FCALL call #t~mem22 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1133] ~state~0 := #t~mem22; [L1133] havoc #t~mem22; [L1134] FCALL call #t~mem23 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem23=4368bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1134] COND FALSE !(12292bv32 == #t~mem23) [L1134] havoc #t~mem23; [L1137] FCALL call #t~mem24 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem24=4368bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1137] COND FALSE !(16384bv32 == #t~mem24) [L1137] havoc #t~mem24; [L1140] FCALL call #t~mem25 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem25=4368bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1140] COND FALSE !(4096bv32 == #t~mem25) [L1140] havoc #t~mem25; [L1143] FCALL call #t~mem26 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem26=4368bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1143] COND FALSE !(20480bv32 == #t~mem26) [L1143] havoc #t~mem26; [L1146] FCALL call #t~mem27 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem27=4368bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1146] COND FALSE !(4099bv32 == #t~mem27) [L1146] havoc #t~mem27; [L1149] FCALL call #t~mem28 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem28=4368bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1149] COND TRUE 4368bv32 == #t~mem28 [L1149] havoc #t~mem28; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=4294967295bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1289] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(48bv32, ~s!offset) }, 4bv32); [L1290] ~ret~0 := #t~nondet65; [L1290] havoc #t~nondet65; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=0bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1291] COND TRUE 0bv32 == ~blastFlag~0 [L1292] ~blastFlag~0 := 1bv32; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1296] COND FALSE !(~bvsle32(~ret~0, 0bv32)) [L1301] FCALL call write~intINTTYPE4(4384bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1302] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(64bv32, ~s!offset) }, 4bv32); [L1303] FCALL call #t~mem66 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(20bv32, ~s!offset) }, 4bv32); [L1303] FCALL call #t~mem67 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(16bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem66!base=0bv32, #t~mem66!offset=1bv32, #t~mem67!base=0bv32, #t~mem67!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1303] COND TRUE ~bvadd32(#t~mem66!base, #t~mem66!offset) != ~bvadd32(#t~mem67!base, #t~mem67!offset) [L1303] havoc #t~mem66; [L1303] havoc #t~mem67; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1605] FCALL call #t~mem128 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(84bv32, ~s!offset) }, 4bv32); [L1605] FCALL call #t~mem129 := read~intINTTYPE4({ base: #t~mem128!base, offset: ~bvadd32(848bv32, #t~mem128!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem128!base=268435457bv32, #t~mem128!offset=4294966500bv32, #t~mem129=4384bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1605] COND FALSE !(0bv32 == #t~mem129) [L1605] havoc #t~mem129; [L1605] havoc #t~mem128; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1634] ~skip~0 := 0bv32; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1131-L1635] COND FALSE !(false) VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4368bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1133] FCALL call #t~mem22 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1133] ~state~0 := #t~mem22; [L1133] havoc #t~mem22; [L1134] FCALL call #t~mem23 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem23=4384bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1134] COND FALSE !(12292bv32 == #t~mem23) [L1134] havoc #t~mem23; [L1137] FCALL call #t~mem24 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem24=4384bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1137] COND FALSE !(16384bv32 == #t~mem24) [L1137] havoc #t~mem24; [L1140] FCALL call #t~mem25 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem25=4384bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1140] COND FALSE !(4096bv32 == #t~mem25) [L1140] havoc #t~mem25; [L1143] FCALL call #t~mem26 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem26=4384bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1143] COND FALSE !(20480bv32 == #t~mem26) [L1143] havoc #t~mem26; [L1146] FCALL call #t~mem27 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem27=4384bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1146] COND FALSE !(4099bv32 == #t~mem27) [L1146] havoc #t~mem27; [L1149] FCALL call #t~mem28 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem28=4384bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1149] COND FALSE !(4368bv32 == #t~mem28) [L1149] havoc #t~mem28; [L1152] FCALL call #t~mem29 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem29=4384bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1152] COND FALSE !(4369bv32 == #t~mem29) [L1152] havoc #t~mem29; [L1155] FCALL call #t~mem30 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem30=4384bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1155] COND TRUE 4384bv32 == #t~mem30 [L1155] havoc #t~mem30; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1311] ~ret~0 := #t~nondet68; [L1311] havoc #t~nondet68; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=1bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1312] COND TRUE 1bv32 == ~blastFlag~0 [L1313] ~blastFlag~0 := 2bv32; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1317] COND FALSE !(~bvsle32(~ret~0, 0bv32)) [L1322] FCALL call #t~mem69 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(92bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem69=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1322-L1326] COND FALSE !(0bv32 != #t~mem69) [L1322] havoc #t~mem69; [L1325] FCALL call write~intINTTYPE4(4400bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1327] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(64bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1605] FCALL call #t~mem128 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(84bv32, ~s!offset) }, 4bv32); [L1605] FCALL call #t~mem129 := read~intINTTYPE4({ base: #t~mem128!base, offset: ~bvadd32(848bv32, #t~mem128!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem128!base=268435457bv32, #t~mem128!offset=4294966500bv32, #t~mem129=4400bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1605] COND FALSE !(0bv32 == #t~mem129) [L1605] havoc #t~mem129; [L1605] havoc #t~mem128; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1634] ~skip~0 := 0bv32; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1131-L1635] COND FALSE !(false) VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4384bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1133] FCALL call #t~mem22 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1133] ~state~0 := #t~mem22; [L1133] havoc #t~mem22; [L1134] FCALL call #t~mem23 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem23=4400bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1134] COND FALSE !(12292bv32 == #t~mem23) [L1134] havoc #t~mem23; [L1137] FCALL call #t~mem24 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem24=4400bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1137] COND FALSE !(16384bv32 == #t~mem24) [L1137] havoc #t~mem24; [L1140] FCALL call #t~mem25 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem25=4400bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1140] COND FALSE !(4096bv32 == #t~mem25) [L1140] havoc #t~mem25; [L1143] FCALL call #t~mem26 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem26=4400bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1143] COND FALSE !(20480bv32 == #t~mem26) [L1143] havoc #t~mem26; [L1146] FCALL call #t~mem27 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem27=4400bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1146] COND FALSE !(4099bv32 == #t~mem27) [L1146] havoc #t~mem27; [L1149] FCALL call #t~mem28 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem28=4400bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1149] COND FALSE !(4368bv32 == #t~mem28) [L1149] havoc #t~mem28; [L1152] FCALL call #t~mem29 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem29=4400bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1152] COND FALSE !(4369bv32 == #t~mem29) [L1152] havoc #t~mem29; [L1155] FCALL call #t~mem30 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem30=4400bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1155] COND FALSE !(4384bv32 == #t~mem30) [L1155] havoc #t~mem30; [L1158] FCALL call #t~mem31 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem31=4400bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1158] COND FALSE !(4385bv32 == #t~mem31) [L1158] havoc #t~mem31; [L1161] FCALL call #t~mem32 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem32=4400bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1161] COND TRUE 4400bv32 == #t~mem32 [L1161] havoc #t~mem32; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1331] FCALL call #t~mem70 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(84bv32, ~s!offset) }, 4bv32); [L1331] FCALL call #t~mem71 := read~$Pointer$({ base: #t~mem70!base, offset: ~bvadd32(836bv32, #t~mem70!offset) }, 4bv32); [L1331] FCALL call #t~mem72 := read~intINTTYPE4({ base: #t~mem71!base, offset: ~bvadd32(12bv32, #t~mem71!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem70!base=268435457bv32, #t~mem70!offset=4294966500bv32, #t~mem71!base=268435457bv32, #t~mem71!offset=52bv32, #t~mem72=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1331-L1345] COND FALSE !(0bv32 != ~bvand32(256bv32, #t~mem72)) [L1331] havoc #t~mem71; [L1331] havoc #t~mem70; [L1331] havoc #t~mem72; [L1334] ~ret~0 := #t~nondet73; [L1334] havoc #t~nondet73; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=2bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1335] COND TRUE 2bv32 == ~blastFlag~0 [L1336] ~blastFlag~0 := 3bv32; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1340] COND FALSE !(~bvsle32(~ret~0, 0bv32)) VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1346] FCALL call write~intINTTYPE4(4416bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1347] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(64bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1605] FCALL call #t~mem128 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(84bv32, ~s!offset) }, 4bv32); [L1605] FCALL call #t~mem129 := read~intINTTYPE4({ base: #t~mem128!base, offset: ~bvadd32(848bv32, #t~mem128!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem128!base=268435457bv32, #t~mem128!offset=4294966500bv32, #t~mem129=4416bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1605] COND FALSE !(0bv32 == #t~mem129) [L1605] havoc #t~mem129; [L1605] havoc #t~mem128; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1634] ~skip~0 := 0bv32; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1131-L1635] COND FALSE !(false) VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4400bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1133] FCALL call #t~mem22 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1133] ~state~0 := #t~mem22; [L1133] havoc #t~mem22; [L1134] FCALL call #t~mem23 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem23=4416bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1134] COND FALSE !(12292bv32 == #t~mem23) [L1134] havoc #t~mem23; [L1137] FCALL call #t~mem24 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem24=4416bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1137] COND FALSE !(16384bv32 == #t~mem24) [L1137] havoc #t~mem24; [L1140] FCALL call #t~mem25 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem25=4416bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1140] COND FALSE !(4096bv32 == #t~mem25) [L1140] havoc #t~mem25; [L1143] FCALL call #t~mem26 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem26=4416bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1143] COND FALSE !(20480bv32 == #t~mem26) [L1143] havoc #t~mem26; [L1146] FCALL call #t~mem27 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem27=4416bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1146] COND FALSE !(4099bv32 == #t~mem27) [L1146] havoc #t~mem27; [L1149] FCALL call #t~mem28 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem28=4416bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1149] COND FALSE !(4368bv32 == #t~mem28) [L1149] havoc #t~mem28; [L1152] FCALL call #t~mem29 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem29=4416bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1152] COND FALSE !(4369bv32 == #t~mem29) [L1152] havoc #t~mem29; [L1155] FCALL call #t~mem30 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem30=4416bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1155] COND FALSE !(4384bv32 == #t~mem30) [L1155] havoc #t~mem30; [L1158] FCALL call #t~mem31 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem31=4416bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1158] COND FALSE !(4385bv32 == #t~mem31) [L1158] havoc #t~mem31; [L1161] FCALL call #t~mem32 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem32=4416bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1161] COND FALSE !(4400bv32 == #t~mem32) [L1161] havoc #t~mem32; [L1164] FCALL call #t~mem33 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem33=4416bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1164] COND FALSE !(4401bv32 == #t~mem33) [L1164] havoc #t~mem33; [L1167] FCALL call #t~mem34 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem34=4416bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1167] COND TRUE 4416bv32 == #t~mem34 [L1167] havoc #t~mem34; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1351] ~ret~0 := #t~nondet74; [L1351] havoc #t~nondet74; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=3bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1352] COND TRUE 3bv32 == ~blastFlag~0 [L1353] ~blastFlag~0 := 4bv32; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp~2=0bv32] [L1357] COND FALSE !(~bvsle32(~ret~0, 0bv32)) [L1362] FCALL call write~intINTTYPE4(4432bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1363] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(64bv32, ~s!offset) }, 4bv32); [L1364] ~tmp___6~0 := #t~nondet75; [L1364] havoc #t~nondet75; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1365] COND FALSE !(0bv32 == ~tmp___6~0) VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1605] FCALL call #t~mem128 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(84bv32, ~s!offset) }, 4bv32); [L1605] FCALL call #t~mem129 := read~intINTTYPE4({ base: #t~mem128!base, offset: ~bvadd32(848bv32, #t~mem128!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem128!base=268435457bv32, #t~mem128!offset=4294966500bv32, #t~mem129=4432bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1605] COND FALSE !(0bv32 == #t~mem129) [L1605] havoc #t~mem129; [L1605] havoc #t~mem128; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1634] ~skip~0 := 0bv32; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1131-L1635] COND FALSE !(false) VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4416bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1133] FCALL call #t~mem22 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1133] ~state~0 := #t~mem22; [L1133] havoc #t~mem22; [L1134] FCALL call #t~mem23 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem23=4432bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1134] COND FALSE !(12292bv32 == #t~mem23) [L1134] havoc #t~mem23; [L1137] FCALL call #t~mem24 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem24=4432bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1137] COND FALSE !(16384bv32 == #t~mem24) [L1137] havoc #t~mem24; [L1140] FCALL call #t~mem25 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem25=4432bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1140] COND FALSE !(4096bv32 == #t~mem25) [L1140] havoc #t~mem25; [L1143] FCALL call #t~mem26 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem26=4432bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1143] COND FALSE !(20480bv32 == #t~mem26) [L1143] havoc #t~mem26; [L1146] FCALL call #t~mem27 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem27=4432bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1146] COND FALSE !(4099bv32 == #t~mem27) [L1146] havoc #t~mem27; [L1149] FCALL call #t~mem28 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem28=4432bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1149] COND FALSE !(4368bv32 == #t~mem28) [L1149] havoc #t~mem28; [L1152] FCALL call #t~mem29 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem29=4432bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1152] COND FALSE !(4369bv32 == #t~mem29) [L1152] havoc #t~mem29; [L1155] FCALL call #t~mem30 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem30=4432bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1155] COND FALSE !(4384bv32 == #t~mem30) [L1155] havoc #t~mem30; [L1158] FCALL call #t~mem31 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem31=4432bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1158] COND FALSE !(4385bv32 == #t~mem31) [L1158] havoc #t~mem31; [L1161] FCALL call #t~mem32 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem32=4432bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1161] COND FALSE !(4400bv32 == #t~mem32) [L1161] havoc #t~mem32; [L1164] FCALL call #t~mem33 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem33=4432bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1164] COND FALSE !(4401bv32 == #t~mem33) [L1164] havoc #t~mem33; [L1167] FCALL call #t~mem34 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem34=4432bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1167] COND FALSE !(4416bv32 == #t~mem34) [L1167] havoc #t~mem34; [L1170] FCALL call #t~mem35 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem35=4432bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1170] COND FALSE !(4417bv32 == #t~mem35) [L1170] havoc #t~mem35; [L1173] FCALL call #t~mem36 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem36=4432bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1173] COND TRUE 4432bv32 == #t~mem36 [L1173] havoc #t~mem36; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1374] ~ret~0 := #t~nondet76; [L1374] havoc #t~nondet76; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1375] COND FALSE !(5bv32 == ~blastFlag~0) VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1380] COND FALSE !(~bvsle32(~ret~0, 0bv32)) [L1385] FCALL call write~intINTTYPE4(4448bv32, { base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1386] FCALL call write~intINTTYPE4(0bv32, { base: ~s!base, offset: ~bvadd32(64bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1605] FCALL call #t~mem128 := read~$Pointer$({ base: ~s!base, offset: ~bvadd32(84bv32, ~s!offset) }, 4bv32); [L1605] FCALL call #t~mem129 := read~intINTTYPE4({ base: #t~mem128!base, offset: ~bvadd32(848bv32, #t~mem128!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem128!base=268435457bv32, #t~mem128!offset=4294966500bv32, #t~mem129=4448bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1605] COND FALSE !(0bv32 == #t~mem129) [L1605] havoc #t~mem129; [L1605] havoc #t~mem128; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1634] ~skip~0 := 0bv32; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1131-L1635] COND FALSE !(false) VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4432bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1133] FCALL call #t~mem22 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); [L1133] ~state~0 := #t~mem22; [L1133] havoc #t~mem22; [L1134] FCALL call #t~mem23 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem23=4448bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1134] COND FALSE !(12292bv32 == #t~mem23) [L1134] havoc #t~mem23; [L1137] FCALL call #t~mem24 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem24=4448bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1137] COND FALSE !(16384bv32 == #t~mem24) [L1137] havoc #t~mem24; [L1140] FCALL call #t~mem25 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem25=4448bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1140] COND FALSE !(4096bv32 == #t~mem25) [L1140] havoc #t~mem25; [L1143] FCALL call #t~mem26 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem26=4448bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1143] COND FALSE !(20480bv32 == #t~mem26) [L1143] havoc #t~mem26; [L1146] FCALL call #t~mem27 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem27=4448bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1146] COND FALSE !(4099bv32 == #t~mem27) [L1146] havoc #t~mem27; [L1149] FCALL call #t~mem28 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem28=4448bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1149] COND FALSE !(4368bv32 == #t~mem28) [L1149] havoc #t~mem28; [L1152] FCALL call #t~mem29 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem29=4448bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1152] COND FALSE !(4369bv32 == #t~mem29) [L1152] havoc #t~mem29; [L1155] FCALL call #t~mem30 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem30=4448bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1155] COND FALSE !(4384bv32 == #t~mem30) [L1155] havoc #t~mem30; [L1158] FCALL call #t~mem31 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem31=4448bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1158] COND FALSE !(4385bv32 == #t~mem31) [L1158] havoc #t~mem31; [L1161] FCALL call #t~mem32 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem32=4448bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1161] COND FALSE !(4400bv32 == #t~mem32) [L1161] havoc #t~mem32; [L1164] FCALL call #t~mem33 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem33=4448bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1164] COND FALSE !(4401bv32 == #t~mem33) [L1164] havoc #t~mem33; [L1167] FCALL call #t~mem34 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem34=4448bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1167] COND FALSE !(4416bv32 == #t~mem34) [L1167] havoc #t~mem34; [L1170] FCALL call #t~mem35 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem35=4448bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1170] COND FALSE !(4417bv32 == #t~mem35) [L1170] havoc #t~mem35; [L1173] FCALL call #t~mem36 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem36=4448bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1173] COND FALSE !(4432bv32 == #t~mem36) [L1173] havoc #t~mem36; [L1176] FCALL call #t~mem37 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem37=4448bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1176] COND FALSE !(4433bv32 == #t~mem37) [L1176] havoc #t~mem37; [L1179] FCALL call #t~mem38 := read~intINTTYPE4({ base: ~s!base, offset: ~bvadd32(52bv32, ~s!offset) }, 4bv32); VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~mem38=4448bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1179] COND TRUE 4448bv32 == #t~mem38 [L1179] havoc #t~mem38; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=1073741824bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1390] ~ret~0 := #t~nondet77; [L1390] havoc #t~nondet77; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=0bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1391] COND TRUE 4bv32 == ~blastFlag~0 VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=0bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1646] assert false; VAL [#in~s!base=268435457bv32, #in~s!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~#SSLv3_client_data~0!base=268435458bv32, ~#SSLv3_client_data~0!offset=0bv32, ~blastFlag~0=4bv32, ~buf~0!base=0bv32, ~buf~0!offset=0bv32, ~cb~0!base=33028bv32, ~cb~0!offset=2147516596bv32, ~init~0=1bv32, ~ret~0=0bv32, ~s!base=268435457bv32, ~s!offset=0bv32, ~skip~0=0bv32, ~state~0=4448bv32, ~tmp___0~1!base=268435457bv32, ~tmp___0~1!offset=204bv32, ~tmp___1~0=0bv32, ~tmp___2~0=0bv32, ~tmp___4~0=1bv32, ~tmp___5~0=1bv32, ~tmp___6~0=1bv32, ~tmp~2=0bv32] [L1042] static int init = 1; [L1043] static SSL_METHOD SSLv3_client_data ; VAL [\old(init)=0, \old(SSLv3_client_data)=null, \old(SSLv3_client_data)=null, init=1, SSLv3_client_data={268435458:0}] [L1065] SSL *s = (SSL*)malloc(sizeof(SSL)) ; [L1069] s->s3 = malloc(sizeof(struct ssl3_state_st)) [L1070] s->ctx = malloc(sizeof(SSL_CTX)) [L1071] s->session = malloc(sizeof(SSL_SESSION)) [L1072] s->state = 12292 [L1073] s->version = __VERIFIER_nondet_int() [L1074] CALL ssl3_connect(s) VAL [init=1, s={268435457:0}, SSLv3_client_data={268435458:0}] [L1080] BUF_MEM *buf = __VERIFIER_nondet_pointer() ; [L1081] unsigned long tmp ; [L1082] unsigned long l ; [L1083] long num1 ; [L1084] void (*cb)() ; [L1085] int ret ; [L1086] int new_state ; [L1087] int state ; [L1088] int skip ; [L1089] int *tmp___0 = __VERIFIER_nondet_pointer() ; [L1090] int tmp___1 = __VERIFIER_nondet_int() ; [L1091] int tmp___2 = __VERIFIER_nondet_int() ; [L1092] int tmp___3 ; [L1093] int tmp___4 ; [L1094] int tmp___5 ; [L1095] int tmp___6 ; [L1096] int tmp___7 ; [L1097] int tmp___8 ; [L1098] long tmp___9 ; [L1100] int blastFlag ; [L1103] blastFlag = 0 [L1104] s->hit=__VERIFIER_nondet_int () [L1105] s->state = 12292 [L1106] tmp = __VERIFIER_nondet_int() [L1107] cb = (void (*)())((void *)0) [L1108] ret = -1 [L1109] skip = 0 [L1110] *tmp___0 = 0 [L1111] EXPR s->info_callback VAL [={0:0}, blastFlag=0, buf={0:0}, init=1, ret=4294967295, s={268435457:0}, s={268435457:0}, s->info_callback={33028:-2147450700}, skip=0, SSLv3_client_data={268435458:0}, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0] [L1111] COND TRUE (unsigned long )s->info_callback != (unsigned long )((void *)0) [L1112] EXPR s->info_callback [L1112] cb = s->info_callback [L1120] EXPR s->in_handshake [L1120] s->in_handshake += 1 [L1121] COND FALSE !(tmp___1 & 12288) VAL [={33028:-2147450700}, blastFlag=0, buf={0:0}, init=1, ret=4294967295, s={268435457:0}, s={268435457:0}, skip=0, SSLv3_client_data={268435458:0}, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0] [L1131] COND TRUE 1 VAL [={33028:-2147450700}, blastFlag=0, buf={0:0}, init=1, ret=4294967295, s={268435457:0}, s={268435457:0}, skip=0, SSLv3_client_data={268435458:0}, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0] [L1133] EXPR s->state [L1133] state = s->state [L1134] EXPR s->state VAL [={33028:-2147450700}, blastFlag=0, buf={0:0}, init=1, ret=4294967295, s={268435457:0}, s={268435457:0}, s->state=12292, skip=0, SSLv3_client_data={268435458:0}, state=12292, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0] [L1134] COND TRUE s->state == 12292 [L1237] s->new_session = 1 [L1238] s->state = 4096 [L1239] EXPR s->ctx [L1239] EXPR (s->ctx)->stats.sess_connect_renegotiate [L1239] (s->ctx)->stats.sess_connect_renegotiate += 1 [L1244] s->server = 0 VAL [={33028:-2147450700}, blastFlag=0, buf={0:0}, init=1, ret=4294967295, s={268435457:0}, s={268435457:0}, skip=0, SSLv3_client_data={268435458:0}, state=12292, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0] [L1245] COND TRUE (unsigned long )cb != (unsigned long )((void *)0) VAL [={33028:-2147450700}, blastFlag=0, buf={0:0}, init=1, ret=4294967295, s={268435457:0}, s={268435457:0}, skip=0, SSLv3_client_data={268435458:0}, state=12292, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0] [L1250] EXPR s->version VAL [={33028:-2147450700}, blastFlag=0, buf={0:0}, init=1, ret=4294967295, s={268435457:0}, s={268435457:0}, s->version=768, skip=0, SSLv3_client_data={268435458:0}, state=12292, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0] [L1250] COND FALSE !((s->version & 65280) != 768) [L1256] s->type = 4096 [L1257] EXPR s->init_buf VAL [={33028:-2147450700}, blastFlag=0, buf={0:0}, init=1, ret=4294967295, s={268435457:0}, s={268435457:0}, s->init_buf={0:1}, skip=0, SSLv3_client_data={268435458:0}, state=12292, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0] [L1257] COND FALSE !((unsigned long )s->init_buf == (unsigned long )((void *)0)) [L1269] tmp___4 = __VERIFIER_nondet_int() [L1270] COND FALSE !(! tmp___4) [L1276] tmp___5 = __VERIFIER_nondet_int() [L1277] COND FALSE !(! tmp___5) [L1283] s->state = 4368 [L1284] EXPR s->ctx [L1284] EXPR (s->ctx)->stats.sess_connect [L1284] (s->ctx)->stats.sess_connect += 1 [L1285] s->init_num = 0 VAL [={33028:-2147450700}, blastFlag=0, buf={0:0}, init=1, ret=4294967295, s={268435457:0}, s={268435457:0}, skip=0, SSLv3_client_data={268435458:0}, state=12292, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1605] EXPR s->s3 [L1605] EXPR (s->s3)->tmp.reuse_message VAL [={33028:-2147450700}, (s->s3)->tmp.reuse_message=4368, blastFlag=0, buf={0:0}, init=1, ret=4294967295, s={268435457:0}, s={268435457:0}, s->s3={268435457:-796}, skip=0, SSLv3_client_data={268435458:0}, state=12292, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1605] COND FALSE !(! (s->s3)->tmp.reuse_message) [L1634] skip = 0 VAL [={33028:-2147450700}, blastFlag=0, buf={0:0}, init=1, ret=4294967295, s={268435457:0}, s={268435457:0}, skip=0, SSLv3_client_data={268435458:0}, state=12292, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1131] COND TRUE 1 VAL [={33028:-2147450700}, blastFlag=0, buf={0:0}, init=1, ret=4294967295, s={268435457:0}, s={268435457:0}, skip=0, SSLv3_client_data={268435458:0}, state=12292, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1133] EXPR s->state [L1133] state = s->state [L1134] EXPR s->state VAL [={33028:-2147450700}, blastFlag=0, buf={0:0}, init=1, ret=4294967295, s={268435457:0}, s={268435457:0}, s->state=4368, skip=0, SSLv3_client_data={268435458:0}, state=4368, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1134] COND FALSE !(s->state == 12292) [L1137] EXPR s->state VAL [={33028:-2147450700}, blastFlag=0, buf={0:0}, init=1, ret=4294967295, s={268435457:0}, s={268435457:0}, s->state=4368, skip=0, SSLv3_client_data={268435458:0}, state=4368, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1137] COND FALSE !(s->state == 16384) [L1140] EXPR s->state VAL [={33028:-2147450700}, blastFlag=0, buf={0:0}, init=1, ret=4294967295, s={268435457:0}, s={268435457:0}, s->state=4368, skip=0, SSLv3_client_data={268435458:0}, state=4368, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1140] COND FALSE !(s->state == 4096) [L1143] EXPR s->state VAL [={33028:-2147450700}, blastFlag=0, buf={0:0}, init=1, ret=4294967295, s={268435457:0}, s={268435457:0}, s->state=4368, skip=0, SSLv3_client_data={268435458:0}, state=4368, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1143] COND FALSE !(s->state == 20480) [L1146] EXPR s->state VAL [={33028:-2147450700}, blastFlag=0, buf={0:0}, init=1, ret=4294967295, s={268435457:0}, s={268435457:0}, s->state=4368, skip=0, SSLv3_client_data={268435458:0}, state=4368, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1146] COND FALSE !(s->state == 4099) [L1149] EXPR s->state VAL [={33028:-2147450700}, blastFlag=0, buf={0:0}, init=1, ret=4294967295, s={268435457:0}, s={268435457:0}, s->state=4368, skip=0, SSLv3_client_data={268435458:0}, state=4368, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1149] COND TRUE s->state == 4368 [L1289] s->shutdown = 0 [L1290] ret = __VERIFIER_nondet_int() [L1291] COND TRUE blastFlag == 0 [L1292] blastFlag = 1 VAL [={33028:-2147450700}, blastFlag=1, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, skip=0, SSLv3_client_data={268435458:0}, state=4368, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1296] COND FALSE !(ret <= 0) [L1301] s->state = 4384 [L1302] s->init_num = 0 [L1303] EXPR s->bbio [L1303] EXPR s->wbio VAL [={33028:-2147450700}, blastFlag=1, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->bbio={0:1}, s->wbio={0:0}, skip=0, SSLv3_client_data={268435458:0}, state=4368, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1303] COND TRUE (unsigned long )s->bbio != (unsigned long )s->wbio [L1605] EXPR s->s3 [L1605] EXPR (s->s3)->tmp.reuse_message VAL [={33028:-2147450700}, (s->s3)->tmp.reuse_message=4384, blastFlag=1, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->s3={268435457:-796}, skip=0, SSLv3_client_data={268435458:0}, state=4368, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1605] COND FALSE !(! (s->s3)->tmp.reuse_message) [L1634] skip = 0 VAL [={33028:-2147450700}, blastFlag=1, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, skip=0, SSLv3_client_data={268435458:0}, state=4368, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1131] COND TRUE 1 VAL [={33028:-2147450700}, blastFlag=1, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, skip=0, SSLv3_client_data={268435458:0}, state=4368, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1133] EXPR s->state [L1133] state = s->state [L1134] EXPR s->state VAL [={33028:-2147450700}, blastFlag=1, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4384, skip=0, SSLv3_client_data={268435458:0}, state=4384, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1134] COND FALSE !(s->state == 12292) [L1137] EXPR s->state VAL [={33028:-2147450700}, blastFlag=1, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4384, skip=0, SSLv3_client_data={268435458:0}, state=4384, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1137] COND FALSE !(s->state == 16384) [L1140] EXPR s->state VAL [={33028:-2147450700}, blastFlag=1, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4384, skip=0, SSLv3_client_data={268435458:0}, state=4384, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1140] COND FALSE !(s->state == 4096) [L1143] EXPR s->state VAL [={33028:-2147450700}, blastFlag=1, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4384, skip=0, SSLv3_client_data={268435458:0}, state=4384, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1143] COND FALSE !(s->state == 20480) [L1146] EXPR s->state VAL [={33028:-2147450700}, blastFlag=1, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4384, skip=0, SSLv3_client_data={268435458:0}, state=4384, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1146] COND FALSE !(s->state == 4099) [L1149] EXPR s->state VAL [={33028:-2147450700}, blastFlag=1, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4384, skip=0, SSLv3_client_data={268435458:0}, state=4384, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1149] COND FALSE !(s->state == 4368) [L1152] EXPR s->state VAL [={33028:-2147450700}, blastFlag=1, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4384, skip=0, SSLv3_client_data={268435458:0}, state=4384, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1152] COND FALSE !(s->state == 4369) [L1155] EXPR s->state VAL [={33028:-2147450700}, blastFlag=1, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4384, skip=0, SSLv3_client_data={268435458:0}, state=4384, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1155] COND TRUE s->state == 4384 [L1311] ret = __VERIFIER_nondet_int() [L1312] COND TRUE blastFlag == 1 [L1313] blastFlag = 2 VAL [={33028:-2147450700}, blastFlag=2, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, skip=0, SSLv3_client_data={268435458:0}, state=4384, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1317] COND FALSE !(ret <= 0) [L1322] s->hit VAL [={33028:-2147450700}, blastFlag=2, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->hit=0, skip=0, SSLv3_client_data={268435458:0}, state=4384, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1322] COND FALSE !(s->hit) [L1325] s->state = 4400 VAL [={33028:-2147450700}, blastFlag=2, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, skip=0, SSLv3_client_data={268435458:0}, state=4384, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1327] s->init_num = 0 VAL [={33028:-2147450700}, blastFlag=2, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, skip=0, SSLv3_client_data={268435458:0}, state=4384, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1605] EXPR s->s3 [L1605] EXPR (s->s3)->tmp.reuse_message VAL [={33028:-2147450700}, (s->s3)->tmp.reuse_message=4400, blastFlag=2, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->s3={268435457:-796}, skip=0, SSLv3_client_data={268435458:0}, state=4384, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1605] COND FALSE !(! (s->s3)->tmp.reuse_message) [L1634] skip = 0 VAL [={33028:-2147450700}, blastFlag=2, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, skip=0, SSLv3_client_data={268435458:0}, state=4384, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1131] COND TRUE 1 VAL [={33028:-2147450700}, blastFlag=2, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, skip=0, SSLv3_client_data={268435458:0}, state=4384, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1133] EXPR s->state [L1133] state = s->state [L1134] EXPR s->state VAL [={33028:-2147450700}, blastFlag=2, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4400, skip=0, SSLv3_client_data={268435458:0}, state=4400, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1134] COND FALSE !(s->state == 12292) [L1137] EXPR s->state VAL [={33028:-2147450700}, blastFlag=2, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4400, skip=0, SSLv3_client_data={268435458:0}, state=4400, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1137] COND FALSE !(s->state == 16384) [L1140] EXPR s->state VAL [={33028:-2147450700}, blastFlag=2, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4400, skip=0, SSLv3_client_data={268435458:0}, state=4400, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1140] COND FALSE !(s->state == 4096) [L1143] EXPR s->state VAL [={33028:-2147450700}, blastFlag=2, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4400, skip=0, SSLv3_client_data={268435458:0}, state=4400, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1143] COND FALSE !(s->state == 20480) [L1146] EXPR s->state VAL [={33028:-2147450700}, blastFlag=2, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4400, skip=0, SSLv3_client_data={268435458:0}, state=4400, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1146] COND FALSE !(s->state == 4099) [L1149] EXPR s->state VAL [={33028:-2147450700}, blastFlag=2, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4400, skip=0, SSLv3_client_data={268435458:0}, state=4400, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1149] COND FALSE !(s->state == 4368) [L1152] EXPR s->state VAL [={33028:-2147450700}, blastFlag=2, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4400, skip=0, SSLv3_client_data={268435458:0}, state=4400, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1152] COND FALSE !(s->state == 4369) [L1155] EXPR s->state VAL [={33028:-2147450700}, blastFlag=2, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4400, skip=0, SSLv3_client_data={268435458:0}, state=4400, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1155] COND FALSE !(s->state == 4384) [L1158] EXPR s->state VAL [={33028:-2147450700}, blastFlag=2, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4400, skip=0, SSLv3_client_data={268435458:0}, state=4400, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1158] COND FALSE !(s->state == 4385) [L1161] EXPR s->state VAL [={33028:-2147450700}, blastFlag=2, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4400, skip=0, SSLv3_client_data={268435458:0}, state=4400, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1161] COND TRUE s->state == 4400 [L1331] EXPR s->s3 [L1331] EXPR (s->s3)->tmp.new_cipher [L1331] EXPR ((s->s3)->tmp.new_cipher)->algorithms VAL [={33028:-2147450700}, ((s->s3)->tmp.new_cipher)->algorithms=0, (s->s3)->tmp.new_cipher={268435457:52}, blastFlag=2, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->s3={268435457:-796}, skip=0, SSLv3_client_data={268435458:0}, state=4400, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1331] COND FALSE !(((s->s3)->tmp.new_cipher)->algorithms & 256UL) [L1334] ret = __VERIFIER_nondet_int() [L1335] COND TRUE blastFlag == 2 [L1336] blastFlag = 3 VAL [={33028:-2147450700}, blastFlag=3, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, skip=0, SSLv3_client_data={268435458:0}, state=4400, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1340] COND FALSE !(ret <= 0) VAL [={33028:-2147450700}, blastFlag=3, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, skip=0, SSLv3_client_data={268435458:0}, state=4400, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1346] s->state = 4416 [L1347] s->init_num = 0 VAL [={33028:-2147450700}, blastFlag=3, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, skip=0, SSLv3_client_data={268435458:0}, state=4400, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1605] EXPR s->s3 [L1605] EXPR (s->s3)->tmp.reuse_message VAL [={33028:-2147450700}, (s->s3)->tmp.reuse_message=4416, blastFlag=3, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->s3={268435457:-796}, skip=0, SSLv3_client_data={268435458:0}, state=4400, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1605] COND FALSE !(! (s->s3)->tmp.reuse_message) [L1634] skip = 0 VAL [={33028:-2147450700}, blastFlag=3, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, skip=0, SSLv3_client_data={268435458:0}, state=4400, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1131] COND TRUE 1 VAL [={33028:-2147450700}, blastFlag=3, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, skip=0, SSLv3_client_data={268435458:0}, state=4400, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1133] EXPR s->state [L1133] state = s->state [L1134] EXPR s->state VAL [={33028:-2147450700}, blastFlag=3, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4416, skip=0, SSLv3_client_data={268435458:0}, state=4416, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1134] COND FALSE !(s->state == 12292) [L1137] EXPR s->state VAL [={33028:-2147450700}, blastFlag=3, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4416, skip=0, SSLv3_client_data={268435458:0}, state=4416, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1137] COND FALSE !(s->state == 16384) [L1140] EXPR s->state VAL [={33028:-2147450700}, blastFlag=3, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4416, skip=0, SSLv3_client_data={268435458:0}, state=4416, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1140] COND FALSE !(s->state == 4096) [L1143] EXPR s->state VAL [={33028:-2147450700}, blastFlag=3, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4416, skip=0, SSLv3_client_data={268435458:0}, state=4416, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1143] COND FALSE !(s->state == 20480) [L1146] EXPR s->state VAL [={33028:-2147450700}, blastFlag=3, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4416, skip=0, SSLv3_client_data={268435458:0}, state=4416, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1146] COND FALSE !(s->state == 4099) [L1149] EXPR s->state VAL [={33028:-2147450700}, blastFlag=3, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4416, skip=0, SSLv3_client_data={268435458:0}, state=4416, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1149] COND FALSE !(s->state == 4368) [L1152] EXPR s->state VAL [={33028:-2147450700}, blastFlag=3, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4416, skip=0, SSLv3_client_data={268435458:0}, state=4416, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1152] COND FALSE !(s->state == 4369) [L1155] EXPR s->state VAL [={33028:-2147450700}, blastFlag=3, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4416, skip=0, SSLv3_client_data={268435458:0}, state=4416, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1155] COND FALSE !(s->state == 4384) [L1158] EXPR s->state VAL [={33028:-2147450700}, blastFlag=3, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4416, skip=0, SSLv3_client_data={268435458:0}, state=4416, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1158] COND FALSE !(s->state == 4385) [L1161] EXPR s->state VAL [={33028:-2147450700}, blastFlag=3, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4416, skip=0, SSLv3_client_data={268435458:0}, state=4416, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1161] COND FALSE !(s->state == 4400) [L1164] EXPR s->state VAL [={33028:-2147450700}, blastFlag=3, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4416, skip=0, SSLv3_client_data={268435458:0}, state=4416, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1164] COND FALSE !(s->state == 4401) [L1167] EXPR s->state VAL [={33028:-2147450700}, blastFlag=3, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4416, skip=0, SSLv3_client_data={268435458:0}, state=4416, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1167] COND TRUE s->state == 4416 [L1351] ret = __VERIFIER_nondet_int() [L1352] COND TRUE blastFlag == 3 [L1353] blastFlag = 4 VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, skip=0, SSLv3_client_data={268435458:0}, state=4416, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1357] COND FALSE !(ret <= 0) [L1362] s->state = 4432 [L1363] s->init_num = 0 [L1364] tmp___6 = __VERIFIER_nondet_int() [L1365] COND FALSE !(! tmp___6) VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, skip=0, SSLv3_client_data={268435458:0}, state=4416, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1605] EXPR s->s3 [L1605] EXPR (s->s3)->tmp.reuse_message VAL [={33028:-2147450700}, (s->s3)->tmp.reuse_message=4432, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->s3={268435457:-796}, skip=0, SSLv3_client_data={268435458:0}, state=4416, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1605] COND FALSE !(! (s->s3)->tmp.reuse_message) [L1634] skip = 0 VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, skip=0, SSLv3_client_data={268435458:0}, state=4416, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1131] COND TRUE 1 VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, skip=0, SSLv3_client_data={268435458:0}, state=4416, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1133] EXPR s->state [L1133] state = s->state [L1134] EXPR s->state VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4432, skip=0, SSLv3_client_data={268435458:0}, state=4432, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1134] COND FALSE !(s->state == 12292) [L1137] EXPR s->state VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4432, skip=0, SSLv3_client_data={268435458:0}, state=4432, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1137] COND FALSE !(s->state == 16384) [L1140] EXPR s->state VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4432, skip=0, SSLv3_client_data={268435458:0}, state=4432, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1140] COND FALSE !(s->state == 4096) [L1143] EXPR s->state VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4432, skip=0, SSLv3_client_data={268435458:0}, state=4432, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1143] COND FALSE !(s->state == 20480) [L1146] EXPR s->state VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4432, skip=0, SSLv3_client_data={268435458:0}, state=4432, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1146] COND FALSE !(s->state == 4099) [L1149] EXPR s->state VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4432, skip=0, SSLv3_client_data={268435458:0}, state=4432, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1149] COND FALSE !(s->state == 4368) [L1152] EXPR s->state VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4432, skip=0, SSLv3_client_data={268435458:0}, state=4432, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1152] COND FALSE !(s->state == 4369) [L1155] EXPR s->state VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4432, skip=0, SSLv3_client_data={268435458:0}, state=4432, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1155] COND FALSE !(s->state == 4384) [L1158] EXPR s->state VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4432, skip=0, SSLv3_client_data={268435458:0}, state=4432, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1158] COND FALSE !(s->state == 4385) [L1161] EXPR s->state VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4432, skip=0, SSLv3_client_data={268435458:0}, state=4432, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1161] COND FALSE !(s->state == 4400) [L1164] EXPR s->state VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4432, skip=0, SSLv3_client_data={268435458:0}, state=4432, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1164] COND FALSE !(s->state == 4401) [L1167] EXPR s->state VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4432, skip=0, SSLv3_client_data={268435458:0}, state=4432, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1167] COND FALSE !(s->state == 4416) [L1170] EXPR s->state VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4432, skip=0, SSLv3_client_data={268435458:0}, state=4432, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1170] COND FALSE !(s->state == 4417) [L1173] EXPR s->state VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4432, skip=0, SSLv3_client_data={268435458:0}, state=4432, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1173] COND TRUE s->state == 4432 [L1374] ret = __VERIFIER_nondet_int() [L1375] COND FALSE !(blastFlag == 5) VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, skip=0, SSLv3_client_data={268435458:0}, state=4432, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1380] COND FALSE !(ret <= 0) [L1385] s->state = 4448 [L1386] s->init_num = 0 VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, skip=0, SSLv3_client_data={268435458:0}, state=4432, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1605] EXPR s->s3 [L1605] EXPR (s->s3)->tmp.reuse_message VAL [={33028:-2147450700}, (s->s3)->tmp.reuse_message=4448, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->s3={268435457:-796}, skip=0, SSLv3_client_data={268435458:0}, state=4432, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1605] COND FALSE !(! (s->s3)->tmp.reuse_message) [L1634] skip = 0 VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, skip=0, SSLv3_client_data={268435458:0}, state=4432, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1131] COND TRUE 1 VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, skip=0, SSLv3_client_data={268435458:0}, state=4432, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1133] EXPR s->state [L1133] state = s->state [L1134] EXPR s->state VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4448, skip=0, SSLv3_client_data={268435458:0}, state=4448, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1134] COND FALSE !(s->state == 12292) [L1137] EXPR s->state VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4448, skip=0, SSLv3_client_data={268435458:0}, state=4448, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1137] COND FALSE !(s->state == 16384) [L1140] EXPR s->state VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4448, skip=0, SSLv3_client_data={268435458:0}, state=4448, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1140] COND FALSE !(s->state == 4096) [L1143] EXPR s->state VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4448, skip=0, SSLv3_client_data={268435458:0}, state=4448, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1143] COND FALSE !(s->state == 20480) [L1146] EXPR s->state VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4448, skip=0, SSLv3_client_data={268435458:0}, state=4448, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1146] COND FALSE !(s->state == 4099) [L1149] EXPR s->state VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4448, skip=0, SSLv3_client_data={268435458:0}, state=4448, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1149] COND FALSE !(s->state == 4368) [L1152] EXPR s->state VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4448, skip=0, SSLv3_client_data={268435458:0}, state=4448, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1152] COND FALSE !(s->state == 4369) [L1155] EXPR s->state VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4448, skip=0, SSLv3_client_data={268435458:0}, state=4448, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1155] COND FALSE !(s->state == 4384) [L1158] EXPR s->state VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4448, skip=0, SSLv3_client_data={268435458:0}, state=4448, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1158] COND FALSE !(s->state == 4385) [L1161] EXPR s->state VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4448, skip=0, SSLv3_client_data={268435458:0}, state=4448, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1161] COND FALSE !(s->state == 4400) [L1164] EXPR s->state VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4448, skip=0, SSLv3_client_data={268435458:0}, state=4448, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1164] COND FALSE !(s->state == 4401) [L1167] EXPR s->state VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4448, skip=0, SSLv3_client_data={268435458:0}, state=4448, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1167] COND FALSE !(s->state == 4416) [L1170] EXPR s->state VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4448, skip=0, SSLv3_client_data={268435458:0}, state=4448, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1170] COND FALSE !(s->state == 4417) [L1173] EXPR s->state VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4448, skip=0, SSLv3_client_data={268435458:0}, state=4448, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1173] COND FALSE !(s->state == 4432) [L1176] EXPR s->state VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4448, skip=0, SSLv3_client_data={268435458:0}, state=4448, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1176] COND FALSE !(s->state == 4433) [L1179] EXPR s->state VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4448, skip=0, SSLv3_client_data={268435458:0}, state=4448, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1179] COND TRUE s->state == 4448 [L1390] ret = __VERIFIER_nondet_int() [L1391] COND TRUE blastFlag == 4 VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=0, s={268435457:0}, s={268435457:0}, skip=0, SSLv3_client_data={268435458:0}, state=4448, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1646] __VERIFIER_error() VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=0, s={268435457:0}, s={268435457:0}, skip=0, SSLv3_client_data={268435458:0}, state=4448, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] ----- [2018-11-23 07:50:58,517 INFO L145 WitnessManager]: Wrote witness to /tmp/vcloud-vcloud-master/worker/working_dir_21ce33b1-1901-46d0-92d7-0f8a6adbdd6c/bin-2019/uautomizer/witness.graphml [2018-11-23 07:50:58,522 INFO L132 PluginConnector]: ------------------------ END Witness Printer---------------------------- [2018-11-23 07:50:58,523 INFO L168 Benchmark]: Toolchain (without parser) took 238784.51 ms. Allocated memory was 1.0 GB in the beginning and 1.3 GB in the end (delta: 253.2 MB). Free memory was 945.4 MB in the beginning and 982.9 MB in the end (delta: -37.5 MB). Peak memory consumption was 215.8 MB. Max. memory is 11.5 GB. [2018-11-23 07:50:58,523 INFO L168 Benchmark]: CDTParser took 0.15 ms. Allocated memory is still 1.0 GB. Free memory is still 978.7 MB. There was no memory consumed. Max. memory is 11.5 GB. [2018-11-23 07:50:58,523 INFO L168 Benchmark]: CACSL2BoogieTranslator took 477.58 ms. Allocated memory was 1.0 GB in the beginning and 1.2 GB in the end (delta: 173.5 MB). Free memory was 945.4 MB in the beginning and 1.2 GB in the end (delta: -207.5 MB). Peak memory consumption was 41.7 MB. Max. memory is 11.5 GB. [2018-11-23 07:50:58,523 INFO L168 Benchmark]: Boogie Procedure Inliner took 35.10 ms. Allocated memory is still 1.2 GB. Free memory was 1.2 GB in the beginning and 1.1 GB in the end (delta: 6.5 MB). Peak memory consumption was 6.5 MB. Max. memory is 11.5 GB. [2018-11-23 07:50:58,523 INFO L168 Benchmark]: Boogie Preprocessor took 61.47 ms. Allocated memory is still 1.2 GB. Free memory was 1.1 GB in the beginning and 1.1 GB in the end (delta: 13.1 MB). Peak memory consumption was 13.1 MB. Max. memory is 11.5 GB. [2018-11-23 07:50:58,524 INFO L168 Benchmark]: RCFGBuilder took 2149.16 ms. Allocated memory is still 1.2 GB. Free memory was 1.1 GB in the beginning and 1.1 GB in the end (delta: 76.3 MB). Peak memory consumption was 76.3 MB. Max. memory is 11.5 GB. [2018-11-23 07:50:58,524 INFO L168 Benchmark]: TraceAbstraction took 227656.77 ms. Allocated memory was 1.2 GB in the beginning and 1.3 GB in the end (delta: 79.7 MB). Free memory was 1.1 GB in the beginning and 1.1 GB in the end (delta: -5.5 MB). Peak memory consumption was 74.2 MB. Max. memory is 11.5 GB. [2018-11-23 07:50:58,524 INFO L168 Benchmark]: Witness Printer took 8401.17 ms. Allocated memory is still 1.3 GB. Free memory was 1.1 GB in the beginning and 982.9 MB in the end (delta: 79.6 MB). Peak memory consumption was 79.6 MB. Max. memory is 11.5 GB. [2018-11-23 07:50:58,525 INFO L336 ainManager$Toolchain]: ####################### End [Toolchain 1] ####################### --- Results --- * Results from de.uni_freiburg.informatik.ultimate.core: - StatisticsResult: Toolchain Benchmarks Benchmark results are: * CDTParser took 0.15 ms. Allocated memory is still 1.0 GB. Free memory is still 978.7 MB. There was no memory consumed. Max. memory is 11.5 GB. * CACSL2BoogieTranslator took 477.58 ms. Allocated memory was 1.0 GB in the beginning and 1.2 GB in the end (delta: 173.5 MB). Free memory was 945.4 MB in the beginning and 1.2 GB in the end (delta: -207.5 MB). Peak memory consumption was 41.7 MB. Max. memory is 11.5 GB. * Boogie Procedure Inliner took 35.10 ms. Allocated memory is still 1.2 GB. Free memory was 1.2 GB in the beginning and 1.1 GB in the end (delta: 6.5 MB). Peak memory consumption was 6.5 MB. Max. memory is 11.5 GB. * Boogie Preprocessor took 61.47 ms. Allocated memory is still 1.2 GB. Free memory was 1.1 GB in the beginning and 1.1 GB in the end (delta: 13.1 MB). Peak memory consumption was 13.1 MB. Max. memory is 11.5 GB. * RCFGBuilder took 2149.16 ms. Allocated memory is still 1.2 GB. Free memory was 1.1 GB in the beginning and 1.1 GB in the end (delta: 76.3 MB). Peak memory consumption was 76.3 MB. Max. memory is 11.5 GB. * TraceAbstraction took 227656.77 ms. Allocated memory was 1.2 GB in the beginning and 1.3 GB in the end (delta: 79.7 MB). Free memory was 1.1 GB in the beginning and 1.1 GB in the end (delta: -5.5 MB). Peak memory consumption was 74.2 MB. Max. memory is 11.5 GB. * Witness Printer took 8401.17 ms. Allocated memory is still 1.3 GB. Free memory was 1.1 GB in the beginning and 982.9 MB in the end (delta: 79.6 MB). Peak memory consumption was 79.6 MB. Max. memory is 11.5 GB. * Results from de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator: - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: BitvecLiteral 0bv32 could not be translated for associated CType STRUCT~~ssl_method_st?version~INT?ssl_new~*((*~SSL~0 ) : INT)?ssl_clear~*((*~SSL~0 ) : VOID)?ssl_free~*((*~SSL~0 ) : VOID)?ssl_accept~*((*~SSL~0 ) : INT)?ssl_connect~*((*~SSL~0 ) : INT)?ssl_read~*((*~SSL~0 *VOID INT ) : INT)?ssl_peek~*((*~SSL~0 *VOID INT ) : INT)?ssl_write~*((*~SSL~0 *VOID INT ) : INT)?ssl_shutdown~*((*~SSL~0 ) : INT)?ssl_renegotiate~*((*~SSL~0 ) : INT)?ssl_renegotiate_check~*((*~SSL~0 ) : INT)?ssl_ctrl~*((*~SSL~0 INT LONG *CHAR ) : LONG)?ssl_ctx_ctrl~*((*~SSL_CTX~0 INT LONG *CHAR ) : LONG)?get_cipher_by_char~*((*UCHAR ) : *~SSL_CIPHER~0)?put_cipher_by_char~*((*~SSL_CIPHER~0 *UCHAR ) : INT)?ssl_pending~*((*~SSL~0 ) : INT)?num_ciphers~*(() : INT)?get_cipher~*((UINT ) : *~SSL_CIPHER~0)?get_ssl_method~*((INT ) : *ssl_method_st)?get_timeout~*(() : LONG)?ssl3_enc~*ssl3_enc_method?ssl_version~*(() : INT)?ssl_callback_ctrl~*((*~SSL~0 INT *(() : VOID) ) : LONG)?ssl_ctx_callback_ctrl~*((*~SSL_CTX~0 INT *(() : VOID) ) : LONG)# - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: BitvecLiteral 0bv32 could not be translated for associated CType STRUCT~~ssl_method_st?version~INT?ssl_new~*((*~SSL~0 ) : INT)?ssl_clear~*((*~SSL~0 ) : VOID)?ssl_free~*((*~SSL~0 ) : VOID)?ssl_accept~*((*~SSL~0 ) : INT)?ssl_connect~*((*~SSL~0 ) : INT)?ssl_read~*((*~SSL~0 *VOID INT ) : INT)?ssl_peek~*((*~SSL~0 *VOID INT ) : INT)?ssl_write~*((*~SSL~0 *VOID INT ) : INT)?ssl_shutdown~*((*~SSL~0 ) : INT)?ssl_renegotiate~*((*~SSL~0 ) : INT)?ssl_renegotiate_check~*((*~SSL~0 ) : INT)?ssl_ctrl~*((*~SSL~0 INT LONG *CHAR ) : LONG)?ssl_ctx_ctrl~*((*~SSL_CTX~0 INT LONG *CHAR ) : LONG)?get_cipher_by_char~*((*UCHAR ) : *~SSL_CIPHER~0)?put_cipher_by_char~*((*~SSL_CIPHER~0 *UCHAR ) : INT)?ssl_pending~*((*~SSL~0 ) : INT)?num_ciphers~*(() : INT)?get_cipher~*((UINT ) : *~SSL_CIPHER~0)?get_ssl_method~*((INT ) : *ssl_method_st)?get_timeout~*(() : LONG)?ssl3_enc~*ssl3_enc_method?ssl_version~*(() : INT)?ssl_callback_ctrl~*((*~SSL~0 INT *(() : VOID) ) : LONG)?ssl_ctx_callback_ctrl~*((*~SSL_CTX~0 INT *(() : VOID) ) : LONG)# - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: BitvecLiteral 0bv32 could not be translated for associated CType STRUCT~~ssl_method_st?version~INT?ssl_new~*((*~SSL~0 ) : INT)?ssl_clear~*((*~SSL~0 ) : VOID)?ssl_free~*((*~SSL~0 ) : VOID)?ssl_accept~*((*~SSL~0 ) : INT)?ssl_connect~*((*~SSL~0 ) : INT)?ssl_read~*((*~SSL~0 *VOID INT ) : INT)?ssl_peek~*((*~SSL~0 *VOID INT ) : INT)?ssl_write~*((*~SSL~0 *VOID INT ) : INT)?ssl_shutdown~*((*~SSL~0 ) : INT)?ssl_renegotiate~*((*~SSL~0 ) : INT)?ssl_renegotiate_check~*((*~SSL~0 ) : INT)?ssl_ctrl~*((*~SSL~0 INT LONG *CHAR ) : LONG)?ssl_ctx_ctrl~*((*~SSL_CTX~0 INT LONG *CHAR ) : LONG)?get_cipher_by_char~*((*UCHAR ) : *~SSL_CIPHER~0)?put_cipher_by_char~*((*~SSL_CIPHER~0 *UCHAR ) : INT)?ssl_pending~*((*~SSL~0 ) : INT)?num_ciphers~*(() : INT)?get_cipher~*((UINT ) : *~SSL_CIPHER~0)?get_ssl_method~*((INT ) : *ssl_method_st)?get_timeout~*(() : LONG)?ssl3_enc~*ssl3_enc_method?ssl_version~*(() : INT)?ssl_callback_ctrl~*((*~SSL~0 INT *(() : VOID) ) : LONG)?ssl_ctx_callback_ctrl~*((*~SSL_CTX~0 INT *(() : VOID) ) : LONG)# - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: BitvecLiteral 0bv32 could not be translated for associated CType STRUCT~~ssl_method_st?version~INT?ssl_new~*((*~SSL~0 ) : INT)?ssl_clear~*((*~SSL~0 ) : VOID)?ssl_free~*((*~SSL~0 ) : VOID)?ssl_accept~*((*~SSL~0 ) : INT)?ssl_connect~*((*~SSL~0 ) : INT)?ssl_read~*((*~SSL~0 *VOID INT ) : INT)?ssl_peek~*((*~SSL~0 *VOID INT ) : INT)?ssl_write~*((*~SSL~0 *VOID INT ) : INT)?ssl_shutdown~*((*~SSL~0 ) : INT)?ssl_renegotiate~*((*~SSL~0 ) : INT)?ssl_renegotiate_check~*((*~SSL~0 ) : INT)?ssl_ctrl~*((*~SSL~0 INT LONG *CHAR ) : LONG)?ssl_ctx_ctrl~*((*~SSL_CTX~0 INT LONG *CHAR ) : LONG)?get_cipher_by_char~*((*UCHAR ) : *~SSL_CIPHER~0)?put_cipher_by_char~*((*~SSL_CIPHER~0 *UCHAR ) : INT)?ssl_pending~*((*~SSL~0 ) : INT)?num_ciphers~*(() : INT)?get_cipher~*((UINT ) : *~SSL_CIPHER~0)?get_ssl_method~*((INT ) : *ssl_method_st)?get_timeout~*(() : LONG)?ssl3_enc~*ssl3_enc_method?ssl_version~*(() : INT)?ssl_callback_ctrl~*((*~SSL~0 INT *(() : VOID) ) : LONG)?ssl_ctx_callback_ctrl~*((*~SSL_CTX~0 INT *(() : VOID) ) : LONG)# * Results from de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction: - CounterExampleResult [Line: 1646]: a call of __VERIFIER_error() is reachable a call of __VERIFIER_error() is reachable We found a FailurePath: [L1042] static int init = 1; [L1043] static SSL_METHOD SSLv3_client_data ; VAL [\old(init)=0, \old(SSLv3_client_data)=null, \old(SSLv3_client_data)=null, init=1, SSLv3_client_data={268435458:0}] [L1065] SSL *s = (SSL*)malloc(sizeof(SSL)) ; [L1069] s->s3 = malloc(sizeof(struct ssl3_state_st)) [L1070] s->ctx = malloc(sizeof(SSL_CTX)) [L1071] s->session = malloc(sizeof(SSL_SESSION)) [L1072] s->state = 12292 [L1073] s->version = __VERIFIER_nondet_int() [L1074] CALL ssl3_connect(s) VAL [init=1, s={268435457:0}, SSLv3_client_data={268435458:0}] [L1080] BUF_MEM *buf = __VERIFIER_nondet_pointer() ; [L1081] unsigned long tmp ; [L1082] unsigned long l ; [L1083] long num1 ; [L1084] void (*cb)() ; [L1085] int ret ; [L1086] int new_state ; [L1087] int state ; [L1088] int skip ; [L1089] int *tmp___0 = __VERIFIER_nondet_pointer() ; [L1090] int tmp___1 = __VERIFIER_nondet_int() ; [L1091] int tmp___2 = __VERIFIER_nondet_int() ; [L1092] int tmp___3 ; [L1093] int tmp___4 ; [L1094] int tmp___5 ; [L1095] int tmp___6 ; [L1096] int tmp___7 ; [L1097] int tmp___8 ; [L1098] long tmp___9 ; [L1100] int blastFlag ; [L1103] blastFlag = 0 [L1104] s->hit=__VERIFIER_nondet_int () [L1105] s->state = 12292 [L1106] tmp = __VERIFIER_nondet_int() [L1107] cb = (void (*)())((void *)0) [L1108] ret = -1 [L1109] skip = 0 [L1110] *tmp___0 = 0 [L1111] EXPR s->info_callback VAL [={0:0}, blastFlag=0, buf={0:0}, init=1, ret=4294967295, s={268435457:0}, s={268435457:0}, s->info_callback={33028:-2147450700}, skip=0, SSLv3_client_data={268435458:0}, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0] [L1111] COND TRUE (unsigned long )s->info_callback != (unsigned long )((void *)0) [L1112] EXPR s->info_callback [L1112] cb = s->info_callback [L1120] EXPR s->in_handshake [L1120] s->in_handshake += 1 [L1121] COND FALSE !(tmp___1 & 12288) VAL [={33028:-2147450700}, blastFlag=0, buf={0:0}, init=1, ret=4294967295, s={268435457:0}, s={268435457:0}, skip=0, SSLv3_client_data={268435458:0}, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0] [L1131] COND TRUE 1 VAL [={33028:-2147450700}, blastFlag=0, buf={0:0}, init=1, ret=4294967295, s={268435457:0}, s={268435457:0}, skip=0, SSLv3_client_data={268435458:0}, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0] [L1133] EXPR s->state [L1133] state = s->state [L1134] EXPR s->state VAL [={33028:-2147450700}, blastFlag=0, buf={0:0}, init=1, ret=4294967295, s={268435457:0}, s={268435457:0}, s->state=12292, skip=0, SSLv3_client_data={268435458:0}, state=12292, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0] [L1134] COND TRUE s->state == 12292 [L1237] s->new_session = 1 [L1238] s->state = 4096 [L1239] EXPR s->ctx [L1239] EXPR (s->ctx)->stats.sess_connect_renegotiate [L1239] (s->ctx)->stats.sess_connect_renegotiate += 1 [L1244] s->server = 0 VAL [={33028:-2147450700}, blastFlag=0, buf={0:0}, init=1, ret=4294967295, s={268435457:0}, s={268435457:0}, skip=0, SSLv3_client_data={268435458:0}, state=12292, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0] [L1245] COND TRUE (unsigned long )cb != (unsigned long )((void *)0) VAL [={33028:-2147450700}, blastFlag=0, buf={0:0}, init=1, ret=4294967295, s={268435457:0}, s={268435457:0}, skip=0, SSLv3_client_data={268435458:0}, state=12292, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0] [L1250] EXPR s->version VAL [={33028:-2147450700}, blastFlag=0, buf={0:0}, init=1, ret=4294967295, s={268435457:0}, s={268435457:0}, s->version=768, skip=0, SSLv3_client_data={268435458:0}, state=12292, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0] [L1250] COND FALSE !((s->version & 65280) != 768) [L1256] s->type = 4096 [L1257] EXPR s->init_buf VAL [={33028:-2147450700}, blastFlag=0, buf={0:0}, init=1, ret=4294967295, s={268435457:0}, s={268435457:0}, s->init_buf={0:1}, skip=0, SSLv3_client_data={268435458:0}, state=12292, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0] [L1257] COND FALSE !((unsigned long )s->init_buf == (unsigned long )((void *)0)) [L1269] tmp___4 = __VERIFIER_nondet_int() [L1270] COND FALSE !(! tmp___4) [L1276] tmp___5 = __VERIFIER_nondet_int() [L1277] COND FALSE !(! tmp___5) [L1283] s->state = 4368 [L1284] EXPR s->ctx [L1284] EXPR (s->ctx)->stats.sess_connect [L1284] (s->ctx)->stats.sess_connect += 1 [L1285] s->init_num = 0 VAL [={33028:-2147450700}, blastFlag=0, buf={0:0}, init=1, ret=4294967295, s={268435457:0}, s={268435457:0}, skip=0, SSLv3_client_data={268435458:0}, state=12292, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1605] EXPR s->s3 [L1605] EXPR (s->s3)->tmp.reuse_message VAL [={33028:-2147450700}, (s->s3)->tmp.reuse_message=4368, blastFlag=0, buf={0:0}, init=1, ret=4294967295, s={268435457:0}, s={268435457:0}, s->s3={268435457:-796}, skip=0, SSLv3_client_data={268435458:0}, state=12292, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1605] COND FALSE !(! (s->s3)->tmp.reuse_message) [L1634] skip = 0 VAL [={33028:-2147450700}, blastFlag=0, buf={0:0}, init=1, ret=4294967295, s={268435457:0}, s={268435457:0}, skip=0, SSLv3_client_data={268435458:0}, state=12292, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1131] COND TRUE 1 VAL [={33028:-2147450700}, blastFlag=0, buf={0:0}, init=1, ret=4294967295, s={268435457:0}, s={268435457:0}, skip=0, SSLv3_client_data={268435458:0}, state=12292, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1133] EXPR s->state [L1133] state = s->state [L1134] EXPR s->state VAL [={33028:-2147450700}, blastFlag=0, buf={0:0}, init=1, ret=4294967295, s={268435457:0}, s={268435457:0}, s->state=4368, skip=0, SSLv3_client_data={268435458:0}, state=4368, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1134] COND FALSE !(s->state == 12292) [L1137] EXPR s->state VAL [={33028:-2147450700}, blastFlag=0, buf={0:0}, init=1, ret=4294967295, s={268435457:0}, s={268435457:0}, s->state=4368, skip=0, SSLv3_client_data={268435458:0}, state=4368, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1137] COND FALSE !(s->state == 16384) [L1140] EXPR s->state VAL [={33028:-2147450700}, blastFlag=0, buf={0:0}, init=1, ret=4294967295, s={268435457:0}, s={268435457:0}, s->state=4368, skip=0, SSLv3_client_data={268435458:0}, state=4368, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1140] COND FALSE !(s->state == 4096) [L1143] EXPR s->state VAL [={33028:-2147450700}, blastFlag=0, buf={0:0}, init=1, ret=4294967295, s={268435457:0}, s={268435457:0}, s->state=4368, skip=0, SSLv3_client_data={268435458:0}, state=4368, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1143] COND FALSE !(s->state == 20480) [L1146] EXPR s->state VAL [={33028:-2147450700}, blastFlag=0, buf={0:0}, init=1, ret=4294967295, s={268435457:0}, s={268435457:0}, s->state=4368, skip=0, SSLv3_client_data={268435458:0}, state=4368, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1146] COND FALSE !(s->state == 4099) [L1149] EXPR s->state VAL [={33028:-2147450700}, blastFlag=0, buf={0:0}, init=1, ret=4294967295, s={268435457:0}, s={268435457:0}, s->state=4368, skip=0, SSLv3_client_data={268435458:0}, state=4368, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1149] COND TRUE s->state == 4368 [L1289] s->shutdown = 0 [L1290] ret = __VERIFIER_nondet_int() [L1291] COND TRUE blastFlag == 0 [L1292] blastFlag = 1 VAL [={33028:-2147450700}, blastFlag=1, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, skip=0, SSLv3_client_data={268435458:0}, state=4368, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1296] COND FALSE !(ret <= 0) [L1301] s->state = 4384 [L1302] s->init_num = 0 [L1303] EXPR s->bbio [L1303] EXPR s->wbio VAL [={33028:-2147450700}, blastFlag=1, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->bbio={0:1}, s->wbio={0:0}, skip=0, SSLv3_client_data={268435458:0}, state=4368, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1303] COND TRUE (unsigned long )s->bbio != (unsigned long )s->wbio [L1605] EXPR s->s3 [L1605] EXPR (s->s3)->tmp.reuse_message VAL [={33028:-2147450700}, (s->s3)->tmp.reuse_message=4384, blastFlag=1, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->s3={268435457:-796}, skip=0, SSLv3_client_data={268435458:0}, state=4368, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1605] COND FALSE !(! (s->s3)->tmp.reuse_message) [L1634] skip = 0 VAL [={33028:-2147450700}, blastFlag=1, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, skip=0, SSLv3_client_data={268435458:0}, state=4368, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1131] COND TRUE 1 VAL [={33028:-2147450700}, blastFlag=1, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, skip=0, SSLv3_client_data={268435458:0}, state=4368, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1133] EXPR s->state [L1133] state = s->state [L1134] EXPR s->state VAL [={33028:-2147450700}, blastFlag=1, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4384, skip=0, SSLv3_client_data={268435458:0}, state=4384, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1134] COND FALSE !(s->state == 12292) [L1137] EXPR s->state VAL [={33028:-2147450700}, blastFlag=1, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4384, skip=0, SSLv3_client_data={268435458:0}, state=4384, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1137] COND FALSE !(s->state == 16384) [L1140] EXPR s->state VAL [={33028:-2147450700}, blastFlag=1, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4384, skip=0, SSLv3_client_data={268435458:0}, state=4384, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1140] COND FALSE !(s->state == 4096) [L1143] EXPR s->state VAL [={33028:-2147450700}, blastFlag=1, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4384, skip=0, SSLv3_client_data={268435458:0}, state=4384, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1143] COND FALSE !(s->state == 20480) [L1146] EXPR s->state VAL [={33028:-2147450700}, blastFlag=1, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4384, skip=0, SSLv3_client_data={268435458:0}, state=4384, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1146] COND FALSE !(s->state == 4099) [L1149] EXPR s->state VAL [={33028:-2147450700}, blastFlag=1, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4384, skip=0, SSLv3_client_data={268435458:0}, state=4384, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1149] COND FALSE !(s->state == 4368) [L1152] EXPR s->state VAL [={33028:-2147450700}, blastFlag=1, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4384, skip=0, SSLv3_client_data={268435458:0}, state=4384, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1152] COND FALSE !(s->state == 4369) [L1155] EXPR s->state VAL [={33028:-2147450700}, blastFlag=1, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4384, skip=0, SSLv3_client_data={268435458:0}, state=4384, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1155] COND TRUE s->state == 4384 [L1311] ret = __VERIFIER_nondet_int() [L1312] COND TRUE blastFlag == 1 [L1313] blastFlag = 2 VAL [={33028:-2147450700}, blastFlag=2, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, skip=0, SSLv3_client_data={268435458:0}, state=4384, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1317] COND FALSE !(ret <= 0) [L1322] s->hit VAL [={33028:-2147450700}, blastFlag=2, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->hit=0, skip=0, SSLv3_client_data={268435458:0}, state=4384, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1322] COND FALSE !(s->hit) [L1325] s->state = 4400 VAL [={33028:-2147450700}, blastFlag=2, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, skip=0, SSLv3_client_data={268435458:0}, state=4384, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1327] s->init_num = 0 VAL [={33028:-2147450700}, blastFlag=2, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, skip=0, SSLv3_client_data={268435458:0}, state=4384, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1605] EXPR s->s3 [L1605] EXPR (s->s3)->tmp.reuse_message VAL [={33028:-2147450700}, (s->s3)->tmp.reuse_message=4400, blastFlag=2, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->s3={268435457:-796}, skip=0, SSLv3_client_data={268435458:0}, state=4384, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1605] COND FALSE !(! (s->s3)->tmp.reuse_message) [L1634] skip = 0 VAL [={33028:-2147450700}, blastFlag=2, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, skip=0, SSLv3_client_data={268435458:0}, state=4384, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1131] COND TRUE 1 VAL [={33028:-2147450700}, blastFlag=2, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, skip=0, SSLv3_client_data={268435458:0}, state=4384, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1133] EXPR s->state [L1133] state = s->state [L1134] EXPR s->state VAL [={33028:-2147450700}, blastFlag=2, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4400, skip=0, SSLv3_client_data={268435458:0}, state=4400, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1134] COND FALSE !(s->state == 12292) [L1137] EXPR s->state VAL [={33028:-2147450700}, blastFlag=2, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4400, skip=0, SSLv3_client_data={268435458:0}, state=4400, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1137] COND FALSE !(s->state == 16384) [L1140] EXPR s->state VAL [={33028:-2147450700}, blastFlag=2, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4400, skip=0, SSLv3_client_data={268435458:0}, state=4400, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1140] COND FALSE !(s->state == 4096) [L1143] EXPR s->state VAL [={33028:-2147450700}, blastFlag=2, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4400, skip=0, SSLv3_client_data={268435458:0}, state=4400, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1143] COND FALSE !(s->state == 20480) [L1146] EXPR s->state VAL [={33028:-2147450700}, blastFlag=2, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4400, skip=0, SSLv3_client_data={268435458:0}, state=4400, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1146] COND FALSE !(s->state == 4099) [L1149] EXPR s->state VAL [={33028:-2147450700}, blastFlag=2, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4400, skip=0, SSLv3_client_data={268435458:0}, state=4400, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1149] COND FALSE !(s->state == 4368) [L1152] EXPR s->state VAL [={33028:-2147450700}, blastFlag=2, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4400, skip=0, SSLv3_client_data={268435458:0}, state=4400, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1152] COND FALSE !(s->state == 4369) [L1155] EXPR s->state VAL [={33028:-2147450700}, blastFlag=2, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4400, skip=0, SSLv3_client_data={268435458:0}, state=4400, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1155] COND FALSE !(s->state == 4384) [L1158] EXPR s->state VAL [={33028:-2147450700}, blastFlag=2, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4400, skip=0, SSLv3_client_data={268435458:0}, state=4400, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1158] COND FALSE !(s->state == 4385) [L1161] EXPR s->state VAL [={33028:-2147450700}, blastFlag=2, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4400, skip=0, SSLv3_client_data={268435458:0}, state=4400, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1161] COND TRUE s->state == 4400 [L1331] EXPR s->s3 [L1331] EXPR (s->s3)->tmp.new_cipher [L1331] EXPR ((s->s3)->tmp.new_cipher)->algorithms VAL [={33028:-2147450700}, ((s->s3)->tmp.new_cipher)->algorithms=0, (s->s3)->tmp.new_cipher={268435457:52}, blastFlag=2, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->s3={268435457:-796}, skip=0, SSLv3_client_data={268435458:0}, state=4400, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1331] COND FALSE !(((s->s3)->tmp.new_cipher)->algorithms & 256UL) [L1334] ret = __VERIFIER_nondet_int() [L1335] COND TRUE blastFlag == 2 [L1336] blastFlag = 3 VAL [={33028:-2147450700}, blastFlag=3, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, skip=0, SSLv3_client_data={268435458:0}, state=4400, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1340] COND FALSE !(ret <= 0) VAL [={33028:-2147450700}, blastFlag=3, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, skip=0, SSLv3_client_data={268435458:0}, state=4400, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1346] s->state = 4416 [L1347] s->init_num = 0 VAL [={33028:-2147450700}, blastFlag=3, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, skip=0, SSLv3_client_data={268435458:0}, state=4400, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1605] EXPR s->s3 [L1605] EXPR (s->s3)->tmp.reuse_message VAL [={33028:-2147450700}, (s->s3)->tmp.reuse_message=4416, blastFlag=3, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->s3={268435457:-796}, skip=0, SSLv3_client_data={268435458:0}, state=4400, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1605] COND FALSE !(! (s->s3)->tmp.reuse_message) [L1634] skip = 0 VAL [={33028:-2147450700}, blastFlag=3, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, skip=0, SSLv3_client_data={268435458:0}, state=4400, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1131] COND TRUE 1 VAL [={33028:-2147450700}, blastFlag=3, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, skip=0, SSLv3_client_data={268435458:0}, state=4400, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1133] EXPR s->state [L1133] state = s->state [L1134] EXPR s->state VAL [={33028:-2147450700}, blastFlag=3, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4416, skip=0, SSLv3_client_data={268435458:0}, state=4416, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1134] COND FALSE !(s->state == 12292) [L1137] EXPR s->state VAL [={33028:-2147450700}, blastFlag=3, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4416, skip=0, SSLv3_client_data={268435458:0}, state=4416, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1137] COND FALSE !(s->state == 16384) [L1140] EXPR s->state VAL [={33028:-2147450700}, blastFlag=3, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4416, skip=0, SSLv3_client_data={268435458:0}, state=4416, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1140] COND FALSE !(s->state == 4096) [L1143] EXPR s->state VAL [={33028:-2147450700}, blastFlag=3, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4416, skip=0, SSLv3_client_data={268435458:0}, state=4416, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1143] COND FALSE !(s->state == 20480) [L1146] EXPR s->state VAL [={33028:-2147450700}, blastFlag=3, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4416, skip=0, SSLv3_client_data={268435458:0}, state=4416, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1146] COND FALSE !(s->state == 4099) [L1149] EXPR s->state VAL [={33028:-2147450700}, blastFlag=3, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4416, skip=0, SSLv3_client_data={268435458:0}, state=4416, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1149] COND FALSE !(s->state == 4368) [L1152] EXPR s->state VAL [={33028:-2147450700}, blastFlag=3, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4416, skip=0, SSLv3_client_data={268435458:0}, state=4416, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1152] COND FALSE !(s->state == 4369) [L1155] EXPR s->state VAL [={33028:-2147450700}, blastFlag=3, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4416, skip=0, SSLv3_client_data={268435458:0}, state=4416, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1155] COND FALSE !(s->state == 4384) [L1158] EXPR s->state VAL [={33028:-2147450700}, blastFlag=3, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4416, skip=0, SSLv3_client_data={268435458:0}, state=4416, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1158] COND FALSE !(s->state == 4385) [L1161] EXPR s->state VAL [={33028:-2147450700}, blastFlag=3, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4416, skip=0, SSLv3_client_data={268435458:0}, state=4416, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1161] COND FALSE !(s->state == 4400) [L1164] EXPR s->state VAL [={33028:-2147450700}, blastFlag=3, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4416, skip=0, SSLv3_client_data={268435458:0}, state=4416, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1164] COND FALSE !(s->state == 4401) [L1167] EXPR s->state VAL [={33028:-2147450700}, blastFlag=3, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4416, skip=0, SSLv3_client_data={268435458:0}, state=4416, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1167] COND TRUE s->state == 4416 [L1351] ret = __VERIFIER_nondet_int() [L1352] COND TRUE blastFlag == 3 [L1353] blastFlag = 4 VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, skip=0, SSLv3_client_data={268435458:0}, state=4416, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1] [L1357] COND FALSE !(ret <= 0) [L1362] s->state = 4432 [L1363] s->init_num = 0 [L1364] tmp___6 = __VERIFIER_nondet_int() [L1365] COND FALSE !(! tmp___6) VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, skip=0, SSLv3_client_data={268435458:0}, state=4416, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1605] EXPR s->s3 [L1605] EXPR (s->s3)->tmp.reuse_message VAL [={33028:-2147450700}, (s->s3)->tmp.reuse_message=4432, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->s3={268435457:-796}, skip=0, SSLv3_client_data={268435458:0}, state=4416, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1605] COND FALSE !(! (s->s3)->tmp.reuse_message) [L1634] skip = 0 VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, skip=0, SSLv3_client_data={268435458:0}, state=4416, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1131] COND TRUE 1 VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, skip=0, SSLv3_client_data={268435458:0}, state=4416, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1133] EXPR s->state [L1133] state = s->state [L1134] EXPR s->state VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4432, skip=0, SSLv3_client_data={268435458:0}, state=4432, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1134] COND FALSE !(s->state == 12292) [L1137] EXPR s->state VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4432, skip=0, SSLv3_client_data={268435458:0}, state=4432, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1137] COND FALSE !(s->state == 16384) [L1140] EXPR s->state VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4432, skip=0, SSLv3_client_data={268435458:0}, state=4432, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1140] COND FALSE !(s->state == 4096) [L1143] EXPR s->state VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4432, skip=0, SSLv3_client_data={268435458:0}, state=4432, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1143] COND FALSE !(s->state == 20480) [L1146] EXPR s->state VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4432, skip=0, SSLv3_client_data={268435458:0}, state=4432, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1146] COND FALSE !(s->state == 4099) [L1149] EXPR s->state VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4432, skip=0, SSLv3_client_data={268435458:0}, state=4432, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1149] COND FALSE !(s->state == 4368) [L1152] EXPR s->state VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4432, skip=0, SSLv3_client_data={268435458:0}, state=4432, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1152] COND FALSE !(s->state == 4369) [L1155] EXPR s->state VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4432, skip=0, SSLv3_client_data={268435458:0}, state=4432, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1155] COND FALSE !(s->state == 4384) [L1158] EXPR s->state VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4432, skip=0, SSLv3_client_data={268435458:0}, state=4432, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1158] COND FALSE !(s->state == 4385) [L1161] EXPR s->state VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4432, skip=0, SSLv3_client_data={268435458:0}, state=4432, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1161] COND FALSE !(s->state == 4400) [L1164] EXPR s->state VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4432, skip=0, SSLv3_client_data={268435458:0}, state=4432, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1164] COND FALSE !(s->state == 4401) [L1167] EXPR s->state VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4432, skip=0, SSLv3_client_data={268435458:0}, state=4432, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1167] COND FALSE !(s->state == 4416) [L1170] EXPR s->state VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4432, skip=0, SSLv3_client_data={268435458:0}, state=4432, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1170] COND FALSE !(s->state == 4417) [L1173] EXPR s->state VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4432, skip=0, SSLv3_client_data={268435458:0}, state=4432, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1173] COND TRUE s->state == 4432 [L1374] ret = __VERIFIER_nondet_int() [L1375] COND FALSE !(blastFlag == 5) VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, skip=0, SSLv3_client_data={268435458:0}, state=4432, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1380] COND FALSE !(ret <= 0) [L1385] s->state = 4448 [L1386] s->init_num = 0 VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, skip=0, SSLv3_client_data={268435458:0}, state=4432, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1605] EXPR s->s3 [L1605] EXPR (s->s3)->tmp.reuse_message VAL [={33028:-2147450700}, (s->s3)->tmp.reuse_message=4448, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->s3={268435457:-796}, skip=0, SSLv3_client_data={268435458:0}, state=4432, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1605] COND FALSE !(! (s->s3)->tmp.reuse_message) [L1634] skip = 0 VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, skip=0, SSLv3_client_data={268435458:0}, state=4432, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1131] COND TRUE 1 VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, skip=0, SSLv3_client_data={268435458:0}, state=4432, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1133] EXPR s->state [L1133] state = s->state [L1134] EXPR s->state VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4448, skip=0, SSLv3_client_data={268435458:0}, state=4448, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1134] COND FALSE !(s->state == 12292) [L1137] EXPR s->state VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4448, skip=0, SSLv3_client_data={268435458:0}, state=4448, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1137] COND FALSE !(s->state == 16384) [L1140] EXPR s->state VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4448, skip=0, SSLv3_client_data={268435458:0}, state=4448, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1140] COND FALSE !(s->state == 4096) [L1143] EXPR s->state VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4448, skip=0, SSLv3_client_data={268435458:0}, state=4448, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1143] COND FALSE !(s->state == 20480) [L1146] EXPR s->state VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4448, skip=0, SSLv3_client_data={268435458:0}, state=4448, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1146] COND FALSE !(s->state == 4099) [L1149] EXPR s->state VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4448, skip=0, SSLv3_client_data={268435458:0}, state=4448, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1149] COND FALSE !(s->state == 4368) [L1152] EXPR s->state VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4448, skip=0, SSLv3_client_data={268435458:0}, state=4448, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1152] COND FALSE !(s->state == 4369) [L1155] EXPR s->state VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4448, skip=0, SSLv3_client_data={268435458:0}, state=4448, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1155] COND FALSE !(s->state == 4384) [L1158] EXPR s->state VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4448, skip=0, SSLv3_client_data={268435458:0}, state=4448, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1158] COND FALSE !(s->state == 4385) [L1161] EXPR s->state VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4448, skip=0, SSLv3_client_data={268435458:0}, state=4448, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1161] COND FALSE !(s->state == 4400) [L1164] EXPR s->state VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4448, skip=0, SSLv3_client_data={268435458:0}, state=4448, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1164] COND FALSE !(s->state == 4401) [L1167] EXPR s->state VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4448, skip=0, SSLv3_client_data={268435458:0}, state=4448, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1167] COND FALSE !(s->state == 4416) [L1170] EXPR s->state VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4448, skip=0, SSLv3_client_data={268435458:0}, state=4448, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1170] COND FALSE !(s->state == 4417) [L1173] EXPR s->state VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4448, skip=0, SSLv3_client_data={268435458:0}, state=4448, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1173] COND FALSE !(s->state == 4432) [L1176] EXPR s->state VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4448, skip=0, SSLv3_client_data={268435458:0}, state=4448, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1176] COND FALSE !(s->state == 4433) [L1179] EXPR s->state VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=1073741824, s={268435457:0}, s={268435457:0}, s->state=4448, skip=0, SSLv3_client_data={268435458:0}, state=4448, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1179] COND TRUE s->state == 4448 [L1390] ret = __VERIFIER_nondet_int() [L1391] COND TRUE blastFlag == 4 VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=0, s={268435457:0}, s={268435457:0}, skip=0, SSLv3_client_data={268435458:0}, state=4448, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] [L1646] __VERIFIER_error() VAL [={33028:-2147450700}, blastFlag=4, buf={0:0}, init=1, ret=0, s={268435457:0}, s={268435457:0}, skip=0, SSLv3_client_data={268435458:0}, state=4448, tmp=0, tmp___0={268435457:204}, tmp___1=0, tmp___2=0, tmp___4=1, tmp___5=1, tmp___6=1] - StatisticsResult: Ultimate Automizer benchmark data CFG has 4 procedures, 142 locations, 1 error locations. UNSAFE Result, 227.5s OverallTime, 19 OverallIterations, 7 TraceHistogramMax, 120.6s AutomataDifference, 0.0s DeadEndRemovalTime, 0.0s HoareAnnotationTime, HoareTripleCheckerStatistics: 3606 SDtfs, 7990 SDslu, 8912 SDs, 0 SdLazy, 9152 SolverSat, 985 SolverUnsat, 4 SolverUnknown, 0 SolverNotchecked, 112.1s Time, PredicateUnifierStatistics: 0 DeclaredPredicates, 3064 GetRequests, 2906 SyntacticMatches, 3 SemanticMatches, 155 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 169 ImplicationChecksByTransitivity, 2.4s Time, 0.0s BasicInterpolantAutomatonTime, BiggestAbstraction: size=1681occurred in iteration=17, traceCheckStatistics: No data available, InterpolantConsolidationStatistics: No data available, PathInvariantsStatistics: No data available, 0/0 InterpolantCoveringCapability, TotalInterpolationStatistics: No data available, 0.0s AbstIntTime, 0 AbstIntIterations, 0 AbstIntStrong, NaN AbsIntWeakeningRatio, NaN AbsIntAvgWeakeningVarsNumRemoved, NaN AbsIntAvgWeakenedConjuncts, 0.0s DumpTime, AutomataMinimizationStatistics: 0.5s AutomataMinimizationTime, 18 MinimizatonAttempts, 6366 StatesRemovedByMinimization, 13 NontrivialMinimizations, HoareAnnotationStatistics: No data available, RefinementEngineStatistics: TraceCheckStatistics: 0.4s SsaConstructionTime, 73.1s SatisfiabilityAnalysisTime, 27.5s InterpolantComputationTime, 2168 NumberOfCodeBlocks, 2168 NumberOfCodeBlocksAsserted, 21 NumberOfCheckSat, 2971 ConstructedInterpolants, 12 QuantifiedInterpolants, 1801287 SizeOfPredicates, 94 NumberOfNonLiveVariables, 6489 ConjunctsInSsa, 122 ConjunctsInUnsatCore, 25 InterpolantComputations, 17 PerfectInterpolantSequences, 4092/4152 InterpolantCoveringCapability, InvariantSynthesisStatistics: No data available, InterpolantConsolidationStatistics: No data available, ReuseStatistics: No data available RESULT: Ultimate proved your program to be incorrect! Received shutdown request...